Records and the annual audit: evidence or it didn't happen
The rule's quiet enforcement mechanism is paper. Records must be kept at least two years and produced on demand — at a regular vessel or facility inspection, not a special cyber visit. Cyber items are now checked by the same inspectors, carrying a job aid, during the same inspections you already receive.
On top of the records sits the annual audit: once a year, someone independent of the measures being audited examines the plan and the evidence behind it. Gaps found in the audit trigger amendments within 30 days.
What must be producible
- The governance set
- The approved plan, current within its five-year cycle; each annual assessment report; the written CySO designation with 24/7 contact; audit reports with auditor-independence evidence; and any waiver filings.
- The operations set
- Training records with dates, duration, topics and attendees; drill and exercise records with corrective actions; the incident log with NRC report numbers; the asset inventory, network map and approved hardware/software list; MFA and account-lifecycle documentation; backup test records; vendor remote-access logs; and physical access logs for OT.
- Approvals with names and timestamps
- Sign-offs are retained with who and when. An approval nobody can attribute is not an approval an inspector will credit.
- Auditor independence — §101.630(f)
- The annual audit must be conducted by someone independent of the measures being audited. A CySO cannot audit their own program. A two-firm structure — one builds, one audits — satisfies this by architecture instead of by exception.
Design for the records request, not the binder
The test of a compliance program is a records request answered in minutes: everything for drills, for the last two years, with corrective actions — produced in one export, not reconstructed from inboxes.
That standard is almost impossible to hit with a file share and an inbox, and nearly automatic when every compliance activity writes its own evidence as it happens. It is the single strongest argument for running the program on purpose-built software.
Straight answers
- Who inspects cyber compliance — a special team?
- Your regular Coast Guard inspectors, during regular vessel and facility inspections, using a verification job aid. Cyber is now part of the same visit that checks everything else.
- Can our IT provider do the annual audit?
- Only if they are genuinely independent of the measures being audited. If the same firm built and runs your controls, they are auditing their own work — which is what §101.630(f) prohibits.
- What does an audit finding do to our plan?
- A gap found in the audit starts a 30-day amendment clock. The audit is not decorative — it is wired into the plan's maintenance cycle by design.