Subchapter M got you audited. The cyber rule runs on a different clock
If you run towing vessels, you have spent years building a Subchapter M program: a TSMS, a third-party organization, audit cycles, corrective actions, records that survive scrutiny. That discipline is a genuine asset for the cyber rule — and it is also the source of the most expensive assumption in the industry right now: that the machinery you built for Sub M has this covered.
It does not. Subchapter M lives in 46 CFR and says nothing about cybersecurity. The cyber rule lives in 33 CFR Part 101 Subpart F, arrives through your Vessel Security Plan rather than your COI, and brings its own plan, its own officer, its own audit and its own evidence standard.
The good news: a company that can pass a TSMS audit already has the muscle the cyber rule demands. The work is real, but the habits transfer.
What transfers, and what does not
- Transfers: the management-system habit
- The cyber rule is a management system wearing a security badge — a plan that says what you do, records that prove you did it, an annual audit that checks, amendment clocks when things change. If your company runs a real TSMS, this shape is familiar. Operators without that habit are starting further back than they think.
- Transfers: fleet-level documentation
- One Cybersecurity Plan may cover a fleet of similar vessels, the same economy Sub M taught you with fleet TSMS documentation. A ten-boat company writes one plan with per-vessel variance noted where systems genuinely differ.
- Transfers: the records reflex
- Cyber records must be kept at least two years and produced on demand at the same inspections you already receive — inspectors now carry a cybersecurity job aid alongside everything else they check. Companies that treat records as evidence rather than paperwork will recognize the standard.
- Does not transfer: your auditor
- The annual cyber audit under §101.630(f) must be performed by someone independent of the measures being audited — and it is a different audit, of a different plan, under a different title of federal law, than anything your third-party organization performs for Sub M. Nobody in your current audit chain is checking this unless you have separately arranged it.
- Does not transfer: the drill calendar
- The cyber rule requires two drills and one exercise per calendar year of its own, with documented corrective actions. The rule allows combining them with existing MTSA security drills where the cyber measures are genuinely exercised — but a fire drill is not a phishing drill, and the records must show the cyber content.
- Does not transfer: the plan itself
- However your TSMS manual is organized, the Coast Guard requires a fourteen-section Cybersecurity Plan under §101.630, submitted for approval and marked as Sensitive Security Information. Cyber paragraphs inside a TSMS manual do not satisfy the submission.
The two-clock problem, managed
Sub M taught the industry to think in audit cycles. The cyber rule adds a second permanent calendar: the annual assessment refresh, the annual independent audit, two drills, an exercise, training anniversaries, the five-day new-hire clock, and amendment windows measured in days. Companies that merge both calendars into one compliance rhythm carry the load; companies that treat cyber as a project to finish do not.
The auditor-independence requirement also settles a structural question: whoever builds and runs your cyber program cannot audit it. A two-firm structure — one builds, one audits — satisfies the rule by design, which is exactly how the Sub M world already separates TSMS support from third-party audit.
Straight answers
- Will our TVIB-certified auditor check cyber compliance?
- Not under your Sub M audit. The cyber audit is a separate annual requirement under §101.630(f) with its own independence standard. Some Sub M audit firms are adding cyber capability; the audit itself remains a distinct event with distinct records either way.
- Can we fold the cyber program into our TSMS manual?
- Internally, organize however your crews will actually use. Externally, the Coast Guard requires the fourteen-section Cybersecurity Plan as its own SSI-marked document, submitted for approval. Write the plan to the rule; reference it from the TSMS if that helps your people.
- Do our existing security drills count toward the cyber requirement?
- They can be combined with the cyber drills where the cyber measures are genuinely exercised, and the records show it. Two drills and one exercise per year must still be evidenced on the cyber side, with corrective actions documented.
- When does the cyber clock actually start for us?
- It already has. Incident reporting to the National Response Center has been in force since July 16, 2025, and the training deadline for everyone with system access passed on January 12, 2026. The July 16, 2027 date is when the plan, the officer designation and the assessment come due — not when the rule begins.