Training: the deadline that already passed
Cybersecurity training for all personnel with IT or OT access — including contractors — was due January 12, 2026, and repeats annually. If your crews have not been trained and the records do not exist, you are out of compliance today, before the 2027 deadline enters the picture.
The rule is specific about who and when: everyone annually; new hires within five days of being granted system access; deeper training for designated key personnel; OT-specific training for people who touch operational technology; and plan-provision training within 60 days of plan approval.
Coast Guard inspectors verify training against a job aid. They look for dates, duration, a topic outline mapped to the rule, and full attendee lists. A gap draws a deficiency finding on a form your insurers will eventually ask about.
What compliant training looks like
- All hands, annually
- Threat recognition, reporting procedures, and the plan provisions relevant to each person's role. Contractors with system access are in scope.
- The five-day clock
- A new deckhand who gets a login must complete training within five days of system access. This is the requirement small operators miss most, because it turns training from an annual event into a standing process.
- Key personnel and OT users
- Designated key personnel get deeper training; anyone operating OT gets OT-specific content.
- Third-party content is fine — if evaluated
- You may use purchased training, but the rule requires you to evaluate it against the requirements and document that evaluation.
- Records that survive inspection
- Date, duration, topics mapped to §101.650(d), attendees, and key-personnel designations — retained at least two years and producible on demand.
This is the door most operators walk through
Training is the cheapest requirement to satisfy and the one already being checked. Getting crews trained and records in order costs days, not months, and it takes the sting out of the first inspection while the plan is still being built.
It is also the honest first conversation with a compliance partner: if the proposal starts anywhere other than the obligation you are already missing, ask why.
Straight answers
- The training deadline passed. What do we do now?
- Train now and document now. An operator who can show completed training with compliant records is in a categorically better position at inspection than one still deciding. The Coast Guard's posture favors entities that actively engage.
- Does a phishing email count as training?
- Phishing simulations can be part of a program, but the rule requires content covering threat recognition, reporting, and plan provisions, with records showing topics and duration. A simulation alone does not evidence that.
- Do office staff need training, or just crews?
- Everyone with access to IT or OT systems, ashore or afloat, including contractors. The dispatcher with the TMS login is in scope just as much as the wheelhouse.