Waivers and equivalencies: real relief, with real rules
The rule contains an honest escape valve. If a specific requirement is unnecessary given the nature of your operation — no OT, no remotely accessible systems — you may request a waiver. If an alternative measure achieves the same protection, you may request an equivalency.
For genuinely low-tech operators — a real slice of the inland fleet — a professionally engineered waiver package is legitimate compliance, and the Coast Guard itself pointed inland operators toward this path at the Inland Marine Expo in June 2026.
Waiver and equivalency requests are also the only submission lane that is open right now: they go to Commandant (CG-5P) via DoD SAFE and are being accepted and processed today, while full plan submissions are held.
The five ground rules
- The assessment comes first, always
- A request without a completed Cybersecurity Assessment attached is returned — even from an operator claiming to have no computers at all.
- Relief is per-requirement, not blanket
- "Exempt us from everything" gets sent back. The realistic outcome is relief from most technical measures while reporting, basic training, and records duties survive.
- Cost and convenience are invalid grounds
- The case must be technical, architectural, or operational. "It's expensive" is explicitly rejected.
- Same deadline
- Requests are due by July 16, 2027, like everything else.
- Filing does not suspend the obligations
- Until relief is granted, the underlying requirements stand. Every waiver applicant needs a contingency posture, not a shrug.
Sold honestly, this is the trust product
The right first step for a small operator is an eligibility screen, not a filing: which requirements you could realistically get relief from, with a confidence rating and the citations, before any money goes into a request. If the honest answer is that you need the full program, the screen should say so.
The Coast Guard has published no grant-rate data yet. Anyone selling waiver approval as a guarantee is selling something the record cannot support. Eligibility opinions are professional judgment with confidence levels — nothing more, and nothing less.
Straight answers
- We already hold an MTSA waiver. Are we exempt from the cyber rule?
- No. The Coast Guard confirmed in July 2026 that pre-existing MTSA waiver holders must still complete a Cybersecurity Assessment and, if warranted, request a Subpart F waiver by July 16, 2027.
- Our boats have no computers. Surely nothing applies?
- The assessment still applies — that is how you prove the claim. What a genuinely low-tech operation can realistically shed is most of the technical measures. Incident reporting, basic training and records duties survive almost any waiver.
- What does a waiver request actually contain?
- The completed assessment; documented evidence of the operating environment — asset census, connectivity proof; the request itself with specific citations and technical justification, including impact analysis; and supporting exhibits. It is filed to CG-5P through DoD SAFE, per work instruction MCP-WI-002.