One membership, the whole obligation
We run the entire program 33 CFR Part 101 Subpart F creates — the build to an approved plan, then the permanent compliance year — for a fixed monthly price, with a portal your whole fleet runs on.
Six to eight weeks to submission-ready
- Week 0 — kickoff and evidence request
- Scope of work, portal onboarding, the document request list, introductions to your MSP and vendors.
- Weeks 1–2 — discovery
- Asset and network inventory, questionnaires, MSP interviews, and the site or vessel sampling visit.
- Weeks 3–4 — assessment
- Risk workshop, criticality calls against the TSI test, vulnerability scan, findings and roadmap. The SSI-marked assessment report lands in your portal.
- Weeks 5–6 — plan build
- The fourteen sections drafted from your assessment, the incident response plan, the CySO designation package. Control remediation starts on the gaps.
- Week 7 — operationalize
- Training rolled out with compliant records, your first drill facilitated and documented, the evidence vault populated.
- Week 8 — QA and file
- Quality review by Virtus Cybersecurity, your sign-off, and the plan staged submission-ready — or the waiver filed now, since that lane is open. Handoff to the membership calendar.
Then the calendar, forever
The rule is not a project. Roughly a third to a half of the original effort repeats every year by regulatory mandate — which is why this is sold as a membership, not an engagement that ends.
- A named CySO of record
- Designated in writing, reachable 24/7 as the rule requires, with an alternate behind them. §101.625 explicitly permits the outsourced model.
- The annual calendar, run for you
- Both drills and the annual exercise, facilitated and documented. The annual assessment refresh. Training anniversaries and the 5-day new-hire clock. KEV watch and patch attestation.
- The independent audit
- Delivered by Virtus Cybersecurity, our security partner, because §101.630(f) bars a CySO from auditing their own measures. Two-firm integrity is built into how we are structured, not an exception we request.
- Incident on-call
- The NRC call made or supervised by the on-call CySO, the parallel CISA notice where it applies, and the post-incident review that feeds amendments.
- Amendment management
- The 30-day, 60-day and 96-hour clocks tracked and filed — including the one that starts the day your CySO or ownership changes.
- The portal, throughout
- Every artifact lands in your portal as it is produced, mapped to its citation. Readiness, deadlines, tasks, records — one place, one export at inspection.
Fixed quotes, itemized in writing
We do not publish a rate card, because no two fleets price the same — boat count, what the boats push, whether a dock comes with them, and what your own people already cover all move the number. What we publish instead is how the quote works: fixed, produced after a thirty-minute scoping call, and itemized line by line — the assessment, the fourteen plan sections, training, drills, the audit — so you can see what the number is made of and challenge any line on it.
Included scope is written down with it: incident response beyond triage and the renewal-year penetration test bill separately, so neither of us plays the change-order game. For context on what doing nothing costs: the Coast Guard's own analysis puts an 8-vessel owner's early-years compliance cost near $299,000 done in-house.
You own your documents. Full export, any time, no questions.
Brown water, mid-size terminals — and honestly, not everyone
We build for towing companies and barge lines running roughly five to fifty vessels, and for the liquid and dry bulk terminals and inland ports below the tier the class societies chase. Blue-water fleets and LNG terminals have incumbents; single-boat operations usually belong on the waiver track, and we will say so.
The audit lane exists because the rule requires independence §101.630(f) — nobody marks their own homework here.