In-house, outsourced, or do it yourself? How to fill the Subpart F Cybersecurity Officer role

Every owner or operator of a U.S.-flagged vessel, facility or OCS facility that must hold a security plan under 33 CFR parts 104, 105 or 106 §101.605(a). The owner or operator must name the CySO in writing, by name and title, and that person must be reachable by the Coast Guard 24 hours a day, 7 days a week §101.620(b)(3). Section 101.625 then sets out what the role involves.

Yes to both. The same person may serve as CySO for more than one vessel, facility or OCS facility, as long as each one is listed in the Cybersecurity Plan of every facility that person covers §101.625(b). The Coast Guard also wrote that the CySO “may be a full-time, collateral, or contracted position” 90 FR 6337.

The rule lists fifteen duties for each facility the CySO covers §101.625(d). They include making sure the Cybersecurity Assessment is done, the Plan's measures are in place and working, an annual audit is run, the Cyber Incident Response Plan is exercised, staff are trained, records are kept, and known exploited vulnerabilities (KEVs) in critical IT or OT systems are found and fixed without delay. The CySO can hand tasks to others but keeps ultimate responsibility §101.625(c).

You recruit and employ someone who has general knowledge in the twelve areas the rule lists, from facility operations to cybersecurity audits and drills §101.625(e). You carry salary, benefits and training, and you need a backup, because the CySO has to be reachable around the clock. It fits a company with enough facilities and systems to keep a full-time cyber lead busy.

You contract the role. An outside officer is designated in your Plan, does the work under the rule, and can cover several of your facilities under §101.625(b). Breakwater works this way: $5,000 a month per vessel, facility or OCS facility, one flat rate with everything in the package included and a 24-month minimum term. The details are on the pricing page. The regulatory responsibility stays with the owner or operator either way.

The rule allows it. The CySO may hold other roles and duties, provided the person can still do everything the rule asks of a CySO §101.625(a). The question is time and knowledge: the fifteen duties come on top of the FSO's existing work, and the twelve knowledge areas include cybersecurity equipment, audit methods and KEVs. Two rules also apply. The annual audit must be done by people who have no regularly assigned cybersecurity duties for the facility and are independent of the measures being audited §101.630(f)(4), so an FSO who is also the CySO cannot audit that Plan, and the facility still needs a separate auditor every year. Breakwater's package covers this with an officer who holds no designation at the site. And one FSO may cover several facilities only if they are in the same COTP zone and no more than 50 miles apart §105.205(a)(2), while the CySO rule has no distance limit, as long as each site is listed in each Plan §101.625(b).

A facility that already has a qualified cyber lead on staff with the hours to hold the role. A company whose FSO already has the cyber background and the hours, and only wants a second opinion. And anyone looking for a one-time document: the rule's work recurs every year, and that is what our monthly rate covers.

Cybersecurity training has been required since 12 January 2026 and repeats every year §101.650(d). The Cybersecurity Assessment must be done by 16 July 2027 §101.650(e)(1), and the Plan must be submitted by the same date §101.655. On 4 June 2026 the Coast Guard asked operators to hold off on submitting full Plans until further notice while it works through waiver requests. That is guidance, not a rule change, and the 2027 date still stands.