What the Coast Guard’s cybersecurity rule requires

The rule reaches owners and operators of U.S.-flagged vessels, facilities and OCS facilities required to hold a security plan under Parts 104, 105 or 106 §101.605(a). A facility operating under an approved Alternative Security Program is included §105.140.

If you hold a Facility Security Plan, the rule reaches your facility. Nothing in it exempts a facility because its systems are small, isolated or old no exemption, waiver or scaling provision appears in §§101.600 to 101.665.

The owner or operator designates a Cybersecurity Officer in writing, by name and by title, and the Plan must state how to reach that person at any time §101.620(b)(3). The officer must be accessible to the Coast Guard 24 hours a day, seven days a week.

The rule sets a knowledge bar across twelve areas §101.625(e) and assigns fifteen duties to the role §101.625(d). One person may hold the designation for more than one facility §101.625(b).

The officer does not have to be an employee. In its section-by-section analysis of §101.625 the Coast Guard states that the CySO “may be a full-time, collateral, or contracted position” 90 FR 6337, and in its response to comments that it is for owners and operators to manage cybersecurity risk “whether through in-house resources or through third-party services” 90 FR 6315. The Coast Guard’s published guidance says the same thing to the public today, in a FAQ answering the question directly.

If the officer changes, the Coast Guard must be notified and the Plan amended within 96 hours §101.630(e)(4).

The Assessment must be completed by 16 July 2027 and repeated annually, and sooner than annually on a change of ownership §101.650(e)(1). It analyses the facility’s networks and identifies the risk posed by each digital asset.

The Assessment comes before the Plan, because the Plan is written from what it finds.

The Plan covers fourteen required sections §101.630(c) and must be filed with the Coast Guard for review and approval by 16 July 2027 §101.655. It may sit inside your Facility Security Plan, be attached as an annex, be included as part of an approved Alternative Security Program, or be filed on its own §101.630(a).

Once approved, a Plan is valid for five years §101.630(d)(3).

When the Plan must be amended

• On a change of owner or operator, within 96 hours §101.630(e)(3)
• On a change of Cybersecurity Officer, within 96 hours §101.630(e)(4)
• When an audit finds the Plan needs it §101.630(f)(5)
• When the Coast Guard returns the Plan because it no longer meets the requirements — at least 60 days to submit amendments, with temporary measures in the meantime §101.630(e)(1)(ii)

The Plan and its implementation are audited annually, beginning no later than one year from the date the Plan is approved §101.630(f)(1). An audit is also required on a change of owner or operator, and when the cybersecurity measures are modified §101.630(f)(2).

Whoever performs it must have no regularly assigned cybersecurity duties at the facility being audited, and must be independent of the measures being audited §101.630(f)(4).

The Facility Security Plan audit has an exception: §105.415(b)(4) applies the independence requirement unless impracticable due to the size and nature of the company or the facility. §101.630(f)(4) carries no equivalent clause. The requirement it states is the requirement.

The rule splits responsibility from performance. The officer must ensure the audit happens §101.625(d)(3), and must ensure problems it finds are corrected §101.625(d)(7). But conducting it is closed to anyone with regularly assigned cybersecurity duties at the facility being audited §101.630(f)(4) — and a designated officer has those duties by definition. Arranging the audit is the officer’s job; conducting it at that facility is not.

The certification is the officer’s own. §101.630(f)(1) assigns it to the Cybersecurity Officer by name rather than to the owner or operator: the CySO must ensure the audit is performed, and the CySO must attach a report to the Plan certifying that the Plan meets the applicable requirements of this subpart §101.630(f)(1).

That last requirement is the one facilities find hardest. Whoever holds the officer role cannot audit that facility’s Plan. The test is on the person, not the organisation, so a colleague with no duties at that facility can.

Drills are held twice each calendar year §101.635(b)(1). A full exercise is held once each calendar year, with no more than 18 months between exercises §101.635(c)(1).

General cybersecurity training has been required since 12 January 2026 and repeats annually §101.650(d)(4). It covers everyone with access to the facility’s systems. Training on the Plan itself is due within 60 days of Plan approval.

The rule requires measures on the facility’s own systems: account security, device security and data security §101.650(a)–(c); supply chain management, resilience and network segmentation §101.650(f)–(h). Multifactor authentication is required on password-protected IT systems and on remotely accessible OT systems §101.650(a)(4).

Where a measure is not feasible, the rule accepts documented compensating controls §101.650(a)(2), §101.650(a)(4), §101.650(e)(3)(i).

These are decisions about your own equipment and budget. We tell you what the rule requires and when, and document what you have.

Reportable cyber incidents are reported to the owner or operator §101.625(d)(10), and to the National Response Center where 33 CFR 6.16-1 reporting does not already apply §101.620(b)(7). A Cyber Incident Response Plan must be developed, approved and exercised §101.620(b)(6), §101.625(d)(4).

Records of training, drills, exercises, cybersecurity threats, reportable cyber incidents and audits of the Cybersecurity Plan are created, maintained and made available to the Coast Guard on request §101.640, §105.225.

• 16 July 2025. The rule took effect. Reportable cyber incidents have had to be reported since that date.
• 12 January 2026. General cybersecurity training has been required since this date, and it repeats annually. Training on the Plan itself is due within 60 days of Plan approval. Coast Guard bulletin MSIB 04-26 says it may be deferred until Plan approval or 16 July 2027, whichever is earlier.
• 16 July 2027. The Cybersecurity Assessment must be done, and the Cybersecurity Plan must be submitted for approval.

As at 8 October 2026, section 101.655 still requires the Plan to be submitted no later than 16 July 2027. On 4 June 2026 the Coast Guard asked maritime entities to refrain from submitting full Cybersecurity Plans until further notice, while it receives waiver and equivalency requests. That notice is guidance. It does not amend the regulation, and it does not move the deadline. On 22 July 2026 the Coast Guard added that an entity granted a waiver in the past from the requirement to have a security plan under 33 CFR part 104, 105, or 106 is not automatically exempt from Subpart F. That entity still has to complete the Assessment and, after the Assessment, request a waiver from all or individual Subpart F requirements no later than 16 July 2027. Name the officer, finish the Assessment, and have the Plan ready to file when the Coast Guard says it will take them.

Failure to comply is subject to civil penalty under 46 U.S.C. 70119 §101.415(b).

The annual audit begins once the Plan is approved. The penetration test begins when that Plan is renewed §101.650(e)(2).

Does Subpart F apply to my facility?

It applies if you own or operate a U.S.-flagged vessel, a facility, or an OCS facility that must already keep a security plan under 33 CFR part 104, 105, or 106. That is section 101.605(a). It does not apply to a foreign-flagged vessel subject to 33 CFR part 104. That is section 101.605(b).

What are the Subpart F deadlines?

The rule took effect on 16 July 2025 (90 FR 6298). The Coast Guard's implementation timeline says reportable cyber incidents have had to be reported since that date. Where 33 CFR 6.16-1 does not already apply, that report goes to the National Response Center (section 101.620(b)(7)). Training under section 101.650(d)(1)(ii) through (v) and key-personnel training under section 101.650(d)(2) have been required since 12 January 2026, and they repeat every year. Training on the Plan itself, under section 101.650(d)(1)(i), is due within 60 days of Plan approval. Coast Guard bulletin MSIB 04-26 says it may be deferred until Plan approval or 16 July 2027, whichever is earlier. The Cybersecurity Assessment is due no later than 16 July 2027 under section 101.650(e)(1). The Cybersecurity Plan must be submitted for approval by that same day under section 101.655. On 4 June 2026 the Coast Guard asked maritime entities to refrain from submitting full Cybersecurity Plans until further notice, while it receives waiver and equivalency requests. That request does not change section 101.655.

Can the Cybersecurity Officer be a contractor?

Yes. In its section-by-section analysis of section 101.625, the Coast Guard said the CySO may be a full-time, collateral, or contracted position (90 FR 6337). The owner or operator still designates that person in writing, by name and by title, and must keep that person reachable by the Coast Guard at any hour (section 101.620(b)(3)). The owner or operator remains responsible for compliance with the subpart (section 101.620(a)).

Can one person be the FSO and the CySO?

Yes, if that person can still do the CySO's work. Section 101.625(a) says the CySO may hold other roles at the vessel, facility, or OCS facility. In the same Federal Register passage, the Coast Guard discusses assigning the CySO role to the existing security officer, and tells the owner or operator to weigh the new duties against the security duties that person already has (90 FR 6337). The designation is still in writing, by name and by title.

Can one CySO cover more than one facility?

Yes. Section 101.625(b) lets the same person be the CySO for more than one U.S.-flagged vessel, facility, or OCS facility. Each Plan has to name every vessel, facility, or OCS facility that person covers.

What does the CySO have to do?

Section 101.625(d) lists fifteen duties. They include making sure the Assessment is done, the Plan's measures are in place and working, the annual audit happens, the incident response plan is exercised, people are trained, reportable incidents are recorded and given to the owner or operator, and known exploited vulnerabilities on critical IT or OT systems are identified and mitigated without delay. The CySO may assign work to other people. The CySO still owns the result (section 101.625(c)). The CySO also needs general knowledge across the twelve areas in section 101.625(e), from facility operations to current threats.

Who is allowed to audit the Plan?

Not the CySO of the facility being audited. Section 101.630(f)(4) says the auditor must not have regularly assigned cybersecurity duties at that vessel, facility, or OCS facility, and must be independent of the measures being audited. The CySO still has to make sure the audit happens (section 101.625(d)(3)). A person may conduct it only if that person has no regularly assigned cybersecurity duties at that vessel, facility, or OCS facility, and is independent of the measures being audited.

For the published record of what Coast Guard cyber teams find on the water, see what Coast Guard cyber teams find on maritime networks. It covers Cyber Protection Team mission counts, cellular modems found on ship-to-shore cranes, and the Coast Guard's Maritime Cyber Alerts.