33 CFR 101.650(e) creates two different cybersecurity testing clocks for covered maritime owners and operators. The Cybersecurity Assessment is due by July 16, 2027, then annually. A penetration test is required in conjunction with Cybersecurity Plan renewal. An operator that purchases an annual pentest solely because the assessment is annual has merged separate requirements; one that treats its annual assessment as the renewal test may miss the required letter and security-assessment handoff.
Quick answer. A covered owner or operator must conduct the first Cybersecurity Assessment by July 16, 2027, and annually thereafter under 33 CFR 101.650(e)(1). Under paragraph (e)(2), it must ensure a penetration test is completed in conjunction with Cybersecurity Plan renewal, then include a letter certifying the test and all identified vulnerabilities in the relevant VSA, FSA or OCS FSA. The approved plan's five-year validity runs from its actual approval date under 33 CFR 101.630(d)(3), so there is no single first renewal-test date for every operator. Stingrai can scope a human-led network, cloud and application test to authorized maritime IT paths, with OT boundaries and operations safety set in the rules of engagement.
This is a buying guide for a US-flagged vessel owner, marine facility operator or offshore facility operator preparing its first plan and future testing program. It explains which task is due when, what evidence the rule asks for, and how to obtain a useful test without assuming every ship or terminal can tolerate the same intrusive methods. The regulations and a facility's approved security plan control the final scope.
Check whether Subpart F covers the operation
33 CFR 101.605 applies Subpart F to owners and operators of US-flagged vessels, facilities and outer continental shelf facilities required to have security plans under Parts 104, 105 and 106. It excludes foreign-flagged vessels covered under Part 104. Before asking vendors for a fleet-wide quote, identify which legal entity owns each covered asset, which security-plan category applies and which Coast Guard approval authority handles its plan.
That applicability question matters for a mixed fleet. A company might operate covered US-flagged vessels, foreign-flagged vessels and shore facilities under different arrangements. A single purchase order can cover multiple systems, but the regulatory mapping should still show each asset's status. Do not tell every maritime business that the July 2027 Cybersecurity Assessment date applies to it without checking the scope provision.
The Cybersecurity Plan rule allows an owner or operator to submit one plan for two or more similar vessels or facilities, provided the plan addresses the specific cybersecurity risks of each. In procurement terms, a common testing framework is sensible, but each vessel, terminal or offshore site still needs an explicit risk and evidence row. The shared plan does not turn distinct networks, vendors and operating conditions into a single generic test target.
Three activities that need separate calendar entries
The rule has an annual Cybersecurity Assessment, an annual audit of the approved Cybersecurity Plan, and a penetration test at plan renewal. The annual activities are not identical, and the renewal-linked test is not annual by default. A buyer should put three deliverables on the calendar instead of asking for one report to cover everything.
Activity | Source trigger | Who owns the work | Required output to plan for |
|---|---|---|---|
Cybersecurity Assessment | First by July 16, 2027, annually thereafter; sooner after change in ownership | Owner or operator through its Cybersecurity Officer and authorized team | Assessment of networks, critical IT and OT risks, plan validation, recommendations and resolutions |
Cybersecurity Plan audit | Annually, beginning no later than one year after initial plan approval | Cybersecurity Officer | Audit of the plan and its implementation |
Penetration test | In conjunction with Cybersecurity Plan renewal | Owner, operator or designated Cybersecurity Officer | Test, letter certifying completion and all identified vulnerabilities in the VSA, FSA or OCS FSA |
Figure 1: The annual assessment, annual plan audit and renewal-linked test have different triggers. Sources: 33 CFR 101.650(e) and 33 CFR 101.630.
The Cybersecurity Assessment is annual
Section 101.650(e)(1) says the Cybersecurity Assessment must be conducted no later than July 16, 2027, and annually thereafter. It must be performed sooner than annually after a change in ownership. The assessment analyzes all networks for vulnerabilities to critical IT and OT systems and the risk posed by each digital asset. It validates the Cybersecurity Plan and documents recommendations and resolutions. The provision also calls for action on known exploited vulnerabilities through patching or compensating controls without delay and plan amendment as needed.
Those are assessment tasks. They may use inventory review, configuration evidence, interviews, vulnerability data and limited technical validation. The rule does not say that every annual assessment must be a full penetration test. If a vendor sells an annual pentest, ask it to show exactly which assessment clauses its deliverable covers, and which tasks remain with the operator and Cybersecurity Officer. A network report that never assesses the approved plan or records resolutions cannot carry the entire assessment merely by title.
The assessment should be an operating process, not a one-day snapshot. The owner knows when vessel software changes, remote maintenance is enabled, a new terminal system joins a network or a third-party connection shifts. The procurement brief can ask a vendor to supply evidence at points in the year while the operator retains the assessment obligation and records the conclusion. This is a suggested delivery model, not a schedule added to the regulation.
The plan audit starts after approval
Section 101.630(f)(1) requires an annual audit of the Cybersecurity Plan and its implementation, beginning no later than one year after initial approval. This is a separate plan-governance activity. A technical tester can provide artifacts for it, such as a segmentation finding or a record of a remote access control. The Cybersecurity Officer still needs to evaluate whether the plan was followed, updated and effective.
The starting point matters. The plan-submission deadline is July 16, 2027, under section 101.655. Submission is not the same event as approval. Track the actual date on the approval letter before calculating the first plan-audit deadline or the five-year validity period.
The pentest follows plan renewal
Section 101.650(e)(2) says that, in conjunction with Cybersecurity Plan renewal, the owner, operator or designated Cybersecurity Officer must ensure a penetration test has been completed. Afterward, a letter certifying the test was conducted and all identified vulnerabilities must be included in the vessel security assessment, facility security assessment or outer continental shelf facility security assessment, as applicable.
The plan rule makes an approved plan valid for five years from approval. The test is therefore a renewal planning milestone, not a blanket July 2027 pentest deadline and not an annual pentest mandate. An operator may buy additional testing based on risk, insurer requirements or a contract, but those are different reasons. Do not label the extra work as a Coast Guard cadence.
Turn the renewal test into a scoped purchase
The Coast Guard tells the operator when a penetration test is needed and where its letter and vulnerabilities go. The quoted paragraph does not prescribe one commercial method, a fixed number of test days or an external-firm requirement. The buyer must make those choices against the network inventory, critical operations and the approved plan. A good statement of work names assets, methods, safety limits, evidence and the decision owner for vulnerabilities.
Start with the asset boundary. List each covered vessel or facility, its shore-side dependencies, critical IT and OT systems, third-party remote connections, cloud control planes, web applications and APIs. Mark shared infrastructure used by multiple assets. A vendor cannot price the work accurately from "one port" or "one vessel" alone when communications, identity and maintenance paths differ. The plan's asset-specific risk requirement supports an asset-by-asset scope even under a shared plan.
Next, define permitted validation. The rule specifically addresses third-party remote connections and IT/OT segmentation elsewhere in section 101.650. Those paths are sensible proposed test scenarios: whether remote maintenance is authorized and monitored, whether an IT compromise can reach a protected OT segment, and whether accounts or APIs allow unintended access to operational data. They are editorial scope suggestions. The cited paragraph does not require a particular exploit or authorize interruption of safety-critical systems.
For OT, a safe plan may use architecture review, configuration examination, passive observation, staged or representative systems, and carefully approved validation of segmentation. Active probing of a controller or live vessel network should never be inferred from a generic web-testing SOW. Identify the operational owner who can approve each method, the window in which it can occur, abort conditions and the chain of communication between tester, Cybersecurity Officer and watch staff. Safety limits belong in signed rules of engagement before credentials or access are issued.
Put evidence destinations in the contract
The required post-test handoff is unusually specific. The buyer needs a letter certifying that testing occurred and a record of all identified vulnerabilities for the VSA, FSA or OCS FSA. Do not order only a summary slide deck that omits lower-severity findings. Ask the bidder to map each finding to an asset, affected boundary, evidence, operational effect, remediation owner and verification status. Those fields are proposed report design, while the letter and inclusion of all vulnerabilities come from section 101.650(e)(2).
The Cybersecurity Plan is sensitive security information protected under 49 CFR Part 1520. A procurement packet should state who may read the plan, network diagrams and test evidence, where those materials may be stored, and what redaction a working copy needs. Access to a plan should not be assumed merely because a vendor is bidding. Include subcontractors and report reviewers in the access decision.
Figure 2: Suggested evidence path for the rule's mandatory letter and vulnerability inclusion. Sources: 33 CFR 101.650(e)(2) and 33 CFR 101.630(b).
Require a coverage and exclusion table
Use a table that both the operator and bidders can sign. It should show the covered asset, technical surface, objective, allowed method, test window, expected evidence and exclusions. For a vessel, an authentication system might be testable in a controlled shore replica while a navigation or propulsion controller is excluded from active probing. For a facility, an external portal may permit a conventional web and API test while a terminal control network needs a passive or staged approach. The buyer should record how excluded areas are assessed through other evidence.
Ask the tester how it will confirm identities and reachability without disrupting operations, how it will distinguish a verified weakness from a scanner alert, and how it will handle a vulnerability that cannot be retested on the live asset. An honest report can state a limitation and the evidence available. It should not claim an excluded OT system was tested through a test of a neighboring office network.
The network testing service illustrates perimeter, internal path and segmentation testing; the web application service covers role and API authorization; the cloud testing service covers identity and workload control planes. The operator should buy only the portions authorized for its covered asset. A maritime engagement may combine these surfaces in one SOW with different methods and restrictions.
Build a calendar from the approval date
The calendar should contain source-defined events and procurement lead time. First, map covered assets against section 101.605. Then schedule the first Cybersecurity Assessment by July 16, 2027, and the plan submission by the same date. Record the actual approval date when issued. Use it to calculate the annual plan-audit starting point and the plan's five-year validity. Put a procurement and remediation buffer ahead of the renewal milestone so the test can be completed and the letter and vulnerabilities inserted into the appropriate assessment.
Calendar entry | Date rule | Buying implication |
|---|---|---|
First Cybersecurity Assessment | No later than July 16, 2027 | Scope all networks and critical IT and OT risks, plan validation and resolutions |
Cybersecurity Plan submission | No later than July 16, 2027 | Assemble plan and submit for Coast Guard review |
Recurring Cybersecurity Assessment | Annually after the first; sooner after ownership change | Reserve assessment and evidence-collection capacity |
Plan audit | Annually, starting no later than one year after initial approval | Set audit owner and supporting technical evidence |
Plan renewal and penetration test | Against actual plan approval and renewal timeline | Book a safe test, remediation, letter and VSA/FSA/OCS FSA update |
No row in that table says every covered operator's first penetration test must occur in 2032. Five years run from each plan's actual approval date, and the rule connects testing to renewal. A hypothetical approval on a particular date can illustrate internal planning, but the operator must calculate its real deadline from its own approved plan.
An ownership change can bring the Cybersecurity Assessment forward under section 101.650(e)(1). Keep that event trigger in the acquisition checklist. The clause does not state that every ownership change is itself a new pentest trigger; assess the new network and plan position before deciding whether additional testing is prudent.
Compare proposals without collapsing the clocks
Ask bidders for distinct prices and deliverables for three possible work packages: support for the annual Cybersecurity Assessment, technical evidence for the annual plan audit, and the renewal-linked penetration test. The operator can award these together or separately, but the contract should keep their acceptance criteria distinct. A vendor offering all three in one line should explain which regulatory clauses each artifact supports.
For the penetration test, normalize quotes using asset count, vessel or facility classes, network segments, user roles, third-party connections, cloud accounts, travel and access arrangements, operational windows, report format and retest terms. A cheap per-vessel price may omit the shared shore identity system that connects the fleet. A high quote might include staging and safety review that a lower quote leaves to the operator. Compare like scopes, not only totals.
The penetration testing SOW guide offers a structure for targets, rules, deliverables and exclusions. For a maritime order, add the plan renewal date, operational authority and the exact security assessment that will receive the letter and vulnerabilities. The cost calculator can help organize surface counts; the final price for a maritime network or OT-adjacent program needs a custom quote with access and safety limits.
Ask these questions in the RFP:
Which covered vessel or facility is each proposed test day attached to, and what shared shore system is included?
What critical IT or OT boundary will be validated, and through which permitted method?
How will third-party remote connections and segmentation be addressed without disrupting operations?
Who has authority to pause or stop the test, and how are watch or plant staff informed?
Will the report list every identified vulnerability, including those accepted or pending remediation?
Who prepares the certifying letter and maps findings into the VSA, FSA or OCS FSA?
How are sensitive plans, diagrams, credentials and evidence stored and removed after handoff?
What retest is included when a fix can be validated safely, and how are untestable fixes recorded?
The questions are buyer criteria, not a claim that the Coast Guard prescribed each line. Their purpose is to make the required outcome safe and reviewable.
Where Stingrai fits
Stingrai is a CREST-accredited penetration testing service provider headquartered in Toronto, with a London office. Two named testers staff each human-led engagement, from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications. Its human-led service covers external and internal network paths, segmentation, web and API roles, and cloud identity and workloads. Confirmed findings appear in the PTaaS portal during testing, and retesting of remediated findings is included. Human-led and hybrid reports include an attestation letter.
For a covered maritime operator, the first scoping step is identifying each approved asset and the parts of its IT environment a tester may touch. Stingrai can deliver a one-time engagement or a continuous program for approved network, cloud and application surfaces. An OT-adjacent scope requires explicit operational limits and an agreed way to report findings without unsafe active testing. The operator should confirm the test letter states the work was conducted and carry all identified vulnerabilities into the applicable VSA, FSA or OCS FSA. Snipe, Stingrai's autonomous agent, is for one web application and associated APIs only, either alone or alongside human testers in a Hybrid engagement. It is not a vessel network or industrial controller test.
Frequently Asked Questions
Does the Coast Guard maritime cyber rule require an annual penetration test?
No. The Cybersecurity Assessment is annual under 33 CFR 101.650(e)(1). Paragraph (e)(2) links a penetration test to Cybersecurity Plan renewal. Additional tests may be sensible or contractually required, but the cited rule does not set a universal annual pentest clock.
When is the first Cybersecurity Assessment due?
For a covered owner or operator, 33 CFR 101.650(e)(1) requires the first Cybersecurity Assessment no later than July 16, 2027, then annually. A change in ownership requires an assessment sooner than the normal annual interval.
When is the first maritime penetration test due?
Section 101.650(e)(2) requires a completed penetration test in conjunction with Cybersecurity Plan renewal. An approved plan is valid for five years from its actual approval date, so the regulation does not give every operator one shared first test date.
Is the annual plan audit the same as the Cybersecurity Assessment?
No. Section 101.630(f)(1) requires an annual audit of the plan and its implementation after approval. Section 101.650(e)(1) separately requires the annual Cybersecurity Assessment, with its network, IT and OT risk analysis and plan validation.
Which maritime operators are covered?
Subpart F applies to owners and operators of US-flagged vessels, facilities and outer continental shelf facilities required to have security plans under 33 CFR Parts 104 to 106. Section 101.605 excludes foreign-flagged vessels covered under Part 104.
What must be delivered after the penetration test?
Under section 101.650(e)(2), a letter certifying the test was conducted and all identified vulnerabilities must be included in the applicable vessel, facility or outer continental shelf facility security assessment.
Can one Cybersecurity Plan cover several vessels or facilities?
Yes, where the assets have similar operations, but section 101.630(d)(2) requires the plan to address each asset's specific cybersecurity risks. A shared testing order should still show asset-specific scope, evidence and exclusions.
Does the rule require intrusive testing of live OT controllers?
The cited penetration-test paragraph does not prescribe an intrusive OT method. The operator should agree on safe scope, operational authority, permitted validation and exclusions before testing, while the annual Cybersecurity Assessment still analyzes critical IT and OT risks.
Related reading
References
Talk to Stingrai
Define the covered assets, approved IT and OT boundaries, renewal milestone and required evidence with Stingrai. Get a Quote or book a free discovery call.
