The CySO must develop, implement and verify a Cybersecurity Plan (inside, annexed to or separate from the security plan, or via an Alternative Security Program) with the 14 prescribed sections, protect it as Sensitive Security Information, and submit it to the COTP/OCMI (facilities) or Marine Safety Center (vessels) by 16 July 2027; approved plans are valid for 5 years; amendments go in 30 days before taking effect; a change of owner or CySO must be reflected within 96 hours; annual independent audits start within a year of approval, with amendments within 30 days of an audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.