US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements C-635: Drill twice and exercise once a year, keep cyber records, maintain communications, and show the plan and pen test results on request

What does C-635 require?

Cybersecurity drills at least twice each calendar year and an exercise each calendar year (no more than 18 months apart, with active CySO participation) testing the plan; records of training, drills, exercises, threats, reportable incidents and audits kept under the security recordkeeping rules; communication means to notify personnel of changing cyber conditions and to reach vessels, the COTP and authorities; and the cybersecurity portion of the plan and penetration test results available to the Coast Guard on request.