X3 Port Security,Field by Field.
Security plans, quarterly drills, annual exercises, audits and MARSEC levels for 33 CFR 104-106.
- 46 CFR 136-144Subchapter M towing vessels
- 46 CFR 199.180Monthly drills
- 46 CFR 10.301Medical certificates
- 46 CFR 16.230Random testing — 50%
- 29 CFR 1915.12Confined & enclosed spaces
- 29 CFR 1917.50Crane certification
- 33 CFR 105.220Security drills every 3 months
- 33 CFR 155.1060Spill response exercises
- 46 CFR 4.05-10CG-2692 within 5 days
- 46 CFR 4.06-32-hour / 32-hour test clocks
Every record X3 Port Security keeps, the rule behind it, how often it comes due, and exactly what to type in each field — with where to find it on your own paperwork.
Security Plans
33 CFR 105.410 / 105.415 · Audit yearly; renew every 5 years
Your Coast Guard-approved Facility or Vessel Security Plan and its required yearly audit. Plans are approved for 5 years.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Plan | The type of security plan. | Cover page of the plan or the Coast Guard approval letter. | Facility Security Plan (33 CFR 105) |
| Plan approved | The date the Coast Guard approved the plan. | Plan approval letter from the COTP (facilities) or Marine Safety Center (vessels). | 06/30/2025 |
| Last annual audit | Date of the last annual audit. The auditor must not have security duties being audited. | Signed audit report. | 06/15/2027 |
| Audit found amendments needed | Yes if the audit found the plan needs changes. | Audit report findings. | No |
| Audit amendments submitted | The date you sent the audit-driven amendments to the Coast Guard (within 30 days). | Your submission letter or email. | 07/10/2027 |
| Security assessment last reviewed | The date the Facility/Vessel Security Assessment was last reviewed. | Assessment report or the plan's record of review. | 06/30/2025 |
Drills
33 CFR 105.220(b) / 104.230(b) · At least every 3 months
Security drills testing your plan. Drills are required at least every 3 months, and unlogged drills are a top deficiency.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Drill held | The date of the drill. | Drill record. | 06/30/2027 |
| Scenario (general terms) | What the drill tested, in general terms (it's sensitive information). | Drill record. | Unauthorized person at gate 2 |
| Participants | Who took part. | Sign-in sheet. | FSO, 2 guards, gate staff |
| Lessons learned | What went wrong or could be better. | Drill debrief notes. | Radio dead spot near warehouse B |
| Vessel reactivated after repairs / seasonal lay-up | For vessels: the date the boat came back after being out of service over 1 month. | Logbook. A drill is then due within 1 week. | 05/01/2027 |
| More than 25% of crew have not drilled on this vessel | Yes if more than 25% of the crew haven't done a drill on this vessel in the last 3 months. | Crew list and drill records. A drill is then due within 1 week. | No |
Exercises
33 CFR 105.220(c) · Each calendar year (max 18 months apart)
Security exercises, which are larger than drills. Required at least once each calendar year, with no more than 18 months between them.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Exercise held | The date of the exercise. | Exercise report. | 10/15/2027 |
| Type | The type of exercise. | Exercise report. Port-wide exercises run by the Area Maritime Security Committee can count. | Tabletop |
| Participants | Who took part. | Sign-in sheet or exercise report. | FSO, guards, Sector rep, local police |
| Lessons learned | What was learned. | Exercise after-action report. | Update call list |
Declarations of Security
33 CFR 105.245 / 105.225(b)(7) · Each time one is signed
Declarations of Security agreed with visiting vessels. They're required in some cases and set who does which security tasks.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Vessel | The vessel the DoS was signed with. | The signed Declaration of Security. | MV Ocean Star |
| Type | Single visit or Continuing (covers repeat visits). | The DoS form. | Single visit |
| Why a DoS | Why a DoS was needed. | Situation at the time. Pick 'Requested by the vessel' if they asked. | Requested by the vessel |
| Signed | The date the DoS was signed. | Signature date on the form. | 06/30/2027 |
| Effective from | When the DoS takes effect. | The DoS form. | 06/30/2027 |
| Effective to | When it ends. | The DoS form. | 07/02/2027 |
| MARSEC level | The MARSEC level when signed. | The current level as set by the Coast Guard. | 1 |
Incidents & Breaches
33 CFR 101.305 / 105.225(b)(3) · Each time it happens
Security breaches, suspicious activity and other incidents. Most must be reported right away to the National Response Center or the Coast Guard.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Date & time | When the incident happened. | Guard's report or log. | 06/30/2027 02:15 |
| Type | The type of incident. | Pick the closest match. | Suspicious activity |
| Where in the facility | Where it happened. | Guard's report. | Fence line by north gate |
| Reported to | Who you reported it to. Suspicious activity and breaches go to the NRC (1-800-424-8802). | A transportation security incident goes to the COTP first. | National Response Center |
| Response taken | What was done. | Guard's or FSO's report. | Police called, area searched |
| NRC report number | The report number the NRC gave you. | Given on the phone at the end of the NRC call. | 1234567 |
| Status | Open or Closed. | Close it when follow-up is done. | Closed |
Security Training
33 CFR 105.210 / 105.225(b)(1) · Per your security plan
Security training records. Records must show date, length, what was covered and who attended.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Group | The person's security role. | Your security plan lists who has security duties. | Personnel with security duties |
| Session date | The date of the training. | Sign-in sheet. | 06/30/2027 |
| Duration (minutes) | How long the training lasted, in minutes. | Agenda or sign-in sheet. | 60 |
| Description | What the training covered. | Agenda. | Access control, TWIC checks, reporting |
| Refresh every (days, your plan) | Days between refreshers, as set by your plan. | Your security plan. | 365 |
Cyber Training
33 CFR 101.650(d) · Within 5 days of access (30 days of hire at the latest), then every year
Every person with access to your computers or control systems — employees and contractors — needs cyber training. Coast Guard inspectors check this roster.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Key personnel (cyber duties under the plan) | Yes if they have cyber duties in your plan — they need extra topics. | Your cybersecurity plan's roles section. | Yes |
| Hired or contract started | The day they were hired or their contract started. | Personnel file or the contractor's start date. | 03/02/2026 |
| IT/OT system access granted | The day they first got an account or access to an IT or OT system. | Your IT ticket, account-creation email or badge record. | 03/03/2026 |
| Cyber training completed | The day they finished cyber training. | Course certificate or your sign-in sheet. | 03/05/2026 |
| Topics covered (recognizing threats, reporting, passwords/MFA, removable media, OT safety) | What the session covered. | The course outline or agenda. | Threats, reporting to the CySO, OT safety |
Cybersecurity Officer
33 CFR 101.625 / 101.630 · Once, then each time the CySO changes
The person (or outside service) responsible for your cybersecurity plan. Must be named by Jul 16, 2027; a change must reach the COTP within 96 hours.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Qualification basis (training, experience, certifications) | Why this person is qualified. | Their training certificates and experience. | CISSP; 6 years OT security |
| Designated in writing | The date the company named the CySO in writing. | The signed designation letter. | 01/15/2027 |
| CySO last changed | When the CySO last changed. | The new designation letter. | 05/01/2027 |
| Coast Guard notified / plan amended after the change | When you told the Captain of the Port and amended the plan. | Your email or letter to the COTP. | 05/03/2027 |
Cyber Systems & Assessment
33 CFR 101.650(e) / CG-5P PL 01-26 · Keep current; assess every year
Every computer, network and control system, marked internal, external or interface. Anything whose loss could cause a transportation security incident is critical. This list drives your cybersecurity assessment.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| System (e.g. gate badge PC, tank level sensors, cargo release) | One system per line. | Your IT inventory, network diagram or vendor list. | Gate badge PC |
| Could losing it cause a transportation security incident? | Could losing this system cause a security incident? Yes or Maybe makes it critical. | Ask: what happens to cargo, access or safety if it goes down? | Maybe |
| Last patched or updated | When it was last updated. | Windows/firmware update history or vendor service report. | 09/30/2026 |
| Backup last restored as a test | When you last restored its backup to prove it works. | Your backup test log. | 08/15/2026 |
| Last cybersecurity assessment | Date of the last cybersecurity assessment covering this system. | The assessment report (it is Sensitive Security Information). | 06/01/2027 |
Patrols & Sweeps
33 CFR 105.255 / 105.275 · Per your security plan
Security patrols and sweeps of the facility, as set by your security plan.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Date & time | When the patrol happened. | Guard's log. | 06/30/2027 22:00 |
| Area | The area patrolled. | Guard's log. | Perimeter fence and warehouse B |
| Result | Whether anything was found. | Guard's log. Report anything found as an incident. | No issues |
TWIC Escort & Visitor Log
33 CFR 101.515 / 105.255 / 105.225(b)(9) · Every entry
Who came into secure and restricted areas, whether they held a TWIC, and who escorted them. TWIC problems cause more facility violations than anything else.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| TWIC expires | The expiry date on their TWIC card. | Front of the TWIC card. | 11/30/2029 |
| Escorted by (TWIC holder) | The TWIC holder who escorted them. Required for anyone without a TWIC in a secure area. | Your gate log. | J. Broussard |
| Canceled Card List checked | Whether the card was checked against TSA's Canceled Card List. | Your reader log, or the date of your manual check. | Yes — by hand |
MARSEC Log
33 CFR 105.230 / 105.225(b)(4) · Each time the MARSEC level changes
Changes in MARSEC (security) level set by the Coast Guard, and how fast you met the new level. The new level must be met within 12 hours.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| New MARSEC level | The new MARSEC level. | The Coast Guard notice. | 2 |
| Notice received from the COTP | When the Coast Guard (COTP) told you the level changed. | The notice email, call or message. | 06/30/2027 08:00 |
| New level attained | When you put the new level's measures in place (within 12 hours). | FSO's log. | 06/30/2027 14:00 |
| Attainment reported to the COTP | When you told the COTP you'd met the new level. | Your email or call log. | 06/30/2027 14:15 |
| Vessels at or due at the facility told | Whether vessels at the facility or due within 96 hours were told. | FSO's log. | Yes |
| Facility uses TWIC readers (Risk Group A) | Yes if your facility must use TWIC card readers. | Your security plan. | No |
| TWIC cancelled card list refreshed | When you last refreshed the list of cancelled TWIC cards. | Reader software log or your manual check. | 06/30/2027 09:00 |
| Count this change as a drill | Yes to count this real level change as one of your drills. | Only if it tested your plan. | No |
Plan Amendments
33 CFR 105.415 · Each plan change
Changes to your approved security plan. Most must be submitted at least 30 days before they take effect.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Change | What is changing in the plan. | Your draft amendment. | New gate and access route at north side |
| Planned effective date | When the change will take effect. | Your project plan. | 09/01/2027 |
| Submitted to the Coast Guard | When you sent it to the Coast Guard (at least 30 days before it takes effect). | Your submission letter or email. | 07/30/2027 |
| Approved | When the Coast Guard approved it. | Approval letter. | 08/20/2027 |
Security Equipment
33 CFR 105.250 / 105.225(b)(5) · Per your security plan
Tests and repairs of security equipment such as cameras, alarms, lighting and TWIC readers.
| Field | What it is | Where to find it | Example |
|---|---|---|---|
| Equipment | The type of security equipment. | Pick the matching type. | CCTV |
| Tested / calibrated | The date the equipment was tested or calibrated. | Test log or vendor service report. | 06/30/2027 |
| Result | Whether it worked. | Test log. | Working |
| Repaired | The date a fault was repaired. | Repair work order. | 07/02/2027 |
| Test every (days, per your plan) | Days between tests, as set by your plan. | Your security plan. | 30 |
Compliance information, not legal advice. Rules cited are current as we publish; confirm against the official eCFR.