What You Should Learn
- Why the IMO position and the U.S. January 2026 rule are two different requirements.
- What the current IMO cyber-risk guidance says about annual training, joining familiarization and OT users.
- Which U.S.-flagged vessels fall under the Coast Guard rule and how quickly new personnel must be trained.
- Why temporary crew and contractors should not be left outside the training process.
- What evidence should be kept so the vessel can show that training actually took place.
There Is No Universal “2026 Cyber Certificate”
The phrase “2026 cyber-training requirement” is being used for two different developments.
The first is international. IMO's current Guidelines on Maritime Cyber Risk Management, MSC-FAL.1/Circ.3/Rev.4, now give very clear training expectations for companies and ships.
The second is a U.S. regulation. For U.S.-flagged vessels within the scope of 33 CFR Part 101 Subpart F, the Coast Guard set a specific 12 January 2026 deadline for cybersecurity training, followed by annual refresher training.
They point in the same direction, but they do not have the same legal status and they do not apply to the same vessels.
What IMO Expects
IMO issued MSC-FAL.1/Circ.3/Rev.4 on 28 May 2026. The circular describes itself as high-level guidance for maritime cyber-risk management, but its controls are now much more specific than earlier versions.
Under the Protect function, the current guidance says organizations should establish:
- annual basic cybersecurity training for all employees;
- OT-specific cybersecurity training for personnel who use operational technology;
- cybersecurity familiarization for all crew when they join the ship; and
- periodic testing of cybersecurity knowledge, for example through drills and exercises.
The basic training is expected to cover cyber hygiene, recognizing and detecting a cyber incident, response and recovery. The Detect, Respond and Recover sections reinforce those subjects by specifically linking the annual training to incident recognition, response and recovery.
This is useful for yachts because it removes much of the ambiguity around frequency. An annual awareness session is no longer simply industry good practice in the IMO guidance. It is an explicit control.
It Is Not a New STCW Certificate
MSC-FAL.1/Circ.3/Rev.4 is an IMO guidance circular. It does not create a new STCW certificate, endorsement or separate seafarer qualification.
The regulatory link for vessels operating under the ISM Code comes from IMO Resolution MSC.428(98). That resolution states that an approved Safety Management System should take cyber risk management into account and asked Administrations to ensure cyber risks were addressed in the SMS no later than the first annual Document of Compliance verification after 1 January 2021.
For an ISM-managed commercial yacht, the practical position in 2026 is therefore straightforward: cyber risk belongs in the SMS, and the current IMO guidance provides the clearest international benchmark for how crew training should be handled.
A sensible vessel policy is to put joining cyber familiarization, annual awareness training and role-specific OT training directly into the SMS or Cyber Security Risk Management Plan, with records that can be shown during audit.
The Separate U.S. Coast Guard Requirement
The genuine 12 January 2026 statutory deadline comes from the United States.
33 CFR Part 101 Subpart F applies to owners and operators of U.S.-flagged vessels required to have a security plan under 33 CFR Part 104. It does not apply to foreign-flagged vessels under this subpart.
For vessels in scope, 33 CFR §101.650 requires cybersecurity training for personnel with access to IT or OT systems. The rule expressly includes contractors and personnel who are part-time, full-time, temporary or permanent.
Scroll sideways to compare all columns
| Who | Training requirement |
|---|---|
| Personnel with IT or OT access | Threat and incident recognition, techniques used to circumvent security controls, cyber-incident reporting procedures and OT-specific content where duties involve OT. |
| Key personnel | All of the core training plus their incident-response responsibilities and current knowledge of changing threats and countermeasures. |
| Existing personnel | Core training was due by 12 January 2026 and is required annually thereafter. |
| New personnel | Training must be completed within 5 days of gaining system access, and no later than 30 days after hiring, then annually thereafter. |
| Personnel using a new IT or OT system | Training on that system must be completed within 5 days of system access, then annually thereafter. |
| Personnel not yet trained | Where access is necessary, they must be accompanied or monitored by someone who has completed the required training. |
Training on the relevant provisions of the approved Cybersecurity Plan has a separate timing requirement: it must be completed within 60 days after the plan is approved.
The Coast Guard's Policy Letter 01-25 adds useful implementation guidance. It treats access broadly and includes both logical access and, in some circumstances, unrestricted physical access to spaces containing IT or OT equipment. It also gives examples of key personnel such as cyber officers, personnel with elevated privileges, system maintainers and OT engineers or technicians.
What This Means for Yachts
Scroll sideways to compare all columns
| Yacht situation | Practical training position in 2026 |
|---|---|
| U.S.-flagged yacht subject to 33 CFR Part 104 | The Coast Guard training rule is legally binding. Annual training, new-joiner timing, OT-specific training and records must meet 33 CFR §101.650. |
| Commercial / ISM yacht under another flag | Cyber risk must be addressed through the SMS. Current IMO Rev.4 explicitly calls for annual basic training, joining familiarization and OT-specific training. |
| ETO, CTO, engineers and other OT users | They should receive additional training relevant to the OT systems they operate, maintain or support. |
| Temporary or rotational crew | IMO calls for familiarization for all crew when they join. Under the U.S. rule, temporary status does not remove the training obligation where the person has IT or OT access. |
| Contractors and service technicians | Control their access. Under the U.S. rule, covered contractors need training or must be accompanied or monitored when access is necessary. |
| Private yacht outside ISM and outside the U.S. rule | There is no single worldwide annual statutory training rule. Check flag, yacht-code, class, insurer and management requirements, then adopt a proportionate onboard standard. |
Temporary Crew Still Need Familiarization
Temporary employment does not make a person less capable of causing a cyber incident.
A relief steward may receive crew Wi-Fi, a vessel email account, cloud-document access or a managed tablet, or a temporary engineer may need to connect a service laptop to machinery networks, and provide a contractor with remote access to an AV controller or PLC.
IMO's wording is helpful here because it calls for cybersecurity familiarization for all crew upon engagement on board. The U.S. regulation goes further for vessels in scope by expressly including temporary personnel and contractors where they have IT or OT access.
The familiarization does not need to turn every short-term crew member into a cybersecurity specialist. They should know the vessel's rules before they are given access: what they can connect, how credentials and MFA are handled, what to do with suspicious emails or USB devices, who to contact, and what actions they must not take on vessel systems.
What Should the Training Cover?
For general crew, keep the training practical and tied to the yacht. Useful subjects include phishing and social engineering, password and MFA handling, personal and guest devices, removable media, suspicious links and QR codes, safe use of vessel Wi-Fi, safe use of AI tools and use of sensitive data, and how to report something that does not look right.
The reporting element matters. Crew should know who to contact and what information to preserve rather than deleting the email, resetting equipment repeatedly or trying to investigate a suspected incident themselves.
OT users need additional material relevant to their job. For an ETO, CTO or engineer this can include engineering workstations, vendor laptops, USB controls, remote support, privileged accounts, network separation, software changes, backups and the operational consequences of a compromised PLC, HMI, PMS or machinery controller.
IMO also expects knowledge to be tested periodically. A short phishing exercise, tabletop cyber scenario or recovery drill can show whether the crew know what to do. Rev.4 does not state that these IMO cyber drills themselves must be annual, so do not invent an annual drill frequency where the vessel's flag or SMS has not set one.
A Practical Yacht Scenario
A temporary AV technician joins during a yard period to troubleshoot a control-system problem. The technician needs access to a technical VLAN and remote vendor tools for two days.
On an ISM yacht, the person should receive the relevant cyber familiarization and be brought under the vessel's contractor and remote-access controls before connecting.
On a U.S.-flagged vessel within 33 CFR Part 101 Subpart F, the owner or operator also needs to consider the formal training rule. If the technician cannot receive the required training before access is needed, §101.650 allows necessary access only when the untrained person is accompanied or monitored by trained personnel. Coast Guard guidance also describes controlled remote monitoring for certain support situations.
The useful lesson is simple: temporary access still needs an owner, a time limit and supervision.
What Evidence Should the Yacht Keep?
Training is difficult to defend in an audit if the only evidence is “everyone did it”.
A useful training record should include:
- crew member or contractor name and role;
- date joined or date access was granted;
- date and duration of training;
- the subjects covered;
- joining familiarization completed;
- annual refresher due date;
- OT-specific training required and completed, where applicable;
- key-personnel designation where the U.S. rule applies;
- trainer or training provider; and
- attendance, certificate, acknowledgement or LMS record.
For vessels subject to the U.S. rule, Coast Guard guidance says records should include at minimum the session date, duration, a description or outline of the training, and the attendee list.
The content outline is worth keeping even when a third-party course provides a certificate. It shows that the course actually covered the subjects required by the vessel's SMS or regulation.
Suggested Onboard Policy Wording
For an ISM yacht, reference the current IMO Guidelines on Maritime Cyber Risk Management and the vessel's approved SMS or Cyber Security Risk Management Plan rather than describing the training as an STCW certificate.
For a U.S.-flagged vessel within 33 CFR Part 101 Subpart F, the vessel procedure should also reproduce the specific personnel, timing, content and documentation requirements of §101.650.
Applicability Note
The exact legal requirement depends on flag state, commercial or private status, ISM applicability, security-plan requirements, vessel operation and the systems each person can access.
IMO MSC-FAL.1/Circ.3/Rev.4 is current international guidance, not a standalone STCW certification requirement. MSC.428(98) links maritime cyber risk management to the ISM Safety Management System for vessels within that regime.
The U.S. requirements discussed here apply specifically to U.S.-flagged vessels within the scope of 33 CFR Part 101 Subpart F. A foreign-flagged yacht entering U.S. waters is not brought into that subpart simply by visiting a U.S. port.
References
IMO — MSC-FAL.1/Circ.3/Rev.4, Guidelines on Maritime Cyber Risk Management, 28 May 2026
IMO — Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems
IMO — International Safety Management (ISM) Code
https://www.imo.org/en/ourwork/humanelement/pages/ismcode.aspx
eCFR — 33 CFR §101.605, Applicability
https://www.ecfr.gov/current/title-33/chapter-I/subchapter-H/part-101/subpart-F/section-101.605
eCFR — 33 CFR §101.650, Cybersecurity Measures
https://www.ecfr.gov/current/title-33/chapter-I/subchapter-H/part-101/subpart-F/section-101.650
U.S. Coast Guard — CG-5PC Policy Letter 01-25, Cybersecurity Training for Personnel with Access to IT or OT Systems
U.S. Coast Guard — Maritime Industry Cybersecurity Resource Page
https://www.uscg.mil/MaritimeCyber/
Federal Register — Cybersecurity in the Marine Transportation System, Final Rule, 17 January 2025