botminds.aiRequest a demo
SystemPorts & Marine Terminals

Port Facility Security Compliance

Facility security plan obligations proven from the terminal's own records: every drill, roster, Declaration of Security and cybersecurity date read as the Coast Guard inspector will read it, weeks before the exam.

See the demoBook a demo
See one terminal's security year proven screen by screen ↓
Watch with transcript →
The problem

The drill happened, and nobody wrote down who took part

A regulated marine terminal lives by its approved plan all year: quarterly drills, an annual exercise and audit, refresher training for everyone with security duties, Declarations of Security when a ship asks, monthly gate checks. The evidence lands in a document system, the badge system, training sign-in sheets, email and the contract guard company's own files.

Before the annual exam the facility security officer spends days building binders from those places, and finds the gaps the way the inspector would. A drill record has a description and lessons but no list of participants; guards' training sheets stayed with the contractor; a declaration carries one signature; a binder sentence claims more than the records show. Now the Coast Guard's cybersecurity rule adds a cybersecurity officer named in writing and training for everyone with access to IT or OT systems, contractors included.

Built forFacility security officersDirectors of securityCybersecurity officersTerminal operations managers

The Problem Today

Drills, training and gate checks run all year, and their records sit with contractors and in separate systems until the exam.

17%
of facility deficiencies were recordkeeping, in 2006 inspections published
3,685
MTSA-regulated facilities, in the Coast Guard's 2025 estimate published

Gathered by hand before each exam

  • Drill forms
  • Sign-ins
  • Guard files
  • DoS copies
  • Lessons that go nowhereAn exercise lesson never reaches the plan or the next drill
  • Cyber duties on a new clockTraining and a cybersecurity plan due on fixed dates

The Solution

  1. The security year read from recordsDrills, exercise, training, declarations, gate checks and cyber dates
  2. Read as the inspector wouldA challenger ranks what the Coast Guard will ask, the agents' draft included
  3. Contractors answer in fieldsThe guard company sends fields and files; its note goes to the officer
  4. The director checks each rulingThe director of security co-signs the amendment and checks each decision

Built-in controls

  • The plan's contents stay off every screen
  • Names are not added to a closed drill record
  • No filing reaches the Coast Guard without two people

What You Get

The terminal goes into the annual exam with each required record on file or a decided gap beside it.

  • Gaps found weeks earlyA missing roster surfaces before the inspector asks for it
  • Contractor records in handGuard training and gate checks arrive as fields and files
  • Cyber plan dates rehearsedAssessment start dates tested against the deadline
Features

Facility security plan compliance features, from year wheel to exam binder

Facility security officers, the cybersecurity officer and the director of security work through them to prove a terminal's year before the Coast Guard's annual exam.

demoThe port, its terminal, the guard company, the IT provider, the people, badges, vessels and records here are sample data; the Coast Guard and its rules are real.

  1. 01Security year

    Facility security plan duties drawn as one year wheel for the terminal

    • Each required event placed on its ring. Quarterly drills, the exercise and audit, training, Declarations of Security, gate checks and cyber dates show where each falls due.
    • Two countdowns at the center. Days to the annual exam and to the cybersecurity plan deadline frame the officer's next weeks.
    • Each facility and next year one click away. The security office switches between its facilities, or opens what the rules will require next year.
  2. 02Steer box

    Contractor gates added to every check by a steer typed mid-read

    • Steers in the officer's own words. The plan gains a step in view, re-reads the gate checks and logs the steer under the officer's name.
    • Gates the contractor checks read too. Monthly checks at the gates the guard company runs are read with the terminal's own, so a missing one is asked for before the exam.
    • Each agent's step and source on its card. The officer opens the record behind any finding straight from the agent that made it.
  3. 03Inspector's read

    MTSA compliance read the way the Coast Guard inspector will, point by point

    • Points ranked as the inspector would ask them. The officer works the likeliest questions first, each tied to its regulation and its record.
    • The agents' readiness note attacked too. A sentence claiming more than the records show is struck and rewritten before anyone signs.
    • Each point owned by a named person. Record gaps go to the facility security officer and training gaps to the cybersecurity officer.
  4. 04Contractor portal

    Guard company answers drill, training and gate requests in fixed fields

    • Questions per drill, per badge and per gate. The guard company answers exactly what the record needs, so a reply cannot stay vague.
    • Fields and files drive the counts. Training per badge flows into the totals, the schedule and the binder with no retyping.
    • Contractor notes held for the officer. The company's free text reaches the security officer without any agent reading it, and the ruling waits until it is opened.
  5. 05Ruling

    Deficient drill record kept as written, with a dated memo to file beside it

    • The original record left as it was. A list found later is filed beside the record and dated, so the record shows what was known on the day.
    • The officer's earlier ruling shown at the decision. How the same question was settled before sits in the dialog, and the new ruling becomes a proposed rule.
    • Corrective action tied to the finding. The plan amendment adding a roster to the drill form, and the next drill testing the open lesson, are part of the ruling.
  6. 06Training

    Coast Guard cybersecurity training matched badge by badge to sign-in sheets

    • Badges matched to sign-in sheets. Everyone with security duties, and everyone with IT or OT access, is checked against an attendance record.
    • Contractor attendance accepted after opening. The cybersecurity officer accepts the guard company's sheet only after reading it, and the acceptance is logged.
    • The untrained scheduled and supervised. Each gets a session date and works accompanied or monitored by a trained person until then.
  7. 07Cyber plan

    USCG cybersecurity plan start dates tested against the submission deadline

    • Each start date shown in weeks and dollars. Assessment, drafting and review time show whether the plan lands before the deadline and by how much.
    • A late start needs its own reason. A start that misses the deadline is flagged and cannot be chosen without a reason code and an acknowledgment.
    • The IT provider's count replaces the assumption. Systems in scope from the provider's own fields reprice the assessment once they arrive.
  8. 08Amendment

    Facility security plan amendment co-signed by the director before submission

    • Cover page opened before co-signing. The director signs what was read, while the plan's changed pages stay in the secure store.
    • Effective date set from the submission. The proposed effective date follows the notice period, and the readiness note says the change is not in force at the exam.
    • Each ruling checked by the director. The officer's decisions on the drill record, the declaration and training wait for the director's check.
  9. 09Exam binder

    Readiness note signed, and the exam binder kept to people who need to know

    • The binder holds records and the note only. Internal challenger points and unverified contractor text go in a separate pack for the security office.
    • Sharing takes two people. The officer shares and the director confirms before the inspector can open the binder.
    • Security-sensitive marking and a need-to-know list. Records carry the SSI marking, and the plan's contents are listed as never in the binder.

Who proves a marine terminal's security year, and what each one gets

The security officer runs the read; the director, the cybersecurity officer and operations each act on their part.

Facility security officers

Prove the year's drills, training, declarations and gate checks before the exam

  • Each required event filled from its record
  • The inspector's likely questions, ranked
  • Contractor records requested as fields
Directors of security

Co-sign plan amendments, check each ruling and approve learned rules

  • The cover page opened before co-signing
  • Each decision waiting for the director's check
  • A binder shared only once the director confirms
Cybersecurity officers

Accept training records, schedule training and set the assessment start

  • Everyone with IT or OT access matched to a sheet
  • Contractor attendance read before accepting
  • Start dates priced against the plan deadline
Terminal operations managers

Release staff for drills and training without seeing scenario details

  • Dates and headcounts to cover the shift
  • Requests with a due date in one queue
  • No plan or scenario text on operations screens
More screens

The decided year, drill records, declarations and the trail behind them

Screens the security office and an internal auditor open once the six points are settled.

The year after the rulingsAll six inspector's points decided or answered, the fourth-quarter drill and the training session scheduled on the wheel, one red mark left for the August record.
Drills against the four required fieldsDate, description, participants and lessons for each drill and the exercise; the August record shows its missing list with the memo filed beside it.
Declarations of SecurityEvery declaration this year with both signatures and the date the rule's minimum copy runs to; one is recorded as incomplete.
Open items across three facilitiesStaff releases for the drill and training waiting on operations, refresher dates and tenant evidence, each with owner and clock.
Requests to outside partiesThe guard company's request, sent with the officer's reason, asks each item as a field: the drill list, training per badge and two months of gate checks.
The audit trailSignatures, rulings, acceptances and the officer opening the contractor's note, each logged with why and what signing meant.

demoSample data, from the working solution.

Eight agents read the security year, and none files with the Coast Guard

They read titles and records, hand findings on by name, and stop where a person must rule.

Plan mapper

Maps each plan section, by title only, to the records it requires.

  • Never shows or quotes the plan's contents
Drill reader

Reads drill and exercise records against the four required fields and the contractor's roster fields.

  • Adds no names to a closed record
Training reader

Matches badges to sign-in sheets and reads the contractor's attendance fields.

  • Accepts no outside record itself
Records clerk

Reads each Declaration of Security and the monthly gate checks.

  • Never fills a blank signature
Cyber milestones

Tracks the cybersecurity rule's dates and runs the assessment what-if.

  • Labels each assumption as one
Contractor requests

Drafts structured requests to the guard company and the IT provider and reads their fields and files.

  • Sends a request only when the officer does
  • Keeps contractor notes out of the records
Inspector's read

Reads the year and the agents' own draft as the Coast Guard inspector would, and ranks the points.

  • Gives no legal view and calls no party dishonest
Exam binder builder

Drafts the readiness note, the binder and the amendment cover, each line cited.

  • Writes no sentence without a record
  • Shares no binder without two people

Filings, rulings on records and training acceptance stay with named officers

Submitting to the Captain of the PortThe facility security officer prepares and submits an amendment only after the director co-signs it.
Ruling on a deficient recordThe officer decides whether a record stands and what is filed beside it, gives a reason, and the director checks the ruling.
Accepting outside training recordsThe cybersecurity officer accepts a contractor's attendance after opening the sheet.
Showing the planAgents read section titles only; the plan's contents stay in the secure store and out of every export.

What security officers ask about facility security plan records

What is a facility security plan?

A facility security plan is the Coast Guard-approved plan an MTSA-regulated facility keeps and lives by: drills, exercises, audits, training, access control and Declarations of Security. Here agents prove the year of records the facility security plan requires, without ever showing its contents.

What records does MTSA compliance require each year?

A security drill at least every three months, an exercise each calendar year with no more than eighteen months between, an annual plan audit, training records with date, duration, description and attendees, and drill records with participants and lessons learned. Records are kept at least two years.

What does the Coast Guard's cybersecurity rule add for facilities?

A cybersecurity officer named in writing, training for everyone with access to IT or OT systems, contractors included, and a cybersecurity assessment and plan by the dates in the rule. The year wheel carries those dates beside the security events.

Can a missing participant list be added after the drill?

The record stays as written and deficient for that drill. A list re-created later by the person who ran it is filed beside the record as a dated memo, and the corrective action, such as a roster on the drill form, goes in a plan amendment.

Does the plan's content appear in the software?

No. Agents read section titles only, records carry the security-sensitive marking, and the exam binder lists the plan as never included. Operations staff outside the need-to-know list see no scenario text.

Who submits plan amendments to the Captain of the Port?

The facility security officer prepares and submits, after the director of security opens the cover page and co-signs. The agents draft the cover page and never file.

Ports & Marine Terminals

Other port and marine terminal solutions

All 6 solutions →
Demurrage Billing Compliance

Invoices that bill only what the terminal’s records prove, well inside 30 days.

1-min demoPort Infrastructure Grant Applications

The scope chosen on corrected numbers, before a federal reviewer finds the error.

1-min demoPort Concession and Lease Management

Every true-up line tied to a clause and a port record, before the invoice goes out.

1-min demo

Bring last year's
exam binder.

Bring one facility's drill, training and declaration records, and we will read the year with you as the inspector would.

Book a demoBrowse solutions