IMI Level 3 Diploma in Light Vehicle Maintenance and Repair (IL3DLVMR)

Correct: According to 33 CFR Part 105, the Facility Security Officer must ensure that any deviation from the approved Facility Security Plan is addressed by implementing compensatory measures that maintain the overall security posture of the facility. Because the FSP is a legally binding document approved by the USCG, significant deviations or the implementation of alternative measures must be reported to the Captain of the Port (COTP) to ensure the facility remains in compliance with the Maritime Transportation Security Act.

Incorrect: Relying solely on internal maintenance logs and increased patrols is insufficient because it does not satisfy the regulatory requirement to notify the USCG of a deviation from the approved plan. The strategy of suspending operations might mitigate risk but does not address the legal requirement to manage the physical security breach according to the FSP’s amendment and deviation protocols. Choosing to delegate security oversight to a maintenance supervisor is a failure of the FSO’s specific regulatory duties, as the FSO is the individual legally responsible for the implementation and oversight of security measures.

Takeaway: FSOs must implement compensatory measures and notify the COTP when operational needs require a temporary deviation from the approved Facility Security Plan.

Correct: Under 33 CFR 105.200 and 105.405, the FSO is responsible for the implementation and maintenance of the Facility Security Plan. This includes ensuring that security measures are effective under all conditions. If a technology like VMD has known limitations in fog or rain, the FSO must provide for compensatory measures, such as increased security patrols or thermal imaging, to ensure continuous monitoring as required by the facility’s security level.

Incorrect: Increasing sensitivity to maximum levels often leads to an unmanageable volume of false alarms, which can cause security personnel to ignore genuine alerts and creates a secondary security risk. The strategy of relying on a single type of sensor like passive infrared is insufficient because every technology has specific environmental vulnerabilities and the USCG does not mandate a single specific brand or type of sensor. Choosing to delay the resolution of a known security gap until a future amendment cycle leaves the facility vulnerable and non-compliant with the requirement to maintain continuous surveillance.

Takeaway: FSOs must implement compensatory measures when environmental factors or technical limitations compromise the effectiveness of primary security technologies.

Correct: According to 33 CFR 105.255, at MARSEC Level 2, the facility must implement additional protective measures which include increasing the frequency and detail of screenings of persons, personal effects, and vehicles. This ensures that the heightened risk is met with more rigorous verification and detection efforts to prevent unauthorized items or individuals from entering the facility.

Incorrect: The strategy of suspending all deliveries and visitors is typically reserved for MARSEC Level 3 or specific emergency scenarios rather than a standard Level 2 transition. Opting to replace human patrols with automated systems during a heightened alert level may create security gaps and fails to meet the requirement for increased vigilance and manual inspection. Focusing only on senior management for security briefings is incorrect because 33 CFR 105 requires that all facility personnel are aware of and can respond to changed security conditions.

Takeaway: Transitioning to MARSEC Level 2 requires the FSO to implement intensified screening and surveillance measures as specified in the Facility Security Plan.

Correct: Isolating affected workstations is a critical first step in incident response to prevent the lateral movement of malware or ransomware across the facility’s network. Simultaneously, conducting a security awareness briefing addresses the human element of the phishing threat, ensuring that personnel can recognize and report suspicious social engineering attempts, which is a key component of maintaining the Facility Security Plan’s integrity.

Incorrect: The strategy of deleting all incoming emails from government domains is counterproductive as it disrupts essential regulatory communications and fails to address the systems that may already be compromised. Opting to block all external traffic is an extreme measure that could halt critical port operations and does not specifically target the phishing vector identified. Focusing only on frequent password changes is ineffective against active malware infections and often leads to password fatigue, which can decrease overall security posture without preventing the initial execution of malicious links.

Takeaway: Effective maritime cyber defense requires combining technical isolation of infected systems with proactive personnel training to counter social engineering threats.

Correct: The effectiveness of any locking mechanism is fundamentally tied to the integrity of the key management system. Under 33 CFR Part 105, the FSO is responsible for ensuring that access control measures are properly maintained and implemented. A centralized system with serialized keys and a documented audit trail ensures accountability, prevents unauthorized duplication, and allows the FSO to identify exactly who has access to restricted areas at any given time.

Incorrect: Focusing only on upgrading physical hardware like strike plates fails to address the primary vulnerability, which is the loss of administrative control over the keys. The strategy of increasing patrol frequency is a compensatory measure that does not fix the underlying security breach caused by missing master keys. Choosing to improve lighting and surveillance may enhance detection capabilities but does not restore the primary access control function that the locking mechanisms are intended to provide.

Takeaway: Physical security hardware is only effective when supported by rigorous administrative controls and a documented chain of custody for access credentials.

Correct: Under 33 CFR 105.415, any amendment to a Facility Security Plan that significantly affects the security of the facility must be submitted to the Captain of the Port (COTP) for approval. The regulation specifically requires that these amendments be submitted at least 30 days before the amendment is to take effect, ensuring the Coast Guard can verify that the facility remains in compliance with the Maritime Transportation Security Act (MTSA) standards.

Incorrect: The strategy of updating the assessment and merely keeping it on-site for the next scheduled visit fails to comply with the legal requirement for proactive regulatory approval of plan modifications. Simply notifying the Company Security Officer and logging the changes internally does not satisfy the federal mandate for oversight by the Captain of the Port. Choosing to implement changes immediately based on a self-assessment of security posture is incorrect because the FSO does not have the legal authority to bypass the formal amendment and approval process required by federal law.

Takeaway: Significant amendments to a Facility Security Plan must be submitted to the Captain of the Port for approval 30 days before implementation.

Correct: Under 33 CFR 105.400, the Facility Security Plan must be consistent with other facility emergency and response plans. The FSO is responsible for ensuring that security measures do not contradict safety or environmental response procedures, allowing for a coordinated and effective reaction to any incident.

Incorrect: Relying on the FSP to override other emergency plans creates dangerous operational conflicts and ignores the regulatory mandate for plan consistency. The strategy of requesting a waiver from the Captain of the Port is inappropriate because the FSO is expected to resolve internal plan conflicts proactively. Choosing to deactivate security controls during an emergency response is a violation of the requirement to maintain the facility’s security posture at all times.

Takeaway: The FSO must ensure the Facility Security Plan is fully integrated and consistent with all other facility emergency response plans.

Correct: Under 33 CFR Part 105, the Facility Security Assessment must be a comprehensive analysis that identifies vulnerabilities in physical security, structural integrity, and personnel protection systems. A scenario-based approach is superior because it allows the Facility Security Officer to evaluate how specific threats could exploit existing weaknesses. This methodology ensures that the assessment considers the potential consequences of an attack, which is a critical component of the risk management process mandated by the Coast Guard.

Incorrect: Relying solely on historical data fails to account for emerging threats or low-frequency, high-impact events that have not yet occurred at that specific location. The strategy of focusing only on external terrorism ignores the regulatory requirement to assess all vulnerabilities, including internal threats and unauthorized access. Choosing a methodology based on frequency alone neglects the severity of consequences, which is a primary factor in maritime security risk management. Simply conducting an analysis of past crimes does not satisfy the requirement to identify specific facility weaknesses that could be exploited by a determined adversary.

Takeaway: A comprehensive Facility Security Assessment must use scenario-based analysis to evaluate vulnerabilities and consequences rather than relying strictly on past incident frequency.

Correct: According to 33 CFR Part 105 and the Maritime Transportation Security Act, individuals requiring unescorted access to secure areas must hold a valid Transportation Worker Identification Credential (TWIC). The Facility Security Officer is responsible for ensuring that the identity of the individual matches the credential through a visual check or biometric verification to confirm the person has passed the required federal security threat assessment.

Incorrect: Relying on a signed affidavit from a private firm is insufficient because private background checks do not meet the specific federal standards required for maritime facility access. The strategy of granting provisional access while applications are pending is a violation of security protocols, as unescorted access is strictly prohibited until the federal credential is fully issued. Focusing on psychological evaluations and liability waivers addresses internal corporate risk management but fails to satisfy the mandatory regulatory requirement for government-vetted identification.

Takeaway: Unescorted access to secure areas in USCG-regulated facilities requires a valid Transportation Worker Identification Credential for all personnel.

Correct: According to 33 CFR 105.415, any amendment to a Facility Security Plan must be submitted to the Captain of the Port (COTP) for approval. The regulations require that the FSO submit the amendment at least 30 days before the change is intended to take effect, ensuring the Coast Guard can verify that the new measures provide an equivalent level of security to the original approved plan.

Incorrect: The strategy of notifying local law enforcement instead of the Coast Guard is incorrect because the COTP holds the federal regulatory authority over FSP approvals. Choosing to wait until the annual audit or the next scheduled inspection to report changes is a violation of the requirement for prior approval of plan amendments. Relying on a Declaration of Security is inappropriate in this context because a DoS is a coordination document between a vessel and a facility for specific interfaces, not a mechanism for approving permanent facility infrastructure changes.

Takeaway: Facility Security Plan amendments must be submitted to the Captain of the Port for approval 30 days before implementation per 33 CFR 105.415.

Correct: According to 33 CFR 105.265, the Facility Security Officer must ensure that security measures for handling cargo are implemented in accordance with the Facility Security Plan (FSP). This includes screening cargo for dangerous substances and devices. Furthermore, the FSO must coordinate these security measures with the vessel’s security personnel to ensure the integrity of the cargo throughout the transfer process.

Incorrect: The strategy of delegating all screening to local law enforcement is incorrect because the FSO maintains the primary regulatory responsibility for facility security operations under federal law. Choosing to perform 100% physical inspections of all cargo at MARSEC Level 1 may exceed the risk-based requirements of the FSP and lead to operational inefficiencies not required by the current threat level. Opting to rely solely on paper manifests and seals is insufficient because federal regulations require active screening measures to detect hidden explosives or contraband that would not be identified by a visual seal inspection alone.

Takeaway: The FSO must execute cargo screening according to the approved Facility Security Plan and coordinate with the vessel to ensure security compliance.

Correct: Under 33 CFR 105.305, the Facility Security Assessment must include a physical survey that examines and evaluates existing security measures. By combining this physical inspection with scenario-based exercises, the Facility Security Officer can identify structural weaknesses while simultaneously testing the operational response of personnel and equipment to specific threat vectors. This dual approach ensures that both the physical hardware and the human elements of the security system are capable of mitigating identified risks effectively.

Incorrect: Relying solely on historical data and crime statistics is insufficient because it fails to account for new or evolving threat tactics that have not yet occurred at the site. The strategy of focusing on administrative audits and training records ensures regulatory compliance but does not actually test the physical or operational resilience of the facility against an active threat. Choosing to rely on remote technology and sensor data without physical walkthroughs is flawed because electronic systems can be bypassed or may have blind spots that only a tactile, on-site inspection can reveal.

Takeaway: A robust Facility Security Assessment must combine physical infrastructure inspections with scenario-based testing to ensure both structural and operational security effectiveness.

Correct: According to 33 CFR 105, the Facility Security Officer is required to notify the Coast Guard Captain of the Port (COTP) when the facility has shifted to a new MARSEC level. Furthermore, the FSO must ensure that all security personnel, facility employees, and vessels currently at the facility are briefed on the change and the specific actions required by the Facility Security Plan.

Incorrect: The strategy of delaying notification until all physical upgrades are finished creates a dangerous information gap and violates the regulatory requirement for immediate reporting of status. Focusing on public media releases ignores the specific regulatory chain of command and may compromise operational security by broadcasting sensitive posture changes. Opting to wait for internal corporate confirmation before alerting vessels at the berth fails to meet the urgency required for maritime security coordination and leaves vessels vulnerable.

Takeaway: The FSO must immediately notify the COTP and coordinate with vessels when security levels change to ensure port-wide synchronization.

Correct: Under 33 CFR 105.410, any changes that affect the security of the facility or the implementation of the FSP must be submitted as an amendment to the COTP. The regulations specifically require that these amendments be submitted for approval at least 30 days before the change is intended to become effective to allow for regulatory review.

Incorrect: Relying solely on the five-year renewal cycle for equipment updates fails to meet the regulatory requirement for maintaining an accurate and approved FSP at all times. Opting for a temporary waiver through the National Vessel Movement Center is incorrect because that agency does not handle facility security plan amendments or equipment approvals. Simply maintaining internal logs without formal plan amendment ignores the legal mandate to have the COTP approve changes to security systems described in the plan.

Takeaway: FSOs must submit FSP amendments to the Captain of the Port within 30 days when facility security equipment or procedures change.

Correct: According to 33 CFR Part 105, any individual who does not hold a valid TWIC must be escorted while in secure areas of a facility. This escorting must be performed by a person who holds a valid TWIC and is authorized by the facility to provide such supervision, ensuring the visitor is either side-by-side with the escort or under continuous monitoring.

Incorrect: Relying solely on state-issued identification and logbook entries fails to satisfy the federal requirement for physical supervision of non-credentialed persons in secure zones. The strategy of issuing temporary passes for unescorted access is prohibited because only TWIC holders are legally permitted to move freely without an escort. Choosing to allow independent movement after a physical screening ignores the mandatory escorting protocols established to prevent unauthorized activities within sensitive maritime infrastructure.

Takeaway: Non-TWIC holders must be escorted or continuously monitored by an authorized TWIC holder when accessing secure areas of a regulated facility.

Correct: Under 33 CFR Part 105, the Facility Security Officer is responsible for ensuring that cargo handling procedures are followed, which includes verifying the integrity of seals. When a seal discrepancy is discovered, it is considered a security incident or a breach of security protocols. The FSO must follow the procedures outlined in the Facility Security Plan, which involves notifying the Company Security Officer, documenting the event, and conducting a thorough inspection of the cargo to verify that the contents have not been tampered with or replaced with dangerous substances.

Incorrect: The strategy of applying a new seal without inspecting the contents first is a significant security failure because it masks a potential breach rather than investigating it. Choosing to allow the container into the facility to avoid congestion prioritizes operational speed over mandatory security requirements and risks introducing threats into the restricted area. Opting for a notarized letter from the point of origin focuses on administrative paperwork rather than the immediate physical security risk posed by a potentially compromised container seal.

Takeaway: A seal discrepancy requires immediate documentation, notification of the CSO, and a physical inspection to ensure cargo integrity and facility security.

Correct: Under 33 CFR Part 105 and NVIC 01-20, the FSO must ensure the Facility Security Assessment (FSA) identifies vulnerabilities in computer systems and networks that could impact security. Integrating these findings into the FSP through a defense-in-depth approach ensures that critical systems, such as those controlling access or monitoring, are protected against cyber-attacks that could lead to a transportation security incident.

Incorrect: Relying solely on corporate IT departments without FSO oversight fails to meet the regulatory requirement that the FSP specifically address facility-specific security vulnerabilities. The strategy of limiting cyber measures to file encryption and workstation passwords neglects the broader network infrastructure and operational technology critical to maritime security. Focusing only on administrative antivirus software while ignoring industrial control systems leaves the facility’s most critical operational functions vulnerable to sabotage or disruption.

Takeaway: FSOs must integrate cybersecurity into the Facility Security Plan by identifying and mitigating vulnerabilities in all systems critical to maritime security.

Correct: Under 33 CFR 105.265, the Facility Security Officer is responsible for ensuring that cargo is checked for evidence of tampering and that the cargo matches the documentation. When a seal discrepancy is identified, the FSO must verify the chain of custody and the legitimacy of the seal change with the shipper or carrier. Refusing entry until official documentation is provided ensures that the facility does not accept potentially compromised cargo, maintaining the integrity of the secure area as required by the Facility Security Plan.

Incorrect: The strategy of allowing the container into a holding area for a full physical inspection by facility staff is problematic because it introduces a potential threat into the facility before its status is confirmed. Simply opting for a waiver of liability and documenting the discrepancy in an annual report fails to address the immediate security risk and violates the requirement to prevent unauthorized items from entering the facility. Choosing to apply a secondary seal and proceeding with offloading does not resolve the original discrepancy and ignores the possibility that the cargo was tampered with before arriving at the gate.

Takeaway: FSOs must verify cargo integrity and chain-of-custody documentation with shippers and carriers whenever security seal discrepancies are detected at the facility gate.

Correct: Under 33 CFR Part 105, the FSO is responsible for the development and maintenance of the Facility Security Plan but must work closely with the CSO. The CSO provides the necessary resources and ensures that the facility-specific security measures are consistent with the company’s overall security policies and organizational goals.

Incorrect: The strategy of transferring the Security Vulnerability Assessment to the CSO is incorrect because the FSO is specifically mandated to ensure the assessment is conducted for their specific facility. Choosing to have the CSO conduct all on-site drills misinterprets the roles, as the FSO is the primary lead for facility-level drills while the CSO maintains a broader oversight role. Opting to limit communication until after regulatory approval is a failure of the required coordination, as the CSO must be involved in the planning and resource management phases of any significant security update.

Takeaway: The FSO manages facility-specific security while coordinating with the CSO to ensure alignment with company-wide security standards and resource needs.

Correct: Under 33 CFR Part 105 and the Maritime Transportation Security Act (MTSA), physical barriers are not standalone solutions; they must be part of an integrated system. The regulations require that security measures for access control and restricted areas be capable of being scaled across MARSEC Levels 1, 2, and 3. Effective implementation involves combining physical deterrents with detection capabilities (like sensors or cameras) and response protocols to ensure that any breach is identified and addressed promptly.

Incorrect: Relying solely on natural vegetation as a primary barrier is insufficient because it rarely provides the necessary delay or detection capabilities required for a regulated facility. The strategy of making all barriers permanent and non-modifiable is flawed because the Facility Security Plan must be flexible enough to undergo periodic reviews and amendments based on new vulnerability assessments. Focusing only on MARSEC Level 1 ignores the federal mandate that the facility must have pre-planned, scalable security measures ready for implementation when the Coast Guard increases the maritime security level.

Takeaway: Physical barriers must be integrated with detection and response measures and remain scalable across all three MARSEC levels.