The United States Transportation Security Administration (TSA) announced two new Security Directives and additional guidance for voluntary measures to strengthen cybersecurity across the transportation sector in response to the ongoing cybersecurity threat to surface transportation systems and associated infrastructure. These actions are among several steps the Department of Homeland Security (DHS) is taking to increase the cybersecurity of U.S. critical infrastructure.

“These new cybersecurity requirements and recommendations will help keep the traveling public safe and protect our critical infrastructure from evolving threats,” said Secretary of Homeland Security Alejandro N. Mayorkas. “DHS will continue working with our partners across every level of government and in the private sector to increase the resilience of our critical infrastructure nationwide.”

TSA is increasing the cybersecurity of the transportation sector through Security Directives, appropriately tailored regulations, and voluntary engagement with key stakeholders. In developing its approach, including these new Security Directives, TSA sought input from industry stakeholders and federal partners, including the Department’s Cybersecurity and Infrastructure Security Agency (CISA), which provided expert guidance on cybersecurity threats to the transportation network and countermeasures to defend against them.

The TSA Security Directives announced today target higher-risk freight railroads, passenger rail, and rail transit, based on a determination that these requirements need to be issued immediately to protect transportation security. These Directives require owners and operators to:

1. designate a cybersecurity coordinator; 
2. report cybersecurity incidents to CISA within 24 hours; 
3. develop and implement a cybersecurity incident response plan to reduce the risk of an operational disruption; and, 
4. complete a cybersecurity vulnerability assessment to identify potential gaps or vulnerabilities in their systems.

TSA is also releasing guidance recommending that all other lower-risk surface transportation owners and operators voluntarily implement the same measures. Further, TSA recently updated its aviation security programs to require airport and airline operators to implement the first two provisions above. TSA intends to expand the requirements for the aviation sector and issue guidance to smaller operators. TSA also expects to initiate a rule-making process for certain surface transportation entities to increase their cybersecurity resiliency.

These efforts are part of a series of new steps to prioritize cybersecurity across DHS. Secretary Mayorkas first outlined his vision for the Department’s cybersecurity priorities in March, which included a series of focused 60-day sprints designed to elevate existing work, remove roadblocks to progress, and launch new initiatives and partnerships to achieve DHS’s cybersecurity mission and implement Biden-Harris Administration priorities. To learn more about the sprints, please visit www.dhs.gov/cybersecurity. 

Ron Brash, VP of Technical Research at ICS/OT software security firm, aDolus Technology, says, “The problem with reporting incidents within 24 hours is that many organizations lack the skill & resources to comply, but it is also dangerous to assume adherence with or without an added coordinator. Currently, beyond the obvious attacks such as ransomware, the majority of organizations have trouble differentiating between accidental and malicious events. For example, a forklift may clip a utility pole, and a fiber optic run is severed — connectivity may degrade or come to a full halt. Legislation such as this may result in overzealous behaviors because coordinators may jump to immediately claiming everything is cyber-related if the clock is fiercely ticking away, or conversely potentially result in the opposite of the intended effect: organizations may avoid reporting and improving infrastructure visibility altogether. I hope neither occurs as that is counterproductive to the spirit of the objective and may discourage proactive action. If Biden’s XO for SBOMs and supply chain transparency overflow into rail and transportation, organizations will need accelerated security program growth and maturity yesterday. This is both a good and bad thing because infrastructure resiliency certainly may increase, but bad because the overall amount of foundational catch-up may lead to overanalysis paralysis or poor budget allocation. Overly prescriptive approaches may also result in too rigid of a structure, and focus on the wrong elements — e.g., a checkbox ticking exercise vs. actual risk reduction.”

To view TSA’s Security Directives and guidance documents, please visit www.tsa.gov/for-industry/surface-transportation-cybersecurity-toolkit.