TSA issues proposed cyber mandates for pipelines, rail, airlines

The Transportation Security Administration issued a Notice of Proposed Rulemaking to formalize and expand cyber mandates for surface transportation (freight and passenger rail, transit, pipelines, and over-the-road buses), consolidating post-Colonial Pipeline security directives. The proposal would require covered entities (roughly 300 operators) to implement cyber risk management programs, cybersecurity operational plans, regular audits, reporting to CISA, and new training/certification/vetting standards; comments are due by Feb. 5, 2025.