How to Respond to TSA’s New Cybersecurity Reporting Standards for US Rail Operators

This report summarizes new U.S. cybersecurity directives for rail (and some air) operators requiring a designated cybersecurity coordinator, 24-hour incident reporting to CISA, incident response plans, and vulnerability assessments. It highlights challenges in assessing OT on locomotives, recommends monitoring strategies (favoring Office Segment sensor placement), hardening mandated technologies like PTC, and advises operators to engage experienced industrial cybersecurity partners (such as Dragos) for vulnerability assessments, penetration tests, IRP workshops, and tabletop exercises to meet the new requirements and reduce operational risk.