TSA Proposes Cyber-Risk Mandates for Pipelines, Transportation Systems

The Transportation Security Administration announced a Notice of Proposed Rulemaking to require cybersecurity risk management and incident reporting across surface transportation and aviation, extending NIST-aligned practices and CISA performance goals; the proposal mandates comprehensive risk programs, incident reporting to CISA, designation of a physical security coordinator, annual cybersecurity evaluations, vulnerability assessments, and operational implementation plans, affecting about 73 freight railroads, 34 public transit and passenger rail agencies, 71 over-the-road bus operators, and 115 pipeline facilities, with public comments open until Feb. 2, 2025, as part of efforts following the Colonial Pipeline ransomware incident.