TSA Releases Proposed Rule to Enhance Pipeline and Railroad Cyber Risk Management
The Transportation Security Administration's ("TSA") proposed rule would require owners and operators of certain pipeline, freight railroad, passenger railroad, rail transit, and over-the-road bus ("OTRB") systems to strengthen their physical security and cybersecurity risk management practices against potential technology security incidents.
On November 6, 2024, TSA announced a Notice of Proposed Rulemaking (the "Rule") which focuses on enhancing cybersecurity risk management in the surface transportation sector. The Rule builds on TSA's security directives issued in the aftermath of a major cyber attack on the largest refined products pipeline in the United States in 2021. TSA seeks to reduce the risk and potential impact of a successful attack or cybersecurity incident on a pipeline, railroad, or OTRB system.
As proposed, the Rule would apply to owners/operators of certain pipeline, freight railroad, passenger railroad, rail transit, and OTRB systems with designated cybersecurity risk profiles. It would require those entities to establish a cybersecurity risk management ("CRM") program that includes:
- Conducting annual enterprise-wide cybersecurity evaluations to identify the entity's current cybersecurity profile compared to the target profile, and contain particular security outcomes and recommendations from the National Institute of Standards and Technology's Cybersecurity Framework;
- Developing a Cybersecurity Operational Implementation Plan that identifies the parties responsible for implementing its CRM program, and provides detailed measures for identifying, monitoring, and protecting critical systems; and
- Establishing a Cybersecurity Assessment Plan that identifies unaddressed vulnerabilities, as well as provides assessment schedules and an annual report of assessment results.
The Rule also tacks on incident notification obligations for certain OTRB owner/operators, requiring them to notify the Cybersecurity and Infrastructure Security Agency, or CISA, no later than 24 hours after a reportable security incident is identified. It also would require certain pipeline facilities and systems to designate a physical security coordinator to serve as the primary contact for physical security-related activities and intelligence with the TSA. Furthermore, OTRB owners/operators would be required to provide training for employees performing "security-sensitive" functions using a curriculum approved by TSA and in compliance with the schedule outlined in the Rule.
Companies that may be covered should carefully review the Rule and submit comments by February 5, 2025.
