How to Respond to TSA’s New Cybersecurity Reporting Standards for US Rail Operators
Summary: Congress passed H.R. 3684, the Infrastructure Investment and Jobs Act, allocating $91 billion to US rail and air infrastructure, and the Biden administration outlined new cybersecurity reporting standards for US rail operators covering all freight rail, passenger rail, and rail transit carriers. DHS also requires air operators to apply the first two directives, but not the final two at this time.
What's compelling: The reporting requirement forces rail operators to define what a 'cybersecurity incident' is and to deploy endpoint or network monitoring - including onboard rolling stock - to detect one, and the Office and Communication segments of PTC and I-ETMS networks are the terrain an attacker must compromise to affect equipment under control.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026