tsa-compliance

TSA designates covered entities individually by sector, so not all pipeline, rail, or transit operators are automatically covered. Identify your sector, check whether TSA has notified or designated your entity, and review the applicable directive series such as SD Pipeline-2021, SD 1580-21-01, or SD 1582-21-01.

A CIP must include an Accountable Executive and Cybersecurity Coordinator, a Critical Cyber System inventory, network architecture description, measures across the four technical domains, incident detection and response procedures, and an annual review process. It must be submitted to TSA for approval before use as compliance evidence.

Report to CISA within 24 hours of identifying the incident via the 24/7 Operations Center at 1-888-282-0870 or [email protected], and also notify TSA. Initial reports can contain limited information, with follow-up updates as the investigation matures.

The four domains are network segmentation between IT and OT, access controls including MFA for remote and privileged access, continuous monitoring and anomaly detection for Critical Cyber Systems, and risk-based patch management with compensating controls for legacy OT systems.

No, the NPRM comment period closed in February 2025 but the final rule is not yet published, so existing Security Directives remain in force. The NPRM would formalize requirements into 49 CFR regulation, add bus operator incident reporting, and explicitly align with NIST CSF 2.0 and CISA CPGs.

TSA Security Directives are Sensitive Security Information, so full directive text is not publicly available and guidance is based on public summaries. The output is informational only, not legal advice, and entities should verify requirements against the current directive revision with TSA and qualified counsel.