TSA ISSUES NEW RULES REQUIRING AVIATION AND RAIL OPERATORS COMPLETE BASIC CYBER PREPARATIONS
January 3, 2022
On Thursday, December 2, 2021, the Transportation Security Administration (“TSA”) issued an Information Circular detailing new rules for the aviation and rail industries. Specifically, the rules require that high-risk freight rail, passenger rail and rail transit operators (1) designate a cyber coordinator; (2) report incidents to CISA within 24-hours; (3) conduct a vulnerability assessment of their systems; and (4) develop an incident response plan. In terms of the aviation industry, the TSA has said that large airports and aircraft operators would need to complete all four steps while smaller airports and aircraft operators would only be required to complete the first two steps, but are recommended to complete all four steps as well.
TSA’s new rules were issued in response to concerns expressed by the Biden administration about the U.S.’s cybersecurity as it relates to vital infrastructure. Earlier this year, TSA issued similar cyber directives for pipeline operators in response to the ransomware attack on the Colonial Pipeline, which caused gasoline supply issues, and shortages in the U.S.
The first two rules (i.e. the requirement of having a cyber-coordinator and an incident-reporting deadline) are now in effect for the aviation sector and the other two rules are expected to take effect in the coming weeks. The effective date of all four rules for the rail and aviation industries is December 31, 2021.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com 202-659-6622) or Drew Derco (dderco@eckertseamans.com 202-659-6665).
Share This Post
Authors
