Topic · tsa-sd

TSA Security Directives

TSA Security Directives for pipelines, aviation, and rail — a distinct critical-infrastructure cyber regime separate from CMMC and FedRAMP.

regulator
TSA submits insider-threat reporting ICR for OMB review
The useful change is standardization; the missing part is who must report, when, and what happens if they miss it.
The Transportation Security Administration sent a new insider-threat incident reporting tool information collection request to the Office of Management and Budget for Paperwork Reduction Act review. Organizations operating at TSA-regulated facilities face a mandatory reporting burden once OMB approves it, including details about potential insider threats and the people involved. TSA is moving from ad-hoc facility reporting toward structured incident data, but the approval timeline, covered entities and penalty structure remain unspecified.
JUL 11
trade-press
CRS pushes Congress toward CIRCIA reporting harmonization
The report turns a private compliance complaint into a congressional question: how much DHS agency autonomy is too much.
The Congressional Research Service identified three overlapping Department of Homeland Security cyber reporting regimes, CISA’s Cyber Incident Reporting for Critical Infrastructure Act rulemaking, Coast Guard rules and TSA’s surface transportation proposal, with different incident definitions, destinations and deadlines. Critical infrastructure primes, contractors, state CISOs and counsel could face parallel reporting tracks unless Congress harmonizes the frameworks or agencies reconcile them through CIRCIA and TSA rulemakings.
JUN 30

TSA submits insider-threat reporting ICR for OMB review