Topic · tsa-sd

TSA Security Directives

TSA Security Directives for pipelines, aviation, and rail — a distinct critical-infrastructure cyber regime separate from CMMC and FedRAMP.

RSS feed ↗

regulator
TSA Revises Surface-Mode Cybersecurity ICR, Routes Incidents to CISA
The revision formalizes what had been guidance-era incident reporting, pulling surface transportation operators into CISA's growing pipeline of mandatory disclosures.
TSA forwarded a revised Information Collection Request (OMB control number 1652-0074) to OMB for the surface-mode cybersecurity program, updating incident reporting to CISA, cybersecurity assessment requirements, and contingency planning obligations. The ICR covers designation of a Cybersecurity Coordinator, incident reporting, development of a contingency and recovery plan, and completion of a cybersecurity assessment. The notice was published September 1, 2026; the prior ICR extension dates to April 2022.
SEP 1
trade-press
GAO: TSA Hasn't Defined Its Aviation Cyber Role
FAA clearly assigned its responsibilities; TSA didn't, and industry stakeholders told GAO the confusion that creates is itself a risk.
The GAO found FAA has clearly defined the roles of the entities responsible for its aviation cybersecurity goals. TSA hasn't. Its 2018 Cybersecurity Roadmap is outdated, no longer aligned with DHS's latest cybersecurity strategy, and doesn't identify which offices are responsible for airport and aircraft operator security programs. Industry stakeholders told GAO they were confused about TSA's role and guidance. The FAA Reauthorization Act of 2024 mandated the review.
AUG 26
regulator
TSA submits insider-threat reporting ICR for OMB review
The useful change is standardization; the missing part is who must report, when, and what happens if they miss it.
The Transportation Security Administration sent a new insider-threat incident reporting tool information collection request to the Office of Management and Budget for Paperwork Reduction Act review. Organizations operating at TSA-regulated facilities face a mandatory reporting burden once OMB approves it, including details about potential insider threats and the people involved. TSA is moving from ad-hoc facility reporting toward structured incident data, but the approval timeline, covered entities and penalty structure remain unspecified.
JUL 11
trade-press
CRS pushes Congress toward CIRCIA reporting harmonization
The report turns a private compliance complaint into a congressional question: how much DHS agency autonomy is too much.
The Congressional Research Service identified three overlapping Department of Homeland Security cyber reporting regimes, CISA’s Cyber Incident Reporting for Critical Infrastructure Act rulemaking, Coast Guard rules and TSA’s surface transportation proposal, with different incident definitions, destinations and deadlines. Critical infrastructure primes, contractors, state CISOs and counsel could face parallel reporting tracks unless Congress harmonizes the frameworks or agencies reconcile them through CIRCIA and TSA rulemakings.
JUN 30

TSA Security Directives

TSA Revises Surface-Mode Cybersecurity ICR, Routes Incidents to CISA

GAO: TSA Hasn't Defined Its Aviation Cyber Role

TSA submits insider-threat reporting ICR for OMB review

CRS pushes Congress toward CIRCIA reporting harmonization