DHS locks in rail cyber defenses for another year
Published Date: 1/21/2025
Rule
Summary
The Department of Homeland Security just confirmed that important security rules for critical rail companies are extended for another year with some updates. These changes help rail operators stay safer from growing cyber threats and keep their systems strong. The new rules took effect in late 2023 and mid-2024, so rail owners need to keep up or face risks.
Analyzed Economic Effects
5 provisions identified: 0 benefits, 5 costs, 0 mixed.
Directives Ratified and Extended
The Transportation Security Oversight Board ratified TSA Security Directive 1580-21-01B, 1582-21-01B, and 1580/82-2022-01A on November 22, 2023, and ratified 1580/82-2022-01C on July 29, 2024. If you are an owner or operator of a critical rail entity, the requirements in those directives remain in effect and some series now run through dates including October 24, 2024 and May 2, 2025.
Must Implement TSA‑Approved Cyber Plans
Covered rail owners/operators must establish and implement a TSA-approved Cybersecurity Implementation Plan (CIP) and a Cybersecurity Assessment Program (CAP) and submit an annual plan describing how they will assess and fix vulnerabilities. These performance-based requirements were part of the 1580/82-2022-01 series extended on October 24, 2023 and revised again in 2024.
Ongoing Incident Reporting and Response Duties
The directives require covered owners/operators to report cybersecurity incidents to CISA, designate a 24/7 cybersecurity coordinator, conduct vulnerability assessments, and maintain a Cybersecurity Incident Response Plan (CIRP) with specified testing exercises. These requirements originate from the December 2021 directives and were extended and clarified in 2023 and 2024.
Positive Train Control Now Covered
Security Directive 1580/82-2022-01C (effective July 1, 2024) specifically requires owners/operators to include Positive Train Control (PTC) systems in their list of Critical Cyber Systems, making PTC subject to the directive's performance-based cybersecurity measures.
Potential for Further Extensions
The TSOB authorized TSA to extend each security directive beyond current expiration dates if: (1) no changes other than extending the expiration date are made, (2) the TSA Administrator affirmatively determines extension is warranted, and (3) that determination is documented and TSOB-notified. This authorization was part of the ratification actions on November 22, 2023 and July 29, 2024.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Related Federal Register Documents
2026-20087, Clarification of Certain Mariner Training Requirements
The Coast Guard wants to simplify training rules for certain mariners, like Masters and Officers in charge of smaller vessels and engineers with big engines. They’re removing six outdated or duplicate requirements to make things clearer and easier while matching international standards. If you’re affected, get ready to share your thoughts by December 30, 2026—no extra costs, just smoother sailing ahead!
2026-20016, U.S. Citizenship and Immigration Services Employment-Based Immigrant Visa, Fifth Preference (EB-5) Fee Rule
Starting November 30, 2026, USCIS is updating the fees for the EB-5 immigrant visa program, which helps investors and their families get green cards. These changes reflect new rules from the EB-5 Reform and Integrity Act of 2022 and include adjusted costs to keep the program fair and efficient. If you're applying or renewing your EB-5 visa after this date, be ready to pay the new fees!
2026-17390, Automated Commercial Environment (ACE) Electronic Export Manifest for Rail Cargo
Starting October 26, 2026, all rail cargo leaving the U.S. must have its export info sent electronically through the Automated Commercial Environment (ACE). This new rule helps Customs keep cargo safe and makes trade smoother for rail exporters. Rail companies and exporters should get ready because enforcement begins a year later, on October 26, 2027.
2026-17324, Fee for Certain H-1B Petitions
The Department of Homeland Security (DHS) proposes to establish a $103,265 fee, payable at the time of filing, for all H-1B cap-subject petitions, including those eligible for the advanced degree exemption, which would be imposed in addition to all other applicable fees or payments. This fee would serve as a dedicated revenue mechanism to help recover a portion of the federal government's costs of administering the lawful immigration system, including activities carried out by DHS, the U.S. Department of Justice (DOJ), the U.S. Department of State (DOS), and the U.S. Department of Labor (DOL).
2026-16313, Mandatory Electronic Filing (e-Filing)
This interim final rule (IFR) amends U.S. Department of Homeland Security (DHS) regulations to provide: USCIS may require mandatory electronic filing (e-filing) of certain benefit requests; the process USCIS will follow to require a benefit request to be e-filed; and how a waiver of the e-filing requirement for those individuals unable to file electronically may be requested. This rule is intended to increase digital intake and processing to move USCIS and requestors from a mostly paper process to an electronic process and further enhance the integrity of the immigration system and the security of the United States.
2026-14439, Establishing a Fixed Time Period of Admission and an Extension of Stay Procedure for Nonimmigrant Academic Students, Exchange Visitors, and Representatives of Foreign Information Media
Starting September 15, 2026, students, exchange visitors, and foreign media reps will get a fixed time to stay in the U.S. instead of an open-ended status. This change helps the government keep better track of who’s following the rules and makes extending stays clearer. It affects F, J, and I visa holders and could mean more careful planning and paperwork, but no new fees are mentioned.
Previous / Next Documents
Previous: 2025-01419, Adjustment of Civil Monetary Penalties for Inflation
Starting January 21, 2025, the Department of Education is raising its civil fines to keep up with inflation. This means anyone facing penalties for violations after November 2, 2015, will see updated, higher amounts to keep the fines fair and effective. These changes help make sure penalties stay strong enough to discourage bad behavior.
Next: 2024-30927, Investment of Customer Funds by Futures Commission Merchants and Derivatives Clearing Organizations
Starting February 21, 2025, futures commission merchants and derivatives clearing organizations must follow new rules on how they invest customer funds. These changes update what investments are allowed, set new limits to keep money safe, and change reporting requirements to the government. The goal? Protect your money better while keeping the market strong and transparent.