2026-07364NoticeWallet

TSA Revises Cyber Measures Reporting for Surface Transport

Published Date: 4/16/2026

Notice

Summary

The TSA is updating how it collects info about cybersecurity for surface transportation like buses and trains. They want to make sure companies have a Cybersecurity Coordinator, report cyber incidents, and have plans to fix problems. If you’re involved, get ready to share updated info by June 15, 2026, helping keep travel safe without extra hassle or cost.

Analyzed Economic Effects

5 provisions identified: 0 benefits, 5 costs, 0 mixed.

Plans, Assessments, and Annual Reporting Required

Covered Owner/Operators must: submit a Cybersecurity Implementation Plan for TSA approval; submit a Cybersecurity Assessment Plan and an annual report of assessment results; develop a Cybersecurity Incident Response (contingency/recovery) Plan; and complete and submit a TSA cybersecurity vulnerability assessment form. These materials may be submitted via the TSA Secure Regulatory Portal or retained locally for review.

Estimated Respondent Counts and Total Hour Burden

TSA estimates the collection applies to 846 total respondents and that the total annual hour burden is 210,684 hours. TSA also provided breakdowns: 73 Owner/Operators for SD 1580/82-2022-01; 449 railroad Owner/Operators; 242 public transportation and rail transit Owner/Operators; and 72 over-the-road bus Owner/Operators.

72‑Hour Cyber Incident Reporting Requirement

Owner/Operators covered by the Security Directives must report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) as soon as practicable and no later than 72 hours after identifying an incident under 49 CFR 1570.203. This reporting requirement is mandatory under the Directives and is a part of TSA's information collection.

Must Name Cybersecurity Coordinators

If you run a railroad, transit agency, or over-the-road bus company, you must provide TSA contact information for a primary Cybersecurity Coordinator and at least one alternate. This requirement is part of TSA's cybersecurity information collection and applies to Owner/Operators covered by the Security Directives and Information Circulars.

New STA Requirement for Non‑U.S. Coordinators

TSA now requires that any non-U.S. citizen who serves as a primary or alternate Cybersecurity Coordinator be a current member of NEXUS, Global Entry, or another TSA‑determined program with a comparable security threat assessment, and submit proof of that membership. TSA notes this revision became effective January 15, 2026 and expects nine or fewer Owner/Operators to respond annually; TSA estimated a 0.25 hour burden per respondent and an additional 2 hours each if a fingerprint-based criminal history check is required.

Your PRIA Score

Score Hidden

Personalized for You

How does this regulation affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this federal register document and every other regulation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Key Dates

Effective Date
Published Date
Comments Due
1/15/2026
4/16/2026
6/15/2026

Department and Agencies

Department
Independent Agency
Agency
Homeland Security Department
Transportation Security Administration
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register