Cybersecurity Policy Report, GOP Lawmakers Urge TSA to Seek ‘Balance’ in Transportation Sector Cyber Rules, (Mar 7, 2025)
Organizations Mentioned:Transportation Security Administration
Any cybersecurity rules imposed on the transportation sector by the Transportation Security Administration (TSA) should be “pragmatic and balanced” and developed in collaboration with the private sector, according to Republican leaders of the House Homeland Security Committee.
In a letter sent yesterday to Adam Stahl, TSA’s acting administrator, the lawmakers cited what they said were missteps by the TSA during the Biden administration following the 2021 ransomware attack on Colonial Pipeline.
“In response, TSA undertook an unprecedented expansion of cybersecurity regulatory efforts in the surface transportation sector, issuing mandatory cybersecurity directives across the pipeline and rail industries for the first time in the agency’s history,” they noted.
“These directives, which establish requirements for threat reporting, incident response, and mitigation measures, represent a significant departure from TSA’s traditionally voluntary and collaborative approach,” they said.
TSA is preparing to replace those post-Colonial Pipeline directives with rules developed through a notice of proposed rulemaking (NPRM) that was issued last year (CPR, Nov. 6, 2024).
“With the [NPRM’s] public comment period closing on February 5, 2025, evaluating the rule’s potential impact on security, regulatory compliance, and industry operations should be a priority,” according to the letter from Reps. Mark Green (R., Tenn.), the committee’s chairman, Andrew Garbarino (R., N.Y.), chairman of the committee’s cybersecurity and infrastructure protection subcommittee, Carlos Gimenez (R., Fla.), chairman of the transportation and maritime security subcommittee, and Sheri Biggs (R., S.C.), a committee member.
“TSA must ensure that its cybersecurity framework is not only effective but also agile enough to respond to multiple simultaneous cyber incidents that impact different nodes of the transportation sector without compromising operational continuity,” the lawmakers said.
“We are concerned that the Biden administration did not take this pragmatic and balanced approach to regulation for the Transportation Systems Sector, instead imposing more requirements on entities that already face a complex cyber regulatory landscape,” they said.
“A rigid or overly burdensome approach could impose operational challenges, while insufficient oversight may leave critical vulnerabilities unaddressed. Striking the right balance will require continuous engagement with industry partners, regular assessments of existing directives, and the flexibility to refine policies in response to emerging threats and technological advancements,” they added.
They asked Mr. Stahl to provide additional information about the rulemaking by March 27, including how robustly TSA engaged with the private sector and whether the Trump administration might adopt an approach different from the regulatory regime contemplated by the Biden-era NPRM.
News: FederalLegislation DataSecurity