U.S. TSA / DHS Security Directive 1580/82-2022-01

Why does it matter?

The directive turns four security outcomes into plan-based duties that TSA inspects against: segmentation between operational technology (OT) and information technology (IT), access control, continuous monitoring and patching of Critical Cyber Systems. A railroad that cannot show an approved Cybersecurity Implementation Plan, an assessment schedule that reaches every measure within three years and the annual report to TSA cannot demonstrate compliance, and each revision lasts one year, so the evidence has to be kept current.

Key benefits include:

• Outcomes, not a control list

Section III states four outcomes and lets each railroad describe its own measures in a plan TSA approves, so the plan becomes the standard TSA inspects against.

• OT and IT separation

Zone boundaries, interdependencies and external connections must be listed, and OT services may not traverse the IT system unless encrypted or otherwise secured.

• Named detection and patching duties

Section III.D lists capabilities such as blocking malicious email and unauthorized code, and III.E requires prioritizing the CISA Known Exploited Vulnerabilities Catalog.

• Assessment with a fixed rhythm

Section III.F requires an architecture design review within 12 months of plan approval and every two years after, and at least one-third of measures assessed each year.

• Clear TSA access

Section IV lists the records TSA may inspect, from asset inventories and firewall rules to log files and network traffic captures of up to 24 hours.

How does it work?

Section II.A sets who is covered: freight railroad owner/operators subject to 49 CFR 1580.101 and additional freight and passenger railroads that TSA designates and notifies, with compliance deadlines set in that notice. The requirements apply to Critical Cyber Systems. An owner/operator that finds it has none must tell TSA in writing within 60 days of the effective date. The owner/operator stays responsible if a managed security service provider performs measures in its plan.

Section III.A requires the railroad to identify its Critical Cyber Systems, and positive train control systems must be included where PTC is required under 49 CFR part 236, subpart I. Sections III.B to III.E then require segmentation, access control, continuous monitoring and detection, and patching measures, all documented in the Cybersecurity Implementation Plan under section II.B. Once TSA approves the plan, the railroad implements it on the schedule the plan states.

Section III.F requires a Cybersecurity Assessment Plan, submitted within 60 days of plan approval and updated yearly for TSA approval, with an annual report of the previous year's assessment results. Section VI requires a request to amend the plan within 50 days of a permanent change, meaning one intended to last 45 days or more.

Key Elements

• Cybersecurity Implementation Plan

A TSA-approved plan describing the measures and schedule for sections III.A to III.E (section II.B).

• Network segmentation (III.B)

Lists of IT and OT interdependencies, external connections and zone boundaries, plus measures to prevent unauthorized communication between zones.

• Access control (III.C)

Password reset policy aligned with NIST SP 800-63, multi-factor authentication or equivalent, least privilege, limits on shared accounts and review of domain trust relationships.

• Monitoring and detection (III.D)

Email, malicious address and web-domain defenses, blocking of unauthorized code, baseline communications, logging and the ability to isolate industrial control systems.

• Patch management (III.E)

A risk-based strategy that prioritizes the CISA Known Exploited Vulnerabilities Catalog and adds mitigations where an OT patch would degrade operations.

• Cybersecurity Assessment Plan (III.F)

Architecture design review, red and purple team testing, one-third of measures assessed each year and an annual report.

• Records and amendments (IV and VI)

SSI handling under 49 CFR part 1520, documentation for TSA inspection and plan amendment requests within 50 days.

What does it cover?

The directive applies to freight railroad owner/operators identified in 49 CFR 1580.101 and to other freight and passenger railroads that TSA designates, and it covers their Critical Cyber Systems: any IT or OT system or data that, if compromised, could cause operational disruption. Section VII defines an Owner/Operator as a railroad carrier operating rolling equipment on the general railroad system of transportation. It does not set requirements for pipelines, which sit under the separate SD Pipeline-2021-02 series.

What are its objectives?

The directive is designed to reduce the risk that cyber threats pose to critical railroad operations and facilities through layered, defense-in-depth measures.

Keep the OT system able to operate safely if the IT system is compromised, through segmentation policies and controls.

Prevent unauthorized access to Critical Cyber Systems, whether local or remote.

Detect cybersecurity threats and correct anomalies that affect Critical Cyber System operations.

Reduce exploitation of unpatched operating systems, applications, drivers and firmware through timely, risk-based patching.

Assess regularly whether the approved measures work, and report results to TSA each year.

Framework in Context

TSA built this directive on the SD 1580-21-01 series, "Enhancing Rail Cybersecurity," which applies to the same railroads, and the SD 1582-21-01 series for public transportation and passenger railroads. Those earlier directives carry incident reporting to CISA, the cybersecurity coordinator, the incident response plan and the vulnerability assessment; SD 1580/82-2022-01 adds the plan-based outcomes and the testing. TSA has said it intends to codify these requirements through rulemaking, and the proposed rule Enhancing Surface Cyber Risk Management (89 FR 88488, docket TSA-2022-0001) would cover rail and pipeline owner/operators. Until a final rule exists, the directive series remains the binding instrument.

Common Framework Mappings

Railroads map the directive's sections to the frameworks below so that one set of plans, tests and evidence serves TSA, internal audit and other customers.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

NIST SP 800-82

PCI DSS 4.0.1

SOC 2