Cybersecurity Measures for Surface Modes

ICR 202111-1652-003

OMB: 1652-0074

Federal Form Document

Forms and Documents
Document
Name
Status
Supplementary Document
2021-11-30
Supplementary Document
2021-11-30
Supplementary Document
2021-11-30
Supplementary Document
2021-11-29
Supporting Statement A
2021-11-29
ICR Details
1652-0074 202111-1652-003
Active
DHS/TSA
Cybersecurity Measures for Surface Modes
New collection (Request for a new OMB Control Number)   No
Emergency 11/30/2021
Approved without change 11/30/2021
Retrieve Notice of Action (NOA) 11/30/2021
Terms of Clearance: Approved contingent that - within 90 days of this approval date - DHS TSA will publish a 60-day Federal Register notice seeking comments in accordance with 5 CFR 1320.8(d).
  Inventory as of this Action Requested Previously Approved
05/31/2022 6 Months From Approved
2,343 0 0
96,063 0 0
0 0 0

TSA intends to publish Security Directives (SD), which will be mandatory, and Information Circular (IC), which will be non-mandatory recommendations, to various surface transportation mode operators to address the ongoing cybersecurity threat using a risk-based approach to transportation security. The SDs would only apply to “Higher Risk” Railroads and Rail Transit operations and the IC would apply to lower-risk operations to enhance the surface transportation integrated system to include transit bus operations and over-the-road bus (OTRB) owner/operators.
Earlier this year, OMB approved, two emergency ICR requests from TSA to collect information via similar SDs directed to pipelines in order to address cybersecurity threats. On May 8, 2021, the Colonial Pipeline Company announced that it had halted its pipeline operations due to a ransomware attack. This attack received national attention as it temporarily disrupted critical supplies of gasoline and other refined petroleum products throughout the East Coast. Such attacks pose significant threats to the country’s transportation infrastructure and economic security as extensive interdependencies exist among transportation and other critical infrastructure sectors. During the last few years, cybersecurity incidents affecting surface transportation has become a growing threat to the integrated cyber and physical systems that operate daily in close coordination with and proximity nation-wide, and its uninterrupted secure and safe operation is critical for the U.S. economy. Malicious cyber actors have demonstrated their willingness to conduct cyber-attacks against critical infrastructure by exploiting the vulnerability of Internet-accessible Operational Technology (OT) and Information Technology (IT) systems and assets. Given the multitude of connected devices already in use by the surface transportation industry and the vast amount of data generated (with more coming online soon), protecting the higher-risk freight rail, passenger rail, and transit industry has become an increasing critically important and complex undertaking to protect critical infrastructure from malicious cyber-attack and other cybersecurity-related threats.

US Code: 49 USC 114(d), (f)(3)-(4), (l)(2), (m Name of Law: ATSA
  
None

Not associated with rulemaking

No

3
IC Title Form No. Form Name
Cybersecurity contingency/reponse plan
Cybersecurity vulnerability assessment
Designation of Cybersecurity Coordinator

  Total Approved Previously Approved Change Due to New Statute Change Due to Agency Discretion Change Due to Adjustment in Estimate Change Due to Potential Violation of the PRA
Annual Number of Responses 2,343 0 0 0 2,343 0
Annual Time Burden (Hours) 96,063 0 0 0 96,063 0
Annual Cost Burden (Dollars) 0 0 0 0 0 0
No
No
This is a new collection so there are no program changes.

$1,058
No
    Yes
    No
No
No
No
No
Christina Walsh 571 227-2062 [email protected]

  No

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
 
 
 
 
 
 
 
    (i) Why the information is being collected;
    (ii) Use of information;
    (iii) Burden estimate;
    (iv) Nature of response (voluntary, required for a benefit, or mandatory);
    (v) Nature and extent of confidentiality; and
    (vi) Need to display currently valid OMB control number;
 
 
 
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
11/30/2021


© 2024 OMB.report | Privacy Policy