[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-297789-105":59,"doc-detail-297789-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","security-directive-158082-2022-01c-rail-cybersecurity-mitigation-actions-and-testing-memorandum","Security Directive 1580/82-2022-01C - Rail Cybersecurity Mitigation Actions and Testing - Memorandum","","Memorandum from the U.S. Transportation Security Administration to covered railroad owner/operators issuing Security Directive 1580/82-2022-01C, a limited correction to the 1580/82-2022-01 series effective May 2, 2024 and expiring May 2, 2025. The directive maintains performance-based cybersecurity requirements for railroads under specified CFR applicability and clarifies physical security alternatives for positive train control components. It also adds a definition for “business critical functions,” explains non-SSI handling, and requires written email confirmation of receipt and submission of queries to TSA.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/security-directive-158082-2022-01c-rail-cybersecurity-mitigation-actions-and-testing-memorandum/297789/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/security-directive-158082-2022-01c-rail-cybersecurity-mitigation-actions-and-testing-memorandum/297789.png","ImageObject",300,407,{"name":92,"@type":93},"Genevieve","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-19","2026-09-18",true,{"@type":102,"interactionType":103,"userInteractionCount":34},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is Security Directive 1580/82-2022-01C correcting?","Question",{"text":112,"@type":113},"It issues a correction to the most recent revision of the Security Directive 1580/82-2022-01 series, adding a definition of “business critical functions” and clarifying application of alternate securing methods for certain positive train control (PTC) components.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does the directive address physical security for PTC components?",{"text":117,"@type":113},"For specified PTC hardware and software components on freight and passenger locomotives, covered owner/operators may rely on physical security measures used to meet other CFR requirements, instead of implementing the referenced Section III.C.1-5 requirements. The Cybersecurity Implementation Plan must specify the physical security measures used to prevent unauthorized access.",{"name":119,"@type":110,"acceptedAnswer":120},"Is this security directive treated as Sensitive Security Information (SSI)?",{"text":121,"@type":113},"No. The memorandum states the directive is not marked as SSI because TSA previously determined that public disclosure would not be detrimental to transportation security.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},297789,1789748072,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":34,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":129,"read_time":144,"preview_page_count":4},1374391974585,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","U.S. Department of Homeland Security  \nTransportation Security Administration  \n6595 Springfield Center Drive Springfield, Virginia 20598  \nMEMORANDUM  \nTo: Covered Railroad Owner/Operators  \nDate: July 1, 2024  \nSubject: Issuance of Security Directive 1580/82-2022-01C: Rail Cybersecurity Mitigation Actions and Testing  \nAttached to this memorandum is Security Directive 1580/82-2022-01C, Rail Cybersecurity Mitigation Actions and Testing. Based on industry feedback TSA is issuing this correction to the most recent revision to the Security Directive 1580/82-2022-01 series, which took effect on May 2, 2024, and expires May 2, 2025. The expiration date is not affected by this correction.  \nThis security directive series applies to each freight railroad carrier identified in 49 CFR § 1580.101 and other TSA-designated freight and passenger railroads. If TSA revises the applicability of the  \nSecurity Directive 1580/82-2022-01 series in the future by designating additional railroad Owner/Operators, TSA will notify these Owner/Operator(s) and provide specific compliance deadlines for the requirements in this security directive.  \nThe issuance of this security directive maintains TSA’s performance-based cybersecurity requirements, which were first issued in October 2022, and includes limited revisions. This correction adds the definition of“business critical functions” and clarifies the application of the alternate methods of securing positive train control (PTC) system components in locomotives in Section III.C.6.  \nThe security directive changes are summarized in the table below.  \n\n| Section III.C.6. |\n| --- |\n| This revised section clarifies that Owner/Operators subject to 49 CFR 232.105(h)(1-4) (General requirements for locomotives), 49 CFR 236.3 (Locking of signal apparatus housings), or 49 CFR 236.553 (Seal, where required) may, for PTC hardware and software components installed on freight and passenger locomotives of the PTC system, rely on the physical security measures used to comply with these requirements, as applicable, in lieu of implementing the requirements in Section III.C.1.-5 . of this security directive. Owner/Operators must specify in their Cybersecurity Implementation Plan what physical security measures it uses to prevent unauthorized access to PTC components installed on locomotives. This alternative only applies to the components identified in this paragraph. |\n| Section VII. |\n| This revised section adds a definition for business critical functions, which was unintentionally omitted from Security Directive 1580/82-2022-01B. For the purpose of this security directive |\n\nseries, business critical functions means the Owner/Operator’s determination of capacity or capabilities to support functions necessary to meet operational needs and supply chain expectations. The use of this term within the context of“operational disruption” is not intended to change the scope of which systems must be identified as critical.  \nConsistent with TSA’s previous determination, this security directive is not marked as Sensitive Security Information (SSI) . While security directives generally are categorically deemed SSI under TSA’s regulations (49 CFR part 1520), TSA previously determined that the contents ofthis security directive would not be detrimental to transportation security if publicly disclosed. No revisions to the Information Collection Request previously approved by the Office of Management and Budget are necessary to accommodate any information collected under the revision.  \nThe security directive requires that railroad Owner/Operators provide written confirmation of receipt via email to [SurfOpsRail-SD@tsa.dhs.gov. All queries](SurfOpsRail-SD@tsa.dhs.gov. All queries) concerning the attached security directive should be [submitted to TSA at TSA-Surface@tsa.dhs.gov](submitted to TSA at TSA-Surface@tsa.dhs.gov).  \nDavid P. Pekoske Administrator  \nTransportation Security Administration  \nAttachment: Security Directive 158","cbCaiiUwLDpKGjZB","https://ap.wps.com/l/cbCaiiUwLDpKGjZB","pdf",389624,18,"English","# Purpose and General Information\n## Scope and Applicability\n## Performance-Based Cybersecurity Requirements\n## Summary of Security Directive Changes","[{\"question\":\"What is Security Directive 1580/82-2022-01C correcting?\",\"answer\":\"It issues a correction to the most recent revision of the Security Directive 1580/82-2022-01 series, adding a definition of “business critical functions” and clarifying application of alternate securing methods for certain positive train control (PTC) components.\"},{\"question\":\"How does the directive address physical security for PTC components?\",\"answer\":\"For specified PTC hardware and software components on freight and passenger locomotives, covered owner/operators may rely on physical security measures used to meet other CFR requirements, instead of implementing the referenced Section III.C.1-5 requirements. The Cybersecurity Implementation Plan must specify the physical security measures used to prevent unauthorized access.\"},{\"question\":\"Is this security directive treated as Sensitive Security Information (SSI)?\",\"answer\":\"No. The memorandum states the directive is not marked as SSI because TSA previously determined that public disclosure would not be detrimental to transportation security.\"}]","Security Directive 1580/82-2022-01C - Rail Cybersecurity Mitigation Actions and Testing - Memorandum | PDF",45]