[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-297785-105":59,"doc-detail-297785-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","tsa-surface-cyber-risk-management-anprm-comments-recommendations-for-harmonization-and-definitions","TSA Surface Cyber Risk Management ANPRM Comments - Recommendations for Harmonization and Definitions","","Comments on the Transportation Security Administration’s advance notice of proposed rulemaking for surface cyber risk management, thanking the agency for the opportunity to provide public input. The letter presents specific recommendations to improve cybersecurity across transportation modes, emphasizing harmonized regulatory requirements with other federal agencies, avoiding conflicts beyond cybersecurity, aligning definitions and shared frameworks, using accepted standards such as NIST, and clarifying concepts like critical cyber systems, compromise, malicious cyber activity, operational disruption, and cybersecurity incidents.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/tsa-surface-cyber-risk-management-anprm-comments-recommendations-for-harmonization-and-definitions/297785/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/tsa-surface-cyber-risk-management-anprm-comments-recommendations-for-harmonization-and-definitions/297785.png","ImageObject",300,407,{"name":92,"@type":93},"Eden","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-01","2026-09-18",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",11,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What is the purpose of the letter regarding TSA’s ANPRM?","Question",{"text":113,"@type":114},"It provides specific recommendations to improve cybersecurity across transportation modes, while not answering each ANPRM question directly.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Why does the letter emphasize harmonizing cybersecurity requirements?",{"text":118,"@type":114},"Because multiple regulators may mandate cybersecurity obligations, and inconsistencies or conflicts can create both security and compliance issues for transportation operators.",{"name":120,"@type":111,"acceptedAnswer":121},"Which definition-related issues does the letter highlight?",{"text":122,"@type":114},"It recommends using accepted standard definitions and notes that TSA’s current definition of “Critical Cyber Systems” is not grounded in existing statute or standards lexicon such as NIST, including concerns about operational disruption thresholds and scope.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},297785,1790010040,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":24,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145,"preview_page_count":4},1374391974468,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","January 31 , 2023  \nMr. Victor Parker  \nSurface Division, Policy, Plans, and Engagement Transportation Security Administration  \n6595 Springfield Center Drive Springfield, VA 22150  \nDear Mr. Parker,  \nThank you for the opportunity to provide comments to the Transportation Security Administration’s (TSA) advance notice of proposed rulemaking on surface cyber risk management. 1 We appreciate that TSA has requested public comments on enhancing surface cyber risk management because TSA’s aviation sector cybersecurity regulatory requirements are informed by TSA’s earlier work with the surface sector. Although we are not providing direct answers to each ANPRM question, we are providing specific recommendations that we believe will improve cybersecurity for all transportation modes. We recommend TSA consider the following:  \na. Harmonize cybersecurity regulatory requirements with other federal regulatory agencies. All transportation modes have touch points with multiple regulatory agencies. We recommend TSA coordinate its proposed cybersecurity regulatory actions with other regulators and agencies that are also mandating cybersecurity requirements on transportation operators. For the aviation sector, these include the Department of Defense, Securities and Exchange Commission, Federal Bureau of Investigations, Customs and Border Protection, and Cybersecurity and Infrastructure Security Agency, to name a few. TSA’s regulatory approach, scope and applicability overlaps with these regulators and agency’s existing and proposed cybersecurity requirements. Inconsistencies or conflicts must be avoided to prevent both security and compliance issues.  \nb. Harmonization must consider other regulatory requirements beyond cybersecurity. TSA’s cybersecurity requirements will impact other regulatory requirements. For example, as TSA considers aircraft within scope of proposed aviation cybersecurity requirements, its cybersecurity requirements will impact the FAA’s safety, airworthiness and aircraft certification requirements. A4A does not support TSA regulating aircraft and aircraft support information systems because it  \nclearly conflicts with existing FAA requirements. Conflicts such as this, highlights the need for TSAto discuss its cyber risk management program objectives, measures and goals with other  \n1 Nov. 30, 2022 (Docket TSA-2022-0001) .  \nregulators to ensure transportation operators are not required to select among conflicting regulations at the risk of noncompliance with a regulator’s requirements.  \nc. Modal equity should not drive sector policies. Although many cybersecurity practices and frameworks are applicable across transportation modes, the ecosystems, controls, contracts and a host of other differences make absolute model equity impractical. For example, although the aviation sector uses operational technology, it is not as dependent upon OT systems for operational execution as other modes of transportation. Over emphasizing controls, such as IT/OT segmentation , is less important than emphasizing outcomes more appropriate to this specific sector.  \nd. When modal equity does make sense, bring all modes together when developing shared definitions, frameworks and processes. For example, definitions such as “critical cyber systems” are foundational to all modes of transportation, yet other transportation sectors did not have an opportunity to provide comments and recommendations during the surface sector’s deliberations.  \ne. Use accepted standard definitions. We recommend all modes of transportation use the following definitions:  \ni. Critical cyber system: “Any Information Technology (IT) or Operational Technology (OT) system whose compromise, as a result of a malicious cyber activity, would result insubstantial operational disruption.\" TSA’s current definition of \"Critical Cyber Systems\" is not founded on existing lexicon within statute or standards organizations such as NIST.  \nii. System (Glossary | CSRC ([nist.gov](nist.","cbCaiqUVyxeAuMNN","https://ap.wps.com/l/cbCaiqUVyxeAuMNN","pdf",260719,"English","# Recommendations on harmonizing TSA cybersecurity requirements\n## Align cybersecurity rules with other federal regulators\n## Account for non-cyber regulatory overlaps and avoid conflicts\n# Modal equity and shared development of definitions\n## Ensure modal equity does not drive policies\n## Bring modes together for shared definitions and frameworks\n# Standardized terminology and definitions\n## Critical cyber system\n## System (glossary definition)\n## Compromise\n## Malicious cyber activity\n## Operational disruption\n## Cybersecurity incident","[{\"question\":\"What is the purpose of the letter regarding TSA’s ANPRM?\",\"answer\":\"It provides specific recommendations to improve cybersecurity across transportation modes, while not answering each ANPRM question directly.\"},{\"question\":\"Why does the letter emphasize harmonizing cybersecurity requirements?\",\"answer\":\"Because multiple regulators may mandate cybersecurity obligations, and inconsistencies or conflicts can create both security and compliance issues for transportation operators.\"},{\"question\":\"Which definition-related issues does the letter highlight?\",\"answer\":\"It recommends using accepted standard definitions and notes that TSA’s current definition of “Critical Cyber Systems” is not grounded in existing statute or standards lexicon such as NIST, including concerns about operational disruption thresholds and scope.\"}]","TSA Surface Cyber Risk Management ANPRM Comments - Recommendations for Harmonization and Definitions | PDF",1789748057,13]