Meet TSA SD 1580/82-2022-01 rail cyber rules with evidence ready

TSA Security Directive 1580/82-2022-01 is a mandatory cybersecurity directive for US railroads titled Rail Cybersecurity Mitigation Actions and Testing. First issued in October 2022, it requires covered operators to identify Critical Cyber Systems, implement a TSA-approved Cybersecurity Implementation Plan for segmentation, access control, monitoring and patching, and run a Cybersecurity Assessment Program that tests those measures. TSA reissues it periodically with lettered revisions.

The directive applies to freight railroad carriers identified in 49 CFR 1580.101 and to other freight and passenger railroads that TSA designates. In practice this covers major freight railroads and higher-risk passenger rail operators. If TSA has not notified your organisation that it is covered, you are not directly bound, although customers that are covered may expect suppliers to support the same controls.

The current version is SD 1580/82-2022-01E, which TSA states is effective from 3 May 2026 to 2 May 2027 and supersedes 01D. Earlier revisions included 01A in October 2023, 01B in May 2024 and the corrected 01C in July 2024, which brought Positive Train Control systems within the scope of Critical Cyber Systems. Always check TSA's security directives page for the latest revision.

The plan must describe how the operator meets each security outcome in Section III: identifying Critical Cyber Systems, network segmentation so operational technology can keep running if IT is compromised, access control including multi-factor authentication and least privilege, continuous monitoring and detection, and a risk-based patch management strategy that prioritises CISA's Known Exploited Vulnerabilities catalogue. TSA must approve the plan, and the operator must then implement it on the agreed schedule.

The Cybersecurity Assessment Program is the directive's testing requirement. Operators must proactively assess whether the measures in their implementation plan are effective, including an architecture design review of the network and additional testing such as penetration testing. Since the 01A revision, the assessment plan is reviewed and submitted to TSA annually, and all cybersecurity measures must be assessed within a three-year period, with results reported to TSA.

Security directives issued under 49 U.S.C. 114(l)(2) are binding on covered owners and operators, and TSA inspects compliance and can take enforcement action, which may include civil penalties. The directive also requires operators to make records available to TSA to demonstrate compliance. Using a managed security service provider does not transfer responsibility: the operator remains accountable for meeting every requirement.

The directive is performance based and does not require certification to any standard, but TSA's informational supplement maps its requirements to the NIST Cybersecurity Framework and NIST SP 800-53 controls. Organisations already running an ISO 27001 or NIST CSF programme will find strong overlap in access control, logging and vulnerability management, though the directive adds rail-specific expectations around IT and OT segmentation and TSA plan approval.

Yes, on request. TSA SD 1580/82-2022-01 is mapped in OneClickComply's control library and can be enabled for your organisation, but it is not yet a live framework in the product. Once enabled, evidence collected for overlapping controls in frameworks such as NIST CSF or ISO 27001 counts towards it, and our audit team can advise on your implementation and assessment plans.