Last verified: 2026-07-03

• Operational disruption (inability to safely operate, monitor, or control physical assets)
• Safety impact (risk to employees, passengers, or the public)
• Environmental impact (uncontrolled release of hazardous materials)
• National security impact

• Is available 24 hours a day, 7 days a week (or has a backup designee)
• Serves as the primary point of contact between the entity, TSA, and CISA
• Coordinates the entity's response to cybersecurity incidents
• Oversees implementation of the Cybersecurity Implementation Plan (CIP) / COIP
• Reports cybersecurity incidents to CISA within required timelines

• Unauthorised access to IT or OT systems
• Discovery of malware or ransomware on CCS
• Denial of service affecting operational capability
• Phishing or social engineering with confirmed system access

• Serve as 24/7 contact for TSA and CISA
• Coordinate implementation of cybersecurity measures
• Coordinate internal response to cybersecurity incidents
• Ensure incident reports are made to CISA within required timelines
• Maintain knowledge of the entity's CCS inventory

• Leadership structure: Accountable Executive with C-suite authority; designated Cybersecurity Coordinator
• CCS inventory: Complete list of Critical Cyber Systems within scope
• Network architecture description: Current IT/OT architecture; segmentation mechanisms; communication flows
• Baseline cybersecurity measures: How each of the four technical domains (below) is addressed
• Protective measures: Access controls, monitoring, patching procedures
• Incident detection procedures: How anomalies and threats are identified
• Incident response procedures: How incidents are contained, remediated, and reported
• Annual review process: How the CIP is kept current

• Roles and responsibilities for incident response
• Detection and analysis procedures
• Containment, eradication, and recovery procedures
• Communication procedures (internal, CISA, TSA, leadership)
• Post-incident review process
• Coordination with third-party vendors and OT vendors

• Isolating IT from OT (IT/OT segregation under incident conditions)
• Testing backup data integrity and restoration capability
• Verifying containment procedures for a simulated ransomware event
• Validating communication channels and escalation procedures

• Review current network topology diagrams (must be current and accurate)
• Assess IT/OT segmentation effectiveness (firewalls, DMZs, data diodes, unidirectional gateways)
• Identify unauthorised or undocumented network connections to CCS
• Assess remote access paths into OT environments
• Evaluate third-party / vendor connectivity to CCS
• Document findings and remediation plan

• Scope: which CCS and CRMP components are in scope for the assessment
• Assessment methodology: penetration testing, vulnerability scanning, configuration review, process review
• Assessment schedule: timeline for assessments during the year
• Responsible parties: internal or third-party assessors
• Reporting requirements: how results are reported to TSA

• Formal network segmentation policy
• Documented and enforced IT/OT boundary (firewall rules, DMZ architecture, or physical separation)
• No direct routable connections between corporate IT and OT/ICS networks without security controls
• Remote access to OT must go through a demilitarised zone (DMZ) or jump server
• All segmentation exceptions documented with business justification

• Current and accurate network topology diagrams
• Firewall ruleset documentation
• Segmentation testing results (at least annually via IRP test or ADR)

• Unique user accounts for all users; no shared accounts on CCS
• Multi-factor authentication (MFA) for all remote access to CCS
• MFA for all privileged access to CCS (local and remote)
• Principle of least privilege for all CCS accounts
• Privileged Access Management (PAM) for OT administrator accounts
• Regular access reviews (at minimum annually)
• Vendor/third-party remote access via time-limited, monitored sessions
• Immediate revocation of access upon termination

• Access control policy; account inventory; PAM solution configuration
• MFA deployment evidence for remote and privileged access
• Access review records

• Network monitoring for OT environments (OT-aware IDS/IPS or network detection and response)
• Log collection and retention from CCS (both IT and OT where feasible)
• Baseline establishment for normal OT communications (protocol, frequency, endpoints)
• Anomaly detection for deviations from OT baseline
• Alerting and escalation procedures for detected anomalies
• Monitoring of remote access sessions to CCS
• Integration or escalation path to Security Operations Centre (SOC)

• Passive monitoring preferred for OT (active scanning can disrupt industrial protocols)
• OT-aware tools: Claroty, Dragos, Nozomi Networks, Armis, Microsoft Defender for IoT
• Focus on detecting: lateral movement, unusual protocol use, unauthorised devices, credential abuse

• Formal patch management policy with defined patch SLAs
• Risk-based prioritisation: critical/high vulnerabilities patched faster than medium/low
• OT-specific process: vendor approval, testing in non-production environment before deployment
• Compensating controls for unpatchable legacy OT systems (network isolation, monitoring)
• Regular vulnerability scanning of CCS (both IT and OT-accessible)
• Exception process for patches requiring extended downtime (operational windows)

• Vendor approval required for many OT patches (to avoid voiding warranties/support)
• Patching windows may be limited to planned maintenance outages (quarterly, annual)
• Legacy PLC/RTU firmware may be unpatchable — compensating controls required

1. Ask: What sector? (pipeline, freight rail, passenger rail/transit, bus, aviation)
2. Ask: Has TSA specifically notified/designated this entity as covered?
3. Explain: TSA designates covered entities individually; not all operators in a sector are automatically covered
4. Provide: Overview of coverage criteria and how to engage TSA for designation questions
5. Note: The 2024 NPRM proposes broader coverage — if finalised, more entities will be subject to mandatory requirements

1. Ask: Which directive series applies? What sector? What revision is current for them?
2. Produce a table covering all four technical domains + CIP/COIP, IRP, ADR, CAP requirements
3. For each: Status (Compliant / Partial / Non-Compliant / N/A), Gap Description, Evidence Required
4. Highlight highest-risk gaps (no incident reporting process, no IT/OT segmentation, no Cybersecurity Coordinator)
5. Offer prioritised remediation roadmap

1. Ask: Which directive applies? Entity type and size? Existing architecture and tools?
2. Build the document following the required sections (see CRMP Component 1 above)
3. Ensure language is outcome-focused and maps to TSA review criteria
4. Flag sections requiring site-specific technical detail that cannot be generic
5. Note: CIP/COIP must be submitted to TSA for approval before use as compliance evidence

1. Provide the 24-hour CISA reporting requirement and contact information
2. Describe required IRP elements and annual testing obligations
3. Draft or review the IRP structure
4. Provide a step-by-step incident response playbook template aligned to TSA requirements

• Always include: Purpose, Scope, Policy Statement, Roles & Responsibilities, Procedures, Review Cycle, TSA Directive references
• Map each policy to the specific TSA directive section it satisfies

• references/tsa-directives-overview.md

  — All active directive series with revision history, covered sectors, and requirements summary

• references/tsa-crmp-requirements.md

  — Detailed CRMP component requirements: CIP/COIP, IRP, ADR, CAP, and the four technical domains with implementation guidance

• references/tsa-incident-reporting.md

  — Incident reporting procedures, CISA contact details, timelines, what qualifies as a reportable incident, and post-incident obligations

• Gap assessment or compliance review → load

  tsa-directives-overview.md

  +

  tsa-crmp-requirements.md

• Incident has occurred or user asks about reporting → load

  tsa-incident-reporting.md

• Architecture review or CIP/COIP drafting → load

  tsa-crmp-requirements.md

• User asks about which directive applies → load

  tsa-directives-overview.md

• NPRM or upcoming regulation questions → load

  tsa-directives-overview.md

This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.