BarbriSFCourseDetails
  • videocam Live Online with Live Q&A
  • calendar_month December 9, 2025 @ 1:00 p.m. ET./10:00 a.m. PT
  • signal_cellular_alt Intermediate
  • card_travel Commercial Law
  • schedule 90 minutes

Railroads and Cybersecurity Risk Management Requirements: Preparing for Implementation of TSA’s 2024 NPRM

BarbriPdBannerMessage

Description

The rail industry has become increasingly digital and interconnected, which opens the door for hackers to exploit vulnerabilities in railroad systems as well as through suppliers and vendors to the industry. Beginning after the 2021 Colonial Pipeline ransomware incident, TSA used its emergency powers to issue, without notice and comment, a series of mandatory "directives" requiring railroad and other infrastructure entities to implement various cybersecurity measures. Then on Nov. 6, 2024, TSA issued an NPRM to permanently codify and expand the five previous directives.

When final, the rule is expected to impact almost 300 transportation entities: 73 freight railroads that move 94% of the rail freight in the U.S., 34 rail transit and passenger railroads, including Amtrak, and certain pipeline and over-the-road bus (OTRB) operations.

The proposed rule includes cybersecurity requirements developed by the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency. Higher risk entities, among other things, must establish and maintain a comprehensive cyber risk management program, have enhanced record-keeping and incident reporting obligations, perform continuous cybersecurity monitoring, and designate a physical security coordinator.

Listen as our renowned panel breaks down the NPRM and offers guidance to counsel for railroads and other transit entities on implementing these measures.

Presented By

Will Daugherty
Head of Cybersecurity, United States
Norton Rose Fulbright LLP

Mr. Daugherty is a nationally recognized leader in data protection and privacy and is a partner in the Norton Rose Fulbright's data protection, privacy and cybersecurity group. Clients in a broad range of industries turn to Mr. Daugherty for his experience, practical solutions, and thought leadership on managing risks associated with data and technology, including assessing organizations' security postures; developing information security programs; privacy and cybersecurity training for boards, executives and employees; privacy compliance; incident response preparedness; and leading organizations through data security incidents. He has led organizations through hundreds of data security incidents, including many of the largest and most complex incidents in the world. Mr. Daugherty works closely with incident response teams and CISO's immediately after discovering a potential security incident to develop an effective strategy to understand what happened, contain and remediate the incident, address regulatory requirements, and build an effective communication strategy designed to preserve customer relationships and minimize the likelihood and consequences of regulatory investigations and litigation. In particular, he is highly sought for his expertise in Payment Card Industry matters, including managing payment card incident investigations, minimizing fees and assessments from the card networks, and counselling on compliance with PCI DSS. Mr. Daugherty also specializes in data security counselling of airlines, financial institutions, energy companies, retailers, hospitality and gaming companies, technology companies, and universities. 

Credit Information
  • This 90-minute webinar is eligible in most states for 1.5 CLE credits.


  • Live Online


    On Demand

Date + Time

  • event

    Tuesday, December 9, 2025

  • schedule

    1:00 p.m. ET./10:00 a.m. PT

I. Brief history of directives and NPRM

A. Objections

B. Grand Trunk, et al v. TSA, et al, ___ F.4th ___ (7th Cir. Aug. 21, 2025)

II. Key provisions for railroads

A. Conducting annual enterprise-wide cybersecurity evaluations

B. Developing a cybersecurity operational implementation plan

C. Establishing a cybersecurity assessment plan

D. Incident notification obligations

III. Compliance and enforcement

IV. Challenges to implementation

A. Legacy equipment

B. Interoperability in the industry

C. Costs

V. Best practices for implementation

The panel will address these and other important issues:

  • How does the NPRM fit in with executive orders on cybersecurity?
  • How different is the NPRM from the prior directives?
  • What can rail organizations do to begin to comply?