- videocam Live Online with Live Q&A
- calendar_month December 9, 2025 @ 1:00 p.m. ET./10:00 a.m. PT
- signal_cellular_alt Intermediate
- card_travel Commercial Law
- schedule 90 minutes
Railroads and Cybersecurity Risk Management Requirements: Preparing for Implementation of TSA’s 2024 NPRM
Welcome! Strafford is now BARBRI! The expert courses you know from the trusted global leader in legal education.
Description
The rail industry has become increasingly digital and interconnected, which opens the door for hackers to exploit vulnerabilities in railroad systems as well as through suppliers and vendors to the industry. Beginning after the 2021 Colonial Pipeline ransomware incident, TSA used its emergency powers to issue, without notice and comment, a series of mandatory "directives" requiring railroad and other infrastructure entities to implement various cybersecurity measures. Then on Nov. 6, 2024, TSA issued an NPRM to permanently codify and expand the five previous directives.
When final, the rule is expected to impact almost 300 transportation entities: 73 freight railroads that move 94% of the rail freight in the U.S., 34 rail transit and passenger railroads, including Amtrak, and certain pipeline and over-the-road bus (OTRB) operations.
The proposed rule includes cybersecurity requirements developed by the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency. Higher risk entities, among other things, must establish and maintain a comprehensive cyber risk management program, have enhanced record-keeping and incident reporting obligations, perform continuous cybersecurity monitoring, and designate a physical security coordinator.
Listen as our renowned panel breaks down the NPRM and offers guidance to counsel for railroads and other transit entities on implementing these measures.
Presented By
Mr. Daugherty is a nationally recognized leader in data protection and privacy and is a partner in the Norton Rose Fulbright's data protection, privacy and cybersecurity group. Clients in a broad range of industries turn to Mr. Daugherty for his experience, practical solutions, and thought leadership on managing risks associated with data and technology, including assessing organizations' security postures; developing information security programs; privacy and cybersecurity training for boards, executives and employees; privacy compliance; incident response preparedness; and leading organizations through data security incidents. He has led organizations through hundreds of data security incidents, including many of the largest and most complex incidents in the world. Mr. Daugherty works closely with incident response teams and CISO's immediately after discovering a potential security incident to develop an effective strategy to understand what happened, contain and remediate the incident, address regulatory requirements, and build an effective communication strategy designed to preserve customer relationships and minimize the likelihood and consequences of regulatory investigations and litigation. In particular, he is highly sought for his expertise in Payment Card Industry matters, including managing payment card incident investigations, minimizing fees and assessments from the card networks, and counselling on compliance with PCI DSS. Mr. Daugherty also specializes in data security counselling of airlines, financial institutions, energy companies, retailers, hospitality and gaming companies, technology companies, and universities.
-
This 90-minute webinar is eligible in most states for 1.5 CLE credits.
-
Live Online
On Demand
Date + Time
- event
Tuesday, December 9, 2025
- schedule
1:00 p.m. ET./10:00 a.m. PT
Outline
I. Brief history of directives and NPRM
A. Objections
B. Grand Trunk, et al v. TSA, et al, ___ F.4th ___ (7th Cir. Aug. 21, 2025)
II. Key provisions for railroads
A. Conducting annual enterprise-wide cybersecurity evaluations
B. Developing a cybersecurity operational implementation plan
C. Establishing a cybersecurity assessment plan
D. Incident notification obligations
III. Compliance and enforcement
IV. Challenges to implementation
A. Legacy equipment
B. Interoperability in the industry
C. Costs
V. Best practices for implementation
Benefits
The panel will address these and other important issues:
- How does the NPRM fit in with executive orders on cybersecurity?
- How different is the NPRM from the prior directives?
- What can rail organizations do to begin to comply?
Unlimited access to premium CLE courses:
- Annual access
- Available live and on-demand
- Best for attorneys and legal professionals
Unlimited access to premium CPE courses.:
- Annual access
- Available live and on-demand
- Best for CPAs and tax professionals
Unlimited access to premium CLE, CPE, Professional Skills and Practice-Ready courses.:
- Annual access
- Available live and on-demand
- Best for legal, accounting, and tax professionals
Unlimited access to Professional Skills and Practice-Ready courses:
- Annual access
- Available on-demand
- Best for new attorneys
Related Courses
Protecting Federal Contracts and Grants Amid Executive Disruption: Navigating Stops, Suspensions, and Exits
Thursday, December 4, 2025
1:00 p.m. ET./10:00 a.m. PT
Railroads and Cybersecurity Risk Management Requirements: Preparing for Implementation of TSA’s 2024 NPRM
Tuesday, December 9, 2025
1:00 p.m. ET./10:00 a.m. PT
Recommended Resources
Navigating Modern Legal Challenges: A Comprehensive Guide
- Business & Professional Skills
- Career Advancement
How to Build a Standout Personal Brand Without Sacrificing Billable Hours
- Career Advancement