TSA Requires Aviation Sector to Enhance Cybersecurity Resilience

The US Transportation Security Administration (TSA) said on Tuesday that airport and aircraft operators will be required to improve their cybersecurity resilience.

The agency said the new cybersecurity requirements, issued through an emergency amendment, come in response to the persistent threats against the country’s aviation sector and other critical infrastructure.

Airport and aircraft operators are required to develop a plan for improving their resilience and preventing infrastructure disruption and degradation. In addition, they need to assess the effectiveness of their measures.

Aviation organizations that are regulated by the TSA are required to develop network segmentation controls and policies to ensure that OT systems are not disrupted by incidents affecting IT systems, and vice versa.

In addition, they need to create access control mechanisms to prevent unauthorized access to critical systems, implement incident detection and response policies and procedures, and ensure that their systems are not left unpatched.

Existing requirements for airport and aircraft operators included reporting significant cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA), having a point of contact for security issues, completing a vulnerability assessment, and creating an incident response plan.

The new requirements for the aviation industry come just months after the TSA issued a directive for improving the cybersecurity of railroad operations in the United States.

They also come just days after the White House released its National Cybersecurity Strategy.

“With this amendment and other ongoing efforts, TSA will continue to work closely with the Department of Transportation, CISA and industry partners to strengthen the cybersecurity resilience of the nation’s critical infrastructure,” the TSA said.

Source link