View Information Collection Request (ICR) Package

OMB Control No: 1652-0074	ICR Reference No: 202606-1652-001
Status: Received in OIRA	Previous ICR Reference No: 202303-1652-001
Agency/Subagency: DHS/TSA	Agency Tracking No:
Title: Cybersecurity Measures for Surface Modes
Type of Information Collection: Revision of a currently approved collection	Common Form ICR: No
Type of Review Request: Regular	Date Submitted to OIRA: 09/01/2026

	Requested	Previously Approved
Expiration Date	36 Months From Approved	10/31/2026
Responses	377	2,562
Time Burden (Hours)	22,167	134,023
Cost Burden (Dollars)	0	0

Abstract: On December 17, 2021, TSA issued the Security Directive (SD) 1580-21-01 series, Enhancing Rail Cybersecurity, and the SD 1582-21-01 series, Enhancing Public Transportation and Passenger Railroad Cybersecurity, which remain in effect as revised, mandating TSA-specified Owner/Operators of “higher risk” railroads and rail transit systems, respectively, to implement an array of cybersecurity measures to prevent disruption and degradation to their infrastructure; these security directives became effective December 31, 2021. In addition, on October 18, 2022, TSA issued the SD 1580/1582-2022-01 series, Rail Cybersecurity Mitigation Actions and Testing, which applies to Owner/Operators of the “Higher Risk” freight railroads identified in 49 CFR 1580.101 and additional TSA-designated freight and passenger railroads. This security directive, which is complementary to the requirements in the previous directives, took effect on October 24, 2022. On October 26, 2022, OMB approved TSA’s request for an emergency approval, revising this information collection. See ICR Reference Number: 202210-1652-001. The collection covers both mandatory reporting under the security directives and collection of information voluntarily submitted under Information Circular (IC) 2021-01, Enhancing Surface Transportation Cybersecurity, which recommended voluntary implementation of actions and reporting by Owner/Operators not covered by the security directives. The OMB approval allowed for the additional institution of mandatory reporting requirements and collection of information voluntarily submitted. See ICR Reference Number: 202111-1652-003.

Authorizing Statute(s): US Code: 49 USC 114(d), (f)(3)-(4), (l)(2), (m Name of Law: ATSA

Citations for New Statutory Requirements: None

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
	Not associated with rulemaking

Federal Register Notices & Comments
60-day Notice:	Federal Register Citation:	Citation Date:
	91 FR 20475	04/16/2026
30-day Notice:	Federal Register Citation:	Citation Date:
	91 FR 56156	09/01/2026
Did the Agency receive public comments on this ICR? No

ICR Summary of Burden

	Total Request	Previously Approved	Change Due to Agency Discretion	Change Due to Adjustment in Estimate
Annual Number of Responses	377	2,562	-1,603	-582
Annual Time Burden (Hours)	22,167	134,023	-111,092	-764
Annual Cost Burden (Dollars)	0	0	0	0

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Miscellaneous Actions

Burden decreases because of Program Change due to Agency Discretion: Yes

Burden Reduction Due to: Miscellaneous Actions

Short Statement: No program changes. However, TSA made several adjustments to this collection to more accurately estimate the costs associated with this collection. TSA updated the number of Owner/Operators that are subject to the information collection required by the SD series. The collection previously applied to 73 Owner/Operators and now it applies to 67 Railroads and/or Passenger rail operations. TSA also updated the number of freight rail, passenger rail, and OTRB entities that are subject to the collection required by the SD series and IC series. The collection previously applied to 457 freight rail entities, 115 passenger rail entities, and 209 OTRB entities. This updated collection now applies to 449 freight rail entities, 242 passenger rail entities, and 72 OTRB entities. In addition, all industry wage rates have been updated from 2021 to 2023 values. Estimated hour burdens for respondents no longer include burden costs associated with the initial development and submission of the Cybersecurity Implementation Plans and the Cybersecurity Incident Response Plans. Owner/Operators to which this collection applies have already developed and submitted these plans to TSA. Accordingly, $3,200,067 in costs for Owner/Operators to develop Cybersecurity Implementation Plans and $6,532,377 in costs associated with the development of the Incident Response Plans are no longer included in the burden estimates. Similarly, the Cybersecurity Vulnerability Assessment is a one-time requirement that Owner/Operators have already completed. As a result, $3,429,433 in burden costs associated with the Vulnerability Assessment are no longer included. Time burden estimates have been updated to include costs associated with the requirement that Owner/Operators conduct an annual review of their Cybersecurity Implementation Plans and update their plans, if necessary. Previously, only the time burden costs associated with the initial development of the Implementation Plans had been included. Time burden estimates have also been updated to reflect the recurring annual cost of completing the Annual Assessment Plan Report, including the associated costs of conducting the assessment and producing the report. Burden costs associated with the designation of Cybersecurity Coordinators have also been adjusted, as Owner/Operators have already designated individuals to fill this role. The initial burden cost to all Owner/Operators for designating a Cybersecurity Coordinator, and an alternate, was previously estimated at $81,654. This initial cost to designate coordinators is no longer included, as the burden estimates have been revised to reflect the recurring annual costs of updating Cybersecurity Coordinator POC information, as required due to employee turnover and address updates.

Annual Cost to Federal Government: $117,269

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination. Yes

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination. No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

Agency Contact: Christina Walsh 571 227-2062 christina.walsh@tsa.dhs.gov

View ICR - Agency Submission