CISA divides the transportation systems sector into seven modes: aviation, highway and motor carrier, maritime, mass transit and passenger rail, pipelines, freight rail, and postal and shipping. Cyber rules differ by mode. This post covers two with sources we read: freight rail and maritime.
The seven modes
From CISA's page, with its figures:
- Aviation: about 19,700 airports, heliports and landing strips, roughly 500 with commercial service.
- Highway and motor carrier: over 4 million miles of roads and more than 600,000 bridges.
- Maritime: 361 ports and more than 25,000 miles of waterways.
- Mass transit and passenger rail.
- Pipelines: over 2.5 million miles.
- Freight rail: seven major carriers and over 138,000 miles of active track.
- Postal and shipping: about 720 million letters and packages daily.
DHS and the Department of Transportation are co-SRMAs for the sector. Some of these figures are dated, for example transit trips are from 2014.
Two modes with named rules
Freight rail. TSA Security Directive 1580-21-01 asked higher-risk freight railroads for a cybersecurity coordinator, incident reporting to CISA, a vulnerability assessment and an incident response plan. See our post on its four requirements.
Maritime. The Coast Guard rule, effective 16 July 2025, covers US-flagged vessels, OCS facilities and MTSA-regulated facilities, with reporting to the National Response Center and later deadlines in 2026 and 2027. See our post on its dates and duties.
For the other modes, we did not fetch a source, so check the relevant agency.
One sector, different clocks
A company that runs trucks, a warehouse and a port terminal can sit in several modes. Each may have its own reporting channel and clock. Make a one-page table of who you report to for each.
Practical steps
- Mark which modes your company touches.
- For each, find the lead agency and its current requirement.
- Keep one incident runbook with a branch per agency.
- Test the branch with a tabletop.
Safeguard offers compliance and evidence automation, which helps keep proof for more than one regime in one place.
Where mixed operators get caught
Logistics firms often sit in several modes without thinking of it that way. A trucking company with a warehouse and a yard at a port touches highway, maritime and possibly postal and shipping. Each can have a different agency and different reporting channel. The first step is simply to write down which modes you touch.
Suppliers also straddle modes. A software vendor whose product runs dispatch for freight rail and for port terminals may get two different sets of customer questions. Keeping one clear security file, with an SBOM and a patch policy, answers both with less effort.
Quick check
How many modes does CISA list?
Seven.
Do all modes share one cyber rule?
No. The two with sources here, freight rail and maritime, have separate rules and agencies.
Sources
- CISA: Transportation Systems Sector
- Federal Register notice on TSA directive
- Jones Walker: Coast Guard rule
Last reviewed: 19 October 2026.
