TSA Security Directive 1580-21-01 told owners and operators of higher-risk freight railroads to do four things: name a cybersecurity coordinator, report incidents to CISA, complete a cybersecurity vulnerability assessment, and write an incident response plan. It took effect on 31 December 2021 and was set to expire a year later.
The four requirements
Per the Federal Register notice:
- Cybersecurity coordinator. A named person, available to TSA and CISA at all hours, who manages incidents and is the main contact.
- Incident reporting. Cybersecurity incidents are reported to CISA.
- Vulnerability assessment. The railroad finds gaps in current measures, identifies fixes and plans how to close them.
- Incident response plan. A plan to reduce the risk of operational disruption if information or operational technology systems are hit.
The notice does not give separate compliance deadlines for these items.
Why it matters even if it expired
The notice states the directive was to expire on 31 December 2022. TSA issued follow-on directives after that, but this post only relies on the notice, so check TSA for the current text and status before planning around any version.
The shape of the original is still a useful template. It is short, role based and operational. A railroad, or a supplier to one, can ask whether the same four items exist at their own firm.
What the four items look like in practice
- A coordinator needs a deputy and an on-call schedule. Hours of availability are the point.
- Reporting needs a drafted template and a rule for who may send it.
- A vulnerability assessment should include the software inventory behind signaling, dispatch and ticketing, not only servers.
- An incident response plan should say what staff do manually when systems fail, such as paper dispatch.
For suppliers
If you sell software to railroads, expect customers to ask who your coordinator equivalent is, how fast you will tell them about an incident, and whether you can supply an SBOM. Safeguard supports SBOM and dependency scanning and compliance evidence automation, which can help you answer those questions with files rather than promises.
Reading old directives for what they teach
Even an expired directive is a window into what a regulator thought mattered first. The four items are all about readiness and people: who answers the phone, who gets told, what is known to be weak and what staff do when things fail. None of the four names a specific technology. That is deliberate in an early directive, and it is also why the list is easy to copy into a contract or an internal policy.
If your organization has none of the four in writing, start with the coordinator. A named person with a phone number is the cheapest item and unlocks the other three.
Quick check
Which agency received the incident reports?
CISA, according to the notice.
Is the 2021 directive still the current rule?
The notice says it was set to expire on 31 December 2022. Check TSA for the version that applies now.
Sources
Last reviewed: 19 October 2026.
