Pipeline and rail operators must now report cyberattacks to the government

The US Transportation Security Administration (TSA) wants to require pipeline and rail companies to report cyberattacks. It also wants to extend physical security reporting rules to these same companies.

For years, many critical infrastructure operators could keep cyber incidents quiet, managing them internally without public or regulatory scrutiny. This proposed rule means the government will get a clearer picture of the actual threat landscape for these vital systems. It also means companies will face new compliance costs and potential liability for failing to report.