FTA Issues Safety Bulletin on Cybersecurity Events for Transit Agencies
7/29/2026
FTA has issued a Safety Bulletin to raise awareness of a cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency. Transit agencies are encouraged to review the information, assess whether it applies to their systems, and take the necessary steps to mitigate potential vulnerabilities.
Recommended immediate actions for transit agencies to take include:
- Disconnect programmable logic controllers (PLCs) from the public-facing internet.
- For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification.
- For devices that allow for software key switching, enable programming protection in PLC configuration software to limit who can modify PLCs remotely.
- Create and test strong backups of PLC logic and configurations.