APTA, Industry Help Shape New Cybersecurity Framework Community Profile

The National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE) has released the Transit Cybersecurity Framework (CSF) Community Profile, providing public transit agencies with a common baseline for assessing and strengthening their cybersecurity programs.

Developed with input from APTA, transit agencies, and public- and private-sector cybersecurity experts, the profile applies the NIST CSF 2.0 to the unique operational environment of public transit. It organizes transit cybersecurity priorities, and established standards, guidance, and resources using an internationally recognized framework that is already widely used across industries and organizations of different sizes and levels of cybersecurity maturity. The profile also provides a common structure that agencies can use to understand their current capabilities, identify cybersecurity gaps, prioritize investments, coordinate with partners and suppliers, and strengthen existing cybersecurity programs.

APTA helped connect the NIST NCCoE with transit leaders and subject-matter experts and encouraged agencies to review and comment on the draft profile. Earlier this year, APTA hosted a webinar featuring NIST and MITRE to introduce the draft and encourage participation in the public review process. The knowledge and real-world experience contributed by APTA members and other transit stakeholders helped ensure the final profile addresses the operational realities and cybersecurity priorities of the industry.

NIST NCCoE marked the release of the profile with a webinar. Sept. 1 featuring transit and cybersecurity leaders. Participants discussed why the Transit CSF Community Profile was developed, cybersecurity challenges facing the transit sector, and how agencies can put the profile into practice. The discussion reinforced an important point: effective cybersecurity is not solely a technology issue. Governance, organizational practices, operational planning, supply chain relationships, and workforce behavior all contribute to an agency’s ability to manage risk.

The release of the Transit CSF Community Profile gives the industry something particularly valuable: a common starting point. Individual transit agencies will continue to have different systems, operating environments, resources, and risk profiles, but they no longer need to approach cybersecurity without a shared framework for determining what good cybersecurity risk management should encompass.

APTA will continue bringing together transit agencies, suppliers, government partners, and cybersecurity experts to share knowledge and advance best practices across the industry. The Transit CSF Community Profile provides a strong foundation for that work, and a practical tool that agencies can use to move from understanding cyber risk to systematically managing it.