CC tsa-compliance

| **Incident reporting** | "We've detected ransomware on our IT network. It hasn't reached our SCADA yet. Do we need to report to CISA?" |

2. **Ransomware response drill**: Malware detected on IT; test containment, backup integrity check, restoration procedure

| Penetration testing | Authorised simulated attack to test defences | IT; OT where safe and agreed |

| Red team exercise | Adversary simulation against CCS | Large/complex environments |

- Penetration testing in OT requires vendor coordination and operational approval

| Q3 | Penetration test (IT external + internal) | IT CCS |

Following the May 2021 Colonial Pipeline ransomware attack, TSA issued mandatory cybersecurity Security Directives requiring critical transportation infrastructure owners and operators to implement ba

- Ransomware infection confirmed on IT or OT systems

- Evidence of lateral movement in IT with potential path to OT

> "[Organisation Name], a [natural gas pipeline / freight railroad / transit agency] operator, is reporting a cybersecurity incident identified on [date/time]. We detected [ransomware/unauthorised acc

- Discovery of malware or ransomware on CCS

- Verifying containment procedures for a simulated ransomware event

- Assessment methodology: penetration testing, vulnerability scanning, configuration review, process review

- Focus on detecting: lateral movement, unusual protocol use, unauthorised devices, credential abuse