Developing a Replicable, Group-Based Cybersecurity Assessment Methodology for Small and Rural Transit Operators

Despite years of education and advocacy, increased availability of free training and resources, increase funding availability, and new requirements for cybersecurity programs as a prerequisite for new federal discretionary grants or insurance, the gap in cyber resilience among small to mid-sized transit and their larger counterparts continues to grow.  Agencies continue to struggle not due to a lack of commitment but because of limited funding, insufficient expertise, and a clear regulatory mandate.

This project responds to this gap by developing a new approach to conducting National Institute for Standards and Technology (NIST) - based Cyber Resilience Reviews (CRR) for small and rural transit agencies. Unlike traditional individual assessments, this project will develop a group-based methodology that fosters shared learning and collective improvement to minimize shared vulnerabilities and risk among similar transit authorities.

U.S. DOT Priorities

The primary objective of this project is to strengthen the cyber resilience of small and rural transit agencies by developing a replicable innovative, collaborative approach to conducting NIST CRR– based cybersecurity assessments in group settings rather than individually, this project seeks to foster a culture of shared learning and best practices, benchmarking among peer agencies, and collective progress towards overall industry resiliency.  Doing so aligns with the U.S. DOT objectives of protecting critical infrastructure, advancing global competitiveness, and enhancing economic strength.  All sectors of critical infrastructure must be equally secure to ensure that “every community can connect to the people, places, and opportunities that make their lives meaningful.”