RR-12 RR-12-08-01 — Cybersecurity and Rail Security Directives
This process outlines the cybersecurity and rail security directives for a US Class I freight railroad, focusing on implementing secure-by-design principles across various systems and ensuring compliance with TSA Security Directive 1580/82-2022-01 series.
🗺 BPMN Process Flow
Click diagram to zoom & pan • Scroll to zoom • Drag to pan • Download SVG
📋 Process Attributes
| Process ID | RR-12-08-01 |
|---|---|
| Domain Family | CORPORATE |
| L1 Domain | Technology, Data & Cybersecurity |
| L2 Process Group | Cybersecurity and Rail Security Directives |
| Trigger | Initiated by the CIO upon identification of new vulnerabilities or changes in regulatory requirements. |
| Outcome | Successful completion ensures that all railroad systems are compliant with cybersecurity directives, enhancing overall security posture and reducing risk exposure. |
| Systems | NetControl I-ETMS Cybersecurity — 'secure-by-design' approach (unbranded) |
| Regulatory Hooks | 49 CFR Part 1180 TSA Security Directive 1580/82-2022-01 series |
📋 L4 Process Steps
| Step | Name | Role | System | Input | Output | KPI | Pain Point / Risk | Decision? | Exception? |
|---|---|---|---|---|---|---|---|---|---|
| 1.1 | Identify Cybersecurity Threats | CIO | Cybersecurity — 'secure-by-design' approach (unbranded) | Threat intelligence reports | Threat assessment report | Number of identified threats per quarter | Inadequate threat detection tools | Y | N |
| 1.2 | Develop Security Policies | Enterprise Architect / Platform Owner | Cybersecurity — 'secure-by-design' approach (unbranded) | Threat assessment report | Security policy document | Number of security policies updated per year | Policy conflicts with existing operational procedures | N | Y |
| 1.3 | Implement Security Measures | Enterprise Architect / Platform Owner | NetControl, I-ETMS | Security policy document | System configuration updates | Percentage of systems secured by design | Resource allocation for security enhancements | Y | N |
| 1.4 | Conduct Security Audits | CIO | Cybersecurity — 'secure-by-design' approach (unbranded) | System configuration updates | Audit report | Number of security audits per year | Inconsistent audit findings | N | Y |
| 1.5 | Review and Update Policies | Enterprise Architect / Platform Owner | Cybersecurity — 'secure-by-design' approach (unbranded) | Audit report | Updated security policy document | Number of policy updates per year | Resistance to change in operational procedures | Y | N |
| 1.6 | Train Staff on Cybersecurity | CIO | Cybersecurity — 'secure-by-design' approach (unbranded) | Updated security policy document | Training completion certificates | Percentage of staff trained per year | Low engagement in training programs | N | Y |
| 1.7 | Monitor System Performance | Enterprise Architect / Platform Owner | NetControl, I-ETMS | System configuration updates | Performance metrics report | System uptime percentage | Inadequate monitoring tools | Y | N |
| 1.8 | Report Security Incidents | CIO | Cybersecurity — 'secure-by-design' approach (unbranded) | Performance metrics report | Incident report | Number of security incidents reported per year | Delayed incident reporting | N | Y |
| 1.9 | Investigate and Resolve Incidents | Enterprise Architect / Platform Owner | Cybersecurity — 'secure-by-design' approach (unbranded) | Incident report | Incident resolution report | Time to resolve incidents in hours | Resource constraints for incident response | Y | N |
| 1.10 | Update Security Measures | Enterprise Architect / Platform Owner | NetControl, I-ETMS | Incident resolution report | System configuration updates | Number of security measures updated per year | Resistance to change in system configurations | N | Y |
| 1.11 | Review and Improve Processes | CIO | Cybersecurity — 'secure-by-design' approach (unbranded) | Incident resolution report | Process improvement plan | Number of process improvements per year | Lack of visibility into process inefficiencies | Y | N |
| 1.12 | Document and Communicate Changes | Enterprise Architect / Platform Owner | Cybersecurity — 'secure-by-design' approach (unbranded) | Process improvement plan | Change management document | Number of changes communicated per year | Inconsistent communication channels | N | Y |
📊 KPIs & Risk Register
KPIs
Number of identified threats per quarter Number of security policies updated per year Percentage of systems secured by design Number of security audits per year Number of policy updates per year Percentage of staff trained per year System uptime percentage Number of security incidents reported per year Time to resolve incidents in hours Number of security measures updated per year Number of process improvements per year Number of changes communicated per year
Key Risks
Inadequate threat detection tools Policy conflicts with existing operational procedures Resource allocation for security enhancements Resistance to change in operational procedures Low engagement in training programs Inadequate monitoring tools Delayed incident reporting Resource constraints for incident response Resistance to change in system configurations Lack of visibility into process inefficiencies Inconsistent communication channels
Swim Lanes
CIO · 1.1, 1.4, 1.8 Enterprise Architect / Platform Owner · 1.2, 1.3, 1.5, 1.6, 1.7, 1.9, 1.10, 1.11, 1.12