The Transportation Security Administration issued a new cybersecurity directive requiring passenger and freight railroad carriers to create plans for responding to cybersecurity incidents and ransomware attacks by February 2023 and requires a Cybersecurity Assessment Program.