Advancing Transit Cybersecurity, System Assurance, and Artificial Intelligence Governance

ETHAN S. LEE
Business Operations & Development Analyst
Max Cybersecurity LLC

Cybersecurity Challenges in 2027 and Beyond

A public transit system can seem to work normally but still may not be safe to trust. As artificial intelligence (AI) becomes part of maintenance, daily operations, and technology supplied by outside companies, transit leaders face an important question: What proof do they have that the systems needed for safe and reliable service are working the way they should?

This question is changing how transit agencies think about cybersecurity. They already face problems involving technology that controls physical equipment, old infrastructure, and systems that are becoming more connected. Now, transit agencies must protect important systems, find and reduce cyber threats, and make sure their systems remain safe to use as new AI-related cyber risks appear. These problems do not affect only computers and software. A cyberattack or other digital problem can affect vehicles, signals, the electricity that powers trains, communications, maintenance, the coordination of vehicles and workers, and ultimately an agency's ability to provide safe and dependable service.

These issues were the main focus of the American Public Transportation Association's (APTA) Transit Cybersecurity Working Group (TCSWG) annual meeting. The meeting took place September 28–29 at APTA headquarters in Washington, DC. It brought together transit agencies, federal government partners, cybersecurity professionals, and industry experts. The meeting continued the group's work of turning real-world industry experience into recommended ways of working, guidance for improving cybersecurity capabilities, and clear priorities for action. The goal was not just to share what people had noticed.

Going Beyond Following Rules to Keeping Services Running

One important message from the meeting was that simply following cybersecurity rules is no longer enough. Transit agencies use many complicated systems that are increasingly connected. These include information technology, technology that controls physical equipment, communications, vehicles, cloud services, remote maintenance tools, and systems operated by outside companies. Many operational technology (OT) systems also use older equipment. This equipment cannot always be updated with security fixes, checked for problems, or separated from other systems in the same way as ordinary information technology (IT) equipment.

This raises a bigger question for transit leaders: Can important transit services keep running safely when part of the system has been disrupted or can no longer be fully trusted?

The meeting discussions stressed that agencies need to know which systems are necessary for important services and how those systems depend on one another. Agencies also need to understand what other safety and security measures they can use when standard cybersecurity protections are not possible. This practical approach is an important part of the working group's work: helping agencies turn technical requirements into guidance they can actually use in complicated transit systems.

AI Brings New Cybersecurity Challenges

Artificial intelligence makes these problems even more complicated. AI does not enter transit agencies only through projects that are clearly labeled as AI projects. It can also be built into products, software updates, tools that study data, maintenance systems, and other technology that an organization already uses. This means a transit agency might be using AI without knowing exactly where it is being used or how it affects decisions about daily operations.

At the same time, AI can give people who carry out cyberattacks more powerful tools. This means agencies need to look again at how they find cyber threats and respond to them. The meeting also highlighted another problem: AI built into products from outside suppliers may affect which maintenance jobs get done first, which warnings appear, or what decisions workers make. Yet these AI features might not appear on an agency's official list of AI projects.

For transit agencies, this means managing and overseeing AI is not just a technology issue. It is also an issue that affects everyday operations. Agencies need to know where AI is used, what information it relies on, which decisions it can affect, who is responsible for those decisions, and when people must continue to have real control over them.

The TCSWG discussions suggested an approach to managing AI based on how much risk it creates. This would include finding where AI is used, checking AI when buying products and services, deciding when its use should be allowed, continuing to monitor it, and making sure AI features can be turned off when necessary.

Building Confidence That Systems Are Safe and Reliable

These challenges also led meeting participants to discuss a new area that TCSWG is exploring, called System Assurance. The working group has not announced an officially accepted standard. Instead, it is looking at how transit agencies can use evidence to build confidence that the systems their services depend on can be trusted.

System Assurance means being able to build and maintain confidence, using evidence, that important transit systems and the other systems they depend on work safely, securely, reliably, and as they are supposed to.

This idea addresses an important problem. A system may still be running even when nobody is sure it has been protected from unwanted changes or interference. During a cyber incident, agency leaders may need to decide whether to keep services running, limit operations, separate a system from other systems, or start restoring services before every technical question has been answered.

System Assurance is about having enough recent and useful evidence to make those decisions. That evidence can include information about how systems are set up, which systems depend on each other, who has permission to access them, results from tests of how they work, information from suppliers, the ability to recover after problems, and records of what systems look like when they are known to be working correctly. The goal is not to remove every doubt. It is to give decision-makers better information so they can decide which systems can be trusted, what is still uncertain, and which actions can be taken safely.

Turning Teamwork into Practical Steps

The September meeting was not just about finding cybersecurity problems. Its purpose was also to help the working group develop practical tools and guidance that transit agencies can use. APTA also wanted to bring together the experience of transit agencies, federal partners, and industry specialists to support its work of developing industry standards.

The discussions identified three main areas of possible work for 2027. The first is choosing five important cybersecurity requirements for buying operational technology, using material from the North American Transit Cybersecurity Agreement (NATCA). The second is developing recommended guidance for checking and studying operational technology systems. The third is exploring ways to manage AI and apply System Assurance specifically to public transit. Other topics included guidance for making decisions during operations, ways to measure how well security measures work, and ways to check whether outside suppliers and their systems can be trusted. These are ideas for the working group to review further. They are not official requirements that have already been approved.

As transit technology continues to change, the industry will need to treat cybersecurity, physical infrastructure, technology that controls equipment, artificial intelligence, and system safety as connected challenges rather than separate problems.

For 2027 and the years after, the main question is not simply whether public transit agencies are following the rules or whether their systems are still running. The bigger question is whether the industry can provide the evidence, practical guidance, and confidence needed to keep public transportation safe and reliable when important systems face problems. By working together to create tools and guidance designed specifically for transit agencies, TCSWG has an opportunity to help agencies answer that question.