TSA's November 2024 record is a proposed rule for selected pipeline, rail, and over-the-road bus operators. A control register should preserve the proposal's status, covered population, requirement set, docket, and later authority instead of presenting proposed text as one current mandate.
NIST Cybersecurity Framework 2.0 provides a taxonomy of cybersecurity outcomes across six functions, including the added Govern function. The framework can structure an OT program and its evidence, but it does not prescribe a safe control design, determine site-specific risk, or prove that an industrial system is secure or compliant.
Directive (EU) 2022/2555 establishes staged reporting duties for significant incidents, but the operating clock depends on entity scope, national transposition, competent authority, awareness, significance, and the facts of the incident.