Building a Practical Path to ITS Cybersecurity Compliance

Author: Elijah Pichler

Ensuring Intelligent Transportation System (ITS) cybersecurity compliance is not as simple as following a single checklist. Transportation agencies manage a wide range of connected technologies and face growing cyber risks as they connect vehicles, traffic signals, sensors, and control centers. The challenge is that there is no single document that says, “Follow these exact steps and your ITS ecosystem will be compliant.” Instead, agencies rely on established cybersecurity frameworks, standards, and guidance documents to build a secure and trusted transportation environment.

Understanding ITS Cybersecurity Compliance

One of the most important resources to transportation agencies is the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The framework provides a structured approach for managing cybersecurity risks through six core Functions:

Govern: Establishes and oversees cybersecurity policies, strategy, and risk management within enterprise risk frameworks.
Identify: Recognizes assets, risks, and vulnerabilities to inform security priorities and improvements.
Protect: Implements safeguards to reduce cybersecurity risks.
Detect: Identifies and analyzes potential cybersecurity threats, anomalies, and incidents.
Respond: Takes action to contain, mitigate, and communicate cybersecurity incidents.
Recover: Restores affected systems and operations while ensuring resilience and transparency.

Each Function is further divided into Categories and Subcategories that provide more detailed guidance for addressing specific cybersecurity areas and operational risks. These Functions help agencies look beyond individual devices and focus on securing the full ITS pipeline, including communications, software, operational processes, third-party integrations, and incident response procedures. A major strength of the NIST CSF is the ability to build both a Current Profile and a Target Profile. The Current Profile reflects an agency’s existing cybersecurity posture, while the Target Profile defines where the agency wants to be. Comparing the two helps identify security gaps, prioritize improvements, and support long-term planning.

Using the ITS Profile to Secure ITS Environments

For transportation environments specifically, the ITS Profile extends the NIST CSF into the ITS domain. The ITS Profile helps agencies apply cybersecurity guidance directly to transportation technologies and operational environments. Another key component of the ITS Profile is the use of Mission Objectives. These objectives are tailored to transportation operations and help agencies focus on what matters most within their environment. Instead of applying every possible cybersecurity recommendation at once, agencies can prioritize security efforts based on operational needs and risk exposure. Below are the 14 Mission Objectives detailed in the ITS Profile:

1: Improve physical safety of the transportation ecosystem.

2: Increase the efficiency of the transportation ecosystem.

3: Collect, manage, use, and disseminate data.

4: Improve ITS infrastructure through maintenance and supply chain management.

5: Coordinate policy and standards.

6: Enable workforce development.

7: Enhance integration and connectivity of transportation system through technology.

8: Build privacy protections into ITS operations.

9: Prepare for and manage natural risks to ITS operations.

10: Maintain secure technology and communications.

11: Enhance telecommunications and networking to facilitate emerging ITS capabilities.

12: Promote and provide access to transportation services for all users.

13: Engage with the community and relevant stakeholders.

14: Facilitate and secure financial transaction.

The DOT Chart

To make implementation easier, the ITS Profile features a dot chart. This visual tool maps chosen mission objectives to the most relevant high-priority subcategories in the NIST framework. It helps teams focus efforts where they matter most. This table shows a snapshot of that chart. Take this subcategory as an example : PR.AA-03 : “Users, services, and hardware are authenticated”. If a gap analysis reveals your organization needs to implement this subcategory, the Dot Chart shows that Mission Objective 3 (Collect, manage, use, and disseminate data) is a high priority, while MO 1 (Improve physical safety) and MO 2 (Increase transportation efficiency) are treated it as lower ones.

Using the ITS Profile is a structured process that helps agencies move from assessment to implementation.

Steps to Apply the ITS Profile

Follow these practical steps to move toward better security:

Build your current profile based on existing practices.
Define a target profile aligned with your risk tolerance and goals.
Prioritize the mission objectives that fit your environment.
Use the dot chart to identify the high-priority subcategories.
Map those subcategories to specific security controls from NIST SP 800-53 using NIST’s informative references.
Turn the controls into a clear action plan with assigned tasks, timelines, and responsibilities.

This structured approach leads to measurable improvements and supports compliance efforts with federal and state expectations.

Need Help?

Frameworks and tools are only effective if teams understand how to apply them within real transportation environments. That is why cybersecurity training plays an important role in ITS security programs.

TrustThink offers free ITS cybersecurity training designed to help transportation agencies better understand the NIST CSF, the ITS Profile, Mission Objectives, and security control implementation. These training opportunities help agencies build the knowledge and skillsets needed to strengthen their environments and support long-term cybersecurity improvement efforts.