U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

1 

79–010 

" ! SENATE 115TH CONGRESS

2d Session 

REPORT

2018

115–322 

Calendar No. 556 

STB INFORMATION SECURITY 

IMPROVEMENT ACT 

R E P O R T 

OF THE

COMMITTEE ON COMMERCE, SCIENCE, AND 

TRANSPORTATION 

ON

S. 2844 

AUGUST 16, 2018.—Ordered to be printed 


congress.#13
(II) 

SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION 

ONE HUNDRED FIFTEENTH CONGRESS

SECOND SESSION

JOHN THUNE, South Dakota, Chairman 

ROGER F. WICKER, Mississippi BILL NELSON, Florida 

ROY BLUNT, Missouri MARIA CANTWELL, Washington 

TED CRUZ, Texas AMY KLOBUCHAR, Minnesota 

DEB FISCHER, Nebraska RICHARD BLUMENTHAL, Connecticut 

JERRY MORAN, Kansas BRIAN SCHATZ, Hawaii 

DAN SULLIVAN, Alaska EDWARD J. MARKEY, Massachusetts 

DEAN HELLER, Nevada TOM UDALL, New Mexico 

JAMES M. INHOFE, Oklahoma GARY C. PETERS, Michigan 

MIKE LEE, Utah TAMMY BALDWIN, Wisconsin 

RON JOHNSON, Wisconsin TAMMY DUCKWORTH, Illinois 

SHELLEY MOORE CAPITO, West Virginia MARGARET WOOD HASSAN, New Hampshire 

CORY GARDNER, Colorado CATHERINE CORTEZ MASTO, Nevada 

TODD C. YOUNG, Indiana JON TESTER, Montana 

NICK ROSSI, Staff Director 

ADRIAN ARNAKIS, Deputy Staff Director 

JASON VAN BEEK, General Counsel 

KIM LIPSKY, Democratic Staff Director 

CHRISTOPHER DAY, Democratic Deputy Staff Director 

Calendar No. 556 

115TH CONGRESS REPORT " ! SENATE 2d Session 115–322 

STB INFORMATION SECURITY IMPROVEMENT ACT 

AUGUST 16, 2018.—Ordered to be printed 

Mr. THUNE, from the Committee on Commerce, Science, and 

Transportation, submitted the following 

R E P O R T 

[To accompany S. 2844] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Commerce, Science, and Transportation, to 

which was referred the bill (S. 2844) to require the Surface Transportation Board to implement certain recommendations of the Inspector General of the Department of Transportation, having considered the same, reports favorably thereon without amendment 

and recommends that the bill do pass. 

PURPOSE OF THE BILL

The purpose of S. 2844 is to improve the information security 

program of the Surface Transportation Board (STB) by requiring it 

to develop a timeline and plan to implement information security 

recommendations from the Department of Transportation Office of 

Inspector General (DOT OIG). 

BACKGROUND AND NEEDS

As the Federal agency charged with economic oversight of the 

Nation’s freight rail system, STB is a five-member, bipartisan 

agency that has regulatory jurisdiction over railroad rate reasonableness, mergers, line acquisitions, new rail-line construction, 

abandonments of existing rail lines, and the conversion of rail 

rights-of-way into hiking and biking trails. 

In 2015, Congress passed the STB Reauthorization Act (P.L. 

114–110), reauthorizing STB for the first time since the agency’s 

creation. Prior to reauthorization, STB was decisionally indeVerDate Sep 11 2014 04:25 Aug 17, 2018 Jkt 079010 PO 00000 Frm 00003 Fmt 6659 Sfmt 6602 E:\HR\OC\SR322.XXX SR322
2 

1Section 9 of the STB Reauthorization Act authorized the DOT OIG to review financial management, property management, and business operations of STB. 2Department of Transportation Office of Inspector General. The Surface Transportation 

Board’s Information Security Program Is Not Effective. Report No. FI2018002. October 26, 2017. 

(https://www.oig.dot.gov/library-item/36067) 

pendent, but administratively housed within DOT.1 The STB Reauthorization Act established STB as an independent agency outside 

of DOT. As a stand-alone agency, STB became responsible for its 

administrative functions, including maintaining its own information security program. 

The Federal Information Security Management Act of 2002 

(FISMA) (P.L. 107–347), as amended by the Federal Information 

Security Modernization Act of 2014 (P.L. 113–283), requires agencies to implement information security programs. FISMA also requires agencies to have an annual independent evaluation performed to determine the effectiveness of their programs and to report the results of these reviews to the Office of Management and 

Budget. Agencies that do not have inspectors general, such as STB, 

must use an external independent auditor to evaluate their information security programs. To perform its 2017 FISMA evaluation, 

STB entered into a memorandum of understanding with DOT OIG. 

Pursuant to this agreement, DOT OIG conducted an independent 

evaluation of STB’s information security programs and, on October 

26, 2017, released its findings in a report entitled, ‘‘The Surface 

Transportation Board’s Information Security Program Is Not Effective.’’ 2 The report, which concluded that STB’s information security 

program is ineffective, included 14 recommendations to assist STB 

in developing an effective information security program. On November 21, 2017, STB submitted to DOT OIG a letter outlining the 

agency’s proposed completion dates for each of the 14 DOT OIG 

recommendations, indicating that all recommendations should be 

implemented by December 31, 2018. 

The STB Information Security Improvement Act would require 

STB to develop a timeline and plan for implementing the DOT OIG 

recommendations. The bill also would require STB to submit, within 180 days of enactment, its timeline and plan to the Committee 

on Commerce, Science, and Transportation of the Senate and the 

Committee on Transportation and Infrastructure of the House of 

Representatives. Finally, the bill would require STB to submit annual updates on its progress until it has fully implemented DOT 

OIG’s recommendations. 

SUMMARY OF PROVISIONS

If enacted, S. 2844 would do the following: 

• Direct STB to develop a timeline and plan to implement the 

recommendations of DOT OIG’s report number FI2018002 in order 

to improve the agency’s information security. 

• Require STB to submit its timeline and plan for implementing 

the DOT OIG recommendations to the relevant congressional committees. 

• Require STB to submit annual updates on its implementation 

progress until it has fully implemented the DOT OIG recommendations. 

3 

LEGISLATIVE HISTORY

S. 2844 was introduced on May 15, 2018, by Senator Thune and 

was referred to the Committee on Commerce, Science, and Transportation of the Senate. On May 22, 2018, the Committee met in 

open Executive Session and, by voice vote, ordered S. 2844 reported 

favorably without amendment. 

ESTIMATED COSTS

In accordance with paragraph 11(a) of rule XXVI of the Standing 

Rules of the Senate and section 403 of the Congressional Budget 

Act of 1974, the Committee provides the following cost estimate, 

prepared by the Congressional Budget Office: 

S. 2844—STB Information Security Improvement Act 

S. 2844 would require the Surface Transportation Board (STB) to 

develop a plan to comply with recommendations made by the Department of Transportation’s inspector general regarding its information security system. The bill would require the STB to report 

annually to the Congress on the status of its compliance with the 

inspector general’s report. 

Under current law, CBO expects that the STB will implement 

the inspector general’s recommendations regarding its information 

security system. The agency has already hired an employee to manage and implement the plan. As a result, CBO estimates that implementing the provisions of S. 2844 would have no significant effect on the federal budget over the 2019–2023 period. 

Enacting S. 2844 would not affect direct spending or revenues; 

therefore, pay-as-you-go procedures do not apply. 

CBO estimates that enacting S. 2844 would not increase net direct spending or on-budget deficits in any of the four consecutive 

10-year periods beginning in 2029. 

S. 2844 contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act. 

On March 20, 2018, CBO transmitted a cost estimate for H.R. 

4921, the STB Information Security Improvement Act, as ordered 

reported by the House Committee on Transportation and Infrastructure on February 14, 2018. The two pieces of legislation are 

similar and CBO’s estimate of their budgetary effects are the same. 

The CBO staff contact for this estimate is Sarah Puro. The estimate was reviewed by H. Samuel Papenfuss, Deputy Assistant Director for Budget Analysis. 

REGULATORY IMPACT STATEMENT

In accordance with paragraph 11(b) of rule XXVI of the Standing 

Rules of the Senate, the Committee provides the following evaluation of the regulatory impact of the legislation, as reported: 

NUMBER OF PERSONS COVERED

S. 2844, as reported, does not create any new programs or impose any new regulatory requirements and therefore would not 

subject any individuals or businesses to new regulations. 

4 

ECONOMIC IMPACT

S. 2844, as reported, is not expected to have a negative impact 

on the Nation’s economy. 

PRIVACY

S. 2844, as reported, is not expected to have an adverse impact 

on the personal privacy of individuals. Section 2 would require STB 

to implement recommendations of the DOT OIG to improve its information security program to provide additional protection for information managed by the agency. This should further ensure the 

privacy of data and records controlled and maintained by STB. 

PAPERWORK

S. 2844, as reported, would only incrementally affect paperwork 

requirements for STB. Section 2 would require STB to develop a 

timeline and plan for improving its information security program 

and to submit such information to Congress. STB further would be 

required to report annually on its implementation progress until 

the DOT OIG recommendations are implemented. This reporting 

requirement is expected to result in only a minimal increase in paperwork for STB until the date of full implementation of the recommendations. 

CONGRESSIONALLY DIRECTED SPENDING

In compliance with paragraph 4(b) of rule XLIV of the Standing 

Rules of the Senate, the Committee provides that no provisions 

contained in the bill, as reported, meet the definition of congressionally directed spending items under the rule. 

SECTION-BY-SECTION ANALYSIS

Section 1. Short title 

This section would provide that the bill may be cited as the ‘‘STB 

Information Security Improvement Act.’’ 

Section 2. Requirements 

This section would require STB to develop a timeline and plan 

to implement the recommendations of the DOT OIG report number 

FI2018002, which would include improvements to identify, protect, 

recover, and respond to controls for information security. STB also 

would be required to submit its implementation plan to Congress 

and to report annually on its progress in implementing the plan 

until all DOT OIG recommendations are closed. 

Section 3. No additional funds authorized 

This section would provide that no additional funds are necessary to carry out the requirements of the bill. 

5 

CHANGES IN EXISTING LAW

In compliance with paragraph 12 of rule XXVI of the Standing 

Rules of the Senate, the Committee states that the bill as reported 

would make no change to existing law. 

Æ