Guidelines on Collaboration and Information Security for State DOTs (2023)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

2023 N A T I O N A L C O O P E R A T I V E H I G H W A Y R E S E A R C H P R O G R A M NCHRP RESEARCH REPORT 1034 Guidelines on Collaboration and Information Security for State DOTs Marisa C. Ramon Lynne A. Randolph Jesus Martinez Southwest Research Institute San Antonio, TX John Wol Joah Sapphire Global Dynamic Group New York, NY Subscriber Categories Administration and Management • Data and Information Technology • Security and Emergencies Research sponsored by the American Association of State Highway and Transportation Ofcials in cooperation with the Federal Highway Administration

NATIONAL COOPERATIVE HIGHWAY RESEARCH PROGRAM Systematic, well-designed, and implementable research is the most effective way to solve many problems facing state departments of transportation (DOTs) administrators and engineers. Often, highway problems are of local or regional interest and can best be studied by state DOTs individually or in cooperation with their state universities and others. However, the accelerating growth of highway transporta- tion results in increasingly complex problems of wide interest to high- way authorities. These problems are best studied through a coordinated program of cooperative research. Recognizing this need, the leadership of the American Association of State Highway and Transportation Officials (AASHTO) in 1962 ini- tiated an objective national highway research program using modern scientific techniques—the National Cooperative Highway Research Program (NCHRP). NCHRP is supported on a continuing basis by funds from participating member states of AASHTO and receives the full cooperation and support of the Federal Highway Administration (FHWA), United States Department of Transportation, under Agree- ment No. 693JJ31950003. The Transportation Research Board (TRB) of the National Academies of Sciences, Engineering, and Medicine was requested by AASHTO to administer the research program because of TRB’s recognized objectivity and understanding of modern research practices. TRB is uniquely suited for this purpose for many reasons: TRB maintains an extensive com- mittee structure from which authorities on any highway transportation subject may be drawn; TRB possesses avenues of communications and cooperation with federal, state, and local governmental agencies, univer- sities, and industry; TRB’s relationship to the National Academies is an insurance of objectivity; and TRB maintains a full-time staff of special- ists in highway transportation matters to bring the findings of research directly to those in a position to use them. The program is developed on the basis of research needs iden- tified by chief administrators and other staff of the highway and transportation departments, by committees of AASHTO, and by the FHWA. Topics of the highest merit are selected by the AASHTO Special Committee on Research and Innovation (R&I), and each year R&I’s recommendations are proposed to the AASHTO Board of Direc- tors and the National Academies. Research projects to address these topics are defined by NCHRP, and qualified research agencies are selected from submitted proposals. Administration and surveillance of research contracts are the responsibilities of the National Academies and TRB. The needs for highway research are many, and NCHRP can make significant contributions to solving highway transportation problems of mutual concern to many responsible groups. The program, however, is intended to complement, rather than to substitute for or duplicate, other highway research programs. Published research reports of the NATIONAL COOPERATIVE HIGHWAY RESEARCH PROGRAM are available from Transportation Research Board Business Office 500 Fifth Street, NW Washington, DC 20001 and can be ordered through the Internet by going to https://www.mytrb.org/MyTRB/Store/default.aspx Printed in the United States of America NCHRP RESEARCH REPORT 1034 Project 23-02 ISSN 2572-3766 (Print) ISSN 2572-3774 (Online) ISBN 978-0-309-68768-3 Library of Congress Control Number 2022951087 © 2023 by the National Academy of Sciences. National Academies of Sciences, Engineering, and Medicine and the graphical logo are trade- marks of the National Academy of Sciences. All rights reserved. COPYRIGHT INFORMATION Authors herein are responsible for the authenticity of their materials and for obtaining written permissions from publishers or persons who own the copyright to any previously published or copyrighted material used herein. Cooperative Research Programs (CRP) grants permission to reproduce material in this publication for classroom and not-for-profit purposes. Permission is given with the understanding that none of the material will be used to imply TRB, AASHTO, APTA, FAA, FHWA, FTA, GHSA, or NHTSA endorsement of a particular product, method, or practice. It is expected that those reproducing the material in this document for educational and not-for-profit uses will give appropriate acknowledgment of the source of any reprinted or reproduced material. For other uses of the material, request permission from CRP. NOTICE The research report was reviewed by the technical panel and accepted for publication according to procedures established and overseen by the Transportation Research Board and approved by the National Academies of Sciences, Engineering, and Medicine. The opinions and conclusions expressed or implied in this report are those of the researchers who performed the research and are not necessarily those of the Transportation Research Board; the National Academies of Sciences, Engineering, and Medicine; the FHWA; or the program sponsors. The Transportation Research Board does not develop, issue, or publish standards or speci- fications. The Transportation Research Board manages applied research projects which provide the scientific foundation that may be used by Transportation Research Board sponsors, industry associations, or other organizations as the basis for revised practices, procedures, or specifications. The Transportation Research Board; the National Academies of Sciences, Engineering, and Medicine; and the sponsors of the National Cooperative Highway Research Program do not endorse products or manufacturers. Trade or manufacturers’ names or logos appear herein solely because they are considered essential to the object of the report.

e National Academy of Sciences was established in 1863 by an Act of Congress, signed by President Lincoln, as a private, non- governmental institution to advise the nation on issues related to science and technology. Members are elected by their peers for outstanding contributions to research. Dr. Marcia McNutt is president. e National Academy of Engineering was established in 1964 under the charter of the National Academy of Sciences to bring the practices of engineering to advising the nation. Members are elected by their peers for extraordinary contributions to engineering. Dr. John L. Anderson is president. e National Academy of Medicine (formerly the Institute of Medicine) was established in 1970 under the charter of the National Academy of Sciences to advise the nation on medical and health issues. Members are elected by their peers for distinguished contributions to medicine and health. Dr. Victor J. Dzau is president. e three Academies work together as the National Academies of Sciences, Engineering, and Medicine to provide independent, objective analysis and advice to the nation and conduct other activities to solve complex problems and inform public policy decisions. e National Academies also encourage education and research, recognize outstanding contributions to knowledge, and increase public understanding in matters of science, engineering, and medicine. Learn more about the National Academies of Sciences, Engineering, and Medicine at www.nationalacademies.org. e Transportation Research Board is one of seven major programs of the National Academies of Sciences, Engineering, and Medicine. e mission of the Transportation Research Board is to provide leadership in transportation improvements and innovation through trusted, timely, impartial, and evidence-based information exchange, research, and advice regarding all modes of transportation. e Board’s varied activities annually engage about 8,000 engineers, scientists, and other transportation researchers and practitioners from the public and private sectors and academia, all of whom contribute their expertise in the public interest. e program is supported by state transportation departments, federal agencies including the component administrations of the U.S. Department of Transportation, and other organizations and individuals interested in the development of transportation. Learn more about the Transportation Research Board at www.TRB.org.

C O O P E R A T I V E R E S E A R C H P R O G R A M S CRP STAFF FOR NCHRP RESEARCH REPORT 1034 Christopher J. Hedges, Director, Cooperative Research Programs Waseem Dekelbab, Deputy Director, Cooperative Research Programs, and Manager, National Cooperative Highway Research Program Sid Mohan, Associate Program Manager, Implementation and Technology Transfer, National Cooperative Highway Research Program David M. Jared, Senior Program Officer Mazen Alsharif, Senior Program Assistant Natalie Barnes, Director of Publications Heather DiAngelis, Associate Director of Publications NCHRP PROJECT 23-02 PANEL Field of Administration—Area of Agency Administration Cindy L. Owings-Hutchison, Maine Department of Transportation, Augusta, ME (Chair) Mike Bousliman, Montana Department of Transportation, Helena, MT Joy E. Graham, Minnesota Department of Transportation, St. Paul, MN Kendra K. Levine, University of California, Berkeley, Berkeley, CA Carolyn Morehouse, Alaska Department of Transportation and Public Facilities, Juneau, AK Leni Oman, Olympia, WA Stephanie W. Tanner, Florida Department of Transportation, Tallahassee, FL Tricia Sergeson, FHWA Liaison King W. Gee, AASHTO Liaison

NCHRP Research Report 1034: Guidelines on Collaboration and Information Security for State DOTs presents guidelines for facilitating secure collaboration and information sharing within state departments of transportation (DOTs) and with other transportation agencies. NCHRP Project 23-02, “Guidelines on Collaboration and Information Security for State DOTs,” explored the need, impediments, and business requirements for facilitating col- laboration and data sharing among state DOTs. The guidelines will be of interest to state DOTs seeking to balance digital asset protection and cybersecurity risk while enhancing the exchange of data and information to mutually support increasingly data-driven operations. Business practices for state DOTs are evolving rapidly, with increasing expectations for information access, knowledge transfer, and collaborative work environments within and between agencies. However, state DOTs have various practices for ensuring information security, cybersecurity, and physical security and controlling permissions for interactive tools, which can make collaboration, information access, and knowledge sharing difficult. Security is a significant business risk area, with the possibility that lax or excessive security could lead to negative consequences. In the transportation community, the issues of bal- ance between information security and access cut across all modes, jurisdictions, and users. Research was needed to develop guidelines on practices that support the evolving business needs of DOTs while providing appropriate data and information security. Under NCHRP Project 23-02, Southwest Research Institute was asked to (1) discover the needs of executives and senior managers at state transportation agencies for sharing data and information; (2) develop guidelines that enable state transportation agency executives and senior managers to assess, classify, and respond to transportation cybersecurity risks; and (3) verify that the guidelines address the needs of users through stakeholder engagement. In addition to this report, two deliverables are not included in the published report but can be found on the National Academies Press website (nap.nationalacademies.org) by searching for NCHRP Research Report 1034: Guidelines on Collaboration and Information Security for State DOTs. The deliverables include (1) a spreadsheet tool to foster secure inter- agency collaboration, and (2) a presentation introducing NCHRP Research Report 1034. F O R E W O R D By David M. Jared Staff Officer Transportation Research Board

Note: Photographs, figures, and tables in this report may have been converted from color to grayscale for printing. The electronic version of the report (posted on the web at nap.nationalacademies.org) retains the color versions. 1 Summary 3 Chapter 1 Introduction 3 1.1 Project Background 3 1.2 Project Goals 3 1.3 Project Scope 4 1.4 Project Schedule 5 Chapter 2 Overview of Tasks 5 2.1 Task 1 – Perform Literature Review 5 2.2 Task 2 – Develop Descriptive and Analytical Framework 6 2.3 Task 3 – Prepare Interim Report 1 6 2.4 Task 4 – Prepare Interim Report 2 7 2.5 Task 5 – Prepare Final Deliverables 8 2.6 Task 6 – Finalize Project Summary Report 9 Chapter 3 Conclusion 9 3.1 Establish Collaboration Business Needs 9 3.2 Document Policies and Procedures 10 3.3 Follow Best Practices for Security 10 3.4 Determine Data Restrictions and Protections 10 3.5 Document Collaborative Activities 10 3.6 Identify Collaborative Tools and Shared Media 11 3.7 Perform Records Management 12 Chapter 4 Future Research 16 Appendix A Acronyms 17 Appendix B Implementation and Products of Research Findings 68 References C O N T E N T S