Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

132 Identify Enhancements to Operations and Maintenance Activities (Step 8B) An agency’s operations and maintenance units are often the ones first affected by system disruptions. This typically involves responding to maintain some level of traffic flow and clean- ing up an incident site. It is the responsibility of the maintenance unit to replace many of the ancillary assets (e.g., traffic signs, signals, and guard rails) that have failed from the disruption and to remove debris that often accompanies extreme weather events. It is the responsibility of the operations unit to reroute traffic around blocked roads and manage evacuation routes in anticipation of or response to major disasters. As noted in an FHWA report, Many TSMO [transportation systems management and operations] and maintenance adaptations will be the “low-hanging fruit” to prepare DOTs for extreme weather events, in contrast to necessary changes to infrastructure design. For example, many of the technology elements used to support safety, congestion mitigation, and traveler information objectives are already in place. To adapt to extreme weather events, agencies need to consider how these existing capabilities that already help to improve operations and reli- ability need to evolve to meet the new and emerging requirements of a changing climate (FHWA 2015). In the same document, FHWA identifies the following potential impacts to TSMO and maintenance programs from extreme weather events and longer-term climate change: • Increased frequency of extreme events requires additional personnel to monitor, control, report, and respond to events. • Changes in long-term climate trends may change seasonal work requirements (e.g., changes in winter weather seasons, construction timing, or landscaping timing) and additional or unique staff expertise to monitor and respond to new types of climate events. • Increases in temperature can increase annual pavement maintenance costs, and changes in freeze/thaw cycles can increase potholes. • Objectives and performance measures relating to emergency response or return to level of service may be affected by the frequency and severity of extreme events. • Bridges with joints and moveable parts are more susceptible to damage due to their sensitivity to temperature and water infiltration. As a result, affected bridges may need to be closed and traffic may need to be rerouted. In today’s world where digital and electronic surveillance and command and control centers serve as the foundation of modern TSMO strategies, traffic operations also become a likely target for cyberattacks. As noted by Fok et al.: Transportation systems are not only becoming more connected but also more dependent on com- munications and information technologies. These technological advances improve the efficiency and functionality of transportation systems, but they also increase potential vulnerabilities to transportation safety. In response, transportation agencies across the country are rising to the challenge to learn more about cybersecurity issues and develop and implement solid cybersecurity programs (Fok et al. 2015). Indeed, all forms of digital and web-based operations data use are potential targets for cyberattacks. C H A P T E R   1 2

Identify Enhancements to Operations and Maintenance Activities (Step 8B) 133   Capability Factors and Levels of Maturity Factor 8B.1: Has your agency assessed current operations & maintenance (O&M) strategies based on the potential vulnerabilities identified in Step 7? Step 7 identified the types of vulnerabilities facing your transportation system. This factor reflects the extent to which O&M actions are part of the strategies identified to reduce these vulnerabilities. The major distinctions among the three levels of maturity reflect the breadth of assessment of such O&M strategies and the degree to which the implementation of such strategies has been considered in the assessment. • Level 1: We have identified O&M-related vulnerability areas. The assessment identified the likely costs of implementing O&M strategies and qualitatively analyzed likely impacts. • Level 2: We have achieved Maturity Level 1. In addition, the assessment has examined the potential impacts of different O&M options along with an assessment of implementation needs (e.g., staffing/training, equipment, and other budgetary requirements). • Level 3: We have achieved Maturity Level 2, plus the assessment included the use of benefit/ cost analysis to determine the most appropriate O&M actions. Our agency has already implemented some of the O&M strategies identified in this assessment. Factor 8B.2: Does your agency provide O&M staff opportunities to report resilience-oriented problems and potential corrective actions? The frontline O&M staff are often the agency staff most familiar with the “on-the-ground” consequences of system disruptions, what it takes to recover in the short term from such dis- ruptions, and understands what might be needed in the longer term. This staff is also often responsible for the collection of data on system performance and asset condition. This factor focuses on the type of information collected by O&M staff as part of an agency’s data collec- tion program and the extent to which resilience-oriented problems are included in such efforts. The major distinctions among the three maturity levels relate to the degree of formality of including resilience-related data in O&M data collection and how that data are used to identify O&M strategies to enhance system resilience. • Level 1: We encourage O&M staff to provide information on resilience-related problems to their managers (e.g., noticeable erosion near culverts or retaining walls). There are no formal requirements for doing so. • Level 2: We have a formal report template to report resilience-related problems to O&M managers. At their discretion, these managers can forward the information to other units in our agency for their use. • Level 3: We have achieved Maturity Level 2. In addition, a formal reporting system is used to proactively request O&M staff to identify actions to enhance transportation system resilience. Our O&M staff provide after-event reports on the nature of disruptions, the type of response undertaken, and costs. Our maintenance-oriented asset inspection program includes infor- mation categories for potential system resilience problems at defined asset locations. Factor 8B.3: Has your agency examined changes in vegetation control practices to keep pace with changes in climate (e.g., increased trimming frequency or planting more drought- or heat-tolerant species)? This factor focuses on a very specific consequence of a changing climate—the needs and challenges to vegetation management and control strategies relating to changing climate

134 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide conditions. For example, in some states where drought or prolonged higher temperatures are already occurring, some agencies are relying more on drought-resistant vegetation in rights- of-way. The major distinctions among the maturity levels for this factor are the depth of the assessment of changing climate conditions on vegetation management and the degree to which specific recommendations have been made in agency practices. • Level 1: We have studied the major climate changes that have occurred in recent years (e.g., prolonged higher temperatures) that might affect our vegetation control practices. This has occurred only in selected geographic regions that have been affected the most and with little to no emphasis on future changes. • Level 2: We have achieved Maturity Level 1. However, the assessment was done statewide and for all types of potential climate change-related environmental stresses that occur in future years. The focus of recommendations has primarily been on the changes in vegeta- tion types. • Level 3: We have achieved Maturity Level 2. In addition, changes in agency vegetation control strategies have been recommended for different timeframes (e.g., short-, medium-, and long-term time horizons). The assessment has also included specific recommendations on a range of changes in agency vegetation practices. Factor 8B.4: Has your agency coordinated the collection of asset condition data as part of its asset management program with ongoing maintenance activities in order to identify the total cost of recurring asset failure? Lifecycle costing (for individual assets) and life cycle planning (LCP) used in developing the Transportation Asset Management Plan (TAMP) are some of the mainstays in many trans- portation agencies for asset management and other investment decision-making support. One of the requirements of such costing is that the costs of different asset conditions and repairs/ replacements are known in sufficient detail to undertake a life cycle cost analysis for individual assets and for classes and subcategories of assets, which may face different hazards and risks over time. Maintenance staff often collect data on repairs and minor replacements, which could provide an important archival database on the potential costs associated with future asset failures. This information can also help inform future systems-level vulnerability analyses. This factor reflects the extent to which the maintenance and asset management programs in your agency have coordinated their cost-data collection efforts to identify the total costs for recurring asset failure. The major distinction among the three maturity levels is the degree to which this coordination is formalized in your agency. (Note that a similar factor is part of Step 8D: Integrate into Asset Management.) • Level 1: Our maintenance unit collects data on asset conditions during its normal data collection activities. This information is primarily used at the district level and not related to asset management. • Level 2: Our maintenance unit collects condition data on assets as part of its formal asset inspection process. If significant maintenance activities have occurred at a specific location, the maintenance requirements and costs in response are forwarded to the asset management program. • Level 3: Our maintenance unit collects asset condition data as part of its asset inspection process and provides this data to the asset management program. Recurring failures at one location or of a particular asset (e.g., a culvert) are incorporated into the extent, type, and cost of investment that occurs at that location. Asset management systems or maintenance

Identify Enhancements to Operations and Maintenance Activities (Step 8B) 135   management systems (MMS) have been configured to issue alerts when vulnerable assets are due for maintenance, repair, or replacement. Factor 8B.5: Does your agency have contingency plans in the event your TMCs are disrupted (e.g., alternative ways of providing traveler information when there is a disruption of the electrical grid)? Many transportation agencies have developed TMCs that provide important system command and control capabilities to agency staff. These centers range in sophistication from simple monitoring of system conditions to real-time control of traffic control devices. Increasingly, these centers are becoming more dependent on internet capability as well as almost completely dependent on the electrical power grid. This factor reflects the extent to which your agency has developed contingency plans in the event a TMC is disrupted either by loss of power or by cyberattacks. The major distinctions among the maturity levels reflect the extent of disruption types that are part of the contingency plan and the degree to which the plan is periodically tested. • Level 1: We have developed TMC contingency plans for one type of system disruption (e.g., power loss). We have not done a comprehensive examination of all types of manage- ment center failures to determine contingencies. • Level 2: We have a contingency plan in place for all possible types of system disruptions. Traffic management center operators understand what needs to be done for each type of disruption. • Level 3: We have achieved Maturity Level 2. In addition, we field test the plans (conducting “what if” scenario analyses) with relevant partner agencies. Redundant systems or other means of conveying information are in place. Factor 8B.6: Has your agency developed field exercises and training exercises for O&M staff on the roles they play in overall system resilience? Staff training and professional development opportunities are an important part of an agency’s resilience strategy. This is especially the case for the O&M staff who have critical response and recovery responsibilities during and after system disruptions. As noted earlier, such staff also have important roles in data collection and in identifying potential resilience strategies to minimize the vulnerability of assets. One of the common approaches to training and professional development for O&M staff is to conduct field exercises or drills that simulate “real-world” situations, usually with a post-drill assessment of how the agency response can be improved. This factor examines the extent to which such field and training exercises occur in your agency. The major distinctions among the maturity levels reflect the breadth of resilience- related O&M training as well as the level to which partner agencies are part of the field exercises. • Level 1: We include an overview of the system resilience role of operations and maintenance in training materials for the respective functional units. The responsibility for structuring this training is at the unit level. • Level 2: We conduct periodic training for our O&M staff on how to better conduct their activities to achieve agency resilience goals. Part of this training includes a focus on system resilience and how the O&M staff can contribute to a more reliable and resilient transpor- tation system. We conduct in-house field exercises that simulate the deployment of O&M resources in response to different types of incidents and disruptions.

136 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide • Level 3: We have achieved Maturity Level 2. In addition, we participate in training and field exercises with partner agencies to test and assess our operational response to system disruptions. Factor 8B.7: Has your agency implemented a cybersecurity protection plan for critical TMC and operations assets? Cybersecurity has become increasingly important to today’s transportation agencies. There have been many examples where transportation agencies or a jurisdiction (e.g., city or county) has been attacked by cyber hackers. Several agencies (e.g., FEMA, DHS, and NIST) have developed guidelines for how agencies can protect themselves against such attacks. This factor emphasizes the degree to which your agency has developed a cybersecurity protection plan for critical traffic operations assets. The major distinction among the maturity levels reflects the degree to which a plan has been implemented in your agency. It is recognized that in some cases the responsibility for cybersecurity does not rest in the transportation agency. In such cases, this factor can be redefined to be more specific to the institutional circumstances of your agency. • Level 1: We have identified command and control facilities and processes that are vulnerable to potential cyberattack but have not yet put protection measures in place. • Level 2: We have identified the points of susceptibility of our critical command and control facilities and processes and have taken steps to protect them against a cyberattack. • Level 3: We have a cybersecurity protection plan for all our critical command and control facilities and processes. System backups are in place if these facilities are compromised. The plan is updated every 2 years. We have also put redundant systems in place to make sure critical operations will continue after a cyberattack. Factor 8B.8: Has a document describing your O&M-related resilience strategy been developed? Formally documenting resilience strategies for all components of your agency’s resilience efforts is considered an important action to not only inform your own staff of what the agency is doing but also to provide information to other stakeholders on the agency’s resilience strategy. Given that O&M staff are part of the first response to system disruptions, their performance will likely have an important influence on public perceptions of your agency’s competence in system management. Thus, it is important that your agency describes the steps it is taking to make sure this response is timely and effective. This factor focuses on whether your agency has produced such materials. The distinctions among the three maturity levels reflect the degree to which such information is available, the breadth of coverage, and the frequency of updating this information. • Level 1: We have information on our O&M resiliency actions, but it is scattered across multiple, internally focused documents. This information is not regularly updated. • Level 2: We have produced a single document that contains sections on each of our O&M resilience responsibilities and efforts. The document is not regularly updated. • Level 3: We have a formal, publicly available document that comprehensively describes all aspects of the O&M resilience strategy and efforts. Updates to the document are made on a regular basis. Table 22 summarizes the factors that are included in the self-assessment tool for Step 8B. The maturity levels for each factor are presented in the descriptions of each factor. The total score for this step is found by summing the number of points given for each factor.

Maturity Factor Level 1 (1 point) Level 2 (2 points) Level 3 (3 points) 8B.1 Has your agency assessed current operations & maintenance (O&M) strategies based on the potential vulnerabilities identified in Step 7? We have identified O&M-related vulnerability areas. The assessment identified the likely costs of implementing O&M strategies and qualitatively analyzed likely impacts. We have achieved Maturity Level 1. In addition, the assessment has examined the potential impacts of different O&M options along with an assessment of implementation needs (e.g., staffing/training, equipment, and other budgetary requirements). We have achieved Maturity Level 2, plus the assessment included the use of benefit/cost analysis to determine the most appropriate O&M actions. Our agency has already implemented some of the O&M strategies identified in this assessment. 8B.2 Does your agency provide O&M staff opportunities to report resilience- oriented problems and potential corrective actions? We encourage O&M staff to provide information on resilience-related problems to their managers (e.g., noticeable erosion near culverts or retaining walls). There are no formal requirements for doing so. We have a formal report template to report resilience-related problems to O&M managers. At their discretion, these managers can forward the information to other units in our agency for their use. We have achieved Maturity Level 2. In addition, a formal reporting system is used to proactively request O&M staff to identify actions to enhance transportation system resilience. Our O&M staff provide after-event reports on the nature of disruptions, the type of response undertaken, and costs. Our maintenance- oriented asset inspection program includes information categories for potential system resilience problems at defined asset locations. 8B.3 Has your agency examined changes in vegetation control practices to keep pace with changes in climate (e.g., increased trimming frequency or planting more drought- or heat-tolerant species)? We have studied the major climate changes that have occurred in recent years (e.g., prolonged higher temperatures) that might affect our vegetation control practices. This has occurred only in selected geographic regions that have been affected the most and with little to no emphasis on future changes. We have achieved Maturity Level 1. However, the assessment was done statewide and for all types of potential climate change-related environmental stresses that occur in future years. The focus of recommendations has primarily been on the changes in vegetation types. We have achieved Maturity Level 2. In addition, changes in agency vegetation control strategies have been recommended for different timeframes (e.g., short-, medium-, and long-term time horizons). The assessment has also included specific recommendations on a range of changes in agency vegetation practices. 8B.4 Has your agency coordinated the collection of asset condition data as part of its asset management program with ongoing maintenance activities in order to identify the total cost of recurring asset failure? Our maintenance unit collects data on asset conditions during its normal data collection activities. This information is primarily used at the district level and not related to asset management. Our maintenance unit collects condition data on assets as part of its formal asset inspection process. If significant maintenance activities have occurred at a specific location, the maintenance requirements and costs in response are forwarded to the asset management program. Our maintenance unit collects asset condition data as part of its asset inspection process and provides this data to the asset management program. Recurring failures at one location or of a particular asset (e.g., a culvert) are incorporated into the extent, type, and cost of investment that occurs at that location. Asset management systems or maintenance management systems (MMS) have been configured to issue alerts when vulnerable assets are due for maintenance, repair, or replacement. Table 22. Assessment table for Step 8B: Identify Enhancements to Operations and Maintenance Activities. (continued on next page)

Maturity Factor Level 1 (1 point) Level 2 (2 points) Level 3 (3 points) 8B.5 Does your agency have contingency plans in the event your TMCs are disrupted (e.g., alternative ways of providing traveler information when there is a disruption of the electrical grid)? We have developed TMC contingency plans for one type of system disruption (e.g., power loss). We have not done a comprehensive examination of all types of management center failures to determine contingencies. We have a contingency plan in place for all possible types of system disruptions. Traffic management center operators understand what needs to be done for each type of disruption. We have achieved Maturity Level 2. In addition, we field test the plans (conducting “what if” scenario analyses) with relevant partner agencies. Redundant systems or other means of conveying information are in place. 8B.6 Has your agency developed field exercises and training exercises for O&M staff on the roles they play in overall system resilience? We include an overview of the system resilience role of operations and maintenance in training materials for the respective functional units. The responsibility for structuring this training is at the unit level. We conduct periodic training for our O&M staff on how to better conduct their activities to achieve agency resilience goals. Part of this training includes a focus on system resilience and how the O&M staff can contribute to a more reliable and resilient transportation system. We conduct in-house field exercises that simulate the deployment of O&M resources in response to different types of incidents and disruptions. We have achieved Maturity Level 2. In addition, we participate in training and field exercises with partner agencies to test and assess our operational response to system disruptions. 8B.7 Has your agency implemented a cybersecurity protection plan for critical TMC and operations assets? We have identified command and control facilities and processes that are vulnerable to potential cyberattack but have not yet put protection measures in place. We have identified the points of susceptibility of our critical command and control facilities and processes and have taken steps to protect them against a cyberattack. We have a cybersecurity protection plan for all our critical command and control facilities and processes. System backups are in place if these facilities are compromised. The plan is updated every 2 years. We have also put redundant systems in place to make sure critical operations will continue after a cyberattack. 8B.8 Has a document describing your O&M-related resilience strategy been developed? We have information on our O&M resiliency actions, but it is scattered across multiple, internally focused documents. This information is not regularly updated. We have produced a single document that contains sections on each of our O&M resilience responsibilities and efforts. The document is not regularly updated. We have a formal, publicly available document that comprehensively describes all aspects of the O&M resilience strategy and efforts. Updates to the document are made on a regular basis. Score Range Description of Agency Maturity in Identifying Enhancements to Operations and Maintenance Activities 0 to 11 Your agency is emerging into this area and has taken initial steps to enhance operations and maintenance activities. However, much more can be done. 12 to 20 Your agency has implemented several enhanced operations and maintenance activities, not so much as part of an agency-wide strategy but primarily at the unit level. There are still important actions that can be taken to reach the next level of maturity. 21 to 24 Your agency has reached significant maturity in enhancing operations and maintenance activities. The major focus should be on maintaining and enhancing existing efforts when appropriate and taking advantage of new opportunities as they become available. Table 22. (Continued).

Identify Enhancements to Operations and Maintenance Activities (Step 8B) 139   Recommended Actions to Maintain the Highest Level of Agency Resilience Capability The highest level of capability for Step 8B: Identify Enhancements to Operations and Mainte- nance Activities focuses on continual improvement in agency capability and actions leading to a more resilient transportation system. If your agency has reached Level 3 maturity, the steps that can be taken to maintain this level include: • Continue to monitor the resilience of the transportation system and consider changes in system performance and asset condition when making changes in the agency’s operations and maintenance capabilities. • Periodically reassess TSMO or maintenance program goals and operations objectives to reflect the latest experience with system disruptions. • Continue to review (and archive) traffic incident reports, maintenance records, after-action reports, emergency reimbursement forms, and other sources of data to determine how system disruptions have affected performance and agency costs over time. • Continue to examine your agency’s response to system disruptions from the perspective of internal actions and procedures. For example, does your agency need to revamp work order codes for system disruptions or use other methods to improve tracking of labor, equipment, and materials costs over time? • Update staff professional development and training opportunities to include the latest thinking and concepts in system resilience as it relates to operations and maintenance. This includes cross-training of agency staff (including across operations, maintenance, and emergency management). • Periodically reassess stand-by support contracts for system disruptions to make sure such contracts are providing the needed capability and resources for the types of disruptions being faced. • Establish transition plans for retiring staff to maintain institutional knowledge as it relates to O&M resilience-related actions. • Maintain situational awareness of rapidly changing cyber and physical security expo- sures that impact agency resilience and capabilities. This includes monitoring develop- ments in technology risks and cyberattacks as they relate to your agency’s IT-related functions. If you did not score a 24 in the assessment (a perfect score for Level 3 efforts), identify those factors that were rated lower and identify a strategy or actions to improve these particular components of Step 8B. Recommended Actions to Achieve Higher Levels of Agency Capability If you scored at Level 1 or 2, you can take steps to continue your evolution toward a more resilience-oriented agency as it relates to enhancements to operations and maintenance activities. In such cases, agency managers should identify which of the factors in Table 22 were most deficient and determine priorities for improving your agency’s organizational resilience capabilities in O&M activities. Table 23 is offered as a template to determine which steps your agency can take to improve its resilience capabilities in operations and maintenance, who should be responsible, the time- frame for implementation, and expected outcomes.

140 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide Let’s do this. (check) Action Re sp on si bi lit y? Ti m ef ra m e? Ex pe ct ed ou tc om es ? Assess your agency’s O&M strategies with respect to the vulnerabilities identified in Step 7. Emphasize the implementation requirements for additional actions that are deemed necessary. Examine how O&M data collection efforts can be modified to collect resilience-related data that can be used for systems-level vulnerability analyses and asset management, in addition to O&M planning. Examine how O&M data can be used to inform life cycle costing analyses in the asset management program or other investment evaluation efforts in your agency. Investigate the extent to which your agency’s vegetation management and control program reflects the likely changes in climate that your jurisdiction will face over time. Update your agency’s COOP as it reflects system operations management and control to reflect the types of vulnerabilities and risks that resulted from Step 7. Re-examine (or develop) contingency plans for TMCs or other critical assets relating to TSMO. The contingency plans should reflect the types of disruptions that could occur and the key functions of the centers that might be lost. Reassess (or develop) multi-agency training and field exercises that reflect the likely circumstances that will be faced during a serious disruption event. Examine your agency’s (or jurisdiction’s) cybersecurity plan from the perspective of vulnerabilities to O&M functions. Investigate the extent to which redundant systems are in place and protected against an initial attack. Examine (or develop) a strategy for backing up critical operations data relating to the functions of TMCs. To what extent are these backup capabilities tested to assure uninterrupted traffic operations’ command and control actions during and following a disruption? Document the O&M resilience efforts of your agency. Possible steps for Step 4: Implement Early Wins Table 23. Actions to achieve higher maturity for Step 8B: Identify Enhancements to Operations and Maintenance Activities.

Identify Enhancements to Operations and Maintenance Activities (Step 8B) 141   Chapter 12 References FHWA. 2015. Transportation System Resilience to Extreme Weather and Climate Change – Executives; Adaptation to Climate Change in Transportation Systems Management, Operations, and Maintenance. FHWA-HOP-15-024. Retrieved June 30, 2020, from https://ops.fhwa.dot.gov/publications/fhwahop15024/index.htm Fok, E., R. Murphy, E. Phomsavath, and J. Walker. 2015. Taming Cyber Risks. Public Roads. Issue No: Vol. 79, No. 2, September/October. Retrieved July 1, 2020, from https://www.fhwa.dot.gov/publications/publicroads/ 15sepoct/01.cfm Useful Resources AASHTO. n.d. Infrastructure Resilience. Website. Center for Environmental Excellence. Retrieved June 30, 2020, from https://environment.transportation.org/environmental_topics/infrastructure_resilience/ DHS. n.d. Cybersecurity. Website. Retrieved June 30, 2020, from https://www.dhs.gov/topic/cybersecurity FHWA. 2013. Making the Connection: Advancing Traffic Incident Management in Transportation Planning— A Primer. Report FHWA-HOP-13-044, July. Retrieved June 30, 2020, from https://ops.fhwa.dot.gov/ publications/fhwahop13044/index.htm FHWA. 2021. Highlights – An important Year in Advancing Asset Management One Step Further. Website. Retrieved March 28, 2021, from https://www.fhwa.dot.gov/asset Flannery, A., M. Pena, and J. Manns. 2018. NCHRP Synthesis 527: Resilience in Transportation Planning, Engineer- ing, Management, Policy, and Administration. Transportation Research Board, Washington, DC. Retrieved June 30, 2020, from https://doi.org/10.17226/25166 Institute of Transportation Engineers (ITE). n.d. Transportation System Management and Operations, System Resiliency, Emergency Management, and Planned Events. Website. Retrieved June 30, 2020, from https:// www.ite.org/technical-resources/topics/transportation-system-management-and-operations/ Ramon, M. and D. Zajac. 2018. NCHRP Project 03-127, “Cybersecurity of Traffic Management Systems.” Cybersecurity Literature Review and Efforts Report. Retrieved June 30, 2020, from http://onlinepubs.trb.org/ onlinepubs/nchrp/docs/NCHRP03-127_Cybersecurity_Literature_Review.pdf TRB. n.d. Cybersecurity Resource Center. Website. Retrieved June  30, 2020, from http://trbcybersecurity. erau.edu/