Skip to Content

Public Review and Comment

Public Review of Draft Documents

APTA invites all stakeholders to review and comment on draft documents in development.  The APTA Standards Development Program publishes documents through a consensus-based process and the public review period is a critical part of the development process.

The current review period starts on November 2, and ends on January 3.

Commenting Instructions

View the latest set of documents in development by APTA’s working groups. Reviewers may submit comments as often as they like during the review period. Start your review today!

  • Reviewers should scroll down to the bottom of this page
  • Select the name of the document to review more details, download or provide a comment
  • To review the documents without commenting, download the “current draft”
  • Select Document Actions to “Add a Comment”
  • Comments are accepted from APTA members or nonmembers
  • Reviewers should contact standards@apta.com if you experience any problems with providing your inputs
  • For additional guidance download this Step-by-Step Guide. 
TitleCategoryWorking GroupDescription
Submit comments (APTA account required):

Securing Control and Communications Systems in Transit Bus Vehicles and Infrastructure

View current draft		Security & Emergency ManagementTransit Cyber Security Working GroupThis white paper provides comprehensive guidance to transit agencies for addressing cybersecurity risks associated with modern bus systems and supporting infrastructure. This document replaces APTA SS-CCS-WP-005-19, “Securing Control and Communications Systems in Transit Bus Vehicles and Supporting Infrastructure.” As transit buses evolve into highly connected, software-driven platforms integrating onboard electronic control units, wireless communications, cloud-based systems and depot technologies, the cybersecurity threat surface has expanded significantly. This document establishes a life cycle–based approach to securing bus operational technology (OT), encompassing procurement, system design, deployment, operations, maintenance and decommissioning. The guidance emphasizes risk-informed decision-making, asset visibility, secure architecture, authenticated communications and monitoring.