norm: norfolk southern railwayno LEI · no CIKMax severity: Low↳ subsidiary of NORFOLK SOUTHERN CORP

Canonical registry

Norfolk Southern Railway Company

ent_74dbf006159e2b2ba090338a

Compliance scorecard →🔔 Follow entity

Disclosures

1

SEC 10-K Item 1C · 1 jurisdiction

Incidents

—

no linked incident in sample

Max affected reported

—

no filed count in sample

Leak-site claims

0

none in sample

Identity resolution

Canonical name: Norfolk Southern Railway Company
Normalized: norfolk southern railway— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: No match
SEC EDGAR CIK: None — not an SEC registrant
Domain: ns.com
Corporate parent: NORFOLK SOUTHERN CORP— per SEC Exhibit 21 filing

Disclosure history (1)newest first

FEDERALSEC 10-K Item 1Cas victim2026-02-09
Norfolk Southern Railway Company (NSC) filed its 10-K Item 1C disclosing its cybersecurity risk management and governance. NSC employs a multi-layered defense strategy based on the NIST Cybersecurity Framework (NIST CSF). The Board has direct oversight of cybersecurity risks, receiving periodic reports from the CISO and CIDO. NSC has experienced prior technology outages and cybersecurity events but states future events could have a materially adverse effect. The company conducts internal and third-party assessments of IT vulnerabilities and resiliency. NSC engages third-party service providers for periodic reviews and requires vendors to maintain security protections. Management reports material incidents to the Board prior to filing 8-Ks. NSC provides cybersecurity awareness training to employees and uses technology-based tools to mitigate risks.