Nice to see this post in Nextgov this morning as Monterey-Salinas Transit was one of the participating agencies in the drafting of this framework.
Most smaller public transportation agencies lack the in-house expertise to defend theirs systems.
Most don't even know where to begin.
Hopefully this guidance will help:
"NIST releases a new draft cybersecurity framework for systems that never stop moving - Sometimes the most important cybersecurity work is not flashy."