TSA Security Directives for Pipelines

Mandatory cybersecurity requirements for critical pipeline owners including incident reporting and recovery plans.

Analysis

Develop and execute a TSA-approved Cybersecurity Implementation Plan (CIP) outlining specific cybersecurity measures, schedules, and controls for critical cyber systems (IT/OT) to achieve outcomes like network segmentation, access controls, continuous monitoring, and timely patching; this plan must identify all critical systems and be submitted for TSA approval, with annual updates required. TSA Pipeline Security Directive Overview TXOne Networks Directive Analysis
Establish and maintain a Cybersecurity Incident Response Plan (CIRP) detailing actions for incidents causing operational disruptions, including annual testing of at least two objectives (e.g., containment, network segregation, backup integrity), with employee involvement based on roles. TSA Pipeline Security Directive Overview TXOne Networks Directive Analysis Nozomi Networks Compliance Guide
Implement a Cybersecurity Assessment Plan (CAP) to test and review cybersecurity measures effectiveness, including bi-annual architecture reviews, penetration testing, vulnerability assessments covering 30% of policies annually (100% over three years), and annual reports to TSA on results and methodologies. TSA Pipeline Security Directive Overview TXOne Networks Directive Analysis
Report cybersecurity incidents promptly to CISA and designate a 24/7 cybersecurity coordinator available to TSA and CISA. TSA Pipeline Security Directive Overview Nozomi Networks Compliance Guide

Prescriptive requirements difficult to achieve, such as mandatory multi-factor authentication (MFA) and handling Sensitive Security Information (SSI) restrictions that limit sharing with contractors, leading to implementation hurdles for legacy OT systems. TXOne Networks Directive Analysis
Resource-intensive planning and testing, including annual CAP reports, bi-annual reviews, and covering 100% of policies over three years, straining smaller operators without automated tools for vast IT/OT data monitoring. TSA Pipeline Security Directive Overview TXOne Networks Directive Analysis
Colonial Pipeline ransomware attack example highlighted reused compromised passwords causing IT hijacking and operational shutdowns, exposing gaps in vulnerability assessments and incident response that directives aim to address but challenge rapid fixes in critical infrastructure. TSA Pipeline Security Directive Overview
Evolving performance-based flexibility requires adapting to new measures like ongoing monitoring and drills, complicating compliance for operators with rigid legacy setups. TXOne Networks Directive Analysis Nozomi Networks Compliance Guide

Conduct a full inventory of critical cyber systems (IT/OT) and develop network segmentation policies to isolate OT from IT breaches, using risk-based patching strategies. TSA Pipeline Security Directive Overview
Appoint a 24/7 cybersecurity coordinator and integrate automated compliance management software for monitoring, incident reporting, and plan execution across plans (CIP, CIRP, CAP). TSA Pipeline Security Directive Overview Nozomi Networks Compliance Guide
Schedule annual CIRP testing (e.g., containment drills) and bi-annual architecture reviews, leveraging NIST Cybersecurity Framework or ISA/IEC 62443 for flexible outcomes-based approaches. TXOne Networks Directive Analysis
Submit plans to TSA for approval, maintain records in CIP, and use tools like Nozomi Networks for OT visibility or AssurX for patch management. TSA Pipeline Security Directive Overview Nozomi Networks Compliance Guide TXOne Networks Directive Analysis

Pipeline-2021-02D (SD-02D) issued in July 2023, replacing 02C, introduces performance-based measures, CIRP annual testing, annual CAP reports, flexible CIP revisions, and expanded scope for critical systems post-consultation; effective immediately upon issuance. TXOne Networks Directive Analysis
July 2022 update to 02B provided flexibility by allowing NIST or ISA/IEC 62443 standards for objectives, reducing prescriptiveness. TXOne Networks Directive Analysis
January 17, 2025 Federal Register ratification confirms ongoing validity of Pipeline-2021-01 and 02 series directives, with no new deadlines specified but requiring continuous compliance. Federal Register Ratification

NIST Cybersecurity Framework aligns with TSA's performance-based outcomes for risk management, vulnerability assessments, and incident response; operators can adopt it for CIP flexibility. TXOne Networks Directive Analysis NIST Framework
ISA/IEC 62443 series supports industrial automation security, overlapping with network segmentation, access controls, and OT monitoring required in TSA directives. TXOne Networks Directive Analysis ISA/IEC 62443
CISA incident reporting mandates prompt breach notifications, directly integrated into TSA coordinator and CIRP requirements for pipelines. Nozomi Networks Compliance Guide CISA Reporting

Enhanced resilience post-Colonial Pipeline attack, reducing outage risks through mandatory plans, but increasing costs for assessments and tools in energy sector OT/IT convergence. TSA Pipeline Security Directive Overview TXOne Networks Directive Analysis
Performance-based shifts allow innovation with emerging tech, benefiting pipeline/LNG operators by adapting to threats without rigid prescriptions, though smaller firms face higher compliance burdens. TXOne Networks Directive Analysis
Broader critical infrastructure protection influences oil/gas, rail, and aviation, promoting unified standards like NIST for threat prevention and recovery. Nozomi Networks Compliance Guide Federal Register Ratification

2026-01-02 — TSA revised the title of its information collection from "Pipeline Corporate Security Reviews and Security Directives" to "Pipeline Corporate Security Reviews and TSA Security Directive Pipeline–2021–02 series" in the Federal Register, reflecting updates to cybersecurity and physical security assessment requirements for critical pipeline operators. (source)

Generate the policy: NERC CIP policy generator (generatepolicy.com)
Buy the policy pack: Critical Infrastructure Bundle (cyberpolicy.shop)
Build it yourself: Build Series Vol. 08 — Network Segmentation & Zero Trust (ciso.diy)