TSA Security Directive Pipeline-2021-02 series: cybersecurity of pipeline and LNG control systems
Designated operators must keep operational technology running safely if the IT network is compromised, control access to critical cyber systems, continuously monitor for and correct anomalies, patch on a risk basis, and maintain a TSA-approved implementation plan, an incident response plan, and an assessment program with testing and audits.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Containment and isolation C-E5 | Required by the text | network segmentation so operational technology keeps running safely if information technology is compromised | high | 5 cases |
| Actor identity verification C-A1 | Required by the text | access control measures that keep unauthorized users out of critical cyber systems | high | 4 cases |
| Warnings designed as alerts C-I4 | Implied | continuous monitoring and detection that surfaces and corrects anomalies | medium | 4 cases |
| Recovery assets outside the failure domain C-R1 | Implied | an incident response plan and segmentation that keep operations recoverable outside the compromised domain | medium | not yet seen missing in a case |