Skip to main content
> TSA Pipeline Security

TSA Pipeline Cybersecurity Directives

Mandatory cybersecurity requirements for pipeline operators

Governing Body: Transportation Security Administration (TSA)
Established: May 2021 (Security Directive Pipeline-2021-01) Last Updated: 2026 (SD-2021-01G / -02G; surface cyber NPRM pending) Scope: Hazardous Liquid and Natural Gas Pipeline Operators
Mandatory
Compliance

What do TSA pipeline cybersecurity directives require today?

TSA's pipeline cybersecurity directives are mandatory for owners and operators of hazardous liquid and natural gas pipelines designated critical to national security. The active directives are SD Pipeline-2021-01G (effective January 16, 2026 through January 15, 2027) and SD Pipeline-2021-02G (effective May 3, 2026 through May 2, 2027). Together they require a designated Cybersecurity Coordinator, incident reporting to CISA no later than 72 hours after identification, network segmentation between IT and OT systems, access control with multi-factor authentication for remote access, continuous monitoring, risk-based patching, an annual incident response exercise, and a TSA-approved Cybersecurity Assessment Plan that incorporates penetration testing and a biennial architecture design review. TSA also published a proposed rule in the Federal Register on November 7, 2024 (Docket TSA-2022-0001) to convert these directives into permanent regulations; public comments closed February 5, 2025, and the final rule has not yet been issued. Sources: tsa.gov pipeline security page; Federal Register 2024-24704.

// What is TSA Pipeline Security?

Following the Colonial Pipeline ransomware attack in May 2021, TSA issued mandatory cybersecurity directives for pipeline operators designated as critical to national security. These directives replaced decades of voluntary guidelines with enforceable requirements.

The directives require pipeline operators to implement specific cybersecurity measures, report incidents to CISA, designate a cybersecurity coordinator, and develop remediation plans for identified gaps. Unlike voluntary frameworks, non-compliance can result in civil penalties under TSA's general authority in 49 CFR 1503.401(b), assessed per violation rather than per day.

TSA has continued updating these requirements through successive reissuances. SD Pipeline-2021-01G (effective January 16, 2026 through January 15, 2027) and SD Pipeline-2021-02G (effective May 3, 2026 through May 2, 2027) carry forward and refine the performance-based cybersecurity requirements. Each version expires after twelve months and is replaced by the next letter in the series. In parallel, TSA published a Notice of Proposed Rulemaking titled 'Enhancing Surface Cyber Risk Management' (Federal Register Nov 7, 2024, Docket TSA-2022-0001) to convert the directives into permanent regulations; comments closed February 5, 2025, and the final rule has not yet been issued. The directives apply to owners and operators of pipelines that have been notified by TSA that they are critical.

// Inside TSA Pipeline Security

TSA's pipeline security directives establish specific cybersecurity requirements across multiple security domains. Operators must implement these controls and maintain evidence of compliance.

1

Incident Reporting

SD Pipeline-2021-01

Mandatory reporting requirements for cybersecurity incidents.

CISA Reporting

Report cybersecurity incidents to CISA as soon as practicable and no later than 72 hours after identification.

Incident Types

Report unauthorized access, denial of service, malware, and other significant incidents.

Primary Contact

Designate a 24/7 primary and alternate cybersecurity coordinator for incident reporting.

2

Cybersecurity Implementation Plan

SD Pipeline-2021-02G

Required security measures owners/operators must implement.

Network Segmentation

Implement network segmentation policies ensuring OT systems can operate if IT systems are compromised.

Access Control

Implement access control measures preventing unauthorized access to critical cyber systems.

Continuous Monitoring

Build continuous monitoring and detection capabilities for cybersecurity threats.

Patch Management

Apply security patches and updates using risk-based methodology, addressing critical vulnerabilities timely.

Password Policies

Implement password policies meeting complexity and change requirements; MFA for remote access.

3

Cybersecurity Assessment

SD Pipeline-2021-02G

Requirements for assessing and testing security controls.

Architecture Design Review

Conduct a cybersecurity architecture design review at least once every two years, including network traffic and system log analysis.

Penetration Testing

Incorporate assessment capabilities such as penetration testing of Information Technology systems and red and purple team testing.

Annual Plan and Report

Submit the Cybersecurity Assessment Plan to TSA annually for approval, with a report of the prior year results. At least one third of the measures in the implementation plan must be assessed each year, and all of them across any three-year period.

4

Incident Response

SD Pipeline-2021-02G

Requirements for responding to and recovering from incidents.

Response Plan

Develop and maintain a cybersecurity incident response plan specific to pipeline operations.

Annual Testing

Test incident response capabilities annually through tabletop or functional exercises.

Recovery Capabilities

Maintain capabilities to restore systems from known-good backups within established timeframes.

Note: TSA conducts inspections to verify compliance. Operators must maintain documentation evidencing implementation of required measures. TSA has authority to require additional measures based on threat intelligence or identified vulnerabilities.

// Who Must Comply

  • 1 Owners/operators of hazardous liquid pipelines designated critical
  • 2 Owners/operators of natural gas and gas transmission pipelines designated critical
  • 3 Pipeline facility operators notified by TSA of designation
  • 4 Operators of liquefied natural gas facilities with TSA notification

// Key Requirements

Incident Reporting

Report cybersecurity incidents to CISA within 72 hours with a designated 24/7 coordinator

Network Segmentation

Implement segmentation ensuring OT can operate independently if IT is compromised

Access Control

Prevent unauthorized access with strong authentication and MFA for remote access

Continuous Monitoring

Build detection capabilities for cybersecurity threats and anomalies

Patch Management

Risk-based patching with timely remediation of critical vulnerabilities

Annual Assessment

TSA-approved Cybersecurity Assessment Plan with annual results reporting and a biennial architecture design review

// Enforcement & Penalties

TSA enforces security directives through its general civil penalty authority under 49 CFR 1503.401(b). Penalties are assessed per violation rather than per day, and a single inspection finding multiple unmet requirements can produce multiple violations. Operators may also face enforcement actions and corrective-action orders.

Maximum Penalty

$14,602 per violation (49 CFR 1503.401(b))

Examples:

  • Up to $73,011 total per civil penalty action for an individual or small business
  • Up to $584,078 total per civil penalty action for other persons
  • Separate violations for each unmet directive requirement found in one inspection
  • Penalties for failure to report a cybersecurity incident to CISA within 72 hours
  • Enforcement actions and corrective-action orders for repeated or willful non-compliance

// Cyber Insurance Impact

Pipeline cyber insurance policies now routinely ask about TSA directive compliance. Insurers may require evidence of compliance as a condition of coverage for pipeline operations. Non-compliance could void coverage or result in claim denials following an incident.

Get ahead of the TSA pipeline requirements

The TSA security directives require pipeline operators to implement specific measures and prove them. A gap assessment maps your OT and IT environment to the directives and shows what to address before your next review.

Book a TSA gap assessment Talk to our team

// How Breach Craft Helps

We help organizations achieve TSA Pipeline Security compliance through genuine security improvements, not checkbox exercises. Our services address the specific requirements and challenges of TSA Pipeline Security.

Gap Assessment

Measure your security against industry standards.

Learn more

Penetration Testing

Find the gaps before attackers do.

Learn more

Vulnerability Assessment

Thorough security scanning and risk prioritization.

Learn more

Tabletop Exercises

Practice your incident response.

Learn more

Virtual CISO

Executive security leadership on demand.

Learn more

// Common Questions

What are the TSA pipeline security directives?
TSA runs two cybersecurity directive series for the pipeline owners and operators it has designated as critical. The SD Pipeline-2021-01 series, Enhancing Pipeline Cybersecurity, requires three actions: designate a primary and at least one alternate Cybersecurity Coordinator, report cybersecurity incidents to CISA, and submit a cybersecurity vulnerability assessment on the form TSA provides. The SD Pipeline-2021-02 series, Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing, carries the performance-based program: a TSA-approved Cybersecurity Implementation Plan, a Cybersecurity Incident Response Plan, and a Cybersecurity Assessment Plan with annual submissions. TSA renews both series every year, so the letter suffix moves while the obligations carry forward. Current versions are listed on TSA's security directives page.

Which TSA pipeline directives are in effect right now?
As of September 2026 the active directives are SD Pipeline-2021-01G, effective January 16, 2026 through January 15, 2027, and SD Pipeline-2021-02G, effective May 3, 2026 through May 2, 2027. Each one cancels and supersedes the version before it, 01F and 02F. The single substantive change in 01G is vetting: any non-U.S. citizen serving as a primary or alternate Cybersecurity Coordinator must be a current member of NEXUS, Global Entry, or another program TSA accepts as a comparable threat assessment. TSA made no substantive revisions in 02G. Every version expires after twelve months, so check the dates before you rely on a directive letter already sitting in your compliance file.

Is SD Pipeline-2021-02C still in effect?
No. SD Pipeline-2021-02C was issued in July 2022 and has been superseded four times since, by 02D, 02E, 02F, and now 02G. What survives from 02C is the structure most operators still work to. That version replaced the prescriptive mitigation measures of the original 2021 directive with a performance-based model built on a TSA-approved Cybersecurity Implementation Plan, an incident response plan, and an assessment plan, and TSA has carried that model through every renewal. If your program documents still cite 02C, the underlying measures probably still map, but your plan submissions and annual reports need to reference the version in force.

Who has to comply with the TSA pipeline cybersecurity directives?
The directives bind owners and operators of a hazardous liquid or natural gas pipeline, or a liquefied natural gas facility, that TSA has notified in writing is critical. You do not self-designate. If TSA has not sent that notification the directives do not apply to you, and if TSA designates you later it issues specific compliance deadlines with the notice. TSA's criticality judgment traces to Section 1557(b) of the 9/11 Commission Act, which directs the agency to review the security plans of the 100 most critical pipeline operators. Plenty of undesignated operators adopt the same measures anyway, because customers, insurers, and state regulators ask about them. We work with utility and energy operators on both sides of that line.

Does TSA require penetration testing of pipeline systems?
Not as a standalone annual test. SD Pipeline-2021-02G requires a Cybersecurity Assessment Plan, and Section III.G.2 names penetration testing of Information Technology systems and red and purple team testing among the assessment capabilities to incorporate. The same section requires a cybersecurity architecture design review at least once every two years, and a schedule that assesses at least one third of the measures in your Cybersecurity Implementation Plan each year and all of them across any three-year period. The plan goes to TSA annually for approval, and a report covering the previous twelve months of results goes with it. Our penetration testing and purple teaming engagements are scoped to produce that evidence.

How fast must a pipeline operator report a cyber incident to CISA?
SD Pipeline-2021-01G requires you to report to CISA as soon as practicable and no later than 72 hours after you identify a cybersecurity incident. That window has moved twice: the original May 2021 directive set 12 hours, SD Pipeline-2021-01B widened it to 24 in 2022, and the current version allows 72. Reportable events include unauthorized access to IT or OT systems, malicious software, denial of service, physical attacks on network infrastructure, and anything with the potential to disrupt operations. Reports go to CISA Central at cisa.gov/report or (844) 729-2472, and your Cybersecurity Coordinator has to be reachable by TSA and CISA around the clock. SD Pipeline-2021-02G separately requires an annual exercise covering at least two incident response plan objectives, which is what our tabletop exercises deliver.

// Related Frameworks

NIST CSF NERC CIP CISA CPGs

// Industries That Need TSA Pipeline Security

These industries commonly require TSA Pipeline Security compliance as part of their regulatory obligations.

Utilities

Guide last reviewed: September 21, 2026

Subject to the TSA pipeline directives?

We assess your OT and IT environment against the TSA security directives.

Schedule Consultation Call Us

Or call us directly at (445) 273-2873