Home

Our Solutions

ThreatHawk SIEM ThreatSearch TIP SAP Guardian CIS Benchmarking Threat Exposure Management Network Configuration Assessment Compliance Automation Agentic SOC AI Agentic Pentesting ThreatHawk MSSP SIEM ThreatHawk SIEM & SOAR → View All Solutions

Resources

Datasheets and Whitepapers Blogs and Articles Webinars

Industries

Financial Services & Banking Healthcare & Life Sciences Government & Public Sector Energy & Critical Infrastructure Technology & SaaS Manufacturing & Industrial Retail & E-Commerce Education & EdTech Logistics & Supply Chain Legal & Professional Services Insurance Media & Entertainment → View All Industries

Compliance

GCC Compliance Hub NCA ECC — Saudi Arabia SAMA CSF — Saudi Arabia PDPL — Saudi Arabia UAE PDPL & NESA Qatar NCS Framework USA Compliance Overview HIPAA / HITECH PCI DSS v4.0.1 SOC 2 Type I & II CMMC 2.0 FedRAMP GDPR — Europe NIS2 Directive DORA EU Compliance Overview Canada Compliance PISF 2025 — Pakistan PISF Resource Hub ISO/IEC 27001:2022 NIST CSF 2.0 PCI DSS — Global SOC 2 — Global → View Full Compliance Center

Partner Program

About Us

Get Demo

© 2026 CyberSilo

TSA Cybersecurity Directive Compliance USA — Pipeline & Rail

Who Must Comply with TSA Cybersecurity Directives?

The TSA's cybersecurity mandates apply to owners and operators of critical infrastructure security that, if disrupted, could cause significant national economic or security consequences. Specifically, three sectors are covered under current TSA directives:

• Pipeline operators: Entities owning or operating hazardous liquid and natural gas pipelines, including liquefied natural gas (LNG) facilities, subject to 49 CFR Part 195 and Part 192. This includes the TSA Pipeline Security Directive (issued May 2021, updated July 2024).
• Rail operators: Class I and Class II freight railroads, passenger rail operators, and rail transit systems deemed high-risk by the TSA. The TSA's 2023 Rail Cybersecurity Directive (SD-Rail-2023-01) applies here, covering Operational Technology (OT) and Industrial Control Systems (ICS).
• Aviation operators: Certain airport authorities and commercial aviation operators that fall under the TSA's Aviation Security Programs, particularly those with significant cargo or passenger volumes, as specified in TSA security program amendments.

If your organization owns or operates any of these asset classes in the United States, you are legally required to comply with the TSA's Cybersecurity Directive for your sector. Note that partner entities with network access to covered systems must also align with the directive's supply chain security requirements.

What Are the Key Requirements of TSA Security Directives?

TSA cybersecurity directives are structured around four core pillars: Implementation Plan, Cybersecurity Assessment, Incident Reporting, and Maintaining Compliance. Below, we break down each pillar with specific, actionable requirements.

Cybersecurity Implementation Plan (CIP)

Every covered operator must develop, document, and submit a TSA-approved Cybersecurity Implementation Plan. The plan must detail how the operator will achieve the following 16 mandatory cybersecurity controls (based on NIST SP 800-82 Rev. 3 and industry best practices):

• Network segmentation and perimeter defense (OT/IT boundaries).
• Access control—least privilege, role-based, and multi-factor authentication.
• Continuous monitoring—24/7 surveillance of all OT assets.
• Patch management within defined risk windows (critical patches within 30 days).
• Malware protection and detection on all OT endpoints.
• Data backup and systematic restoration testing (quarterly).
• Incident detection and response—dedicated SOC with OT-specific playbooks.
• Supply chain security—vetting of connected third parties.
• Physical security integration for OT facilities.
• Cybersecurity awareness training for OT personnel (annually).
• Vulnerability management—regular scanning and remediation SLAs.
• Log management—centralized logging of all OT security events.
• Cybersecurity governance—defined leadership responsibilities and reporting.
• Configuration management—controlled changes with approval workflows.
• Control system resilience—redundant architectures and failover plans.
• Cyber incident response plan—tested at least annually.

Each control must be mapped to specific OT systems, with evidence of implementation. Following TSA review (capped at 60 days from submission), operators receive an approval letter or a deficiency notice requiring remediation within 15 business days.

Annual Cybersecurity Assessment

TSA mandates an independent third-party cybersecurity assessment of your OT/ICS environment every 12 months, as per the TSA Assessment Standard (TSA-AS-2024-01). The assessment must evaluate compliance against the CIP controls and additionally test: (1) the effectiveness of your incident detection and response capabilities; (2) the integrity of your backup and restoration procedures; and (3) the security of any supply chain interconnections. Assessment results are submitted directly to TSA's Cybersecurity Division, with a 90-day window to address any findings of non-compliance.

Cyber Incident Reporting Obligations (CIRCIA-Ready)

TSA directives incorporate the CISA Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. Covered pipeline, rail, and aviation operators must report any "substantial cyber incident" to CISA within 24 hours of confirmation via the CISA Reporting Portal. A "substantial incident" is defined as any cyber event that: (a) causes operational disruption (loss of process control, safety system compromise); (b) results in ransomware payment demands; (c) affects a significant number of customer records; or (d) leads to physical equipment damage. Beyond the 24-hour report, operators must provide a full incident report within 72 hours and a final forensic report within 30 days.

What Changed in the 2024/2025 TSA Directive Updates?

The most significant update to the TSA cybersecurity framework came with the July 2024 revision of the Pipeline Security Directive and the October 2024 update to the Rail Cybersecurity Directive. Key changes include:

• Expanded coverage: The rail directive now applies to smaller commuter and freight operators previously exempt. Approximately 60 additional operators were brought into scope.
• Tighter CIP approval timelines: TSA reduced its evaluation window for new CIP submissions from 90 days to 45 days (and 60 days for amended plans). Operators must prove "immediate action" on critical control gaps within 5 business days.
• Supply chain security mandate: All operators must now conduct cybersecurity audits of their critical technology vendors (those with remote access or OT software) at least once every 24 months, following the TSA Supply Chain Security Profile (TSA-SC-2024-01).
• Incident reporting trigger expanded: The 24-hour reporting requirement now covers "near miss" incidents involving cyber-induced safety system failures, even if no operational loss occurred.
• Penalty escalation: Fines increased from a maximum of $1,000 per violation per day (previous cap) to $10,000 per violation per day as of January 1, 2025, per the TSA Civil Penalty Adjustment. Repeated non-compliance can now result in TSA revoking the operator's security program approval.

These changes create urgency: operators must update their CIPs, conduct vendor risk assessments, and stress-test their incident response capabilities immediately. CyberSilo's Compliance Standards Automation module helps operators track and implement these directive changes in real time.

How to Build a TSA-Compliant Cybersecurity Program

Compliance with TSA directives is not a one-time submission—it is a continuous operational improvement process. Below is a phased approach that aligns with the TSA compliance framework and the CyberSilo platform.

Step 1: Scoping and Gap Analysis

Identify all OT/ICS assets, networks, and SCADA systems within the TSA's scope. Use the TSA Asset Classification Matrix (AC-MAT) to categorize systems as "critical" (directly tied to safety or core operations) or "supporting." A gap analysis against the 16 mandatory controls is required. CyberSilo's Threat Exposure Management platform provides an automated asset discovery and mapping tool that generates a TSA-specific compliance gap report in under 24 hours.

Step 2: Develop and Submit Cybersecurity Implementation Plan

Draft a CIP covering each of the 16 controls. For each control, include: (a) asset coverage; (b) the specific technical solution; (c) the policy or procedure name; (d) responsible owners; and (e) a timeline for full implementation (maximum 12 months). TSA maintains a CIP Template (TSA-FORM-004) that must be used. CyberSilo's Compliance Standards Automation solution includes a TSA CIP Builder that auto-populates control evidence from your connected OT tools (firewalls, EDR, SIEM, backup logs) and generates a submission-ready document.

What Is the Role of a SIEM in TSA Compliance?

A Security Information and Event Management (SIEM) system is not explicitly mandated by TSA directives, but it is effectively required to satisfy the continuous monitoring and log management control requirements. Specifically, TSA expects that operators collect and retain logs from all OT devices, PLCs, RTUs, HMIs, and firewalls for at least 18 months (3 months online, 15 months cold storage), with real-time alerting for anomalous events. A SIEM platform like ThreatHawk SIEM centralizes these logs, correlates OT-specific events, and triggers alerts within seconds—satisfying both the detection and reporting objectives. For operators that also need response orchestration, ThreatHawk SIEM + SOAR automates containment actions (e.g., isolating a compromised PLC) while generating the compliance artifacts needed for TSA audits.

TSA Compliance for Pipeline Operators – Deeper Dive

Pipeline operators face the most mature TSA compliance framework, with the first directive issued in May 2021. As of 2025, all covered pipeline operators must have submitted their CIP and undergone at least one annual assessment. Key nuances for pipeline operators:

• SCADA security emphasis: TSA expects deep-visibility into SCADA and DCS systems, including secure Remote Access (RA) solutions with MFA and session recording. CyberSilo provides a pipeline OT security guide with specific SCADA control mapping.
• Physical-cyber convergence: Pipeline facilities must secure physical access points (gates, pump stations, valve sites) with cyber-physical controls—electronic access logs must feed into the SIEM.
• Incident response drills: TSA mandates tabletop exercises every 6 months and a full-scale operational drill (including system failover) every 12 months. CyberSilo's top 10 agentic SOC AI tools can simulate OT threat scenarios and generate after-action reports for TSA.

Operators in the pipeline sector should reference the TSA cybersecurity compliance page for a full checklist.

How Much Does TSA Compliance Cost?

Costs for TSA cybersecurity directive compliance vary significantly based on the size and complexity of your OT environment and current state of security. Typical cost drivers include:

• Technology implementation (SIEM, OT monitoring, MFA, network segmentation): $150,000–$500,000 for mid-size pipeline or rail operators.
• Annual independent assessment: $50,000–$150,000 per assessment.
• Staff training and incident response drills: $10,000–$30,000 per year.
• Compliance automation platform (like CyberSilo): $25,000–$75,000 per year, variable by asset count.
• Penalties for non-compliance: $10,000 per day per violation—a significant risk driver.

Most pipeline operators report total first-year costs of $300,000–$800,000, with ongoing annual costs of $80,000–$200,000. The ROI is clear: avoiding a single incident (average cost of OT ransomware incident: $4.5 million per IBM) or avoiding one month of TSA fines ($300,000) justifies the investment.

Frequently Asked Questions About TSA Cybersecurity Compliance

What happens if I don't comply with TSA directives?

Non-compliance triggers escalating enforcement: (1) TSA issues a Notice of Deficiency with a 15-day cure period; (2) after that, daily fines of $10,000 per violation begin; (3) if non-compliance persists, TSA may revoke the operator's security program approval, effectively shutting down operations. In 2024, TSA issued over $12 million in civil penalties to pipeline operators for directive violations.

Are Canadian operators subject to TSA directives?

No. TSA directives apply strictly to US-based operators and those foreign entities with operations physically in the United States. Canadian pipeline, rail, and aviation operators must comply with Canadian federal regulations (see our Canada cybersecurity compliance services page for guidance on PIPEDA, Bill C-26, and CCCS ITSG-33). However, US-based operations of Canadian companies are subject to TSA.

How often must I update my TSA plan?

Plans must be updated every 12 months for the annual assessment, or within 45 days of any significant operational change (new pipeline segment, major OT system upgrade, change in vendor access). TSA also reserves the right to issue updated directive requirements at any time (as it did in July 2024).

Can ThreatHawk SIEM help with TSA compliance?

Yes. ThreatHawk SIEM is pre-configured with TSA-specific correlation rules covering pipeline, rail, and aviation OT environments. It provides log retention (18+ months), real-time alerting for TSA reportable events, and automatic evidence export for CIP and annual assessment documentation. The platform also integrates with OT-specific tools (Modbus, DNP3, Siemens S7, Rockwell) for deep session-level monitoring.

We are committed to delivering cutting-edge cybersecurity solutions that empower organizations to stay ahead of threats

Contact Info

• Office Location: Canada, USA, UAE, UK, Pakistan & other global markets
• Phone: +1 (416) 576-8744
• Email: info@cybersilo.tech

Useful Links

• Home
• ThreatHawk SIEM
• Compliance Solution
• Partner Program
• About Us
• SIEM Resources
• Industry Directory
• Compliance Resources
• Threat & SOC Resources
• MSSP & Partner Resources
• SAP Security Resources
• CIS Benchmark Resources
• Product Videos
• Contact Us
• Cookie Policy
• 🍪 Cookie Preferences