OT Security for Pipelines: TSA-Aligned Best Practices

What Do TSA's Pipeline Security Directives Require?

TSA issued Security Directive SD-01A (effective July 2021, superseding SD-01) and SD-02A (effective May 2022) to impose mandatory cybersecurity requirements on U.S. pipeline operators. These directives apply to all owners and operators of hazardous liquid and natural gas pipelines that are subject to 49 CFR Parts 190–199, covering an estimated 2.7 million miles of pipeline infrastructure.

The core requirements under the current TSA directives include:

• Designation of a Cybersecurity Coordinator — A single point of contact available to TSA and CISA 24/7 for cybersecurity incident coordination.
• Reporting of confirmed and suspected cybersecurity incidents — Any incident that impacts or could impact pipeline operations must be reported to CISA within 12 hours of confirmation. This includes ransomware, unauthorized access to OT systems, and denial-of-service attacks affecting ICS/SCADA environments.
• Identification and assessment of critical cyber systems — Operators must inventory all digital control systems, safety instrumented systems (SIS), and supporting IT networks that could affect pipeline safety or reliability.
• Implementation of containment measures — Network segmentation between IT and OT environments, application of access controls, and deployment of continuous monitoring capabilities are mandatory.
• Development and testing of a Cybersecurity Incident Response Plan (CSIRP) — Plans must be tested at least annually, with results documented and provided to TSA upon request.
• Conducting a cybersecurity architecture design review — A one-time review, with findings and remediation plans submitted to TSA.

These directive requirements are layered on top of existing regulatory obligations under the Pipeline and Hazardous Materials Safety Administration (PHMSA) and are informed by the NIST Cybersecurity Framework (CSF) 2.0 and NIST SP 800-82 Rev. 3 (Guide to Industrial Control Systems Security).

The OT Security Threat Landscape for U.S. Pipelines

Pipeline OT environments face a distinct set of threats that differ sharply from traditional IT security concerns. Understanding these threats is a prerequisite for building an effective defense program that meets TSA expectations.

Ransomware Targeting ICS/SCADA

The Colonial Pipeline attack demonstrated that ransomware groups (in that case, DarkSide) do not need to compromise OT directly to cause operational impact. By encrypting IT billing and business systems, Colonial Pipeline’s operator took the pipeline offline proactively to prevent potential OT infection. The attack cost the company $4.4 million in ransom (later partially recovered by DOJ) and caused fuel shortages across the U.S. East Coast for up to 11 days.

CISA’s 2023 Risk Management Year in Review noted that ransomware remains the most prevalent threat to critical infrastructure, with 49% of all reported incidents involving ransomware. For pipeline operators, the attack surface includes remote access points (VPNs, jump hosts), third-party vendor connections, and unsegmented IT/OT networks — all of which are prioritized under the TSA directive requirements.

State-Sponsored APT Operations

Advanced persistent threat (APT) groups sponsored by nation-states target U.S. pipeline infrastructure for espionage, prepositioning, and potential disruption. The 2022 attack on Colonial Pipeline’s OT environment was attributed by CISA to state-aligned threat actors who deployed custom malware targeting safety instrumented systems. Similarly, CISA’s 2024 advisory (AA24-046A) detailed Russian state-sponsored cyber operations targeting North American energy sector OT assets, including pipeline control systems running GE, Siemens, and Rockwell Automation equipment.

CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) and the TSA directives both emphasize the need for detection and response capabilities against advanced threats, not just commodity ransomware.

Insider and Third-Party Vendor Threats

Pipeline OT environments rely heavily on third-party vendors for system integration, remote monitoring, and maintenance. CISA reported that 59% of energy sector breaches in 2023 involved third-party access. A compromised vendor remote-access account — often lacking multi-factor authentication (MFA) — can provide attackers a direct path into pipeline control networks. TSA Directive SD-02A specifically mandates that operators identify and manage risks associated with third-party access to critical cyber systems.

TSA-Aligned OT Security Best Practices: A Step-by-Step Implementation Guide

Below is a practical, phased approach to implementing OT security controls that map directly to TSA directive requirements. These steps follow the NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) and align with the Cybersecurity and Infrastructure Security Agency (CISA) performance goals for critical infrastructure.

How TSA Directives Map to NIST CSF 2.0 and CISA CPGs

Understanding the mapping between TSA directive requirements and the broader compliance ecosystem helps operators avoid duplicative effort. The table below aligns TSA SD-01A/SD-02A requirements with NIST CSF 2.0 functions and CISA Cross-Sector Cybersecurity Performance Goals (CPGs).

This mapping demonstrates that TSA directives are not an isolated regulatory burden — they are consistent with the broader national approach to critical infrastructure security set by CISA and NIST. Operators who achieve robust TSA compliance are also well-positioned for NIST SP 800-171 (required for federal contractors), NERC CIP (for electric utilities that also own pipelines), and emerging CIRCIA incident reporting obligations.

Common Challenges in Pipeline OT Security Implementation

Even with regulatory clarity, pipeline operators face significant technical and operational hurdles when implementing TSA-aligned security. Understanding these challenges upfront allows for better planning and resource allocation.

Legacy ICS/SCADA Equipment Without Security Capabilities

Many pipelines still run on programmable logic controllers (PLCs) and remote terminal units (RTUs) that are 15–20 years old, running proprietary, unpatched operating systems. These devices typically lack built-in logging, encryption, or authentication capabilities. Forcing security agents onto these devices is often infeasible. Instead, deploy out-of-band network monitoring taps or port mirrors on the OT network to monitor traffic without impacting operational continuity. Where feasible, replace end-of-life devices with modern equivalents that support ISA/IEC 62443-4-2 security-by-design principles.

Bandwidth Limitations in Remote Pipeline Locations

Pipeline assets — including pump stations, valve sites, and meter stations — are often located in remote areas with limited or unreliable connectivity (satellite or cellular at 1–5 Mbps). Sending full packet captures from these locations is impractical. Use edge-based data processing: deploy OT monitoring sensors at each remote site that pre-process network data, discard benign traffic, and send only correlated alerts or summary telemetry to the central SOC. This approach aligns with CISA’s guidance for constrained operational environments.

Skilled Workforce Shortage in OT Security

The demand for cybersecurity professionals with both IT security and ICS/OT domain expertise far outstrips supply. According to the 2024 ICS/OT Cybersecurity Workforce Report by Dragos, 49% of energy organizations report difficulty hiring OT security analysts. Mitigate this by augmenting in-house teams with managed SOC services in the USA that offer 24/7 OT monitoring coverage and access to threat intelligence specific to the energy sector.

Building a TSA-Ready Incident Response Plan for Pipeline Environments

Your Cybersecurity Incident Response Plan (CSIRP) must address the unique realities of OT environments. Unlike IT systems, you cannot simply reboot or reformat a compromised PLC if it controls a high-pressure natural gas pipeline. Below are the critical components TSA inspectors expect to see in your CSIRP.

Define OT-Specific Scenarios

Your tabletop exercises should cover at least three distinct OT attack scenarios per annual cycle:

• Scenario A: Ransomware in the IT/OT boundary — Attackers compromise an engineering workstation that has a persistent VPN connection to OT. The ransomware encrypts HMI project files. Exercise focuses on containment without shutting down the pipeline.
• Scenario B: Remote access compromise of a pump station — A third-party vendor’s credentials are stolen and used to access an RTU at a remote booster station. Exercise focuses on isolating the station and verifying integrity of control logic.
• Scenario C: Safety instrumented system (SIS) alert manipulation — Attackers modify SIS configuration to prevent emergency shutdown signals. Exercise focuses on manual override procedures and physical safety team coordination.

Define Communication Protocols with Regulators

Include a specific protocol for notifying TSA and CISA within the 12-hour reporting window. This should include:

• Primary and backup methods for reaching the CISA Central Watch Desk (telephone: 1-888-282-0870, web: CIRS portal).
• A pre-approved internal declaration authority (the Cybersecurity Coordinator or delegate) who can authorize reporting.
• Legal counsel review templates for public disclosure and SEC Form 8-K filing under the SEC Cyber Disclosure Rule (if publicly traded).

Define OT Recovery Procedures

For each critical system, document step-by-step recovery procedures that include:

• Identifying and verifying the integrity of known-good backup configurations.
• Restore sequence (e.g., restore network switches before PLCs, restore DCS controllers before HMIs).
• Post-restore validation tests (e.g., verify actuator response, pressure sensor accuracy).
• Documentation of "fail-safe" and "fail-steady" states for each controlled device.

The Path Forward: What's Coming for Pipeline Cybersecurity

TSA has signaled that the current Security Directives will eventually be replaced by a permanent regulation under 49 CFR. In TSA's 2024 Advance Notice of Proposed Rulemaking (ANPRM), the agency requested public comment on requirements including:

• Mandatory adoption of NIST SP 800-82 Rev. 3 as a baseline standard.
• Independent third-party assessment at least every 3 years.
• Supply chain risk management requirements for OT equipment procurement.
• Expanded reporting categories beyond "incidents" to include near-misses and precursor events.
• Potential alignment with CIRCIA's two-tier reporting structure (24-hour initial notice, 72-hour detailed report).

Additionally, the Cybersecurity and Infrastructure Security Agency's 2025 Roadmap for Critical Infrastructure Resilience identifies pipeline OT systems as a priority area for cross-sector information sharing. Operators should prepare for more prescriptive requirements around supply chain assurance, including vulnerability disclosure programs for OT hardware and firmware.

The TSA cybersecurity compliance page on CyberSilo is updated quarterly to reflect regulatory changes and provides a consolidated resource for pipeline operators navigating this evolving landscape.