In May 2021, Colonial Pipeline shut down the line that carries roughly 45 percent of the East Coast’s fuel, and investigators found no sign the ransomware behind it ever reached the systems that run the pipeline. DarkSide hit the business network. Colonial stopped the flow anyway because nobody could prove where the damage ended, and fuel shortages spread across several states while the company found out.
The TSA pipeline security directive is a set of mandatory cybersecurity rules for pipeline and LNG operators that TSA designates as critical. It requires them to report cybersecurity incidents to CISA within 72 hours, keep a cybersecurity coordinator on call around the clock, and run a TSA-approved implementation plan, a tested incident response plan and an annual assessment program. If TSA hasn’t designated your company, it still matters, because customers, insurers and pending regulation now treat it as the benchmark for pipeline cybersecurity.
Here’s what it requires, who it really reaches and which parts an IT partner can own for you.
Find Your Gaps First
What Is the TSA Pipeline Security Directive?
It’s two series of security directives that TSA issues under its emergency authority in 49 U.S.C. 114(l)(2). The SD Pipeline-2021-01 series sets standing duties: incident reporting, a 24/7 cybersecurity coordinator and a vulnerability assessment. The SD Pipeline-2021-02 series carries the substance: planning, response and assessment requirements. TSA renews both every year, and the current versions are SD Pipeline-2021-01G (effective January 16, 2026) and SD Pipeline-2021-02G (effective May 3, 2026).
Check TSA’s Security Directives page before trusting any summary: the version letters keep marching through the alphabet, and many guides still describe a directive TSA has already replaced. In July 2022, TSA swapped the original prescriptive controls for outcomes: operators decide how they’ll meet each security goal, write it into a plan and get TSA’s approval. Since July 2023, they also have to prove the plan works through annual testing.
One common mix-up: TSA owns pipeline security, while the Pipeline and Hazardous Materials Safety Administration (PHMSA) owns pipeline safety. The directive sits alongside the PHMSA rules your operations team already knows, not inside them.
Who Has to Comply With the TSA Pipeline Security Directive?
Only owners and operators of hazardous liquid and natural gas pipelines or LNG facilities that TSA has notified as critical must comply. There’s no self-assessment: if TSA hasn’t contacted you, you aren’t formally bound. Companies off the list still feel the directive through customer contracts, insurance questionnaires, new designations and TSA’s pending rulemaking.
Designated operators
According to the DHS Office of Inspector General, TSA determined in May 2021 that 97 pipeline operators were critical, and the OIG’s September 2023 audit found that TSA did not ensure all of them met the directives’ requirements on time. Its first recommendation: finish the rulemaking that would make those requirements permanent.
Everyone else: four ways the directive reaches you
For mid-size midstream companies, gathering operators and the firms that serve them, the directive arrives through side doors:
- Your customers flow it down. If you connect to a covered operator’s network, expect contract language and security questionnaires that mirror the directive. TSA’s proposed permanent rule goes further and folds in CISA’s supply chain risk management goals.
- Your insurer asks the same questions. Marsh’s 12 key cybersecurity controls, the list cyber insurers use to assess risk, include MFA for remote and privileged access, endpoint detection and response, and incident response planning and testing. That’s much of the same ground the directive covers.
- Designations change. TSA’s 2025 renewal memo states that TSA will notify additional operators it identifies as critical and set specific compliance deadlines for them. An acquisition or new throughput can put you on that list.
- The rule may outgrow the list. TSA’s November 2024 proposed rule would make pipeline and rail cyber requirements permanent and sets its own applicability thresholds, such as annual gas delivery volume. As of mid-2026, TSA had not finalized it.
Treat the directive as the standard of care for pipeline cybersecurity, whether or not TSA has your phone number.
What Does SD Pipeline-2021-02G Require in 2026?
SD Pipeline-2021-02G requires covered operators to maintain a TSA-approved Cybersecurity Implementation Plan covering segmentation, access control, continuous monitoring and risk-based patching; a Cybersecurity Incident Response Plan tested every year; and a Cybersecurity Assessment Program with an annual plan and results report. The companion SD-01G adds a 24/7 coordinator and incident reporting to CISA within 72 hours.
TSA Pipeline Security Directive Requirements at a Glance (2026)
| Requirement | Directive | What it means in practice | How often |
|---|---|---|---|
| Cybersecurity Implementation Plan | SD-02G | TSA-approved plan for segmentation, access control, monitoring and risk-based patching | Ongoing; update after significant changes |
| Incident response plan testing | SD-02G | Exercise at least two of the plan's objectives | Every year |
| Cybersecurity Assessment Program | SD-02G | Submit an assessment plan to TSA and report the results | Every year |
| Architecture design review | SD-02G | Review of your cybersecurity architecture, included in the assessment plan | At least every two years |
| Cybersecurity Coordinator | SD-01G | Primary and alternate reachable by TSA and CISA | 24/7 |
| Incident reporting | SD-01G | Report to CISA through its incident reporting system | Within 72 hours of identification |
A Cybersecurity Implementation Plan
The plan describes how and when you’ll achieve each security outcome:
- Network segmentation, so operational technology can keep running safely even if IT systems are compromised.
- Access control, including multi-factor authentication and an end to shared accounts.
- Continuous monitoring and detection of threats to critical systems.
- Risk-based patching of operating systems, applications, drivers and firmware, with compensating controls where patching isn’t safe.
When TSA released the 2023 update, Dragos’s Jason Christopher told SecurityWeek that it lets operators build on standards they already use, such as the NIST Cybersecurity Framework and ISA/IEC 62443. API Standard 1164, the American Petroleum Institute’s cybersecurity standard for pipeline control systems, covers the OT side in more depth. Once TSA approves the plan, it holds you to what you committed to, not what you meant.
An incident response plan you test, and an assessment program you report
You need a written plan for containing an incident that affects IT or OT systems while keeping operations running, and you must test at least two of its objectives every year. Each year you also submit a Cybersecurity Assessment Plan for TSA approval, test your measures on a rolling schedule and report the results. That plan must include a cybersecurity architecture design review at least once every two years.
A coordinator and a 72-hour reporting clock
SD Pipeline-2021-01G requires a cybersecurity coordinator and an alternate, reachable around the clock, plus incident reporting to CISA. This is where much of the content online is out of date. The original 2021 directive set a 12-hour window. TSA extended it to 24 hours in 2022, and the January 2026 version moved it to “as soon as practicable, but no later than 72 hours” after an operator identifies an incident. TSA still recommends flagging significant incidents to TSA sooner, under Information Circular IC Surface-2025-01.
Seventy-two hours sounds generous until you remember the clock starts at identification, which assumes someone notices the incident in the first place. The new window matches the 72-hour standard in the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), though CISA’s CIRCIA rule was still not final as of mid-2026.
The directive never asks whether you'll be attacked. It asks whether you'll know, and how fast you can prove what happened.
Map the Directive to Your IT
Which Parts of the Directive Can an IT Partner Handle?
An IT and security partner can own the corporate side of the directive: 24/7 detection and escalation fast enough to report on time, phishing-resistant MFA and vendor access control, IT-side segmentation mapping, patching of corporate systems, tabletop exercises and automated compliance evidence. Control systems, PLC firmware and OT patching decisions stay with your OT engineers and control-system vendors.
Ransomware, phishing and stolen vendor credentials, the threats behind most oil and gas cybersecurity incidents, all start on the IT side, exactly where Colonial’s breach began. According to Dragos’s 2026 OT Cybersecurity Year in Review, 119 ransomware groups hit 3,300 industrial organizations in 2025, up from 80 groups the year before, and Dragos CEO Robert M. Lee warned that industrial companies underestimate ransomware’s reach into OT “because they think it’s ‘just IT”.
Endpoints, identities, email and the corporate network are what managed IT for oil and gas runs every day.
Detection fast enough to report
You can’t report an incident within 72 hours of identifying it if nobody identifies it. Detection takes endpoint detection and response (EDR) on every server and laptop, identity monitoring on Microsoft Entra ID or Active Directory, and a SIEM correlating those signals around the clock. That 24/7 watch is the core of managed security services for oil and gas, and your escalation runbook should name the person who files the report through CISA’s incident reporting form.
MFA on every remote path into operations
Remote access is where IT and operations meet. Dragos’s 2026 oil and gas briefing describes a botnet pre-staging on VPN appliances across the sector and cellular routers creating unauthorized pathways into OT. The access control outcome translates into phishing-resistant MFA (FIDO2 security keys or passkeys) on remote and privileged access, no shared logins, and vendor accounts that are time-limited, session-recorded through a privileged access management tool and closed when the job is.
According to NIST SP 800-82 Rev. 3, OT network accounts should use separate authentication mechanisms and credentials from the corporate network rather than reusing corporate user accounts. An IT partner can deploy and maintain both sets.
Segmentation documented from the IT side
The target architecture is well established: a demilitarized zone (DMZ) between the enterprise network and the control environment, so no traffic crosses directly, described in the zones-and-conduits terms of ISA/IEC 62443 that OT teams and assessors already use.
Picture a typical first mapping exercise at a mid-size operator. The risky paths usually aren’t exotic: a remote-support tool a vendor installed years ago and never removed, a shared login on a jump server, or a historian or reporting server that both the corporate and control networks can reach. None of them appears on the official network diagram, and all of them sit on the IT side of the line.
An IT partner won’t redesign your control network, but it can map every path from the corporate side, close the ones you don’t need and document the rest. Running remote field sites over SD-WAN with security built in also consolidates scattered site links into fewer, managed paths you can actually defend.
Patching, tabletops and evidence on the corporate side
Control systems patch on the OT team’s schedule. Corporate servers, laptops, firewalls and remote access appliances have no such excuse, and anything on CISA’s Known Exploited Vulnerabilities catalog goes first. For the annual test, an outside team can run tabletop exercises built from CISA’s free Tabletop Exercise Packages, using scenarios like ransomware on the business network forcing a shutdown decision. The payoff goes beyond compliance: Marsh McLennan found that firms running regular tabletop exercises are 13 percent less likely to suffer a material cyber event.
The assessment program rewards evidence that collects as a byproduct of normal work: MFA enrollment reports, EDR and SIEM logs, patch compliance reports and training records. If gathering it takes a month of screenshots every spring, the program will decay.
What Your IT Partner Shouldn't Pretend to Own
An IT and security partner doesn’t redesign SCADA networks, update PLC firmware or decide when a control system can safely take a patch. Those calls belong to your OT engineers and control-system vendors. If a provider promises to handle all of your TSA compliance from the help desk, ask which control systems it has ever patched.
The arrangement that works is a clear split: your OT team owns the control environment, your IT partner owns everything that touches it from the corporate side, and both work from one implementation plan and one incident response plan. Your IT partner should join the tabletop, own its section of the plan and get your coordinator the logs fast enough to report well inside the 72-hour window.
Frequently Asked Questions
How quickly do pipeline operators have to report a cybersecurity incident?
Under SD Pipeline-2021-01G, effective January 16, 2026, covered operators must report to CISA as soon as practicable and no later than 72 hours after identifying a cybersecurity incident. The window started at 12 hours in 2021 and moved to 24 hours in 2022, which is why many guides still quote those numbers.
Does the TSA pipeline security directive apply to LNG facilities?
Yes, if TSA has designated the facility as critical. Both directive series cover owners and operators of critical hazardous liquid and natural gas pipelines and liquefied natural gas facilities, and TSA notifies each one directly.
Is TSA's proposed pipeline cybersecurity rule final?
Not as of mid-2026. TSA proposed the rule in November 2024 to make cyber risk management requirements for pipelines and rail permanent. Until a final rule takes effect, the annual security directives remain the binding requirements.
The TSA pipeline security directive began as an emergency response to one very bad week in 2021. Treat it as a description of good practice, not a letter you hope never arrives, and you’ll be ready whichever way TSA’s list moves.
