TSA Pipeline Compliance
Summary: TSA Security Directive Pipeline-2021-02F, effective May 3, 2025, requires owners and operators of TSA-designated critical pipeline systems notified before July 26, 2022, to implement cybersecurity measures protecting critical cyber systems from malicious intrusions. The directive requires identifying Critical Cyber Systems, network segmentation, access controls with MFA, continuous monitoring and detection, risk-based vulnerability management, incident response planning, and regular cybersecurity assessments.
Why it matters: The renewal maintains all existing requirements as ongoing obligations rather than one-time implementations, so operators must continuously maintain and improve their Cybersecurity Implementation Plans. The sector logged 44 documented ransomware incidents in 2024, and nation-state actor VOLTZITE targeted 23 pipeline operators.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026