How to Identify Cyber Critical Systems with a Crown Jewel Analysis
Summary: TSA Security Directive Pipeline-2021-02C requires owners and operators of critical pipelines and LNG facilities to identify their cyber critical systems, defined as any information or operational technology system or data that, if compromised or exploited, could result in operational disruption. Dragos describes its crown jewel analysis as a repeatable scoping model that walks through six layers of functional output, functional dependencies, and exposure to show how an attacker would assess a system to achieve a specific consequence.
What you should know: The directive tells pipeline and LNG operators to name their cyber critical systems but gives no guidance on how to do it, leaving each organization to define for itself which OT assets could cause operational disruption, financial damage, or threats to human safety if compromised.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026