How to Implement the Revised TSA Pipeline Security Directive
Summary: On July 21, 2022, TSA issued Security Directive Pipeline-2021-02C, effective July 27, 2022, replacing Pipeline-2021-02B and shifting pipeline cybersecurity requirements from a prescriptive, compliance-based standard to a functional, performance-based one. The directive requires a draft Cybersecurity Implementation Plan within 90 days (October 25, 2022), a draft Cybersecurity Assessment Plan within 60 days of TSA approval, and alignment with NIST CSF, API 1164, and ISA/IEC 62443.
Bottom line: TSA now expects owners and operators to agree risk-based decisions with the agency rather than check boxes by a fixed date, so the 90-day implementation plan draft is the point where your documented approach to segmentation, continuous monitoring, MFA compensating controls, and patch prioritization becomes the basis for a defensible architecture.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026