Conducting Architecture Reviews in Light of the New TSA Directives
Summary: TSA, the sector-specific agency for pipelines, issued its first pipeline directive on May 27 and a second on July 20, though the second directive's particulars have not been made public. The May 27 directive calls for a Validated Architecture Design Review, and Dragos reports common findings from such reviews including incomplete asset inventories, outdated network diagrams, improper account management for human and automated users, and gaps in OT visibility.
Bottom line: Pipeline operators are being asked to conduct architecture design reviews against a directive whose details TSA is keeping on a need-to-know basis, so the work of answering basic questions about what is on the network, how it communicates, and who holds accounts falls to asset owners without the full text in hand.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026