Key takeaways
- Report cybersecurity incidents to CISA.
- The second directive, Pipeline-2021-02, issued 20 July 2021, carries the substantive security-program requirements.
- TSA notifies owner/operators directly when it designates their pipeline or LNG facility as critical — there is no published, self-identifying list.
- Confirm your designation status directly with TSA, not by inference — there is no public critical-pipeline list, and the compliance clock starts from TSA's notification, not from publication of a directive revision.
Two separate TSA Security Directive series, both issued under existing statutory authority rather than new legislation, now govern cybersecurity for US pipeline and LNG operators TSA designates as critical: the Pipeline-2021-01 series sets standing reporting and coordination duties, and the Pipeline-2021-02 series (now at SD-02D, effective 27 July 2023) requires three TSA-approved cybersecurity plans. Both trace directly back to the May 2021 Colonial Pipeline ransomware attack, which disrupted fuel supply across the US East Coast and pushed TSA to act within weeks rather than wait for Congress.
SD-01: report, coordinate, assess
TSA issued Security Directive Pipeline-2021-01 on 27 May 2021, effective the next day, setting three standing duties for covered owner/operators:
Report cybersecurity incidents to CISAThe original 12-hour reporting window was extended to 24 hours by amendment SD-01B, ratified 24 June 2022 — aligning pipeline reporting with TSA's other surface transportation and aviation reporting timelines. Designate a Cybersecurity Coordinator, with a primary or alternate accessible to TSA and CISA 24 hours a day, seven days a week, to coordinate cybersecurity practices and incident response. Complete a vulnerability assessmentof current cybersecurity practices against TSA's own recommendations, identify gaps, and develop a remediation plan and timeline, reported to TSA and CISA.
SD-01 has been amended multiple times since (through at least SD-01D) to clarify these duties, but the three-part structure — report, coordinate, assess — has stayed stable since 2021.
SD-02: from prescriptive rules to a performance-based model
The second directive, Pipeline-2021-02, issued 20 July 2021, carries the substantive security-program requirements. Industry pushback on the original 2021 text — criticized as overly prescriptive for a sector with highly varied OT environments — led TSA to revise it as SD-02C in 2022, shifting to a performance-based model aligned with frameworks like NIST CSF, IEC 62443 and ISA-99 rather than mandating specific technical controls by a fixed date. See our NIST SP 800-82 OT security and IEC 62443-3-3 guides for the underlying frameworks TSA's performance-based language draws on.
The three required plans
| Plan | What it covers |
|---|---|
| Cybersecurity Implementation Plan (CIP) | The operator's TSA-approved description of the specific cybersecurity measures it uses to achieve the directive's required outcomes — network segmentation, access control, continuous monitoring and patching, among others — and how the operator verifies they work |
| Cybersecurity Incident Response Plan | How the operator detects, responds to and recovers from a cybersecurity incident affecting IT or OT systems, with named roles |
| Cybersecurity Assessment Plan | How the operator tests and audits its own CIP measures on a recurring schedule, reported to TSA |
SD-02D (2023): more audit rigor, not a new framework
SD-02D, effective 27 July 2023, supersedes SD-02C. TSA describes it as a minor revision reinforcing SD-02C's community-developed controls rather than a new framework, but it adds real procedural teeth:
- Rolling three-year audit cycle: at least 30% of the Assessment Plan's policies, procedures, measures and capabilities must be assessed each year, so the full plan is covered every three years, with annual Assessment Plan reports submitted to TSA.
- Mandatory annual tabletop exercises testing the Incident Response Plan, covering at least two plan objectives, with the specific named roles who participate in the exercise documented.
- Critical Cyber System designation challenge process: if TSA disagrees with an operator's list of in-scope critical systems, the operator may need to justify exclusions or add systems TSA identifies.
- A 60-day notification requirement for an operator that determines it has no Critical Cyber Systems, with a duty to reassess that determination after operational changes.
Who is covered, and how well-implemented it is
TSA notifies owner/operators directly when it designates their pipeline or LNG facility as critical — there is no published, self-identifying list. Operators notified before 26 July 2022 are covered under the current SD-02D baseline; TSA can add others later, each on their own compliance timeline from the date of notification. A DHS Office of Inspector General audit (OIG-23-57, September 2023) found implementation uneven in the directives' first two years: some designated critical operators had not met one or more SD-02 requirements, and TSA had issued multiple warning notices for violations — worth knowing if you're a covered operator assuming self-reported compliance is sufficient without expecting active TSA follow-up.
How this fits alongside other OT/ICS obligations
TSA's directive authority is sector-specific to pipeline/LNG transportation, so a covered operator that also runs other critical infrastructure assets may face overlapping obligations: compare against NERC CIP if the same organization also operates bulk electric system assets, or Australia's SOCI Act and CISA's CIRCIA for the closest non-US and more general US analogues to this reporting-plus-risk-management structure. Unlike CIRCIA, which as of this guide's research still has no binding reporting rule in force, TSA's pipeline directives have been operational, audited and enforced since 2021.
A workable starting point
Confirm your designation status directly with TSA, not by inference — there is no public critical-pipeline list, and the compliance clock starts from TSA's notification, not from publication of a directive revision. Build the Cybersecurity Coordinator and 24-hour reporting path before an incident, not during one — SD-01's 24/7 availability requirement assumes this already exists. Treat the CIP as a living document tied to your assessment schedule, not a one-time submission — SD-02D's 30%-per-year, three-year audit cycle only works if the plan, the assessment evidence and the tabletop exercise records stay synchronized. Run the annual tabletop exercise against named roles, not a generic scenario — SD-02D specifically requires documenting which positions participated and which two-plus Incident Response Plan objectives were tested. Expect active TSA follow-up, not passive filingThe 2023 OIG audit found real gaps between what operators reported and what they had actually implemented; build evidence you could defend in an audit, not just a plan you could submit.
SoftWSP's OT Snapshot assessment can help build the segmentation, access-control and monitoring evidence a TSA-approved Cybersecurity Implementation Plan and its supporting Assessment Plan expect: see OT Snapshot.
This guide summarizes TSA's own published security directive text, Federal Register notices, a DHS Office of Inspector General audit report, and independent secondary legal/industry analysis current as of this guide's last-updated date. TSA security directives are Sensitive Security Information in places and subject to revision; this is general information, not legal or compliance advice — confirm your specific obligations directly with TSA before relying on this guide for a compliance decision.
Sources
- TSA: Security Directive Pipeline-2021-02C (SD02C), 21 July 2022
- TSA: Security Directive Pipeline-2021-01D
- Federal Register, Vol. 86, No. 183 (24 September 2021): notice referencing Security Directive Pipeline-2021-01 issuance and ratification
- Federal Register (6 June 2023): TSA pipeline/LNG cybersecurity notice
- DHS Office of Inspector General: Better TSA Tracking and Follow-up Needed for the 2021 Pipeline Cybersecurity Requirements (OIG-23-57, September 2023)
- Davis Wright Tremaine: TSA Updates Cybersecurity Requirements for 'Critical' Pipelines and LNG Facilities (SD-02D analysis)
- Dragos: TSA Security Directive Pipeline-2021-02D Reinforces Requirement for Tabletop Exercises and Rigor in Plan Auditing
- CISA: Pipeline Cybersecurity (Transportation Systems Sector)
Frequently asked questions
What triggered TSA's pipeline cybersecurity directives, and when were they issued?
The May 2021 Colonial Pipeline ransomware attack, which disrupted fuel supply across the US East Coast, led TSA to issue Security Directive Pipeline-2021-01 on 27 May 2021 (effective 28 May 2021) under its existing statutory security-directive authority over pipeline transportation, rather than through new legislation. A second, more substantive directive series, Pipeline-2021-02, followed on 20 July 2021 (effective 26 July 2021).
What does the SD Pipeline-2021-01 series require?
The original SD-01, per TSA's own directive text and secondary legal summaries, set three standing duties for covered owner/operators: report cybersecurity incidents to CISA (the original 12-hour window was extended to 24 hours by amendment SD-01B, ratified 24 June 2022); designate a Cybersecurity Coordinator, with a primary or alternate accessible to TSA and CISA 24 hours a day, seven days a week; and complete a vulnerability assessment of current cybersecurity practices against TSA's recommendations, identifying gaps and a remediation plan and timeline.
What does the SD Pipeline-2021-02 series (02C, 02D) require, and how is it different from SD-01?
Where SD-01 set standing reporting and coordination duties, the 02 series carries the substantive security-program requirements. The original SD-02 (July 2021) was criticized by industry as overly prescriptive; TSA's revision, SD-02C (2022), shifted to a performance-based model requiring covered owner/operators to develop and get TSA approval for a Cybersecurity Implementation Plan (CIP), alongside a Cybersecurity Incident Response Plan and a Cybersecurity Assessment Plan — rather than mandating specific technical controls by a fixed date. SD-02D, effective 27 July 2023, supersedes SD-02C without a major overhaul: it keeps the same three-plan structure but adds audit specificity (at least 30% of the Assessment Plan's measures tested each year, so all of it is covered over a rolling three-year cycle), mandatory annual tabletop exercises testing at least two Incident Response Plan objectives with named-role participants, and a process for TSA to challenge an operator's Critical Cyber System designations.
Who is covered by these directives?
TSA-designated owner/operators of 'critical' pipeline and, as of the SD-02 series' later revisions, liquefied natural gas (LNG) facilities — entities TSA notifies directly rather than a published, self-identifying list. Owner/operators notified of critical status before 26 July 2022 are covered under the current SD-02D baseline; TSA can and has added additional owner/operators subsequently, each with their own compliance deadline once notified. A DHS Office of Inspector General audit found implementation uneven in the directives' first two years, with some critical operators not meeting one or more SD-02 requirements and TSA issuing warning notices for violations.
In this cluster
