← Frameworks / API 1164 / Control Mappings

Machine-readable: JSON API guide

API Standard 1164 Pipeline Control Systems Cybersecurity 3rd Edition

Industry standard for cybersecurity of pipeline SCADA and control systems in the oil and natural gas sector. 12 requirement areas covering risk management, security architecture, access control, system integrity, data protection, monitoring and detection, incident response, business continuity, supply chain security, personnel security, physical security, and compliance assessment. Aligned with NIST CSF and TSA Pipeline Security Directives. Used by pipeline operators for control system cybersecurity programs.

Controls: 88
Total Mappings: 90
Publisher: American Petroleum Institute (API) Version: 3rd Edition (2021)
API 1164 → SP 800-53 SP 800-53 → API 1164 Coverage Analysis
AC (7) AT (3) AU (3) CA (5) CM (6) CP (7) IA (4) IR (6) MP (2) PE (8) PL (1) PM (3) PS (6) RA (6) SA (3) SC (8) SI (4) SR (6)

AC Access Control

Control Name API 1164 References
AC-02 Account Management
Sec 6
AC-03 Access Enforcement
Sec 6
AC-04 Information Flow Enforcement
Sec 5Sec 8
AC-05 Separation of Duties
Sec 6
AC-06 Least Privilege
Sec 6
AC-07 Unsuccessful Logon Attempts
Sec 6
AC-17 Remote Access
Sec 6

AT Awareness and Training

Control Name API 1164 References
AT-01 Policy and Procedures
Sec 13
AT-02 Literacy Training and Awareness
Sec 13
AT-03 Role-based Training
Sec 13

AU Audit and Accountability

Control Name API 1164 References
AU-02 Event Logging
Sec 9
AU-03 Content of Audit Records
Sec 9
AU-06 Audit Record Review, Analysis, and Reporting
Sec 9

CA Security Assessment and Authorization

Control Name API 1164 References
CA-01 Policy and Procedures
Sec 15
CA-02 Control Assessments
Sec 15
CA-05 Plan of Action and Milestones
Sec 15
CA-07 Continuous Monitoring
Sec 9Sec 15
CA-08 Penetration Testing
Sec 15

CM Configuration Management

Control Name API 1164 References
CM-02 Baseline Configuration
Sec 7
CM-03 Configuration Change Control
Sec 7
CM-04 Impact Analyses
Sec 7
CM-06 Configuration Settings
Sec 7
CM-07 Least Functionality
Sec 7
CM-14 Signed Components
Sec 7

CP Contingency Planning

Control Name API 1164 References
CP-01 Policy and Procedures
Sec 11
CP-02 Contingency Plan
Sec 11
CP-04 Contingency Plan Testing
Sec 11
CP-06 Alternate Storage Site
Sec 11
CP-07 Alternate Processing Site
Sec 11
CP-09 System Backup
Sec 11
CP-10 System Recovery and Reconstitution
Sec 11

IA Identification and Authentication

Control Name API 1164 References
IA-02 Identification and Authentication (Organizational Users)
Sec 6
IA-03 Device Identification and Authentication
Sec 6
IA-05 Authenticator Management
Sec 6
IA-08 Identification and Authentication (Non-organizational Users)
Sec 6

IR Incident Response

Control Name API 1164 References
IR-01 Policy and Procedures
Sec 10
IR-02 Incident Response Training
Sec 10
IR-04 Incident Handling
Sec 10
IR-05 Incident Monitoring
Sec 10
IR-06 Incident Reporting
Sec 10
IR-08 Incident Response Plan
Sec 10

MP Media Protection

Control Name API 1164 References
MP-02 Media Access
Sec 8
MP-04 Media Storage
Sec 8

PE Physical and Environmental Protection

Control Name API 1164 References
PE-01 Policy and Procedures
Sec 14
PE-02 Physical Access Authorizations
Sec 14
PE-03 Physical Access Control
Sec 14
PE-04 Access Control for Transmission
Sec 14
PE-06 Monitoring Physical Access
Sec 14
PE-08 Visitor Access Records
Sec 14
PE-09 Power Equipment and Cabling
Sec 14
PE-11 Emergency Power
Sec 14

PL Planning

Control Name API 1164 References
PL-08 Security and Privacy Architectures
Sec 5

PM Program Management

Control Name API 1164 References
PM-06 Measures of Performance
Sec 15
PM-09 Risk Management Strategy
Sec 4
PM-14 Testing, Training, and Monitoring
Sec 15

PS Personnel Security

Control Name API 1164 References
PS-01 Policy and Procedures
Sec 13
PS-02 Position Risk Designation
Sec 13
PS-03 Personnel Screening
Sec 13
PS-04 Personnel Termination
Sec 13
PS-06 Access Agreements
Sec 13
PS-07 External Personnel Security
Sec 13

RA Risk Assessment

Control Name API 1164 References
RA-01 Policy and Procedures
Sec 4
RA-02 Security Categorization
Sec 4
RA-03 Risk Assessment
Sec 4
RA-05 Vulnerability Monitoring and Scanning
Sec 4
RA-07 Risk Response
Sec 4
RA-09 Criticality Analysis
Sec 4

SA System and Services Acquisition

Control Name API 1164 References
SA-04 Acquisition Process
Sec 12
SA-08 Security and Privacy Engineering Principles
Sec 5
SA-09 External System Services
Sec 12

SC System and Communications Protection

Control Name API 1164 References
SC-07 Boundary Protection
Sec 5
SC-08 Transmission Confidentiality and Integrity
Sec 8
SC-12 Cryptographic Key Establishment and Management
Sec 8
SC-13 Cryptographic Protection
Sec 8
SC-28 Protection of Information at Rest
Sec 8
SC-32 System Partitioning
Sec 5
SC-46 Cross Domain Policy Enforcement
Sec 5
SC-48 Sensor Relocation
Sec 9

SI System and Information Integrity

Control Name API 1164 References
SI-02 Flaw Remediation
Sec 7
SI-03 Malicious Code Protection
Sec 7
SI-04 System Monitoring
Sec 9
SI-07 Software, Firmware, and Information Integrity
Sec 7

SR Supply Chain Risk Management

Control Name API 1164 References
SR-01 Policy and Procedures
Sec 12
SR-02 Supply Chain Risk Management Plan
Sec 12
SR-03 Supply Chain Controls and Processes
Sec 12
SR-05 Acquisition Strategies, Tools, and Methods
Sec 12
SR-06 Supplier Assessments and Reviews
Sec 12
SR-11 Component Authenticity
Sec 12