TSA Pipeline Security Directives (SD-1 and SD-2)
Mandatory cybersecurity requirements for owner/operators of hazardous liquid and natural gas pipelines designated as critical infrastructure by TSA. Security Directive Pipeline-2021-01 (SD-1) requires cybersecurity coordinator designation, 24-hour incident reporting to CISA, vulnerability assessment, and remediation. Security Directive Pipeline-2021-02 (SD-2) mandates network segmentation, access control, continuous monitoring, patch management, cybersecurity implementation plans, architecture design review, testing, and training. Issued following the Colonial Pipeline ransomware attack.
Controls: 48
Total Mappings: 56
Publisher: Transportation Security Administration (TSA) Version: 2021 (reissued 2023) AC Access Control
| Control | Name | TSA Pipeline SD References |
|---|---|---|
| AC-02 | Account Management | SD-2 Sec B |
| AC-03 | Access Enforcement | SD-2 Sec B |
| AC-04 | Information Flow Enforcement | SD-2 Sec A |
| AC-05 | Separation of Duties | SD-2 Sec B |
| AC-06 | Least Privilege | SD-2 Sec B |
| AC-07 | Unsuccessful Logon Attempts | SD-2 Sec B |
| AC-17 | Remote Access | SD-2 Sec B |
AT Awareness and Training
AU Audit and Accountability
CA Security Assessment and Authorization
CM Configuration Management
IA Identification and Authentication
IR Incident Response
PL Planning
PM Program Management
| Control | Name | TSA Pipeline SD References |
|---|---|---|
| PM-01 | Information Security Program Plan | SD-1 Sec 1SD-2 Sec E |
| PM-02 | Information Security Program Leadership Role | SD-1 Sec 1 |
| PM-04 | Plan of Action and Milestones Process | SD-1 Sec 4 |
| PM-09 | Risk Management Strategy | SD-2 Sec E |
| PM-10 | Authorization Process | SD-1 Sec 1 |
| PM-13 | Security and Privacy Workforce | SD-2 Sec H |
| PM-15 | Security and Privacy Groups and Associations | SD-1 Sec 2 |