TSA's Pipeline Of Cybersecurity Requirements

Highlights

• Having previously advocated for voluntary pipeline cybersecurity standards for two decades, the Transportation Security Administration (TSA) recently issued mandatory cybersecurity rules on owners and operators of pipelines in response to the Colonial Pipeline ransomware attack.
• What is publicly known about the TSA's latest directive is that it requires pipeline companies to immediately implement mitigation measures to protect against cyberattacks, to develop a cybersecurity contingency and recovery plan, and to conduct a cybersecurity architecture design review.
• With more cybersecurity regulations likely on the way, pipeline companies should assess their cybersecurity policies and procedures and consider revising them in accordance with the Critical Infrastructure Protection cybersecurity standards, which are mandated for the electric grid by the North American Electric Reliability Corporation (NERC), as an informative framework.