TSA Security Directive Requires 30-Day Cybersecurity Assessments, Rapid Incident Notification For "Critical" Pipeline And LNG Facilities

Less than a month after the high-profile ransomware attack against Colonial Pipeline, the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has issued its first-ever set of mandatory cybersecurity rules for pipelines and liquefied natural gas (LNG) facilities.

The TSA, which assumed primary responsibility for security of pipelines and other oil and gas distribution infrastructure when it was created in 2001, had previously issued only voluntary Pipeline Security Guidelines (the Guidelines). Following the Colonial Pipeline attack, which we discussed in a prior blog post, the TSA faced both criticism for its voluntary approach to pipeline cybersecurity and calls for mandatory rules similar to those in place for the electric power grid.