On May 27, 2021 the Department of Homeland Security’s (DHS) Transportation Security Administration (TSA) announced a Security Directive that will enable the department to better identify, protect against and respond to cybersecurity threats to critical companies in the pipeline sector. This is in direct response to the ransomware attack on Colonial Pipeline last month which lead to fuel shortages in multiple states.
“The cybersecurity landscape is constantly evolving and we must adapt to address new and emerging threats,” said Secretary of Homeland Security Alejandro N. Mayorkas. “The recent ransomware attack on a major petroleum pipeline demonstrates that the cybersecurity of pipeline systems is critical to our homeland security. DHS will continue to work closely with our private sector partners to support their operations and increase the resilience of our nation’s critical infrastructure.”
The Security Directive requires critical pipeline owners and operators to report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency (CISA) and to designate a Cybersecurity Coordinator, to be available 24 hours a day, seven days a week. It also requires critical pipeline owners and operators to evaluate their current cybersecurity programs as well as to identify any gaps and develop remediation measures and to report the results to TSA and CISA within 30 days.
In the wake of the Colonial attack, federal officials cited the need for cybersecurity regulatory standards (as opposed to guidelines) for pipeline operators, similar to other more highly regulated sectors such as electricity and water.
DHS stated it is applying this directive to pipelines designated by the TSA a “critical” across the nation, and that financial penalties would be imposed, to ramp up on a daily basis, for companies that do not comply with the directive. They stressed that the directive represented “step one” and would be “followed by more” actions from the Biden administration in the future to secure pipelines against cyber threats.
Next Steps – TRC Can Help:
Learn more about TRC’s support services related to Required Action E of Security Directive Pipeline-2021-01 such as gap assessments via the recommendations, reporting, procedure and practice reviews and updates. TSA Pipeline Cybersecurity Services
This action is step one and will be followed by more actions, mandatory measures and requirements from TSA to further support the pipeline industry against cyber threats by enhancing its cybersecurity and to strengthen the public-private partnership so critical to our nation. Learn more about TRC’s Physical and Cyber Security Services
Resources:
For more information on how TRC can help please contact Charles E. Venditti, PE, PMP; Pipeline Integrity Manager at
CVenditti@TRCCompanies.com.