The US Transportation Security Administration has today issued Security Directive Pipeline-2021-01, the first mandatory cybersecurity requirements for critical pipeline owners and operators, following the Colonial Pipeline ransomware attack.
Key points
- Owners and operators must report cybersecurity incidents to CISA within 12 hours.
- A cybersecurity coordinator must be available 24 hours a day.
- Current practices must be reviewed against TSA guidelines, with gaps and remediation reported within 30 days.
- Further directives are expected.
The directive marks a shift from voluntary guidance to mandatory rules for US critical infrastructure. UK suppliers to US energy operators should expect incident reporting and security requirements to flow down.
Source: TSA Security Directive for pipelines announcement (DHS)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
