TSA Pipeline Directive SD02F
TSA Pipeline Cybersecurity Planning, Testing & Mitigation
TSA Pipeline Cybersecurity Directive SD02F [2025]
On May 1, 2025, the U.S. Department of Homeland Security Transportation Security Administration, issued an update to their TSA pipeline directive SD02E previously updated in July 2024. The new TSA cybersecurity pipeline directive SD02F is effective as of May 3, 2025. The Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing directive is targeted towards Owner/Operators of hazardous liquid, natural gas pipelines, liquefied natural gas facilities, and lays out a timeline along with actions required for compliance.
This update continues to require a performance-based approach. Per the TSA, the following high-level cybersecurity requirements will be met to prevent disruption and degradation to TSA identified facilities:
In order to meet the criteria of the 2025 TSA pipeline security directive update, Mangan Cybersecurity recommends a tiered approach be followed including these steps:
Training – Identify capabilities to meet the SD02F and execute operations-specific training for PMs, Engineers, and OT Cyber Personnel.
To engage with Mangan about an assessment to satisfy all of the TSA SD02F Requirements, chat live with one of representatives 24/7 so we can gather your contact information, or you can reach out and contact us via phone or email.
What is the TSA Pipeline Directive?
Back in 2021 the TSA launched a set of mandatory cybersecurity rules for critical pipelines and LNG facilities. The TSA pipeline directive sets immediately applicable expectations for a cybersecurity program to developed and maintained by identified owner/operators. These requirements for the TSA pipeline cybersecurity directive include the following:
- The requirements apply to all notified Owner/Operators as well as additional ‘Critical Pipeline Systems or Facilities’ identified by the TSA after the notification date. All newly identified Owner/Operators will be notified by the TSA and provided with specific compliance deadlines for the requirements of the Security Directive.
- If an Owner/Operator determines they do not have Critical Cyber Systems, they must notify the TSA in writing within 60 days of the effective date of this security directive.
- All Owner/Operators shall submit a Cybersecurity Implementation Plan for TSA approval. This plan sets the security measures and requirements against which TSA inspects for compliance.
- If an Owner/Operator is denied approval of their updated Cybersecurity Implementation Plan they must file a petition for reconsideration no later than 30 Calendar Days.
- Implementation of a ‘zero trust’ policy to manage unauthorized execution, monitoring or data acquisition both internal to OT networks as well as inter IT/OT networks is expected. The Cybersecurity Implementation Plan must also include time-based evaluation and execution of the following:
- Identification of all OT based Critical Systems
- Network segmentation policies and controls that include an isolated interface between IT and OT environments
- Understanding and definition of all external connections (whether for ingress or egress) from the OT environment
- IT/OT zone boundaries, definitions, logical segmentation, criticality, consequence, and necessity for business continuity
- Security approach for protecting zones while data is at rest and in transit; this may include new encryption requirements
- Access control measure for both local and remote systems access and control including:
- Identification and authentication policies and procedures
- Schedules for password and/or security resets
- Mitigation strategies for systems incapable of managing password resets automatically or via procedure
- Multi-factor authentication
- Access rights based on the principle of ‘least privilege’ including separation of duties and admin access controls
- Assessment and remediation inasmuch as possible for shared login accounts and procedures that describe the compensating controls that will be applied
- Implementation of continuous monitoring and detection policies and procedures to prevent, detect, and respond to cybersecurity threats and/or attacks
- Malicious email protections
- Security controls to prevent access or communication with potentially malicious operators
- Security controls to minimize web access with potentially malicious sites
- Blocking of unauthorized code including macros, shareware, and customized applications
- Procedure to audit unauthorized access
- Procedure to document communications to/from OT systems that deviate from pretested and approved communication paths
- Procedure to identify and respond to execution of unauthorized code
- Procedure to Implement capabilities to define, prioritize, and drive standardized incident response activities
- Policies that address continuous collection of data associated with potential intrusions and retention timeframes
- Implementation strategies to isolate systems deemed as potentially compromised both within the OT network and to/from the IT environment
- Provisions and standards for proper patch management of all OT systems, controllers and devices including a risk methodology for categorizing patches or updates
- Prioritization of all security patches and updates on CISA’s Known Exploited Vulnerabilities Catalog
- Owner/Operators must have an up-to-date Cybersecurity Incident Response Plan for the Critical Cyber Systems that include measures to reduce the risk of operational disruption, or the risk of other significant impacts on necessary capacity, should their pipeline or facility experience a cybersecurity incident. This response plan must provide measure sufficient to ensure the following objectives:
- Prompt containment of infected systems
- Segregation of infected networks to ensure malicious code does not spread further
- Ensure the security and integrity of backed-up data including methods to separately store data and procedures to ensure data for testing and restoration is free of malicious code.
- Establish capability and governance for isolating IT and OT systems in the event of a cyber incident
- Must identify who (by position) is responsible for implementing specific measures in the Incident Response Plan and all required resources
- Inclusion of cybersecurity architecture design review at least once every two years.
- Incorporation of other assessment capabilities such as penetration testing and “red” and “purple” team adversarial testing.
- Implementation of a schedule for assessing and auditing specific cybersecurity measures.
- Maintain Secure and up-to-date records available to the TSA at any time for the following and have all the following documentation in order to establish compliance:
- All documentation for hardware/software asset inventory, including supervisory control, and data acquisition systems.
- All documentation for Firewall Rules
- All documentation for Network diagrams, switch and router configurations, architecture diagrams, publicly routable internet protocol addresses, and virtual Local Area Networks
- All documentation for Policy, procedural, and other documents that informed the development, and documented implementation of, the Owner/Operator’s Cybersecurity Implementation PIan, Cybersecurity Incident Response PIan, Cybersecurity Assessment Plan, and assessment or audit results.
- All documentation for a “snapshot” of activity on and between Information and Operational Technology systems, such as log files, network traffic captures, East-West Traffic (Inside OT Network), North-South Traffic (Outside OT Network)
July 2023 Updates (SD02D)
- Owner/Operators to re-assess and reach out to the TSA if it’s determined ‘they now have’ Critical Cyber Systems whenever their operation methods change.
- Owner/Operators to follow Section VI procedures in this security directive if their Cybersecurity Implementation Plan changes due to the July 2023 update.
- Cybersecurity Implementation Plan “Alternative Measures” and attachments from SD02C – Removed.
- TSA (post consultation) may inform Owner/Operators to include additional Critical Cyber Systems in their Cybersecurity Implementation Plan.
- Owner/Operators are required to test at least two Cybersecurity Incident Response Plan objectives no less than annually. Identified employees (by position) must participate in the required Cybersecurity Incident Response Plan exercise.
- Cybersecurity Assessment Program replaced with “Cybersecurity Assessment Plan” (CAP)
- Owner/Operators to submit annual Cybersecurity Assessment Plan update for TSA approval with subsequent updates requiring approval also.
- Cybersecurity Assessment Plan will include a timeline ensuring at least 30% of the policies, procedures, measures, and capabilities included in the Cybersecurity Implementation Plan are evaluated annually – with 100% evaluated by three years.
- Annual Cybersecurity Assessment Plan report submission to TSA required. Including Cybersecurity Implementation Plan evaluation results and methods utilized for determining if the annually evaluated Cybersecurity Implementation Plan items are proving effective as originally planned.
- All previously developed plans, assessments, test, and evaluations utilized to meet the security directive requirements (listed in the index) – must now be included in the Cybersecurity Implementation Plan and provided to the TSA as needed.
- Owner/Operators must submit all documentation in the manner defined by the TSA.
July 2024 Updates (SD02E)
- Owner/Operator shares responsibility with a Managed Security Service Provider for specific security measures in their Cybersecurity Implementation Plan (CIP), the Owner/Operator remains solely responsible for ensuring compliance with the TSA-approved CIP and this security directive.
- Authorized Representative, empowered by the Owner/Operator, can coordinate or conduct activities required by this security directive or the TSA-approved CIP. Both the Owner/Operator and the Authorized Representative are liable for any non-compliance with the CIP and this security directive.
- Changes “30 percent” term to “one-third (1/3)” for Cybersecurity Assessment Plan (CAP) submissions. This edit clarifies that at least one-third of the TSA-approved CIP and Critical Cyber Systems must be assessed each year, ensuring 100% are assessed every three years.
- Clarifies that the annual CAP report must cover assessments conducted “in the previous 12 months.”
- Clarifies the deadline for submitting CAPs to TSA. Owner/Operators must submit their CAP annually, no later than 12 months after TSA’s approval of the previous CAP.
- Clarifies the deadline for submitting annual CAP reports to TSA. They must be submitted within 12 months of TSA’s approval of the most recent CAP.
- Defines “Authorized Representative” as a non-employee authorized to act on the Owner/Operator’s behalf to perform tasks required by the security directive or TSA-approved CIP. This can include agents, contractors, and subcontractors, but not “Managed Security Service Providers”.
- Defines “business critical functions” as the Owner/Operator’s determination of the capacity or capabilities needed to support essential operations and supply chain expectations. This term, when used in the context of “operational disruption,” does not change which systems must be identified as critical.
- Updates the definition of “days” to clarify that if a requirement’s deadline falls on a federal holiday, the compliance deadline will be the next federal business day.
- Adds the term “Managed Security Service Providers” (MSSPs) are individuals or companies who are not directly employed by the Owner/Operator but offer services or capabilities needed to meet security requirements and TSA-approved CIP standards. MSSPs provide logical services or capabilities but are not considered Authorized Representatives.
- The term “Operational disruption” now means any deviation or interruption of crucial business functions caused by data loss, system issues, or loss of control. The term ‘business critical functions’ is used instead of ‘necessary capacity’ in this updated definition.
- Several sections of the SD have been updated to replace ‘necessary capacity’ with ‘business critical functions,’ in line with the new definition of “operational disruption”.
May 2025 Updates (SD02F)
- No updates. Continues to require performance-based regulatory cybersecurity measures.
TSA Pipeline Directive Recommendations
At Mangan Cybersecurity, we know that meeting these objectives is not only paramount, but essential. This is why to strive to be proactive with our planning and remediation efforts and know that projects may require that the TSA cybersecurity pipeline directive mandates be understood, evaluated, and potentially applied.
In order to meet the criteria of the 2025 TSA pipeline security directive update, Mangan Cybersecurity recommends a tiered approach be followed including these steps:
Assessment – Review to the TSA pipeline directive to determine the areas and environment that need to be covered in the cybersecurity implementation plan.
Training – Identify capabilities to meet the SD02F and execute operations-specific training for PMs, Engineers, and OT Cyber Personnel.
Strategize – Develop the cybersecurity implementation plan and a cybersecurity incident response plan that can be tested and evaluated for projects and facilities that reside within the TSA directive requirements.
Execute – Complete and implement the plans utilizing Mangan Cybersecurity’s ICSSbD® methodology to provide a comprehensive OT cybersecurity management system and remain both compliant and proactive with the current TSA pipeline directive requirements.
To engage with Mangan about an assessment to satisfy all of the TSA SD02F Requirements, chat live with one of representatives 24/7 so we can gather your contact information, or you can reach out and contact us via phone or email.
