83 F
Washington D.C.
Friday, May 24, 2024

OIG Assesses TSA’s Pipeline Cybersecurity Directives

TSA is currently working to issue a regulation that will codify critical cybersecurity requirements for pipelines. The target for publication of the final rule is the fourth quarter of fiscal year 2024.

The Transportation Security Administration (TSA) issued two pipeline security directives in FY 2021 following the Colonial Pipeline ransomware attack. Now, the Office of Inspector General (OIG) has assessed whether these security directives addressed cyber threats and stakeholder concerns and strengthened pipeline security. 

OIG found that while the directives should strengthen pipeline operators’ posture against cyber threats, TSA did not ensure all pipeline operators adhered to security requirements contained in the directives in a timely manner. For example, OIG found that several critical pipeline operators did not meet one or more requirements in Security Directive Pipeline–2021– 02 Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing (SD-02). Additionally, TSA used action plans and warning notices to bring pipeline operators into compliance with SD-02, but TSA could not easily provide related information, such as which SD-02 requirements remained unresolved.

OIG found that TSA did not follow up and track the pipeline operators’ assessments of the effectiveness of their cybersecurity practices. This occurred, the watchdog said, because TSA does not have standard operating procedures or a formal system to track and follow up on pipeline operators’ implementation of the security directives. Without additional oversight, OIG is concerned that TSA cannot ensure full implementation of security directives, which can leave pipelines vulnerable to cyber attacks. 

In light of the audit’s findings, OIG has made three recommendations:

  • Complete rulemaking that will permanently codify critical cybersecurity requirements for pipelines. 
  • Develop standard operating procedures and a formal tracking system to ensure consistent tracking and follow-up of the implementation of security directives and eventual regulations.
  • Include a requirement to conduct follow-up inspections that ensure pipeline operators have completed mitigation activities to address cybersecurity vulnerabilities. 

TSA concurred with each recommendation and is currently working to issue a regulation that will codify critical cybersecurity requirements for pipelines. The target for publication of the final rule is the fourth quarter of fiscal year 2024. 

Read the partially redacted report at OIG

author avatar
Homeland Security Today
The Government Technology & Services Coalition's Homeland Security Today (HSToday) is the premier news and information resource for the homeland security community, dedicated to elevating the discussions and insights that can support a safe and secure nation. A non-profit magazine and media platform, HSToday provides readers with the whole story, placing facts and comments in context to inform debate and drive realistic solutions to some of the nation’s most vexing security challenges.
Homeland Security Today
Homeland Security Todayhttp://www.hstoday.us
The Government Technology & Services Coalition's Homeland Security Today (HSToday) is the premier news and information resource for the homeland security community, dedicated to elevating the discussions and insights that can support a safe and secure nation. A non-profit magazine and media platform, HSToday provides readers with the whole story, placing facts and comments in context to inform debate and drive realistic solutions to some of the nation’s most vexing security challenges.

Related Articles

- Advertisement -

Latest Articles