TSA pipeline security directives
TSA Security Directive Pipeline-2021-02 series and the proposed Enhancing Surface Cyber Risk Management rule (Docket TSA-2022-0001)
After the 2021 Colonial Pipeline ransomware attack, TSA used its emergency authority under 49 U.S.C. 114(l) to issue security directives to TSA-designated critical pipeline owners and operators. The SD Pipeline-2021-02 series, first issued on July 19, 2021, requires specific mitigations against ransomware and other threats to IT and OT systems; in 2022 TSA moved it to performance-based requirements that let operators choose how to meet security outcomes. On November 7, 2024 TSA proposed a rule (89 FR 88488) to make cyber risk management requirements permanent for certain pipeline and rail owners and operators, including MFA or equivalent controls, least privilege, and limits on shared accounts. Comments closed on February 5, 2025. The current Unified Agenda lists the rule as a long-term action with the final rule date to be determined.
Who it applies to
The security directives apply to owners and operators of TSA-designated critical pipelines that transport hazardous liquids and natural gas, with parallel directives for higher-risk freight railroads and passenger rail and rail transit. The proposed rule would cover pipeline owners and operators above thresholds in proposed 49 CFR 1586.101, such as hazardous liquid systems delivering more than 50 million barrels a year or gas systems delivering more than 275 million dekatherms a year, plus certain rail operators, and would require a more limited incident reporting duty from certain over-the-road bus operators.
Identity requirements
- Proposed rule: include in the Cybersecurity Operational Implementation Plan (COIP) identification and authentication controls for Critical Cyber Systems, including a policy for memorized secret (password) resets with criteria and lockouts (proposed 49 CFR 1586.217(b)(1))
- Proposed rule: use multi-factor authentication, or other logical and physical controls that give risk mitigation commensurate with MFA, to supplement passwords (proposed 1586.217(b)(2)(i))
- Proposed rule: pipeline control room workstations may rely on PHMSA control room physical security (49 CFR 192.631 and 195.446) in place of MFA, if the system is identified as a Critical Cyber System and the compensating controls are described in the COIP (proposed 1586.217(b)(2)(ii))
- Proposed rule: manage access rights on least privilege and separation of duties, with documented compensating controls where that is not technically feasible (proposed 1586.217(b)(3))
- Proposed rule: limit shared accounts to those critical for operations; anyone who no longer needs access must not know the shared password, and logs must allow positive user identification of shared account use (proposed 1586.217(b)(4))
- Proposed rule: review existing domain trust relationships on a regular schedule and enforce policies to manage them (proposed 1586.217(b)(5))
- Security directives: designate a Cybersecurity Coordinator and report cybersecurity incidents to CISA within 24 hours
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | The proposed rule carries forward the directives' approach of MFA or controls of equivalent strength, with a narrow exception for pipeline control room workstations where MFA could delay emergency response. |
| Privileged access (PAM) | TSA's preamble says most intrusions are identity compromises and points to just-in-time privileged account management; the proposed text requires least privilege, separation of duties and governed shared accounts. |
| Identity governance (IGA) | Access rights must follow least privilege, people who leave a role must lose knowledge of shared credentials, and domain trusts must be reviewed on a schedule. |
| Breach notification | Covered owners and operators must report cybersecurity incidents to CISA within 24 hours under the directives, a duty the proposed rule would codify. |
| Audit, logging & accountability | Shared account use must be logged well enough to identify the individual user, and the proposed rule requires an annual Cybersecurity Assessment Plan to audit the COIP. |
Penalties
The security directives are mandatory for the owners and operators TSA designates. Under the proposed rule, each covered owner or operator would need a TSA-approved Cybersecurity Operational Implementation Plan and an annual Cybersecurity Assessment Plan, with the requirements placed in 49 CFR Parts 1580, 1582 and 1586 alongside TSA's existing surface transportation regulations.
Status and dates last verified against primary sources on 2026-11-05.
TSA pipeline security directives: frequently asked questions
- Does the TSA pipeline security directive require MFA?
- The directives and the November 2024 proposed rule require multi-factor authentication or other logical and physical controls that provide equivalent risk mitigation for access to Critical Cyber Systems. The proposed rule keeps a limited exception for pipeline control room workstations that meet PHMSA control room rules, provided the compensating physical security controls are documented.
- Is the TSA surface cyber rule final?
- No. TSA published the notice of proposed rulemaking on November 7, 2024 (89 FR 88488, RIN 1652-AA74) and comments closed on February 5, 2025. The current Unified Agenda entry on reginfo.gov lists it as a long-term action with the final rule date to be determined. TSA published a notice in January 2026 (91 FR 149) submitting a revised information collection for the SD Pipeline-2021-02 series to OMB for review.
- What is a Cybersecurity Operational Implementation Plan?
- The COIP is the TSA-approved plan in which an owner or operator describes how it meets the required security outcomes, such as network segmentation, access control, patch management and logging. Under the proposed rule, an annual Cybersecurity Assessment Plan would audit whether the COIP is working.