TSA Pipeline Security Directives

TSA Security Directives for pipeline operators - cybersecurity architecture, IR plans, vulnerability mgmt.


Short name	TSA SD
Region	Americas
Country or scope	United States
Sector	Energy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers TSA SD

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for TSA SD.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for TSA SD and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TSA-SD02-INV` Critical Cyber System Identification	Owner/operators must identify their critical cyber systems in the Cybersecurity Implementation Plan; an enumerated inventory of the software components composing those systems is the foundational artifact (TSA SD Pipeline-2021-02 series, Cybersecurity Implementation Plan requirements)	Scan
`TSA-SD02-IDENT` Unambiguous Asset Identification	Risk-based defense of critical cyber systems requires each software asset to be matchable against vulnerability intelligence; components should carry standard identifiers (PURL/CPE) at a high coverage bar befitting critical infrastructure (TSA SD Pipeline-2021-02 series, asset identification provisions)	Scan
`TSA-SD02-PATCH` Patch and Update Management	Operators must apply security patches and updates for operating systems, applications, drivers and firmware on a risk-informed timeline to reduce the risk of exploitation of unpatched systems; this requires near-complete version records across the estate (TSA SD Pipeline-2021-02 series, patch-management provisions)	Scan
`TSA-SD02-VERS` Determinable Versions for Risk Assessment	Risk-based patch prioritisation collapses if deployed versions are indeterminate; vague version declarations (latest, wildcards, ranges) make exposure to a given CVE unassessable (TSA SD Pipeline-2021-02 series, vulnerability-management provisions)	Scan
`TSA-SD02-DETECT` Integrity Monitoring and Threat Detection	Continuous monitoring and detection policies must be able to detect malicious activity and unauthorised change on critical cyber systems; baseline integrity hashes for deployed components are the reference point for detecting tampering (TSA SD Pipeline-2021-02 series, monitoring and detection provisions)	Scan
`TSA-SD01-COORD` Cybersecurity Coordinator Contact	Owner/operators must designate a cybersecurity coordinator available to TSA and CISA 24/7 and report incidents to CISA within the mandated window; a recorded, reachable responsible contact in system documentation evidences that accountability chain (TSA SD Pipeline-2021-01, coordinator and incident-reporting requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TSA-IP-01`	Cybersecurity Implementation Plan
`TSA-IR-01`	Incident Response Plan
`TSA-VA-01`	Vulnerability Assessment
`TSA-NS-01`	Network Segmentation
`TSA-MFA-01`	Multi-Factor Authentication
`TSA-PM-01`	Patch & Update Management
`TSA-CA-01`	Cybersecurity Architecture Review
`TSA-AC-01`	Least Privilege Access Control
`TSA-LOG-01`	Security Logging & Monitoring
`TSA-PT-01`	Pipeline Cybersecurity Training

Policy templates

Written for TSA SD:

Pipeline Cybersecurity Implementation Plan: TSA SD 2021-02
Pipeline Cybersecurity Incident Response Plan: TSA SD 2021-02
Pipeline Cybersecurity Vulnerability Assessment Plan: TSA SD 2021-02

And 22 from the standard set, adapted to TSA SD.