US TSA Pipeline & Rail Cybersecurity Security Directives
Status: SD Pipeline-2021-02G and SD 1580/82-2022-01E in force 3 May 2026 – 2 May 2027; final rule TBD
Performance-based cybersecurity requirements for TSA-designated hazardous liquid and natural gas pipelines/LNG facilities and for freight and passenger railroads: a TSA-approved Cybersecurity Implementation Plan, an incident response plan and an annual Cybersecurity Assessment Plan. The May 2026 renewals made no substantive changes. TSA's rulemaking to codify these requirements (NPRM Nov 2024) lists the final rule as "To Be Determined".
Who it applies to
- TSA-designated owner/operators of critical hazardous liquid and natural gas pipelines and LNG facilities
- Freight railroads in 49 CFR 1580.101 and other TSA-designated freight and passenger railroads
Why it matters for OT
Requires IT/OT network segmentation, access control, continuous monitoring and patching outcomes for pipeline and rail OT.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| Network segmentation policies and controls between IT and OT | IEC 62443-3-2 (zones & conduits), 62443-3-3 SR 5 |
| Access control measures (MFA, least privilege) | IEC 62443-3-3 SR 1, SR 2 |
| Continuous monitoring and detection | IEC 62443-3-3 SR 6 |
| Patch/update of OT systems based on risk | IEC 62443-2-3, 62443-3-3 SR 3 |
| Cybersecurity Assessment Plan (annual) | IEC 62443-2-1 programme review |
IEC 62443 mappings are editorial and indicative.
Recent changes
Pipeline and rail SDs renewed without substantive changes
New series letters (02G, 01E) effective 3 May 2026 through 2 May 2027.
Sources
- TSA – Security Directives and Emergency Amendments tsa.gov
- TSA – SD Pipeline-2021-02G (PDF) tsa.gov
- TSA – SD 1580/82-2022-01E (PDF) tsa.gov
- Reginfo.gov – RIN 1652-AA74 Enhancing Surface Cyber Risk Management reginfo.gov
Monitored for changes: tsa.gov, reginfo.gov. Data file: data/regulations/tsa.yaml. Not legal advice.
Get TSA SDs changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.