Colonial Pipeline Security Incident

Skip to content August 13, 2021 TSA's Pipeline of Cybersecurity Requirements Holland & Knight Alert Shardul Desai | Marissa C. Serafino Highlights Having previously advocated for voluntary pipeline cybersecurity standards for two decades, the Transportation Security Administration (TSA) recently issued mandatory cybersecurity rules on owners and operators of pipelines in response to the Colonial Pipeline ransomware attack. What is publicly known about the TSA's latest directive is that it requires pipeline companies to immediately implement mitigation measures to protect against cyberattacks, to develop a cybersecurity contingency and recovery plan, and to conduct a cybersecurity architecture design review. With more cybersecurity regulations likely on the way, pipeline companies should assess their cybersecurity policies and procedures and consider revising them in accordance with the Critical Infrastructure Protection cybersecurity standards, which are mandated for the electric grid by the North American Electric Reliability Corporation (NERC), as an informative framework. The Transportation Security Administration (TSA) on July 20, 2021, reversed two decades of pipeline cybersecurity policies. 1 Having previously advocated for voluntary pipeline cybersecurity standards, the TSA quickly issued mandatory cybersecurity rules on owners and operators of pipelines (hereinafter, pipeline companies) in response to the Colonial Pipeline ransomware attack. 2 The latest TSA security directive (Second Directive) was deemed sensitive and was shielded from public disclosure. What is publicly known about the Second Directive is that it requires pipeline companies to immediately implement mitigation measures to protect against cyberattacks, to develop a cybersecurity contingency and recovery plan, and to conduct a cybersecurity architecture design review. These new mandatory cybersecurity rules are backed up with fines, which could be as high as $11,904 per day, per...

... (truncated for display)