Electric/Gas Utilities and Oil/Gas Pipelines Security Incident

Post Meta Related Post August 12, 2021 Power Cybersecurity Directives Require Quick Action by Electric/Gas Utilities by Michael D. Falk Related Posts August 4, 2025 Power Q&A: Gaining More Life From Nuclear Assets Is Sensible Strategy by The Burns & McDonnell Team July 30, 2025 Power Solving the Repowering Puzzle: Why Early Integrated EPC Involvement Matters by Adam Doiron July 29, 2025 Power 5 Powerful Reasons for Early Action on FERC Order 881 Compliance by Sam Agranoff Share The federal Transportation Security Administration (TSA) is moving quickly to ramp up the ability of utilities and pipelines to defend themselves against future cyberattacks. The TSA has issued two recent security directives (SDs) that require comprehensive assessments of assets owned and operated by electric and gas utilities as well as oil and gas pipelines. The first SD was issued May 28, 2021, shortly after a ransomware attack that caused Colonial Pipeline to shut down its system for five days. That initial SD was sent as a reminder to pipeline operators that they must complete self-assessments of security measures enacted under 2018 TSA cybersecurity guidelines. The May SD also established new requirements for internal security staffing and reporting of any cyberattacks or related incidents to the Cybersecurity and Infrastructure Security Agency (CISA). On July 20, 2021, TSA issued its second directive (SD2) requiring both pipelines and utilities to conduct assessments of assets and operations to determine if they meet new criteria defining critical energy infrastructure. Called a criticality analysis, this comprehensive assessment is required for all assets that may have exposure to cyberattacks. The SD2 contains additional requirements and sets strict deadlines for compliance, going well beyond requirements of the earlier SD. If any assets are deemed to meet the criteria as critical energy infrastructure, cyber asset inventories must be completed, security vulnerability assessments...

... (truncated for display)