TSA Pipeline and Rail Cybersecurity Directives Guide: Obligations, Status and Compliance Steps

US pipeline and rail operators designated by the Transportation Security Administration (TSA) must meet binding cybersecurity security directives that are renewed every year, while a proposed rule to make them permanent is still not final. The directives began as emergency measures after the May 2021 ransomware attack on Colonial Pipeline and have since moved from prescriptive controls to performance-based outcomes: segmentation, access control, continuous monitoring and risk-based patching, backed by a TSA-approved implementation plan. This guide explains which directives exist, who they cover, what they require, how the November 2024 proposed rule would change them, and how to build a programme that satisfies both. It is for security, OT and compliance leads at pipeline, freight rail, passenger rail and transit operators, and for suppliers who support them. Status line: directive versions and rulemaking stage as shown on TSA and Reginfo.gov pages checked on 27 October 2026; directives are reissued regularly, so confirm the current version with TSA before relying on any date here.

Key takeaways

• Two families of directives apply. The pipeline series (SD Pipeline-2021-01 and -02) and the rail series (SD 1580-21-01, SD 1582-21-01 and SD 1580/82-2022-01) apply to owners and operators TSA has designated as critical.
• Outcomes, not checklists. The current directives require four security outcomes and a TSA-approved Cybersecurity Implementation Plan (CIP) describing how you achieve them, plus an incident response plan and an assessment programme.
• Incidents go to CISA within 24 hours. The directives require reporting of cybersecurity incidents to CISA and a 24/7 cybersecurity coordinator.
• The permanent rule is still pending. TSA published the "Enhancing Surface Cyber Risk Management" proposed rule on 7 November 2024; Reginfo.gov lists the final rule as "To Be Determined".
• Access control is where identities live. Service accounts, vendor remote access and shared OT credentials are the identities most likely to undermine the access control outcome, as Colonial Pipeline's unused VPN account showed.

Scope: who and what is covered

TSA's authority over surface transportation security lets it issue security directives that bind specific owners and operators. The cyber directives do not apply to every pipeline or railroad: they apply to those TSA has notified as critical or higher risk.

Proposed rule scope: TSA's notice of proposed rulemaking (NPRM) estimates that a TSA-approved cyber risk management (CRM) programme would be required for 73 of about 620 freight railroads, 34 of about 92 public transportation agencies and passenger railroads, and 115 of about 2,105 pipeline facilities and systems. About 71 higher-risk over-the-road bus operators would face incident reporting only. Pipeline facilities already regulated by the Coast Guard under 33 CFR parts 105 and 106 would be excluded.

What is in scope technically: the directives centre on "Critical Cyber Systems", the IT and OT systems whose compromise could disrupt operations. The outcomes apply to those systems and the connections between IT and OT. Broader regulatory context sits in the Critical Infrastructure Regulation Map.

Key obligations

Baseline requirements (the 01 series)

• Cybersecurity coordinator: a primary and alternate coordinator available 24/7 to TSA and CISA.
• Incident reporting: report cybersecurity incidents to CISA within 24 hours. TSA's NPRM notes this window was 12 hours in the first pipeline directive and was revised to 24 hours in May 2022.
• Vulnerability assessment: an assessment of current practices against TSA's requirements, with gaps and remediation reported.
• Incident response plan (rail 01 series): TSA describes the earlier rail directives as also requiring an incident response plan.

Performance-based requirements (pipeline 02 series and rail 2022-01 series)

TSA's press releases for the July 2022 pipeline and October 2022 rail directives list the same four outcomes.

• Cybersecurity Implementation Plan (CIP): a TSA-approved plan describing the specific measures used to achieve each outcome. TSA approves the plan and then inspects against it, so the plan itself becomes the compliance baseline.
• Cybersecurity Incident Response Plan (CIRP, pipelines): actions to take when an incident causes operational disruption or significant business degradation.
• Cybersecurity Assessment Program (CAP): proactive testing and regular audit of the measures, with identification and resolution of vulnerabilities. The 2025 ratification notice describes an annual CAP plan for pipelines.
• Compensating controls: the NPRM records that SD Pipeline-2021-02 accepts that some measures, such as MFA on control room workstations, may be inadvisable and that compensating controls are allowed. Document the reason and the alternative in the CIP.

What the proposed rule adds

The NPRM would move the directive requirements into 49 CFR parts 1580 (freight rail), 1582 (passenger rail and transit), 1584 (over-the-road bus) and a new part 1586 (pipelines), with a CRM programme made up of:

1. Cybersecurity Evaluation: an annual, enterprise-wide comparison of current cybersecurity profile against a target profile.
2. Cybersecurity Operational Implementation Plan (COIP): governance (an accountable executive and Cybersecurity Coordinators), identification of Critical Cyber Systems, and protect, detect, respond and recover measures.
3. CIRP: required for every in-scope owner or operator, even one with no Critical Cyber Systems.
4. Cybersecurity Assessment Plan (CAP): an assessment schedule, an annual report of results and a list of unaddressed vulnerabilities, with independent assessors.

The NPRM also asks for comment on whether new software for Critical Cyber Systems should meet CISA's Secure by Design and Secure by Default principles, and on security threat assessments for accountable executives and coordinators. These are questions, not proposed requirements.

Timeline and current status

How renewal works: each directive version runs for a fixed term, typically one year, and is reissued with a new letter. The January 2025 Federal Register ratification notice also records that the Transportation Security Oversight Board allowed TSA to extend a directive beyond its expiry if it is unchanged apart from the date and the Administrator documents the determination. Practically, operators should expect directives to continue until a final rule replaces them, and should track each reissue for changed wording.

Enforcement and penalties

• Inspections: TSA approves the CIP and then inspects against it. Inspectors look for evidence that the approved measures are in place, not just documented.
• Legal basis: the NPRM cites TSA's enforcement authority under 49 U.S.C. 114(f)(7) and notes that 6 U.S.C. 1207(d) authorises penalties against pipeline facilities and systems for non-compliance. This guide does not state penalty amounts: check current civil penalty figures with counsel.
• Oversight pressure: the DHS Office of Inspector General report OIG-23-57 found that TSA did not ensure all pipeline operators met the 2021 directive requirements on time, and recommended completing rulemaking, building a formal tracking system and adding follow-up inspections to confirm mitigation. Expect inspections to follow up on open items in your CAP.

What it means for AI agents and non-human identities

Neither the directives nor the TSA press releases mention AI agents, and the NPRM text read for this guide does not set agent-specific rules. The access control outcome, however, covers every identity that can reach a Critical Cyber System, and in pipeline and rail estates most of those are not people.

• Service and integration accounts: historian connectors, SCADA polling accounts, SCADA-to-ERP interfaces and backup agents often hold standing, shared credentials across the IT/OT boundary. List them in the CIP's access control section, with owners and rotation. See the Service Account Security Guide.
• Vendor and integrator access: remote support accounts for control system vendors are a classic weak point. The Colonial Pipeline attack began with a VPN account that was no longer used, never disabled and protected only by a password. Route all third-party access through brokered, recorded sessions. See the OT Remote Access Guide.
• Device and machine identities: RTUs, PLCs and train control equipment authenticate with certificates, keys or shared passwords. Inventory them as part of Critical Cyber System identification.
• AI agents and automation: an AI assistant or agent given access to OT data, ticketing or change systems is another identity reaching Critical Cyber Systems. Treat it as an in-scope identity: unique credentials, least privilege, human approval for any write to OT, and logging that feeds the monitoring outcome. See the Agent Identity and Access Guide.
• Where MFA is impractical: where the directive allows compensating controls (for example on control room workstations), use physical access control, allowlisted hosts and session monitoring, and record the decision in the CIP.

Compliance steps

1. Confirm designation and current versions. Check your TSA notification, obtain the current directive text from TSA's security directives page or your TSA contact, and log the version letter.
2. Identify Critical Cyber Systems. Build the inventory of IT and OT systems whose compromise could disrupt operations, including the identities that reach them.
3. Map current controls to the four outcomes. For each outcome record the control, its coverage and gaps. Use the NIST CSF 2.0 profile approach, which the NPRM's Cybersecurity Evaluation mirrors.
4. Write or update the CIP. Describe specific measures per outcome, compensating controls and timelines. Submit to TSA for approval and keep the approved version under change control.
5. Test incident reporting. Run a tabletop that exercises the 24-hour CISA report, coordinator escalation and the CIRP's IT/OT separation decision. See the OT Incident Response Guide.
6. Run the assessment programme. Schedule architecture reviews, penetration tests and control audits under the CAP, track findings to closure and report annually.
7. Prepare for the rule. Name an accountable executive, start an annual Cybersecurity Evaluation against a target profile and use independent assessors now, so the move from CIP to COIP is a relabelling rather than a rebuild.
8. Track each reissue. When TSA publishes a new letter version, compare it with the last and update the CIP if requirements changed.

Decision guidance

• Large pipeline or Class I rail operators: treat the CIP as a living engineering document owned by OT and IT jointly, with a dedicated compliance evidence repository.
• Smaller designated operators: focus on segmentation and access control first; these give most risk reduction and are what inspectors check most closely. Use managed monitoring if 24/7 staffing is impractical, but keep the coordinator role in-house.
• Not designated: the directives do not bind you, but customers, insurers and the eventual rule may expect similar controls. Use the four outcomes as a baseline.

Metrics

• CIP measure completion: percentage of approved CIP measures implemented on schedule.
• Access control coverage: percentage of Critical Cyber System accounts (human and non-human) with an owner, MFA or a documented compensating control.
• Dormant account count: number of remote access or service accounts unused for 90 days and still enabled (target zero).
• Reporting drill time: time from detection to CISA report in exercises (target well under 24 hours).
• CAP finding closure: percentage of assessment findings closed within agreed timescales.

Framework mapping

For OT-specific control depth, the IEC 62443 Guide and the NIST SP 800-82 OT Security Guide provide the zone, conduit and account management detail that a CIP can reference. Rail operators should also see the Rail Cybersecurity Guide (TS 50701).

Practitioner checklist

• Confirm TSA designation, obtain the current directive versions and record their version letters.
• Name primary and alternate cybersecurity coordinators reachable 24/7 and test the contact path.
• Document a 24-hour CISA reporting procedure and exercise it at least annually.
• Complete the Critical Cyber System inventory, including service, vendor and device identities that reach them.
• Map controls to segmentation, access control, monitoring and patching, and record compensating controls where MFA or patching is impractical.
• Keep the TSA-approved CIP under change control and update it after each directive reissue.
• Disable dormant remote access and service accounts and route vendor access through brokered, recorded sessions.
• Run the CAP with independent assessors and track findings to closure.
• Track the NPRM (RIN 1652-AA74) and prepare an accountable executive and annual Cybersecurity Evaluation.

Standards and references

• TSA: Security Directives and Emergency Amendments
• Federal Register: Enhancing Surface Cyber Risk Management, proposed rule (89 FR 88488)
• Federal Register: Ratification of Security Directives (January 2025)
• Reginfo.gov: RIN 1652-AA74 Unified Agenda entry
• TSA: TSA revises and reissues cybersecurity requirements for pipeline owners and operators
• TSA: TSA issues new cybersecurity requirements for passenger and freight railroad carriers
• DHS OIG: Better TSA tracking and follow-up for 2021 security directives implementation (OIG-23-57)
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Transportation Identity and OT Access Guide · CIRCIA Incident Reporting Guide · OT and ICS Identity and Access Guide · Energy Sector Identity and OT Access Guide. This guide summarises the TSA pipeline and rail cybersecurity security directives and the proposed surface cyber rule and is not legal advice.