TSA Pipeline Cybersecurity Directives SD02-II.A.3: SD02 II.A.3 Managed Security Service Providers: owner/operator keeps sole responsibility

Where an owner/operator has delegated to, or shares responsibility with, a Managed Security Service Provider for specific measures in its Cybersecurity Implementation Plan, the owner/operator retains sole responsibility under the directive for compliance with its approved plan and the directive.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in SD Pipeline-2021-02G Sections II and IV to VI: Applicability, implementation plan, records and amendments – TSA Pipeline Cybersecurity Directives

SD02-II.A.4 SD02 II.A.4 Authorized Representatives: joint liability
SD02-II.A.5 SD02 II.A.5 Scope: Critical Cyber Systems and the no-system notification
SD02-II.B.1 SD02 II.B.1 CIP content: defense-in-depth plan for Sections III.A to III.E
SD02-II.B.2 SD02 II.B.2 Implement and maintain the approved CIP and its schedule
SD02-IV.A SD02 IV.A Use of previous plans, assessments, tests and evaluations
SD02-IV.B SD02 IV.B Protection of sensitive security information
SD02-IV.C SD02 IV.C Documentation to establish compliance
SD02-V.A SD02 V Directive procedures: receipt, dissemination and submissions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All TSA Pipeline Cybersecurity Directives controls