TSA Pipeline Cybersecurity Directives SD02-II.A.5: SD02 II.A.5 Scope: Critical Cyber Systems and the no-system notification

The requirements apply to the covered owner/operator's Critical Cyber Systems. An owner/operator that determines it has none must notify TSA in writing within 60 days of the directive's effective date; TSA may disagree and ask for the methodology and rationale. If its method of operations changes, it must re-evaluate and, if it now has a Critical Cyber System, notify TSA within 60 days of the change to set a compliance schedule.