TSA Pipeline Cybersecurity Directives SD02-II.B.1: SD02 II.B.1 CIP content: defense-in-depth plan for Sections III.A to III.E

The CIP must provide the information Sections III.A to III.E require and describe in detail the owner/operator's defense-in-depth plan, including physical and logical security controls, for meeting each of those requirements (Critical Cyber System identification, network segmentation, access control, continuous monitoring and detection, patch management).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in SD Pipeline-2021-02G Sections II and IV to VI: Applicability, implementation plan, records and amendments – TSA Pipeline Cybersecurity Directives

SD02-II.A.3 SD02 II.A.3 Managed Security Service Providers: owner/operator keeps sole responsibility
SD02-II.A.4 SD02 II.A.4 Authorized Representatives: joint liability
SD02-II.A.5 SD02 II.A.5 Scope: Critical Cyber Systems and the no-system notification
SD02-II.B.2 SD02 II.B.2 Implement and maintain the approved CIP and its schedule
SD02-IV.A SD02 IV.A Use of previous plans, assessments, tests and evaluations
SD02-IV.B SD02 IV.B Protection of sensitive security information
SD02-IV.C SD02 IV.C Documentation to establish compliance
SD02-V.A SD02 V Directive procedures: receipt, dissemination and submissions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All TSA Pipeline Cybersecurity Directives controls