TSA Pipeline Cybersecurity Directives SD02-III.G.2.b: SD02 III.G.2.b Architecture design review at least every two years

The CAP must include a cybersecurity architecture design review at least once every two years, including verification and validation of network traffic and review and analysis of system logs, to identify vulnerabilities in network design, configuration and interconnection with internal and external systems; the review is a technical assessment against government and industry standards, guidelines and best practices applicable to IT and OT, judging whether systems are designed, built and operated reliably and resiliently.