TSA Pipeline Cybersecurity Directives SD02-III.G.2.d: SD02 III.G.2.d Schedule covering one-third each year and all over three years

The CAP must schedule the assessment and auditing of the measures required by G.2.a to G.2.c so that at least one-third of the policies, procedures, measures and capabilities in the approved CIP are assessed each year and 100 percent over any three-year period (02E replaced '30 percent' with one-third).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in SD Pipeline-2021-02G Section III.G: Cybersecurity Assessment Plan – TSA Pipeline Cybersecurity Directives

SD02-III.G.1 SD02 III.G.1 Develop a Cybersecurity Assessment Plan
SD02-III.G.2.a SD02 III.G.2.a Assess the effectiveness of the approved CIP
SD02-III.G.2.b SD02 III.G.2.b Architecture design review at least every two years
SD02-III.G.2.c SD02 III.G.2.c Other assessment capabilities: penetration testing, red and purple teams
SD02-III.G.2.e SD02 III.G.2.e Annual report content
SD02-III.G.3 SD02 III.G.3 Submit the CAP annually for approval
SD02-III.G.4 SD02 III.G.4 Submit the CAP annual report

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All TSA Pipeline Cybersecurity Directives controls