TSA Pipeline Cybersecurity Directives SD02-IV.A: SD02 IV.A Use of previous plans, assessments, tests and evaluations

Owner/operators may use previously developed plans, assessments, tests and evaluations to meet the directive; if they do, they must keep an index of the records and their location in the same sequence as the directive's requirements, incorporate the materials explicitly by reference into the CIP and make them available to TSA on request.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in SD Pipeline-2021-02G Sections II and IV to VI: Applicability, implementation plan, records and amendments – TSA Pipeline Cybersecurity Directives

SD02-II.A.3 SD02 II.A.3 Managed Security Service Providers: owner/operator keeps sole responsibility
SD02-II.A.4 SD02 II.A.4 Authorized Representatives: joint liability
SD02-II.A.5 SD02 II.A.5 Scope: Critical Cyber Systems and the no-system notification
SD02-II.B.1 SD02 II.B.1 CIP content: defense-in-depth plan for Sections III.A to III.E
SD02-II.B.2 SD02 II.B.2 Implement and maintain the approved CIP and its schedule
SD02-IV.B SD02 IV.B Protection of sensitive security information
SD02-IV.C SD02 IV.C Documentation to establish compliance
SD02-V.A SD02 V Directive procedures: receipt, dissemination and submissions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All TSA Pipeline Cybersecurity Directives controls