Each pipeline operator should establish and implement a risk-based corporate security program that documents its policies and procedures for managing security threats, incidents and responses, and should: develop a corporate security plan (Section 3); provide sufficient resources, including trained staff and equipment, to run the program; allocate funds for identified security deficiencies through the corporate budgeting and purchasing processes; assign a qualified primary and alternate staff member to manage the program; develop and maintain a cyber/SCADA security plan or put cyber/SCADA measures into the corporate plan; build security elements into the corporate incident response and recovery plan; implement threat-level protective measures when a pertinent NTAS Bulletin or Alert is received; and notify TSA of security incidents meeting the Appendix B criteria by phone or email as soon as possible. Figure 1 sequences the program: criticality, an SVA for each critical facility, baseline measures at all facilities and baseline plus enhanced measures at critical ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.