TSA Pipeline Security AppB: Appendix B TSA notification criteria

Operators should notify the Transportation Security Operations Center (TSOC, 866-615-5150 or TSOC.ST@dhs.gov) as soon as possible of incidents indicating a deliberate attempt to disrupt pipeline operations or possible precursors: suspicious explosions or fires; actual or suspected attacks; bomb or WMD threats; theft of company vehicles, uniforms or employee credentials; suspicious persons or vehicles near systems, facilities or rights-of-way; suspicious photography or surveillance; suspicious inquiries about operations, vulnerabilities or security; suspicious applicants for security-sensitive positions; and theft or loss of sensitive security information such as detailed maps or plans; or any other reason to believe a terrorist incident is planned or has occurred. Reports give the reporter's contact details, time and location, a description, who else was notified and what was done, and descriptions of persons, suspicious parties and license plates. Actual or suspected cyber-attacks that could affect industrial control, measurement, telemetry or associated enterprise IT systems go to the NCCIC (now CISA), 888-282-0870.