TSA Pipeline Security
The TSA Pipeline Security Guidelines (March 2018 with Change 1, April 2021), the voluntary federal baseline for pipeline security in the United States: a risk-based corporate security program and plan, criticality assessments every 18 months against seven criteria per subsector, security vulnerability assessments for critical facilities, baseline and enhanced physical and personnel security measures, pipeline cyber asset measures organized by the NIST Cybersecurity Framework, NTAS threat response and TSA incident notification. The mandatory cybersecurity Security Directives are a separate framework.
TSA Pipeline Security is a compliance framework from United States (federal, TSA) with 7 domains and 52 controls that map to 1 other frameworks. The largest domains are Section 6 and Table 2: Facility security measures – TSA Pipeline Security (18 controls), Section 7 and Table 3: Pipeline cyber asset security measures – TSA Pipeline Security (18 controls), Section 5: Criticality (Change 1, April 2021) – TSA Pipeline Security (8 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Section 2: Corporate security program – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::2 | 2 Corporate security program |
Section 3: Corporate security plan – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::3.1 | 3.1 Corporate security plan: minimum content, review and protection |
| tsa-pipeline-security::3.2 | 3.2 Security plan elements |
Section 4: Risk analysis – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::4.1 | 4.1 Risk management process and methodology |
| tsa-pipeline-security::4.2 | 4.2 Criticality assessment |
| tsa-pipeline-security::4.3 | 4.3 Security vulnerability assessment (SVA) |
Section 5: Criticality (Change 1, April 2021) – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::5.2 | 5.2 Facility criticality: written policy and determination rules |
| tsa-pipeline-security::5.2.C1 | 5.2 Table 1 criterion 1: service to installations critical to national defense |
| tsa-pipeline-security::5.2.C2 | 5.2 Table 1 criterion 2: service to key infrastructure such as power plants and major airports |
| tsa-pipeline-security::5.2.C3 | 5.2 Table 1 criterion 3: mass injuries, casualties or significant health or environmental effects |
| tsa-pipeline-security::5.2.C4 | 5.2 Table 1 criterion 4: state or local essential public services and emergency response |
| tsa-pipeline-security::5.2.C5 | 5.2 Table 1 criterion 5: major rivers, lakes or waterways |
| tsa-pipeline-security::5.2.C6 | 5.2 Table 1 criterion 6: service to a significant number of customers |
| tsa-pipeline-security::5.2.C7 | 5.2 Table 1 criterion 7: significant disruption of pipeline system operations |
Section 6 and Table 2: Facility security measures – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::6.2 | 6.2 Baseline and enhanced security measures |
| tsa-pipeline-security::6.3 | 6.3 Site-specific security measures |
| tsa-pipeline-security::T2.01 | Table 2 Fencing and barriers |
| tsa-pipeline-security::T2.02 | Table 2 Access controls |
| tsa-pipeline-security::T2.03 | Table 2 Gates |
| tsa-pipeline-security::T2.04 | Table 2 Locks and key control |
| tsa-pipeline-security::T2.05 | Table 2 Facility lighting |
| tsa-pipeline-security::T2.06 | Table 2 Intrusion detection and monitoring |
| tsa-pipeline-security::T2.07 | Table 2 Personnel identification and badging |
| tsa-pipeline-security::T2.08 | Table 2 Background investigation |
| tsa-pipeline-security::T2.09 | Table 2 Equipment maintenance and testing |
| tsa-pipeline-security::T2.10 | Table 2 Design and construction |
| tsa-pipeline-security::T2.11 | Table 2 Communication |
| tsa-pipeline-security::T2.12 | Table 2 Personnel training |
| tsa-pipeline-security::T2.13 | Table 2 Drills and exercises |
| tsa-pipeline-security::T2.14 | Table 2 Security incident procedures |
| tsa-pipeline-security::T2.15 | Table 2 Recordkeeping |
| tsa-pipeline-security::T2.16 | Table 2 Outreach |
Section 7 and Table 3: Pipeline cyber asset security measures – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::7.2 | 7.2 Pipeline cyber assets classification |
| tsa-pipeline-security::T3.DE.AE | Table 3 Detect: Anomalies and Events |
| tsa-pipeline-security::T3.DE.CM | Table 3 Detect: Security Continuous Monitoring |
| tsa-pipeline-security::T3.DE.DP | Table 3 Detect: Detection Processes |
| tsa-pipeline-security::T3.ID.AM | Table 3 Identify: Asset Management |
| tsa-pipeline-security::T3.ID.BE | Table 3 Identify: Business Environment |
| tsa-pipeline-security::T3.ID.GV | Table 3 Identify: Governance |
| tsa-pipeline-security::T3.ID.RA | Table 3 Identify: Risk Assessment |
| tsa-pipeline-security::T3.ID.RM | Table 3 Identify: Risk Management Strategy |
| tsa-pipeline-security::T3.PR.AC | Table 3 Protect: Access Control |
| tsa-pipeline-security::T3.PR.AT | Table 3 Protect: Awareness and Training |
| tsa-pipeline-security::T3.PR.DS | Table 3 Protect: Data Security and Information Protection |
| tsa-pipeline-security::T3.PR.PT | Table 3 Protect: Protective Technology |
| tsa-pipeline-security::T3.RC.IM | Table 3 Recover: Improvements |
| tsa-pipeline-security::T3.RC.RP | Table 3 Recover: Recovery Planning |
| tsa-pipeline-security::T3.RS.CO | Table 3 Respond: Communications |
| tsa-pipeline-security::T3.RS.MI | Table 3 Respond: Mitigation |
| tsa-pipeline-security::T3.RS.RP | Table 3 Respond: Response Planning |
Section 8 and Appendix B: NTAS protective measures and TSA notification – TSA Pipeline Security
| Code | Title |
|---|---|
| tsa-pipeline-security::8 | 8 Protective measures for National Terrorism Advisory System (NTAS) alerts |
| tsa-pipeline-security::AppB | Appendix B TSA notification criteria |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what TSA Pipeline Security overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is TSA Pipeline Security and who does it apply to?
TSA Pipeline Security is a compliance framework from United States (federal, TSA) with 7 domains and 52 controls. The TSA Pipeline Security Guidelines (March 2018 with Change 1, April 2021), the voluntary federal baseline for pipeline security in the United States: a risk-based corporate security program and plan, criticality assessments every 18 months against seven criteria per subsector, security vulnerability assessments for critical facilities, baseline and enhanced physical and personnel security measures, pipeline cyber asset measures organized by the NIST Cybersecurity Framework, NTAS threat response and TSA incident notification. The mandatory cybersecurity Security Directives are a separate framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does TSA Pipeline Security actually require?
TSA Pipeline Security has 52 controls organised across 7 domains. The largest domains are Section 6 and Table 2: Facility security measures – TSA Pipeline Security (18 controls), Section 7 and Table 3: Pipeline cyber asset security measures – TSA Pipeline Security (18 controls), Section 5: Criticality (Change 1, April 2021) – TSA Pipeline Security (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of TSA Pipeline Security do I already cover?
TSA Pipeline Security maps to 1 other compliance frameworks. The top mapping partners are ISO 27002:2022 (23% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement TSA Pipeline Security?
Start your TSA Pipeline Security compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about TSA Pipeline Security requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 52 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required