The TSA Security Directives are the binding cyber security requirements for critical US pipeline owners and operators. They require you to designate a cybersecurity coordinator, report incidents to CISA within 24 hours, maintain a cybersecurity incident response plan, and run an annual cybersecurity assessment program.
Cyber security requirements for US pipeline and energy operators come in layers. The binding layer is the TSA Security Directives for critical pipeline owners and operators: designate a cybersecurity coordinator, report incidents to CISA within 24 hours, maintain a cybersecurity incident response plan, and run an annual cybersecurity assessment program.
The technical layer is the four required outcomes: network segmentation between IT and operational technology, access control, continuous monitoring and detection, and risk-based application of security patches. API Standard 1164 and NIST SP 800-82 supply the engineering detail.
Operators that also own bulk electric assets pick up NERC CIP on top.
Official source: https://www.tsa.gov/for-industry/surface-transportation-cybersecurity
ThreeShield's CISSP- and CISA-certified assessors run the US Pipeline & Energy Cyber Security (TSA) engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| US Pipeline & Energy Cyber Security (TSA) requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
It likely does if your organization is a US pipeline or energy operator. The TSA Security Directives bind critical pipeline owners and operators, and operators that also own bulk electric assets pick up NERC CIP as well. We confirm scope in the first call, at no charge.
A gap assessment against the TSA pipeline requirements usually takes a few weeks, depending on your starting point. Closing the gaps and standing up the evidence takes longer and is where most of the work sits. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
Start at whatever security maturity you have today. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You