How to Implement the Revised TSA Pipeline Security Directive

### Executive Summary This report explains TSA’s July 2022 Security Directive Pipeline-2021-02C for hazardous liquid and natural gas pipeline operators, highlighting a shift from prescriptive rules to performance-based, risk-informed requirements. It outlines required deliverables and timelines (Cybersecurity Implementation Plan, Assessment Plan, and Incident Response Plan), alignment with industry standards (NIST CSF, API 1164, ISA/IEC 62443), and five core OT controls—incident response, defensible architecture (asset inventory and segmentation), visibility/monitoring, multi-factor authentication with compensating controls for OT, and vulnerability/patch management—intended to improve pipeline cybersecurity resilience.