Enbridge Katy Pipeline Expansion: What Houston Contractors Need

The Katy to Gillis Expansion Project is a proposed natural gas route from the Katy Hub in Texas to the Gillis Hub in southwest Louisiana, combining capacity on Enbridge's Texas Eastern system and ARM Energy's Mustang Express Pipeline, sized at up to 2 Bcf/d and targeted for early 2031.

Texas Eastern Transmission, an Enbridge company, opened a non-binding open season on October 7, 2026 to measure how much capacity shippers want on the Katy to Gillis route.

An open season is a sign-up window, and nothing is built yet. Oil & Gas Journal reports that final capacity, receipt and delivery points, and design depend on the interest Enbridge gets, and that completion is subject to commercial support and required approvals. Caitlin Tessin, Enbridge's vice president of commercial gas transmission, called the project "the missing puzzle piece" between gas arriving at Katy and demand in Gillis, according to the Houston Business Journal.

Reuters reports that Enbridge says the route would improve access to LNG export facilities and to industrial and power generation markets along the Gulf Coast. The Mustang Express half is a 236-mile, 2.5-Bcf/d line that ARM Energy expects to finish in late 2028 or early 2029, per Oil & Gas Journal. Enbridge keeps its U.S. headquarters in Houston, and ARM Energy is Houston-based too, so the decisions about who does the work get made close to home.

For a Katy business owner, the takeaway is simple. Big midstream projects buy engineering, surveying, inspection, construction, environmental and controls work from regional firms, and the Katy Hub sits in CinchOps' own backyard.

TSA Security Directive Pipeline-2021-02 is a federal cybersecurity order for TSA-designated natural gas and hazardous liquid pipeline operators. It defines authorized representatives to include contractors and subcontractors, so a Houston contractor whose staff access an operator's systems works under that operator's access, password and monitoring rules.

The directive TSA first issued after the 2021 Colonial Pipeline attack still governs critical pipeline operators, and the 02F renewal, effective May 3, 2025, made no substantive changes to it.

The 02F text requires each covered operator to run a TSA-approved Cybersecurity Implementation Plan. That plan has to cover network segmentation between IT and OT, access control "including for local and remote access", continuous monitoring, patching of operating systems, applications, drivers and firmware, and an incident response plan exercised no less than annually. The directive defines an authorized representative as someone who is not the operator's employee but acts on its behalf, and says that term "may include agents, contractors, and subcontractors."

That definition is the bridge to your firm. Operators answer to TSA, and they carry that obligation into vendor onboarding. In 35+ years doing this, I've watched the security questionnaire show up after the bid was already priced far more often than before it.

Colonial is the reason the access rules read the way they do. Colonial CEO Joseph Blount told the Senate Homeland Security and Governmental Affairs Committee in June 2021 that the DarkSide attackers got in through a legacy VPN that used a compromised password and did not require multifactor authentication. One login, no second factor, and fuel stopped moving on the East Coast.

The table below maps six requirements in TSA SD Pipeline-2021-02F to what a 10 to 50 person Houston contractor should expect an operator to ask about, and the proof worth having on hand before that conversation.

Two proposed Katy-to-Gillis natural gas pipelines, Enbridge's Katy to Gillis Expansion and Boardwalk's Texas Gateway, carry public target dates between 2028 and 2031, and Houston contractors who want that work have time to fix MFA, shared accounts, patching and incident planning before operators start vetting vendors in earnest.

Boardwalk's Gulf South Pipeline is developing the Texas Gateway Project, a 155-mile line from the Katy and Carthage hubs to southwest Louisiana near Gillis, with a target in-service date of November 1, 2029.

That makes the Katy-to-Gillis corridor a two-operator story. Pipeline & Gas Journal reported Texas Gateway at 1.45 Bcf/d of proposed capacity, contingent on approvals and customer commitments. A Katy engineering or inspection firm could end up answering security questions from Enbridge, Boardwalk and ARM Energy inside the same few years, and each will send its own form.

Every one of those dates depends on shippers signing up and regulators approving. Plan for the work anyway. Security fixes for a small firm take weeks, and a vendor review that finds no MFA on remote access can cost you a bid in an afternoon.

The sensible order for a Houston contractor is short. Turn on MFA everywhere first, because Colonial proved a single password is enough. Replace shared logins with named accounts next. Then get patch reporting and a written incident plan, and answer every operator's questionnaire from that one evidence file.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

For a contractor eyeing the Katy to Gillis corridor, CinchOps builds the evidence pack an operator asks for and keeps it current. That covers the four controls TSA's pipeline directive leans on hardest.

• Through cybersecurity services, CinchOps enforces MFA, replaces shared logins with named accounts and runs 24/7 threat monitoring on endpoints and email.
• Through managed IT support, CinchOps patches laptops, field tablets and firmware and produces the compliance report an operator's questionnaire asks for.
• For firms with control-system work, CinchOps segments IT from OT and SCADA networks at the boundary, which is the same split the TSA directive requires of operators.
• Through business continuity and disaster recovery, CinchOps keeps immutable, offsite backup copies and helps write the incident plan you can show an operator.
• CinchOps supports oil and gas companies, energy and utilities contractors, engineering firms and construction companies across Katy, Houston, Cypress and Fulshear.

The Katy to Gillis project won't carry gas until 2031, and that is plenty of runway for a contractor that starts now and none for one that starts when the vendor form arrives. CinchOps works on a Zero-Zero-Zero model with no long-term contracts, no hidden fees and no cancellation penalties, so getting ready doesn't lock you in. If your firm plans to bid pipeline work, talk to CinchOps.