TSA Security Directive Pipeline-2021-02G: 2026 Guide for Houston

The 02 series has moved from prescriptive rules to operator-written plans, then settled into yearly renewals with one contractor-facing change in between.

The TSA SD Pipeline-2021-02 series changed substantively three times. Version 02C (July 2022) replaced fixed rules with a TSA-approved Cybersecurity Implementation Plan, 02D (July 2023) added yearly testing and auditing, and 02E (July 2024) made authorized representatives, including contractors, liable. Versions 02F and 02G were renewals with no substantive revisions.

The table below compares every public version of SD Pipeline-2021-02 by TSA's listing or issue date, what TSA changed, and what that change means for a Houston contractor reading an operator's paperwork.

The practical reading is simple. If your addendum cites 02E, 02F or 02G, the requirements are the same text. If it cites 02B or the original, the operator copied an old template, and the gap is worth one polite email asking which version and which plan sections apply to your work.

Three substantive changes in five years is a slow pace for a federal cybersecurity rule, and that is good news for a small firm. The controls you put in place to satisfy an operator in 2024 still satisfy the same operator under SD Pipeline-2021-02G in 2026, as long as they still work when someone checks.

SD Pipeline-2021-02G requires covered operators to run three documents: an implementation plan, an incident response plan and an assessment plan.

SD Pipeline-2021-02G requires each covered operator to implement a TSA-approved Cybersecurity Implementation Plan covering network segmentation, access control, continuous monitoring and patching for its Critical Cyber Systems, plus an incident response plan exercised at least yearly and an assessment plan that audits one-third of the approved plan every year.

A Critical Cyber System means any IT or OT system or data that, if compromised, could cause operational disruption, and the 02G definition includes business services. TSA writes the outcomes and the operator writes the method, which is why the directive reads short and the operator's plan reads long. TSA says every currently identified critical operator already has an approved plan in place.

Three requirements in the 02G text tend to land on a contractor's side of the fence, because they govern how outside people get into the operator's systems:

• Access control (Section III.C) covers local and remote access, requires multi-factor authentication or controls that provide equivalent risk reduction, and limits shared accounts to those critical for operations. When a shared account is used, anyone who no longer needs access must not know its password.
• Monitoring (Section III.D) requires capabilities to stop malicious email, block known bad IP addresses and web domains, and prevent unauthorized code, including macro scripts, from running.
• Patching (Section III.E) covers operating systems, applications, drivers and firmware, and puts the CISA Known Exploited Vulnerabilities Catalog at the top of the queue.

The companion SD Pipeline-2021-01G (in force January 16, 2026 through January 15, 2027) adds the reporting side: a Cybersecurity Coordinator reachable 24 hours a day, at least one coordinator who is a U.S. citizen, and incident reports to CISA no later than 72 hours after the operator identifies a cybersecurity incident. If your staff notice something odd on an operator's network, the operator's 72-hour clock may already be running, so tell them the same day.

TSA SD Pipeline-2021-02 binds pipeline operators, but since 02E it also names the contractors who do directive work for them.

TSA SD Pipeline-2021-02 is addressed to TSA-designated pipeline operators, but since 02E an authorized representative, meaning a non-employee the operator empowers to perform directive or plan measures, can be held liable alongside the operator for its own non-compliance. The term includes agents, contractors and subcontractors and excludes managed security service providers.

The exact 02G wording is short: "Both Owner/Operators and Authorized Representatives are liable for non-compliance on the part of the Authorized Representative." Whether your firm is an authorized representative depends on what the operator has empowered you to do. A controls integrator configuring a SCADA firewall rule the plan depends on sits much closer to that line than a surveyor who never logs in.

The split runs the other way for security vendors. If an operator hands monitoring or another plan measure to a managed security service provider, the 02G text says the operator "retains sole responsibility" for compliance. So the provider watching the operator's network is outside the authorized-representative definition, while the field firm whose engineers log in to change a setting may be inside it.

This matters more in Katy each year. The Katy Hub sits at the start of two proposed lines to the Gillis area in Louisiana: Enbridge's Katy to Gillis expansion, up to 2 Bcf/d by early 2031, and Boardwalk's 155-mile Texas Gateway, targeting November 1, 2029. Both projects are still subject to approvals. Every new line means more engineering, inspection and controls firms in west Houston answering to operators that run under this directive. Here is what to ask an operator before work starts:

• Does your Cybersecurity Implementation Plan treat our firm as an authorized representative, and for which sections?
• Which version letter does our addendum rely on, and will you update it to SD Pipeline-2021-02G?
• How will our staff authenticate for remote access, and do any shared accounts apply to us?
• Who do we call, and how fast, if we see a possible cybersecurity incident on your systems?

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

Section IV of SD Pipeline-2021-02G lists the records TSA may inspect at an operator: a hardware and software asset inventory including SCADA systems, firewall rules, network and architecture diagrams, log files, and a packet capture of network traffic for up to 24 hours. A contractor isn't required to keep that set. Keeping a small version of it is the fastest way to answer an operator's questions about your firm.

• Through managed IT support, CinchOps keeps the device and account list current, answers help desk requests in under 15 minutes, and patches laptops and field tablets on a schedule you can show an operator.
• Through cybersecurity services, CinchOps turns on MFA for remote access, removes shared logins and runs 24/7 threat monitoring with logs you keep.
• Through business continuity and disaster recovery, CinchOps keeps immutable, offsite backup copies stored apart from the systems they protect, which is the same idea Section III.F of the directive asks of operators.
• For oil and gas, energy services and utilities and engineering firms, CinchOps segments office IT from OT and SCADA connections at the boundary.
• CinchOps supports contractors in Houston, Katy, Cypress and The Woodlands.

The TSA pipeline directive will keep changing letters every year, and TSA has said it intends to replace the directives with a permanent rule. Your obligations follow the operator's approved plan and your contract, so build your records around those two documents and you won't care which letter comes next. If an operator's addendum has you unsure where you stand, talk to CinchOps.