Expanding Pipeline Cybersecurity Regulations Drives Performance Management

A range of cyber attacks on oil and natural gas infrastructure have occurred over the past decade showing a range of capability and potential impact across critical infrastructure. These attacks showcase the potential of adversaries to disrupt the delivery of oil and gas products, highlighting the need for enhanced cyber risk management across oil and gas infrastructure networks. Since the Colonial Pipeline cyber attack in May of 2021, the Department of Homeland Security’s (DHS) Transportation Security Administration (TSA) has provided and updated several security directives regarding physical and cyber security for pipeline and rail systems, driving the need to measure baseline and improvements to cybersecurity performance. In order to implement a comprehensive approach to cybersecurity, an owner or operator must first measure their baseline vulnerabilities and risks, develop a set of cybersecurity controls and metrics, and regularly measure the implementation, effectiveness, and impact of controls. This paper will discuss cybersecurity performance metrics and methods for measuring and managing cybersecurity performance for pipeline owners and operators.