Pipeline System

The national pipeline system consists of more than 2.7 million miles of  networked pipelines transporting oil, natural gas, and other hazardous  liquids. NCCIC reported that the energy  sector, which includes pipelines, experienced more cyber incidents than  any sector from 2013 to 2015, accounting for 35 percent of the 796  incidents reported by all critical infrastructure sectors. These entities include the  following:  Transportation Security Administration (TSA). TSA, within DHS, has  primary oversight responsibility for the physical security and cybersecurity  of transmission and distribution pipeline systems. All of the pipeline operators we interviewed reported using other  guidelines or standards to address pipeline systems’ security risks. For a listing of federal and  industry guidelines identified as applicable to security by the pipeline  operators, see appendix I.

		TSA Does Not Have a Documented Process for Updating Its Pipeline Security Guidelines to Reflect Revisions to Supporting Standards

TSA’s Pipeline Security Branch issued its revised Pipeline Security  Guidelines in March 2018, but TSA has not established a documented  process to ensure that revisions occur and fully capture updates to  supporting standards and guidance. The guidelines were revised to,  among other things, reflect the dynamic threat environment and to  incorporate cybersecurity principles and practices from the NIST  Cybersecurity Framework, which were initially issued in February 2014. However, our analysis of TSA’s data found that at least 34 of the top 100  critical pipeline systems deemed highest risk indicated that they had no  critical facilities. The fact that pipeline operators of about one third of the highest risk  systems identified no critical facilities may be due, in part, to the Pipeline  Security Branch not clearly defining the criteria outlined in the Pipeline  Security Guidelines that pipeline operators are to use to determine the  criticality of their facilities. TSA Conducts Assessments of Pipeline Security Risks

TSA’s Intelligence and Analysis produces assessments related to pipeline  security risks, including Pipeline Modal and Cyber Modal Threat  Assessments and the Transportation Sector Security Risk Assessment. TSA Conducts Pipeline Security Reviews to Assess Implementation of Pipeline Guidelines, but Does Not Have a Strategic Workforce Plan to Address Staffing Challenges

According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews  (CFSRs)—to assess pipeline vulnerabilities and industry implementation  of TSA’s Pipeline Security Guidelines. TSA officials reported that staffing limitations have prevented TSA from  conducting more reviews. As shown in table 3, TSA Pipeline Security  Branch staffing levels (excluding contractor support) have varied  significantly over the past 9 years ranging from 14 full-time equivalents  (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014. By establishing a strategic workforce plan, TSA can help ensure it has  identified the knowledge, skills, and abilities that the future workforce of  TSA’s Pipeline Security Branch may need in order to meet its mission of  reducing pipeline systems’ vulnerabilities to physical and cybersecurity  risks, especially in a dynamic and evolving threat environment. Additionally, sources of data and underlying  assumption and judgments regarding certain threat and vulnerability  inputs to the assessment are not fully documented. TSA’s Pipeline Risk Assessment Has Not Been Peer Reviewed to Help Validate the Data and Methodology

In addition to the shortfalls identified above, the risk assessment has not  been peer reviewed since its conception in 2007. The  management measure is based on the number of complete pipeline  security reviews. Objectivity. Taking steps to ensure that the pipeline security program performance  measures exhibit key attributes of successful performance measures  could allow TSA to better assess the program’s effectiveness at reducing  pipeline physical and cybersecurity risks. TSA Does Not Track the Implementation Status of Past CSR Recommendations, and Supporting Data Are Not Sufficiently Reliable

According to TSA officials, the primary means for assessing the  effectiveness of the agency’s efforts to reduce pipeline security risks is  through conducting pipeline security reviews— Corporate Security  Reviews (CSRs) and Critical Facility Security Reviews (CFSRs). Until TSA  monitors and records the status of these reviews’ recommendations, it will  be hindered in its efforts to determine whether its recommendations are  leading to significant reduction in risk. By entering information on CSR  recommendations and monitoring and recording their status, developing  written documentation of its data entry and verification procedures and  electronic safeguards, and improving the quality of its pipeline security  program data, TSA could better ensure it has the information necessary  to effectively monitor pipeline operators’ progress in improving their  security posture, and evaluate its pipeline security program’s   effectiveness in reducing security risks to pipelines. However, without a  documented process defining how frequently TSA is to review and, if  deemed necessary, revise its guidelines, TSA cannot ensure that its  guidelines reflect the latest known standards and best practices for  physical and cybersecurity, or address the persistent and dynamic  security threat environment currently facing the nation’s pipeline system. Establishing a strategic workforce plan could  help TSA ensure that it has identified the necessary skills, competencies,  and staffing allocations that the Pipeline Security Branch needs to carry  out its responsibilities, including conducting security reviews of critical  pipeline companies and facilities, as well as their cybersecurity posture. Better considering threat, vulnerability, and consequence elements in its  risk assessment and incorporating an independent, external peer review  in its process would provide more assurance that the Pipeline Security  Branch ranks relative risk among pipeline systems using comprehensive  and accurate data and methods. Recommendations for Executive Action

We are making 10 recommendations to TSA:
The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to implement a documented process  for reviewing, and if deemed necessary, for revising TSA’s Pipeline  Security Guidelines at regular defined intervals. (Recommendation 1)
The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to clarify TSA’s Pipeline Security  Guidelines by defining key terms within its criteria for determining  critical facilities. With regard to our fifth recommendation, that TSA fully document the data  sources, underlying assumptions, and judgements that form the basis of  the Pipeline Relative Risk Ranking Tool, including sources of uncertainty  and any implications for interpreting the results from the assessment,  DHS stated that TSA will fully document the data sources, underlying  assumptions, and judgements that form the basis of the Pipeline Relative  Risk Ranking Tool. With regard to our eighth recommendation, that TSA ensure that the  Security Policy and Industry Engagement's Surface Division has a suite of  performance measures which exhibit key attributes of successful  performance measures, including measurable targets, clarity, baseline,  and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section  will develop both physical and cyber security performance measures, in  consultation with pipeline stakeholders, to ensure that it has a suite of  performance measures which exhibit key attributes of successful  performance measures, including measurable targets, clarity, baseline,  and trend data. Further, this judgment is not documented in the risk  assessment’s methodology. Capturing cybersecurity in the risk assessment is also an area for  improvement.
Why GAO Did This Study

More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity.
GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks.
GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations.

What GAO Found

Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality.
To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page.
TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing.
GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods.
TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk.

What GAO Recommends

GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred.
GAO recommends, among other things, that the TSA Administrator take the following actions:
implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals;
clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities;
develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division;
update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats;
fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology;
take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology;
ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and
enter information on Corporate Security Review recommendations and monitor and record their status.