FY2013 BASE MT Template

Status: Original and derived artifacts are available for this document.

Download: xlsx | pdf | html

SENSITIVE SECURITY INFORMATION
DEPARTMENT OF HOMELAND SECURITY
Transportation Security Administration
CSR SH ONLY No SD
FY2022 V.1 (December
2022)

Pipeline Corporate Security Review (CSR)
CSR Date

10/18/2021
Report Date

TYPE OF VISIT

Name of Pipeline Operator

Stakeholder Self-Assessment
Street
County
City
Street
City
Agency Website:

US States of Operation (List):
International Cross-border Operations (Y/N):

24-Hour Emergency Contact Telephone Numbers
Purpose

Products Carried (mark applicable with "X"):

< Natural Gas/LNG
< Crude Oil
< Refined Products
< NGL/LPG
< Toxic Inhalation Hazard (TIH)
< Chemicals (list below)
List >
Quantity

Infrastructure

State

Zip Code

Employees
Total Corporate Employees
Total Pipeline Operations Employees
Product Flow
Number of pipeline systems operated
Total Pipeline Mileage
Pipeline size(s)
Maximum daily flow capacity
Average daily flow capacity
Annual Deliveries
Storage Capacity

Telephone

24-Hour Emergency

1
2
3

State
Zip Code
Corporation / Company Mailing Address

Infrastructure Inventory
Quantity

Pipelines on Bridges
Standalone Pipeline Bridges
Storage Facilities
Breakout Tank Facilities
Pumping Stations
Compressor Stations
LNG Facilities

Infrastructure
NGL Facilities
Marine Terminals
SCADA Control Rooms
Backup SCADA Control Rooms
Emergency Operations Centers
Delivery Points
Other

Corporation / Company Profile Comments:
Comments:

Security Personnel Interviewed
Name

Title
Security Coordinator
Alternate Security Coordinator

Telephone

Cell

E-mail

Telephone

E-mail

Telephone

E-mail

Telephone

E-mail

Review Team
Name

Title
Lead
Secondary
TSS

Location Assignment
SSI
SSI
TSA - HQ

Supervisory Approval
Name

Title

Location Assignment

STSI
AFSD-I

TSA Headquarters Approval
Name

Title
Program Manager

Location Assignment
HQ
HQ

OMB Control # 1652-0056

SENSITIVE SECURITY INFORMATION

DEPARTMENT OF HOMELAND SECURITY
Transportation Security Administration

Pipeline Corporate Security Review (CSR)
0
Question
Type

Question #

SAI

1.0000

Security Plans

1.0100

Is your corporate security manager solely dedicated to a corporate security function
or tasked with other responsibilities such as environmental, health, and safety?

CSR Question

N/A

1.0701
1.0702
1.0703
1.0704
1.0705
1.0706
R

1.0800

Is the corporate security plan reviewed on an annual basis and updated as required?

R

1.0900

1.0300
1.0400
1.0401
1.0402
1.0403
1.0404
1.0405
1.0406
1.0407
1.0408
R

1.0500

R

1.0600

R

1.0700

1.1000
R

1.1100
1.1101
1.1102

Answer
(Yes/No/X)

Comments

SAI

Does your corporate security manager or equivalent position have a direct reporting
relationship to the senior leadership in the company?
Does the company have a cross-departmental security committee?
Which of the following departments are represented on the security committee?
Corporate Management
Human Resources
Security
Legal
Engineering
Operations and/or Maintenance
Information Technology
Other (if checked, elaborate)
Have you established a corporate security program to address and document
policies and procedures for managing security-related threats, incidents, and
responses?
Does your company have a written corporate security plan?
Which of the following company plans are directly included or incorporated by
reference in the corporate security plan?
Business Continuity Plan
Incident Response Plan
Incident Recovery Plan
Enterprise Cybersecurity Plans
OT Cybersecurity Plans
Other (if checked, elaborate)

1.0200

CSR SH ONLY No SD FY2022 V.1 (December 2022)
Assessment Date:
10/18/2021

Operator Name:

ZZZ

Does the corporate security plan identify the primary and alternate security manager
or officer responsible for executing and maintaining the plan?
Is the corporate security plan readily available to those persons responsible for
security actions?
Do you incorporate the following elements into your corporate security plan or
associated documents?
System Description
Security Administration and Management Structure

OMB Control # 1652-0056

CSR Checklist Page 3 of 23

1.1103
1.1104
1.1105
1.1106
1.1107
1.1108
1.1109
1.1110
1.1111
1.1112
1.1113
1.1114
1.1115
1.1116
1.1117
R

1.1200

R

1.1300
1.1400
1.1401
1.1402
1.1403
1.1404
1.1405
1.1406
1.1500
1.1501
1.1502
1.1503
1.1504
1.1505
1.1506
1.1600

R

1.1700

R

1.1800

SAI
SAI

2.0000
3.0000

R

3.0100

SENSITIVE SECURITY INFORMATION

Risk Analysis and Assessments
Physical Security and Access Control Measures
Equipment Maintenance and Testing
Personnel Screening
Communications
Personnel Training
Security Incident Procedures
National Terrorism Advisory System (NTAS) Response Procedures
Security Plan Reviews
Recordkeeping
Cyber/SCADA System Security Measures
Essential Security Contacts
Security Testing and Audits
Outreach (neighbors, law enforcement, media, public)
Other (if checked, elaborate)
Do you have sufficient resources, including trained staff and equipment, to
effectively execute the corporate security program?
Are appropriate financial resources allocated in the corporate budgeting and
purchasing process to correct identified security deficiencies?
How much operations and/or maintenance money did your company spend on
security in the previous fiscal year?
< $99,999
$100,000 - $249,999
$250,000 - $499,999
$500,000 - $999,999
$1,000,000 - $4,999,999
>$5,000,000
How much capital money did your company spend on security in the previous fiscal
year?
< $99,999
$100,000 - $249,999
$250,000 - $499,999
$500,000 - $999,999
$1,000,000 - $4,999,999
>$5,000,000
Has your company established security metrics?
Are the corporate security plan, the enterprise cyber security plan, and the OT cyber
security plan, as applicable, protected from unauthorized access?
Are the corporate security plan, the enterprise cyber security plan, and the OT cyber
security plan, as applicable, available for TSA review upon request?
Security Plans - Cyber
Communication
Does your company have internal and external notification requirements and
procedures for security events?

OMB Control # 1652-0056

ZZZ

ZZZ

SAI
SAI

CSR Checklist Page 4 of 23

SENSITIVE SECURITY INFORMATION

R

3.0200

R

3.0300

R

3.0400
3.0500
3.0501
3.0502
3.0503

SAI

3.0504
3.0505
3.0506
3.0507
3.0508
3.0509
3.0510
4.0000

R

4.0100
4.0200
4.0300
4.0301
4.0302
4.0303
4.0304
4.0305
4.0306
4.0307
4.0308
4.0309
4.0310
4.0311
4.0312

R

4.0400

Does your company document and periodically update contact and communication
information for Federal, state, and local homeland security/law enforcement
agencies?
Does your company have a defined process for receiving, handling, disseminating,
and storing security and threat information?
Do all critical facilities have primary and alternate communication capabilities for
internal and external reporting of appropriate security events and information?
Which of the following external agencies/organizations would the company notify in
the event of a security incident, a security threat, or suspicious activity?
National Response Center (NRC)
Local emergency responders/911
Transportation Security Administration / Transportation Security Operations Center
(TSA/TSOC)
Tribal emergency responders
State emergency responders
Other federal agencies
Federal Bureau of Investigation (FBI)
Department of Homeland Security (DHS)
Neighboring companys
Other (if checked, elaborate)
Security Incident Procedures
Are security elements developed and maintained within the corporate incident
response and recovery plan?
Does your company have a policy and/or procedure for handling security threat or
incident information?
From whom does your company receive current security threat information?
Transportation Security Operations Center (TSOC)
DHS Protective Security Advisor (DHS PSA)
Joint Terrorism Task Force (JTTF)
Federal Bureau of Investigation (FBI)
Homeland Security Information Network (HSIN)
State fusion center(s)
Local law enforcement
Coast Guard
Corporate affiliations
Department of Energy
Homeland Infrastructure Threat and Risk Analysis Center (HITRAC)
Other (if checked, elaborate)
Does your company notify TSA via the Transportation Security Operations Center
(TSOC) by phone or email as soon as possible if any of the types of security incidents
listed in Appendix B – TSA Notification Criteria, 2018 TSA Pipeline Security
Guidelines, occurs or if there is any other reason to believe that a terrorist incident
may be planned or may have occurred?

OMB Control # 1652-0056

ZZZ

SAI

ZZZ

CSR Checklist Page 5 of 23

SENSITIVE SECURITY INFORMATION

R

4.0500

R

4.0600

R

4.0700

R

4.0800
4.0900

R

4.1000

R

4.1100
4.1101
4.1102
4.1103
4.1104
4.1105
4.1106
4.1107
4.1108
4.1109
4.1110

R

4.1200
4.1201
4.1202
4.1203
4.1204

R

4.1300
4.1301
4.1302
4.1303

Has your company implemented procedures for responding to security incidents or
emergencies and to pertinent National Terrorism Advisory System (NTAS) Bulletins
or Alerts, including appropriate reporting requirements?
Has your company implemented site-specific security measures for each critical
facility to be taken in response to pertinent NTAS Bulletins or Alerts or other threat
information?
Are the site-specific security measures for each critical facility reviewed and updated
as necessary at least every 18 months?
Does your company have adequate staffing to implement security measures in
response to security threat information?
Does your company have contracts in place with private security providers to
augment existing security staffing during times of heightened alert?
Are bomb threat checklists posted by telephones at all staffed facilities?
At an Elevated Threat Level, would your company enact the following physical access
controls at your critical facilities?
Limit facility access to essential personnel.
Limit facility access to essential visitors, personnel, and vehicles.
Increase surveillance of critical areas and facilities.
Restrict deliveries to those essential to continued operations.
Conduct random inspections of vehicles
and of bags, backpacks, purses, etc.
Delay or reschedule non-vital maintenance and capital project work
that could affect facility security, as appropriate.
Increase lighting in facility buffer zones, as appropriate.
Verify the operating condition of security systems such as
intrusion detection, cameras, and lighting initially and
at least weekly thereafter until termination of the advisory.
Request that local law enforcement agencies
increase the frequency of patrols of the facility.
Other (if checked, elaborate)
At an Elevated Threat Level, would your company enact the following measures on
your cyber/SCADA system(s)?
Increase monitoring of intrusion detection systems.
Remind personnel of the reporting requirements for
any unusual enterprise or control systems network activity.
Remind personnel to be vigilant regarding suspicious electronic mail.
Other (if checked, elaborate)
At an Elevated Threat Level, would your company enact the following
communications measures at your critical facilities?
Inform all employees and on-site contractors
of the change to the Elevated Threat Level.
Conduct security awareness briefings
for all employees and on-site contractors.
Brief employees and on-site contractors on
the characteristics of suspicious packages or mail.

OMB Control # 1652-0056

CSR Checklist Page 6 of 23

4.1304
4.1305
4.1306
4.1307
4.1308
R

4.1400
4.1401
4.1402
4.1403
4.1404
4.1405
4.1406
4.1407
4.1408
4.1409
4.1410
4.1411

R

4.1500
4.1501
4.1502
4.1503

R

4.1600
4.1601
4.1602
4.1603
4.1604
4.1700
4.1800

SAI

5.0000

R

5.0100

SENSITIVE SECURITY INFORMATION

Review response procedures for suspicious packages or mail.
Inform local law enforcement that the facility is at an Elevated Threat Level and
advise them of the security measures being employed.
Verify the proper operation of intelligence and emergency communications
networks/channels, including those with TSA and first responder agencies.
Monitor these networks/channels as appropriate.
Other (if checked, elaborate)
At an Imminent Threat Level, would your company enact the following physical
access controls at your critical facilities?
Cancel or delay non-vital contractor work and services.
Allow deliveries by appointment only.
Inspect all bags, backpacks, purses, etc. prior to entering the facility.
Inspect all vehicles prior to gaining access to the facility.
Inspect all deliveries, including packages and cargo.
Secure all non-essential entrances and facility access points.
Staff or monitor active facility entrances and access points 24/7.
Erect barriers and/or obstacles to control vehicular traffic flow.
Where possible, restrict vehicle parking to 150 feet
from all critical areas and assets.
Coordinate with local authorities regarding closing
nearby public roads and facilities, if appropriate.
Other (if checked, elaborate)
At an Imminent Threat Level, would your company enact the following measures on
your cyber/SCADA system(s)?
Limit network communications links to essential sites/users.
Review remote access for individuals and revoke
any credentials that are not current and necessary.
Other (if checked, elaborate)
At an Imminent Threat Level, would your company enact the following
communications measures?
Inform all employees and contractors of the
increase to the Imminent Threat Level.
Conduct daily security and awareness briefings for each shift.
Participate in situation update briefings with TSA,
other government agencies including local law enforcement,
and pipeline industry associations.
Other (if checked, elaborate)
Does your company use an incident management system, such as the National
Incident Management System (NIMS), for security-related events?
Does your company have a process for assuring the viability of the OT cyber recovery
plan, including a backup control center?
Security Training
Does your company provide security awareness briefings, to include security
incident recognition and reporting procedures, for all personnel with unescorted
access upon hiring and every three years thereafter?

OMB Control # 1652-0056

SAI

CSR Checklist Page 7 of 23

SENSITIVE SECURITY INFORMATION

R

5.0200

Does your company document security training and maintain records in accordance
with company record retention policy?

R

5.0300

Does your company provide security training, to include incident response training,
to personnel assigned security duties upon hiring and annually thereafter?

5.0400

SAI

5.0401
5.0402
5.0403
5.0404
5.0405
5.0406
5.0407
5.0500
6.0000

R

6.0100

R

6.0200

R

6.0300

R

SAI

6.0400
6.0401
6.0402
6.0403
6.0404
7.0000

R

7.0100

R

7.0200

R

7.0300

R

7.0400
7.0401
7.0402
7.0403
7.0404
7.0405
7.0406

Have your company’s security personnel availed themselves of any of the following
training opportunities or affiliations?
Security forums or conferences
Pipeline forums or conferences
Advanced security training
Security Committee(s) participation
Government Sector Committee(s)
Industry security collaboration
Other (if checked, elaborate)
Does your company use any of the TSA security training material?
Outreach
Does each critical facility conduct outreach to nearby law enforcement agencies to
ensure awareness of the facility’s functions and significance?

SAI

Does each critical facility conduct outreach to neighboring businesses to coordinate
security efforts and to neighboring residences to provide facility security awareness?
For critical pipeline cyber assets, does your company ensure that threat and
vulnerability information received from information-sharing forums and sources are
made available to those responsible for assessing and determining the appropriate
course of action?
Does your company report significant cyber incidents to the following?
Senior management
Appropriate federal entities
Appropriate state, local, and tribal entities
Applicable ISAC(s)
Risk Analysis and Assessments
Does your company conduct criticality assessments for all facilities at least every 18
months?
Is the methodology used to determine critical facilities documented in the corporate
security plan?
Did you utilize the criteria from the 2018 TSA Pipeline Security Guidelines to
determine your list of critical facilities?
During the criticality assessment of your facilities, were all of the following criteria
considered?
Critical to national defense
Key infrastructure
Mass casualty or significant health effects
Disruption to state or local government public or emergency services
National landmarks or monuments
Major rivers, lakes, or waterways
OMB Control # 1652-0056

SAI

CSR Checklist Page 8 of 23

7.0407
7.0408
7.0409
R

7.0500

R

7.0600

R

7.0700

R

7.0800

R

7.0900
7.1000

R

7.1100
7.1101
7.1102
7.1103
7.1104
7.1105

R

7.1200

SAI
SAI

8.0000
9.0000

R

9.0100

R

9.0200

R

9.0300
9.0400
9.0401
9.0402
9.0403
9.0404
9.0405
9.0406
9.0407

SENSITIVE SECURITY INFORMATION

Deliverability to significant number of customers
Significantly disrupt pipeline system operations
for an extended period of time, i.e., business critical facilities
Other (if checked, elaborate)
Does your company conduct a security vulnerability assessment (SVA) or equivalent
of each critical facility at least every 36 months?
Does your company conduct an SVA or equivalent within 12 months after achieving
operational status for newly identified or constructed facilities?
Does your company conduct an SVA or equivalent of any critical facility within 12
months of completing a significant enhancement or modification to the facility?
Upon completion of an SVA or equivalent, are corrective actions implemented within
24 months?
Are assessment results documented and retained until no longer valid?
Does your company conduct SVAs or equivalent on your non-critical facilities?
When conducting an SVA or equivalent, do you use one or more of the following
methodologies?
Criticality, Accessibility, Recuperability,
Vulnerability, Effect, Recognizability (CARVER)
American Petroleum Institute/National Petrochemical
and Refiners Association (API/NPRA)
Mission, Symbolism, History, Accessibility,
Recognizability, Population, Proximity (MSHARPP)
Third-party or corporate proprietary
Other (if checked, elaborate)
Does your company integrate security risk mitigation measures during the design,
construction, or renovation of a facility?
Risk Analysis and Assessments - Cyber
Drills & Exercises
Does your company conduct periodic security drills and exercises for all facilities,
including in conjunction with other required drills or exercises?
Does your company require each critical facility to conduct or participate in an
annual security drill or exercise, including common drills or exercises in which
multiple facilities may participate?

SAI
SAI

Does your company require each critical facility to prepare a written post-event
report assessing security drills and exercises and documenting corrective actions?
Over the past three years, with whom has your company participated in security
drills or exercises?
Local emergency responders
Tribal emergency responders
State emergency responders
Federal emergency responders
Federal Bureau of Investigation (FBI)
Department of Homeland Security (DHS)
Transportation Security Administration (TSA)

OMB Control # 1652-0056

ZZZ

CSR Checklist Page 9 of 23

9.0408
9.0409
R

9.0500

SAI

10.0000
10.0500
10.2400
10.2600

SAI

10.2700
11.0000
11.0100
11.0101
11.0102
11.0103
11.0104
11.0105
11.0106
11.0107
11.0108
11.0109
11.0110
11.0111
11.0112
11.0113
11.0114
11.0115
11.0116
11.0117
11.0118
11.0119
11.0200
11.0201
11.0202
11.0203
11.0204
11.0205
11.0206
11.0207

SENSITIVE SECURITY INFORMATION

Neighboring companys
Other (if checked, elaborate)
Does the corporate security plan include policies and procedures for auditing and
testing the effectiveness of the company’s security procedures, to include
documentation of results?
Cyber Security
Are methods in place to verify the accuracy of the diagrams and/or other
documentation related to your OT system?
Does the OT system deny network traffic by default and allow only authorized
network traffic?
Do OT system controls protect the integrity of electronically-communicated
information? (e.g., preventing man in the middle)?
Does the OT system prevent traffic from being routed to the internet?
Physical Security & Access Control
Which of the following security measures does your corporate security plan require
at critical facilities?
Fences
Gates equivalent to attached barriers
Signage such as No Trespassing, Do Not Enter,
Authorized Personnel Only, CCTV in Use, etc.
Closed circuit television (CCTV)
Intrusion sensors
Alarms
Clear zones around fence lines
Locks
Barriers such as bollards, planters, or Jersey barriers
Tamper devices
Patrols
Lighting
Crime Prevention Through Environmental Design (CPTED)
Unarmed Guards
Armed Guards
Video-analytic Systems
Video Recording
Intrusion-detection Systems
Other (if checked, elaborate)
How does your company physically control access to controlled-access areas?
Lock and Key
Biometric reader
Digital keycard
PIN Code
Proximity Card
Radio Remote Control
Other (if checked, elaborate)

OMB Control # 1652-0056

SAI

SAI
ZZZ

ZZZ

CSR Checklist Page 10 of 23

SENSITIVE SECURITY INFORMATION

11.0300
11.0301
11.0302
11.0303
11.0304
11.0305
11.0306
11.0307
11.0308
11.0309
11.0310
11.0311
11.0312
11.0313
11.0314
11.0315
11.0316
11.0317
11.0318
11.0319
R

11.0400
11.0401
11.0402
11.0403

R

11.0500
11.0501
11.0502
11.0503

R

11.0600

R

11.0700

Which of the following security measures does your corporate security plan require
at all facilities?
Fences
Gates equivalent to attached barriers
Signage such as No Trespassing, Do Not Enter,
Authorized Personnel Only, CCTV in Use, etc.
Closed circuit television (CCTV)
Intrusion sensors
Alarms
Clear zones around fence lines
Locks
Barriers such as bollards, planters, or Jersey barriers
Tamper devices
Patrols
Lighting
Crime Prevention Through Environmental Design (CPTED)
Unarmed Guards
Armed Guards
Video-analytic Systems
Video Recording
Intrusion-detection Systems
Other (if checked, elaborate)
Does the corporate security plan require the following security measures at all
facilities?
Employ measures to impede unauthorized persons from
gaining access to a facility and restricted areas within a facility.
Close and secure perimeter gates or entrances when not in use.
Post “No Trespassing” or “Authorized Personnel Only” signs
at intervals that are visible from any point of potential entry.
Does the corporate security plan require the following security measures at all
facilities?
Employ measures to impede unauthorized access to facilities.
Maintain fences, if used, without gaps
around gates or underneath the fence line.
Ensure that there is a clear zone for several feet on either side
of the fence, free of obstructions, vegetation, or objects that
could be used for concealment or to scale the fence.
Does the corporate security plan require that each critical facility implement
procedures (e.g., manual or electronic sign in/out) for controlling access to the
facility and restricted buildings or areas within the facility?
Does the corporate security plan require that each critical facility create a security
perimeter that impedes unauthorized vehicles from entering the facility perimeter or
critical areas by installing and maintaining barriers (e.g., fences, bollards, jersey
barriers)?

OMB Control # 1652-0056

ZZZ

CSR Checklist Page 11 of 23

SENSITIVE SECURITY INFORMATION

R

11.0800

Does the corporate security plan require that each critical facility ensure that visitors
are monitored and escorted?

R

11.0900

Does the corporate security plan require that each critical facility install and maintain
gates of an equivalent quality to the barrier to which they are attached?

R

11.1000

R

11.1100

R

11.1200

R

11.1300

R

11.1400

SAI

12.0000

R

12.0100
12.0200
12.0300
12.0301
12.0302
12.0303
12.0400

R

12.0500
12.0501
12.0502
12.0503
12.0504

R

12.0700
12.0701
12.0702
12.0703

Does the corporate security plan require that each critical facility provide sufficient
illumination for human and technological recognition of intrusion into the facility
perimeter or critical areas?
Does the corporate security plan require that each critical facility or critical areas
within a facility have security measures to monitor, detect, and assess 24 hours per
day, 7 days per week?
Does your company have key control procedures for key issuance, tracking,
collection, loss, and unauthorized duplication at each critical facility?
Does your company conduct a key inventory at least every 24 months at each critical
facility?
Does your company use restricted, patented, or electronic keys at each critical
facility to prevent unauthorized duplication?
Personnel Security
Has your company established policies and procedures for applicant preemployment screening and behavioral criteria for disqualification of applicants and
employees?
Is there at least one individual within your company who holds a current federal
security clearance?
What is the highest level of clearance that is held within your company?
Secret
Top Secret
Top Secret SCI
Does your company conduct pre-employment background investigations on all
potential employees?
Does your company conduct pre-employment background investigations of
applicants for positions that involve any of the following?
Authorized regular unescorted access
to control systems or sensitive areas.
Authorized access to sensitive information.
Assigned security roles
Assigned to work at or granted
access rights to critical facilities.
Do pre-employment background investigations of applicants for positions described
in Question 12.0500 above include all of the following?
Verification and validation of identity
Criminal history check
Verification and validation of
legal authorization to work

OMB Control # 1652-0056

SAI

ZZZ

CSR Checklist Page 12 of 23

SENSITIVE SECURITY INFORMATION

R

12.0800
12.0801
12.0802
12.0803
12.0900

R

12.1000

R

12.1100

R

12.1200

R

12.1300
12.1400

SAI

12.1500
12.1501
12.1502
12.1503
12.1504
12.1505
12.1506
12.1507
13.0000

R

13.0100

R

13.0200

R

13.0300

R

13.0400
13.0500
13.0501
13.0502
13.0503
13.0504

Has your company developed identification and badging policies and procedures for
personnel who have access to secure areas or sensitive information that address the
following?
Lost or stolen identification cards or badges
Temporary badges
Personnel termination
Does your company use the federally-established list of disqualifying crimes (listed in
49 CFR 1572.103) to assess the suitability of personnel for positions described in
Question 12.0500 above?
Does your company conduct recurring background investigations at least every ten
years for employees occupying security positions or who have access to sensitive
information or areas?
Does the corporate security plan require that each critical facility ensure that
company or vendor identification is available for examination by being visibly
displayed or carried by personnel while on-site?
Does your company verify that contractors have background investigation policies
and procedures at least as rigorous as the company’s?
Does the corporate security plan require that each critical facility ensure personnel
identification cards or badges are secure from tampering and contain the individual’s
photograph and name?
Does your company have a policy and/or procedure in place addressing security
issues related to employee termination?
Are the following actions taken during termination activities?
Retrieve badge or identification card.
Disable passwords.
Retrieve keys.
Retrieve operational and/or security manuals.
Block computer-system access.
Discharged employee signs nondisclosure agreement.
Other (if checked, elaborate)
Equipment Maintenance and Testing
Has your company implemented a maintenance program to ensure that security
systems are in good working order?
Does your company identify and respond to security equipment malfunctions or
failures in a timely manner?
Do all critical facilities, through routine use or quarterly examination, verify the
proper operation and/or condition of all security equipment?
Do all critical facilities provide an equivalent level of protective security measures to
mitigate risk during power outages, security equipment failure, or extended repair of
security systems?
Does your corporate security maintenance program include all of the following?
Corrective maintenance
Preventive maintenance
Testing
Inspection

OMB Control # 1652-0056

SAI

CSR Checklist Page 13 of 23

SAI

14.0000

R

14.0100

R

14.0200
14.0201
14.0202
14.0203
14.0204
14.0205
14.0206

R

14.0300
14.0301
14.0302
14.0400

R

14.0500
14.0600
14.0601
14.0602
14.0603
14.0604
14.0605
14.0606
14.0607
14.0608
14.0609
14.0610
14.0611

R

14.0700

SENSITIVE SECURITY INFORMATION

Recordkeeping
Does the corporate security plan address recordkeeping policies and procedures for
security information, including the protection of Sensitive Security Information (SSI)
in accordance with the provisions of 49 CFR Parts 15 and 1520?
Do all facilities retain the following documents, as appropriate, until superseded or
replaced?
Corporate security plan
Criticality assessment(s)
Training records
Security drill or exercise reports
Incident response plan(s)
Security testing and audits
In addition to the documents listed in Question 14.0200 above, does each critical
facility retain the following documents until superseded or replaced?
SVA(s)
Site-specific security measures
Does your company have a document-marking policy or procedure?
Does the company make the security information records described in Questions
14.0200 and 14.0300 above available to TSA upon request?
Has your company taken any of the following steps to apply operations security
(OPSEC) in daily activities?
Mark documents.
Hold conversations in appropriate locations.
Report undue interest in pipeline security or operations.
Secure sensitive documents outside of
office areas such as in vehicles or in transport.
Dispose of documents properly.
Dispose of computer equipment and associated media securely.
Create strong passwords.
Change passwords periodically.
Vary patterns of behavior
Remove badges in public
Other (if checked, elaborate)
Does your company maintain and secure criticality assessments, critical facility lists,
and security vulnerability assessments or equivalent?

OMB Control # 1652-0056

SAI

CSR Checklist Page 14 of 23

SENSITIVE SECURITY INFORMATION

DEPARTMENT OF HOMELAND SECURITY
Transportation Security Administration

Pipeline Corporate Security Review (CSR) IT Questions

CSR SH ONLY No SD FY2022 V.1 (December 2022)
Assessment Date:
10/18/2021

Operator Name:

0
Question
Question #
Type

SAI
SAI
R

R

SAI
SAI
R
R

SAI
SAI
SAI

CSR Question

2.0000 Security Plans - Cyber
4.0000 Security Incident Procedures
At an Elevated Threat Level, would your company enact the following measures on your
4.1200
cyber/SCADA system(s)?
4.1201
Increase monitoring of intrusion detection systems.
Remind personnel of the reporting requirements for
4.1202
any unusual enterprise or control systems network activity.
4.1203
Remind personnel to be vigilant regarding suspicious electronic mail.
4.1204
Other (if checked, elaborate)
At an Imminent Threat Level, would your company enact the following measures on your
4.1500
cyber/SCADA system(s)?
4.1501
Limit network communications links to essential sites/users.
Review remote access for individuals and revoke
4.1502
any credentials that are not current and necessary.
4.1503
Other (if checked, elaborate)
Does your company have a process for assuring the viability of the OT cyber recovery plan,
4.1800
including a backup control center?
5.0000 Security Training
6.0000 Outreach

N/A

Answer
(Yes/No/X)

SAI
SAI

SAI
SAI

For critical pipeline cyber assets, does your company ensure that threat and vulnerability
6.0300 information received from information-sharing forums and sources are made available to
those responsible for assessing and determining the appropriate course of action?
6.0400
6.0401
6.0402
6.0403
6.0404
8.0000
9.0000
10.0000
10.0500
10.2400
10.2600
10.2700

Does your company report significant cyber incidents to the following?
Senior management
Appropriate federal entities
Appropriate state, local, and tribal entities
Applicable ISAC(s)
Risk Analysis and Assessments - Cyber
Drills & Exercises
Cyber Security
Are methods in place to verify the accuracy of the diagrams and/or other documentation
related to your OT system?
Does the OT system deny network traffic by default and allow only authorized network
traffic?
Do OT system controls protect the integrity of electronically-communicated information?
(e.g., preventing man in the middle)?
Does the OT system prevent traffic from being routed to the internet?

SAI
SAI
SAI

SENSITIVE SECURITY INFORMATION

0
Recommendations

Recommendation #

CSR
Question #

SAI Category

Recommendation Narrative

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

OMB Control # 1652-0056

SENSITIVE SECURITY INFORMATION
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

OMB Control # 1652-0056

SENSITIVE SECURITY INFORMATION
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

OMB Control # 1652-0056

CSR Recommendations Follow-up
Pipeline Operator

0

Follow-up Request Date

Stakeholder Response Date

Recommendation #
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

CSR Question #

Recommendation

CSR Date:

10/18/2021

18-24 Month Follow-up Window
From:
4/18/2023
Stakeholder Response Code

To:
10/18/2023
Stakeholder Response Narrative

SENSITIVE SECURITY INFORMATION
0
Critical Facility List
#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Critical Facility Name

Address

City

State

OMB Control # 1652-0056

Latitude

Longitude

Description / Notes

SENSITIVE SECURITY INFORMATION

0
Meeting Attendees
Date:

10/18/2021

TSA Pipeline Security Attendees
Name

Title

Division

Name

Name

Title

Division

Name

Title

Organization / Company

Name

Title

Division

Title

Division

Name

Title

Division

Name

Title

Organization / Company

Title

Division

Pipeline Corporation Attendees

Other Attendees

CSR Form Filled Out By
Name

OMB Control # 1652-0056

SAI #
SAI Description
1 Security Plans
2 Security Plans - Cyber
3 Communication
4 Security Incident Procedures
5 Security Training
6 Outreach
7 Risk Analysis and Assessments
8 Risk Analysis and Assessments - Cyber
9 Drills & Exercises
10 Cyber Security
11 Physical Security & Access Control
12 Personnel Security
13 Equipment Maintenance and Testing
14 Recordkeeping

Paperwork Reduction Act Burden Statement: This is a voluntary collection of information. TSA estimates that the tota
response associated with this collection is approximately 8 hours and an additional 1-3 hours for follow-up on TSA reco
agency may not conduct or sponsor, and a person is not required to respond to a collection of information unless it dis
control number. The control number assigned to this collection is OMB 1652-0056, which expires on 02/29/2020. Sen
this burden estimate or collection to: TSA-11, Attention: PRA 1652-0056 Pipeline CSR, 601 South 12th Street, Arlington,