Critical Infrastructure Protection: Actions Needed to Address Significant Weaknesses in TSA's Pipeline Security Program Management

More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity.

GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks.

GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations.

Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality.

To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page.

TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing.

GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods.

TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk.

GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred.

GAO recommends, among other things, that the TSA Administrator take the following actions:

implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals;

clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities;

develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division;

update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats;

fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology;

take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology;

ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and

enter information on Corporate Security Review recommendations and monitor and record their status.

The security of the nation’s pipeline systems is vital to public confidence  and the nation’s safety, prosperity, and well-being. More than 2.7 million  miles of pipeline transport and distribute the oil, natural gas, and other  hazardous liquids that U.S. citizens and businesses depend on to operate  vehicles and machinery, heat homes, generate electricity, and  manufacture products. The interstate pipeline system runs through  remote, as well as highly populated urban areas, and is vulnerable to  accidents, operating errors, and malicious attacks. In addition, pipelines  increasingly rely on sophisticated networked computerized systems and  electronic data, which are vulnerable to cyber attack or intrusion.

Given that many pipelines transport volatile, flammable, or toxic oil and  liquids, and given the potential consequences of a successful physical or  cyber attack on life, property, the economy, and the environment, pipeline  systems are attractive targets for terrorists, hackers, foreign nations,  criminal groups, and others with malicious intent. For example, according  to the Transportation Security Administration (TSA)—the federal agency  with responsibility for security in all modes of transportation, which  includes the oversight of pipeline physical security and cybersecurity—a  minor pipeline system disruption could result in commodity price  increases while prolonged pipeline disruptions could lead to widespread  energy shortages. Further, disruption of any magnitude may affect other  domestic critical infrastructure and industries that are dependent on  pipeline system commodities.

Since the September 11, 2001, terrorist attacks, new threats to the  nation’s pipeline systems have evolved to include sabotage by  environmental activists and cyber attack or intrusion by nations. In  October 2016, environmental activists forced the shutdown of five crude  oil pipelines in four states. In addition, the U.S. energy sector has  experienced cyber intrusions by nation-state actors into their networks.  For example, in March 2018, the Federal Bureau of Investigation and the  National Cybersecurity and Communications Integration Center (NCCIC)  reported that a nation-state had targeted organizations within multiple  U.S. critical infrastructure sectors, including the energy sector, and  collected information pertaining to Industrial Control Systems (ICS). Also,  in April 2012, the Industrial Control Systems Cyber Emergency Response  Team reported that an unidentified cyber attacker had conducted a series  of cyber intrusions into U.S. natural gas pipeline systems beginning in  December 2011.

The security of federal cyber assets has been on our High Risk list since  1997 and was expanded to include the protection of critical cyber  infrastructure in 2003. In September 2018, we issued an update to the  information security high-risk area that identified actions needed to  address cybersecurity challenges facing the nation. We last reported on  pipeline security in 2010 and made eight recommendations to TSA to  develop outcome-based performance measures for assessing TSA’s  pipeline security efforts, and to track its corporate security reviews and  critical facility inspections’ recommendations, among others. We  discuss some of these recommendations in more detail later in this report.  In 2012, we reviewed information provided by TSA and closed the  recommendations as implemented.

You requested that we review TSA’s efforts to enhance pipeline physical  security and cybersecurity. This report examines the following objectives:  1.  how do pipeline sector stakeholders share security-related  2.  what guidance do pipeline operators report using to address security  risks and to what extent does TSA ensure its guidelines reflect the  current threat environment;  3.  to what extent has TSA assessed security risks to pipeline systems;  4.  to what extent has TSA assessed its effectiveness in reducing  pipeline security risks.

For each objective, we interviewed representatives of the five major  associations with ties to the pipeline industry: the American Petroleum  Institute (API), the Association of Oil Pipe Lines, the American Gas  Association (AGA), the Interstate Natural Gas Association of America  (INGAA), and the American Public Gas Association. We also interviewed  a nonprobability sample of security personnel from 10 pipeline operators.  We selected the 10 pipeline operators from TSA’s list of the top 100  critical pipeline systems. We chose operators to ensure a mixture of the  following characteristics: (a) type of pipeline commodity transported (i.e.,  natural gas or hazardous oil and liquids); (b) volume of product  transported; and (c) whether or not the pipeline operators’ critical facilities  had been the subject of a TSA security review. We also considered the  location of selected operators’ pipeline systems to ensure that a single  state or region was not overrepresented in our sample. We then  conducted semistructured interviews to obtain operators’ perspectives on  pipeline security and the role of federal agencies in assisting operators  with security activities. While the information gathered during operator  interviews cannot be generalized to all pipeline operators, it provides a  range of perspectives on a variety of topics relevant to pipeline security.

To identify how pipeline sector stakeholders share security-related  information, we reviewed documents describing federal agencies’  processes for sharing security-related information with federal partners  and private industry. In addition, we reviewed relevant documents from  TSA and other federal entities, including the Department of  Transportation (DOT), DOT’s Pipeline and Hazardous Materials Safety  Administration (PHMSA), the Department of Energy (DOE), and the  Federal Energy Regulatory Commission (FERC). We also interviewed  agency and industry officials to gather their perspectives on how security  information is shared among pipeline sector stakeholders.

To identify the guidance pipeline operators report using to address  security risks and the extent to which TSA ensures its guidelines reflect  the current threat environment, we reviewed TSA’s 2018 Pipeline Security  Guidelines and compared the cybersecurity-related sections to  applicable standards of the National Institute of Standards and  Technology’s (NIST) Framework for Improving Critical Infrastructure  Cybersecurity. We also interviewed federal officials to identify security- related standards and guidance issued. In addition, we obtained from  industry officials the security-related standards and guidance they use  and asked them about any challenges they experienced in implementing TSA’s Pipeline Security Guidelines. Based on the results of our operator  interviews, we analyzed TSA data on critical facility identification. Further,  to assess TSA’s process for updating the guidelines, we compared the  process with TSA’s Pipeline Security Smart Practice Observations for  pipeline operators and our Standards for Internal Control in the Federal  Government.

To determine the extent TSA has assessed security risks to pipelines, we  reviewed key threat assessments from TSA, such as its Pipeline Modal  and Cyber Modal Threat Assessments and Transportation Sector  Security Risk Assessments that it issued during calendar years 2011  through 2017. We also evaluated TSA’s identification of the 100 most  critical pipeline systems, its methods for assessing relative risk among  those systems, and its prioritization of its pipeline reviews. As part of that  evaluation, we assessed the reliability of the data within TSA’s pipeline  relative risk ranking tool by performing electronic and manual checks for  such things as logic errors and missing data. Additionally, we  interviewed TSA officials about how the risk tool is updated and  maintained to ensure data reliability. We determined the data were  sufficiently reliable for the purpose of our review. We also interviewed  TSA officials about the methods they used to rank relative risk among  pipeline systems and the extent to which those methods aligned with the  National Infrastructure Protection Plan 2013: Partnering for Critical  Infrastructure Security and Resilience (NIPP), other Department of  Homeland Security (DHS) priorities, and previously identified best  practices for program management and risk assessment. We also  analyzed information on the number of pipeline security reviews— Corporate Security Reviews (CSR) and Critical Facility Security Reviews  (CFSR)—that TSA conducted by fiscal year, as well as TSA staffing  levels and contractor support. Further, we interviewed TSA officials about  their staffing allocation and workforce planning process and compared  TSA’s process to our previous work which identified principles that a  strategic workforce planning process should follow.

To further our understanding of TSA’s pipeline security review processes,  we observed TSA officials and contractors conduct one CSR of one  pipeline system, and three CFSRs at three critical facilities in the Houston  and Beaumont, Texas, areas. While the results of our observations  cannot be generalized to all CSRs and CFSRs or all pipeline systems and  critical facilities, they provided us with an understanding of how TSA  conducts these reviews and inspections. We also interviewed  representatives of Secure Solutions International—a security and risk  management consulting firm that assists TSA in conducting CSRs and  CFSRs—about critical facilities and the inspection process.

To determine the extent TSA has assessed its effectiveness in reducing  pipeline security risks, we assessed key strategic documents, such as  TSA’s performance report, against our key characteristics of effective  performance measures. We also reviewed TSA guidance, such as the  standard operating procedures outlining how TSA staff are to conduct  pipeline security reviews and monitor operators’ implementation of their  recommendations. We then compared TSA’s assessment efforts to our  Standards for Internal Control in the Federal Government. In addition, we  evaluated the databases TSA officials reported using to analyze and  record the results and recommendations of pipeline security reviews. We  reviewed each database to determine what information was stored in  them, such as the number of observations, what fields were present, and  typical entries within each field. We then reviewed and conducted  electronic testing on the universe of fields and observations. Although we  identified limitations, which we discuss later in the report, we found that  the data was sufficiently reliable to provide general information such as  summary figures describing pipeline security reviews completed. We also  interviewed TSA officials to understand TSA’s efforts to assess its overall  effectiveness in reducing pipeline security risks and related data  collection efforts.

We conducted this performance audit from June 2017 to December 2018  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The national pipeline system consists of more than 2.7 million miles of  networked pipelines transporting oil, natural gas, and other hazardous  liquids. Hazardous liquid and natural gas pipelines—primarily buried  underground in the continental United States—run under remote and  open terrain, as well as densely populated areas. These pipelines are of  three main types:

Hazardous liquid: About 216,000 miles of hazardous liquid pipeline  transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia,  and carbon dioxide.

Natural gas transmission and storage: About 319,000 miles of  pipeline—mostly interstate—transport natural gas from sources to  communities.

Natural gas distribution: About 2.2 million miles of pipeline—mostly  intrastate—transport natural gas from transmission sites to  consumers.

Figure 1 depicts the network of hazardous liquid and natural gas  transmission pipelines in the United States.

More than 3,000 pipeline companies operate the nation’s pipeline  systems, which can traverse multiple states and the U.S. borders with  Canada and Mexico. Many pipeline systems are comprised of the  pipelines themselves, as well as a variety of facilities, such as storage  tanks, compressor stations, and control centers. Most pipeline systems  are monitored and moderated through automated ICS or Supervisory  Control and Data Acquisition (SCADA) systems using remote sensors,  signals, and preprogramed parameters to activate and deactivate valves  and pumps to maintain flows within tolerances.

Federal agencies and pipeline operators determine the criticality of  pipeline systems and their facilities based on their importance to the  nation’s energy infrastructure; service to installations critical to national  defense; or, if attacked, have the potential to cause mass casualties and  significant impact on public drinking water affecting major population  centers. Accordingly, those determined to be critical merit increased  attention to security. However, as we previously reported, the inherent  design and operation of U.S. pipeline systems may reduce some potential  impacts of lost service. The pipeline sector is generally considered to be  resilient and versatile. Historically, pipeline operators have been able to  quickly respond to the adverse consequences of an incident—whether it  is damage from a major hurricane or a backhoe—and quickly restore  pipeline service. Pipeline infrastructure also includes redundancies such  as parallel pipelines or interconnections that enable operators to reroute  material through the network. Figure 2 depicts the U.S. pipeline system,  its basic components, examples of vulnerabilities, and the entities to  which it supplies energy and raw materials. These entities include utility  companies, airports, military sites, and industrial and manufacturing  facilities.

Physical and Cyber Threats to Pipeline Systems

According to TSA, pipelines are vulnerable to physical attacks—including  the use of firearms or explosives—largely due to their stationary nature,  the volatility of transported products, and the dispersed nature of pipeline  networks spanning urban and outlying areas. The nature of the  transported commodity and the potential effect of an attack on national  security, commerce, and public health make some pipelines and their  assets more attractive targets for attack. Oil and gas pipelines have  been and continue to be targeted by terrorists and other malicious groups  globally. Terrorists have also targeted U.S. pipelines, but have not  succeeded in attacking them. Further, environmental activists and lone  actors seeking to halt the construction of new pipelines through sabotage  have recently emerged as a new threat to pipelines. For example, in  March 2017, activists used blowtorches to cut holes in empty portions of  the Dakota Access Pipeline in two states. In February 2017, local law  enforcement officers fatally shot a man who used an assault rifle to  damage the Sabal Trail Pipeline, a natural gas pipeline under  construction in Florida.

The sophisticated computer systems that pipeline operations rely on are  also vulnerable to various cyber threats. According to DOE, the  frequency, scale, and sophistication of cyber threats have increased, and  attacks have become easier to launch. NCCIC reported that the energy  sector, which includes pipelines, experienced more cyber incidents than  any sector from 2013 to 2015, accounting for 35 percent of the 796  incidents reported by all critical infrastructure sectors. In 2016, NCCIC  reported that the energy sector was the third most frequently attacked  sector. Further, according to DOE, the cost of preventing and  responding to cyber incidents in the energy sector is straining the ability  of companies to adequately protect their critical cyber systems. For  example, a 2015 study by the Ponemon Institute estimated the  annualized cost of cyber crime for an average energy company to be  about $28 million.

Ineffective protection of cyber assets from these threats can increase the  likelihood of security incidents and cyber attacks that disrupt critical  operations; lead to inappropriate access to and disclosure, modification,  or destruction of sensitive information; and threaten national security,  economic well-being, and public health and safety. Unintentional or  nonadversarial threat sources may include failures in equipment or  software due to aging, resource depletion, and errors made by end users.  They also include natural disasters and failures of critical infrastructure on  which the organization depends, but that are outside of the control of the  organization.

Intentional or adversarial threats may include corrupt employees, criminal  groups, terrorists, and nations that seek to leverage the organization’s  dependence on cyber resources (i.e., information in electronic form,  information and communications technologies, and the communications  and information-handling capabilities provided by those technologies).  These threat adversaries vary in terms of their capabilities, their  willingness to act, and their motives, which can include seeking monetary  gain or seeking an economic, political, or military advantage.

Cyber threat adversaries make use of various techniques, tactics,  practices, and exploits to adversely affect an organization’s computers,  software, or networks, or to intercept or steal valuable or sensitive  information. For example, an attacker could infiltrate a pipeline’s  operational systems via the internet or other communication pathways to  potentially disrupt its service and cause spills, releases, explosions, or  fires. Moreover, ICS, which were once largely isolated from the Internet  and the company’s information technology systems, are increasingly  connected in modern energy systems, allowing cyber attacks to originate  in business systems and migrate to operational systems. For example,  malicious nation-state actors used spear-phishing and other similar  approaches in 2018 against energy sector organizations to gain access to  their business systems, conduct reconnaissance, and collect information  about their ICS. Similarly, in April 2012, the Industrial Control Systems  Cyber Emergency Response Team reported that an unidentified cyber  attacker had conducted a series of cyber intrusions into U.S. natural gas  pipeline systems beginning in December 2011.

Key Critical Infrastructure Protection Guidance and Presidential Directives

Federal policy and public-private plans establish roles and responsibilities  for the protection of critical infrastructure, including pipelines. These  include Presidential Policy Directive 21 (PPD-21), the NIPP, and  Executive Order 13636. PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural  disasters, terrorism, and cyber incidents. The directive also identifies the  16 critical infrastructure sectors and assigns roles and responsibilities  for each critical infrastructure sector among nine designated federal  sector-specific agencies.

While PPD-21 identified the critical infrastructure sectors and assigned  responsibility for each sector’s sector-specific agency, the NIPP outlines  critical infrastructure stakeholder roles and responsibilities regarding  critical security and resilience. It describes a voluntary partnership model  as the primary means of coordinating government and private sector  efforts to protect critical infrastructure. As part of the partnership structure,  the designated sector-specific agencies serve as the lead coordinators for  security programs of their respective sector. As sector-specific agencies,  federal departments or agencies lead, facilitate, or support the security  and resilience programs and associated activities of their designated  critical infrastructure sector. For example, DHS and DOT are both  designated as sector-specific agencies for the transportation systems  sector, which includes pipelines. Each sector also has a government  coordinating council, consisting of representatives from various levels of  government, and many have a sector coordinating council (SCC)  consisting of owner-operators of these critical assets or members of their  respective trade associations. For example, the Transportation  Government Coordinating Council has been established, and the Pipeline  Modal SCC has been established to represent pipeline operators.

The NIPP also outlines a risk management framework for critical  infrastructure protection. As shown in Figure 3, the NIPP uses a risk  management framework as a planning methodology intended to inform  how decision makers take actions to manage risk. The risk management  framework calls for public and private critical infrastructure partners to  conduct risk assessments to understand the most likely and severe  incidents that could affect their operations and communities, and use this  information to support planning and resource allocation.

According to DHS, the risk management framework is influenced by the  nature and magnitude of a threat, the vulnerabilities to that threat, and the  consequences that could result, as shown in Figure 4.

Federal policy has encouraged voluntary information-sharing  mechanisms between the federal government and critical infrastructure  owners and operators. For example, Information Sharing and Analysis  Centers (ISAC) are formed by critical infrastructure owners and operators  to gather, analyze, appropriately sanitize, and disseminate intelligence  and information related to critical infrastructure. They typically collect,  analyze and disseminate actionable threat information to their members  and provide members with tools to mitigate risks and enhance resiliency.  ISACs in which pipeline operators may participate have been formed  including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC,  and Electricity ISAC.

Finally, in February 2013, the president issued Executive Order 13636,  Improving Critical Infrastructure Cybersecurity, which cited repeated  cyber intrusions into critical infrastructure as demonstrating the need for  improved cybersecurity. Executive Order 13636 outlined actions for  improving critical infrastructure cybersecurity, including direction for the  National Institute of Standards and Technology (NIST) to lead the  development of a voluntary risk-based cybersecurity framework that  would comprise a set of industry standards and best practices to help  organizations manage cybersecurity risks. NIST issued the framework  in 2014 and updated it in April 2018. The order also addressed the need to improve cybersecurity information sharing and collaboratively develop  risk-based standards and stated that U.S. policy was to increase the  volume, timeliness, and quality of cyber threat information shared with  private sector entities so that these entities may better protect and defend  themselves against cyber threats.

Pipeline Stakeholders’ Security Roles and Responsibilities

Protecting the nation’s pipeline systems is a responsibility shared by both  the federal government and private industry. As a result, several federal  departments, agencies, and the private sector have significant roles in  pipeline physical and cyber-related security. These entities include the  following:  Transportation Security Administration (TSA). TSA, within DHS, has  primary oversight responsibility for the physical security and cybersecurity  of transmission and distribution pipeline systems. Within TSA, the  Security Policy and Industry Engagement’s Pipeline Security Branch is  charged with overseeing its pipeline security program. Pursuant to its  authority, TSA’s Pipeline Security Branch first issued its voluntary  Pipeline Security Guidelines in 2011, and released revised guidelines in  March 2018. In accordance with the 9/11 Commission Act, TSA’s  Pipeline Security Branch identifies the top 100 critical pipeline systems in  the nation. To do so, it uses system annual throughput, which is based  on the amount of hazardous liquid or natural gas product transported  through a pipeline in 1 year (i.e., annual throughput). TSA also ranks the  relative risk among the top 100 critical pipeline systems, discussed later  in the report. Additionally, TSA’s Pipeline Security Branch is responsible  for conducting voluntary Corporate Security Reviews (CSR) and Critical  Facility Security Reviews (CFSR), which assess the extent to which the  100 most critical pipeline systems are following the intent of TSA’s  Pipeline Security Guidelines. See figure 5 below for an overview of the  CSR and CFSR processes.

In addition, TSA Intelligence and Analysis is responsible for collecting and  analyzing threat information related to the transportation network, and  sharing relevant threat information to pipeline stakeholders.

National Cybersecurity and Communications Integration Center  (NCCIC). Within DHS, NCCIC assists critical infrastructure owners in  addressing cyber incidents and attacks, including those targeting  industrial control systems. The NCCIC’s mission is to reduce the  likelihood and severity of incidents that may significantly compromise the  security and resilience of the nation’s critical information technology and  communications networks. NCCIC’s role is to serve as the federal  civilian interface for sharing information related to cybersecurity risks,  incidents, analysis, and warnings with federal and nonfederal entities, and  to provide shared situational awareness to enable real-time actions to  address cybersecurity risks and incidents to federal and nonfederal  entities.

Pipeline and Hazardous Materials Safety Administration (PHMSA).  PHMSA, within DOT, is responsible for regulating the safety of hazardous  materials transportation and the safety of pipeline systems, some aspects  of which can be related to pipeline security. In 2004, PHMSA and TSA  entered into a memorandum of understanding regarding their respective  roles in all modes of transportation. In 2006, they signed an annex to the  memorandum of understanding that further delineates lines of authority  and responsibility between TSA and PHMSA on pipeline and hazardous  materials transportation security. The annex identifies TSA as the lead  federal entity for transportation security, including hazardous materials  and pipeline security, and PHMSA as responsible for administering a  national program of safety in natural gas and hazardous liquid pipeline  transportation, including identifying pipeline safety concerns and  developing uniform safety standards.

Department of Energy (DOE). DOE is responsible for protecting electric  power, oil, and natural gas delivery infrastructure and, in December 2015,  was identified in statute as the sector-specific agency for cybersecurity for  the energy sector. The Office of Cybersecurity, Energy Security, and  Emergency Response is the lead for DOE’s cybersecurity efforts. In  addition, DOE operates the National SCADA Test Bed Program, a  partnership with Idaho National Laboratory, Sandia National Laboratories,  and other national laboratories which addresses control system security  challenges in the energy sector. Among its key functions, the program  performs control systems testing, research, and development; control  systems requirements development; and industry outreach.

Federal Energy Regulatory Commission (FERC). FERC regulates the  U.S. bulk electric power system, which is increasingly powered by natural  gas pipeline systems. FERC has regulatory authority over interstate  natural gas pipelines under the Natural Gas Act. However, its role is  limited to natural gas pipeline siting and rate regulation. The North  American Electric Reliability Corporation is the federally designated U.S.  Electric Reliability Organization, and is overseen by FERC. The North  American Electric Reliability Corporation, with approval from FERC, has  developed mandatory critical infrastructure protection standards for  protecting electric utility–critical and cyber-critical assets.

Private sector. Although TSA has primary federal responsibility for  overseeing interstate pipeline security, private sector pipeline operators  are responsible for implementing asset-specific protective security  measures. As we previously reported, operators have increased their  attention on security by incorporating security practices and programs into  their overall business operations. Pipeline operators’ interests and  concerns are primarily represented by five major trade associations with  ties to the pipeline industry—the Interstate Natural Gas Association of  America (INGAA), American Gas Association (AGA), American Public  Gas Association, American Petroleum Institute (API), and Association of  Oil Pipe Lines. According to TSA officials, pipeline operators, and  association representatives, these associations have worked closely with  the federal government on a variety of pipeline security-related issues,  including collaborating on TSA’s voluntary standards and information  sharing.

Federal and Nonfederal Pipeline Stakeholders Exchange Risk- Related Security Information

All of the pipeline operators and pipeline association representatives we  interviewed reported receiving security information from federal and  nonfederal entities. Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur.  Multiple federal entities exchange alerts of physical and cybersecurity  incidents and other risk-related information with critical infrastructure  partners, including pipeline operators. For example, DHS components  including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with  sector stakeholders. Specifically, Intelligence and Analysis provides  quarterly intelligence briefings to pipeline operators. NCCIC also issues  indicator bulletins, which can contain information related to cyber threat  indicators, defensive measures, and cybersecurity risks and incidents.

In addition, TSA and other federal entities have coordinated to address  specific pipeline-related security incidents. For example, TSA officials  coordinated with DOT, DOE, the Department of Justice, and FERC  through the Oil and Natural Gas subsector SCC to address ongoing  incidents of vandalism and sabotage of critical pipeline assets by  environmental activists in 2016. In July 2017, according to DOT officials,  PHMSA and TSA collaborated on a web-based portal to facilitate sharing  sensitive but unclassified incident information among federal agencies  with pipeline-related responsibilities. See table 1 for the key federal  information sharing entities and programs that exchange security-related  or incident information with critical infrastructure stakeholders, including  the pipeline sector.

Pipeline operators also share security-related information with TSA and  the NCCIC. In its Pipeline Security Guidelines, TSA requests that pipeline  operators report by telephone or email to its Transportation Security  Operations Center (TSOC) any physical security incidents that are  indicative of a deliberate attempt to disrupt pipeline operations or  activities that could be considered precursors to such an attempt. TSA’s  Pipeline Security Guidelines also request that operators report any actual  or suspected cyber attacks that could impact pipeline industrial control  systems or other information technology-based systems to the NCCIC.  According to the TSOC’s operating procedures, if a reported incident  meets certain criteria, such as the incident was intended to or resulted in  damage or requires a general evacuation of a facility, the TSOC watch  officer is then to contact Office of Security and Industry Engagement  officials. According to TSA officials, the TSOC does not conduct  investigations of the specific security incidents that pipeline operators  report. However, TSOC staff do analyze the incident information they  receive for national trends and common threats. TSA officials stated that  they share their observations with pipeline operators and other critical  infrastructure asset owners during monthly and quarterly conference calls  that TSA holds with pipeline operators.

All the pipeline operators and association representatives we interviewed  identified other nonfederal information sharing entities, including ISACs,  fusion centers, industry associations, and SCCs, which provide forums for  exchanging information about physical and cyber incidents throughout the  pipeline sector. See table 2 for nonfederal information sharing entities  identified as available to pipeline operators.

Operators and TSA officials reported that the current backlog in granting  security clearances for some key pipeline operator employees was a  significant factor affecting information sharing between TSA and pipeline  operators. TSA officials acknowledged that some pipeline operators have  had difficulty obtaining security clearances for key employees due to  ongoing backlogs in processing requests by the Office of Personnel  Management National Background Investigation Bureau, and that TSA’s  ability to share timely information with operators whose staff do not have  a clearance may be hindered. Three of the 10 pipeline operators we  interviewed identified receiving timely classified security information as a  specific challenge due, in part, to difficulties staff have had obtaining  security clearances. Further, 7 of the 10 pipeline operators that we  interviewed reported experiencing delays in obtaining a security  clearance or were aware of others who had experienced this issue.  However, according to three operators we interviewed, TSA was helpful  in facilitating approval of security clearances for the operators’ personnel  to access classified information when necessary.

This security clearance challenge is not faced by pipeline operators  alone. In January 2018, we designated the backlog of investigations for  the clearance process and the government-wide personnel security  clearance process as a high-risk area. We will continue to monitor  agencies’ progress in reducing the backlog and improving the security  clearance process.

Pipeline Operators Use a Range of Guidelines and Standards to Address Risks, but TSA’s Guidelines Lack Clear Definitions and a Process for Updating Them

Pipeline operators that we interviewed reported using a range of  guidelines and standards to address their physical and cybersecurity  risks, and all of them reported implementing TSA’s voluntary Pipeline  Security Guidelines that were applicable to their operations. TSA revised  and issued its Pipeline Security Guidelines in March 2018, but the revised  guidelines lack a defined process to consider updates to supporting  guidance such as to the NIST Framework for Improving Critical  Infrastructure Cybersecurity (Cybersecurity Framework). Furthermore,  TSA has not clearly defined the terms within the criteria that pipeline  operators are to use to determine the criticality of their facilities.

Pipeline Operators Use a Range of Guidelines and Standards to Address Security

Pipeline operators that we interviewed reported using a range of  guidelines and standards to address their physical and cybersecurity  risks. For example, all 10 of the pipeline operators we interviewed stated  they had implemented the voluntary 2011 TSA Pipeline Security  Guidelines the operators determined to be applicable to their  operations. The guidelines provide TSA’s recommendations for pipeline  industry security practices such as establishing a corporate security  program and identifying critical facilities among others (see sidebar).  Five of the 10 pipeline operators we interviewed characterized the  guidelines as generally or somewhat effective in helping to secure their  operations, 1 was neutral on their effectiveness, and 4 did not provide an  assessment of the guidelines’ effectiveness. However, one operator  pointed out that they had not adopted the guidelines’ recommended  interval of 36 months or less for conducting security vulnerability  assessments due to staffing limitations. Also, another pipeline operator  noted that they were working to implement the guidelines in the  operations of a newly acquired asset that they determined was not using  the guidelines in the same manner as their company.

All of the pipeline operators we interviewed reported using other  guidelines or standards to address pipeline systems’ security risks. For  example, pipeline operators reported using and industry association  representatives reported that their members use INGAA’s Control  Systems Cyber Security Guidelines for the Natural Gas Pipeline  Industry, API’s Pipeline SCADA Security standard, and the NIST  Cybersecurity Framework as sources of cybersecurity standards,  guidelines, and practices that may be scaled and applied to address a  pipeline operator’s cybersecurity risks.

Further, pipeline operators are required to adhere to regulations related to  pipeline safety and, depending upon their assets, operations, and  location, may be required to adhere to regulations for electrical utilities,  chemical storage facilities, and locations near waterways. For example,  all pipeline operators must adhere to DOT’s PHMSA safety regulations.  In addition, pipeline operators whose systems include chemical facilities  may be required to comply with DHS’s Chemical Facility Anti-Terrorism  Standards (CFATS). Pipeline operators whose systems include a  terminal located on a U.S. port may be required to comply with Maritime  Transportation Security Act regulations. For a listing of federal and  industry guidelines identified as applicable to security by the pipeline  operators, see appendix I.

TSA Does Not Have a Documented Process for Updating Its Pipeline Security Guidelines to Reflect Revisions to Supporting Standards

TSA’s Pipeline Security Branch issued its revised Pipeline Security  Guidelines in March 2018, but TSA has not established a documented  process to ensure that revisions occur and fully capture updates to  supporting standards and guidance. The guidelines were revised to,  among other things, reflect the dynamic threat environment and to  incorporate cybersecurity principles and practices from the NIST  Cybersecurity Framework, which were initially issued in February 2014.  To revise the guidelines and incorporate feedback, according to Pipeline  Security Branch officials, they incorporated outcomes from pipeline modal  threat assessments and best practices from security reviews, and  collaborated with pipeline sector stakeholders—including industry  associations and other federal agencies with a role in pipeline security.  Officials from the industry associations we interviewed confirmed that  they provided input to the revised pipeline guidelines, including meeting  with and consolidating comments from member pipeline operators. See  figure 6 for a timeline of events pertinent to federal pipeline security  guidelines.

TSA’s Pipeline Security Smart Practice Observations for pipeline  operators states that security plans should have a documented process to  include security plan reviews and updates on a periodic and an as- needed basis. Standards for Internal Control in the Federal Government  states that periodic review of policies, procedures, and related control  activities should occur to determine their continued relevance and  effectiveness in achieving identified objectives or addressing related  risks. The NIPP and NIST also emphasize the need to provide updates  on incident response guidance and security procedures, respectively.  Moreover, other pipeline industry guidance cited by TSA’s guidelines also  has a prescribed interval for review and revision. For example, API  reviews its standards at least every 5 years.

However, TSA has not instituted a documented process to consider the  need to update the Pipeline Security Guidelines on a regular basis.  Pipeline Security Branch officials acknowledged the value of having a  defined process for reviewing and, if necessary, revising TSA’s Pipeline  Security Guidelines at regular defined intervals to ensure it includes,  among other things, newly identified best practices and updated industry  guidance that are relevant to pipeline operators, such as the elements of  the latest version of NIST’s Cybersecurity Framework. For example,  TSA’s revisions to its guidelines incorporated some, but not all of the  elements of the NIST Cybersecurity Framework version 1. Specifically, to  improve incident response, the NIST framework recommends  implementing an incident response analysis and feedback function to a  security program. However, TSA’s Pipeline Security Guidelines do not  include similar steps for pipelines operators to include in their pipeline  security programs. Further, because NIST released version 1.1 of the  Cybersecurity Framework in April 2018, the guidelines that TSA released  in March 2018 do not incorporate cybersecurity elements that NIST  added to the latest Cybersecurity Framework such as the Supply Chain  Risk Management category.

Pipeline Security Branch officials said that they have not instituted a  review process on a regular basis because they intended to review and  revise TSA’s guidelines on an as-needed basis in response to updated  supporting guidance, but could provide no timeline for doing so. Without a  documented process defining how frequently Pipeline Security Branch  staff are to review and revise its guidelines, TSA cannot ensure that its  guidelines reflect the latest known standards and best practices for  physical and cybersecurity, or address the persistent and dynamic  security threat environment currently facing the nation’s pipeline system.

Pipeline Security Guidelines Lack Clear Definitions to Ensure Pipeline Operators Consistently Apply TSA’s Criteria for Identifying Critical Facilities

Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical  facilities to TSA. TSA’s Pipeline Security Branch conducts CFSRs at the  critical facilities that pipeline operators have identified.

However, our analysis of TSA’s data found that at least 34 of the top 100  critical pipeline systems deemed highest risk indicated that they had no  critical facilities. Accordingly, TSA would not conduct a CFSR at any of  these systems’ facilities because their operators identified none of them  as critical.

The fact that pipeline operators of about one third of the highest risk  systems identified no critical facilities may be due, in part, to the Pipeline  Security Branch not clearly defining the criteria outlined in the Pipeline  Security Guidelines that pipeline operators are to use to determine the  criticality of their facilities. Three of the 10 operators we interviewed  stated that some companies reported to TSA that they had no critical  facilities, and may possibly be taking advantage of the guidelines’ lack of  clarity. Accordingly, operators that report no critical facilities would avoid  TSA’s reviews of their facilities. service or deliverability resulting in a state  or local government's inability to provide  essential public services and emergency  response for an extended period of time;

Significantly damage or destroy national  intended use of major rivers, lakes, or  waterways (e.g., public drinking water for  large populations or disruption of major  commerce or public transportation  routes);  service or deliverability to a significant  number of customers or individuals for an  extended period of time;   operations for an extended period of time  (i.e., business critical facilities).

Our review of the eight criteria included in TSA’s Pipeline Security  Guidelines (see sidebar) found that no additional examples or clarification  are provided to help operators determine criticality. Although we  previously noted that 5 of the 10 operators we interviewed generally  found TSA’s Guidelines as a whole helpful in addressing pipeline security,  more than half of the operators we interviewed identified TSA’s criticality  criteria as a specific area for improvement. Specifically, 3 of the 10  pipeline operators that we interviewed stated that TSA had not clearly  defined certain terms within the criteria, and 3 additional operators of the  10 reported that additional consultation with TSA was necessary to  appropriately apply the criteria and determine their facilities’ criticality. For  example, 2 operators told us that individual operators may interpret TSA’s  criterion, “cause mass casualties or significant health effect,” differently.  One of these operators that we interviewed stated that this criterion could  be interpreted either as a specific number of people affected or a  sufficient volume to overwhelm a local health department, which could  vary depending on the locality. Another operator reported that because  TSA’s criteria were not clear, they created their own criteria which helped  the operator identify two additional critical facilities.

Pipeline Security Branch officials acknowledged there are companies that  report having no critical facilities in their pipeline systems. According to  Pipeline Security Branch officials, pipeline operators are in the best  position to determine which of their facilities are critical, and the  companies that have determined that their pipeline systems have no  critical facilities also have reported sufficient redundancies to make none  of their facilities critical to the continuity of their operations. According to  these officials, they have had extensive discussions with pipeline  company officials to assess the validity of their criticality determinations,  and have closely questioned companies to ensure they have properly  applied TSA’s criteria.

However, according to TSA’s Pipeline Security Guidelines, operators  should use a consistent set of criteria for determining the criticality of their  facilities. In addition, Standards for Internal Control in the Federal  Government states that management should define objectives clearly to  enable the identification of risks. To achieve this, management generally  defines objectives in specific and measurable terms and ensures the  terms are fully and clearly set forth so they can be easily understood.

Pipeline Security Branch officials acknowledged that the criticality  definitions in the Pipeline Security Guidelines could be clarified to be  more specific. Additionally, an industry association representative  reported that the association, in consultation with TSA, has been  developing supplementary guidance for its members to clarify certain  terms in TSA’s critical facility criteria. As of October 2018 this guidance is  still under review at the association and has not been made available to  the association’s members. Pipeline Security Branch officials confirmed  they worked with the industry association on its supplementary guidance,  but also acknowledged that the supplementary guidance may only be  distributed to the association’s membership.

Without clearly defined criteria for determining pipeline facilities’ criticality,  TSA cannot ensure that pipeline operators are applying its guidance  uniformly. Further, because TSA selects the pipeline facilities on which to  conduct CFSRs based on operators’ determinations, TSA cannot fully  ensure that all of the critical facilities across the pipeline sector have been  identified using the same criteria, or that their vulnerabilities have been  identified and addressed.

TSA Assesses Pipeline Risk and Conducts Security Reviews, but Limited Workforce Planning and Shortfalls in Assessing Risk Present Challenges

TSA’s Intelligence and Analysis identifies security risks to pipeline  systems through various assessments. Additionally, TSA’s Pipeline  Security Branch conducts security reviews to assess pipeline operators’  implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing  and lack of a workforce plan may affect its ability to carry out effective  reviews. The Pipeline Security Branch also developed a pipeline risk  assessment to rank relative risk of the top 100 critical pipeline systems  and to prioritize its security reviews of pipeline companies, but shortfalls  in its calculations of threat, vulnerability, and consequence may limit its  ability to accurately identify pipeline systems with the highest risk. Finally,  the pipeline risk assessment has not been peer reviewed to validate the  assessment’s data and methodology, which we previously reported as a  best practice in risk management.

TSA Conducts Assessments of Pipeline Security Risks

TSA’s Intelligence and Analysis produces assessments related to pipeline  security risks, including Pipeline Modal and Cyber Modal Threat  Assessments and the Transportation Sector Security Risk Assessment.  The Pipeline and Cyber Modal Threat Assessments are issued on a  semiannual basis; TSA Intelligence and Analysis may also issue  additional situation-based products on emerging threats. The Pipeline  Modal and Cyber Modal Threat Assessments evaluate, respectively,  physical and cyber threats to pipelines. The pipeline modal threat  assessment evaluates terrorist threats to hazardous liquid and natural  gas pipelines, and the cyber modal threat assessment evaluates cyber  threats to transportation, including pipelines. Both assessments  specifically analyze the primary threat actors, their capabilities, and  activities—including attacks occurring internationally—as well as other  characteristics of threat.

The Transportation Sector Security Risk Assessment assesses threat,  vulnerability, and consequence for various attack scenarios across the  five transportation modes for which TSA is responsible. The scenarios  define a type of threat actor—including homegrown violent extremists and  transnational extremists, such as al Qaeda and its affiliates—a target, and  an attack mode. For example, a scenario might assess the risk of attacks  using varying sizes of improvised explosive devices on pipeline system  assets. As part of the assessment process, TSA engages with subject  matter experts from TSA and industry stakeholder representatives to  compile vulnerabilities for each mode, and TSA analyzes both direct and  indirect consequences of the various attack scenarios. According to  Pipeline Security Branch officials, the assessments produced by TSA’s  Intelligence and Analysis provide key information to inform the pipeline  security program’s efforts.

TSA Conducts Pipeline Security Reviews to Assess Implementation of Pipeline Guidelines, but Does Not Have a Strategic Workforce Plan to Address Staffing Challenges

According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews  (CFSRs)—to assess pipeline vulnerabilities and industry implementation  of TSA’s Pipeline Security Guidelines. However, as shown by Figure 7  below, the number of CSRs and CFSRs completed by TSA has varied  during the last five fiscal years, ranging from zero CSRs conducted in  fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31,  2018.

TSA officials reported that staffing limitations have prevented TSA from  conducting more reviews. As shown in table 3, TSA Pipeline Security  Branch staffing levels (excluding contractor support) have varied  significantly over the past 9 years ranging from 14 full-time equivalents  (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014. They  stated that, while contractor support has assisted with conducting CFSRs,  there were no contractor personnel providing CSR support from fiscal  years 2010 through 2017, but that has now increased to two personnel in  fiscal year 2018.

TSA prioritizes reviewing and collecting information on the nation’s top  100 critical pipeline systems. According to TSA officials, they would need  to conduct 46 CSRs in order to review the top 100 critical pipeline  systems. In July 2018, TSA officials stated that TSA’s current target was  to assess each pipeline company every 2 to 3 years; this would equate to  about 15 to 23 CSRs per year. TSA officials stated that they expect to  complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security  Branch employees and contract support, and have completed 23 CSRs  through July 2018 for fiscal year 2018.

Given the ever-increasing cybersecurity risks to pipeline systems,  ensuring that the Pipeline Security Branch has the required cybersecurity  skills to effectively evaluate pipeline systems’ cybersecurity is essential.  Pipeline operators we interviewed emphasized the importance of  cybersecurity skills among TSA staff. Specifically, 6 of the 10 pipeline  operators and 3 of the 5 industry representatives we interviewed reported  that the level of cybersecurity expertise among TSA staff and contractors  may challenge the Pipeline Security Branch’s ability to fully assess the  cybersecurity portions of its security reviews. TSA officials stated that  Security Policy and Industry Engagement staff are working with DHS’s  National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and  competencies required for the pipeline security program. The officials  were uncertain, however, whether TSA would use contractor support or  support from the National Protection and Programs Directorate to provide  identified skills and competencies. TSA officials also stated that Security  Policy and Industry Engagement staff work with TSA’s human resource  professionals to identify critical skills and competencies needed for  Pipeline Security Branch personnel, and helps its workforce maintain  professional expertise by providing training and education for any  identified skill or competency gaps.

Our previous work has identified principles that a strategic workforce  planning process should follow including developing strategies tailored to  address gaps in number, deployment, and alignment of human capital  approaches for enabling and sustaining the contributions of all critical  skills and competencies. Workforce planning efforts, linked to an  agency’s strategic goals and objectives, can enable it to remain aware of  and be prepared for its needs, including the size of its workforce, its  deployment across the organization, and the knowledge, skills, and  abilities needed for it to pursue its mission. Agencies should consider how  hiring, training, staff development, performance management, and other  human capital strategies can be aligned to eliminate gaps and improve  the long-term contribution of skills and competencies identified as  important for mission success.

TSA has not established a workforce plan for its Security Policy and  Industry Engagement or its Pipeline Security Branch that identifies  staffing needs and skill sets such as the required level of cybersecurity  expertise among TSA staff and contractors. When asked for TSA  strategic workforce planning documents used to inform staffing  allocations related to the pipeline security program, TSA officials  acknowledged they do not have a strategic workforce plan. Rather,  according to these officials, TSA determines agency-level staffing  allocations through the Planning, Programming, Budgeting and Execution  process, which is used to decide policy, strategy, and the development of  personnel and capabilities to accomplish anticipated missions. According  to TSA officials, when they use this process they look at existing  resources and then set priorities based on the TSA Administrator’s needs.  However, a strategic workforce plan allows an agency to identify and  prepare for its needs, such as the size of its workforce, its deployment  across the organization, and the knowledge, skills, and abilities needed to  pursue its mission. TSA officials stated that the agency has a detailed  allocation plan for strategically aligning resources to screen passengers  at TSA-regulated airports, but not for the entire agency.

By establishing a strategic workforce plan, TSA can help ensure it has  identified the knowledge, skills, and abilities that the future workforce of  TSA’s Pipeline Security Branch may need in order to meet its mission of  reducing pipeline systems’ vulnerabilities to physical and cybersecurity  risks, especially in a dynamic and evolving threat environment. Further,  as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential.  Furthermore, a workforce plan could enable TSA to determine the  number of personnel it needs to meet its stated goals for conducting  CSRs and CFSRs.

TSA Calculates Relative Risk of Pipeline Systems, but Its Ranking Tool Does Not Include Current Data or Align with DHS Priorities to Help Prioritize Security Reviews

After TSA identifies the top 100 critical pipeline systems based on  throughput, the Pipeline Security Branch uses the Pipeline Relative Risk  Ranking Tool (risk assessment), which it developed in 2007, to assess  various security risks of those systems. We previously reported, in  2010, that the Pipeline Security Branch was the first of TSA’s surface  transportation modes to develop a risk assessment model that combined  all three components of risk—threat, vulnerability, and consequence—to  generate a risk score. The risk assessment generates a risk score for  each of the 100 most critical pipeline systems and ranks them according  to risk. The risk assessment calculates threat, vulnerability, and  consequence for each pipeline system on variables such as the amount  of throughput in the pipeline system and the number critical facilities. The  risk assessment combines data collected from pipeline operators, as well  as other federal agencies, such as the Departments of Transportation and  Defense, to generate the risk score.

However, the last time the Pipeline Security Branch calculated relative  risk among the top 100 critical pipeline systems using the risk  assessment was in 2014. Pipeline Security Branch officials told us that  they use the pipeline risk assessment to rank relative risk of the top 100  critical pipeline systems, and the standard operating procedures for  conducting CSRs state the results of the risk ranking are the primary  factor considered when prioritizing corporate security reviews of pipeline  companies. According to Pipeline Security Branch officials, the risk  assessment has not changed since 2014 because the Pipeline Security  Branch is still conducting CSRs based on the 2014 ranking of pipeline  systems.

As outlined in table 4 below, we identified several factors that likely limit  the usefulness of the current risk assessment in calculating threat,  vulnerability, and consequence to allow the Pipeline Security Branch to  effectively prioritize reviews of pipeline systems. For example, because  the risk assessment has not changed since 2014, information on threat  may be outdated. Additionally, sources of data and underlying  assumption and judgments regarding certain threat and vulnerability  inputs to the assessment are not fully documented. For example, threats  to cybersecurity are not specifically accounted for in the description of the  risk assessment methodology, making it unclear if cybersecurity is part of  the assessment’s threat factor. Further, the risk assessment does not  include information that is consistent with the NIPP and other DHS  priorities for critical infrastructure risk mitigation, such as information on  natural hazards and the ability to measure risk reduction (feedback data).

According to Pipeline Security Branch officials, the risk ranking  assessment is not intended to be a fully developed risk model detailing all  pipeline factors influencing risk. Rather, officials said they are primarily  interested in assessing risk data that impacts security. However, because  TSA’s Pipeline Security Program is designed to enhance the security  preparedness of the pipeline systems, incorporating additional factors that  enhance security into their risk calculation would better align their efforts  with PPD-21. For example, PPD-21 calls for agencies to integrate and  analyze information to prioritize assets and manage risks to critical  infrastructure, as well as anticipate interdependencies and cascading  impacts. For a more detailed discussion of the shortfalls we identified,  refer to appendix II.

TSA’s Pipeline Risk Assessment Has Not Been Peer Reviewed to Help Validate the Data and Methodology

In addition to the shortfalls identified above, the risk assessment has not  been peer reviewed since its conception in 2007. In our past work, we  reported that independent, external peer reviews are a best practice in  risk management and that independent expert review panels can provide  objective reviews of complex issues. According to the National  Research Council of the National Academies, external peer reviews  should, among other things, address the structure of the assessment, the  types and certainty of the data, and how the assessment is intended to be  used. The National Research Council has also recommended that DHS  improve its risk analyses for infrastructure protection by validating the  assessments and submitting them to independent, external peer review.

Other DHS components have implemented our prior recommendations to  conduct peer reviews of their risk assessments. For example, in April  2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used  to assess risk did not consider all of the elements of consequence, threat,  and vulnerability associated with a terrorist attack involving certain  chemicals. The Infrastructure Security Compliance Division, which  manages the CFATS program conducted a multiyear effort to improve  their risk assessment methodology and included commissioning a peer  review by the Homeland Security Studies and Analysis Institute, which  resulted in multiple recommendations. As part of the implementation of  some of the peer review’s recommendations, DHS conducted peer  reviews and technical reviews with government organizations and facility  owners and operators, and worked with Sandia National Laboratories to  verify and validate the CFATS program’s revised risk assessment  methodology, which was completed in January 2017.

According to Pipeline Security Branch officials, they are considering  updates to the risk assessment methodology including changes to the  vulnerability and consequence factors. These officials said the risk  assessment was previously reviewed within the past 18 months by  industry experts and they consider input from several federal partners  including DHS, DOT, and the Department of Defense. Officials also said  they will consider input from industry experts and federal partners while  working on updating the risk assessment. However, most of the proposed  changes to the risk assessment methodology officials described are ones  that have been deliberated since our last review in 2010. Therefore, an  independent, external peer review would provide the opportunity for  integration and analysis of additional outside expertise across the critical  infrastructure community.

While independent, external peer reviews cannot ensure the success of a  risk assessment approach, they can increase the probability of success  by improving the technical quality of projects and the credibility of the  decision-making process. According to the National Research Council of  the National Academies, independent, external peer reviews should  include validation and verification to ensure that the structure of the risk  assessment is both accurate and reliable. Thus, an independent, external  peer review would provide better assurance that the Pipeline Security  Branch can rank relative risk among pipeline systems using the most  comprehensive and accurate threat, vulnerability, and consequence  information.

TSA Has Established Performance Measures, but Limitations Hinder TSA’s Ability to Determine Pipeline Security Program Effectiveness

TSA has established performance measures, as well as databases to  monitor pipeline security reviews and analyze their results. However,  weaknesses in its performance measures and its efforts to record pipeline  security review recommendations limit its ability to determine the extent  that its pipeline security program has reduced pipeline sector risks.  Furthermore, we identified data reliability issues in the information that  TSA collects to track the status of pipeline security review  recommendations, such as missing data, inconsistent data entry formats,  and data entry errors.

TSA Has Established Performance Measures but Faces Challenges in Assessing the Effectiveness of Its Efforts to Reduce Pipeline Security Risks

TSA has three sets of performance measures for its pipeline efforts: the  Pipeline Security Plan in the 2018 Biennial National Strategy for  Transportation Security (NSTS), a management measure in the DHS  fiscal year 2019 congressional budget justification, and summary figures  in their CSR and CFSR databases. As a result of our 2010 work, TSA  established performance measures and linked them to Pipeline Security  Plan goals within the Surface Security Plan of the 2018 NSTS. See  table 5 below for the 2018 NSTS Pipeline Security Plan performance  measures.

As shown in table 6 below, DHS also included a management measure in  its fiscal year 2019 congressional budget justification to track the annual  number of completed pipeline security reviews.

Finally, TSA Pipeline Security Branch officials said they use summary  figures in the CFSR status database and the CSR goals and priorities  database as performance measures. For example, these include the  percentage of CFSR recommendations implemented and the average  percentage compliance with the guidelines by fiscal year.

We previously found that results-oriented organizations set performance  goals to clearly define desired program outcomes and develop  performance measures that are clearly linked to the performance goals.  Performance measures should focus on whether a program has achieved  measurable standards toward achieving program goals, and allow  agencies to monitor and report program accomplishments on an ongoing  basis. Our previous work on performance metrics identified 10 attributes  of effective performance. Table 7 identifies each key attribute of  effective performance measures along with its definition.

We evaluated the current performance measures included in the 2018  NSTS, the DHS fiscal year 2019 congressional budget justification, the  CSR goals and priorities database, and the CFSR status database  related to TSA’s Pipeline Security Branch.

We primarily focused on key attributes which could be applied to  individual measures. These include clarity, linkage, measurable targets,  objectivity, reliability, and baseline and trend data. Our prior work on  performance measurement found that all performance measure attributes  are not equal and failure to have a particular attribute does not  necessarily indicate that there is a weakness in that area or that the  measure is not useful; rather, it may indicate an opportunity for further  refinement.

Based on our evaluation, the TSA-identified measures do not possess  attributes that we have identified as being key to successful performance  measures. As a result, TSA cannot fully determine the extent to which the  Pipeline Security Branch has achieved desired outcomes, including the  effectiveness of its efforts to reduce risks to pipelines. Specifically, many  of TSA’s measures cover agency goals and mission, but they generally  lack clarity and measurable targets, provide significantly overlapping  information, and do not include baseline and trend data.

Clarity. The pipeline-related measures in the 2018 NSTS are not  clear because they do not describe the methodology used to calculate  them, and the names and definitions are not clearly described. For  example, NSTS goal 1 includes an objective to conduct training of  employees responding to terrorist attacks. The desired outcome is to  improve the capability of industry employees to respond and recover  from terrorist attacks. However, the performance measure is the  percentage of critical pipeline systems implementing the TSA Pipeline  Security Guidelines. It is not clear if this measure is specific to the  sections of the guidelines related to employee training or overall  implementation of the guidelines. The CFSR status database  measures include the percentage of recommendations implemented  by topic, such as “Site Specific Security Measures,” “Signage,” or  “Miscellaneous.” However, the database does not specifically define  these topics or explain the methodology for calculating the  measures. Unclear measures could be confusing and misleading to  users.

Core program activities. The pipeline-related measures in the 2018  NSTS cover some of the agency’s core program activities, such as  conducting security exercises with the pipeline industry and providing  intelligence and information products to the industry. However, the  NSTS Pipeline Security Plan measures do not specifically include  some core program activities, such as updating the TSA Pipeline  Security Guidelines or the results of conducting CSRs and CFSRs in  order to collect the information necessary for the existing performance  measures. The CSR goals and priorities database and the CFSR  status database include measures intended to track some of the  results of pipeline security reviews, such as the average percentage  compliance with the guidelines by fiscal year and the percentage of  CFSR recommendations implemented. If core program activities are  not covered, there may not be enough information available in those  areas to managers and stakeholders.

Limited overlap. The pipeline-related measures in the 2018 NSTS do  not have limited overlap. As discussed previously, four of the five  NSTS measures are based on the percentage of critical pipeline  systems implementing TSA’s Pipeline Security Guidelines. The  management measure is based on the number of complete pipeline  security reviews. The CFSR status database measures are based on  the percentage of recommendations implemented overall and by  groups. Finally, the CSR goals and priorities database measures are  based on the average compliance percentage of companies that had  CSRs conducted in fiscal years 2016 and 2017. This is similar to four  of the five NSTS measures. Significantly overlapping measures may  lead to redundant, costly information that does not add value for TSA  management.

Linkage. The pipeline-related measures in the 2018 NSTS generally  exhibited this key attribute. For example, all of the NSTS measures  were arranged by agency strategic goals and risk-based priorities.  However, the management measure in DHS’s fiscal year 2019  congressional budget justification and the CFSR status database  measures did not specify the TSA goals and priorities to which they  were aligned. If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by  these measures do not support achieving those goals or mission.

Measurable target. TSA’s measures generally did not include  measurable targets in the form of a numerical goal and none of the  NSTS measures had measurable targets. For example, the NSTS  measure under the Security Planning priority, which tracks the  percentage of critical pipeline systems implementing TSA’s Pipeline  Security Guidelines, does not state what specific percentages would  be considered an improvement in industry security plans. However,  the management measure did include target numbers of pipeline  security reviews by fiscal year. Both the CFSR status database  measures and CSR goals and priorities database measures did not  include measurable targets. Without measurable targets, TSA cannot  tell if performance is meeting expectations.

Objectivity. Because the pipeline-related measures in the 2018  NSTS, the CFSR status database, and the CSR goals and priorities  database generally lack clarity and measurable targets, TSA cannot  ensure its measures are free from bias or manipulation, and therefore,  are not objective. If measures are not objective, the results of  performance assessments may be systematically overstated or  understated.

Reliability. Because the pipeline-related measures in the 2018 NSTS,  the CFSR status database, and the CSR goals and priorities database  generally lack clarity, measurable targets, and baseline and trend  data, it is not clear if TSA’s measures produce the same result under  similar conditions; therefore, the pipeline-related measures are  unreliable. If measures are not reliable, reported performance data  may be inconsistent and add uncertainty.

Baseline and trend data. TSA’s measures generally did not include  baseline and trend data. For example, none of the NSTS measures  included past results and compared them to measurable targets. TSA  officials were unable to identify measures or goals to assess the  extent to which pipeline operators have fully implemented the  guidelines or increased pipeline security, but did say developing a  feedback mechanism to measure progress in closing vulnerability  gaps was important. However, the management measure did include  the number of completed pipeline security reviews for each fiscal year  from 2014 through 2017, as well as numerical goals. The CFSR  status database includes information on CFSRs conducted from May  22, 2012, through June 29, 2017, but the measures are calculated for  the entire time period rather than year-by-year. The CSR goals and  priorities database measures include percentage compliance with the  guidelines for CSRs conducted in fiscal years 2016 and 2017, as well  as a combined measure. However, baseline and trend data are not  tracked or reported in either database. Collecting, tracking,  developing, and reporting baseline and trend data allows agencies to  better evaluate progress being made and whether or not goals are  being achieved.

Pipeline Security Branch officials explained that in addition to the  measures reported in the 2018 NSTS Pipeline Security Plan, they  primarily rely on measures assessing CSR and CFSR implementation for  assessing the value of its pipeline security program. TSA officials  reported that they collect and analyze data and information collected from  CSRs and CFSRs to, among other things, determine strengths and  weaknesses at critical pipeline facilities, areas to target for risk reduction  strategies, and pipeline industry implementation of the voluntary Pipeline  Security Guidelines. For example, TSA officials reported that they  analyzed information from approximately 734 CFSR recommendations  that were made during fiscal years 2012 through 2016. They found that  pipeline operators had made the strongest improvements in security  training, public awareness outreach and law enforcement coordination,  and site specific security measures. The most common areas in need of  improvement were 24x7 monitoring, frequency of security vulnerability  assessments, and proper signage.

However, as described above, we found those measures also did not  comport with key attributes for successful measures and we report below  on reliability concerns for underlying data supporting those measures. In  addition, while the Pipeline Security Branch may not rely on the measures  included in the 2018 NSTS Pipeline Security Plan and the fiscal year  2019 congressional budget justification, they are important for reporting  the status of pipeline security efforts to TSA as a whole and to external  stakeholders such as Congress.

Taking steps to ensure that the pipeline security program performance  measures exhibit key attributes of successful performance measures  could allow TSA to better assess the program’s effectiveness at reducing  pipeline physical and cybersecurity risks. This could include steps such  as modifying its suite of measures so they are clear, have measurable  targets, and add baseline and trend data. Further examples include the  following:

Adding measurable targets consisting of numerical goals could allow  TSA to better determine if the pipeline security program is meeting  expectations. For example, measurable targets could be added to  TSA’s existing measures by developing annual goals for the  percentage of recommendations implemented to the CFSR status  database and then reporting annual results.

To make measures clearer, TSA could verify that each measure has a  clearly stated name, definition, and methodology for how the measure  is calculated. For example, the NSTS objective for security training  mentioned above could have more specific language explaining how  the measure is calculated and whether it applies to pipeline operators’  implementation of the training-related portions of the TSA Pipeline  Security Guidelines or overall implementation.

Finally, adding baseline and trend data could allow TSA to identify,  monitor, and report changes in performance and help ensure that  performance is viewed in context. For example, the NSTS measures,  CFSR status database measures, and CSR goals and priorities  database measures could have annual results from prior years. This  could help TSA and external stakeholders evaluate the effectiveness  of the pipeline security program and whether it is making progress  toward its goals.

TSA Does Not Track the Implementation Status of Past CSR Recommendations, and Supporting Data Are Not Sufficiently Reliable

According to TSA officials, the primary means for assessing the  effectiveness of the agency’s efforts to reduce pipeline security risks is  through conducting pipeline security reviews— Corporate Security  Reviews (CSRs) and Critical Facility Security Reviews (CFSRs).  However, TSA has not tracked the status of CSR recommendations for  over 5 years and related security review data are not sufficiently reliable.

When conducting CSRs and CFSRs, TSA staff makes recommendations  to operators, if appropriate. For example, a CSR recommendation might  include a suggestion to conduct annual security-related drills and  exercises, and a CFSR recommendation might include a suggestion to  install barbed wire on the main gate of a pipeline facility. In response to  recommendations that we made in our 2010 report, TSA developed three  databases to track CSR and CFSR recommendations and their  implementation status by pipeline facility, system, operator, and product  type. In addition, the agency recently developed a fourth database to  collect and analyze information gathered from pipeline operators’  responses to CSR questions. TSA officials reported that they use this  database to assess the extent that TSA’s pipeline security program has  met NSTS goals and Pipeline Security Branch priorities. TSA officials  stated that they use the CSR goals and priorities database for follow-up  on recommendations, indications of improvement in pipeline security, and  as an input into TSA performance goals and measures, including the  performance measures for the 2018 NSTS Pipeline Security Plan.

We found several problems with the databases that indicate that the  pipeline security program data are not sufficiently reliable and do not  provide quality information that is current, complete, and accurate. First,  the CSR recommendations database only included information for  reviews conducted from November 2010 through February 2013. TSA  officials stated that the agency stopped capturing CSR recommendations  and status information in 2014. A TSA official stated that one factor was  that the pipeline staffing level was one FTE in fiscal year 2014. However,  the Pipeline Security Branch did not resume entering CSR  recommendation-related information when staffing levels rose to 6 FTEs  in the following year and beyond. As a result, TSA is missing over 5 years  of data for the recommendations it made to pipeline operators when  conducting CSRs.

The agency collected some information from CSRs conducted in fiscal  years 2016 and 2017 in the separate CSR goals and priorities database.  However, this database does not include all of the information that TSA  collects when conducting CSRs. Specifically, the CSR goals and priorities  database does not state which companies were reviewed, what specific  recommendations were made, or the current status of those  recommendations, and only records operators’ responses to 79 of the  222 CSR questions.

Second, our review identified instances of missing data, inconsistent data  entry formats, and data entry errors in the four databases. For example:

The CSR recommendations database had missing data in all 13 of the  included fields and a data entry error shifted 50 observations into the  wrong fields, impacting both the Status Date and Completion Code  fields.

The CSR goals and priorities database had seven entries with  inconsistent data formatting and five of those entries were not taken  into account when calculating summary figures.

The CFSR recommendations database had missing data in 3 of 9  fields. There was also inconsistent data entry formats in 3 fields.

The CFSR status database had missing data in 7 of 29 fields and  inconsistent data entry formats in 4 fields.

Finally, TSA has not documented its data entry and verification  procedures, such as in a data dictionary or user manual, and does not  have electronic safeguards for out-of-range or inconsistent entries for any  of the databases it uses to track the status of CSR or CFSR  recommendations and analyze operator responses to the CSR. TSA  Pipeline Security Branch officials told us that they had not documented  data entry and verification procedures and did not have electronic  safeguards. This was for two reasons. First, the officials stated that the  databases are small and maintained in a commercial spreadsheet  program that does not allow for electronic safeguards. However, based  on our review of the databases, the spreadsheet program does allow for a  variety of electronic safeguards. For example, entries can be restricted to  only allow selections from a drop-down list or only allow dates to be  entered. Second, only a small number of TSA employees enter  information into these databases. TSA officials explained that typically  one TSA employee is responsible for entering information from pipeline  security reviews, and another individual, usually whoever conducted the  review, is tasked to verify the accuracy of the data entered. As a result,  according to the officials, any errors would be self-evident and caught  during these TSA employees’ reviews.

Our work has emphasized the importance of quality information for  management to make informed decisions and evaluate agencies’  performance in achieving key objectives and addressing risks. The  Standards for Internal Control in the Federal Government states that  management should use quality information to achieve agency objectives,  where “quality” means, among other characteristics, current, complete,  and accurate. In addition, DHS’s Information Quality Guidelines state  that all DHS component agencies should treat information quality as  integral to every step of the development of information, including  creation, collection, maintenance, and dissemination. The guidelines also  state that agencies should substantiate the quality of the information  disseminated through documentation or other appropriate means.

Without current, complete, and accurate information, it is difficult for TSA  to evaluate the performance of the pipeline security program. Until TSA  monitors and records the status of these reviews’ recommendations, it will  be hindered in its efforts to determine whether its recommendations are  leading to significant reduction in risk. By entering information on CSR  recommendations and monitoring and recording their status, developing  written documentation of its data entry and verification procedures and  electronic safeguards, and improving the quality of its pipeline security  program data, TSA could better ensure it has the information necessary  to effectively monitor pipeline operators’ progress in improving their  security posture, and evaluate its pipeline security program’s   effectiveness in reducing security risks to pipelines.

A successful pipeline attack could have dire consequences on public  health and safety, as well as the U.S. economy. Recent coordinated  campaigns by environmental activists to disrupt pipeline operations, and  the successful attempts by nation-state actors to infiltrate and obtain  sensitive information from pipeline operators’ business and operating  systems, demonstrate the dynamic and continuous threat to the security  of our nation’s pipeline network.

To help ensure the safety of our pipelines throughout the nation, it is  important for TSA to address weaknesses in the management of its  pipeline security program. TSA’s Pipeline Security Branch revised its  security guidelines in March 2018 to, among other things, reflect the  dynamic threat environment and incorporate NIST’s Cybersecurity  Framework cybersecurity principles and practices. However, without a  documented process defining how frequently TSA is to review and, if  deemed necessary, revise its guidelines, TSA cannot ensure that its  guidelines reflect the latest known standards and best practices for  physical and cybersecurity, or address the persistent and dynamic  security threat environment currently facing the nation’s pipeline system.  Further, without clearly defined criteria for determining pipeline facilities’  criticality, TSA cannot ensure that pipeline operators are applying  guidance uniformly and that all of the critical facilities across the pipeline  sector have been identified; or that their vulnerabilities have been  identified and addressed.

TSA could improve its ability to conduct pipeline security reviews and the  means that it uses to prioritize which pipeline systems to review based on  their relative risk ranking. Establishing a strategic workforce plan could  help TSA ensure that it has identified the necessary skills, competencies,  and staffing allocations that the Pipeline Security Branch needs to carry  out its responsibilities, including conducting security reviews of critical  pipeline companies and facilities, as well as their cybersecurity posture.  Better considering threat, vulnerability, and consequence elements in its  risk assessment and incorporating an independent, external peer review  in its process would provide more assurance that the Pipeline Security  Branch ranks relative risk among pipeline systems using comprehensive  and accurate data and methods.

We are making 10 recommendations to TSA:

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to implement a documented process  for reviewing, and if deemed necessary, for revising TSA’s Pipeline  Security Guidelines at regular defined intervals. (Recommendation 1)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to clarify TSA’s Pipeline Security  Guidelines by defining key terms within its criteria for determining  critical facilities. (Recommendation 2)

The TSA Administrator should develop a strategic workforce plan for  its Security Policy and Industry Engagement’s Surface Division, which  could include determining the number of personnel necessary to meet  the goals set for its Pipeline Security Branch, as well as the  knowledge, skills, and abilities, including cybersecurity, that are  needed to effectively conduct CSRs and CFSRs. (Recommendation  3)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to update the Pipeline Relative Risk  Ranking Tool to include up-to-date data to ensure it reflects industry  conditions, including throughput and threat data. (Recommendation 4)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to fully document the data sources,  underlying assumptions and judgments that form the basis of the  Pipeline Relative Risk Ranking Tool, including sources of uncertainty  and any implications for interpreting the results from the assessment.  (Recommendation 5)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to identify or develop other data  sources relevant to threat, vulnerability, and consequence consistent  with the NIPP and DHS critical infrastructure risk mitigation priorities  and incorporate that data into the Pipeline Relative Risk Ranking Tool  to assess relative risk of critical pipeline systems, which could include  data on prior attacks, natural hazards, feedback data on pipeline  system performance, physical pipeline condition, and cross-sector  interdependencies. (Recommendation 6)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to take steps to coordinate an  independent, external peer review of its Pipeline Relative Risk  Ranking Tool, after the Pipeline Security Branch completes  enhancements to its risk assessment approach. (Recommendation 7)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to ensure that it has a suite of  performance measures which exhibit key attributes of successful  performance measures, including measurable targets, clarity, and  baseline and trend data. (Recommendation 8)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to take steps to enter information on  CSR recommendations and monitor and record their status.  (Recommendation 9)

The TSA Administrator should direct the Security Policy and Industry  Engagement’s Surface Division to improve the quality of its pipeline  security program data by developing written documentation of its data  entry and verification procedures, implementing standardized data  entry formats, and correcting existing data entry errors.  (Recommendation 10)

We provided a draft of this report to DHS, DOE, DOT, and FERC.  DHS  provided written comments which are reproduced in appendix III. In its  comments, DHS concurred with our recommendations and described  actions planned to address them. DHS, DOE, DOT, FERC, also provided  technical comments, which we incorporated as appropriate. We also  provided draft excerpts of this product to the American Petroleum Institute  (API), the Association of Oil Pipe Lines, the American Gas Association  (AGA), the Interstate Natural Gas Association of America (INGAA), the  American Public Gas Association, and the selected pipeline operators  that we interviewed. For those who provided technical comments, we  incorporated them as appropriate.

With regard to our first recommendation, that TSA implement a  documented process for reviewing, and if deemed necessary, for revising  its Pipeline Security Guidelines at regular defined intervals, DHS stated  that TSA will implement a documented process for reviewing and revising  its Pipeline Security Guidelines at regular defined intervals, as  appropriate. DHS estimated that this effort would be completed by March  31, 2019. This action, if fully implemented, should address the intent of  the recommendation.

With regard to our second recommendation, that TSA clarify its Pipeline  Security Guidelines by defining key terms within its criteria for determining  critical facilities, DHS stated that TSA will clarify its Pipeline Security  Guidelines by defining key terms within its criteria for determining critical  facilities. DHS estimated that this effort would be completed by May 31,  2019. This action, if fully implemented, should address the intent of the  recommendation.

With regard to our third recommendation, that TSA develop a strategic  workforce plan for its Security Policy and Industry Engagement's Surface  Division,  DHS stated that TSA will develop a strategic workforce plan for  the division, which includes determining the number of personnel  necessary to meet the goals set for the Pipeline Security Branch, as well  as the knowledge, skills, and abilities, including cybersecurity, that are  needed to effectively conduct CSRs and CFSRs. DHS estimated that this  effort would be completed by June 30, 2019. This action, if fully  implemented, should address the intent of the recommendation.

With regard to our fourth recommendation, that TSA update the Pipeline  Relative Risk Ranking Tool to include up-to-date data in order to ensure it  reflects industry conditions, including throughput and threat data, DHS  stated that TSA will update the Pipeline Relative Risk Ranking Tool to  include up-to-date data in order to ensure it reflects industry conditions,  including throughput and threat data. DHS estimated that this effort would  be completed by February 28, 2019. This action, if fully implemented,  should address the intent of the recommendation.

With regard to our fifth recommendation, that TSA fully document the data  sources, underlying assumptions, and judgements that form the basis of  the Pipeline Relative Risk Ranking Tool, including sources of uncertainty  and any implications for interpreting the results from the assessment,  DHS stated that TSA will fully document the data sources, underlying  assumptions, and judgements that form the basis of the Pipeline Relative  Risk Ranking Tool. According to DHS, this will include sources of  uncertainty and any implications for interpreting the results from the  assessment. DHS estimated that this effort would be completed by  February 28, 2019. This action, if fully implemented, should address the  intent of the recommendation.

With regard to our sixth recommendation, that TSA identify or develop  other data sources relevant to threat, vulnerability, and consequence  consistent with the NIPP and DHS critical infrastructure risk mitigation  priorities and incorporate that data into the Pipeline Relative Risk Ranking  Tool to assess relative risk of critical pipeline systems, DHS stated that  TSA will identify and/or develop other sources relevant to threat,  vulnerability, and consequence consistent with the NIPP and DHS critical  infrastructure risk mitigation priorities. DHS also stated that TSA will  incorporate that data into the Pipeline Risk Ranking Tool to assess  relative risk of critical pipeline systems, which could include data on prior  attacks, natural hazards, feedback data on pipeline system performance,  physical pipeline condition, and cross-sector interdependencies. DHS  estimated that this effort would be completed by June 30, 2019. This  action, if fully implemented, should address the intent of the  recommendation.

With regard to our seventh recommendation, that TSA take steps to  coordinate an independent, external peer review of its Pipeline Relative  Risk Ranking Tool, after the Pipeline Security Branch completes  enhancements to its risk assessment approach, DHS stated that, after  completing enhancements to its risk assessment approach, TSA will take  steps to coordinate an independent, external peer review of its Pipeline  Relative Risk Ranking Tool. DHS estimated that this effort would be  completed by November 30, 2019. This action, if fully implemented,  should address the intent of the recommendation.

With regard to our eighth recommendation, that TSA ensure that the  Security Policy and Industry Engagement's Surface Division has a suite of  performance measures which exhibit key attributes of successful  performance measures, including measurable targets, clarity, baseline,  and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section  will develop both physical and cyber security performance measures, in  consultation with pipeline stakeholders, to ensure that it has a suite of  performance measures which exhibit key attributes of successful  performance measures, including measurable targets, clarity, baseline,  and trend data. DHS estimated that this effort would be completed by  November 30, 2019. This action, if fully implemented, should address the  intent of the recommendation.

With regard to our ninth recommendation, that TSA take steps to enter  information on CSR recommendations and monitor and record their  status, DHS stated that TSA will enter information on CSR  recommendations and monitor and record their status. DHS estimated  that this effort would be completed by October 31, 2019. This action, if  fully implemented, should address the intent of the recommendation.

With regard to our tenth recommendation, that TSA take steps to improve  the quality of its pipeline security program data by developing written  documentation of its data entry and verification procedures, implementing  standardized data entry formats, and correcting existing data entry errors,  DHS stated that TSA will develop written documentation of its data entry  and verification procedures, implementing standardized data entry  formats, and correcting existing data entry errors. DHS estimated that this  effort would be completed by July 31, 2019. This action, if fully  implemented, should address the intent of the recommendation.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until one day from the  report date. At that time, we will send copies to the appropriate  congressional committees; the Secretaries of Energy, Homeland Security,  and Transportation; the Executive Director of the Federal Energy  Regulatory Committee; and other interested parties. In addition, the report  is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Chris Currie at (404) 679-1875 or curriec@gao.gov, and Nick Marinos at  (202) 512-9342 or marinosn@gao.gov. Key contributors to this report are  listed in appendix IV.

Appendix I: Federal and Industry Security Guidelines and Standards for the Pipeline Sector

This appendix lists security guidance and guidance-related tools that the  pipeline operators and industry association officials we interviewed  identified as adopted or available in order to secure their physical and  cyber operations. This list should not be considered to include all physical  and cybersecurity guidance that may be available or used by all pipeline  operators nor do all operators use all guidance listed.

Appendix II: Description of Areas for Improvement in the Pipeline Security Branch’s Pipeline Relative Risk Ranking Tool

The Transportation Security Administration’s (TSA) Pipeline Security  Branch developed the Pipeline Relative Risk Ranking Tool (risk  assessment) in 2007. The risk assessment calculates threat,  vulnerability, and consequence on variables such as the amount of  throughput in the pipeline system (consequence input). Pipeline Security  Branch officials told us that they use the pipeline risk assessment to rank  relative risk of the top 100 critical pipeline systems, and the standard  operating procedures for conducting Corporate Security Reviews (CSR)  state the results of the risk ranking are the primary factor considered  when prioritizing CSRs of pipeline companies.

However, we identified several factors that likely limit the usefulness of  the current assessment in calculating threat, vulnerability, and  consequence to allow the Pipeline Security Branch to effectively prioritize  reviews of pipeline systems. For example, because the risk assessment  has not changed since 2014, information on threat may be outdated.  Additionally, sources of data and underlying assumption and judgments  regarding certain threat and vulnerability inputs to the assessment are not  fully documented. For example, threats to cybersecurity are not  specifically accounted for in the description of the risk assessment  methodology, making it unclear if cybersecurity is part of the  assessment’s threat factor. Further, the risk assessment does not include  information that is consistent with the National Infrastructure Protection  Plan (NIPP) and other Department of Homeland Security (DHS) priorities  for critical infrastructure risk mitigation, such as information on natural  hazards and the ability to measure risk reduction (feedback data).

According to Pipeline Security Branch officials, the risk ranking  assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk. Rather, officials said they are primarily  interested in assessing risk data that impacts security. However, because  TSA’s Pipeline Security Program is designed to enhance the security  preparedness of the pipeline systems, incorporating additional factors that  enhance security into their risk calculation of the most critical pipeline  systems would better align their efforts with Presidential Policy Directive  21 (PPD-21). For example, PPD-21 calls for agencies to integrate and  analyze information to prioritize assets and manage risks to critical  infrastructure, as well as anticipate interdependencies and cascading  impacts.

Below we present the various shortfalls in the risk assessment—outdated  data, limited description of sources and methodology, and opportunities to  better align with the NIPP and other DHS priorities for critical  infrastructure risk mitigation—in the context of the components that  comprise a risk assessment: threat, vulnerability, and consequence.  Whereas in 2010 we made recommendations to improve the  consequence component in the pipeline relative risk ranking tool, we have  currently identified shortfalls that cut across all risk components: threat,  vulnerability, and consequence.

We identified several shortfalls in the pipeline risk assessment’s  calculation of threat. First, while the risk assessment assesses  consequence and vulnerability by pipeline system through use of multiple  variables, it currently ranks threat for pipeline systems equally. Second,  the evolving nature of threats to pipelines may not be reflected, since the  risk assessment was last updated in 2014. Third, the threat calculation  does not take into account natural hazards.

Pipeline Security Branch officials said they currently rank threat equally  across pipeline systems because they do not have granular enough  threat information to distinguish threat by pipeline. However, ranking  threat equally effectively has no effect on the risk calculation for pipeline  systems. Further, this judgment is not documented in the risk  assessment’s methodology. According to the NIPP, a risk assessment’s  methodology must clearly document what information is used and how it  is synthesized to generate a risk estimate, including any assumptions and  judgments. Additionally, our analysis of the pipeline risk assessment  found that it includes at least one field that TSA could use to differentiate  threat by pipeline. Specifically, the risk assessment includes a field that  accounts for whether a pipeline experienced a previous security threat  (including failed attacks), and information provided by Pipeline Security  Branch suggests some pipeline systems have experienced such threats.

However, the Pipeline Security Branch did not capture these events in the  risk assessment’s calculation, which Pipeline Security Branch officials  said should be part of the threat calculation, but could not account for why  they were not calculated for the systems in the risk assessment. These  officials also clarified that incidents such as suspicious photography or  vandalism do not constitute an attack to be accounted for in the threat  calculation. Documenting such assumptions, judgments, or decisions to  exclude information could provide increased transparency to those  expected to interpret or use the results.

Pipeline Security Branch officials also said that they ranked threat equally  because TSA Intelligence and Analysis data show that threats to the oil  and natural gas sector have been historically low, and Intelligence and  Analysis does not conduct specific threat analysis against individual  pipeline systems. However, the Pipeline Security Branch has not updated  the risk assessment since June 2014; therefore, the threat information it  used to determine threat calculations—and decide to rank threat  equally—may be outdated and not reflect the threats to the industry that  have emerged in recent years. In fact, pipeline operators we interviewed  indicated that the types of threats that concern pipeline operators have  evolved. For example, 5 of the 10 operators we interviewed indicated that  environmental activists were an increased threat to the pipeline industry  because they use sabotage techniques, such as valve turning and cutting  in service pipelines with blow torches, against pipelines. Additionally, 6 of  10 pipeline operators we interviewed said cyber attacks from nation-state  actors were a primary threat to their industry. Further, when TSA issued  its revised Pipeline Security Guidelines in March 2018, it stated that its  revisions to the guidelines were made to reflect the ever-changing threat  environment in both the physical and cybersecurity realms. However,  threats to cybersecurity are not specifically accounted for in the  description of the risk assessment methodology. Recent Pipeline Modal  and Cyber Modal Threat Assessments include cyber threats to the  pipeline industry, but the description of the pipeline risk assessment’s  methodology does not specify what types of threat assessments  (sources) are used to calculate its threat score. To better align with the  guidance in the NIPP for documenting sources of information when  conducting risk assessments, the Pipeline Security Branch should  document the information used. Keeping the risk assessment updated  with current information, as well as documenting those data sources,  could help the Pipeline Security Branch ensure it is using its limited  resources to review the pipeline systems with greater risk.

Natural Hazard Threats to Pipelines  The Transportation Systems Sector, of which  pipelines are a part, is critical to the Pacific  Northwest, but also at risk from natural  hazards, like earthquakes. For example,  according to the Department of Homeland  Security, an earthquake in the Puget Sound  region—which relies on the transportation of  crude oil from Alaska—could cripple the ports  of Seattle and Tacoma, as well as the  Olympic and Williams Pipelines greatly  impacting the Pacific Northwest Economic  Region.  Hurricanes are the most frequent disruptive  natural hazard for the oil and natural gas  subsector and can cause the shutdown of  facilities in an area, even when the facilities  themselves are not directly affected by the  storms. For example, according to the U.S.  Energy Information Administration, the flow of  petroleum into the New York area via pipeline  from the Gulf Coast relies on the ability to  move it through major terminals. In August  2017, Hurricane Harvey caused major  disruptions to crude oil and petroleum product  supply chains, including those to New York  Harbor from Houston, Texas via the Colonial  Pipeline. Due to the hurricane, decreased  supplies of petroleum products available for  the pipeline in Houston forced Colonial  Pipeline to limit operations temporarily.

Finally, another shortfall in the current pipeline risk assessment  methodology is that it does not account for natural hazards in its threat  calculation, even though DHS’s definition of threat includes natural  hazards, and security and resilience of critical infrastructure are often  presented in the context of natural hazards. According to the NIPP,  threat is a natural or manmade occurrence, individual, entity, or action  that has or indicates the potential to harm life, information, operations, the  environment, and/or property. As such, along with terrorism, criminal  activity and cybersecurity, natural disasters are a key element of DHS’s  critical infrastructure security and resilience mission.

According to Pipeline Security Branch officials, there is not sufficient  historical data available that would indicate a significant impact from  natural disasters on specific pipeline systems. However, we identified  possible sources of data for the Pipeline Security Branch to consider. For  example, a 2016 RAND Corporation study examined national  infrastructure systems’ exposure to natural hazards, including pipelines.  Additionally, the Federal Emergency Management Agency (FEMA) has  collaborated with stakeholders to develop the National Risk Index to,  among other things, establish a baseline of natural hazards risk for the  United States While there may not be historical data of natural hazard  impact for every pipeline system, consulting other sources or experts  could provide regional data or analysis to build a more comprehensive  threat picture to help distinguish threats by pipeline system. According to  the NIPP, hazard assessments should rely not only on historical  information, but also future predictions about natural hazards to assess  the likelihood or frequency of various hazards.

We also identified multiple shortfalls in the vulnerability factors used in the  risk assessment methodology, such as the potential uncertainty of the  number of critical facilities and incorporating a feedback mechanism to  calculate overall risk reduction. Other considerations for vulnerability  calculations include physical condition of the pipeline system,  cybersecurity activities, and interdependencies among sectors.

The number of critical facilities a pipeline system has identified is used as  an input for its vulnerability calculation in the Pipeline Security Branch’s  risk assessment methodology. As discussed earlier, we identified  deficiencies in TSA’s criteria for identifying critical facilities, and found that  well-defined criteria and consistent application of the criteria for identifying  critical facilities could improve the results of the Pipeline Security  Branch’s risk assessment. Nevertheless, communicating in the risk  assessment the uncertainty that may be inherent in this self-reported  information would better align the risk assessment with the NIPP.

Measuring Effectiveness in a Voluntary  Environment  According to the National Infrastructure  Protection Plan, the use of performance  metrics is an important step in the critical  infrastructure risk management process to  enable assessment of improvements in critical  infrastructure security and resilience. The  metrics provide a basis for the critical  infrastructure community to establish  accountability, document actual performance,  promote effective management, and provide a  feedback mechanism to inform decision  making.  By using metrics to evaluate the effectiveness  of voluntary partnership efforts to achieve  national and sector priorities, critical  infrastructure partners can adjust and adapt  their security and resilience approaches to  account for progress achieved, as well as  changes in the threat and other relevant  environments. Metrics are used to focus  attention on areas of security and resilience  that warrant additional resources or other  changes through an analysis of challenges  and priorities at the national, sector, and  owner/operator levels.  Metrics also serve as a feedback mechanism  for other aspects of the critical infrastructure  risk management approach.

Another shortfall in the risk assessment is its inability to reliably measure  the progress a pipeline system made in addressing vulnerability gaps  between security reviews. The current risk assessment includes a CSR  score as part of its vulnerability calculation, which was developed in part  in response to our 2010 recommendation to use more reliable data to  measure a pipeline system’s vulnerability gap. However, during our  review, Pipeline Security Branch officials said they plan to remove  pipeline companies’ CSR scores from the risk assessment calculations,  because they and industry partners do not have confidence that the score  appropriately measures a pipeline system’s vulnerability. For example,  Pipeline Security Branch officials explained that pipeline companies  consider security factors differently, which can lead to variation in  implementing risk reduction activities and by extension lead to different  CSR scores. However, removing the CSR score eliminates the only  feedback mechanism in the risk assessment from a pipeline company’s  actual security review conducted by the Pipeline Security Branch. The  NIPP and DHS’s Risk Management fundamentals emphasize the  important role that such feedback mechanisms play in risk management.  Officials from the Pipeline Security Branch agree on the importance of a  feedback mechanism tying results of reviews to a revised vulnerability  metric, but said they need a better measure than the current CSR score  which is unreliable for comparative and analytic purposes. Developing a  feedback mechanism based on implementation of TSA’s Pipeline Security  Guidelines could be an important input to the risk assessment’s  vulnerability calculation. This information would also inform the amount of  risk pipeline companies are reducing by implementing the guidelines and  could be used to inform overall risk reduction.

The physical and cyber environments in which the pipeline sector  operates also present vulnerabilities not accounted for in the pipeline risk  assessment. In recent years, DHS has listed the potential for catastrophic  losses to dramatically increase the overall risk associated with failing  infrastructure and highlighted risks due to climate change and natural  hazards to pipelines. For example, DHS reported extreme  temperatures—such as higher and lower temperatures over prolonged  periods of time—increase vulnerability to the critical infrastructure by  causing elements to break and cease to function. Pipelines that freeze  and then rupture can affect the energy and transportation systems  sectors. As noted above, according to the NIPP, a natural or man-made  occurrence or action with the potential to harm life is considered a threat,  whereas vulnerability is defined as a physical feature or operational  attribute that renders an entity open to exploitation or susceptible to a  given threat or hazard. While pipeline physical condition is typically  thought of in context of safety, pipeline condition or location (such as  above or below ground) could touch upon pipeline security as it relates to  system vulnerability. For example, a pipeline system or segment of a  system with a compromised physical condition due to corrosion or age  could affect the system’s vulnerability to threats and affect its ability to  recover from such threats by potentially increasing the time a system is  offline.

According to the Transportation Systems Sector-Specific Plan,  vulnerabilities to damage in aging transportation infrastructure—of which  pipelines are a part—are projected to increase with the continued effects  of climate change. Further, according to TSA’s Pipeline Security and  Incident Recovery Protocol Plan, pipeline integrity efforts—including the  design, construction, operation, and maintenance of pipelines—are  important to pipeline security because well-maintained, safe pipelines are  more likely to tolerate a physical attack. The Pipeline Security Branch  already collects information from the Pipeline and Hazardous Materials  Safety Administration (PHMSA) for its risk assessment, specifically  information on High Consequence Area and High Threat Urban Area  mileage. By considering additional information PHMSA collects on  pipeline integrity, the Pipeline Security Branch could also use the  information to help pipeline operators identify security measures to help  reduce the consequences related to the comparatively higher vulnerability  of an aging or compromised system. This would align with the Pipeline  Security Branch’s efforts to improve security preparedness of pipeline  systems and could better inform its vulnerability calculations for relative  risk ranking of pipeline systems.

Capturing cybersecurity in the risk assessment is also an area for  improvement. Pipeline Security Branch officials told us they consulted  with the National Cybersecurity and Communications Integration Center  to revise TSA’s Pipeline Security Guidelines to align with the National  Institute of Standards and Technology (NIST) Cybersecurity Framework  and that absent data specific to pipelines on their cybersecurity  vulnerabilities, they are unable to include a pipelines’ vulnerability to  cyber attack in the risk assessment. However, the Pipeline Security  Branch recently updated the security review questions asked of pipeline  operators during corporate and critical facility reviews based on the  recently updated Pipeline Security Guidelines. Using these updated  questions related to companies’ cybersecurity posture, the Pipeline  Security Branch could collect additional information on cybersecurity  vulnerabilities which could inform the risk assessment. This could be an  element of the feedback mechanism described above and emphasized in  the NIPP. Additionally, NIST identified several supply chain vulnerabilities  associated with cybersecurity, which are not currently accounted for in  TSA’s Pipeline Security Guidelines. As pipeline operators implement increasing levels of network technologies to control their systems, the  Pipeline Security Branch may not be fully accounting for pipeline systems’  cybersecurity posture by not including the cybersecurity-related  vulnerabilities in its risk assessment inputs.

Finally, we identified shortfalls in cross-sector interdependencies, which  could affect vulnerability calculations. According to the NIPP,  understanding and addressing risks from cross-sector dependencies and  interdependencies is essential to enhancing critical infrastructure security  and resilience. The Pipeline Security Branch’s pipeline risk assessment  currently considers the effects of a pipeline system’s ability to service  assets such as major airports, the electric grid, and military bases.  However, consequence is calculated on the loss or disruption of the  pipeline system to these other assets and does not capture the  dependency of the pipeline system on other energy sources, such as  electricity. Weather events such as Gulf of Mexico hurricanes and  Superstorm Sandy highlighted the interdependencies between the  pipeline and electrical sectors. Specifically, according to a 2015 DHS  annual report on critical infrastructure, power failures during Superstorm  Sandy in 2012 closed major pipelines for 4 days, reducing regional oil  supplies by 35 to 40 percent. The report goes on to say that the  interconnected nature of infrastructure systems can lead to cascading  impacts and are increasing in frequency. Pipeline Security Branch  officials are considering cross-sector interdependencies and said they  discuss these factors with operators as they relate to system resiliency.  Considering interdependencies of sectors in both directions—such as  calculating the likelihood that an input like electricity could fail and cause  disruptions to critical pipelines—could improve the calculations in the  pipeline risk assessment.

As previously discussed, the Pipeline Security Branch last calculated  relative risk among the top 100 pipeline systems in 2014. When doing so,  it used pipeline systems’ throughput data from 2010 to assess relative  risk. According to Pipeline Security Branch officials, the amount of  throughput in pipeline systems does not change substantially year to  year. However, Standards for Internal Control in the Federal Government  calls for management to use quality information to achieve the entity’s  objectives, including using relevant data from reliable sources obtained in  a timely manner. The Pipeline Security Branch uses throughput data as a  consequence factor in the risk assessment to determine a pipeline  system’s relative risk score. Throughput changes could affect relative  risk ranking and the Pipeline Security Branch’s ability to accurately  prioritize reviews based on relative risk.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

Chris P. Currie at (404) 679-1875 or curriec@gao.gov    Nick Marinos at (202) 512-9342 or marinosn@gao.gov.

In addition to the contacts named above, Ben Atwater, Assistant Director;  Michael W. Gilmore, Assistant Director; and Michael C. Lenington,  Analyst-in-Charge, managed this assignment. Chuck Bausell, David  Blanding, Dominick Dale, Eric Hauswirth, Kenneth A. Johnson, Steve  Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and  Janay Sam made significant contributions to this report.

The nation depends on the interstate pipeline system to deliver oil, natural gas, and more. This increasingly computerized system is an attractive target for hackers and terrorists. (Protection of cyber critical infrastructure is on our High Risk List.)

We found weaknesses in how TSA manages its pipeline security efforts. For example, it has no process for determining when to update its guidelines for pipeline operators. Also, its method for assessing risks needs updating.

We made 10 recommendations, including establishing better processes for updating guidelines and assessing risks.