Pipeline transportation and pipeline facilities security responsibilities

(a)

In general

Subtitle D of title XV of the Implementing Recommendations of the 9/11 Commission Act of 2007 (6 U.S.C. 1201 et seq.) is amended by adding at the end the following new section:

1559.

Pipeline security

(a)

In general

The Administrator of the Transportation Security Administration shall maintain responsibility, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department, as appropriate, for securing pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code) against cybersecurity threats (as such term is defined in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650)), acts of terrorism (as such term is defined in section 3077 of title 18, United States Code), and other security threats. (b)

Guidelines, directives, and regulations

In carrying out subsection (a), the Administrator of the Transportation Security Administration shall carry out the following: (1)Ensure the development and updating, in consultation with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, of guidelines, consistent with the National Institute of Standards and Technology Framework for Improvement of Critical Infrastructure Cybersecurity (and any update to such Framework) pursuant to section 2(c)(15) of the National Institute for Standards and Technology Act (15 U.S.C. 272(c)(15)), to improve the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. (2)Promulgate any additional security directives or regulations as the Administrator determines necessary to secure pipeline transportation or pipeline facilities. (3)Share, as appropriate, with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, the guidelines described in paragraph (1), security directives, and regulations and, as appropriate, intelligence and information, regarding cybersecurity threats, acts of terrorism, and other security threats to pipeline transportation and pipeline facilities. (4)Assess and inspect, as appropriate, the implementation of such guidelines, security directives, and regulations, including the security policies, plans, practices, and training programs maintained by owners and operators of pipeline transportation and pipeline facilities, to provide recommendations or requirements for the improvement of the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. (5)Identify and rank the relative security risks to pipeline transportation and pipeline facilities. (6)Inspect pipeline transportation and pipeline facilities, including such transportation or facilities, as the case may be, designated as critical by owners and operators of such transportation or facilities based on such guidelines, security directives, or regulations. (c)

Stakeholder engagement

Not later than one year after the date of the enactment of this subsection, the Administrator of the Transportation Security Administration shall convene at least one industry day to engage with relevant pipeline transportation and pipeline facilities stakeholders on matters related to the security of pipeline transportation and pipeline facilities.

(b)

Oversight

The Administrator of the Transportation Security Administration shall report to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation and the Committee on Homeland Security and Governmental Affairs of the Senate not less frequently than biennially on activities of the Administration to carry out responsibilities to secure pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code), pursuant to section 1559 of the Implementing Recommendations of the 9/11 Commission Act of 2007, as added by subsection (a). (c)

Personnel strategy

(1)

In general

Not later than 180 days after the date of the enactment of this Act, the Administrator of the Transportation Security Administration, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, as appropriate, shall develop a personnel strategy (in this subsection referred to as the strategy) for carrying out the Administrator’s responsibilities to secure pipeline transportation and pipeline facilities, pursuant to section 1559 of the Implementing Recommendations of the 9/11 Commission Act of 2007, as added by subsection (a). (2)

Contents

The strategy may take into consideration the most recently published versions of each of the following documents: (A)The Transportation Security Administration National Strategy for Transportation Security. (B)The Department of Homeland Security Cybersecurity Strategy. (C)The Transportation Security Administration Cybersecurity Roadmap. (D)The Department of Homeland Security Balanced Workforce Strategy. (E)The Department of Homeland Security Quadrennial Homeland Security Review. (F)Other relevant strategies or plans, as appropriate. (3)

Cybersecurity expertise

The strategy shall include the following: (A)An assessment of the cybersecurity expertise determined necessary by the Administrator of the Transportation Security Administration to secure pipeline transportation and pipeline facilities. (B)A plan for expanding such expertise within the Transportation Security Administration. (4)

Resources

The strategy shall include an assessment of resources determined necessary by the Administrator of the Transportation Security Administration to carry out such strategy. (5)

Submission to Congress

Upon development of the strategy, the Administrator of the Transportation Security Administration shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation and the Committee on Homeland Security and Governmental Affairs of the Senate a copy of such strategy. (d)

GAO review

Not later than two years after the date of the enactment of this Act, the Comptroller General of the United States shall conduct a review of the implementation of this Act. (e)

Clerical amendment

The table of contents in section 1(b) of the Implementing Recommendations of the 9/11 Commission Act of 2007 is amended by inserting after the item relating to section 1558 the following new item:

Sec. 1559. Pipeline security.