This section of the FEDERAL REGISTER

contains regulatory documents having general

applicability and legal effect, most of which

are keyed to and codified in the Code of

Federal Regulations, which is published under

50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by

the Superintendent of Documents.

Rules and Regulations Federal Register

5491 

Vol. 90, No. 11 

Friday, January 17, 2025 

1Annual Threat Assessment of the U.S. 

Intelligence Community, Office of the Director of 

National Intelligence (2024 Intelligence Community 

Assessment), 11, 16 (dated Feb. 5, 2024) (last 

accessed July 23, 2024, at https://www.dni.gov/files/ 

ODNI/documents/assessments/ATA-2024- 

Unclassified-Report.pdf). 

2These activities include the January 2023 breach 

of the Washington Metropolitan Area Transit 

Authority; the January 2023 breach of San 

Francisco’s Bay Area Rapid Transit System; and the 

April 2021 breach of New York City’s Metropolitan 

Transportation Authority (the nation’s largest mass 

transit agency) by hackers linked to the Chinese 

government. This threat is ongoing: on February 7, 

2024, CISA published an advisory warning of the 

threat posed by PRC state-sponsored actors. See 

Cybersecurity Advisory (AA24–038A), PRC StateSponsored Actors Compromise and Maintain 

Persistent Access to U.S. Critical Infrastructure. 

3Alert (AA22–040A), 2021 Trends Show 

Increased Globalized Threat of Ransomware, 

released by CISA on February 10, 2022 (as revised). 

4 Joint Cybersecurity Alert—Alert (AA22–110A), 

Russian State-Sponsored and Criminal Cyber 

Threats to Critical Infrastructure, released 

cybersecurity authorities of the United States, 

Australia, Canada, New Zealand, and the United 

Kingdom on April 20, 2022 (as revised). 

5Annual Threat Assessment of the U.S. 

Intelligence Community, Office of the Director of 

National Intelligence (2023) (2023 Intelligence 

Community Assessment), 10 (dated February 6, 

2023) (last accessed July 23 2024, at https://

www.dni.gov/files/ODNI/documents/assessments/ 

ATA-2023-Unclassified-Report.pdf. 

6 2024 Intelligence Community Assessment at 11. 

7 2024 Intelligence Community Assessment at 16, 

20. 

8 DHS Intelligence and Analysis (I&A), Homeland 

Threat Assessment (2024) at 18 (last accessed July 

23, 2024, at https://www.dhs.gov/sites/default/files/ 

2023-09/23_0913_ia_23-333-ia_u_homeland-threatassessment-2024_508C_V6_13Sep23.pdf). 

DEPARTMENT OF HOMELAND 

SECURITY 

6 CFR Chapter I 

49 CFR Chapter XII 

Ratification of Security Directives 

AGENCY: Office of Strategy, Policy, and 

Plans, Department of Homeland 

Security (DHS). 

ACTION: Notice of ratification of security 

directives. 

SUMMARY: The Department of Homeland 

Security (DHS) is publishing official 

notice that the Transportation Security 

Oversight Board (TSOB) ratified 

Transportation Security Administration 

(TSA) Security Directive Pipeline-2021– 

01D and Security Directive Pipeline2021–02E, applicable to owners and 

operators of critical hazardous liquid 

and natural gas pipeline infrastructure 

(owner/operators). Security Directive 

Pipeline-2021–01D, issued on May 29, 

2024, extended the requirements of the 

Security Directive Pipeline-2021–01 

series for an additional year, with minor 

revisions. Security Directive Pipeline2021–02E, issued on July 26, 2024, 

extended the requirements of the 

Security Directive Pipeline-2021–02 

series for an additional year, with 

amendments to strengthen their 

effectiveness and provide additional 

clarity. 

DATES: The TSOB ratified Security 

Directive Pipeline-2021–01D on June 28, 

2024 and Security Directive Pipeline2021–02E on August 23, 2024. 

FOR FURTHER INFORMATION CONTACT: 

Thomas McDermott, Deputy Assistant 

Secretary for Cyber, Infrastructure, Risk 

and Resilience Policy, at 202–834–5803 

or thomas.mcdermott@hq.dhs.gov. 

SUPPLEMENTARY INFORMATION: 

I. Background 

A. Cybersecurity Threat 

The cyber threat to the country’s 

critical infrastructure has only increased 

in the time since TSA issued its initial 

cybersecurity-related security directives 

to pipeline entities in 2021 in response 

to the Colonial Pipeline incident. Cyber 

threats to surface transportation 

systems, including hazardous liquid and 

natural gas pipelines and facilities, 

continue to proliferate, as both nationstates and criminal cyber groups target 

critical infrastructure in order to cause 

operational disruption and economic 

harm.1 In addition to the Colonial 

Pipeline incident, cyber attackers have 

maliciously targeted surface 

transportation modes in the United 

States, including freight railroads, 

passenger railroads, and rail transit 

systems, with multiple cyberattack and 

cyber espionage campaigns.2 Cyber 

incidents, particularly ransomware 

attacks, are likely to increase in the near 

and long term, due in part to 

vulnerabilities identified by threat 

actors in U.S. networks.3 Especially in 

light of the ongoing Russia-Ukraine 

conflict,4 these threats remain elevated 

and pose a risk to the national and 

economic security of the United States. 

In its 2023 annual assessment, the 

Intelligence Community noted that 

‘‘China almost certainly is capable of 

launching cyber attacks that could 

disrupt critical infrastructure services 

within the United States, including 

against oil and gas pipelines, and rail 

systems.’’ 5 And the 2024 annual 

assessment notes that, ‘‘[i]f Beijing 

believed that a major conflict with the 

United States were imminent, it would 

consider aggressive cyber operations 

against U.S. critical infrastructure and 

military assets. Such a strike would be 

designed to deter U.S. military action by 

impeding U.S. decision-making, 

inducing societal panic, and interfering 

with the deployment of U.S. forces.’’ 6

In addition, ‘‘Russia maintains its ability 

to target critical infrastructure . . . in 

the United States as well as in allied and 

partner countries’’ and ‘‘Tehran’s 

opportunistic approach to cyber-attacks 

puts U.S. infrastructure at risk for being 

targeted.’’ 7 Furthermore, ‘‘malicious 

cyber actors have begun testing the 

capabilities of AI-developed malware 

and AI-assisted software development— 

technologies that have the potential to 

enable larger scale, faster, efficient, and 

more evasive cyber-attacks—against 

targets, including pipelines, railways, 

and other U.S. critical infrastructure.’’ 8

B. Regulatory History 

Following the Colonial Pipeline 

incident in May 2021, TSA issued two 

security directives requiring owners and 

operators of critical hazardous liquid 

and natural gas pipelines or liquefied 

natural gas facilities (owner/operators) 

to implement cybersecurity measures 

necessary to prevent disruption and 

degradation to their critical 

infrastructure. On May 27, 2021, TSA 

issued the first directive (Security 

Directive Pipeline-2021–01), which 

required covered owner/operators to: (1) 

report cybersecurity incidents to CISA; 

(2) designate a cybersecurity coordinator 

to be available 24/7 to coordinate with 

TSA and CISA; and (3) conduct a 

vulnerability assessment of 

cybersecurity practices, identify any 


KHAMMOND on DSK9W7S144PROD with RULES
5492 Federal Register / Vol. 90, No. 11 / Friday, January 17, 2025 / Rules and Regulations 

9TSA Surface Transportation Cybersecurity 

Toolkit, available at https://www.tsa.gov/forindustry/surface-transportation-cybersecuritytoolkit. 

10Security Directive Pipeline-2021–01B also 

extended the deadline by which cybersecurity 

incidents must be reported to CISA from 12 hours 

to 24 hours after an incident is identified. This 

change aligned the reporting timeline for critical 

pipeline entities to mirror the reporting 

requirements applicable to other surface 

transportation entities and aviation entities. 

gaps, and develop a plan and timeline 

for remediation. TSA issued the second 

directive (Security Directive Pipeline2021–02) on July 19, 2021, which 

required owner/operators to implement 

additional specific cybersecurity 

measures to prevent disruption and 

degradation to their infrastructure. 

Due to the continuing cyber threat to 

pipeline infrastructure, the 

requirements of both Security Directive 

Pipeline-2021–01 and Security Directive 

Pipeline-2021–02 have been renewed 

and extended beyond their original 

expiration dates by subsequent 

directives, creating two security 

directive ‘‘series’’ (the Security Directive 

Pipeline-2021–01 series and the 

Security Directive Pipeline-2021–02 

series). In several instances, as TSA 

renewed each of these security directive 

series, TSA also amended their 

requirements to strengthen their 

effectiveness and address emerging 

cyber threats. Most significantly, TSA 

transitioned the requirements of the 

Security Directive Pipeline-2021–02 

series to be more performance-based 

and less prescriptive. The performancebased approach enhances security by 

mandating that critical security 

outcomes are achieved while allowing 

owner/operators to choose the most 

appropriate security measures for their 

specific systems and operations. Under 

the performance-based framework of the 

Security Directive Pipeline-2021–02 

series, TSA identified critical security 

outcomes that covered parties must 

achieve. To ensure that these outcomes 

are met, the directives in this series now 

require owner/operators to: 

• Establish and implement a TSAapproved Cybersecurity Implementation 

Plan (CIP) that describes the specific 

cybersecurity measures employed and 

the schedule for achieving the security 

outcomes identified; 

• Develop and maintain an up-to-date 

Cybersecurity Incident Response Plan 

(CIRP) to reduce the risk of operational 

disruption, or the risk of other 

significant impacts on business critical 

functions, as defined in the directive, 

should the Information and/or 

Operational Technology systems of a gas 

or liquid pipeline be affected by a 

cybersecurity incident; and 

• Establish a Cybersecurity 

Assessment Program (CAP) and submit 

an annual plan that describes how the 

owner/operator will proactively and 

regularly assess the effectiveness of 

cybersecurity measures and identify and 

resolve device, network, and/or system 

vulnerabilities. 

The table below provides a list of each 

the security directives issued within the 

Security Directive Pipeline-2021–01 and 

Security Directive Pipeline-2021–02 

series. All of the security directives in 

both series are available online in TSA’s 

Surface Transportation Cybersecurity 

Toolkit.9

TABLE 1—TSA SECURITY DIRECTIVES APPLICABLE TO CRITICAL PIPELINE SYSTEMS

Security directive Date issued Effective date Date ratified by TSOB Set expiration date Federal Register citation of ratification 

Pipeline-2021–01 ....... May 27, 2021 ............ May 28, 2021 ............ July 3, 2021 .............. May 28, 2022 ............ 86 FR 38209. 

Pipeline-2021–01A ..... Dec. 2, 2021 ............. Dec. 2, 2021 ............. Dec. 29, 2021 ........... May 28, 2022 ............ 87 FR 31093. 

Pipeline-2021–01B ..... May 27, 2022 ............ May 29, 2022 ............ June 24, 2021 ........... May 29, 2023. ........... 88 FR 36919.10

Pipeline-2021–01C ..... May 22, 2023 ............ May 29, 2023 ............ June 21, 2023 ........... May 29, 2024 ............ 89 FR 28570. 

Pipeline-2021–01D ..... May 29, 2024 ............ May 29, 2024 ............ June 28, 2024 ........... May 29, 2025 ............ *Current.

Pipeline-2021–02 ....... Jul. 19, 2021 ............. Jul. 26, 2021 ............. Aug. 17, 2021 ........... Jul. 26, 2022 ............. 86 FR 52953. 

Pipeline-2021–02B ..... Dec. 17, 2021 ........... Dec. 17, 2021 ........... Jan. 13, 2022 ............ Jul. 26, 2022 ............. 87 FR 31093. 

Pipeline-2021–02C ..... Jul. 21, 2022 ............. Jul. 27, 2022 ............. Aug. 19, 2022 ........... Jul. 27, 2023 ............. 88 FR 36919. 

Pipeline-2021–02D ..... Jul. 26, 2023 ............. Jul. 27, 2023 ............. Aug. 24, 2023 ........... Jul. 27, 2024 ............. 89 FR 28570. 

Pipeline-2021–02E ..... Jul. 26, 2024 ............. Jul. 27, 2024 ............. Aug. 23, 2024 ........... Jul. 27, 2025 ............. *Current. 

C. Security Directive Pipeline-2021–01D 

In light of the continuing threat, TSA 

determined that the cybersecurity 

measures required by the Security 

Directive Pipeline-2021–01 series, as 

amended and extended, remain 

necessary to protect the Nation’s critical 

pipeline infrastructure beyond Security 

Directive Pipeline-2021–01C’s 

expiration date of May 29, 2024. On 

May 29, 2024, TSA issued Security 

Directive Pipeline-2021–01D to extend 

the requirements of Security Directive 

Pipeline-2021–01 series for an 

additional year. Security Directive 

Pipeline-2021–01D became effective 

May 29, 2024, and expires on May 29, 

2025. Security Directive Pipeline-2021– 

01D contains minor revisions refining 

existing requirements to clarify 

applicability, compliance timelines, and 

reporting requirements, as well as 

updated definitions to ensure 

standardization across TSA’s 

cybersecurity requirements applicable 

to different transportation modes. 

D. Security Directive Pipeline-2021–02E 

Considering the continuing threat, 

TSA also determined that the measures 

required by the Security Directive 

Pipeline-2021–02 series, as amended 

and extended, remain necessary to 

protect the Nation’s critical pipeline 

infrastructure beyond Security Directive 

Pipeline-2021–02D’s expiration date of 

July 27, 2024. On July 26, 2024, TSA 

issued Security Directive Pipeline2021–02E to extend the requirements of 

Security Directive Pipeline-2021–02 

series for an additional year. Security 

Directive Pipeline-2021–02E became 

effective July 27, 2024, and expires on 

July 27, 2025. 

In addition to extending the existing 

requirements, Security Directive 

Pipeline-2022–02E contains several 

amendments to strengthen the 

effectiveness of certain requirements 

and provide further clarity. The 

revisions include new and modified 

definitions clarifying certain terms and 

harmonizing terminology across TSA’s 

cybersecurity requirements applicable 

to different transportation modes; 

clarifying when responsibility for 

compliance with the directive’s 

requirements is shared between an 

owner/operator and a third party; and 

clarifying requirements regarding 

submission of CAP and related annual 

reports. 

II. TSOB Ratification 

TSA has broad statutory 

responsibility and authority to safeguard 


KHAMMOND on DSK9W7S144PROD with RULES
Federal Register / Vol. 90, No. 11 / Friday, January 17, 2025 / Rules and Regulations 5493 

11See, e.g., 49 U.S.C. 114(d), (f), (l), (m). 

12See, e.g., 49 U.S.C. 115; 49 U.S.C. 114(l)(2)(B). 

13 49 U.S.C. 114(l)(2)(B). 

14The Secretary of Homeland Security serves as 

the TSOB Chairperson, 49 U.S.C. 115(b)(2), and has 

further delegated that responsibility to the Deputy 

Secretary of Homeland Secretary. DHS Delegation 

No. 7071.1. 

1More information on ELAP is available at 

https://www.fsa.usda.gov/programs-and-services/ 

disaster-assistance-program/emergency-assist-forlivestock-honey-bees-fish/index. 

2More information on LFP is available at https:// 

www.fsa.usda.gov/programs-and-services/disasterassistance-program/livestock-forage/index. 

3More information about LIP is available at 

https://www.fsa.usda.gov/programs-and-services/ 

disaster-assistance-program/livestock-indemnity/ 

index. 

4See 7 CFR 1416.107(a). 

5See 7 CFR 1416.305(b). 

the nation’s transportation system.11

The TSOB—a body consisting of the 

Secretary of Homeland Security, the 

Secretary of Transportation, the 

Attorney General, the Secretary of 

Defense, the Secretary of the Treasury, 

the Director of National Intelligence, or 

their designees, and a representative of 

the National Security Council—reviews 

certain TSA regulations and security 

directives as consistent with law.12 TSA 

issued Security Directive Pipeline2021–01D and Security Directive 

Pipeline-2021–02E under 49 U.S.C. 

114(l)(2)(A), which authorizes TSA to 

issue emergency regulations or security 

directives without providing notice or 

the opportunity for public comment 

where ‘‘the Administrator determines 

that a regulation or security directive 

must be issued immediately in order to 

protect transportation security . . . .’’ 

Security directives issued pursuant to 

the procedures in 49 U.S.C. 114(l)(2) 

‘‘shall remain effective for a period not 

to exceed 90 days unless ratified or 

disapproved by the Board or rescinded 

by the Administrator.’’ 13

Following the issuance of Security 

Directive Pipeline-2021–01D on May 29, 

2024, and Security Directive Pipeline2021–02E on July 26, 2024, the chair of 

the TSOB convened the board to review 

the directives.14 In reviewing each 

Security Directive, the TSOB reviewed 

the required measures extended and 

amended by the directives and the 

continuing need for TSA to maintain 

these requirements pursuant to its 

emergency authority under 49 U.S.C. 

114(1)(2) to prevent the disruption and 

degradation of the country’s critical 

transportation infrastructure. The TSOB 

also considered whether to authorize 

TSA to extend each security directive 

beyond their current expiration dates 

subject to certain conditions, should the 

TSA Administrator believe such an 

extension is necessary to address the 

evolving threat that may continue 

beyond the original expiration date. 

Following its review, the TSOB 

ratified Security Directive Pipeline2021–01D on June 28, 2024, and 

Security Directive Pipeline-2021–02E on 

August 23, 2024. The TSOB also 

authorized TSA to extend each of the 

security directives beyond their current 

expiration dates, should the TSA 

Administrator determine such an 

extension is necessary to address the 

evolving threat that may continue 

beyond the original expiration date. 

Such an extension is subject to the 

following conditions: (1) there are no 

changes to the security directive other 

than an extended expiration date; (2) the 

TSA Administrator makes an affirmative 

determination that conditions warrant 

the extension of the directive’s 

requirements; and (3) the TSA 

Administrator documents such a 

determination and notifies the TSOB. 

Kristie Canegallo, 

Senior Official Performing the Duties of the 

Deputy Secretary of Homeland Security & 

Chairman of the Transportation Security 

Oversight Board. 

[FR Doc. 2025–01243 Filed 1–15–25; 11:15 am] 

BILLING CODE 9110–9M–P 

DEPARTMENT OF AGRICULTURE 

Commodity Credit Corporation 

7 CFR Part 1416 

[Docket ID: CCC–2024–0003] 

RIN 0560–AI68 

Supplemental Agricultural Assistance 

Programs 

AGENCY: Commodity Credit Corporation 

(CCC) and Farm Service Agency (FSA), 

Department of Agriculture (USDA). 

ACTION: Final rule. 

SUMMARY: This rule makes discretionary 

changes to simplify and streamline 

deadlines for the Emergency Assistance 

for Livestock, Honeybees, and FarmRaised Fish Program (ELAP), the 

Livestock Forage Disaster Program 

(LFP), and the Livestock Indemnity 

Program (LIP). It also makes changes to 

clarify ELAP provisions for assistance 

for transportation of livestock feed. 

DATES: Effective January 17, 2025. 

FOR FURTHER INFORMATION CONTACT: For 

ELAP: Seth Cross; telephone: (402) 309– 

3338; email: seth.cross@usda.gov. For 

LFP and LIP: Kelly Breinig; telephone: 

(202) 720–1603; email: kelly.breinig@

usda.gov. Individuals who require 

alternative means for communication 

should contact the USDA Target Center 

at (202) 720–2600 (voice and text 

telephone (TTY)) or dial 711 for 

Telecommunications Relay service (both 

voice and text telephone users can 

initiate this call from any telephone). 

SUPPLEMENTARY INFORMATION: 

Background 

ELAP, LFP, and LIP use CCC funds to 

provide emergency relief to eligible 

producers (7 U.S.C. 9081). FSA 

administers ELAP, LFP and LIP on 

behalf of CCC. ELAP provides assistance 

to producers of livestock, honeybees, 

and farm-raised fish to aid in the 

reduction of losses due to disease, 

adverse weather, or other conditions, 

such as blizzards and wildfires, as 

determined by the Secretary, that are 

not covered by LIP or LFP.1 LFP 

provides assistance to livestock 

producers who suffer eligible grazing 

losses on land physically located in a 

county experiencing a qualifying 

drought during the normal grazing 

period for the county or are prohibited 

by a Federal agency from grazing the 

normal permitted livestock on managed 

rangeland due to a qualifying fire.2 LIP 

provides assistance for livestock deaths 

in excess of normal mortality caused by 

adverse weather or by attacks by 

animals reintroduced into the wild by 

the Federal Government.3

This rule makes discretionary changes 

to simplify and streamline the deadlines 

for ELAP, LFP, and LIP. It also makes 

discretionary changes to the ELAP 

regulations for assistance for 

transportation of livestock feed. 

Deadlines for ELAP, LFP, and LIP 

This rule amends the regulations for 

ELAP, LFP, and LIP to have a single 

deadline across all three programs for 

filing a notice of loss (required for 

ELAP 4 and LIP 5), an application for 

payment, and other required 

documentation. Previously, each of the 

three programs had multiple deadlines 

and time frames for submitting required 

forms and documentation, and those 

deadlines also varied among the three 

programs. These changes are intended 

to improve efficiencies for producers 

and FSA staff, provide clarity regarding 

program timelines, and give FSA staff 

sufficient time to deliver support to 

producers who have suffered eligible 

losses due to disaster events. 

This rule changes the deadlines in 

§§ 1416.107, 1416.202, and 1416.305 to 

specify that the deadline to file a notice 

of loss, an application for payment, and 

required documentation for each 

program is March 1 following the end of 

the applicable program year, which is 

based on the calendar year for the three 


KHAMMOND on DSK9W7S144PROD with RULES