The American Petroleum Institute (API) has published its 3rd Edition of Standard (Std) 1164, Pipeline Control Systems Cybersecurity, underscoring the natural gas and oil industry’s ongoing commitment to protecting the US’ critical infrastructure from malicious and potentially disruptive cyber-attacks.
In development since 2017, the 3rd edition is a result of expert input from more than 70 organizations, including state and federal regulators within FERC, TSA, PHMSA, CISA, DoE, NIST, as well as Argonne National Laboratory, the American Gas Association (AGA), Interstate National Gas Association of America (INGAA), the Association of Oil Pipe Lines (AOPL) and numerous pipeline operators.
It is based on the NIST (National Institute of Standards and Technology) Cybersecurity Framework and NERC-CIP (Critical Infrastructure Protection) standards and significantly expands the scope compared to the previous edition of the standard to cover all control system cybersecurity instead of solely supervisory control and data acquisition (SCADA) systems.
“The new edition API Std 1164 builds on our industry’s long history of engaging and collaborating with the federal government to protect the nation’s vast network of pipelines and other critical energy infrastructure from cyber-attacks,” API senior vice president of API Global Industry Services (GIS), Debra Phillips, said.
She added: “This standard will help protect the nation’s critical pipeline infrastructure by enhancing safeguards for both digital and operational control systems, improving safety and preventing disruptions along the entire pipeline supply chain. What sets this framework apart is its adaptive risk assessment model that provides operators with an appropriate degree of flexibility to proactively mitigate against the rapidly evolving cyber threat matrix.”
“This premier standard helps the operator manage cyber-risks associated with control system cybersecurity environments by providing requirements and guidance for proper isolation of control system environments from non-control system environments,” added AGA senior vice president for safety, operations and security, Christina Sames.
API 780: provides tools to conduct effective security risk assessments, which are used to identify threats to facilities as well as countermeasures to those threats. Last October, API 780 was certified as an anti-terrorism technology by the US Department of Homeland Security (DHS) under the Support Anti-terrorism by Fostering Effective Technologies Act of 2002. This provides liability protection if API members and others using API 780 have a terrorist attack at one of their facilities.
Recommended Practice 1173: Pipeline Safety Management Systems provides pipeline operators with safety management system requirements that when applied provide a framework to reveal and manage risk, promote a learning environment, and continuously improve pipeline safety and integrity.
For more information visit www.api.org