Sponsors (3)
The bill strengthens pipeline cybersecurity and federal oversight—reducing risk of cyberattacks and service disruptions—at the cost of higher compliance and federal spending, possible short-term service interruptions, and concerns over sharing sensitive operational data.
Pipeline operators, transportation workers, and the public will face lower risk of cyberattacks and related service disruptions because the bill requires NIST-aligned cybersecurity guidance plus regular risk rankings and inspections that strengthen protection of pipeline systems.
Congress, federal overseers, and the public gain clearer visibility and accountability for pipeline security through biennial reports and a GAO review, and TSA will expand cybersecurity expertise via a personnel strategy to improve federal capacity to prevent and respond to incidents.
Pipeline operators will face higher compliance costs to meet new TSA directives, inspections, and required security improvements, costs that can be passed along to consumers or absorbed by companies.
Stricter security rules and inspections could force short-term service interruptions or project delays when remediation is required, disrupting transportation and service in affected areas (notably rural communities).
Expanding TSA responsibilities and staffing to deliver the required cybersecurity roles will likely increase federal spending, imposing additional costs on taxpayers.
Based on analysis of 2 sections of legislative text.
Assigns TSA lead responsibility for pipeline cybersecurity and security, requiring NIST-aligned guidance, inspections, information-sharing, reporting, and a personnel strategy.
Introduced August 29, 2025 by Julie Johnson · Last progress August 29, 2025
Assigns the Transportation Security Administration (TSA) primary responsibility for securing pipeline transportation and pipeline facilities against cybersecurity threats, terrorism, and other security risks, working with CISA as appropriate. It directs TSA to develop NIST-aligned guidance, issue security directives or regulations, share threat information, inspect and assess owner/operator implementation, rank security risks, convene industry engagement, report biennially to Congress, and deliver a personnel strategy within 180 days; GAO must review implementation within two years.