Twelve hours to report: the pipeline directive that set the clock for everyone

The week

On May 27, 2021, the Department of Homeland Security announced that the Transportation Security Administration had issued Security Directive Pipeline-2021-01, its first mandatory cybersecurity requirement for the pipeline sector, which until then had relied on voluntary guidelines. Issued less than three weeks after the ransomware attack that shut down Colonial Pipeline, the directive required owners and operators of critical pipelines to report confirmed and potential cybersecurity incidents to CISA within 12 hours, to designate a cybersecurity coordinator available around the clock, and to review their practices against TSA’s pipeline security guidelines, identifying gaps and remediation measures and reporting the results within 30 days. A second directive in July 2021 added specific mitigation requirements.

The directive was narrow, applying only to operators TSA designated as critical. Its significance was what it started: a regulator answering a serious incident with short, fixed obligations instead of new guidance. Over the next two years the pattern spread across sectors. The directive is best read through its three components. Each became a template, and each demands a different internal capability, whether you write such rules or must answer to several of them: the clock, the coordinator, and the gap assessment.

The clock: short deadlines and an unclear start

Twelve hours is very short. In the first hours of an incident, an organization often does not know whether an event is malicious, how far it has spread, or what has been affected. The directive covered potential incidents too, so operators had to report before they had answers. That was a deliberate choice: the government valued early warning over accurate detail.

Every reporting rule raises the question of when the clock starts. Is it when an alert fires, when an analyst confirms suspicious activity, or when leadership is told? Without written definitions, the clock either starts too late, risking non-compliance, or the organization over-reports, flooding the regulator with noise and its own executives with false alarms. A workable definition ties the start to a specific event, such as a security analyst confirming malicious activity on a covered system, and names who may make that confirmation.

The template spread quickly, each version with its own trigger. In November 2021, the federal banking agencies finalized a 36-hour notice rule. Banking organizations must tell their primary federal regulator within 36 hours of determining that a significant computer-security incident has occurred, with compliance from May 2022. In March 2022, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act, directing CISA to require reports of substantial incidents within 72 hours and ransom payments within 24 hours. In July 2023, the SEC required public companies to disclose material cybersecurity incidents within four business days of determining materiality. New York’s Department of Financial Services already required 72-hour notice and later added a 24-hour rule for extortion payments. HIPAA breach notification works on a different logic altogether, with a 60-day outer limit.

A bank holding company with a public listing, a New York license and an insurance subsidiary could face several clocks for one event, each starting at a different moment and going to a different recipient. Separate procedures for each rule fail under pressure. What works is a single incident classification step that evaluates every applicable rule at once, supported by a register of obligations listing each trigger, deadline, threshold and recipient.

The coordinator: a named person, always reachable

The requirement to designate a cybersecurity coordinator available at all times looks administrative. It answered a real problem. During a crisis, government agencies need to know whom to call, and that person needs the authority and knowledge to answer. Many organizations had security leaders but no primary and backup contact registered with government, and no arrangement for nights and holidays. Colonial itself had been hit on a Friday.

Internally, the coordinator is the natural owner of the reporting decision, the person with authority to start the clock. Making that work requires pre-agreed escalation paths to legal, communications and executive leadership, and a decision log that records when each threshold was assessed, by whom and on what facts. Regulators reviewing a late report later will ask exactly those questions, and a contemporaneous log answers them better than recollection.

Templates help too. Each recipient wants different fields. Having pre-drafted notices for each, with the factual sections left blank, saves hours when hours are what the rule allows. Some organizations rehearse the reporting decision as a distinct inject in tabletop exercises, timing how long it takes from first alert to a filed notice.

The gap assessment: self-review with a deadline

The third component required operators to assess themselves against existing guidelines and report gaps within 30 days. That turned voluntary guidance into a documented baseline, and gave the regulator a sector-wide view of where weaknesses lay.

For operators, this was in some ways the most demanding requirement. It required honest internal evaluation on a short timeline, and it created a written record regulators could later compare against actual practice. Admitting a gap creates a duty to fix it. Claiming compliance that does not exist creates a different and worse problem. Organizations that already kept a current assessment against a recognized framework, with evidence attached to each control, found the requirement manageable. Those that did not had to build one in a month.

The template spread here too. Later rules increasingly asked organizations to document their programs, test them and certify the results, with senior officials signing. The capability that matters is a living control assessment, maintained continuously and mapped to each framework a regulator might cite, so that a 30-day request becomes an export instead of a project.

With hindsight

From 2026, the directive looks like the first move in an effort that still has not settled. TSA revised its pipeline directives in 2022 to be more performance-based after industry objected to prescriptive requirements, and in late 2024 proposed formal rules for pipeline and rail cybersecurity. CISA proposed its rule under the 2022 reporting law in April 2024; the final rule missed its statutory deadline of October 2025 and, as of this writing, has still not been published, so organizations should check its status. Congress and regulators repeatedly acknowledged that overlapping reporting requirements burden companies at the worst moment of an incident, and harmonization has been achieved only in part. Organizations that built one classification process covering all their obligations, with clear decision rights and a documented log, have absorbed each new rule as an update instead of a reinvention.