
The exposure
The directive is the floor, not the ceiling.
TSA SD Pipeline-2021-02 requires segmentation between IT and OT and a plan for degraded operation. Field sites with satellite backhaul and shared vendor credentials make both hard.
TSA SD-02API 1164IEC 62443
■IT / OT segmentation evidence for the directive
■Compressor and pump station remote access
■Operating without SCADA: the degraded-mode plan
Typical topologyExposed path
L3.5 · DMZPipeline DMZ
VENDOR VPN
L2 · HMIControl room HMI
L2 · SCADAPipeline SCADA
L2 · HISTORIANLeak detection
L1 · PLCStation PLC
L1 · RTUWellhead / valve RTU
L1 · SAFETYESD system
L0 · PROCESSCompressors · pumps · valves · tanks
Where we start
