Morris Petition Response

Page 1U.S. Department of Transportation Pipeline and Hazardous Materials Safety Administration 1200 New Jersey Avenue, SE Washington, D.C. 20590 APR 2 0 2015 Dr. Alan Morris Physical Engineer Morris and Ward Consulting Engineers 4938 Hampden Lane #114 Bethesda, MD 20814 Dear Dr. Morris: In a letter to the Pipeline and Hazardous Materials Safety Administration (PHMSA) dated March 14, 2013, you submitted a petition for rulemaking to amend a portion of the Federal Pipeline Safety Regulations. Specifically, your letter proposes PHMSA require the installation of new-design programmable logic computers (controllers) in the control systems of oil and gas pipelines and require pipeline staff training in the programming and handling of non-rewritable memories. These proposals would help block mal ware attacks on the industrial control systems of the affected facilities. PHMSA reviewed your proposed changes and your rationale for your proposals. At this time, PHMSA is denying your petition for rulemaking. PHMSA does not have the authority to establish new infrastructure security standards for pipeline control systems. The Transportation Security Administration (TSA) and the Department of Homeland Security (DHS) have primary responsibility for infrastructure and cyber asset security, including security standards for pipeline control systems. · TSA's Pipeline Security Guidelines include cyber asset security measures and can be found at: www.tsa.gov/sites/default/fl.les/assets/pdf/lntermodal/tsa pipeline sec guideline april20ll.pdf. Additionally, DHS developed Chemical Facility Anti-Terrorism Standards, which are applicable to fixed energy and utility facilities that manufacture, store, and distribute certain chemicals- some of which are transported by pipelines. These standards also include cybersecurity requirements. While PHMSA agrees that the security of pipeline systems is of tremendous importance, PHMSA does not have the authority to undertake any rulemaking pertaining to your proposal at this time. We hope this information is helpful to you. If you have any questions or need further assistance, please contact John Gale, Director of Standards and Rulemaking, at 202-366-0434. Sincerely, I~ Jeffrey D. Wiese Associate Administrator for Pipeline Safety#