TSA Cybersecurity Compliance

TSA Cybersecurity Compliance is a community Agent Skill by Hemant Naik (sushegaad on GitHub), part of his Claude Skills for Governance, Risk and Compliance collection. TSA here is the US Transportation Security Administration. The skill covers its cybersecurity Security Directives for transportation critical infrastructure: SD Pipeline-2021-01 and -02 for pipeline operators, SD 1580-21-01 for freight railroads and SD 1582-21-01 for public transit and passenger rail, plus the November 2024 proposed rule (NPRM) that would turn them into permanent regulations. It's written for operators' security, OT/ICS and compliance teams, and for the consultants who work with them. What you can do with it - Work out whether TSA's directives apply to you, by sector and by whether TSA has designated you as covered - Run a gap assessment against the directive that applies, as a table of requirement, status, gap and evidence needed, with a prioritised remediation roadmap - Draft a Cybersecurity Implementation Plan (CIP or COIP) or a Cybersecurity Assessment Plan (CAP), with the sections that need site-specific detail flagged - Plan incident response: reporting incidents to CISA, the incident response plan and its annual testing - Get guidance on the four technical areas: IT/OT network segmentation, access controls, continuous monitoring and patch management - Prepare for an Architecture Design Review, and draft TSA-aligned policies mapped to the directive sections they serve - See what the 2024 NPRM would change, and how it lines up with NIST CSF 2.0 and CISA's Cross-Sector Cybersecurity Performance Goals How it works It's an Agent Skill: one SKILL.md with three reference files (a directives overview, the risk management program requirements, and incident reporting). The author also publishes it as a Claude Code plugin, tsa-compliance, in his own grc-skills marketplace. It comes into play when you ask about TSA directives. Tell it your sector, your IT/OT setup and which directive you're under for the most useful answers. Good to know - TSA's directives are Sensitive Security Information, so their full text isn't public. The skill works from public summaries, Federal Register notices and DHS and CISA publications, and covered operators should treat the directive TSA sent them as the authority. - The author says its output is informational guidance, not legal, regulatory or professional compliance advice. He recommends working with TSA, your legal counsel and qualified OT/ICS security professionals, and checking against the current revision of your directive. - It's a community project by an individual, not made by TSA, CISA or Anthropic.

• “We're a natural gas pipeline operator. Are we subject to TSA Security Directives, and what does that mean for us?”

  Copy

• “Run a gap assessment of our cybersecurity programme against SD Pipeline-2021-02.”

  Copy

• “Help me draft a Cybersecurity Implementation Plan for our pipeline OT environment.”

  Copy

• “We've found ransomware on our IT network but not our SCADA. Do we need to report it to CISA?”

  Copy

• “How do we set up the IT/OT network segmentation the directives require for our SCADA environment?”

  Copy