Oil and gas
Security monitoring for pipelines and refineries.
Security built for pipelines and plants
Security and operations need a shared account of activity across offices, remote sites and the IT/OT boundary. Connected records help the team assess an intrusion and decide what action the operating environment can support.
Directives
| Directive | Measure | Supporting evidence |
|---|---|---|
| TSA Pipeline-2021-01 | Report to CISA within 24 hours. | A signed case timeline. → |
| TSA Pipeline-2021-02 | Continuous monitoring and detection. | Boundary correlation and near-hourly baselines. → |
| TSA Pipeline-2021-02 | Segmentation so OT runs if IT is hit. | Boundary firewall and jump host logs. → |
| HSE OG86 | Records of periodic security log monitoring. | Scheduled reports and signed logs. → |
| Havtil, 2025 | Central logging with anomaly detection. | a SIEM and behavioral detection. → |
TSA Pipeline-2021-02
VPN, firewall and remote-access records can show activity between business and operational environments. Correlation in a SIEM helps investigators follow the sequence and identify gaps before reaching a conclusion about its effect.
Safety systems
This monitoring scope uses agreed boundary-system records rather than direct connections to safety systems or controllers. The operator retains the design and authority of those systems.
TSA Pipeline-2021-01
Where the applicable TSA directive requires a 24-hour report, a maintained incident timeline helps the reporting team act promptly. Record discovery, affected services and the evidence available as the investigation develops.
Remote sites
Source-health monitoring in a SIEM shows when a remote station stops reporting. Supported buffering and recovery help preserve records through link interruptions and make delayed history visible.
By rule
HSE OG86
Records of periodic security log monitoring. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Havtil, 2025
Central logging with anomaly detection. a SIEM and behavioral detection.
Questions
Who decides a shutdown?
The authorized operating team makes that decision under its procedures. Security workflows in a SOAR supply context and document approvals without transferring operational authority to the model.
What stays with the operator?
The operator owns TSA plans and reports, API 1164 work and the control and safety systems. Monitoring contributes evidence within the agreed collection scope.
Guide
What do TSA pipeline security directives require?
They require incident reports to CISA within 24 hours, IT/OT separation, and continuous monitoring and detection.
What is API 1164?
API Standard 1164 is the pipeline industry standard for control system cybersecurity.
How do operators know if an attack reached OT?
Review available VPN, firewall, jump-host and plant-system records across the IT/OT boundary. The conclusion should identify both observed activity and the limits of visibility.
How ARRTECH takes care of oil and gas security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
