H.R. 5062: Pipeline Security Act

H.R. 5062, the Pipeline Security Act, is designed to remove any doubt about who leads federal pipeline security: the Administrator of the Transportation Security Administration. The bill says TSA must maintain responsibility for securing pipeline transportation and pipeline facilities, while consulting with the Director of the Cybersecurity and Infrastructure Security Agency as appropriate. It ties TSA’s cybersecurity work to the National Institute of Standards and Technology Framework for Improvement of Critical Infrastructure Cybersecurity, signaling a more formal and standardized approach.

The bill also turns broad responsibility into a list of concrete duties. TSA would have to develop and update guidelines, consult with Federal, State, local, Tribal, and territorial governments plus public- and private-sector stakeholders, issue additional security directives or regulations when needed, share guidance and intelligence, assess and inspect implementation, identify and rank relative security risks, and inspect pipeline transportation and facilities, including those owners and operators designate as "critical." That is a significant operational checklist, even though the bill does not create a new funding stream.

Deadlines are the real enforcement mechanism here. TSA must develop a personnel strategy not later than 180 days after enactment, and that strategy must assess needed cybersecurity expertise, lay out a plan to expand that expertise inside TSA, and assess necessary resources. TSA also must convene at least one industry day not later than 1 year after enactment, send oversight reports to three congressional committees not less frequently than biennially, and then face a Government Accountability Office review not later than 2 years after enactment.

What the bill does not do is also important. It does not list civil fines, criminal penalties, or dollar authorizations. Instead, it leans on oversight, reporting, inspections, and TSA’s existing ability to issue directives or regulations as deemed necessary. In practice, that means Congress is trying to strengthen pipeline security governance first: clearer lines of authority, a workforce plan within 180 days, recurring reports every 2 years or more often, and an independent implementation check after 2 years.