Beyond Detection: The Oil and Gas SOC Guide
Splunk’s 2026 CISO Report found that 78% of CISOs worry about being held personally liable for security incidents, up from 56% a year earlier. In oil and gas, that worry traces to TSA directives that require operators to prove, measure by measure, that their cybersecurity plan actually operated.
In brief: Oil and gas SOCs rarely lack alerts. They lack decisions they can explain and evidence they can produce when an inspector asks. This guide covers five moves, in order, from fragmented IT and OT data to governed action.
Why do oil and gas CISOs worry more about the audit than the breach?
The audit is a standing obligation, and the evidence trail carries the CISO’s name. Operators of TSA-designated hazardous liquid and natural gas pipelines and LNG facilities work under Security Directive Pipeline-2021-01 and 2021-02, which require a TSA-approved implementation plan, an annual assessment plan with prior-year results, compliance records, and CISA notification within 24 hours of identifying an incident. Penalties reach $14,602 per violation for surface transportation modes, but the larger exposure is being unable to show that a named measure actually operated.
What makes oil and gas security different from other sectors?
The attack surface is physical. Refineries, pipelines, well pads, and offshore platforms run on operational technology (OT) that was never designed to be internet-connected, and it is converging with IT faster than most programs can secure it. Dragos’s 2026 OT/ICS Cybersecurity Year in Review put poor IT/OT segmentation at the top of its oil and gas findings, the highest share of any sector it analyzed. On a flat network, ransomware that starts in IT can reach OT with little resistance, and downtime there carries safety, environmental, and supply consequences.
What does the guide cover?
- Start with the data. Normalize to one open schema (OCSF), remove duplicates before they become alerts, and fuse intelligence at ingest so context arrives with the event.
- See across IT and OT. A dormant foothold can sit for months, well beyond the 30 to 90 days most SIEMs keep data hot. Long-term retention closes that gap, and Mean Time to Prioritized Remediation (MTPR) measures it.
- Move from detecting to deciding. The TSA model rewards proof that a measure worked, so the reasoning behind each decision should exist as a record.
- Consolidate on one intelligence-first platform. A team running eight to twelve disconnected products has eight to twelve places for third-party risk to hide. This section also explains how ONE-ISAC peer sharing works.
- Adopt AI on a governed path. Tines’ 2026 Voice of the SOC Analyst report found 71% of analysts report burnout tied to alert fatigue. Governance comes before adoption.
Who should read it?
CISOs get a plain account of where liability lands when a decision cannot be explained. SOC managers and directors get the case for treating analyst time as the constraint, since manual pivoting between the IT SIEM, the OT historian, and cold-storage exports is the toil analysts cite when they leave.
Frequently asked questions
Which TSA requirements apply to oil and gas pipeline operators?
Operators of TSA-designated critical hazardous liquid and natural gas pipelines and LNG facilities fall under the SD Pipeline-2021-01 and 2021-02 series, reissued annually since the 2021 Colonial Pipeline attack. It covers an approved implementation plan, an incident response plan, an annual assessment plan, recordkeeping, and CISA notification within 24 hours.
Does the Coast Guard’s maritime cybersecurity rule apply to refineries?
It can. Refineries, marine terminals, and LNG facilities with marine transfer operations and security plans under 33 CFR parts 104-106 are covered by the rule, effective July 16, 2025, with requirements phasing in through July 16, 2027.
What is Mean Time to Prioritized Remediation (MTPR)?
MTPR measures how long it takes to get from a detected issue to a prioritized remediation action. The guide sets the target at seconds, so that “are we impacted, and where” across IT and OT needs no special export from OT engineering.
Why does SIEM retention matter for OT intrusions?
Most SIEMs keep full-fidelity data hot for 30 to 90 days, while a dormant OT foothold can sit for months before it moves. Retention shorter than the adversary’s patience leaves investigators without the history they need.
Do we need to replace our SIEM to use Anomali?
No. Anomali deploys on top of the SIEM you already run, so monitoring continues without a platform migration.
Read the guide
Five moves, six pages, for the CISO who has to defend the decision and the SOC leader who has to staff it.
Discover More About Anomali
Check out some of our other great resources covering the latest cybersecurity trends, threat intelligence, security and IT operations, and Anomali product updates.
