KINDER MORGAN INC

In response to ongoing cybersecurity threats affecting the pipeline industry, the Department of Homeland Security’s (DHS) Transportation Security Administration, or TSA, has issued a series of security directives setting forth specific elements that owners and operators of certain “critical” pipelines must include in their cybersecurity planning and their reporting of any incidents. These security directives require, among other things, that identified pipeline owners comply with mandatory reporting measures; designate a cybersecurity coordinator; provide vulnerability assessments; ensure compliance with certain cybersecurity requirements; establish and implement a TSA-approved Cybersecurity Implementation Plan; develop and maintain a Cybersecurity Incident Response Plan (CIRP), which shall include individuals identified as active participants in CIRP exercises, and annually test at least two CIRP objectives; and establish a Cybersecurity Assessment Plan (CAP), and annually submit an updated CAP to TSA for review and approval, which shall include a schedule for assessing and auditing specific cybersecurity measures for effectiveness. TSA recently issued a proposed rulemaking to codify and expand these requirements for certain pipeline assets and LNG facilities, including obligations to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency and physical security incidents to TSA.

In addition, PHMSA requires reporting of certain events that involve a release from or the shutdown of a pipeline, including those that may be caused by a cyber-attack. On July 26, 2023, the SEC adopted new disclosure requirements regarding cybersecurity risk management, strategy, governance, and incidents. Please read Item 1C. “Cybersecurity.” Regulations are also under development to implement reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, a law concerning the reporting of cyber incidents and ransomware payments that is expected to take effect in 2024.