# CSA Z246.1: Security management for petroleum and natural gas industry systems

**CSA Z246.1** (officially titled *"Security management for petroleum and natural gas industry systems"*) is a Canadian standard published by the CSA Group. While earlier editions have existed since 2009, its fourth edition (**CSA Z246.1:21**) introduced a massive expansion regarding cybersecurity\[1\]\[2\]. It was designed to address the increasing threat of cyberattacks against critical energy infrastructure and provides a framework to evaluate and respond to physical and cyber security threats\[1\]\[3\].

Here is a breakdown of the standard, its relationship to other frameworks, and best practices for implementing it.

### What are the key aspects of this standard?

- **Security Management Program (SMP):** The core requirement of CSA Z246.1 is that organisations must develop, implement, and maintain a documented SMP\[2\]\[3\]. This program follows the Plan-Do-Check-Act (PDCA) cycle for continuous improvement\[2\]\[3\].
- **Holistic Security:** It does not treat cybersecurity in a vacuum. The standard mandates an integrated approach that covers cybersecurity, information security, physical security, and personnel security\[2\]\[3\].
- **Risk-Based & Performance-Based Approach:** Instead of a rigid checklist of technical controls, the standard focuses on performance\[1\]\[2\]. It requires operators to proactively identify critical assets, assess threats and vulnerabilities, and scale their security measures based on the specific risks to their operational environments\[1\]\[3\].
- **Incident Management:** It requires structured policies for detecting, mitigating, and responding to security incidents to protect public safety, the environment, assets, and economic stability\[[1](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQFBSRqe9SLL0F3uKzrbTK-AuGQ1B01sBRbiVB_qHoe06nOuqwn3pN5cqDs32rq8gFGywFaSzB_-FdZJ-LWUmkHemZDnsUoCGfKcDAClcISXYuy054rc19PXWL8TOEIXozdN3GxOH0oqbK8%3D)\]\[[3](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQEmDRTS_d5PRrsaqXK9XmQlQNAmoBb8uxzUyF0j7nVLAd23_AqylK6G60_5Vh5Y6BNLeryFwiyp7j4Irk6KogrS2vceWPN8Q3PDIxQkOhdTsRq5REOKkPXKhPz8lo90J2sNQWd2IRDsOHxe80TkeDGADL83ySyLwm5bGHmHtWkyft2Rp-zOEp9OfVMDYgpQ3tjC4hX9YmXkNcxEWgS8yHT15DNLRbBfpvUKYUjMvyF_Atnx_Mqcvw6lm4Hz3zNMqnnzu3t3AeXNmpsZYlkSJ52WD0q6k-W42Pcwv-4%3D)\]. Organisations must also evaluate their response through drills and post-incident reporting\[[3](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQEmDRTS_d5PRrsaqXK9XmQlQNAmoBb8uxzUyF0j7nVLAd23_AqylK6G60_5Vh5Y6BNLeryFwiyp7j4Irk6KogrS2vceWPN8Q3PDIxQkOhdTsRq5REOKkPXKhPz8lo90J2sNQWd2IRDsOHxe80TkeDGADL83ySyLwm5bGHmHtWkyft2Rp-zOEp9OfVMDYgpQ3tjC4hX9YmXkNcxEWgS8yHT15DNLRbBfpvUKYUjMvyF_Atnx_Mqcvw6lm4Hz3zNMqnnzu3t3AeXNmpsZYlkSJ52WD0q6k-W42Pcwv-4%3D)\].

### What entities are required to follow it?

Compliance is primarily mandatory for operators in the petroleum, natural gas, and broader energy sectors, enforced by provincial and federal regulators:

- **Federal / Interprovincial (CER):** The Canadian Energy Regulator requires all federally regulated interprovincial and international pipelines to comply with CSA Z246.1 under the Onshore Pipeline Regulations\[4\].
- **Alberta (AER):** Starting **May 31, 2025**, the *Security Management for Critical Infrastructure Regulation* (Alberta Regulation 84/2024) will take effect\[5\]\[6\]. The Alberta Energy Regulator (AER) will enforce compliance for facilities deemed "critical," which includes pipelines, processing plants, wells, mines, and *in situ* operations\[5\]\[6\]. Failure to comply could result in the complete shutdown of a facility\[7\]\[8\].
- **British Columbia (BCER):** The BC Energy Regulator made the standard enforceable in **June 2023** for all oil and gas activity permit holders (including wells, pipelines, LNG facilities, and processing plants)\[3\]\[9\].

### How does it relate to NIST SP 800-82?

CSA Z246.1 and **NIST SP 800-82** (*Guide to Operational Technology (OT) Security*) are highly complementary, and regulators strongly recommend using them together\[[10](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQGl9Ubg5wOeVB0gBk9CHyNanq5Yo_17BeOfSG671oc3Xgh95qhD08JcHdvUZnWIwn0V-XS17zYxN-MVjKL0BgCALRYJceCqq0_6We3jbPiwH7WFnjQKVgiyxvp1c6WchJZvR8UUGSc1xeFaCjE4o1g_ukLLM0Q0-ik-nFbNuXNch6aE)\]\[[11](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQFNlYsmBTOBuEEm5iYj6tnw_jcnNgcECan98eMVyXHPwj3JXLSH8Da4L-GQSiqIgXitkx2eXAclQYBfCkYjHQVXHBrcCR0JURAxyhZ04tvwA_pcKpRCSqfAbHMh0itWocJBMpBehg%3D%3D)\].

- **Governance vs. Technical Controls:** CSA Z246.1 dictates *what* needs to be achieved from a high-level governance and risk management perspective (e.g., "You must have a program to manage cybersecurity risk"). However, it gives organisations discretion on exactly *how* to secure their software and networks\[5\]\[7\].
- **Filling the Implementation Gap:** NIST 800-82 provides the granular, technical "how-to" for securing Industrial Control Systems (ICS) and Operational Technology (OT)\[[6](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQHCtMIrED89XSXBh1pn_8xfHwzaEfm__xyBkN4yU_9diaREE6TWQoqqELETCLw09MtBV5dJxLTC5CujHdjHBn2EmDbQm0ovfkzl6Dhq3WvpEMUdmjdar8zN7pI071SbCHRsEKQSmf-aaEBbS2egQQHTZij8a5Nn6kqX3po-tYCbUtjBv7MXq6x1BZJHe6cR55f1V2e9Zfhk8e2klYzO6TMgqe0%3D)\].
- **The Relationship:** To comply with CSA Z246.1, you use its framework to establish your policies, audits, and compliance tracking\[1\]\[3\]. You then map your actual technical safeguards to NIST 800-82 to ensure your OT environments are resilient against attacks\[6\].

### What are the best practices to implement it?

Because the standard is performance-based, implementing it requires strategic planning rather than simply buying a new software tool.

- **Map to Established Frameworks:** Because CSA Z246.1 lacks prescriptive technical controls, integrate it with proven frameworks. Use **NIST SP 800-82** or **IEC 62443** for your Operational Technology (OT) security, and **ISO/IEC 27001** or the **NIST Cybersecurity Framework (CSF)** for your corporate IT\[2\]\[6\].
- **Conduct Thorough Risk Assessments:** Identify and categorise all critical processes, cyber assets, and physical infrastructure\[2\]. Leverage established risk assessment methodologies (like ISO 31000) to uncover vulnerabilities across your People, Processes, and Technology\[1\]\[2\].
- **Break Down IT/OT Silos:** Ensure that physical security, IT enterprise risk management (ERM), and OT network security teams are working together under a unified Security Management Program, rather than operating in isolated silos\[2\].
- **Standardise Documentation:** Regulators will want proof of compliance. Keep rigorous, standardised documentation of your threat assessments, security policies, access controls, and training logs to ensure smooth auditing\[3\]\[7\].
- **Run Drills and Mock Audits:** CSA Z246.1 emphasises continuous improvement\[1\]\[3\]. Conduct cross-functional tabletop exercises and simulated cyberattacks to test your incident response\[3\]\[6\]. Use third-party consultants to perform "mock audits" to catch gaps before regulators like the AER or BCER do\[2\]\[7\].
- **Secure Executive Buy-In:** Ensure senior management is fully on board\[2\]. A compliant Security Management Program will require dedicated budget, personnel, and a shift in company culture to treat cyber threats as critical safety hazards.

1. [https://www.csagroup.org](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.csagroup.org)
2. [https://www.simpligrc.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.simpligrc.com)
3. [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
4. [https://www.justice.gc.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.justice.gc.ca)
5. [https://www.bdplaw.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bdplaw.com)
6. [https://mobia.io](https://www.google.com/url?sa=E&q=https%3A%2F%2Fmobia.io)
7. [https://ionunited.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fionunited.com)
8. [https://www.bennettjones.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bennettjones.com)
9. [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
10. [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
11. [https://www.bcuc.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bcuc.com)