# CSA Z246.1: Security management for petroleum and natural gas industry systems

- Link: https://www.agilicus.com/csa-z246-1-security-management-for-petroleum-and-natural-gas-industry-systems/
- Published: 2026-03-04T03:57:55+00:00
- Author: Don Bowman

**CSA Z246.1** (officially titled _“Security management for petroleum and natural
gas industry systems”_) is a Canadian standard published by the CSA Group. While
earlier editions have existed since 2009, its fourth edition (**CSA Z246.1:21**)
introduced a massive expansion regarding cybersecurity[1][2]. It was designed to
address the increasing threat of cyberattacks against critical energy infrastructure
and provides a framework to evaluate and respond to physical and cyber security 
threats[1][3].

Here is a breakdown of the standard, its relationship to other frameworks, and best
practices for implementing it.

### What are the key aspects of this standard?

 * **Security Management Program (SMP):** The core requirement of CSA Z246.1 is 
   that organisations must develop, implement, and maintain a documented SMP[2][
   3]. This program follows the Plan-Do-Check-Act (PDCA) cycle for continuous improvement[
   2][3].
 * **Holistic Security:** It does not treat cybersecurity in a vacuum. The standard
   mandates an integrated approach that covers cybersecurity, information security,
   physical security, and personnel security[2][3].
 * **Risk-Based & Performance-Based Approach:** Instead of a rigid checklist of 
   technical controls, the standard focuses on performance[1][2]. It requires operators
   to proactively identify critical assets, assess threats and vulnerabilities, 
   and scale their security measures based on the specific risks to their operational
   environments[1][3].
 * **Incident Management:** It requires structured policies for detecting, mitigating,
   and responding to security incidents to protect public safety, the environment,
   assets, and economic stability[[1](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQFBSRqe9SLL0F3uKzrbTK-AuGQ1B01sBRbiVB_qHoe06nOuqwn3pN5cqDs32rq8gFGywFaSzB_-FdZJ-LWUmkHemZDnsUoCGfKcDAClcISXYuy054rc19PXWL8TOEIXozdN3GxOH0oqbK8%3D)][
   [3](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQEmDRTS_d5PRrsaqXK9XmQlQNAmoBb8uxzUyF0j7nVLAd23_AqylK6G60_5Vh5Y6BNLeryFwiyp7j4Irk6KogrS2vceWPN8Q3PDIxQkOhdTsRq5REOKkPXKhPz8lo90J2sNQWd2IRDsOHxe80TkeDGADL83ySyLwm5bGHmHtWkyft2Rp-zOEp9OfVMDYgpQ3tjC4hX9YmXkNcxEWgS8yHT15DNLRbBfpvUKYUjMvyF_Atnx_Mqcvw6lm4Hz3zNMqnnzu3t3AeXNmpsZYlkSJ52WD0q6k-W42Pcwv-4%3D)].
   Organisations must also evaluate their response through drills and post-incident
   reporting[[3](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQEmDRTS_d5PRrsaqXK9XmQlQNAmoBb8uxzUyF0j7nVLAd23_AqylK6G60_5Vh5Y6BNLeryFwiyp7j4Irk6KogrS2vceWPN8Q3PDIxQkOhdTsRq5REOKkPXKhPz8lo90J2sNQWd2IRDsOHxe80TkeDGADL83ySyLwm5bGHmHtWkyft2Rp-zOEp9OfVMDYgpQ3tjC4hX9YmXkNcxEWgS8yHT15DNLRbBfpvUKYUjMvyF_Atnx_Mqcvw6lm4Hz3zNMqnnzu3t3AeXNmpsZYlkSJ52WD0q6k-W42Pcwv-4%3D)].

### What entities are required to follow it?

Compliance is primarily mandatory for operators in the petroleum, natural gas, and
broader energy sectors, enforced by provincial and federal regulators:

 * **Federal / Interprovincial (CER):** The Canadian Energy Regulator requires all
   federally regulated interprovincial and international pipelines to comply with
   CSA Z246.1 under the Onshore Pipeline Regulations[4].
 * **Alberta (AER):** Starting **May 31, 2025**, the _Security Management for Critical
   Infrastructure Regulation_ (Alberta Regulation 84/2024) will take effect[5][6].
   The Alberta Energy Regulator (AER) will enforce compliance for facilities deemed“
   critical,” which includes pipelines, processing plants, wells, mines, and _in
   situ_ operations[5][6]. Failure to comply could result in the complete shutdown
   of a facility[7][8].
 * **British Columbia (BCER):** The BC Energy Regulator made the standard enforceable
   in **June 2023** for all oil and gas activity permit holders (including wells,
   pipelines, LNG facilities, and processing plants)[3][9].

### How does it relate to NIST SP 800-82?

CSA Z246.1 and **NIST SP 800-82** (_Guide to Operational Technology (OT) Security_)
are highly complementary, and regulators strongly recommend using them together[
[10](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQGl9Ubg5wOeVB0gBk9CHyNanq5Yo_17BeOfSG671oc3Xgh95qhD08JcHdvUZnWIwn0V-XS17zYxN-MVjKL0BgCALRYJceCqq0_6We3jbPiwH7WFnjQKVgiyxvp1c6WchJZvR8UUGSc1xeFaCjE4o1g_ukLLM0Q0-ik-nFbNuXNch6aE)][
[11](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQFNlYsmBTOBuEEm5iYj6tnw_jcnNgcECan98eMVyXHPwj3JXLSH8Da4L-GQSiqIgXitkx2eXAclQYBfCkYjHQVXHBrcCR0JURAxyhZ04tvwA_pcKpRCSqfAbHMh0itWocJBMpBehg%3D%3D)].

 * **Governance vs. Technical Controls:** CSA Z246.1 dictates _what_ needs to be
   achieved from a high-level governance and risk management perspective (e.g., “
   You must have a program to manage cybersecurity risk”). However, it gives organisations
   discretion on exactly _how_ to secure their software and networks[5][7].
 * **Filling the Implementation Gap:** NIST 800-82 provides the granular, technical“
   how-to” for securing Industrial Control Systems (ICS) and Operational Technology(
   OT)[[6](https://www.google.com/url?sa=E&q=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fgrounding-api-redirect%2FAUZIYQHCtMIrED89XSXBh1pn_8xfHwzaEfm__xyBkN4yU_9diaREE6TWQoqqELETCLw09MtBV5dJxLTC5CujHdjHBn2EmDbQm0ovfkzl6Dhq3WvpEMUdmjdar8zN7pI071SbCHRsEKQSmf-aaEBbS2egQQHTZij8a5Nn6kqX3po-tYCbUtjBv7MXq6x1BZJHe6cR55f1V2e9Zfhk8e2klYzO6TMgqe0%3D)].
 * **The Relationship:** To comply with CSA Z246.1, you use its framework to establish
   your policies, audits, and compliance tracking[1][3]. You then map your actual
   technical safeguards to NIST 800-82 to ensure your OT environments are resilient
   against attacks[6].

### What are the best practices to implement it?

Because the standard is performance-based, implementing it requires strategic planning
rather than simply buying a new software tool.

 * **Map to Established Frameworks:** Because CSA Z246.1 lacks prescriptive technical
   controls, integrate it with proven frameworks. Use **NIST SP 800-82** or **IEC
   62443** for your Operational Technology (OT) security, and **ISO/IEC 27001** 
   or the **NIST Cybersecurity Framework (CSF)** for your corporate IT[2][6].
 * **Conduct Thorough Risk Assessments:** Identify and categorise all critical processes,
   cyber assets, and physical infrastructure[2]. Leverage established risk assessment
   methodologies (like ISO 31000) to uncover vulnerabilities across your People,
   Processes, and Technology[1][2].
 * **Break Down IT/OT Silos:** Ensure that physical security, IT enterprise risk
   management (ERM), and OT network security teams are working together under a 
   unified Security Management Program, rather than operating in isolated silos[
   2].
 * **Standardise Documentation:** Regulators will want proof of compliance. Keep
   rigorous, standardised documentation of your threat assessments, security policies,
   access controls, and training logs to ensure smooth auditing[3][7].
 * **Run Drills and Mock Audits:** CSA Z246.1 emphasises continuous improvement[
   1][3]. Conduct cross-functional tabletop exercises and simulated cyberattacks
   to test your incident response[3][6]. Use third-party consultants to perform “
   mock audits” to catch gaps before regulators like the AER or BCER do[2][7].
 * **Secure Executive Buy-In:** Ensure senior management is fully on board[2]. A
   compliant Security Management Program will require dedicated budget, personnel,
   and a shift in company culture to treat cyber threats as critical safety hazards.

 1.  [https://www.csagroup.org](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.csagroup.org)
 2.  [https://www.simpligrc.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.simpligrc.com)
 3.  [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
 4.  [https://www.justice.gc.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.justice.gc.ca)
 5.  [https://www.bdplaw.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bdplaw.com)
 6.  [https://mobia.io](https://www.google.com/url?sa=E&q=https%3A%2F%2Fmobia.io)
 7.  [https://ionunited.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fionunited.com)
 8.  [https://www.bennettjones.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bennettjones.com)
 9.  [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
 10. [https://www.bc-er.ca](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bc-er.ca)
 11. [https://www.bcuc.com](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.bcuc.com)