Security Training for Surface Transportation Employees

Federal RegisterMar 23, 2020

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HOMELAND SECURITY

Transportation Security Administration

49 CFR Parts 1500, 1520, 1570, 1580, 1582, and 1584

[Docket No. TSA-2015-0001]

RIN 1652-AA55

Security Training for Surface Transportation Employees

AGENCY:

Transportation Security Administration, DHS.

ACTION:

Final rule.

SUMMARY:

The Transportation Security Administration (TSA) is requiring owner/operators of higher-risk freight railroad carriers, public transportation agencies (including rail mass transit and bus systems), passenger railroad carriers, and over-the-road bus companies, to provide TSA-approved security training to employees performing security-sensitive functions. The training curriculum must teach employees how to observe, assess, and respond to terrorist-related threats and/or incidents. Additionally, TSA is expanding its requirements for security coordinators and reporting of significant security concerns (currently limited to rail operations) to include bus operations within the scope of the regulation's applicability. TSA is amending other provisions of its regulations, as necessary, to implement these requirements.

DATES:

Effective date:

This rule is effective June 22, 2020.

Compliance date:

In general, compliance schedules are indicated in this rule. The requirements in 49 CFR 1570.201 must be met no later than July 29, 2020.

FOR FURTHER INFORMATION CONTACT:

Harry Schultz (TSA, Security Policy and Industry Engagement, Surface Division) or David Kasminoff (TSA, Senior Counsel, Regulations and Security Standards) at telephone (571) 227-5563, or email to

SecurityTrainingPolicy@tsa.dhs.gov.

SUPPLEMENTARY INFORMATION:

Availability of Rulemaking Document

An electronic copy can be obtained using the internet by—

(1) Searching the electronic Federal Docket Management System (FDMS) web page at

http://www.regulations.gov;

(2) Accessing the Government Printing Office's web page at

http://www.gpo.gov/fdsys/browse/collection.action?collectionCode=FR

to view the daily published

Federal Register

edition; or accessing the “Search the Federal Register by Citation” in the “Related Resources” column on the left, if you need to do a Simple or Advanced search for information, such as a type of document that crosses multiple agencies or dates.

In addition, copies are available by writing or calling the individual in the

FOR FURTHER INFORMATION CONTACT

section. Make sure to identify the docket number of this rulemaking.

Small Entity Inquiries

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires TSA to comply with small entity requests for information and advice about compliance with statutes and regulations within TSA's jurisdiction.

Any small entity that has a question regarding this document may contact the person listed in the

FOR FURTHER INFORMATION CONTACT

section. Persons can obtain further information regarding SBREFA on the Small Business Administration's web page at

https://www.sba.gov/category/advocacy-navigation-structure/regulatory-policy/regulatory-flexibility-act/sbrefa.

Public Law 104-121, 110 Stat. 857 (Mar. 29, 1996).

Abbreviations and Terms Used in This Document

Amtrak—National Railroad Passenger Corporation

APTA—American Public Transportation Association

CDL—Commercial Driver's License

DHS—Department of Homeland Security

DOT—Department of Transportation

FRA—Federal Railroad Administration

FTA—Federal Transit Administration

GAO—U.S. Government Accountability Office

HSA—Homeland Security Act of 2002

HTUA—High Threat Urban Area

IED—Improvised Explosive Device

MOU—Memorandum of Understanding

NSI—Nationwide Suspicious Activity Reporting (SAR) Initiative

OMB—Office of Management and Budget

OSHA—Occupational Health and Safety Administration

OTRB—Over-the-Road Bus

PHMSA—Pipeline and Hazardous Materials Safety Administration

PRA—Paperwork Reduction Act of 1995

PTPR—Public Transportation and Passenger Railroads

RFA—Regulatory Flexibility Act of 1980

RIA—Regulatory Impact Analysis

RSC—Rail Security Coordinator

RSSM—Rail Security-Sensitive Material

SBA—Small Business Administration

SBREFA—Small Business Regulatory Enforcement Fairness Act of 1996

SSI—Sensitive Security Information

TSA—Transportation Security Administration

TSSM—Transportation Security-Sensitive Material

UASI—Urban Area Security Initiative

UMRA—Unfunded Mandates Reform Act of 1995

VBIED—Vehicle-Borne Improvised Explosive Device

Table of Contents

I. Executive Summary and Background

A. Statutory Mandate

B. Benefits of Requiring Security Training

C. Costs of This Final Rule

D. Organization of This Final Rule

II. Security Program Requirements

A. Who must provide security training?

1. Freight Railroads (§ 1580.101)

2. Public Transportation and Passenger Railroads (§ 1582.101)

3. Over-the-Road Buses (§ 1584.101)

4. Impact on Certain Business Operations

B. Who is responsible for determining whether a specific owner/operator is subject to the requirements of the rule (applicability determinations)? (§ 1570.105)

C. Which employees must receive security training? (§§ 1580.115(a), 1582.115(a) and 1584.115(a))

D. How does an owner/operator determine if someone is a security-sensitive employee? (§§ 1580.3, 1582.3, and 1584.3)

E. Can untrained security-sensitive employees perform security-sensitive functions? (§§ 1580.115(b), 1582.115(b), and 1584.115(b))

F. What topics must be included in the security training? (§§ 1580.115(c)-(f), 1582.115(c)-(f), and 1584.115(c)-(f))

G. Who will provide the security training curriculum? (§§ 1580.113, 1582.113, and 1584.113)?

H. Can owner/operators use pre-existing material or other third-party material? (§ 1570.103)

I. How do these requirements relate to other security training required by other Federal or State agencies? (§§ 1580.115(c), 1582.115(c), and 1584.115(c))

J. What is the required schedule for providing training? (§ 1570.111)

1. Initial Training (§ 1570.111(a))

2. Recurrent Training (§ 1570.111(b))

3. Previous Training (§ 1570.107)

K. Do employees have to pass a test? ((§§ 1580.113(b)(9), 1582.113(b)(9), and 1584.113(b)(9))

III. Operational Requirements (Subpart D)

A. Security Coordinator Requirements (§ 1570.201)

B. Requirement To Report Security Concerns (§ 1570.203)

C. Methods for Reporting Information and Substance of Information Provided (§ 1570.203 (a) and (c))

IV. Security Program Procedures

A. Deadlines Related to Submission and Approval of Security Training Program

B. Amendments

1. Amendments Initiated by Owner/Operator (§ 1570.113)

2. Amendments Initiated by TSA (§ 1570.115)

C. Alternative Measures (§ 1570.117)

D. Petitions for Reconsideration (§ 1570.119)

E. Recordkeeping Requirements (§ 1570.121)

F. Summary of Deadlines

V. Miscellaneous Changes

A. Amendments to Part 1500

B. Amendments to Part 1503

C. Amendments to Part 1520

D. Amendments to Part 1570

1. Security Responsibilities for Employees and Other Persons (§ 1570.7)

2. Compliance, Inspection, and Enforcement (§ 1570.9)

3. “Covered Person” (§ 1570.305)

VI. Summary of Changes

VII. Response to Comments on NPRM

A. General Comments

1. Need for Rule

2. Cost of Rule

3. Stakeholder Consultation

4. Terms

B. Investigative and Enforcement Procedures

C. Part 1570—General Rules

1. Terms Used in This Subchapter (§ 1570.3)

2. Recognition of Prior or Established Security Measures or Programs (§ 1570.7)

3. Submission and Approval (§ 1570.109)

4. Implementation Schedule (§ 1570.111)

5. Recordkeeping and Availability (§ 1570.121)

6. Security Coordinator (§ 1570.201)

7. Reporting Significant Security Concerns (§ 1570.203)

D. Subpart B—Security Programs

1. Security Training Program General Requirements (§§ 1580.113, 1582.113, and 1584.113)

2. Security Training and Knowledge for Security-Sensitive Employees (§§ 1580.115, 1582.115, and 1584.115)

E. Freight Rail Specific Issues

1. Applicability of Security Training Requirements (§ 1580.101)

2. Chain of Custody and Control Requirements (§ 1580.205)

F. Public Transportation and Passenger Railroad Specific Issues

G. OTRB Specific Issues

1. Definition of Security-Sensitive Employees (§ 1584.3 and Appendix B to Part 1584)

2. Applicability (§ 1584.101)

H. Comments Beyond Scope of Rulemaking

VIII. Rulemaking Analyses and Notices

A. Paperwork Reduction Act

B. Economic Impact Analyses

1. Regulatory Impact Analysis Summary

2. Executive Orders 12866, 13563, and 13711 Assessments

3. OMB A-4 Statement

4. Alternatives Considered

5. Regulatory Flexibility Assessment

6. International Trade Impact Assessment

7. Unfunded Mandates Assessment

C. Executive Order 13132, Federalism

D. Environmental Analysis

E. Energy Impact Analysis

I. Executive Summary and Background

A. Statutory Mandate

Following the attacks of September 11, 2001, Congress created TSA under the Aviation and Transportation Security Act (ATSA) and established the agency's primary Federal role to enhance security for all modes of transportation.

The scope of TSA's authority includes assessing security risks, developing security measures to address identified risks, and enforcing compliance with these measures.

TSA also has broad regulatory authority to issue, rescind, and revise regulations as necessary to carry out its transportation security functions.

Public Law 107-71, 115 Stat. 597 (Nov. 19, 2001). ATSA created TSA as a component of the Department of Transportation (DOT). Section 403(2) of the Homeland Security Act of 2002 (HSA), Public Law 107-296, 116 Stat. 2135 (Nov. 25, 2002), transferred all functions related to transportation security, including those of the Secretary of Transportation and the Under Secretary of Transportation for Security, to the Secretary of Homeland Security. Pursuant to DHS Delegation Number 7060.2, the Secretary delegated to the Administrator, subject to the Secretary's guidance and control, the authority vested in the Secretary with respect to TSA, including the authority in sec. 403(2) of the HSA.

See

49 U.S.C. 114, which codified section 101 of ATSA.

49 U.S.C. 114(l)(1).

As part of the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act),

Congress mandated regulations to enhance surface transportation security through security training of frontline employees. The mandate includes prescriptive requirements for who must be trained, what the training must encompass, and how to submit and obtain approval for a training program.

The 9/11 Act also mandates regulations requiring higher-risk railroads and over-the-road buses (OTRBs) to appoint security coordinators.

In addition to implementing these provisions, this final rule also addresses a mandate to define Transportation Security-Sensitive Materials.

Public Law 110-53, 121 Stat. 266 (Aug. 3, 2007).

See

secs. 1408, 1517, and 1534 of the 9/11 Act, codified at 6 U.S.C. 1137, 1167, and 1184, respectively.

See

secs. 1512 and 1531 of the 9/11 Act, codified at 6 U.S.C. 1162 and 1181, respectively. TSA addresses 1512(e)(1)(A) and 1531(e)(1)(A) in this rulemaking. TSA intends to address the other regulatory requirements of these provisions in separate rulemakings.

See

sec. 1501 of the 9/11 Act, codified at 6 U.S.C. 1151.

B. Benefits of Requiring Security Training

TSA is issuing this rule pursuant to its authority and responsibility over the security of the nation's transportation systems. TSA fulfills its transportation security mission in partnership with its industry and government stakeholders. As noted in the 2018

National Strategy for Counterterrorism in the United States:

The critical infrastructure of the United States—much of which is privately owned—provides the essential goods and services that drive American prosperity. Coordinated efforts are, therefore, necessary to strengthen and maintain secure and resilient critical infrastructure and to prepare Americans to respond appropriately should an attack occur. By integrating and improving preparedness across all levels of government as well as the private and public sectors, we will stop terrorists from undermining our security and prosperity.

See

The White House,

National Strategy for Counterterorrism in the United States,

at 19 (Oct. 2018), available at

https://www.dni.gov/files/NCTC/documents/news_documents/NSCT.pdf

(last accessed Nov. 26, 2018) (

National Strategy

Consistent with this strategy, the purpose of this rule is to solidify the baseline of security for higher-risk surface transportation operations by improving and sustaining the preparedness of surface transportation employees in higher-risk operations, including their critical capability to observe, assess, and respond to security risks and potential security breaches within their unique working environment. In developing this rulemaking, TSA recognizes private sector capabilities, voluntary initiatives, and other Federal requirements to raise security within distinct surface transportation operations. By integrating these efforts, setting a national standard for surface transportation employee security training, and ensuring this training is sustained across higher-risk operations, this rule promotes national security in alignment with the intent of the 9/11 Act and the

National Strategy.

The rule accomplishes this purpose by requiring higher-risk public transportation systems, railroad carriers (passenger and freight), and OTRB owner/operators to prepare and train their employees performing security-sensitive job functions. Through security training, employees will have the capability to identify, report, and appropriately react to suspicious activity, suspicious items, dangerous substances, and security incidents that may be associated with terrorist reconnaissance, preparation, or action. TSA believes this training may be the critical point for preventing a terrorist act and mitigating the consequences.

In order to ensure effective communication regarding threats (both to regulated parties and from regulated parties), TSA is also expanding applicability of current requirements for rail operations to have security coordinators and report security incidents to TSA. With this rulemaking,

the applicability for this requirement is expanded to include any owner/operator required to provide security training. Requiring higher-risk owner/operators to have security coordinators and report significant security concerns to TSA will enhance TSA's ability to recognize trends and communicate directly with individuals within higher-risk operations that have direct responsibility for security.

C. Costs of This Final Rule

Table 1 identifies TSA's estimates for the overall cost of this rule.

Table 1—Cost of Final Rule

Estimated costs

(over 10 years, discounted at 7 percent)

Freight Railroads

$25.09 million.

Public Transportation and Passenger Railroads (PTPRs)

17.12 million.

OTRBs

8.06 million.

TSA

2.03 million.

Total

52.30 million.

D. Organization of This Final Rule

Subchapter D of chapter XII of title 49, “Maritime and Surface Transportation Security”

(Subchapter D), includes security program requirements for surface transportation, including the requirements in this final rule. Before this final rule, Subchapter D included requirements relevant to two vetting programs (the Transportation Worker Identification Credential (TWIC) and Hazmat Material Endorsement (HME), as well as certain rail security requirements, including chain of custody for Rail Security-Sensitive Materials (RSSM), appointment of security coordinators, and reporting security issues.

TSA is modifying the title of this subchapter, changing it from “Maritime and Land Transportation Security” to “Maritime and Surface Transportation Security.”

This final rule (1) adds requirements for security training for certain surface transportation owner/operators; (2) expands applicability of the security coordinator and reporting security issue requirements to include higher-risk bus operations; and (3) adds other miscellaneous provisions necessary for implementation of a new regulatory program.

To incorporate these new elements, TSA is organizing Subchapter D as follows.

• Part 1570 is divided into four subparts: (1) Subpart A includes requirements generally applicable to all aspects of subchapter D; (2) subpart B includes security program requirements consistently relevant to multiple modes; (3) subpart C includes operational requirements consistently applicable to multiple modes; and (4) subpart D moves and consolidates general provisions related to security threat assessments (STAs) which are more specifically addressed in part 1572. As noted below, mode-specific requirements are contained in subsequent parts.

• Part 1580 is modified to limit requirements applicable to rail security. This part includes operational requirements unique to freight railroads and rail hazardous materials shippers/receivers (such as chain of custody)

and modal-specific security training requirements for freight railroads. The requirements for appointment of security coordinators and reporting security issues are moved to part 1570 and several definitions are moved to part 1500.

See

Rail Transportation Security Final Rule (Rail Security Rule), 73 FR 72130, (Nov. 26, 2008).

• Part 1582, a new part entitled “Public Transportation and Passenger Railroad Security,” includes modal-specific security training requirements for public transportation system and passenger railroads (PTPR). The requirements for appointment of security coordinators and reporting security issues applicable to PTPR rail operations are moved to part 1570 and several definitions are moved to part 1500.

• Part 1584, a new part entitled, “Highway and Motor Carrier Security,” includes modal-specific security training requirements for OTRB owner/operators.

Owner/operators subject to the requirements of this final rule will need to address the requirements in part 1570 as well as the requirements applicable to their respective mode in parts 1582 through 1584. Sections II through IV, which follow, provide a comprehensive discussion of these requirements as they will be implemented, rather than a sequential section-by-section analysis. Section II addresses general programmatic requirements, including: Applicability determinations, which employees must be trained, content of training, and the required training schedule. Section III discusses operational requirements, such as the requirement for security coordinators and reporting of security incidents. Section IV provides the procedural requirements for submission and approval of a security training program, amendments to the program, and recordkeeping requirements. This section also includes a table that summarizes the compliance deadlines owner/operators must meet. Section V discusses other revisions to TSA's regulations that result from adding these new requirements to Subchapter D.

The discussion does not address provisions that are moved, as discussed above, but not modified.

This final rule includes TSA's responses to comments received on the NPRM. Section VI includes a chart summarizing the minimal changes between the NPRM and final rule. Section VII provides TSA's responses to comments on the NPRM.

Section VIII includes the rulemaking analysis and notices. This analysis includes any changes in the impact estimates between the NPRM and the final rule and the basis for those changes.

II. Security Program Requirements

A. Who must provide security training?

Consistent with TSA's commitment to a risk-based approach to transportation security, the requirements of this rule only apply to higher-risk operations. A higher-risk operation is one that meets the criteria in §§ 1580.101 (freight railroads), 1582.101 (PTPR), and 1584.101 (OTRB). These criteria are used to identify operations with a relatively higher-risk of being targeted or used by terrorists. While there are approximately 10,000 surface transportation operations, approximately 300 of them currently meet the criteria.

A full discussion of TSA's analysis and considerations in making its determination and developing the applicability criteria can be found in the NPRM.

See

81 FR at 91355

et seq.

(section III.F. of the NPRM).

While the requirements of this rule are limited to higher-risk operations, TSA encourages all owner/operators to consider implementing the security training program required by this rule, modified and adapted to their operations, as appropriate. TSA will ensure resources developed for regulated owner/operators, such as TSA-created training materials, are available to owner/operators of non-higher-risk operations who are committed to enhancing security through improving the security awareness of employees.

TSA's applicability criteria for freight railroads, PTPR, OTRB, and certain business operations are as follows.

1. Freight Railroads (§ 1580.101)

A freight railroad owner/operator must provide security training if it is: (a)

Designated as Class I;

(b) transports RSSM in one or more of the areas listed in current Appendix A to 49 CFR part 1580;

and/or (c) hosts a higher-risk rail operation (including freight railroads and the intercity or commuter systems identified in § 1582.101). The flowchart in Figure 1 summarizes when a freight railroad owner/operator must provide security training and when this training is recommended by TSA. TSA estimates the requirements of this rule currently apply to 33 freight railroads.

The Surface Transportation Board defines a Class I railroad as one with annual operating revenue in excess of $447,621,226 (adjusted for inflation).

See

§ 1580.3 for definition of RSSM.

ER23MR20.000

2. Public Transportation and Passenger Railroads (§ 1582.101)

A public transportation agency or passenger railroad must provide security training if it is (a) one of the 46 identified PTPR systems listed in 49 CFR part 1582, Appendix A; (b) Amtrak; or (c) hosts a higher-risk freight railroad. DHS consistently identifies the eight regions where the 46 systems operate as having the highest transit-specific risk. Applying the rule's requirements to these systems corresponds to providing enhanced security for more than 80 percent of all PTPR passengers.

3. Over-the-Road Buses (§ 1584.101)

An OTRB owner/operator must provide security training if it provides fixed-route service to, through, or from any of ten areas identified in 49 CFR part 1584, Appendix A. These ten areas receive the highest funding allocation under the FY 2018 Urban Area Security Initiative (UASI) grant program (87 percent of the total available funding).

TSA estimates that this rule will apply to approximately 205 OTRB owner/operators.

UASI funds are allocated based on a risk methodology employed by DHS and the Federal Emergency Management Agency (FEMA). For the list of UASI allocations for the FY 2018 UASI grant program, which is administered by FEMA as part of the larger Homeland Security Grant Program, see the FY 2018 Homeland Security Grant Program Notice of Funding Opportunity, Appendix A at

https://www.fema.gov/media-library-data/1526578809767-7f08f471f36d22b2c0d8afb848048c96/FY_2018_HSGP_NOFO_FINAL_508.pdf.

The determining factor for whether a fixed-route OTRB owner/operator is within the scope of the rule is not where they are headquartered, but where they provide service. In deciding to rely on where the owner/operator provides service, rather than corporate headquarters locations, TSA considered factors that could make an OTRB a potential target for a terrorist attack, including (1) its visibility (the size of its operations); (2) the extent to which its schedule is publicly available; (3) whether or not it is relatively easy for unknown individuals to board the bus; (4) and whether the bus will have ease of access to high-consequence locations.

TSA is aware that some private companies provide commuter services that may trigger applicability of the rule. Figure 2 provides a flowchart to assist companies with determining if the security training requirements apply.

ER23MR20.001

4. Impact on Certain Business Operations

Parent corporations and subsidiaries.

While the criteria for higher-risk determinations presumes similarities for operations within each mode,

TSA recognizes there are other considerations that could affect applicability, particularly related to subsidiaries. As discussed in section III.F of the NPRM,

TSA is limiting the requirements to the level of the subsidiary whose operations fit the applicability criteria identified in the rule.

See

discussion on applicability at 81 FR 91355

et seq.

(sec. III.F. of NPRM).

81 FR at 91355.

During the review and approval process of the security training program, TSA will work with owner/operators to address any compliance issues based on corporate structure. For example, owner/operator A may be organized to make each regional area a separate subsidiary. As such, only the subsidiary that meets the applicability requirements must develop a security training program. Owner/operator B may be a single entity for purposes of corporate-legal structure with branches, rather than subsidiaries, providing service on specific routes. Under this rule, the entire corporation is subject to the requirements based on the operations of one route. In this situation, owner/operator B could choose to submit a proposed alternative to limit application of the requirements to branches and a handful of headquarters or other regional employees that provide operational support. The submission requirements and procedures for requesting alternative measures are discussed in section IV.

Foreign owner/operators.

While the applicability provisions for security training do not specifically reference foreign owner/operators, the requirements apply to employees performing a security-sensitive function “. . . in the United States or in direct support of the common carriage of persons or property between a place in the United States and any place outside the United States.” Therefore, the training requirements of this rule apply to both domestic owner/operators and foreign owner/operators with employees performing covered functions within the United States or in support of operations within the United States. For example, the rule may apply to a Canadian OTRB owner/operator offering fixed-route service that begins at a point in Canada and transits through an area identified in part 1584, Appendix A before concluding at a point in Mexico. Even if only one employee (for example, the driver), performs a security-sensitive function while physically in the United States, applicability is triggered by the route. The Canadian OTRB owner/operator would be required to have a security training program and provide the required training to the driver and any other employee performing a security-sensitive function that supports the operations transiting through higher-risk regions in the United States (such as individuals providing maintenance or inspection services and dispatch information applicable to the covered route). Once applicability is triggered, it is irrelevant where the OTRB owner/operator's company is located or where the function is being performed (whether the employee is performing the security-sensitive function at a location in Canada or along the route in the United States).

In addition, while foreign owner/operators providing service in the United States are required to have a security coordinator and alternate, foreign owner/operators are only required to report potential threats and significant security concerns for operations in the United States or transportation to, from, or within the United States. A similar requirement currently applies to foreign freight railroad owner/operators under 49 CFR part 1580. This approach is also consistent with that taken by the Federal Railroad Administration (FRA).

Hosting relationships.

TSA recognizes that joint operations are common within the rail industry and include agreements

such as hosting. In a hosting relationship, the “host railroad” owns the track and exercises operational control of the movement of trains of other railroads (the “tenant” railroads) while they are using that track.

Under this rule, both the host and tenant railroads are required to have a training program that appropriately addresses the ramifications of the hosting relationship. For example, the host railroad's training program will need to address the operational considerations of the hosting relationship, such as training dispatchers on their role and responsibilities in halting the tenant railroad's operations over a segment of track where there is a potential threat (such as a suspected improvised explosive device (IED) or tampering with infrastructure). Similarly, a tenant railroad subject to the security training requirements of 49 CFR part 1582 (PTPR), will need to address the operational considerations of the hosting relationship, such as instructing its train and engine employees on the proper communication procedures to follow when a potential threat is identified. Under either example, the host and tenant railroad owner/operators are only responsible for training their own employees.

Contracted services.

Contracted services may involve joint operation pursuant to specific terms, but are different from hosting relationships. For example, some commuter passenger train services are owned by public transportation agencies, but the agency has a contract with a private company (such as a freight railroad) to operate the train. This is not a hosting relationship.

When inspecting compliance by participants in this type of a contracted services agreement, TSA will consider the freight railroad carrier (the private company/contractor) to be an authorized representative of the PTPR owner/operator (the owner/operator of the passenger train service). TSA will hold the PTPR owner/operator primarily responsible for compliance and for ensuring that all security-sensitive employees receive the required training, whether they are employed directly by the PTPR owner/operator or contractor. The PTPR owner/operator must train the freight railroad carrier's employees performing security-sensitive functions related to the passenger train service.

To the extent the contract between the PTPR owner/operator and the freight railroad includes a provision for the freight railroad to train its own employees, the passenger operation is responsible for documenting satisfaction of the training requirements within its TSA-approved-security training program. TSA will expect the passenger operation to clearly state in its security training program, as part of the submission process under 49 CFR 1570.109, that the freight railroad carrier will conduct the training and provide the required information on that training.

Regardless of how the parties define who will do what, TSA has authority to inspect both parties' operations for compliance. The regulated party is primarily responsible, but TSA has authority to initiate enforcement actions for non-compliance against either party based upon a fact-specific determination. While TSA historically initiates enforcement actions against the regulated entity, we have begun to look more closely at authorized representative/contractual relationships in our effort to address the root cause of noncompliance.

B. Who is responsible for determining whether a specific owner/operator is subject to the requirements of the rule (applicability determinations)? (§ 1570.105)

Owner/operators are required to use the criteria in 49 CFR parts 1580, 1582, and 1584 (contained in a subpart B to each part) to determine whether their operations are higher-risk. If the operations meet the criteria, the requirements of this rule apply. Under § 1570.105(a), owner/operators must notify TSA within 30 days of the effective date of this final rule if they meet the criteria for applicability. This obligation also applies to new and modified operations (commencing after publication of the final rule). Under § 1570.105(b), owner/operators must notify TSA no later than 90 calendar days before commencing operations or implementing modifications triggering applicability of the requirements.

While the rule requires owner/operators to determine whether the criteria apply, TSA is aware of the operations that are likely to be within the scope of applicability. TSA may initiate a compliance investigation if an owner/operator fails to self-identify within the required period.

To mitigate the likelihood of an owner/operator failing to comply based upon lack of recognition of the applicability for these requirements, TSA will use a variety of communication strategies to notify regulated parties that are likely to meet the applicability criteria. For example, TSA will use email to immediately notify its key stakeholder points of contact regarding publication of this final rule. In addition to these established information sharing mechanisms, TSA also conducts regular calls, workshops, and meetings with major industry partners and trade associations. TSA's surface representatives also work closely with surface-system owner/operators during industry-led security work groups, conferences, roundtables, and other sector-specific government coordination meetings. TSA plans to use all of these mechanisms to notify relevant industry partners of the new requirements.

C. Which employees must receive security training? (§§ 1580.115(a), 1582.115(a) and 1584.115(a))

Any owner/operator required to have a security training program under §§ 1580.101, 1582.101, or 1584.101, must provide security training to all security-sensitive employees. Security-sensitive employees include any direct employee, contractor, employee of a contractor, or other authorized person who is compensated for performing a security-sensitive function on behalf of or for the benefit of the owner/operator.

For example, if an OTRB owner/operator does not employ any drivers directly, but uses drivers under contract, these drivers will need to be trained. Similarly, if an owner/operator has chosen to combine dispatch services with any affiliates of its parent corporation, the owner/operator required to provide security training to its direct employees will also be required to provide security training to any dispatchers providing services for its fleet.

See

§ 1570.3 for the definition of an “employee.”

D. How does an owner/operator determine if someone is a security-sensitive employee? (§§ 1580.3, 1582.3, and 1584.3)

Definitions of mode-specific “security-sensitive employees” are included in §§ 1580.3 (freight rail), 1582.3 (PTPR), and 1584.3 (OTRB), with additional detail regarding job functions provided in mode-specific tables published as appendices to parts 1580,

1582, and 1584. As discussed in section III.E. of the NPRM, “security-sensitive employees” are individuals who perform functions with a direct nexus to, or impact on, transportation

security.

These functions fall into the following categories: (1) Operating a vehicle; inspecting and maintaining vehicles; (2) inspecting or maintaining building or transportation infrastructure; (3) controlling dispatch or movement of vehicles; (4) providing security of the owner/operator's equipment and property; (5) loading or unloading cargo or baggage; (6) interacting with travelling public (on board a vehicle or within a transportation facility); and (7) complying with security programs or measures, including those required by Federal law (a catch-all category that includes a small number of employees such as security coordinators and any other individuals who may have responsibility for carrying out aspects of the owner/operator's security program or other security measures who are not otherwise identified in the previous categories).

The table in part 1580 Appendix B is unique in that it includes examples of the job titles related to these functions based on historic use of these terms for railroads. The job titles, however, are provided solely as a resource to help understand the functions described; whether an employee must be trained is based upon the function, not the job title.

See

81 FR at 91353

et seq.

for more information on how TSA identifies these employees and how the chosen functions align with requirements in the 9/11 Act.

The requirements also apply to managers, supervisors, or others who perform a security-sensitive function or who so directly supervise the performance of such a function that their nexus is equivalent to the security-sensitive employee.

For example, a yardmaster in freight railroad operations is considered a security-sensitive employee because he or she directs security-sensitive functions, even if not in the direct management chain of all individuals performing these functions. At the same time, individuals within a corporate structure who neither perform a security-sensitive function nor have direct management responsibilities over individuals who do are unlikely to have a position within the corporation with a significant nexus to the transportation operations of the business (such as accounting functions). To the extent there are such individuals in the management structure, they will not be considered “security-sensitive” employees.

The definition of “employee,” which is in § 1570.3, includes immediate supervisors.

In some circumstances, security-sensitive functions may be performed by individuals not within the definition of “employee.” For example, police officers employed by a local law enforcement agency may be routinely patrolling the owner/operator's premises and/or operations, but do not work directly for, or under contract to, the owner/operator. Owner/operators are not required to provide training to these individuals. To the extent, however, these individuals work in the same environment as security-sensitive employees, TSA encourages owner/operators to make their training materials and sessions available. Providing awareness of training content to local law enforcement personnel regularly assigned to patrols at locations where security-sensitive employees work can enhance communication and cooperation in response to potential threats or actual terrorist-related incidents.

The law enforcement agency or personnel may be considered security-sensitive employees of the owner/operator if, for example, there is a contractual relationship for the law enforcement agency to provide services to the owner/operator and the law enforcement officer is assigned to that location by the owner/operator. Similarly, where the owner/operator has a dedicated police or security force who are employees of the owner/operator, these individuals are security-sensitive employees who must be trained under this rule.

TSA encourages owner/operators to consider other employees within their corporate structure or business operations who may not be performing a security-sensitive function as identified in the rule, but who could provide an additional layer of security if they received security training. Furthermore, if an owner/operator identifies positions or functions not listed by TSA as security-sensitive, but which have the nexus to transportation security that is intended to be covered by the rule, TSA encourages the owner/operator to identify and include these employees within its security training program.

E. Can untrained security-sensitive employees perform security-sensitive functions? (§§ 1580.115(b), 1582.115(b), and 1584.115(b))

If a security-sensitive employee does not receive the required security training, this employee is prohibited from performing a security-sensitive function without the direct supervision of an employee who has met the training requirements applicable to that security-sensitive function. While TSA is not defining “direct,” TSA expects the supervisor to be located in reasonable proximity to the employee to supervise actions and provide the necessary level of security awareness and response capabilities.

Furthermore, even if an employee is directly supervised, TSA imposes a 60-day limit for the amount of time that an employee may perform a security-sensitive function without completing the required training. After 60 days, the rule requires the owner/operator to remove the employee from a security-sensitive function. This requirement does not affect the owner/operators' discretion to reassign the individual to other non-security-sensitive job functions.

F. What topics must be included in the security training? (§§ 1580.115(c)-(f), 1582.115(c)-(f), and 1584.115(c)-(f))

TSA is requiring a training program that focuses on the specific knowledge provided to security-sensitive employees related to preparedness, observation, assessment and response. As a key aspect of security awareness is the ability to detect anomalies in the operating environment, the rule affords flexibility for owner/operators to develop and implement a program that addresses the above-required components in the context of their unique operational environments.

The “prepare” category addresses training on discharging any security responsibilities that security-sensitive employees may have under an owner/operator's existing security plan or security measure. This rule does not require any owner/operator to adopt or implement a security plan or measures, but TSA is aware that many owner/operators have security plans or measures implemented to comply with Federal requirements, to qualify for Federal grants, or as the result of voluntary initiatives. To the extent these plans or procedures exist, employees must be trained in order to ensure they are effective. Similar to the threat and incident prevention and response training, this portion of the training program will need to be tailored to the specific operation.

The “prepare” element provides multiple benefits to transportation security and to owner/operators. First, the requirement recognizes that the time when a crisis is occurring is not the time to provide training on how to implement crisis-response measures. Employees need to be prepared in advance, especially if they have responsibilities related to responding to a terrorist incident in order to mitigate the consequences. Second, this training element ensures that training conducted under this rule meets all of the requirements for security training required for “hazmat employees” under 49 CFR 172.704(a)(5).

Third, this

element also captures specific training for freight railroads related to the requirements in § 1580.115(c) for chain of custody and control requirements, ensuring appropriate procedures are followed to comply with the security requirements in subpart C to part 1580 (which contains the requirements moved from §§ 1580.103 and 1580.107 as a result of this rulemaking).

An analysis of the relationship between the Pipeline and Hazardous Materials Safety Administration (PHMSA) required training and the training provided by this final rule can be found in Diagram B of the NPRM.

See

81 FR at 91364. The relation with other training is also discussed in section II.H. and I. of this preamble.

Finally, the “prepare” category captures training that may vary based on the specific nature of an employee's responsibilities. For example, appropriate methods of self-defense may vary based upon an employee's job and extent to which he or she interacts with the public. Similarly, an employee's need to be trained in how to operate and maintain security equipment may be dictated by the employee's responsibilities. Within this category, owner/operators have some flexibility to shape the training to be appropriate for their specific employees and operations. This flexibility allows owner/operators to avoid situations where employees are required to sit through training completely irrelevant to their roles and responsibilities.

TSA intends for the training required in the Observe, Assess, and Respond categories to be relevant to all employees, regardless of their job functions. Training in security awareness and behavior recognition is appropriate for all employees and TSA believes there should be a common level of proficiency on these issues among security-sensitive employees of the owner/operators.

The “observe” category is intended to provide knowledge to increase a security-sensitive employee's observational skills. In general, this training focuses on recognizing the difference between what is normal for the operational environment and abnormalities that could indicate terrorist planning or imminent attack. Training delivered should teach the employees that suspicious activity is a combination of actions and individual behaviors that appear strange, inconsistent, or out of the ordinary for the employee's work environment. In most instances, it will not be a single factor, but a combination of factors taking place at a particular time and place, that will accurately identify a suspicious individual or act.

The “assess” category requires providing knowledge of how to determine the most appropriate response to what is observed. For example, does the incident require a response and, if so, what is the appropriate response?

The “respond” category includes training on security incident responses—including how to appropriately report a security threat, interact with the public and first responders at the scene of a threat or incident, applicable uses of self-defense devices or protective equipment, and communication with passengers. In addition to meeting training requirements enumerated in the 9/11 Act,

this category is intended to provide elements of security awareness training required by 49 CFR 172.704(a)(4). To the extent owner/operators need to provide training on specific self-defense devices or protective equipment, TSA has not calculated these costs. Such training is not a cost of this rule based on an assumption that training on the use of self-defense devices and equipment is a standard part of any operation before providing such devices or equipment to individuals.

Diagram B in the NPRM,

Development Considerations for Requirements in §§ 1580.113, 1582.113, and 1584.11,

provides an analysis of the 9/11 Act's requirements and other considerations incorporated into the four categories of training required by this rule.

See

81 FR at 91364.

TSA recognizes that owner/operators may choose, or have chosen, to integrate varying levels of training into their security training programs, such as for particular categories of employees or job functions, to meet the objectives of their overall security program or plan. As noted in section I, TSA intends for this rule to establish and solidify the baseline of security for higher-risk surface transportation operations. To the extent an owner/operator has a program that goes beyond the required baseline, TSA encourages continuation of these efforts as long as the owner/operator can meet the minimum training required by this rule for all security-sensitive employees.

G. Who will provide the security training curriculum? (§§ 1580.113, 1582.113, and 1584.113)?

Owner/operators are required to train security-sensitive employees using curriculum approved by TSA. TSA assumes that many of the owner/operators required to provide security training under this rule already have training programs in place that may substantially comply with the rule's requirements. This assumption is based on TSA's involvement in allocations of grant funding to owner/operators for the development of security training materials, funded through various DHS-grant program appropriations, as well as a comprehensive review of available training materials to determine whether they meet the standards and criteria required by the 9/11 Act. This assumption is also bolstered by certain industry responses to TSA's Notice published in 2013 in which TSA sought public comment and data on current security training practices.

See Request for Comments on Security Training Programs for Surface Mode Employees,

78 FR 35945, 35948 (June 14, 2013) (discussion on grant-funded training programs under “Relation to Other Training Programs”). TSA summarizes the response to the 2013 Notice in this final rule's RIA, Section 1.5. TSA explains in Sections 1.8.2. and 1.8.3. of the RIA how it used information from the responses to the 2013 Notice to assess the level of training in the baseline for PTPR and OTRB owner/operators, respectively.

TSA is committed to mitigating the costs of training for all owner/operators through several initiatives. For example, TSA has, and will continue, to identify existing training materials that address the curriculum content requirements identified in the rule and will make this information available to regulated parties.

TSA is also developing training materials that meet specific training requirements in this rule. TSA will notify regulated parties as the relevant training materials are completed.

See, e.g.,

Example of Security Training Matrix (TSA-2013-0005-0084) available in the docket to this rulemaking at

www.regulations.gov

H. Can owner/operators use pre-existing material or other third-party material? (§ 1570.103)

This rule does not require the owner/operator to create their own material or impose limits on the use of third-party material. If, however, owner/operators choose to rely on previously prepared training material, including material developed to satisfy other regulatory requirements, or third-party material, they must incorporate that material into an appendix to their security training program and reference that appendix in the corresponding portions of their security program, as discussed below.

I. How do these requirements relate to other security training required by other Federal or State agencies? (§§ 1580.115(c), 1582.115(c), and 1584.115(c))

TSA recognizes that many owner/operators covered by this rule are subject to training requirements under regulations of the Department of Transportation (DOT) that overlap with the training content required in the 9/11 Act.

TSA does not expect owner/operators to duplicate training. To the extent that an owner/operator intends to use existing training programs

implemented to comply with other Federal requirements or other standards in order to satisfy some or all of the requirements of this rule, the program submitted to TSA for approval must identify how the owner/operators intends to use the other training to satisfy TSA's requirements, such as the curriculum or lesson plan for that program. TSA intends to maintain an iterative list available to regulated owner/operators of training programs that have been approved by TSA for use in meeting this rule's requirements.

See

sections III.G.5 and I of NPRM for a discussion of other related training. 81 FR at 91361-91362 and 91364

et seq.

Paragraph (c)(2) requires an index to be provided if the owner/operator chooses to submit all or part of an existing security training program to TSA for approval. The index must be organized in the same sequence as the content requirements in §§ 1580.115, 1582.115, and 1584.115. Indexing is a necessary requirement if TSA is to provide flexibility for owner/operators to use existing training programs to satisfy this rule. TSA may request additional information on the program through the review and approval process.

J. What is the required schedule for providing training? (§ 1570.111)

1. Initial Training (§ 1570.111(a))

Current employees must be trained within one year of TSA's approval of the security training program. Initial training for new employees or those transitioning to a covered job function (as identified in Appendix B to parts 1580 (freight rail), 1582 (PTPR), and 1584 (OTRB)), must occur within the first 60 days of the date an employee begins to perform a security-sensitive function. In general, this means that an employee must be trained within 60 days of starting in a permanent-employment position that may require performance of a security-sensitive function, whether full or part-time.

These deadlines are set by secs. 1408(d)(3), 1517(d)(3), 1534(d)3 of the 9/11 Act, codified at 6 U.S.C. 1137, 1167, and 1184.

Section 1570.111(a)(3) addresses non-permanent employees. Non-permanent employees must receive training within 60 calendar days after employment that meets the definition of a security-sensitive employee. If an individual is employed on an intermittent or non-permanent basis, such as a contractor hired to perform a security-sensitive function for short durations, then the training must take place before the individual's aggregated length of employment by the owner/operator equals 60 calendar days within a consecutive twelve-month period. Training is

not

required if an individual is employed to perform a security-sensitive function one time for less than 60 days. Training

required if an individual performs a security-sensitive function for short but repeated durations and the aggregated period of time equals 60 days. TSA recognizes that some owner/operators may choose to train all regular contractors or other individuals employed for short but regular durations rather than having to monitor aggregated days of employment.

In meeting the initial training schedule, TSA expects that many owner/operators will rely on the provisions in § 1570.107, which provide standards for accepting previous training. TSA may allow “training credit” to be given for employees who received equivalent security training within one year before the rule's effective date. This training credit may include the following:

• Training on emergency preparedness plans that railroads connected with the operation of passenger trains must implement to address subjects such as communication, employee training and qualification, joint operations, tunnel safety, liaison with emergency responders, on-board emergency equipment, and passenger safety information.

• Training on policies that public transportation agencies implement to ensure safety promotion to support the execution of the Public Transportation Agency Safety Plan required under 49 CFR part 673 for all employees, agents, and contractors of any State, local government authority, or other operator of a public transportation system that receives Federal financial assistance under 49 U.S.C. Chapter 53.

• Training provided through funds granted under the Transit Security Grant Program or other grant programs.

The recordkeeping provisions, discussed below, require an owner/operator to provide current and former employees with documentation upon request of any training completed to meet the requirements of this rule. Options for compliance with this requirement could include providing employees with certificates to validate completed training. Providing employees with documentation of training is particularly relevant for operations such as those in the OTRB industry, where employees (for example, commercial drivers) may work for multiple owner/operators. If an owner/operator can validate an employee has received the required training within the specified timeframe, the training does not need to be repeated. Because of its obligation to ensure all training requirements are met, the current owner/operator is responsible for ensuring that any previous training courses satisfy the rule's requirements and documenting that the training was received within the required timeframe.

Finally, there may be situations where “dual-hatted” or other specific-function employees are required to receive security training from other sources as part of their jobs, such as railroad police officers employed by the owner/operator. As indicated above, it is the obligation of the owner/operator to ensure and document the training, including training received under these circumstances.

2. Recurrent Training (§ 1570.111(b))

TSA believes regular recurrent training is essential for transportation employees to maintain a high level of awareness and competency. To ensure this need is met, this rule requires owner/operators to provide the TSA-approved security training curriculum to their security-sensitive employees at least once every three years. This frequency is consistent with the requirements for security training imposed by the Pipeline and Hazardous Material Safety Administration (PHMSA) for hazardous materials employees under 49 CFR part 172.

In addition, consistent with 49 CFR 172.704, if the owner/operator modifies a security program or security plan for which training is required under this rule, the owner/operator must ensure that each security-sensitive employee with position- or function-specific responsibilities related to the revised plan or program changes receives training on the revisions within 90 days of implementation of the revised plan or program changes. This requirement ensures employees responsible for implementing the security program or plan will be trained in a timely manner concerning any changes or revisions to the security plan or program as necessary to reflect changes in security affecting their specific operating environment or the surface transportation system.

3. Previous Training (§ 1570.107)

While there is no specific requirement in the 9/11 Act for TSA to allow use of existing training programs to satisfy the security training regulatory requirements, this rule provides an opportunity for owner/operators to seek recognition of previously provided training. Under § 1570.107, an owner/operator may rely on previous training that occurred within the identified periods for initial or recurrent training.

In order to use previous training, the owner/operator must validate that the previous training satisfies the requirements of this rule (for example, reviewing records of training and curriculum), is relevant to the employee's job function, and appropriate for owner/operator's operations. As part of its inspection and compliance authority, TSA may require the owner/operator to provide the documentation used to determine the previous training met the requirements of this rule.

K. Do employees have to pass a test? ((§§ 1580.113(b)(9), 1582.113(b)(9), and 1584.113(b)(9))

TSA is not requiring security training programs to include employee testing, with prescribed pass/fail rates. The security training programs submitted to TSA, however, must include how the owner/operator will measure the effectiveness of the training program. TSA will afford flexibility to each individual owner/operator to identify measures for determining the effectiveness of their security training program using methods and criteria appropriate for their operations. For example, TSA expects that some owner/operators will choose to administer a written test or evaluation to gauge their employees' level of knowledge in order to assess the overall effectiveness of training, while others may rely upon operational tests conducted by supervisors to determine whether employees are being trained effectively. Some may use the results of drills and exercises to measure effectiveness and identify areas where modifications are needed.

Similarly, TSA is not prescribing conditions for a pass/fail policy that may be associated with post-training testing. While individual companies may elect to enforce pass/fail criteria with associated personnel actions, TSA is neither requiring nor recommending a specified maximum number of times that an individual may take a test or evaluation to demonstrate knowledge and competency. As previously noted, however, the methods submitted by an owner/operator for determining training efficacy may affect TSA's approval of any alternative measures for compliance. In reviewing security training programs, TSA's focus is on whether the program includes measures for the effectiveness of the training

program,

not an individual employee's performance.

III. Operational Requirements (Subpart D)

TSA requires freight and passenger railroad carriers, rail transit systems, rail hazardous materials shippers, and certain rail hazardous materials receivers, to appoint “rail security coordinators”

(RSCs) and report significant security concerns to TSA.

The RSCs are security liaisons to TSA, providing a single point of contact for receiving communications and inquiries from TSA concerning threat information or security procedures, and coordinating responses with appropriate law enforcement and emergency response agencies. This information, reported to TSA from the frontline of rail operations, is consolidated and analyzed by TSA to identify developing threats and trend analysis.

These requirements were promulgated in 2008,

see supra

n. 8, codified at 49 CFR 1580.101 and 1580.201 (before changes made by this rule).

See id.

at 49 CFR 1580.105 and 1580.203 (before changes made by this rule).

TSA is expanding applicability of these requirements to the owner/operators subject to the security training requirements. As a result, the scope of the requirement applies to:

• All rail operations subject to the security coordinator and reporting requirements under previous 1580.101, 1580.105, 1580.201, and 1580.203 (now located in sections 1570.201 and 1570.203);

• Any bus operations of a public transportation owner/operator required to provide security training under this rule; and

• Any OTRB owner/operator required to provide security training under this rule.

As previously noted, TSA currently requires security coordinators for rail operations, including freight railroads, passenger railroads, and public transportation rail operations. In addition to mandating security coordinators for railroads, the 9/11 Act also requires security coordinators for bus operations.

See

9/11 Act sec. 1531, codified at 6 U.S.C. 1181(e)(1)(A) (“Identification of a security coordinator having authority—(i) to implement security actions under the plan; (ii) to coordinate security improvements; (iii) to receive immediate communications from appropriate Federal officials regarding over-the-road bus security”).

See

9/11 Act sec. 1512, codified at 6 U.S.C. 1162(e)(1)(A). For a similar provision applicable to railroads. Consistent with this mandate, TSA is extending the requirement to appoint a primary and at least one alternate security coordinator for OTRB companies and bus operations of PTPR owner/operators identified as higher-risk through this rulemaking. This will have a limited impact on the PTPR mode as most public transportation bus agencies covered by this rule are part of a larger system that is already required to have a security coordinator under current 49 CFR part 1580.

See

sec. III.D.4 of the NPRM for more discussion regarding the security coordinator and reporting requirements (81 FR at 91350

et seq.

As proposed in the NPRM, the rule text for applicability of the security coordinator requirements erroneously included all bus-only public transportation systems, TSA intended, however, to limit applicability to the bus-only public transportation systems within the scope of the security training requirements, that is, the higher-risk bus-only systems.

To be consistent with TSA's intent as explained above and in the preamble of the NPRM, TSA is clarifying the requirement in the final rule text.

See

81 FR at 91350: “Because of the benefits of [the security coordinator and reporting requirements] to transportation security, TSA is proposing to extend these requirements to the modes of transportation covered by this proposed rule that are not currently subject to the requirements of 49 CFR part 1580. . . . TSA proposes to extend the requirement to appoint a primary and at least one alternate security coordinator for OTRB companies and the bus operations of PTPR owner/operators (with a limited impact as most public transportation bus agencies are part of a larger system that is required to have a security coordinator under current 49 CFR part 1580).”

Table 2 compares applicability scope of the previous requirement with the expanded applicability. The cost estimate for this requirement in the NPRM is consistent with TSA's intent and the corrected rule text.

Table 2—Comparison of Applicability for Security Coordinator and Reporting Requirements

§§ 1580.101/103 and 1580.201/203

New

§§ 1570.201/203

Freight railroad carriers

Rail hazardous materials shippers

Rail hazardous materials receivers in High Threat Urban Areas (HTUAs)

Owner/operators of private rail cars*

Railroads hosting freight or PTPR rail operations

PTPR operating rail transit systems on general railroad system, intercity passenger train service, and commuter train services

PTPR operating rail transit systems not part of general railroad system

PTPR operating bus transit or commuter bus systems in designated areas

Tourist, scenic, historic, and excursion rail owner/operators*

OTRB owner/operators providing fixed-route service in designated areas

* Security Coordinator only required if notified by TSA in writing that a threat exists. Requirement to report significant security concerns always applies.

A. Security Coordinator Requirements (§ 1570.201)

Security coordinators are a vital part of transportation security, providing TSA and other government agencies with an identified point of contact with access to company leadership and knowledge of the owner/operators' operations, in the event it is necessary to convey extremely time-sensitive information about threats or security procedures to an owner/operator, particularly in situations requiring frequent information updates. The security coordinator and alternate provide TSA with a contact in a position to understand security problems; immediately raise issues with, or transmit information to, corporate or system leadership; and help recognize when emergency response action is appropriate. The individuals must be accessible to TSA 24 hours per day, 7 days per week.

The rule does not change the expectation that the security coordinator and alternate be appointed at the headquarters level. Nor does the rule require the security coordinator or alternate to be a dedicated position who has no other primary or additional duties. As with the previous part 1580 requirements, TSA's primary concern is having a designated point of contact available to TSA at all times.

The rule also requires the owner/operator to submit contact information for both the security coordinator and alternate and to update this information within 7 days if it changes. As previously noted, this is not a new requirement for owner/operators of railroads, including the rail transit operations of PTPR owner/operators. If an owner/operator subject to this rule has provided current information for primary and alternate RSCs to TSA, it will not have to take further action to meet the requirement.

TSA assumes this is true for passenger rail carriers, freight railroad carriers, and rail transit systems operated by public transportation agencies. Owner/operators required to appoint security coordinators for the first time under this rule must provide this information to TSA by July 29, 2020. TSA will also use this contact for communications related to requirements in this rule.

Any changes to the information must, as previously required, be reported within seven calendar days of the change taking effect.

B. Requirement To Report Security Concerns (§ 1570.203)

As with the security coordinator requirement, TSA is moving and consolidating the requirement to report security concerns from part 1580 into § 1570.203 and extending it to higher-risk bus operations.

The list of reportable incidents can be found in Appendix A to part 1570 and includes not only a list of incidents, but descriptions and examples to assist regulated parties in making a determination of whether an incident must be reported based on its similarity to one of the examples.

This extension is within TSA's discretion to require other actions or procedures determined to be appropriate to address the security of public transportation and OTRB operations.

See

9/11 Act sections. 1405(c)(2)(I) and 1531(e)(1)(H), as codified at 6 U.S.C. 1134 and 1181, respectively.

This list of reportable significant security concerns is consistent with the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI). The NSI is a partnership between Federal, State, local, tribal, and territorial law enforcement that “establishes a national capacity for gathering, documenting, processing, analyzing and sharing SAR information . . . in a manner that rigorously protects the privacy and civil liberties of Americans.”

The NSI defines “suspicious activity” as “observed behavior reasonably indicative of pre-operational planning associated with terrorism or other criminal activity.”

The standardized approach among law enforcement officers and security officials with surface transportation entities produces more informative reports that can, more effectively, focus investigative efforts and intelligence analysis for potential trends and indicators of terrorism-related activity.

See

Nationwide SAR Initiative (NSI), “About the NSI” (accessed Nov. 3, 2016), available at

http://nsi.ncirc.gov/about_nsi.aspx

Id.

Finally, consistent with TSA's purpose in requiring submission of the information, the rule requires notification within 24-hours of the initial discovery of the incident by the owner/operator (

see

49 CFR 1570.203(a)).

This schedule will enable TSA to obtain timely information, without undermining the ability of the owner/operator to appropriately handle a situation. If there is an immediate threat, owner/operators and/or their employees should prioritize notifying and working with first responders. The notification to TSA should occur after the immediate crisis is addressed, but within a timeframe that allows TSA to assess and share timely information.

This change to reporting is a modification from the requirement as promulgated in the Rail Security Rule, which required immediate reporting.

For purposes of this requirement, the clock “starts running” when the owner/operator becomes aware of the incident. Awareness of the owner/operator includes awareness of (or discovery by) employees of the owner/operator.

TSA recognizes that local law enforcement do not always immediately notify owner/operators when there is a security-related incident on the owner/operator's property or affecting their operations.

One of the required training elements includes how to appropriately report security issues.

C. Methods for Reporting Information and Substance of Information Provided (§ 1570.203 (a) and (c))

As previously noted, TSA has almost a decade of experience with incidents reported by railroads. Based on this experience, TSA recognizes that its ability to analyze the data and improve

the quality of information disseminated back to its stakeholders is proportional to the quality of information it receives. Section 1570.203(b) is consistent with the reporting requirements as promulgated in 2008, which reflected the need for detailed and verified information from individual owner/operators to enhance TSA's ability to provide timely and useful information products to all of the relevant stakeholders.

TSA is working on two initiatives that should assist owner/operators with reporting information. The first is to pilot an electronic reporting option for significant security concerns.

If made a permanent capability, TSA intends to develop an online form that owner/operators, or their designated employees, may use to submit information to TSA to meet the requirements of this rule. If the pilot succeeds, TSA may pursue a second initiative to provide an electronic reporting form on a secure website. TSA will provide updates on development of these capabilities to owner/operators through the designated security coordinators as well as appropriate notices in the

Federal Register

. Pending completion of these capabilities owner/operators and their designated employees are generally required to meet the requirements of this section by contacting the Transportation Security Operations Center at 1-866-615-5150. There is an exception for owner/operators participating in the pilot to report electronically.

See

OMB Control No. 1652-0051, 30-Day Notice:

Revision of Agency Information Collection Activity Under OMB Review: Rail Transportation Security,

83 FR 40542 (Aug. 15, 2018), and related supporting statement available at

https://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201809-1652-002

IV. Security Program Procedures

A. Deadlines Related to Submission and Approval of Security Training Program

Section 1570.109 identifies the required deadlines for submitting security training programs and the process for TSA approval. In general, not later than 90 days from the effective date of this final rule, owner/operators are required to submit programs to TSA in a form and manner prescribed by TSA. Owner/operators commencing new businesses or operations triggering applicability are required to submit their security training programs to TSA no less than 60 days before commencing operations.

TSA will provide details for submission of security programs directly to security coordinators identified under section 1570.201, within 10 business days from the effective date of this final rule. Consistent with comments received on the NPRM, this information will include the designated email address and any related information regarding submission of Sensitive Security Information (SSI).

As required by the 9/11 Act, TSA will review the programs within 60 days of receipt and either approve them or specify changes that are needed for approval.

If TSA requires changes, the owner/operator must submit a modified training program that meets TSA's specifications within 30 days of notification by TSA. TSA provides an analysis of burden and estimated costs associated with this information collection in section VIII.A. of this preamble and the Office of Management and Budget (OMB) 83-I Supporting Statement for its information collection request, which is available in the docket for this rulemaking.

See

9/11 Act secs. 1137(d)(2), 1167(d)(2), and 1184(d)(2), codified at 6 U.S.C. 1137, 1167, and 1184.

B. Amendments

Procedures related to revision and/or amendment of security training programs, as described in §§ 1570.113, 1570.115, and 1570.117, are necessary as part of developing a regulatory program and are consistent with the 9/11 Act's requirements for implementation and submission of programs. These procedures are also consistent with TSA's statutory authority to allow exemptions from regulatory requirements.

The rule provides for two types of amendments: (1) Amendments initiated by owner/operators and (2) amendments initiated by TSA.

See

49 U.S.C. 114(q).

1. Amendments Initiated by Owner/Operator (§ 1570.113)

Under section 1570.113, there are three situations which require owner/operators to submit a request to amend their security training programs: (1) Changes affecting ownership or control of the operations; (2) changes to conditions affecting security; and (3) changes to content in the security training program. Owner/operators must seek an amendment if any of these changes are expected to have a duration of more than 60 days.

Amendments related to changes in ownership/control are necessary for TSA to maintain current information about relevant contacts as well as for purposes related to enforcement and liability. Amendments related to the second and third categories are necessary to ensure the training programs are providing relevant and timely information to security-sensitive employees.

This final rule revises the NPRM's proposed requirement for seeking an amendment for any changes relating to “measures, training, or staffing described in the security program.” Since publication of the NPRM, TSA determined that the scope of this requirement is too broad as it could capture measures relevant to security in general, such as theft. As proposed, the requirement could impose an unnecessary burden on owner/operators and create conflict between the programmatic requirements. For example, the overly broad requirement for amendments could result in the need to revise a security training program to address issues not related to reducing the risk of terrorism-related incidents.

To narrow the scope of the amendment requirement, the final rule incorporates a specific list of the types of changes to security that require an amendment. For purposes of identifying what types of changes should be included in the list, TSA determined the most appropriate source is the 9/11 Act's requirements for TSA to issue a vulnerability assessment and security planning regulation for surface owner/operators.

The 9/11 Act's provisions are tailored to security issues related to reducing the risk of terrorism-related incidents.

As previously discussed, the 9/11 Act includes a mandate for TSA to issue regulations requiring vulnerability assessments and security plans in addition to the requirements for security training.

See

9/11 Act sections 1405, 1612, and 1531, codified at 6 U.S.C. 1134, 1162, and 1181, respectively. The security planning requirements include a detailed list of security measures that must be incorporated into an owner/operator's TSA-approved security plan. TSA intends to address the vulnerability assessment and security training requirements through a separate rulemaking.

If an owner/operator makes any changes to the security measures identified in § 1570.113, the owner/operator must request an amendment to modify the TSA-approved security training program to align with these changes. In general, the program must be amended if there are changes to procedures intended to prevent and detect unauthorized access to restricted areas; measures to be implemented in response to periods of heightened security risk; and changes to emergency response plans.

The security program requirements established by this rulemaking will also be applicable to a future rulemaking to address the 9/11 Act's requirements for

vulnerability assessments and security planning. As a result, incorporating the 9/11 Act's list of security measures to be incorporated in security planning as the basis for determining when an amendment is necessary to a security training program establishes a framework that can be consistently applied in the future as the scope of requirements for higher-risk owner/operators of surface transportation systems is expanded.

See

discussion

supra

in n. 42

Finally, owner/operators must request an amendment if their security training program is modified, including modifications related to addressing the effectiveness of the program or development of recurrent training materials that differ from the initial training. This provision is intended to ensure an owner/operator is appropriately addressing the results of its TSA-approved method for determining effectiveness of security training.

It is TSA's intent that this specificity will reduce the burden for owner/operators by providing clarity on the types of changes that may trigger the need for an amendment. If there are any changes in these areas, it is reasonable to expect that some aspects of the security training program must be revised.

See

requirements in subpart B to parts 1580, 1582, and 1584.

In addition to the preceding issues that require owner/operators to request an amendment, the same procedures can be used when the owner/operator seeks to amend its program to address other operation issues. For example, an owner/operator may choose to seek an amendment to modify the required training schedule. The same procedural requirements for seeking an amendment apply.

TSA may approve an amendment if it is in the interest of public and transportation security and meets the required security standards. As part of its standard practice for security program administration, TSA works with owner/operators on amendment requests to develop options acceptable to both TSA and the requesting owner/operator. TSA may ask for additional information from the owner/operator or require more time in order to makes its determination.

If TSA is unable to come to agreement with the owner/operator on the content or scope of the amendment, TSA may deny the amendment request. The denial will include a statement of why the request is denied. The owner/operator can petition for reconsideration under section 1570.119.

While the rule only requires amendments if the change is to be permanent (defined as 60 or more calendar days), TSA recognizes that there are times when a change of short duration could have a significant impact on training. For example, if a city is hosting a National Special Security Event (NSSE), the public transportation system serving that city may implement additional security measures. It is likely that additional training will be necessary to raise appropriate awareness of these additional measures. The rule does not require the owner/operator to request an amendment to provide this additional training.

TSA is also modifying the schedule for submitting an amendment from the requirement as proposed in the NPRM. Under the NPRM, an amendment had to be submitted no later than 45 days before the change takes effect. This schedule does not work with the provision that allows changes to security measures to be in effect for 60 days before they are considered permanent, and only permanent changes require notification and amendment. To address this inconsistency, TSA is requiring amendments to be submitted within 65 days of the change. As the owner/operator controls changes to the security measures identified in the rule and whether these changes will be permanent, it is presumed the owner/operator will have sufficient advance notice that an amendment is needed and can prepare and submit the request within this timeframe. This specificity is added to provide clarity for compliance.

2. Amendments Initiated by TSA (§ 1570.115)

TSA may require amendments in the interest of the public and transportation security. As indicated in § 1570.115, TSA may require owner/operators to revise their training based on emerging threats or methods for addressing emerging threats. This is consistent with TSA's authorities under 49 U.S.C. 114 and the 9/11 Act, which specifically provide that TSA must update the requirements, as appropriate, “to reflect new or changing security threats.”

For example, the curriculum requirements identified in the 9/11 Act do not address training to respond to active shooter incidents. Following several active shooter incidents, including one that resulted in the death of a Transportation Security Officer in Los Angeles, Congress prioritized the need for this type of training.

TSA could also require an amendment to provide additional training to address risks like the NSSE discussed above, in section C. As with other requirements imposed by TSA, the owner/operator may request a petition for reconsideration of TSA-required amendments.

See

9/11 Act at 1408(d)(4), 1517(d)(4), and 1534(d)(4), codified at 6 U.S.C. 1137, 1167, and 1184, respectively. This provision also requires owner/operators change their programs to address TSA's requires updates and retrain employees as necessary, within a reasonable time.

Section 7 of the

Gerardo Hernandez Airport Security Act of 2015

(Pub. L. 114-50), which directed TSA, in consultation with the Department of Transportation and other relevant agencies, to conduct outreach to all passenger transportation agencies and providers of high-risk facilities to verify such agencies and providers have in place plans to respond to active shooters, acts of terrorism, or other security-related incidents that target passengers.

C. Alternative Measures (§ 1570.117)

Section 1570.117 includes the procedures for requesting a waiver, procedures for requesting the use of alternative measures, and identification of the types of information TSA will need in order to make a decision to grant such requests. TSA may grant such a request under the authority 49 U.S.C. 114(q), based on a determination that the alternative measure or exemption is in the public interest. In general, TSA will consider factors such as risk associated with the type of operation, current threat information, and any other factors relevant to potential risk to the public and transportation security if the request is granted.

These procedures can be used by an owner/operator to request alternative measures to satisfy all of some or all of the requirements of subchapter D. For example, the owner/operator could request to extend the time period for submitting its training program or for training all of its security-sensitive employees. An owner/operator could also request a waiver from some or all of the regulatory requirements. For example, a freight railroad may meet the criteria for applicability, but the operations that trigger applicability may be a

de minimis

part of its overall business operations. In such a situation, the owner/operator might consider requesting either a complete waiver or an alternative that limits the requirements to a more discrete part of its business.

D. Petitions for Reconsideration (§ 1570.119)

Section 1570.119 describes the review and petition process for TSA's reconsideration when it denies a request for amendment, waiver, or alternative measures, as well as a TSA requirement

to modify or amend a program. If an owner/operator seeks to challenge the decision, the owner/operator is required to submit a written petition for reconsideration within the time frame identified in the applicable section. The petition must include a statement, with supporting documentation, explaining why the owner/operator believes the reason for the denial or for the amendment, as applicable, is incorrect. If the owner/operator requested the amendment, the results of the reconsideration could be confirmation of TSA's previous denial or approval of the proposed amendment. If the issue involves a TSA-required amendment, the results of the reconsideration could be withdrawal, affirmation, or modification of the amendment. A disposition pursuant to 49 CFR 1570.119 occurs when the Administrator or designee has disposed of the petition by affirming, modifying, or rescinding the previous decision. Such disposition constitutes a final agency action for purposes of review under 49 U.S.C. 46110.

E. Recordkeeping Requirements (§ 1570.121)

The final rule requires owner/operators to create and maintain lists of their security-sensitive employees and specify when these employees received the required training. Training records must include each trained employee's name, job title or function, date of hiring, and date and course information on the most recent security training that each employee received. Records for individual employees must reflect the training courses completed and date of completion. Records of an employee's initial and recurrent training must be maintained by owner/operators for no less than five years from the date of the training and available at the location(s) specified in the security training program approved by TSA.

The final rule provides flexibility to owner/operators to decide whether to maintain the records in electronic format provided that (1) any electronic records system used is designed to prevent tampering, loss of data, or corruption of records, and (2) paper copies of records, and any amendments to these records, must be made available to TSA upon request for inspection or copying. Whether the records are kept in electronic or other form, the employee must be provided with proof of training upon request, at any time during the three-year recordkeeping period, without regard to the requestor's current status as an employee of that entity. As discussed above in II.J. (Initial Training), owner/operators may meet the proof-of-training requirement by providing a certificate, letter, or other similar documentation to the employee upon completion of training. In order for TSA to allow any owner/operator to rely upon previous security training to satisfy the requirements of this rule, it is critical that employees be able to validate whether they received previous training.

TSA assumes training records are unlikely to include SSI, but nonetheless provides a reminder in this provision that any SSI maintained as a result of these recordkeeping requirements must be maintained consistent with the requirements in 49 CFR part 1520. For example, an owner/operator may decide to keep a copy of the content of the training program with the employee files (which is not required by the rule). If the curriculum contains SSI information, any file it is in must be stored as required by the SSI regulations. Owner/operators needing additional information about appropriately maintaining SSI may contact TSA for assistance and/or find information on TSA's website.

See https://www.tsa.gov/for-industry/sensitive-security-information.

F. Summary of Deadlines

The following table summarizes the deadlines for the preceding programmatic requirements. The information is provided for operations that exist on the effective date of this rule and those that may commence or trigger applicability based on future modifications.

Table 3—Summary of Deadlines for Compliance

Requirement

Dates

Existing operations

New or modified operations

New employees (hired after TSA approves the security program)

Effective date of rule

June 22, 2020

Deadline for notifying TSA of applicability determination (1570.105)

July 22, 2020

90 calendar days before commencing new or modified operations

Deadline for providing security coordinator information to TSA (1570.201)

July 29, 2020

7 calendar days after commencement of operations

Deadline for submission of security training program to TSA for approval (1570.109(b))

90 calendar days from effective date

90 calendar days after commencing new or modified operations

TSA approval or notification of required modification (1570.109(c))

60 calendar days from receipt of security training program

Initial training of security-sensitive employees (1570.111(a))

1 year from TSA approval of security training program

60 calendar days after employee first performs a security-sensitive job function (60th day, aggregated over 12-month period, if intermittent employee).

Recurrent training of security-sensitive employees (1570.111(b))

Within three-years of the date of initial training and every three-years thereafter

Within 90 days of changes to security program or security plan affecting employees' security-related responsibilities

V. Miscellaneous Changes

This final rule includes the following changes to other provisions in TSA's regulations as necessary to implement these requirements.

A. Amendments to Part 1500

Consistent with the rule's organization, TSA includes definitions for terms relevant to several subchapters of TSA regulations, beyond the requirements of subchapter D, in part 1500. Terms only relevant to the provisions in subchapter D are incorporated in § 1570.3. Terms uniquely relevant to each mode or the other requirements in subchapter D are incorporated into the relevant parts.

As noted in the NPRM, TSA is meeting a 9/11 mandate to define, through notice and comment rulemaking, the term “security-sensitive material.” To meet the requirement, TSA is incorporating by reference the definition of hazardous materials for which a security program is required under 49 CFR 172.800(b), promulgated by PHMSA through notice and comment rulemaking and in consultation with TSA.

There are no current TSA-programmatic requirements linked to this definition. A full discussion of amendments to the terms in part 1500 is provided in the NPRM.

See

81 FR at 91344.

See

section III.A. of the NPRM. 81 FR at 91342

et seq.

B. Amendments to Part 1503

TSA is making minor amendments to part 1503 (Investigative and Enforcement Procedures), as necessary, to conform these regulations to changes made by this final rule. In § 1503.101(b), the scope of statutory provisions is amended to add authorities from the 9/11 Act that are administered by the TSA Administrator. These are conforming amendments with no cost impact.

C. Amendments to Part 1520

TSA is also finalizing proposed modifications to part 1520 (Protection of Sensitive Security Information). As discussed in the NPRM, these changes are necessary to conform the SSI provisions to include the transportation security-related requirements in this rule.

The amendments are limited to: (1) Eliminating unnecessary terms from part 1520 that are added to part 1500 and (2) replacing the limiting term “rail transportation security requirement” with “surface transportation security requirement.” In some places, such as the definition of “vulnerability assessment” in § 1520.3, TSA is streamlining a lengthy description of types of transportation to simply state “aviation, maritime, or surface transportation.”

See id.

at 91343-91345.

The impact of these revisions should also be minimal. Under § 1520.7(j), any person who has access to SSI is required to protect it according to the requirements of the regulation. Most of the population affected by this rule has previously received SSI information from TSA, as well as training on the proper handling of SSI, and have procedures in place to ensure the requirements of the regulation are met.

See https://www.tsa.gov/for-industry/sensitive-security-information.

D. Amendments to Part 1570

Because of the significant restructuring of part 1570, as discussed above, the rule text includes the entire part. In addition, TSA is adding a provision related to security responsibilities and relocating to this part the provisions related to compliance, inspection, and enforcement (previously in part 1580).

1. Security Responsibilities for Employees and Other Persons (§ 1570.7)

Under § 1570.7, the obligation for compliance is not limited to owner/operators specifically referenced under applicability provisions. Rather, any person may be held to have violated these rules, including contractors who provide service to owner/operators and the employees of such contractors. This provision in subchapter D ensures a uniform application of TSA's enforcement policy across all modes of transportation, consistent with TSA's authority under 49 U.S.C. 114(f).

In addition to violations for failure to comply with requirements, TSA can also pursue enforcement actions for interfering with compliance or hiding evidence of non-compliance. Contractors are also subject to inspection for compliance with this rule and enforcement actions, as discussed below.

See

49 U.S.C. 114(f)(7) and (11). A similar provision applicable to aviation employees and other related persons is in 49 CFR 1540.105(a)(1) and (b).

2. Compliance, Inspection, and Enforcement (§ 1570.9)

TSA is mandated to: (1) Enforce its regulations and requirements; (2) oversee the implementation and ensure the adequacy of security measures; and (3) inspect, maintain, and test security facilities, equipment, and systems for all modes of transportation.

This mandate applies even in the absence of rulemaking, but TSA has chosen to include a restatement of its authority in its rules. The statute specifically requires TSA to—

See

49 U.S.C. 114(f).

• Assess threats to transportation;

• Enforce security-related regulations and requirements;

• Inspect, maintain, and test security of facilities, equipment, and systems;

• Ensure the adequacy of security measures for the transportation of cargo;

• Oversee the implementation, and ensure the adequacy, of security measures at airports and other transportation facilities;

• Require background checks for airport security screening personnel, individuals with access to secure areas of airports, and other transportation security personnel; and

• Carry out such other duties, and exercise such other powers, relating to transportation security as the Administrator considers appropriate, to the extent authorized by law.

While current part 1570 includes a provision stating TSA's compliance, inspection, and enforcement authority, it is not provide the same detail found in other regulatory provisions.

Therefore, TSA is transferring the text of current § 1580.5 to subpart A as § 1570.9, with minor modifications to reflect the addition of certain bus operations that have previously been unregulated by TSA.

Compare current § 1570.11 with current § 1580.5. The provision in part 1580 is also consistent with 49 CFR 1542.5, 1544.3. 1546.3, 1548.3, and 1549.3.

A more detailed discussion of current § 1580.5, still relevant to the section, can be found in the preamble for current part 1580.

See

71 FR 76852 (Dec. 21, 2006) and the Rail Security Rule,

see supra

n. 8. (Final Rule).

3. “Covered Person” (§ 1570.305)

This final rule includes a technical correction to § 1570.305 (currently § 1570.13) of subchapter D as part of this rulemaking. This provision prohibits public transportation agencies and rail carriers from knowingly misrepresenting Federal guidance or regulations related to security background checks for certain individuals.

The definitions in the section currently include the term “covered individual,” which may result in confusion as to whether the term has the same meaning as “covered person” in TSA's programs to address access to SSI.

To eliminate any potential for confusion, this rule amends § 1570.305

to delete the definition and consistently use the term “employee” (as defined by this rulemaking in § 1570.3) rather than “covered individual.” This change is for clarification purposes only and has no substantive impact.

This final rule moves this section from § 1570.13 of subchapter D to section § 1570.305. The requirement was added to address another 9/11 Act requirement.

See

73 FR 44665 (July 31, 2008) for more information on the rulemaking that added this provision.

See

49 CFR 1520.7.

VI. Summary of Changes

The following table summarizes changes between the NPRM and final rule.

Table 4—Summary of Changes Between NPRM and Final Rule

Section No.

Section title

Change from NPRM

Implication

1570.111(b)

Implementation schedules (recurrent security training)

In response to comments, TSA is modifying the recurrent security training schedule to a three-year cycle rather than annual. Changes to security programs and plans may require training certain employees within 90 days of the changes

Cost Savings.

1570.113

Amendments requested by owner/operator

NPRM proposed requiring owner/operators to request an amendment to their security training programs when there are changes to (a) ownership or control of operations and/or (b) measures, training, or staffing described in the security program. The final rule includes a specific list of the types of changes that would trigger the need to update the security training program. The NPRM also proposed to require an amendment to be filed within 45 days before the amendment takes effect. The final rule requires an amendment to be requested no later than 65 days after the change to the security program/measures/plans takes effect

TSA recognizes that some owner/operators may have security programs that address issues not related to transportation security, such as theft or vandalism. TSA is narrowing the scope of the requirement to reduce the burden. The final rule identifies the types of issues that would require amendment. The list of issues used by TSA is consistent with the requirements for security plans in sections 1405, 1512, and 1531 of the 9/11 Act. Modifying the deadline for requesting an amendment is intended to provide clarity for compliance and be more appropriate for the types of amendment-requests TSA expects to receive.

1570.201

Security coordinator

NPRM proposed requiring all public transportation agencies to have a security coordinator. Final rule limits the scope of the requirement to rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk

The scope of this requirement in the NPRM was broader than TSA intended as the result a drafting error. TSA intended the security coordinator requirement to apply to all of the rail operations and shippers/receivers covered by the Rail Security Rule, plus bus operations required to provide security training under this rule.

1570.203

Reporting significant security concerns

NPRM proposed requiring all public transportation agencies to report security issues. Final rule limits the scope of the requirement to rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk

The scope of this requirement in the NPRM was broader than TSA intended as the result of a drafting error. TSA intended the reporting requirement to apply to all of the rail operations and shippers/receivers covered by the Rail Security Rule, plus bus operations that are required to provide security training under this rule.

1570.305

False statements regarding security background checks by public transportation agency or railroad carrier

TSA is making a technical correction to this provision by replacing the term “covered individual,” with the term “employee,” which is defined by this rulemaking in § 1570.3

This technical revision eliminates potential confusion in the terminology.

VII. Response to Comments on NPRM

Following TSA's publication of the NRPM on December 16, 2016, industry associations, unions, and private citizens were among those who submitted comments in docket TSA 2015-0001. TSA's responses are organized by topic.

A. General Comments

1. Need for Rule

Comments endorsing the rulemaking and recommending an expanded scope:

A number of submissions included a statement of general support for TSA to issue this rulemaking. Commenters also endorsed the rule, noting that proper training could prevent harm to both employees and passengers. A few commenters suggested expanding the scope of the rulemaking to include additional training for surface workers, such as self-defense training, or to provide training to all American citizens to identify terrorist threats. One commenter supported a “community of the whole” approach, reflecting the collaborative and cooperative partnership between TSA and industry to detect and deter individuals seeking to commit acts of terrorism.

TSA response:

This rulemaking is intended to solidify a baseline of security training. Promulgation of this rule does not signal a change in TSA's commitment to maximize enhancements to surface transportation security through voluntary cooperation and collaboration. Consistent with this commitment, TSA does not believe it is necessary to expand the scope of applicability or requirements, but encourages owner/operators to provide additional security training as they consider appropriate to address potential vulnerabilities or threats within their unique operational environments. As noted in the NPRM, TSA encourages owner/operators covered by this rule to determine

whether there are employees not covered by the scope of the security-sensitive definition who could provide benefits to security if trained.

Regarding the recommended expansion of the rule to cover broader populations, including the general public, DHS has numerous programs and initiatives to provide and encourage awareness of terrorist threats and appropriate responses. These initiatives include “hometown security” and the “See Something, Say Something” campaign. More information on these initiatives and training available to support them can be found on the DHS website.

TSA also encourages owners/operators not within the scope of the rule's applicability to voluntarily provide security training to their employees, using the curriculum requirements in this rule to guide development of voluntary security training programs. As noted in section II.A., TSA also intends to provide resources developed to support this rule to other owner/operators, as appropriate.

See www.dhs.gov/hometown-security

and

www.dhs.gov/see-something-say-something.

Comments opposing rulemaking:

Other commenters opposed the rulemaking, primarily because they believe certain modes already conduct training, and asserted these efforts make the rulemaking unnecessary. Three commenters expressed concern the rule overlaps with existing State and Federal training requirements, including the FRA's 2014 final rule, which established minimum training standards for all safety-related railroad employees.

One commenter suggested States may have different requirements, which should be considered in this rulemaking. Several commenters advocated for the rule to be voluntary, and noted voluntary training has so far produced exceptional results.

See

79 FR 66460 (Nov. 7, 2014), codified at 49 CFR part 243.

TSA response:

As previously discussed, TSA has a statutory mandate to publish a final rule requiring security training for frontline employees of public transportation agencies, railroads, and OTRB owner/operators.

The statutory mandate includes specific requirements for the content of the required security training. In addition, TSA determined it is necessary to require security training for employees of higher-risk surface transportation operations and appropriate to use its general authority under ATSA to issue a rule including these requirements.

See

discussion in section I.A. of this rule.

See also

81 FR 91341 (discussion of statutory authorities and requirements for this rulemaking).

See

81 FR 91339-91341 (discussion of purpose and authorities).

The terrorism-related threat to surface transportation modes has not subsided and Congress has not retreated from its commitment to the need for this rule. Since enactment of the 9/11 Act, Members of Congress and the DHS Office of the Inspector General (OIG) have expressed continued interest in the publication of this rule.

This rulemaking is intended to solidify the baseline for security training of surface employees. TSA recognizes the substantial efforts of our stakeholders to enhance their security posture since 9/11 and seeks to recognize and build upon these efforts. As noted in the NPRM, owner/operators subject to requirements to provide similar training may request to use this training to satisfy requirements in this rule. For example, TSA is aware that many public transportation agencies and railroads currently provide security training to comply with State or Federal training requirements. (TSA is not aware of any overlapping requirements for OTRB owner/operators.) If an owner/operator intends to use previous training or existing training programs in order to satisfy some or all of the requirements of this rule, the program submitted to TSA for approval must identify how the other training satisfies TSA's requirements. This will likely necessitate submitting the curriculum or lesson plan for that program and training records, as well as information on the employees who have completed the training and the date of the most recent training.

Regarding voluntary training, TSA acknowledges many owner/operators of higher-risk surface transportation operations have voluntarily implemented security training programs addressing some of the requirements in this rule. As noted in the

Preliminary Regulatory Impact Analysis and Initial Regulatory Flexibility Analysis

(NPRM RIA), however, the private market may not provide adequate incentives for owner/operators to make an optimal investment in the full range of measures to reduce the probability of a successful terrorist attack based on the economics of externalities. Mandating security training for higher-risk operations will solidify the current baseline of security training established through voluntary measures.

See

NPRM RIA at 116-117 (available in the docket to this rulemaking at

www.regulations.gov

2. Cost of Rule

Comments:

Some commenters expressed concern that the cost of the rulemaking is too high, and that the rule is too costly for industry to implement. Commenters also asserted the estimate of OTRB owner/operators is too low, and questioned whether TSA's cost-estimate analysis considers the Unfunded Mandate Reform Act of 1995 (UMRA).

One commenter generally suggested that the expense of providing security awareness training to surface transportation personnel may not be justified by the potential benefits. Another commenter, a mass transit agency in a large metropolitan area, estimated the cost of the rule to be higher than the estimate TSA provided in the NPRM RIA.

Public Law 104-4, 109 Stat. 48 (Mar. 22, 1995), codified at 2 U.S.C. 1501-1538.

TSA response:

A full discussion of the cost-benefit analysis is included in the

Final Regulatory Impact Analysis and Regulatory Flexibility Analysis

(Final RIA)

and summarized in section VIII.B.1. While training and the other requirements of this final rule are not absolute deterrents for a terrorist intent on carrying out attacks on surface modes of transportation, TSA expects the probability of success for such attacks to decrease when the requirements of this rule are fully implemented.

The Final RIA is available in the docket for this rulemaking at

www.regulations.gov.

Regarding the commenters concerns that TSA's estimate of OTRB owner/operators within the scope of applicability is too low, TSA acknowledges the inherent uncertainty in this estimate due to the fluid and opaque nature of the industry. As described in the Final RIA, “many [OTRB] owner/operators that operate charter and/or tour services also provide scheduled or fixed-route services, sometimes on an ad hoc basis, making it difficult for any one source to keep track of those that may provide scheduled service as part of their non-primary operation.”

In response to the issue of disparate data, TSA consulted multiple sources and databases to build its estimate.' The commenter who stated the OTRB estimate was too low did not provide any reason to support the claim that TSA underestimated the number of affected owner/operators or any source/

data to back up the assertion. As mentioned in the NPRM RIA, TSA sought public contribution to refine its estimate, but neither the commenter nor anyone else provided any data or new information on which to build a different estimate.

Id.

at 40. Note: Under the requirements of this rule, any owner/operators conducting ad hoc or sub-contracted service for a regulated person must comply with the requirements of the rule as an authorized representative. Similarly, an owner/operator not subject to the requirements of the rule may trigger applicability if they contract for ad hoc or subcontracted service through an area that triggers applicability.

Title II of UMRA, establishes requirements for Federal Agencies to assess the effects of their regulatory actions on State, local, and tribal governments and the private sector.

Agencies must prepare a written statement, including a cost-benefit analysis, for proposed and final rules with “Federal mandates” that may result in expenditures by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year.

TSA's analysis for both the NPRM RIA and Final RIA determined this rule does not contain a Federal mandate that may result in expenditures of $100 million or more either for State, local, and tribal governments in the aggregate, or for the private sector in any one year.

See supra

n. 63.

Id.

at sec. 202, codified at 2 U.S.C. 1532. The $100 million in 1995 dollars is adjusted for inflation to 2017 dollars using the GDP implicit price deflator for the U.S. economy. Bureau of Economic Analysis,

National Data,

Table 1.1.4. Price Indexes for Gross Domestic Product, Line 1 Gross domestic product. Available at:

https://apps.bea.gov/iTable/iTable.cfm?reqid=19&step=2#reqid=19&step=2&isuri=1&1921=survey.

The commenter who stated security awareness training may not be justified by the potential benefits did not provide data to support this assertion. Based upon the data available to TSA, as shown in the Final RIA, TSA disagrees with the commenter. In both the NPRM and Final RIA, TSA includes a chapter, titled “Benefits of Employee Security Training,” which identifies the security risks to surface transportation and explained how providing employees with the knowledge to prepare, observe, assess, and respond to a terrorist related threat or incident reduces the vulnerability to a terrorist attack. In addition, TSA conducted a break even analysis that compared the cost of the surface training program to the direct economic losses that would be averted by avoiding certain terrorist attack scenarios. Given the relative small costs of implementing training compared to the catastrophic costs of a successful terrorist attack, this analysis found that the rule would only have to deter, at minimum, one attack every 40 years for the benefits to equal costs for freight rail, a number that increases to one attack every 166 years for OTRBs.

The monetized benefits of preventing an attack would likely be greater were TSA to conduct a break even analysis that accounts for the difficult-to-estimate macroeconomic and other indirect impacts (avoided indirect costs) that may be even more significant than the direct impacts of the attack. Avoided consequences, such as the value of a reduction in fear felt by the public at large, are not included in the analysis because they are difficult to measure and quantify. Given these results and the demonstrated effectiveness of employee training—including security awareness in mitigating terrorist attacks

—TSA believes the benefits of the rule justify its costs. Finally, as previously discussed, TSA is under a statutory mandate to publish a final rule requiring security training for frontline employees of public transportation agencies, railroads, and OTRB owner/operators.

See

Final RIA at Section 4.3.

See id.

at Section 4.1 (full summary of the threat to surface transportation and an example of security training effectiveness).

One commenter, from a large metropolitan area public transportation system, provided information to support statements that the costs of implementing the rule would be higher than TSA estimated in the NPRM RIA for that commenter. TSA believes there are a number of issues with the commenter's estimate that result in an overestimation of the rule's burden. The commenter assumed the duration of training to be three hours when TSA estimates that training for security-sensitive employees of a PTPR owner/operator will likely average 1 hour and 20 minutes in order to address all of the required elements in this rule.

The commenter appears to base their three hour estimate on an assumption that a classroom setting and development of original course material is necessary. As further discussed below in section VII.D., TSA is not requiring instructor or classroom training and will further mitigate costs by providing a video, free of charge, to regulated owner/operators for compliance with the parts of the rule. TSA intends for this material to cover three of the four PTPR training elements in the rule and take less than one hour.

See

Final RIA at Section 2.4 for an explanation and rationale to why TSA estimates 1 and 20 minutes needed to train mass transit agencies' security-sensitive employees on the training components of the final rule.

Finally, the commenter comes from one of the largest metropolitan areas in the United States with one of highest costs of living. This leads TSA to believe that the estimate provided by the commenter is likely higher than the national average of transit agencies. TSA used national wage data for transit agencies from the Bureau of Labor Statistics to estimate cost of the rule to PTPR owner/operators. TSA believes this is a reasonable rate to calculate incurred costs to regulated PTPR owner/operators because it encompasses the entire transit industry (which are typically found in cities around the country). Based on this analysis, TSA believes its cost-assessment for the final rule is representative of the incremental burden PTPR owner/operators will incur from implementing the regulatory requirements at a national level. However, TSA does acknowledge that differences in the cost of labor among the various cities may contribute to certain transit agencies having higher or lower costs than the national average.

3. Stakeholder Consultation

Comments:

Several commenters suggested TSA consult with labor unions in drafting the rulemaking, as required by the 9/11 Act, and also reach out to international security experts.

TSA response:

The 9/11 Act directed TSA to consult with major stakeholders during the development of the NPRM, including labor organizations. As noted and summarized in the NPRM, TSA conducted numerous meetings and conference calls with all necessary parties, including relevant labor organizations.

In addition to inviting participation of labor union representatives in many of the mode-specific meetings, TSA also met directly with labor unions as part of its stakeholder consultation process, including the Transportation Trades Department of the American Federation of Labor and Congress of Industrial Organizations, the International Brotherhood of Teamsters, the Brotherhood of Locomotive Engineers, and the Amalgamated Transit Union.

See

81 FR 91336 at 91368-91370.

See id.

at 91370.

International outreach is also a key component of TSA's transportation security mission. TSA surface representatives partner with the international community through a number of forums, such as INTERPOL, European Network of Railway Police Forces (RAILPOL), and the United Nations led International Working Group Land Transport Security (IWGLTS). These meetings include a regular exchange of lessons learned in addressing emerging threats within the surface transportation environment.

4. Terms

Comments on definition of “transportation security-sensitive materials (TSSM)”:

Several commenters

asked for clarification regarding how the TSSM definition applies to motor coaches, and suggested industry aid TSA in determining what should qualify as TSSM. One commenter asked TSA to provide handling and storage information regarding TSSM specific to the motor coach industry.

TSA response:

As noted in the NPRM, TSA is satisfying a 9/11 Act requirement to define TSSM

by incorporating by reference the hazardous materials identified in 49 CFR 172.800(b). There are no specific requirements in the rule related to the definition. To the extent there are requirements associated with the materials identified in 49 CFR 172.800(b), persons should consult 49 CFR part 172, the hazardous materials rules promulgated by PHMSA. The PHMSA rules include security requirements related to these specific materials. The PHMSA requirements were promulgated through notice and comment rulemaking, including participation by relevant stakeholders in developing the list of materials.

Id.

at 91344.

Comments on definition of “host railroad”:

One commenter asserted the definition of “host railroad” is confusing. Additionally, the commenter noted TSA's expectations of the railroads responsible for ensuring training of employees in “host” situations are unclear, as railroads currently train employees under existing training programs.

TSA response:

As noted in the NPRM,

TSA is defining “host railroad” consistent with the definition well-established by use for the rail industry under rules of the FRA.

Under this rule, both the host and tenant railroads are required to have a training program that appropriately addresses the ramifications of the hosting relationship. For example, the host railroad's training program will need to address the operational considerations of the hosting relationship, such as training dispatchers on their role and responsibilities in halting the tenant railroad's operations over a segment of track where there is a potential threat (such as a suspected IED or tampering with infrastructure). Similarly, a tenant railroad subject to the security training requirements of 49 CFR part 1582 (PTPR), will need to address the operational considerations of the hosting relationship, such as instructing its train and engine employees on the proper communication procedures to follow when a potential threat is identified. Under either example, the host and tenant railroad owner/operators will only be responsible for training their own employees.

Id.

at Table 3,

Explanation of Proposed Terms and Definitions.

See

49 CFR 236.1003.

When inspecting for compliance by regulated parties participating in a contractual relationship, TSA will consider the freight railroad carrier (the private company) to be an authorized representative of the PTPR owner/operator (the owner/operator of the passenger train service). TSA will hold the PTPR owner/operator primarily responsible for compliance and for ensuring that all security-sensitive employees receive the required training, whether they are employed directly by the PTPR owner/operator or contractor. The PTPR owner/operator must train the freight railroad carrier's employees performing security-sensitive functions related to the passenger train service.

See supra,

section II.A.4 for more discussion on the distinction between hosting and contractual relationships and the ramifications for responsibility of providing security training.

B. Investigative and Enforcement Procedures

Comments on penalties and violations under 49 CFR part 1503:

Several commenters requested clarification regarding the exact penalties for non-compliance, and others asked TSA to explain the basis of violations.

TSA response:

The 9/11 Act included authority for TSA to assess civil penalties for violations of title 49 of the U.S. Code, including surface transportation requirements.

TSA posts, and regularly updates, its sanction policies on its website.

Between this rule's date of publication and effective date, TSA will update this policy to address violations of this rule.

See

sec. 1302(a) of the 9/11 Act. TSA is issuing this rule under the authority of 49 U.S.C. 114.

See https://www.tsa.gov/sites/default/files/enforcement_sanction_guidance_policy.pdf.

Comments on compliance, inspection, and enforcement under 49 CFR 1570.9:

Several commenters expressed concern regarding how TSA will enforce the rule. One commenter suggested TSA and relevant DOT components should develop a cooperative enforcement program allowing DOT personnel to enforce TSA's security training requirements as they conduct their safety inspections. Several commenters suggested TSA coordinate with the owner/operator before an inspection, and one suggested that TSA provide an audit checklist before arriving on the owner/operator's property. Another commenter asked TSA inspectors to undergo safety training before visiting the property. Finally, one commenter suggested TSA consider an audit program for contractors, rather than making the owner/operator responsible for ensuring contractor receives training or otherwise comply with the rule's requirements.

TSA response:

As explained in the NPRM, TSA is mandated to: (1) Enforce its rules and requirements; (2) oversee the implementation and ensure the adequacy of security measures; and; (3) inspect, maintain, and test security facilities, equipment, and systems for all modes of transportation.

TSA's authority over transportation security is comprehensive and supported with specific powers related to the development and enforcement of security-related regulations and other requirements. Within this broad authority, the agency may assess a security risk for any mode of transportation and develop security measures for dealing with this risk.

If TSA identifies noncompliance with its requirements, TSA may hold the owner/operators responsible for the violation and subject to enforcement action, which may result in civil monetary penalties.

See

81 FR 91341,

citing

49 U.S.C. 114.

49 U.S.C. 114(f) and (l).

49 U.S.C. 114(f) and (v).

Pursuant to its statutory authority and responsibilities, TSA is the sole Federal agency with authority to enforce its regulations. DOT's components do not have authority to enforce TSA's rules and TSA cannot enforce theirs. DHS and DOT, however, do consult and coordinate with each other on security-related issues pursuant to various memoranda of understanding (MOU). To mitigate concerns about duplication of efforts by inspectors, DHS has entered into an MOU with DOT with separate annexes between TSA and the modal components of DOT. These annexes address coordination on regulatory matters.

When appropriate, TSA will coordinate with an owner/operator on inspections. Notice gives the parties to be inspected the opportunity to gather evidence of compliance and to arrange to have the appropriate personnel available to assist TSA. Some inspections, however, can only be effective if TSA's presence is unannounced. TSA must have the flexibility to respond to information, operations, and specific circumstances whenever they exist or develop.

Security concerns are different at different times of the day and on different days of the week. Terrorists may seek to take advantage of vulnerabilities whenever they occur.

TSA has the authority to assess the security of transportation entities during all times of the day or night and under all operational situations (including nights, weekends, and holidays). The nature of any given TSA inspection will depend on the specific circumstances surrounding a particular owner/operator at a given point in time and will be considered in conjunction with available threat information.

An audit checklist is unnecessary for this program. Under the rule, owner/operators are required to submit a security training program to TSA for approval. As the regulated owner/operators are the original drafters of the security training program approved by TSA, they should not need a checklist from TSA to inform them of the program's content and requirements. The use of TSA-provided training material does not eliminate the owner/operator's ownership of the program and knowledge of the program's contents. The security training program developed and submitted by the owner/operator to TSA for approval is likely to include additional information provided or developed by the owner/operator to meet all of the curriculum requirements.

Regarding having TSA inspectors undergo safety training prior to visiting a property, TSA's inspectors are properly trained regarding how to safely inspect an owner/operator's property and the importance of complying with official safety-related requirements while on the owner/operator's property. For example, TSA puts its inspectors through a rigorous training program, incorporating classroom and field training, so inspectors are knowledgeable on all aspects related to this regulatory program as well as on safety issues. TSA recognizes the importance of this training to ensure inspectors avoid danger to themselves, to workers on the inspected property, to travelers, and to the inspected property.

Finally, concerning the suggestion that TSA consider an audit program for contractors, in lieu of making the owner/operator responsible for ensuring contractor receives training, TSA applies two important regulatory policies related to responsibilities of contractors. First, contractors performing measures required under TSA's rules are “authorized representatives” of the regulated party.

As part of its general enforcement policy, TSA consistently holds regulated parties responsible for the actions of their authorized representatives.

See

the rule's definition of “authorized representative” in 49 CFR 1500.3.

Second, authorized representatives and other contractors (and their employees) are also responsible for complying with TSA's regulatory requirements. Under section 1570.7 of this rule, any person may be subject to enforcement action for violations of the rule, including contractors who provide service to owner/operators and the employees of such contractors. As a result, TSA could pursue an enforcement action against the regulated party, the regulated party

and

the contractor as an authorized representative, or against the contractor.

C. Part 1570—General Rules

1. Terms Used in This Subchapter (§ 1570.3)

Comments on definition of “security-sensitive employees”:

In addition to comments of general support for the definition of security-sensitive employee, TSA received a few questions about the term. One commenter sought more information on what defines an employee in a security-sensitive position, specifically asking whether the definition includes a cyber-expert or a frontline engineer staffing a commuter train. Another commenter suggested replacing the term with “Frontline Employees” for consistency with the 9/11 Act, finding the term “security-sensitive” to be confusing and therefore subject to misinterpretation. Further, this commenter found no risk-based justification for establishing a classification of employees to determine who should receive security training.

TSA response:

As discussed in the NPRM, the definition of “security-sensitive employees” includes employees who perform functions with a direct nexus to, or impact on, transportation security based on their job functions.

Engineers are specifically covered within the job functions identified for 49 CFR parts 1580 (freight railroads) and 1582 (public transportation and passenger railroads). A cyber-expert may be considered a security-sensitive employee based upon specific job functions, such as functions involving control or movement of trains, or because of other cyber-security responsibilities related to the owner/operators security measures in its security plan to protect the integrity of its information systems.

81 FR 91333

et seq.

TSA chose the term “security-sensitive” for this rule to mirror the term “safety-sensitive” used in rules promulgated by DOT. There is no statutory requirement for TSA to specifically use the term “frontline employee,” as long as the scope of the rule includes the employees identified in relevant portions of the 9/11 Act, which it does.

Finally, as discussed in the NPRM,

TSA applied a risk-based approach to all requirements in this rule, including the definition of security-sensitive employee. The NPRM explained TSA began with an analysis of the employees listed in the 9/11 Act's definitions of “frontline employees” who must receive training

and then considered whether other employees may also be in a position to spot suspicious activity because of where they work, their interaction with the public, or their access to information. TSA also considered who needs to know how to report or respond to these potential threats. This additional group of employees includes managers, supervisors, or others who perform the function or who so directly supervise the performance of a function that their nexus to the job function is equivalent to the employee.

See id.

at 61353-61355.

See id.

at Table 6,

Comparison of security training NPRM proposed categories for “security-sensitive employees” to 9/11 Act definitions of “frontline employees” who must be trained.

2. Recognition of Prior or Established Security Measures or Programs (§ 1570.7)

Comments related to use of existing training:

Several commenters suggested that TSA should allow use of previous training or programs to satisfy the rule's requirements. The range of these existing programs include training provided under TSA's First Observer

program and existing railroad security training, which commenters assert meets the intent of the 9/11 Act. Commenters noted that both freight and passenger railroads currently maintain effective security training programs.

Comments on how to use these existing programs varied, including allowing owner/operators to amend their existing programs to make them comply with the rule's requirements; letting currently trained employees be “grandfathered” in as long as their training meets the rule's requirements; and a request that TSA determine these existing training programs meet the 9/11 Act's requirements without imposing additional regulatory requirements.

Finally, a commenter expressed concern that owner/operators will be allowed to fulfill the training requirements in a variety of ways, creating unique programs for each system. The commenter noted the

training requirements may become overly burdensome for employees and employers if an employee must be re-trained every time he or she leaves one transportation operation and joins another.

TSA response:

Consistent with requirements of the 9/11 Act, the rule specifically provides for recognition of previous training in § 1570.107.

Under this section, owner/operators can use previously provided training meeting or exceeding the requirements of the rule to the extent they can provide documentation of the training and validation this training satisfies the requirements applicable to that employee. The rule also provides owner/operators with the flexibility to use other training programs addressing some or all of the same topics to satisfy the regulatory requirements in §§ 1580.113(c), 1582.113(c), and 1584.113(c).

See id.

at 91347 for the discussion on this topic in the NPRM.

See id.

at 91361-91362.

TSA recognizes that many of the owner/operators to be regulated by this rule have taken voluntary actions to raise their security baseline. TSA applauds these efforts, but also notes that they do not negate the benefits of this rulemaking. The purpose of this rule is to solidify the baseline for those that have already implemented security training programs, and to raise those who have not to a consistent standard across higher-risk operations. To the extent owner/operators established security training programs consistent with the 9/11 Act as a voluntary initiative or implemented use of TSA's First Observer

program,

and continue to provide regular training to their employees, these efforts should significantly mitigate any costs for compliance with the rule.

The First Observer

program, previously known as Operation Secure Transport, has been in use for highway motor carriers (OTRB owner/operators) and covers the Observe, Assess, and Respond security training components required by this rulemaking. TSA credits those OTRB owner/operators who have used the First Observer

program in its RIA (full description in Section 1.5 of the Final RIA).

Finally, the provision on use of previous training, in § 1570.107, also addresses concerns about unique training programs and the impact on employees who change jobs. If the owner/operator can validate the content and timing of the previous training, the rule allows this training to be credited towards satisfying the regulatory requirements. At most, the new employer may need to supplement portions of previous training to address unique aspects of its own TSA-approved security training program. This allows the owner/operator to ensure all of the security-sensitive employees receive training specific to their operations in order to best mitigate security risks.

3. Submission and Approval (§ 1570.109)

Comments on frequency of submitting security training programs to TSA:

Two commenters suggested companies should be permitted to submit training plans and curriculum only once to TSA, which TSA would store and review on a yearly basis and make recommended changes based on the current threat.

TSA response:

The rule does not impose a specific schedule for owner/operators to submit updates to their security programs, such as an annual update. It does, however, require owner/operators to request to amend their programs if necessary to reflect changes in ownership or permanent changes in operations affecting the security training program or curriculum.

For example, a program may need to be updated if the owner/operator replaces equipment resulting in instructions conflicting with the current security training curriculum, or expands operations into a new commodity with different risks, changes personnel structures affecting reporting, or begins operations in a new geographical area. In addition, the final rule narrows the scope of amendments required for changes to security measures or plans. Recognizing an owner/operator's security program may include issues not specifically relevant to the scope of transportation security this rule is intended to address, the final rule includes a list of the specific type of measures and program changes triggering the requirement to request an amendment. TSA may also require owner/operators to amend their plans in the interest of the public and transportation security.

See

§ 1570.113 and discussion in section IV.B.1.

See

§ 1570.115 and discussion in section IV.B.2.

Comments on methods for submitting security programs to TSA:

A number of commenters supported submitting training programs to TSA via electronic means, such as in email on a secured password protected platform. One commenter also expressed support for the proposed initial security program submission and approval process, as well as the amendment approval process.

Two commenters, however, raised concerns with this process, claiming it is too rigid and cumbersome to be effective. Commenters noted railroad training programs are robust and adaptable, evolving to address threats and security concerns. To continue to be effective, the commenters advocated that they be allowed to update their programs as needed without TSA approval. They also noted the FRA already oversees railroad security training programs, and TSA inspectors can review the same materials. They noted that given their current process, the NPRM lacked adequate justification for the imposition of a prescriptive process for submission, review, and approval of training programs already in effect.

TSA response:

In response to concerns regarding form of submission, TSA intends to allow for electronic submission of required documentation, consistent with SSI requirements. Relating to the need for updating programs, the final rule requires owner/operators to adapt their training materials to address specific threats in the various modes as they emerge. TSA approval is not required for an update unless the changes stay in effect for more than 60 days. For example, an owner/operator may provide additional training to address risks associated with a city hosting a national special security event. If the changes are to stay in effect for more than 60 days, the owner/operator must formally request approval to amend their security program. As the required content for the required security training is general operation security, TSA does not anticipate the TSA-approved security training needing to change significantly in response to a specific threat.

As to the concern about duplication of effort, TSA may accept all or portions of an owner/operator's existing security training. Under § 1570.107, an owner/operator may rely on previous training provided within the stipulated periods for initial or recurrent training, as validated by TSA (based on information submitted by the owner/operator). In addition, the rule provides for owner/operators to rely on training conducted pursuant to other requirements to satisfy the rule's security training requirements.

In fact, the rule specifically references training required by FRA.

In reviewing material prepared for other requirements, TSA will determine whether the material adequately addresses security training from TSA's perspective and reduces the risk of a terrorist-related attack on the transportation. As previously noted, TSA mitigates concerns about

duplication of inspections, through the annexes to the DHS/DOT MOU. These annexes address distinctions between TSA's focus on security and DOT's focus on safety, as well as coordination on regulatory matters between TSA and the relevant modal components of DOT.

See

§§ 1580.113(c), 1582.113(c), and 1584.113(c).

See

§§ 1580.113(c) and 1582.113(c).

Finally, regarding the prescriptive process requirements, TSA reviewed all requirements in this rule to identify any options to reduce the burden without undermining the rule's effectiveness or conflicting with requirements in the 9/11 Act. The 9/11 Act specifically requires submission of the training programs to DHS for approval and regular updates.

TSA believes the submission and approval requirements in § 1570.109 are consistent with this statutory requirement, provide clear instruction on how this requirement is to be met, and ensure consistent application of the rule's requirements.

9/11 Act sections 1408(d), 1517(d), and 1534(d).

4. Implementation Schedule (§ 1570.111)

Comments on initial security training:

Several commenters advocated for the proposed accumulated grace periods, ranging from 90 to 180 days, to allow recently hired employees to work before they complete the training requirements. One commenter suggested abandoning the accumulated days concept and replacing it with a requirement for all employees to receive security training no later than 90 days after beginning employment. One commenter suggested a method for calculating date: A day should be based on full-time employment, with each 8-hour period worked counting as one day. Regarding contractors, the same commenter suggested the training responsibility should rest with the contracted company.

Comments also addressed how to regulate temporary and/or part-time employees. One commenter suggested all drivers, whether employees or contractors, should be trained. Another commenter explained “pooling agreements,” which allow or require employees from other companies to operate their equipment, and noted these arrangements should be covered in the final rule.

TSA response:

While TSA appreciates concerns regarding the implementation schedule for initial training, the 60-day requirement is set by the statute. As noted in the NPRM, the 9/11 Act requires initial training within the first 60-days of employment for new employees or for those transitioning to a covered job function (as identified in Appendix B to parts 1580 (freight rail), 1582 (PTPR), and 1584 (OTRB).

TSA is not adopting the suggestion of a day equaling an aggregated 8-hour period. TSA's intent with this rule is to ensure employee's that are regularly positioned to identify and respond to security threats are prepared to do so. TSA does not believe that this priority is served by hourly calculations to determine what constitutes a day.

See

81 FR 91347.

As to contractors, TSA consistently applies a policy requiring regulated parties to accept responsibility for their contractors, including employees operating under pooling agreements. Any person working for an owner/operators within the scope of applicability, performing a security-sensitive position—without regard to primary employer or full/part-time status—must be trained. In other words, a pooling agreement does not mitigate the need for security training. The impact of this policy is more fully discussed under comments related to 49 CFR part 1503.

Finally, TSA is not changing the aggregated employment requirement in § 1570.111(4) nor the requirement for employees (whether intermittent or contract) to be trained no later than the 60th day of aggregated employment performing a security-sensitive function. This requirement ensures these employees are trained after they are in a position with a particular owner/operator long enough to gain awareness of the operations necessary to determine when there is an anomaly that could constitute a threat.

In response to the comment about all drivers (presumably of OTRBs) being required to receive training, TSA is limiting it to individuals with a commercial driver's license to focus on those with a nexus to security, in other words, those likely to operate a bus to, through, or from a high-risk location, rather than employees moving a bus across a yard. While TSA is not currently requiring all drivers to receive the security training, this does not prevent owner/operators from voluntarily providing the security training required for security-sensitive employees to a broader population of employees.

In addition, TSA is developing training materials that can be consistently used across a particular mode. Use of this material, coupled with the ability to use previous training, will minimize the burden of ensuring employees in pooling agreements received adequate training. Owner/operators can rely on the TSA-provided material to address most of the requirements and limit their operation-specific training to procedures unique to their operation, such as points of contact to report security concerns and emergencies.

Comments on recurrent security training:

TSA received a variety of comments on recurrent training. Some commenters generally supported annual recurrent training. Other commenters stated they should have flexibility to self-determine the training schedule for their employees, as opposed to an adhering to a “one size fits all” approach. Some commenters expressed concern with the time frame due to cost constraints and the practicality of training employees while simultaneously maintaining service. These commenters suggested longer time periods between training, such as two or three years. One commenter highlighted the safety requirements in FRA's rules, which require training every three years.

TSA response:

TSA considered options for recurrent training both before proposing the requirement in the NPRM and in consideration of comments submitted on the NPRM. TSA continues to believe in the importance of recurrent training to meet the purpose of the rule, but is adjusting the frequency of training in consideration of the comments. The final rule requires recurrent training once every three years. If, however, the owner/operator modifies its security program or plan and those changes affect the responsibilities of specific security-sensitive employees, based on their position or function in relation to security program or plan requirements, the affected employees must receive recurrent training to address the changes within 90 days of implementation of the revisions. This change is consistent with the requirements for hazardous materials employees under 49 CFR 172.704.

The recurrent training requirements are discussed in more detail in section II.J.2.

In addition, TSA notes that it may order modifications to a security program or plan, or order additional training, as necessary.

See, e.g.,

49 U.S.C. 114(l).

5. Recordkeeping and Availability (§ 1570.121)

Comments:

Two commenters said the proposed 5-year record-keeping requirement would be excessive in duration, costly and burdensome in administration, and unjustified by any risk-based factors. As an alternative, they suggested owner/operators should only be required to retain training from

the past three years (assuming TSA adopts a 3-year training requirement).

TSA response:

Within the context of an annual recurrent training requirement, TSA considered modifying the record retention period based on the comments as three years would provide adequate records of previous training. The change, however, to recurrent training on a three-year cycle necessitates maintaining the 5-year retention schedule in order to ensure that the owner/operator can provide adequate representation of previous training consistent with recurrent training requirements as well as any training based on modification to the owner/operator's security program or plan.

6. Security Coordinator (§ 1570.201)

Comments on security coordinator availability:

Two commenters suggested changes to the security coordinator requirements specifically for railroad companies. First, they suggested TSA only require affected railroads to maintain a 24/7 communications capability to ensure TSA can reach the rail security coordinators and designated representatives for the stated purpose of receiving intelligence information and coordinating on security practices and procedures.

Second, there was one objection to the proposed requirement for freight railroad operators to name rail security coordinators (RSC) “accessible to TSA on a 24-hour a day, 7-day a week basis.” The commenter suggests modifying this proposal to require the railroad to “maintain a 24/7 communications capability to ensure TSA can reach the RSCs and designated representatives for the stated purpose of receiving intelligence information and coordinating on security practices and procedures.”

TSA response:

First, TSA is reorganizing the location of the RSC requirements promulgated in 2008, moving the requirements from 49 CFR part 1580 to part 1570 (§§ 1570.201 and 1570.203) and expanding applicability of the existing RSC requirement to include bus operations of public transportation systems and OTRB owner/operators within the scope of the rule's applicability. TSA neither proposed nor is adopting any modifications to the RSC requirements as they apply to railroads and the requirement regarding 24/7 accessibility of security coordinators.

It is critical for security coordinators to be “accessible to TSA on a [24/7] basis” rather than accepting “a 24/7 communications capability [that] can reach the RSCs.” Although most communication between TSA and security coordinators may be routine, these individuals are intended to serve key roles in times of heightened and specific security threat and incident. During such periods, immediate communication with the security coordinators may be required to prevent or mitigate loss of life or severe harm to transportation security. TSA believes the requirement for security coordinators to be accessible to TSA on a 24-hour a day, 7-day a week basis is amply justified by commonly accepted principles of emergency and security management. If TSA needs to convey extremely time-sensitive security information to a regulated party, particularly in situations requiring frequent information updates, the information exchange benefits if there is continuity in participants. The security coordinator must be in a position to understand security problems, raise issues with corporate leadership, and recognize when emergency response action is appropriate. If the contact changes every time TSA makes a call, the loss of continuity will undermine the effectiveness of the communication.

Comments on citizenship requirement for security coordinators:

Two commenters stated disclosing citizenship status is unnecessary and should not be required. One of the two commenters suggests TSA should recognize Canadian government security clearances in lieu of requiring RSC to be citizens of the United States.

TSA response:

The rule does not require a rail security coordinator to be a citizen of the United States. It does however, require each owner/operator to report the citizen status of individuals it intends to put forward as its RSC under § 1570.201(d). This requirement is necessary to meet the 9/11 Act requirement that security coordinators be U.S. citizens unless TSA determines it is appropriate to waive the requirement “based on a background check of the individual and a review of the consolidated terrorist watchlist.”

By providing this information up front, TSA can initiate any additional actions necessary to comply with this requirement.

See

9/11 Act sections 1512(e)(2) and 1531(e)(2).

7. Reporting Significant Security Concerns (§ 1570.203)

Comments on mandatory reporting requirement, scope of reporting, and form of reporting:

Several commenters opposed a mandatory reporting requirement. A few argued the requirements would open up their companies and employees to liability should an incident occur and an earlier warning action was not observed. Several other commenters specifically opposed the 24-hour proposed time limit, stating it was too short, and some transit agencies may not know what the threat is in that amount of time.

Commenters also suggested TSA authorize electronic reporting of significant security concerns to meet the reporting requirements in § 1580.203. These commenters noted the rail industry has developed an electronic reporting capability and demonstrated its effectiveness in three industry-wide exercises.

Finally, a few commenters asked for additional clarity regarding what “significant security concern” entails, and one asked for a list of examples. One commenter specifically suggested TSA harmonize its definition of “security threat” with the FRA's requirement in 49 CFR part 239. Several commenters suggested streamlining the requirements.

TSA response:

As with the security coordinator requirement, TSA is reorganizing the location of the reporting significant security concerns requirements promulgated in 2008 (which were at 49 CFR part 1580), placing the requirement in part 1570 to expand its applicability to OTRBs and bus operations of public transportation system companies within the scope of the rule's applicability. As proposed in the NPRM, TSA is making three primary changes to the current requirement through this final rule. These changes affect all owner/operators required to report, but results in a reduced burden for rail operators previously required to report. First, the rule modifies the current requirement to report

immediately,

to allow

up to 24 hours

to report significant security concerns. TSA is providing a period of up to 24 hours to report the information for two reasons: (1) If there is an emergency, the immediate priority is to notify and work with first responders, not call TS, and (2) TSA is aware the quality of information provided is improved when owner/operators have an opportunity to review the information and ensure it constitutes a valid significant security concern consistent with the description of activities in Appendix A to part 1570 before it is reported. TSA believes 24 hours is an adequate period for this process to work effectively. If more time is granted, the information may be too stale to be of benefit to TSA or its other stakeholders.

Second, TSA is modifying the existing requirement to allow for electronic reporting. The current rule requires reporting to be made by telephone. With

this final rule, TSA is expanding the requirement to allow for other methods prescribed by TSA. TSA will communicate these methods directly to security coordinators to avoid a situation where a phone number or email address may become outdated based on changes or requirements beyond the scope of this rulemaking.

Third, as noted in the NPRM and discussed in section III.C, TSA is including in the final rule a table that identifies categories of incidents and provides detailed descriptions.

These incidents are modified from the requirements promulgated in 2008 to align with other standards, including those mentioned by commenters, and recommendations from the Government Accountability Officer (GAO).

See

Appendix A to part 1570.