Surface Transportation Security Training

On March 23, 2020, TSA published the Security Training for Surface Transportation Final Rule in the Federal Register. In special consideration of ongoing challenges to the surface transportation industry in response to COVID-19, TSA has extended the deadline for submitting security training programs to TSA for approval to June 21, 2021.The rule requires owner/operators of higher-risk freight railroad carriers, public transportation agencies (including rail mass transit and bus systems), passenger railroad carriers and over-the-road bus companies to provide TSA-approved security training to employees who perform security-sensitive functions. The training curriculum must teach employees how to observe, assess and respond to terrorist-related threats and/or incidents. TSA is also expanding its requirements for security coordinators and the reporting of significant security concerns (currently limited to rail operations), including bus operations within the scope of the regulation. TSA is amending other provisions of its regulations, as necessary, to implement these requirements. The effective date of this regulation is September 21, 2020. The public may access the final rule in the Federal Register here.

HISTORICAL BACKGROUND - STATUATORY MANDATE

Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act) for Surface Transportation

As part of the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act), Congress mandated regulations to enhance surface transportation security through security training of frontline employees. The mandate includes prescriptive requirements for who must be trained, what the training must encompass and how to submit and obtain approval for a training program. The 9/11 Act also mandates regulations requiring higher-risk railroads and over-the-road buses to appoint security coordinators. In addition to implementing these provisions, this final rule also addresses a mandate to define Transportation Security-Sensitive Materials.

How do I determine whether the Rule applies to my agency or company?

TSA’s applicability criteria for freight railroads, public transportation/passenger rail (PTPR), OTRB and certain business operations are as follows:

Freight Rail (49 CFR § 1580.101):

  • (a) Class I freight railroads (as described in §1580.1(a)(1))
  • (b) Each freight railroad carrier (as described in § 1580.1(a)(1)) that transports one or more categories of Rail Security Sensitive Material (RSSM) in an High Threat Urban Area (HTUA) as defined in the rule.
  • (c) Railroads (as described in § 1580.1(a)(4)) that serves as a host railroad to a freight railroad described in paragraph (a) of (b) of this section or a passenger operation described in § 1582.101 of the regulation.

Public Transportation and Passenger Railroads (PTPR) (49 CFR § 1582.101):

A public transportation agency (including rail mass transit and bus systems) or passenger railroad must provide security training if it is (a) one of the 46 identified PTPR systems listed in 49 CFR part 1582, Appendix A; (b) Amtrak; or (c) hosts a higher-risk freight railroad.

Over-the-Road Bus (OTRB) (49 CFR § 1584.101):

An OTRB owner/operator must provide security training if it provides fixed-route service to, through or from any of ten areas identified in 49 CFR part 1584, Appendix A.

How do I notify TSA that the Security Training Rule applies to my agency/company?

Owner/operators required to notify TSA whether the rule applies to their agency/company must provide this information to TSA by October 21, 2020.

  1. Owner/Operators may notify TSA via the following email address: SecurityTrainingPolicy@tsa.dhs.gov.
  2. Include in the subject line of your email: Security Training Rule Applicability - (Agency or Company Name)
  3. Include the following information in the body of the email:
    • a. Mode of transportation (e.g. Freight Rail, Passenger Rail, Public Transportation, OTRB)
    • b. Owner/operator corporate name
    • c. Doing business as (DBA) name
    • d. Corporate address
    • e. Contact name, email address and phone number

See 49 CFR § 1570.105 for information regarding an owner/operator’s responsibility for determining whether the rule applies to the agency/company.

Questions: Contact TSA at (571) 227-5563

How do I provide my agency/company’s training program to TSA?

TSA will provide security plan submission instructions to covered parties after they have notified TSA in accordance with 49 CFR § 1570.105.

How do I provide TSA my agency/company Security Coordinator and Alternate Security Coordinator information?

Owner/operators required to appoint security coordinators for the first time (e.g., higher-risk bus-only public transportation agencies and over-the-road bus companies) under this rule must provide this information to TSA by October 28, 2020. [Note: Regulated parties previously covered under 49 CFR §§ 1580.101 and 1580.201 (Rail Security Coordinator) must ensure the information requested below has been provided and is updated as appropriate.]

  1. Owner/Operators may notify TSA in the following manner:

    1. Via the following email address: TSA.seccoord@tsa.dhs.gov
      1. Include in the subject line of your email: Security Coordinator Contact Info - (Agency or Company Name)
      2. Include the following information in the body of the email:
        1.  Security Coordinator
          1.  First and last name
          2.  Title
          3.  Office and mobile phone number
          4.  Email address
          5.  U.S. citizenship status
          6.  Corporate address (optional)
          7.  Shipping/mailing address (optional)
        2.  Alternate Security Coordinator
          1.  First and last name
          2. Title
          3. Office and mobile phone number
          4. Email address
          5. U.S. citizenship status
          6. Corporate address (optional)
          7. Shipping/mailing address (optional)
    2. By U.S. mail or package delivery service
      1. Include the following information on company letterhead:
        1. Security Coordinator
          1. First and last name
          2. Title
          3. Office and mobile phone number
          4. Email address
          5. U.S. citizenship status
          6. Corporate address (optional)
          7. Shipping/mailing address (optional)
        2. Alternate Security Coordinator
          1. First and last name
          2. Title
          3. Office and mobile phone number
          4. Email address
          5. U.S. citizenship status
      2. Send letter to the following address:
        Transportation Security Administration
        Attention: OS/PPE/Surface Division
        TSA-28
        601 S. 12th Street
        Arlington, VA 20598-6028

[Note: Please allow 14 days for shipping and mail screening to ensure letter arrives before the regulatory deadline.]

See 49 CFR § 1570.201 for further information about the roles and responsibilities of security coordinators.

Regulatory Deadlines
Action Timeframe Date
Effective date of rule   Sep 21, 2020
Deadline for notifying TSA of applicability determination
(49 CFR § 1570.105)		   Oct 21, 2020
Deadline for submission of security coordinator information to TSA (49 CFR § 1570.201)   Oct 28, 2020
Deadline for submission of security training program to TSA for approval 
(49 CFR § 1570.109(b))		   Jun 21, 2021
Complete Initial training of security-sensitive employees 
(49 CFR § 1570.111(a))		 Within 1 year from TSA approval of the security training program if the plan is received after March 22, 2021.  
Within 15 months from TSA approval of the security training program if the plan was received on or before March 22, 2021.
Recurrent training of security-sensitive employees
(49 CFR § 1570.111(b))		 Within three-years of initial training  
Regulatory requirements

The Security Training for Surface Transportation Employees Final Rule includes four major requirements:

  1. Each covered party must notify TSA of applicability per 49 CFR § 1570.105 
  2. Each covered party must designate security coordinators and alternates per 49 CFR § 1570.201.
  3. Each covered party must report significant security concerns to TSA per 49 CFR § 1570.203. Significant security concerns must be reported telephonically to the Transportations Security Operations Center at 1-866-615-5150.
  4. Owner/operators must provide training to security-sensitive employees addressing how to prepare, observe, assess and respond to terrorist-related threats and/or incidents in accordance with 49 CFR Sections 1580.113, 1582.113, and 1584.113 as appropriate. 

For a description of the mode-specific security-sensitive job functions see the mode-specific appendices: 

  • Freight Railroads – Appendix B to 49 CFR part 1580 
  • Public Transportation and Passenger Railroads – Appendix B to 49 CFR part 1582 
  • Over-the-Road Bus – Appendix B to 49 CFR part 1584
     

Additional FAQ

How can an owner/operator covered by this rule submit its training plans to TSA for approval?

TSA will provide details for submission of training programs after receiving confirmation from the owner/operators that its agency/company is subject to the rule per applicability determination requirements covered in 49 CFR § 1570.105 of the rule. TSA intends to send this information to the owner/operator’s security coordinator.

How can owner/operators obtain TSA developed training materials described in the rule’s preamble?

TSA has developed five videos that cover a portion of the “Observe, Assess and Respond (OAR)” elements under 49 CFR 1580.115, 1582.115, and 1584.115. The videos are available free of charge to industry. The videos cover:

  • OAR Security Training for Freight Rail Security Sensitive Employees
  • OAR Security Training for Mass Transit Bus Security Sensitive Employees
  • OAR Security Training for Mass Transit Rail Security Sensitive Employees
  • OAR Security Training for Over-the-Road Bus Security Sensitive Employees
  • OAR Security Training for Passenger Rail Security Sensitive Employees

Please contact SecurityTrainingPolicy@tsa.dhs.gov to request a copy of the video(s).

What are requirements of a Security Coordinator?

Each owner/operator must ensure that at least one Security Coordinator:

  1. Serves as the primary contact for intelligence information and security related activities and communications with TSA. Any individual designated as a Security Coordinator may perform other duties in addition to the duties described in this section.
  2. Is accessible to TSA on a 24 hours a day, 7 days a week basis.
  3. Coordinates security practices and procedures internally and with appropriate law enforcement and emergency response agencies.
What are the requirements for record keeping for training of sensitive security employees?

The rule requires owner/operators to create and maintain lists of their security sensitive employees and specify when these employees received the required training. Training records must include each trained employee’s name, job title or function, date of hiring and date and course information on the most recent security training that each employee received. Records for individual employees must reflect the training courses completed and date of completion. Records of an employee’s initial and recurrent training must be maintained by owner/operators for no less than five years from the date of the training and made available at the location(s) specified in the security training program approved by TSA.

What is the Intent of the Rule?

The purpose of this rule is to solidify the baseline of security for higher risk surface transportation operations by improving and sustaining the preparedness of surface transportation employees in higher-risk operations, including their critical capability to prepare, observe, assess and respond to security risks and potential security breaches within their unique working environment.

In order to ensure effective communication regarding threats (both to regulated parties and from regulated parties), TSA also is expanding applicability of current security reporting requirements for rail operations to include bus operations within the scope of the regulation’s applicability. This expansion requires higher risk owner/operators of these bus operations to identify security coordinators and report significant security concerns to TSA. These security measures will enhance TSA’s ability to recognize potential security trends and communicate directly with individuals within higher risk operations that have direct responsibility for security.

What is the regulatory timeline?
  • This rule becomes effective September 21, 2020.  
  • Regulated entities must notify TSA of their applicability determination October 21, 2020.
  • Regulated entities must report to TSA the names and contact information of a security coordinator and an alternate security coordinator October 28, 2020
  • Regulated entities must provide their training plans to TSA by June 21, 2021.
  • Owner/operators must ensure employees in security sensitive positions complete initial training within one (1) year of TSA approving their training program. Owner/operators that submitted a program by March 21, 2021, must ensure employees in security sensitive positions complete training within 15 months of TSA approving their training program.
  • Employees in sensitive-security jobs must receive recurrent training at least once every three years. 

Contacting TSA

Questions? 

You can submit questions to TSA at  SecurityTrainingPolicy​@tsa.dhs.gov.  In the subject line of your email, please begin with "Training Rule Question"

You can also call and leave a voicemail at (571) 227-5563.  Please include your name, company/organization, and contact phone number in your message.