49 CFR Part 1570 — General Rules

PART 1570—GENERAL RULES Authority: 18 U.S.C. 842, 845; 46 U.S.C. 70105; 49 U.S.C. 114, 5103a, 40113, and 46105; Pub. L. 108-90 (117 Stat. 1156, Oct. 1, 2003), sec. 520 (6 U.S.C. 469), as amended by Pub. L. 110-329 (122 Stat. 3689, Sept. 30, 2008) sec. 543 (6 U.S.C. 469); Pub. L. 110-53 (121 Stat. 266, Aug. 3, 2007) secs. 1402 (6 U.S.C. 1131), 1405 (6 U.S.C. 1134), 1408 (6 U.S.C. 1137), 1413 (6 U.S.C. 1142), 1414 (6 U.S.C. 1143), 1501 (6 U.S.C. 1151), 1512 (6 U.S.C. 1162), 1517 (6 U.S.C. 1167), 1522 (6 U.S.C. 1170), 1531 (6 U.S.C. 1181), and 1534 (6 U.S.C. 1184). Source: 85 FR 16499, Mar. 23, 2020, unless otherwise noted. Subpart A—General § 1570.1 Scope. This part applies to any person involved in maritime or surface transportation as specified in this subchapter. § 1570.3 Terms used in this subchapter. In addition to the definitions in §§ 1500.3, 1500.5, and 1503.202 of subchapter A, the following terms are used in this subchapter: Adjudicate Applicant Commercial driver's license (CDL) Contractor Convicted Determination of No Security Threat Employee Federal Maritime Security Coordinator (FMSC) Final Determination of Threat Assessment Hazardous materials endorsement (HME) Immediate supervisor (1) Performs the work of a security-sensitive employee; or (2) Supervises and otherwise directs the performance of a security-sensitive employee. Imprisoned imprisonment Incarceration Initial Determination of Threat Assessment Initial Determination of Threat Assessment and Immediate Revocation Invalidate Maritime facility Mental health facility Revocation Secure area Security-sensitive employee, Security-sensitive job function, Transportation Worker Identification Credential (TWIC) Withdrawal of Initial Determination of Threat Assessment [85 FR 16499, Mar. 23, 2020, as amended at 89 FR 35631, May 1, 2024; 91 FR 7161, Feb. 17, 2026] § 1570.5 Fraud and intentional falsification of records. No person may make, cause to be made, attempt, or cause to attempt any of the following: (a) Any fraudulent or intentionally false statement in any record or report that is kept, made, or used to show compliance with the subchapter, or exercise any privileges under this subchapter. (b) Any reproduction or alteration, for fraudulent purpose, of any record, report, security program, access medium, or identification medium issued under this subchapter or pursuant to standards in this subchapter. § 1570.7 Security responsibilities of employees and other persons. (a) No person may— (1) Tamper or interfere with, compromise, modify, attempt to circumvent, or cause another person to tamper or interfere with, compromise, modify, or attempt to circumvent any security measure implemented under this subchapter. (2) Enter, or be present within, a secured or restricted area without complying with the security measures applied as required under this subchapter to control access to, or presence or movement in, such areas. (3) Use, allow to be used, or cause to be used, any approved access medium or identification medium that authorizes the access, presence, or movement of persons or vehicles in secured or restricted areas in any other manner than that for which it was issued by the appropriate authority to meet the requirements of this subchapter. (b) The provisions of paragraph (a) of this section do not apply to conducting inspections or tests to determine compliance with this subchapter authorized by— (1) TSA and DHS officials working with TSA; or (2) The owner/operator when acting in accordance with the procedures described in a security plan and/or program approved by TSA. § 1570.9 [Reserved] Subpart B—Security Programs § 1570.101 Scope. The requirements of this subpart address general security program requirements applicable to each owner/operator required to have a security program under subpart B to 49 CFR parts 1580, 1582, and 1584. § 1570.103 Content. (a) Security program. (b) Use of appendices. § 1570.105 Responsibility for Determinations. (a) Higher-risk operations. (b) New or modified operations. § 1570.107 Recognition of prior or established security measures or programs. Previously provided security training may be credited towards satisfying the requirements of this subchapter provided the owner/operator— (a) Obtains a complete record of such training and validates the training meets requirements of § 1580.115, § 1582.115, or § 1584.115 of this subchapter as it relates to the function of the individual security-sensitive employee and the training was provided within the schedule required for recurrent training. (b) Retains a record of such training in compliance with the requirements of § 1570.121 of this part. § 1570.109 Submission and approval. (a) Submission of security program. (b) Security training deadlines. (1) Submit its program to TSA for approval no later than June 21, 2021. (2) If commencing or modifying operations so as to be subject to the requirements of subpart B to 49 CFR parts 1580, 1582, or 1584 after June 21, 2021, submit a training program to TSA no later than 90 calendar days before commencing new or modified operations. (c) TSA approval. (2) Notice to modify. (3) TSA may request additional information, and the owner/operator must provide the information within the time period TSA prescribes. The 60-day period for TSA approval or modification will begin when the owner/operator provides the additional information. (g) Petition for reconsideration. [85 FR 16499, Mar. 23, 2020, as amended at 85 FR 67683, Oct. 26, 2020; 86 FR 23632, May 4, 2021] § 1570.111 Implementation schedules. (a) Initial security training. (1) For security training programs submitted to TSA for approval on or before March 22, 2021, if the employee is employed to perform a security-sensitive function on the date TSA approves the program, then initial training must be provided no later than fifteen months after the date that TSA approves the owner/operator's security training program. (2) For security training programs submitted to TSA for approval after March 22, 2021, if the employee is employed to perform a security-sensitive function on the date TSA approves the program, then initial training must be provided no later than twelve months after the date that TSA approves the owner/operator's security training program. (3) If performance of a security-sensitive job function is initiated after TSA approves the owner/operator's security training program, then initial training must be provided no later than 60 calendar days after the employee first performs the security-sensitive job function. (4) If the security-sensitive job function is performed intermittently, then no later than the 60th calendar day of employment performing a security-sensitive function, aggregated over a consecutive 12-month period. (b) Recurrent security training. (2) If an owner/operator modifies a security program or security plan for which training is required under § 1580.203(b), § 1582.115(b), or § 1584.115(b) of this subchapter, the owner/operator must ensure each security-sensitive employee with position- or function-specific responsibilities related to the revised plan or program changes receives training on the revisions within 90 days of implementation of the revised plan or program changes. All other employees must receive training that reflects the changes to the operating security requirements as part of their regularly scheduled recurrent training. (3) The three-year recurrent training cycle is based on the anniversary calendar month of the employee's initial security training. If the owner/operator provides the recurrent security training in the month of, the month before, or the month after it is due, the employee is considered to have taken the training in the month it is due. (c) Extensions of time. [85 FR 16499, Mar. 23, 2020, as amended at 86 FR 23632, May 4, 2021] § 1570.113 Amendments requested by owner/operator. (a) Changes to ownership or control of operations. (b) Changes to conditions affecting security. (1) Specific procedures implemented or used to prevent and detect unauthorized access to restricted areas designated by the owner/operator; (2) Measures to be implemented in response to a period of heightened security risk, communicated through a DHS enhanced security notification, including the process used to notify all employees of changes in alert level status or requirements to implement specific elements of the security plan and verify that appropriate enhanced security measures have been implemented at all relevant locations. (3) Emergency response plans, including: (i) Coordinated response plans establishing procedures for appropriate interaction with State, local, and tribal law enforcement agencies, emergency responders, and Federal officials in order to coordinate security measures and plans for response in the event of a terrorist threat, attack, or other transportation security-related incident; (ii) Specific procedures to be implemented or used by the owner/operator in response to a terrorist attack, including evacuation and communication plans that include individuals with disabilities; and (iii) Additional measures to be adopted to address weaknesses in emergency response procedures identified during regular drills or exercises that test corporate capabilities to direct, coordinate, and execute prevention and response activities for terrorist attacks or other security threats, including tunnel evacuation procedures, if applicable. (iv) Redundant and backup systems to ensure the continuity of operations of critical assets and infrastructure system in the event of a terrorist attack or other transportation security-related incident. (c) Changes to security training curriculum. (1) Determinations that the security training program is ineffective based on the approved method for evaluating effectiveness in the security training program approved by TSA under subpart B of parts 1580, 1582, and 1584; or (2) Development of recurrent training material for purposes of meeting the requirements in § 1570.111(b) of this part or other alternative training materials not previously approved by TSA. (d) Permanent change. (e) Schedule for requesting amendment. (f) TSA approval. (2) TSA may approve— (i) An amendment to a security program if TSA determines that it is in the interest of the public and transportation security and the proposed amendment provides the level of security required under this subchapter. (ii) Modification to security training curriculum, including alternative training for purposes of meeting the recurrent training requirement, if all the required training elements are addressed and the material is consistent with the most recent iteration of the security program submitted to, and approved by, TSA (including amendments made to reflect relevant changes to operations and/or security measures and response plans). (iii) TSA may request additional information from the owner/operator before rendering a decision. (g) Petition for reconsideration. § 1570.115 Amendments required by TSA. (a) Notification of requirement to amend. (1) TSA will notify the owner/operator of the proposed amendment, fixing a period of not less than 30 calendar days within which the owner/operator may submit written information, views, and arguments on the amendment. (2) After TSA considers all relevant material received, TSA will notify the owner/operator of any amendment adopted or rescind the notice. (b) Effective date of amendment. (c) Emergency amendments. § 1570.117 Alternative measures. (a) If in TSA's judgment, the overall security of transportation provided by an owner/operator subject to the requirements of 49 CFR part 1580, 1582, or 1584 are not diminished, TSA may approve alternative measures. (b) Each owner/operator requesting alternative measures must file the request for approval in a form and manner prescribed by TSA. The filing of such a request does not affect the owner/operator's responsibility for compliance while the request is being considered. (c) TSA may request additional information, and the owner/operator must provide the information within the time period TSA prescribes. Within 30 calendar days after receiving a request for alternative measures and all requested information, TSA will, in writing, either approve or deny the request. (d) If TSA finds that the use of the alternative measures is in the interest of the public and transportation security, it may grant the request subject to any conditions TSA deems necessary. In considering the request for alternative measures, TSA will review all relevant factors including— (1) The risks associated with the type of operation, for example, whether the owner/operator transports hazardous materials or passengers within a high threat urban area, whether the owner/operator transports passengers and the volume of passengers transported, or whether the owner/operator hosts a passenger operation. (2) Any relevant threat information. (3) Other circumstances concerning potential risk to the public and transportation security. (e) No later than 30 calendar days after receiving a denial, the owner/operator may petition for reconsideration under § 1570.119 of this part. § 1570.119 Petitions for reconsideration. (a) If an owner/operator seeks to petition for reconsideration of a determination, required modification, denial of a request for amendment by the owner/operator, denial to rescind a TSA-required amendment, or denial of an alternative measure, the owner/operator must submit a written petition for reconsideration that includes a statement and any supporting documentation explaining why the owner/operator believes TSA's decision is incorrect. (b) Upon review of the petition for reconsideration, the Administrator or designee will dispose of the petition by affirming, modifying, or rescinding its previous decision. This is considered a final agency action. § 1570.121 Recordkeeping and availability. (a) Retention. (1) Retain security training records for each individual required to receive security training under §§ 1580.115, 1582.115, and 1584.115 that, at a minimum— (i) Includes employee's full name, job title or function, date of hire, and date of initial and recurrent security training; and (ii) Identifies the date, course name, course length, and list of topics addressed for the security training most recently provided in each of the areas required under §§ 1580.115, 1582.115, and 1584.115 of this subchapter. (2) Retain records of initial and recurrent security training for no less than five (5) years from the date of training. (3) Provide records to current and former employees upon request and at no charge as necessary to provide proof of training. (b) Electronic records. (c) Protection of SSI. (d) Availability. Subpart C—Operations § 1570.201 Security Coordinator. (a) Except as provided in paragraphs (b) and (c) of this section, each owner/operator identified in §§ 1580.1, 1582.1, and 1584.101 of this subchapter must designate and use a primary and at least one alternate Security Coordinator. (b) An owner/operator identified in § 1582.1(a)(2) of this subchapter (public transportation agency) that owns or operates a bus-only operation must designate and use a primary and at least one alternate Security Coordinator only if the owner/operator is identified in appendix A to part 1582 of this subchapter or is notified by TSA in writing that a threat exists concerning that operation. (c) An owner/operator identified in § 1580.1(a)(5) or § 1582.1(a)(4) of this subchapter (private rail car, tourist, scenic, historic, or excursion rail operations) must designate and use a primary and at least one alternate Security Coordinator, only if notified by TSA in writing that a threat exists concerning that type of operation. (d) The Security Coordinator and alternate(s) must be appointed at the corporate level. (e) Each owner/operator required to have a Security Coordinator must provide in writing to TSA the names, U.S. citizenship status, titles, phone number(s), and email address(es) of the Security Coordinator and alternate Security Coordinator(s) within 37 calendar days of the effective date of this rule, commencement of operations, or change in any of the information required by this section. (f) Each owner/operator required to have a Security Coordinator must ensure that at least one Security Coordinator— (1) Serves as the primary contact for intelligence information and security-related activities and communications with TSA. Any individual designated as a Security Coordinator may perform other duties in addition to the duties described in this section. (2) Is accessible to TSA on a 24 hours a day, 7 days a week basis. (3) Coordinates security practices and procedures internally and with appropriate law enforcement and emergency response agencies. § 1570.203 Reporting significant security concerns. (a)(1) Except as provided in paragraph (a)(2) of this section, each owner/operator identified in §§ 1580.1, 1582.1, and 1584.101 of this subchapter must report, within 24 hours of initial discovery, any potential threats and significant security concerns involving transportation-related operations in the United States or transportation to, from, or within the United States as soon as possible by the methods prescribed by TSA. (2) An owner/operator identified in § 1582.1(a)(2) of this subchapter (public transportation agency) that owns or operates a bus-only operation must only comply with the requirements in this section if the owner/operator is identified in appendix A to part 1582 of this subchapter or is notified by TSA in writing that a threat exists concerning that operation. (b) Potential threats or significant security concerns encompass incidents, suspicious activities, and threat information including, but not limited to, the categories of reportable events listed in appendix A to this part. (c) Information reported must include the following, as available and applicable: (1) The name of the reporting individual and contact information, including a telephone number or email address. (2) The affected freight or passenger train, transit vehicle, motor vehicle, station, terminal, rail hazardous materials facility, or other facility or infrastructure, including identifying information and current location. (3) Scheduled origination and termination locations for the affected freight or passenger train, transit vehicle, or motor vehicle-including departure and destination city and route. (4) Description of the threat, incident, or activity, including who has been notified and what action has been taken. (5) The names, other available biographical data, and/or descriptions (including vehicle or license plate information) of individuals or motor vehicles known or suspected to be involved in the threat, incident, or activity. (6) The source of any threat information. [85 FR 16499, Mar. 23, 2020, as amended at 86 FR 23632, May 4, 2021] Subpart D—Security Threat Assessments § 1570.301 Fraudulent use or manufacture; responsibilities of persons. (a) No person may use or attempt to use a credential, security threat assessment, access control medium, or identification medium issued or conducted under this subchapter that was issued or conducted for another person. (b) No person may make, produce, use or attempt to use a false or fraudulently created access control medium, identification medium or security threat assessment issued or conducted under this subchapter. (c) No person may tamper or interfere with, compromise, modify, attempt to circumvent, or circumvent TWIC access control procedures. (d) No person may cause or attempt to cause another person to violate paragraphs (a) through (c) of this section. § 1570.303 Inspection of credential. (a) Each person who has been issued or possesses a TWIC must present the TWIC for inspection upon a request from TSA, the Coast Guard, or other authorized DHS representative; an authorized representative of the National Transportation Safety Board; or a Federal, State, or local law enforcement officer. (b) Each person who has been issued or who possesses a TWIC must allow his or her TWIC to be read by a reader and must submit his or her reference biometric, such as a fingerprint, and any other required information, such as a PIN, to the reader, upon a request from TSA, the Coast Guard, other authorized DHS representative; or a Federal, State, or local law enforcement officer. § 1570.305 False statements regarding security background checks by public transportation agency or railroad carrier. (a) Scope. (b) Definitions. Security background check (i) Relevant criminal history databases. (ii) In the case of an alien (as defined in sec. 101 of the Immigration and Nationality Act (8 U.S.C. 1101(a)(3)), the relevant databases to determine the status of the alien under the immigration laws of the United States. (iii) Other relevant information or databases, as determined by the Secretary of Homeland Security. (c) Prohibitions. (2) A railroad carrier or a contractor or subcontractor of a railroad carrier may not knowingly misrepresent to an employee or other relevant person, including an arbiter involved in a labor arbitration, the scope, application, or meaning of any rules, regulations, directives, or guidance issued by the Secretary of Homeland Security related to security background check requirements for employees when conducting a security background check. Appendix A to Part 1570—Reporting of Significant Security Concerns Category Description Breach, Attempted Intrusion, and/or Interference Unauthorized personnel attempting to or actually entering a restricted area or secure site relating to a transportation facility or conveyance owned, operated, or used by an owner/operator subject to this part. This includes individuals entering or attempting to enter by impersonation of authorized personnel (for example, police/security, janitor, vehicle owner/operator). Activity that could interfere with the ability of employees to perform duties to the extent that security is threatened. Misrepresentation Presenting false, or misusing, insignia, documents, and/or identification, to misrepresent one's affiliation with an owner/operator subject to this part to cover possible illicit activity that may pose a risk to transportation security. Theft, Loss, and/or Diversion Stealing or diverting identification media or badges, uniforms, vehicles, keys, tools capable of compromising track integrity, portable derails, technology, or classified or sensitive security information documents which are proprietary to the facility or conveyance owned, operated, or used by an owner/operator subject to this part. Sabotage, Tampering, and/or Vandalism Damaging, manipulating, or defeating safety and security appliances in connection with a facility, infrastructure, conveyance, or routing mechanism, resulting in the compromised use or the temporary or permanent loss of use of the facility, infrastructure, conveyance or routing mechanism. Placing or attaching a foreign object to a rail car(s). Cyber Attack Compromising, or attempting to compromise or disrupt the information/technology infrastructure of an owner/operator subject to this part. Expressed or Implied Threat Communicating a spoken or written threat to damage or compromise a facility/infrastructure/conveyance owned, operated, or used by an owner/operator subject to this part (for example, a bomb threat or active shooter). Eliciting Information Questioning that may pose a risk to transportation or national security, such as asking one or more employees of an owner/operator subject to this part about particular facets of a facility's conveyance's purpose, operations, or security procedures. Testing or Probing of Security Deliberate interactions with employees of an owner/operator subject to this part or challenges to facilities or systems owned, operated, or used by an owner/operator subject to this part that reveal physical, personnel, or cyber security capabilities. Photography Taking photographs or video of facilities, conveyances, or infrastructure owned, operated, or used by an owner/operator subject to this part in a manner that may pose a risk to transportation or national security. Examples include taking photographs or video of infrequently used access points, personnel performing security functions (for example, patrols, badge/vehicle checking), or security-related equipment (for example, perimeter fencing, security cameras). Observation or Surveillance Demonstrating unusual interest in facilities or loitering near conveyances, railcar routing appliances or any potentially critical infrastructure owned or operated by an owner/operator subject to this part in a manner that may pose a risk to transportation or national security. Examples include observation through binoculars, taking notes, or attempting to measure distances. Materials Acquisition and/or Storage Acquisition and/or storage by an employee of an owner/operator subject to this part of materials such as cell phones, pagers, fuel, chemicals, toxic materials, and/or timers that may pose a risk to transportation or national security (for example, storage of chemicals not needed by an employee for the performance of his or her job duties). Weapons Discovery, Discharge, or Seizure. Weapons or explosives in or around a facility, conveyance, or infrastructure of an owner/operator subject to this part that may present a risk to transportation or national security (for example, discovery of weapons inconsistent with the type or quantity traditionally used by company security personnel). Suspicious Items or Activity Discovery or observation of suspicious items, activity or behavior in or around a facility, conveyance, or infrastructure of an owner/operator subject to this part that results in the disruption or termination of operations (for example, halting the operation of a conveyance while law enforcement personnel investigate a suspicious bag, briefcase, or package).

Related documents

• 50 CFR Part 10 — General Provisions#512073
• 37 CFR Part 220 — General Provisions#509153
• 43 CFR Part 1810 — Introduction and General Guidance#510087
• 49 CFR Part 1100 — General Provisions#511977
• 16 CFR Part 4 — Miscellaneous Rules#506014