49 CFR Part 673

49 CFR Part 673
Title	49 CFR Part 673
Subject	Transportation security regulation
Issued by	United States Department of Transportation; Transportation Security Administration
Legal authority	Maritime Transportation Security Act of 2002; Robert T. Stafford Disaster Relief and Emergency Assistance Act
Code	Title 49, Code of Federal Regulations
First issued	2003

49 CFR Part 673

49 CFR Part 673 prescribes security planning, performance standards, and implementation procedures for transportation-sensitive operations and facilities regulated under the United States Code. The regulation establishes mandatory safeguards, assessment methodologies, and corrective-action obligations administered by the Transportation Security Administration and coordinated with other agencies such as the United States Coast Guard and the Federal Emergency Management Agency. It is situated in Title 49 of the Code of Federal Regulations and interacts with statutory authorities including the Maritime Transportation Security Act of 2002 and other executive directives.

Overview

49 CFR Part 673 sets forth requirements for written security plans, performance-based standards, vulnerability assessments, and continuous monitoring for covered entities. The rule is designed to reduce risk from threats identified by the Department of Homeland Security, informed by intelligence from the Federal Bureau of Investigation, and aligned with guidance from the National Transportation Safety Board. It mandates coordination with local entities such as the Department of Defense, United States Secret Service, and state-level homeland security agencies to align preparedness and response. The regulation emphasizes risk management, situational awareness, and resilience consistent with directives from the White House and federal statutory frameworks like the Homeland Security Act of 2002.

Applicability and Scope

Part 673 applies to designated transportation operators, facilities, and service providers identified by the Transportation Security Administration and sector-specific agencies. Covered entities frequently include ports overseen by the United States Coast Guard, rail infrastructure connected to the Federal Railroad Administration, and aviation operations tied to the Federal Aviation Administration. The scope extends to entities subject to the Maritime Transportation Security Act of 2002 and intermodal supply chain participants linked to the Department of Commerce or regulated by the Surface Transportation Board. Exemptions or modified requirements may apply where other statutes such as the Aviation and Transportation Security Act or bi-national agreements with Canada and Mexico create overlapping regimes.

Security Plan Requirements

Entities subject to Part 673 must develop, submit, and maintain security plans that incorporate vulnerability assessments, mitigation strategies, and continuous improvement processes. Plans typically reference standards from the National Institute of Standards and Technology and coordination protocols with the Federal Emergency Management Agency and local first responders such as municipal police and fire departments. Security plans must identify critical assets, protective measures, access controls, and incident reporting procedures consistent with guidance from the Transportation Security Administration and intelligence-sharing frameworks of the Intelligence Community. Plans often integrate exercises modeled after national drills like those coordinated by the Department of Homeland Security and incorporate lessons learned from incidents investigated by the National Transportation Safety Board.

Performance Standards and Procedures

Part 673 prescribes performance-based outcomes rather than prescriptive hardware requirements, requiring entities to demonstrate effective risk reduction through measurable metrics. Performance standards align with consensus documents published by bodies such as the National Institute of Standards and Technology and interoperability expectations with the Federal Communications Commission for secure communications. Procedures include vulnerability testing, access control verification, screening protocols influenced by practices at John F. Kennedy International Airport and Los Angeles International Airport, and continuity measures compatible with FEMA recovery planning. Entities may use third-party assessors with credentials recognized by agencies like the Transportation Security Administration and professional organizations such as the American Society of Civil Engineers.

Enforcement and Compliance

Compliance with Part 673 is enforced through inspections, audits, and civil penalties administered by the Transportation Security Administration in coordination with the Department of Homeland Security. Noncompliance can lead to corrective action orders, fines, and, in certain circumstances, operational restrictions enforced with assistance from the United States Coast Guard or Federal Aviation Administration. Appeals and adjudications may proceed through administrative law processes involving the Department of Transportation and federal courts such as the United States Court of Appeals for the District of Columbia Circuit. Entities are required to report significant security incidents to agencies including the Federal Bureau of Investigation and to participate in interagency investigations when incidents implicate national security.

History and Regulatory Amendments

Part 673 originated in the post-9/11 regulatory environment shaped by statutes such as the Aviation and Transportation Security Act and the Maritime Transportation Security Act of 2002. Its development involved rulemaking notices and public comment periods managed by the Department of Transportation and the Transportation Security Administration, reflecting input from stakeholders including port authorities like the Port Authority of New York and New Jersey and rail carriers represented by the Association of American Railroads. Subsequent amendments have incorporated advances in cybersecurity guidance from the National Institute of Standards and Technology and risk-assessment methodologies promulgated following events investigated by the National Transportation Safety Board and intelligence assessments by the Office of the Director of National Intelligence. Periodic updates continue to reconcile Part 673 with international conventions administered by organizations such as the International Maritime Organization and bilateral agreements involving Canada and Mexico.

Category:United States federal transportation regulations