49 CFR §299.11

1. (a)The railroad maintains an information technology security program adequate to ensure the integrity of the electronic data storage system, including the prevention of unauthorized access to the program logic or individual records;
2. (b)The program and data storage system must be protected by a security system that utilizes an employee identification number and password, or a comparable method, to establish appropriate levels of program access meeting all of the following standards:
   1. (1)No two individuals have the same electronic identity; and
   2. (2)A record cannot be deleted or altered by any individual after the record is certified by the employee who created the record.
3. (c)Any amendment to a record is either—
   1. (1)Electronically stored apart from the record that it amends; or
   2. (2)Electronically attached to the record as information without changing the original record;
4. (d)Each amendment to a record uniquely identifies the person making the amendment;
5. (e)The system employed by the railroad for data storage permits reasonable access and retrieval; and
6. (f)Information retrieved from the system can be easily produced in a printed format which can be readily provided to FRA representatives in a timely manner and authenticated by a designated representative of the railroad as a true and accurate copy of the railroad's records if requested to do so by FRA representatives.