(a) Initial security training. Each owner/operator required under parts 1580, 1582, or 1584 of this subchapter to adopt and carry out a security program must provide initial security training to security-sensitive employees, using the curriculum approved by TSA—

(1) No later than one year after the date of TSA-approval of the owner/operator's security training program if the employee is employed to perform a security-sensitive function on the date TSA approves the program.

(2) No later than 60 calendar days after the employee first performs a security-sensitive job function if performance of a security-sensitive job function is initiated after TSA approves the security training program.

(3) No later than the 60th calendar day of employment performing a security-sensitive function, aggregated over a consecutive 12-month period, if the security-sensitive job function is performed intermittently.

(b) Recurrent security training.

(1) Except as provided in paragraph (b)(2) of this section, a security-sensitive employee required to receive training under part 1580, 1582, or 1584 of this subchapter must receive the required training at least once every three years.

(2) If an owner/operator modifies a security program or security plan for which training is required under §1580.203(b), §1582.115(b), or §1584.115(b) of this subchapter, the owner/operator must ensure each security-sensitive employee with position- or function-specific responsibilities related to the revised plan or program changes receives training on the revisions within 90 days of implementation of the revised plan or program changes. All other employees must receive training that reflects the changes to the operating security requirements as part of their regularly scheduled recurrent training.

(3) The three-year recurrent training cycle is based on the anniversary calendar month of the employee's initial security training. If the owner/operator provides the recurrent security training in the month of, the month before, or the month after it is due, the employee is considered to have taken the training in the month it is due.

(c) Extensions of time. TSA may grant an extension of time for implementing a security program identified in subpart B to parts 1580, 1582, and 1584 of this subchapter upon a showing of good cause. The owner/operator must request the extension of time in writing and TSA must receive the request within a reasonable time before the due date to be extended; an owner/operator may request an extension after the expiration of a due date by sending a written request describing why the failure to meet the due date was excusable. TSA will respond to the request in writing.