(a) Retention. Each owner/operator required to have a security program under subpart B to parts 1580, 1582, and 1584 of this subchapter must—

(1) Retain security training records for each individual required to receive security training under §§1580.115, 1582.115, and 1584.115 that, at a minimum—

(i) Includes employee's full name, job title or function, date of hire, and date of initial and recurrent security training; and

(ii) Identifies the date, course name, course length, and list of topics addressed for the security training most recently provided in each of the areas required under §§1580.115, 1582.115, and 1584.115 of this subchapter.

(2) Retain records of initial and recurrent security training for no less than five (5) years from the date of training.

(3) Provide records to current and former employees upon request and at no charge as necessary to provide proof of training.

(b) Electronic records. Each owner/operator required to retain records under this section may keep them in electronic form. An owner/operator may maintain and transfer records through electronic transmission, storage, and retrieval provided that the electronic system provides for the maintenance of records as originally submitted without corruption, loss of data, or tampering.

(c) Protection of SSI. Each owner/operator must restrict the distribution, disclosure, and availability of security sensitive information, as identified in part 1520 of this chapter, to persons with a need to know. The owner/operator must refer requests for such information by other persons to TSA.

(d) Availability. Each owner/operator must make the records available to TSA upon request for inspection and copying.