Each State must revoke an individual's HME immediately, if TSA informs the State that the individual does not meet the standards for security threat assessment in 49 CFR 1572.5 and issues an Initial Determination of Threat Assessment and Immediate Revocation.

(a) No State may issue or renew an HME for a CDL, unless the State receives a Determination of No Security Threat from TSA.

(b) Each State must notify each individual holding an HME issued by that State that he or she will be subject to the security threat assessment described in this part as part of an application for renewal of the HME, at least 60 days prior to the expiration date of the individual's HME. The notice must inform the individual that he or she may initiate the security threat assessment required by this section at any time after receiving the notice, but no later than 60 days before the expiration date of the individual's HME.

(c) The State that issued an HME may extend the expiration date of the HME for 90 days, if TSA has not provided a Determination of No Security Threat or a Final Determination of Threat Assessment before the expiration date. Any additional extension must be approved in advance by TSA.

(d) Within 15 days of receipt of a Determination of No Security Threat or Final Determination of Threat Assessment from TSA, the State must—

(1) Update the applicant's permanent record to reflect:

(i) The results of the security threat assessment;

(ii) The issuance or denial of an HME; and

(iii) The new expiration date of the HME.

(2) Notify the Commercial Drivers License Information System (CDLIS) operator of the results of the security threat assessment.

(3) Revoke or deny the applicant's HME if TSA serves the State with a Final Determination of Threat Assessment.

(e) For applicants who apply to transfer an existing HME from one State to another, the second State will not require the applicant to undergo a new security threat assessment until the security threat assessment renewal period established in the preceding issuing State, not to exceed five years, expires.

(f) A State that is not using TSA's agent to conduct enrollment for the security threat assessment must retain the application and information required in 49 CFR 1572.9, for at least one year, in paper or electronic form.