(a) Training required for security-sensitive employees. No owner/operator required to have a security training program under §1584.101 of this part may use a security-sensitive employee to perform a function identified in Appendix B to this part unless that individual has received training as part of a security training program approved by TSA under 49 CFR part 1570, subpart B, or is under the direct supervision of an employee who has received the training required by this section as applicable to that security-sensitive function.

(b) Limits on use of untrained employees. Notwithstanding paragraph (a) of this section, a security-sensitive employee may not perform a security-sensitive function for more than sixty (60) calendar days without receiving security training.

(c) Prepare. Each owner/operator must ensure that each of its security-sensitive employees with position- or function-specific responsibilities under the owner/operator's security program have knowledge of how to fulfill those responsibilities in the event of a security threat, breach, or incident to ensure—

(1) Employees with responsibility for transportation security equipment and systems are aware of their responsibilities and can verify the equipment and systems are operating and properly maintained; and

(2) Employees with other duties and responsibilities under the company's security plans and/or programs, including those required by Federal law, know their assignments and the steps or resources needed to fulfill them.

(d) Observe. Each owner/operator must ensure that each of its security-sensitive employees has knowledge of the observational skills necessary to recognize—

(1) Suspicious and/or dangerous items (such as substances, packages, or conditions (for example, characteristics of an IED and signs of equipment tampering or sabotage);

(2) Combinations of actions and individual behaviors that appear suspicious and/or dangerous, inappropriate, inconsistent, or out of the ordinary for the employee's work environment, which could indicate a threat to transportation security; and

(3) How a terrorist or someone with malicious intent may attempt to gain sensitive information or take advantage of vulnerabilities.

(e) Assess. Each owner/operator must ensure that each of its security-sensitive employees has knowledge necessary to—

(1) Determine whether the item, individual, behavior, or situation requires a response as a potential terrorist threat based on the respective transportation environment; and

(2) Identify appropriate responses based on observations and context.

(f) Respond. Each owner/operator must ensure that each of its security-sensitive employees has knowledge of how to—

(1) Appropriately report a security threat, including knowing how and when to report internally to other employees, supervisors, or management, and externally to local, state, or Federal agencies according to the owner/operator's security procedures or other relevant plans;

(2) Interact with the public and first responders at the scene of the threat or incident, including communication with passengers on evacuation and any specific procedures for individuals with disabilities and the elderly; and

(3) Use any applicable self-defense devices or other protective equipment provided to employees by the owner/operator.