(a) In general
Not later than 12 months after August 3, 2007, the Secretary shall issue regulations that—

(1) require each railroad carrier assigned to a high-risk tier under this section to—

(A) conduct a vulnerability assessment in accordance with subsections (c) and (d); and

(B) to ¹ prepare, submit to the Secretary for approval, and implement a security plan in accordance with this section that addresses security performance requirements; and

(2) establish standards and guidelines, based on and consistent with the risk assessment and National Strategy for Railroad Transportation Security developed under section 1161 of this title, for developing and implementing the vulnerability assessments and security plans for railroad carriers assigned to high-risk tiers.

(b) Non high-risk programs
The Secretary may establish a security program for railroad carriers not assigned to a high-risk tier, including—

(1) guidance for such carriers in conducting vulnerability assessments and preparing and implementing security plans, as determined appropriate by the Secretary; and

(2) a process to review and approve such assessments and plans, as appropriate.

(c) Deadline for submission
Not later than 9 months after the date of issuance of the regulations under subsection (a), the vulnerability assessments and security plans required by such regulations for railroad carriers assigned to a high-risk tier shall be completed and submitted to the Secretary for review and approval.

(d) Vulnerability assessments

(1) Requirements
The Secretary shall provide technical assistance and guidance to railroad carriers in conducting vulnerability assessments under this section and shall require that each vulnerability assessment of a railroad carrier assigned to a high-risk tier under this section, include, as applicable—

(A) identification and evaluation of critical railroad carrier assets and infrastructure, including platforms, stations, intermodal terminals, tunnels, bridges, switching and storage areas, and information systems as appropriate;

(B) identification of the vulnerabilities to those assets and infrastructure;

(C) identification of strengths and weaknesses in—

(i) physical security;

(ii) passenger and cargo security, including the security of security-sensitive materials being transported by railroad or stored on railroad property;

(iii) programmable electronic devices, computers, or other automated systems which are used in providing the transportation;

(iv) alarms, cameras, and other protection systems;

(v) communications systems and utilities needed for railroad security purposes, including dispatching and notification systems;

(vi) emergency response planning;

(vii) employee training; and

(viii) such other matters as the Secretary determines appropriate; and

(D) identification of redundant and backup systems required to ensure the continued operation of critical elements of a railroad carrier's system in the event of an attack or other incident, including disruption of commercial electric power or communications network.

(2) Threat information
The Secretary shall provide in a timely manner to the appropriate employees of a railroad carrier, as designated by the railroad carrier, threat information that is relevant to the carrier when preparing and submitting a vulnerability assessment and security plan, including an assessment of the most likely methods that could be used by terrorists to exploit weaknesses in railroad security.

(e) Security plans

(1) Requirements
The Secretary shall provide technical assistance and guidance to railroad carriers in preparing and implementing security plans under this section, and shall require that each security plan of a railroad carrier assigned to a high-risk tier under this section include, as applicable—

(A) identification of a security coordinator having authority—

(i) to implement security actions under the plan;

(ii) to coordinate security improvements; and

(iii) to receive immediate communications from appropriate Federal officials regarding railroad security;

(B) a list of needed capital and operational improvements;

(C) procedures to be implemented or used by the railroad carrier in response to a terrorist attack, including evacuation and passenger communication plans that include individuals with disabilities as appropriate;

(D) identification of steps taken with State and local law enforcement agencies, emergency responders, and Federal officials to coordinate security measures and plans for response to a terrorist attack;

(E) a strategy and timeline for conducting training under section 1167 of this title;

(F) enhanced security measures to be taken by the railroad carrier when the Secretary declares a period of heightened security risk;

(G) plans for providing redundant and backup systems required to ensure the continued operation of critical elements of the railroad carrier's system in the event of a terrorist attack or other incident;

(H) a strategy for implementing enhanced security for shipments of security-sensitive materials, including plans for quickly locating and securing such shipments in the event of a terrorist attack or security incident; and

(I) such other actions or procedures as the Secretary determines are appropriate to address the security of railroad carriers.

(2) Security coordinator requirements
The Secretary shall require that the individual serving as the security coordinator identified in paragraph (1)(A) is a citizen of the United States. The Secretary may waive this requirement with respect to an individual if the Secretary determines that it is appropriate to do so based on a background check of the individual and a review of the consolidated terrorist watchlist.

(3) Consistency with other plans
The Secretary shall ensure that the security plans developed by railroad carriers under this section are consistent with the risk assessment and National Strategy for Railroad Transportation Security developed under section 1161 of this title.

(f) Deadline for review process
Not later than 6 months after receiving the assessments and plans required under this section, the Secretary shall—

(1) review each vulnerability assessment and security plan submitted to the Secretary in accordance with subsection (c);

(2) require amendments to any security plan that does not meet the requirements of this section; and

(3) approve any vulnerability assessment or security plan that meets the requirements of this section.

(g) Interim security measures
The Secretary may require railroad carriers, during the period before the deadline established under subsection (c), to submit a security plan under subsection (e) to implement any necessary interim security measures essential to providing adequate security of the railroad carrier's system. An interim plan required under this subsection will be superseded by a plan required under subsection (e).

(h) Tier assignment
Utilizing the risk assessment and National Strategy for Railroad Transportation Security required under section 1161 of this title, the Secretary shall assign each railroad carrier to a risk-based tier established by the Secretary:

(1) Provision of information
The Secretary may request, and a railroad carrier shall provide, information necessary for the Secretary to assign a railroad carrier to the appropriate tier under this subsection.

(2) Notification
Not later than 60 days after the date a railroad carrier is assigned to a tier under this subsection, the Secretary shall notify the railroad carrier of the tier to which it is assigned and the reasons for such assignment.

(3) High-risk tiers
At least one of the tiers established by the Secretary under this subsection shall be designated a tier for high-risk railroad carriers.

(4) Reassignment
The Secretary may reassign a railroad carrier to another tier, as appropriate, in response to changes in risk. The Secretary shall notify the railroad carrier not later than 60 days after such reassignment and provide the railroad carrier with the reasons for such reassignment.

(i) Nondisclosure of information

(1) Submission of information to Congress
Nothing in this section shall be construed as authorizing the withholding of any information from Congress.

(2) Disclosure of independently furnished information
Nothing in this section shall be construed as affecting any authority or obligation of a Federal agency to disclose any record or information that the Federal agency obtains from a railroad carrier under any other Federal law.

(j) Existing procedures, protocols and standards

(1) Determination
In response to a petition by a railroad carrier or at the discretion of the Secretary, the Secretary may determine that existing procedures, protocols, and standards meet all or part of the requirements of this section, including regulations issued under subsection (a), regarding vulnerability assessments and security plans.

(2) Election
Upon review and written determination by the Secretary that existing procedures, protocols, or standards of a railroad carrier satisfy the requirements of this section, the railroad carrier may elect to comply with those procedures, protocols, or standards instead of the requirements of this section.

(3) Partial approval
If the Secretary determines that the existing procedures, protocols, or standards of a railroad carrier satisfy only part of the requirements of this section, the Secretary may accept such submission, but shall require submission by the railroad carrier of any additional information relevant to the vulnerability assessment and security plan of the railroad carrier to ensure that the remaining requirements of this section are fulfilled.

(4) Notification
If the Secretary determines that particular existing procedures, protocols, or standards of a railroad carrier under this subsection do not satisfy the requirements of this section, the Secretary shall provide to the railroad carrier a written notification that includes an explanation of the determination.

(5) Review
Nothing in this subsection shall relieve the Secretary of the obligation—

(A) to review the vulnerability assessment and security plan submitted by a railroad carrier under this section; and

(B) to approve or disapprove each submission on an individual basis.

(k) Periodic evaluation by railroad carriers required

(1) Submission of evaluation
Not later than 3 years after the date on which a vulnerability assessment or security plan required to be submitted to the Secretary under subsection (c) is approved, and at least once every 5 years thereafter (or on such a schedule as the Secretary may establish by regulation), a railroad carrier who submitted a vulnerability assessment and security plan and who is still assigned to the high-risk tier must also submit to the Secretary an evaluation of the adequacy of the vulnerability assessment and security plan that includes a description of any material changes made to the vulnerability assessment or security plan.

(2) Review of evaluation
Not later than 180 days after the date on which an evaluation is submitted, the Secretary shall review the evaluation and notify the railroad carrier submitting the evaluation of the Secretary's approval or disapproval of the evaluation.

(l) Shared facilities
The Secretary may permit under this section the development and implementation of coordinated vulnerability assessments and security plans to the extent that a railroad carrier shares facilities with, or is colocated with, other transportation entities or providers that are required to develop vulnerability assessments and security plans under Federal law.

(m) Consultation
In carrying out this section, the Secretary shall consult with railroad carriers, nonprofit employee labor organizations representation railroad employees, and public safety and law enforcement officials.