(a) The oversight agency shall require the rail transit agency to implement a system security plan that, at a minimum, complies with requirements in this part and the oversight agency's program standard. The system security plan must be developed and maintained as a separate document and may not be part of the rail transit agency's system safety program plan.

(b) The oversight agency may prohibit a rail transit agency from publicly disclosing the system security plan.

(c) After approving the system security plan, the oversight agency shall issue a formal letter of approval, including the checklist used to conduct the review, to the rail transit agency.