Passenger Rail Transportation Security Regulations — 6
Security risk assessment 6 (1) A passenger company, other than a small passenger company, must conduct a security risk assessment of its network and operations that are related to passenger rail transportation in Canada that identifies, describes, assesses and prioritizes security risks and that (a) is based on the following elements: (i) current security threats, including security threat information received from a federal department or agency and threats or immediate threats identified in an instrument made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act; (ii) operations, railway equipment, railway works and other assets that are deemed critical and that most require protection from acts and attempted acts of unlawful interference with passenger rail transportation; (iii) security vulnerabilities, including those identified during daily operations, in security reports made under section 4 , during security inspections carried out under section 5 and during security exercises carried out under section 9 ; and (iv) potential impacts, including a decrease in public safety and security, loss of life, damage to property or the environment, disruption of rail transportation and financial and economic loss; (b) identifies, for each risk, the likelihood that the risk will occur and the severity of the impact that it could have if it occurs; and (c) identifies potential safeguards intended to mitigate the risks identified. Report (2) The security risk assessment must be documented in a report within 30 days after the day on which the assessment is completed and the report must (a) indicate the date of completion of the assessment; and (b) contain all the information referred to in subsection (1). Subsequent risk assessments (3) A passenger company, other than a small passenger company, must conduct a new security risk assessment within three years after the date of completion of the current security risk assessment, or any assessment that is carried out before the day on which this section comes into force and that meets the requirements of this section. Review (4) A passenger company, other than a small passenger company, must review its security risk assessment within seven days after the day on which (a) there is a change in circumstances that is likely to adversely affect passenger rail transportation security; (b) an instrument that identifies a threat or an immediate threat to passenger rail transportation security that is not described in the assessment is made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act; or (c) the company identifies a significant security vulnerability that is not described in the assessment. Periodic review (5) A passenger company, other than a small passenger company, must review its security risk assessment at least once every 12 months. A new risk assessment conducted under subsection (3) or a review conducted under subsection (4) is a review for the purposes of this subsection. Requirements for review (6) As part of a review referred to in subsection (4) or (5) — with the exception of a new risk assessment referred to in subsection (5) — a passenger company, other than a small passenger company, must (a) identify, describe, assess and prioritize any new security risks in accordance with subsection (1); and (b) document the review in the report on the current security risk assessment, including the date of the review, the reason for the review under subsection (4) or (5) and any new risks that have been identified, their priority level and the potential security safeguards, if applicable.