[Code of Federal Regulations]
[Title 39, Volume 1]
[Revised as of July 1, 2003]
From the U.S. Government Printing Office via GPO Access
[CITE: 39CFR501.13]

[Page 179-180]
 
                        TITLE 39--POSTAL SERVICE
 
                 CHAPTER I--UNITED STATES POSTAL SERVICE
 
PART 501--AUTHORIZATION TO MANUFACTURE AND DISTRIBUTE POSTAGE METERS--Table 
of Contents
 
Sec. 501.13  Reporting.

    (a) For purposes of this section, ``manufacturer'' refers to the 
authorized postage meter manufacturer in Sec. 501.1 and its foreign 
affiliates, subsidiaries, assigns, dealers, independent dealers, 
employees, and parent corporations.
    (b) Each authorized meter manufacturer in Sec. 501.1 must submit a 
preliminary report to notify the Postal Service promptly (in no event 
more than 21 calendar days of discovery or 21 calendar days from June 
30, 1995) of the following:
    (1) All findings or results of any testing known to the manufacturer 
concerning the security or revenue protection features, capabilities, or 
failings of any meters sold, leased, or distributed by the manufacturer 
that have been approved for sale, lease, or distribution by the Postal 
Service or any foreign postal administration; or have been submitted for 
approval by the manufacturer to the Postal Service or other foreign 
postal administration(s).
    (2) All potential security weaknesses or methods of meter tampering 
of the meters that the manufacturer distributes of which the 
manufacturer knows or should know, and the meter or model subject to 
each method. These potential security weaknesses include but are not 
limited to suspected equipment defects, suspected abuse by a meter 
licensee or manufacturer employee, suspected security breaches of the 
Computerized Remote Postage Meter Resetting System, occurrences outside 
normal performance, or any repeatable deviation from normal meter 
performance (within the same model family and/or by the same licensee).
    (c) Within 45 days of the preliminary notification of the Postal 
Service under Sec. 501.13(b), the manufacturer must submit a written 
report to the Postal Service. The report must include the circumstances, 
proposed investigative procedure, and the anticipated completion date of 
the investigation. The manufacturer must also provide periodic status 
reports to the Postal Service during subsequent investigation and, on 
completion, must submit a summary of the investigative findings.

[[Page 180]]

    (d) The manufacturer must establish and adhere to timely and 
efficient procedures for internal reporting of potential security 
weaknesses. The manufacturer is required to submit a copy of internal 
reporting procedures and instructions to the Postal Service for review.