[Code of Federal Regulations]
[Title 49, Volume 9]
[Revised as of October 1, 2006]
From the U.S. Government Printing Office via GPO Access
[CITE: 49CFR1520.9]

[Page 293-294]
 
                        TITLE 49--TRANSPORTATION
 
   CHAPTER XII--TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF 
                            HOMELAND SECURITY
 
PART 1520_PROTECTION OF SENSITIVE SECURITY INFORMATION--Table of Contents
 
Sec.  1520.9  Restrictions on the disclosure of SSI.

    (a) Duty to protect information. A covered person must--
    (1) Take reasonable steps to safeguard SSI in that person's 
possession or control from unauthorized disclosure. When a person is not 
in physical possession of SSI, the person must store it a secure 
container, such as a locked desk or file cabinet or in a locked room.
    (2) Disclose, or otherwise provide access to, SSI only to covered 
persons who have a need to know, unless otherwise authorized in writing 
by TSA, the Coast Guard, or the Secretary of DOT.
    (3) Refer requests by other persons for SSI to TSA or the applicable 
component or agency within DOT or DHS.
    (4) Mark SSI as specified in Sec.  1520.13.
    (5) Dispose of SSI as specified in Sec.  1520.19.
    (b) Unmarked SSI. If a covered person receives a record containing 
SSI that is not marked as specified in Sec.  1520.13, the covered person 
must--
    (1) Mark the record as specified in Sec.  1520.13; and

[[Page 294]]

    (2) Inform the sender of the record that the record must be marked 
as specified in Sec.  1520.13.
    (c) Duty to report unauthorized disclosure. When a covered person 
becomes aware that SSI has been released to unauthorized persons, the 
covered person must promptly inform TSA or the applicable DOT or DHS 
component or agency.
    (d) Additional Requirements for Critical Infrastructure Information. 
In the case of information that is both SSI and has been designated as 
critical infrastructure information under section 214 of the Homeland 
Security Act, any covered person who is a Federal employee in possession 
of such information must comply with the disclosure restrictions and 
other requirements applicable to such information under section 214 and 
any implementing regulations.