Public Transportation and Transit Agency Security

Public Transportation Agency Safety Plan requirements sit at 49 CFR Part 673, as amended by a final rule effective May 13, 2024. Agencies must maintain a Safety Management System with documented risk assessment and mitigation. That is a paperwork obligation with a technology consequence, because undocumented risk is the kind auditors find.

The amendments specifically require agencies to consider deployment of assault mitigation infrastructure and technology, including barriers restricting unwanted entry into bus operator workstations. Consideration has to be documented, which means the decision to install or not install is itself a record.

Joint labor-management Safety Committees are required for providers serving urbanized areas over 200,000 population, and those committees must be involved in assault mitigation decisions. Bring them in before the equipment decision, not after.

Safety Performance Targets must be set, including targets for assaults on transit workers. Safety management system documentation is retained a minimum of three years.

FTA issued General Directive 24-1 on assaults on transit workers on September 25, 2024. It required a safety risk assessment, identification of mitigations and a one-time report back to FTA.

FTA's published analysis of those reports found that more than two-thirds of transit agencies determined safety risk mitigations are necessary to reduce the risk of assaults on transit workers. The four most commonly reported mitigations were de-escalation training, operator area barriers, policies and procedures, and patrol strategies.

FTA attached its own caveat, and it is worth repeating: it does not equate full mitigation implementation with full prevention. Nobody in this field should promise otherwise.

49 CFR Part 1582 requires security training for employees in security-sensitive positions, including operators, dispatchers, station agents and maintenance staff with restricted area access. An employee cannot perform that function for more than 60 calendar days without completing the training.

Beyond that, an honest read matters. TSA's surface transportation regime is overwhelmingly cybersecurity focused and applies mainly to higher-risk rail operators rather than to a typical bus agency. Selling a mid-size bus agency a compliance panic about TSA directives is not accurate.

For most agencies the relevant angle is hardening the video system itself. That means network segmentation away from business systems, certificate management, a real firmware lifecycle rather than install-and-forget, and readiness to report an incident quickly. A camera network is a fleet of small Linux computers on your network, and it should be maintained like one.

APTA's recommended practice for transit CCTV remains the technical baseline the industry cites. It dates to 2011, so its resolution guidance is dated, written before current sensor and compression capability.

Its functional-objective and retention framework still holds. Defining what each camera must accomplish, monitor, recognize or identify, and then designing to that objective, is the part that has aged well. Use the framework and update the pixel math.

Section 5307 requires a recipient to certify that it will spend at least one percent of its formula funds on public transportation security projects. The statute also allows a recipient to certify that such expenditures are not necessary, so in practice it functions as an opt-out rather than a hard floor. Eligible capital uses explicitly include crime prevention and security equipment, at an 80 percent federal share for capital.

The Transit Security Grant Program is the competitive path. A recent cycle made 88.35 million dollars available with an expected award range of 431,327 to 33,898,500 dollars across roughly 25 awards, with no cost share required. CCTV is explicitly eligible.

Eligibility is narrow. It is limited to passenger rail, intra-city bus and ferry systems specifically identified in the program appendix, based on daily unlinked passenger trips and service to designated urban areas. Many agencies that would benefit are simply not eligible, and the Section 5307 path is the realistic one for them.

Here is the planning question an agency will actually find useful. It is not whether you need cameras. It is how you are meeting your Section 5307 security expenditure certification this year, and whether the projects you are already planning qualify.

One platform, four domains. Vehicles report events and offload video at the yard. Stations record continuously with defined retention. Facilities and yards carry access control, gates and license plate recognition. The operations center searches all of it from one interface with role-based access and a single audit trail.

Genetec is the software platform we build on for that work, because open architecture lets an agency keep serviceable equipment and standardize operations without committing to one hardware source for the next decade.