Safety and Security Management
Safety and Security Management
This domain tests the Safety Management System (SMS) framework that U.S. transit agencies must now operate, the risk-analysis skills underneath it, and the security side of the same coin. Expect questions on 49 CFR Part 673 (Public Transportation Agency Safety Plans, PTASP), 49 CFR Part 674 (State Safety Oversight), hazard analysis, and all-hazard security planning.
The SMS structure
- Four pillars: safety policy, safety risk management, safety assurance, safety promotion. Every regulatory citation and every scenario answer should map to one.
- Accountable Executive - a single named person with authority over the agency's budget and operations; Chief Safety Officer runs the day-to-day SMS.
- PTASP applies to recipients and operators of Section 5307 urbanized area funds; it must document performance targets, a risk-management process, and employee reporting.
- Part 674 requires an independent State Safety Oversight agency for rail fixed guideway systems; 49 CFR Part 672 sets the safety certification training required for designated safety personnel.
- Hazard vs. risk: a hazard is a condition with potential to harm; risk is the assessed likelihood × severity of that harm. Control hierarchy runs eliminate, engineer, administrate, then protect the person.
Security
Security uses an all-hazard, threat-based version of the same logic: threat × vulnerability × consequence. Transit agencies work through TSA security assessments, the Incident Command System (ICS/NIMS), joint drills with first responders, and CPTED design (lighting, sightlines, access control).
Worked example
A busy platform has a 4-inch horizontal and 2-inch vertical gap. Severity is scored 4 (serious injury, likely hospitalization) and likelihood 3, giving 12 - high risk. Engineering control (gap fillers, platform edge tactile strip) reduces likelihood to 1, scoring 4 - acceptable with monitoring. The entry in the risk register needs an owner, a due date, and a verification method; that is what distinguishes a compliant PTASP from a document that merely describes the problem.
Traps that cost marks
- Writing a mitigation with no owner, date, or residual-risk re-score.
- Treating security as a separate plan disconnected from the SMS.
- Assuming "just culture" means no accountability - it distinguishes error from at-risk and reckless behavior.
- Citing NFPA 130 egress criteria (roughly 4 minutes to clear a platform, 6 to reach a point of safety) for a non-fixed-guideway mode.