Title 6—Domestic Security--Volume 1

§ 124.1 Purpose and scope.

(a) Purpose. This part implements the authority of the Secretary of Homeland Security and the Attorney General to develop the governance framework for the exercise of all counter-unmanned aircraft system (C-UAS) actions by State, local, Tribal, and territorial (SLTT) law enforcement and correctional agencies and their personnel under 6 U.S.C. 124n(a)(2), as amended by the SAFER SKIES Act. The purpose of actions taken under this authority is to detect, identify, monitor, track, warn, and, if necessary, mitigate credible threats posed by unmanned aircraft or unmanned aircraft systems (UAS) to the safety or security of people, facilities, or assets; a venue or set of venues used for large-scale public gatherings or events; critical infrastructure; or a correctional facility.

(b) Scope. This part applies to all SLTT law enforcement and correctional agencies, and their personnel seeking to exercise or exercising authority under 6 U.S.C. 124n(a)(2). This part does not govern Federal agency operations under 6 U.S.C. 124n(a)(1), nor deputized SLTT personnel conducting C-UAS as part of an FBI C-UAS task force, which are subject to separate policies and guidance. An SLTT law enforcement or correctional agency that conducts only detection and warning operations using systems the operation of which requires the authority of the Act or the relief it provides from certain laws is subject principally to the Detection and Warning Certification requirement of § 124.5(c), the detection and warning policy provisions of § 124.6(g), the authorized technology requirements of § 124.7, the C-UAS Operations Plan requirement of § 124.8, the operational conditions of § 124.12, and the privacy and data handling requirements of § 124.14.

(c) Relationship to other laws. As provided in 6 U.S.C. 124n(a)(2), actions taken by SLTT law enforcement and correctional agencies and their personnel in compliance with this part may be taken notwithstanding section 46502 of title 49, United States Code, and sections 32, 1030, and 1367 and chapters 119 and 206 of title 18, United States Code, and notwithstanding the laws of any particular State, local, Tribal, or territorial jurisdiction. Nothing in this part vests in the Secretary of Homeland Security or the Attorney General any authority of the Secretary of Transportation or the Administrator of the Federal Aviation Administration.

(d) Comprehensive framework. This part establishes the complete framework governing the exercise of authority under 6 U.S.C. 124n(a)(2), including the training and certification procedures required by 6 U.S.C. 124n(d)(2)(A) and the guidance required by 6 U.S.C. 124n(d)(1) on the matters this part addresses. An SLTT law enforcement or correctional agency and its personnel exercising authority under 6 U.S.C. 124n(a)(2) must conduct operations in accordance with this part. The Attorney General, the Secretary of Homeland Security, the Secretary of Transportation, and the Administrator of the Federal Aviation Administration may issue forms, templates, curricula, and other implementing materials under this part to the extent consistent with law. Where any implementing material addresses a matter also addressed by this part, this part controls. Nothing in this part limits the authority of the Secretary of Homeland Security, the Attorney General, or the Secretary of Transportation to issue guidance under 6 U.S.C. 124n(d)(1) in their respective areas.

(e) Parallel regulations. Consistent with section 8606(a)(1) of the Act, identical implementing regulations appear at 6 CFR part 124 and 28 CFR part 124. The Department of Homeland Security and Department of Justice administer and interpret their respective regulations with respect to their own programs, activities, and solely held authorities. Any description in these regulations of the other Department's programs, activities, or solely held authorities is provided for context and does not itself govern the other Department's exercise of its statutory authorities.

§ 124.2 Definitions.

As used in this part:

Agency accreditation means an agency's eligibility to exercise authority under this part, established when the agency has adopted the implementation policy and completed the portal attestation required by § 124.6(d), deploys only systems within categories on the Authorized Technologies List and, where populated, on the Authorized Systems List, and ensures that its personnel hold the certifications required for the authorities exercised.

Agency Approving Official means the senior official designated by an SLTT law enforcement or correctional agency in its implementation policy under § 124.6(a)(1), or in its detection and warning policy under § 124.6(g), authorized to approve C-UAS operations on behalf of the agency. The Agency Approving Official must not be below the rank of a Senior Executive or Senior Official or its equivalent, except that for an agency in which no equivalent rank exists, the agency head or the agency head's designee may serve as Agency Approving Official. The Agency Approving Official may not serve as a mitigation operator for an operation that official has approved.

Authorized Systems List means the subset of the Authorized Technologies List that identifies specific systems—including make, model, and hardware version—that have been authorized for operational use within one or more technology categories on the Authorized Technologies List. The Authorized Systems List is populated on a phased basis. As systems complete interagency assessment, systems may be added to the Authorized Systems List with appropriate operational limitations based on the approved capabilities, functions, and hardware version of the system.

Authorized Technologies List means the list of authorized technology categories for C-UAS operations by SLTT law enforcement and correctional agencies, maintained jointly by the Department of Justice, the Department of Homeland Security, the Department of Defense, the Department of Transportation and Federal Aviation Administration, the Federal Communications Commission, and the National Telecommunications and Information Administration, consistent with 6 U.S.C. 124n(d)(2)(A)(iii) and section 8606(a)(4) of the SAFER SKIES Act.

Control communications means any wire, oral, or electronic communication used to navigate, command, or otherwise control a UAS or unmanned aircraft, including telemetry transmitted from the aircraft to its operator, command-and-control signals transmitted from the operator to the aircraft, and any video, audio, or other data stream used by the operator to navigate the aircraft when other navigation telemetry is unavailable or insufficient. The operational role of a communication, rather than its packet type or transmission frequency, determines whether it is a control communication. Whether a communication is a control communication is determined when captured material is processed under § 124.14 and does not require an operator to determine in real time whether a particular video, audio, or data stream is being used to navigate the aircraft. Control communications also include a UAS unique identifier (such as a manufacturer device identifier or serial-correlated number), the operator or take-off location of the UAS, and the location, velocity, and emergency status of the UAS when that information is acquired by intercepting a communication from an unmanned aircraft or unmanned aircraft system pursuant to the relief provided by 6 U.S.C. 124n. The same information is not a control communication when it is obtainable without that relief.

Correctional agency has the meaning given in section 8606(c)(2) of the SAFER SKIES Act.

Correctional facility has the meaning given in 6 U.S.C. 124n(l)(9).

Credible threat means a threat that, based on the totality of circumstances known to the operator at the time of the determination, would cause a reasonable person in the operator's position, considering the operator's training and experience, to conclude that a UAS or unmanned aircraft poses an articulable risk to the safety or security of people, a facility, or an asset; a venue or set of venues used for large-scale public gatherings or events; critical infrastructure; or a correctional facility.

(1) A credible threat may be based on, but is not limited to:

(i) Specific intelligence, including information from law enforcement databases, threat assessments, or intelligence community products;

(ii) Behavioral indicators, including operation in airspace in which UAS operations have been restricted or prohibited by the Federal Aviation Administration, operation not in compliance with Federal Aviation Administration's flight requirements, approach toward a protected interest, failure to respond to warnings, or evasive maneuvering inconsistent with normal flight operations;

(iii) Payload or physical configuration indicators, including observed attachments, modifications, or configurations inconsistent with ordinary recreational or commercial UAS use that suggest capability to cause harm or to deliver prohibited items;

(iv) Unauthorized surveillance or reconnaissance of a protected interest that by law is protected from such activities, or interference with the operational mission of a protected interest;

(v) Indications that the UAS is being used to gain unauthorized access to, or to disclose, classified, law enforcement sensitive, or otherwise lawfully protected information; or

(vi) Pattern-based indicators, including repeated unauthorized UAS activity at a specific location (such as repeat incursions of national defense airspace in violation of 49 U.S.C. 46307), which may inform but do not independently satisfy the credible threat standard.

(2) A credible threat determination rests on the totality of the circumstances. A single indicator may establish a credible threat where it is sufficiently probative. For mitigation actions under 6 U.S.C. 124n(b)(1)(C), (D), and (F), the determination must be supported by a contemporaneous indicator that the specific unmanned aircraft system or unmanned aircraft at issue poses a current, articulable risk if unabated. For detection and warning actions under 6 U.S.C. 124n(b)(1)(A) and (B), a credible threat determination may also be supported by a reasonable basis to anticipate that one or more unmanned aircraft systems or unmanned aircraft poses an articulable risk. Activity protected by the First Amendment to the Constitution of the United States may not be considered in making a credible threat determination.

Critical infrastructure has the meaning given in subsection (e) of the Critical Infrastructures Protection Act of 2001 (Pub. L. 107-56, sec. 1016, 115 Stat. 272, 400-02 (codified at 42 U.S.C. 5195c)), as referenced in 6 U.S.C. 124n(l)(10).

Data purge verification means documented confirmation that records subject to purge have been deleted from all systems on which they were stored. Verification may be performed through an automated system, supervisory review, or other documented confirmation process, and must be recorded in the audit trail required by § 124.14.

Designated Federal C-UAS coordination portal means the electronic submission system designated by the Attorney General and Secretary of Homeland Security for advance notifications, notices of intent, C-UAS Operations Plans, mitigation notifications, post-operation reports, and other submissions required by this part.

Detection and Warning Certification means certification that personnel have successfully completed the online detection and warning training curriculum developed and maintained through the National Counter-UAS Training Center (NCUTC) and passed the post-course assessment. A Detection and Warning Certification authorizes the holder to exercise the authorities described in 6 U.S.C. 124n(b)(1)(A), (B), and (E). The certification is issued automatically through the NCUTC training portal upon successful completion of the curriculum and assessment and recorded in the NCUTC certification database.

Detection and warning operations means operations conducted using systems the operation of which requires the authority of, or relief from certain laws under, 6 U.S.C. 124n and involve only the actions described in 6 U.S.C. 124n(b)(1)(A) and (B). Detection and warning activity conducted using systems that do not require the authority of 6 U.S.C. 124n (including, for example, electro-optical, infrared, acoustic sensors, and radar) is not subject to this part. Operation of RF-emitting C-UAS systems remains subject to applicable Federal Communications Commission authorization requirements and Federal Aviation Administration coordination if such emission could impact the National Airspace System or other systems located at or near airports.

Detection system means a system or technology used to take an action described in 6 U.S.C. 124n(b)(1)(A) or (B)—that is, to detect, identify, monitor, or track a UAS or unmanned aircraft, or to warn its operator, and that has no capability enabled to disrupt or seize control of, or disable, damage, or destroy a UAS or unmanned aircraft.

FAA-designated coordination mechanism means the program, office, or process designated by the Administrator of the Federal Aviation Administration for the coordination of C-UAS operations that might affect aviation safety, civilian aviation and aerospace operations, aircraft airworthiness, or the use of the airspace.

Hazardous Devices School means the schoolhouse operated by the Federal Bureau of Investigation at which public safety bomb technicians are certified and recertified in accordance with the National Guidelines for Bomb Technicians, or any successor publication.

Mitigation action means an action described in 6 U.S.C. 124n(b)(1)(C), (D), or (F). Detection and warning, described in 6 U.S.C. 124n(b)(1)(A) and (B), are not mitigation actions.

Mitigation Certification means certification issued by the National Counter-UAS Training Center upon successful completion of the NCUTC mitigation training course or a successor course approved by the Attorney General acting through the Director of the Federal Bureau of Investigation, authorizing the holder to exercise the authorities described in 6 U.S.C. 124n(b)(1)(C), (D), and (F), to the extent consistent with this part and applicable laws, using authorized technologies within the mitigation technology categories covered by the approved mitigation courses the holder has completed. A current Detection and Warning Certification is a prerequisite for obtaining and maintaining a Mitigation Certification.

Mitigation operation means an operation in which a mitigation system is deployed for the purpose of taking an action described in 6 U.S.C. 124n(b)(1)(C), (D), or (F), including disrupting, seizing, or exercising control of, or using reasonable force, if necessary, to disable, damage, or destroy a UAS or unmanned aircraft, whether or not a mitigation action is taken during the operation. A mitigation operation may include elements of detection and warning operations.

Mitigation system means a system or technology used or capable of being employed to take an action described in 6 U.S.C. 124n(b)(1)(C), (D), or (F), including disrupting, seizing or exercising control of, or using force to disable, damage, or destroy a UAS or unmanned aircraft. A system with both detection and mitigation capability is a mitigation system while its mitigation capability is enabled.

National Counter-UAS Training Center (NCUTC) means the national schoolhouse operated by the Federal Bureau of Investigation and designated by the Attorney General, acting through the Director of the Federal Bureau of Investigation, as the national training center for purposes of 6 U.S.C. 124n and as the sole certifying authority for SLTT C-UAS mitigation operators under 6 U.S.C. 124n(d)(2)(A)(i).

Pattern data means a derived data product reflecting aggregated trends, frequencies, or statistical observations of UAS activity across multiple C-UAS operations that has met the anonymization standards established by the agency's implementation policy and contains no information identifying any specific aircraft, operator, or natural person.

Personnel means officers and employees with assigned duties that include the security or protection of people, facilities, or assets of SLTT law enforcement and correctional agencies, as defined in 6 U.S.C. 124n(a)(2) and (l)(6)(B). This term does not include contractors of SLTT law enforcement and correctional agencies.

Raw sensor data means unprocessed or minimally processed data generated by C-UAS detection or mitigation systems, including radio frequency signal captures, waveform recordings, radar returns, optical and infrared imagery, acoustic signatures, full sensor logs, and system telemetry. Whether a particular item of raw sensor data constitutes a control communication, and is therefore a record of communications subject to the retention limit of § 124.14, is determined by its function.

RF-emitting C-UAS system means any C-UAS system that, when employed for detection or mitigation purposes, actively transmits radio frequency energy to detect, disrupt, disable, or seize control of a UAS or unmanned aircraft. This includes systems employing technologies for detection-only purposes, such as radars that transmit radio frequency signals, that may require a radiolocation service license to be issued from the Federal Communications Commission, and mitigation systems that employ radio frequency jamming (broadband or protocol-specific disruption of command-and-control links, video downlinks, or navigation signals) and radio frequency protocol manipulation (command injection or cyber takeover of control signals).

SLTT law enforcement agency has the meaning given in section 8606(c)(1) of the SAFER SKIES Act.

Special Event Assessment Rating means a rating assigned to an event under the special event assessment process administered by the Department of Homeland Security, or the equivalent rating under any successor event rating system.

§ 124.3 Scope of authority and mitigation standards.

(a) Scope of authority. An SLTT law enforcement or correctional agency exercising authority under 6 U.S.C. 124n(a)(2) may take actions described in 6 U.S.C. 124n(b)(1), which generally include detection, warning, and mitigation, that are necessary to address or eliminate a credible threat that a UAS or unmanned aircraft poses to the safety or security of people, a facility, or an asset; a venue or set of venues used for large-scale public gatherings or events; critical infrastructure; or a correctional facility. These statutory categories are functional and are not a prescribed list of property types. The determination of whether a specific property falls within these categories is made by the agency's Agency Approving Official, consistent with this part and 6 U.S.C. 124n. No “covered facility or asset” designation under 6 U.S.C. 124n(l)(3) is required for SLTT law enforcement or correctional agency operations; however, a risk-based assessment is required as part of the Operations Plan, as outlined in § 124.8. Whether the property falls within a section 124n(a)(2) category is a separate question from the credible threat determination. The credible threat determination required by paragraph (b) of this section must be made before any mitigation action.

(b) Credible threat determination for mitigation actions. Before taking any mitigation action, personnel must reasonably determine, under the totality of the circumstances, that a credible threat exists, as defined in § 124.2. The determination must be made in real time by the certified and trained personnel closest to the operational situation and documented as part of the post-operation report required by § 124.13. An established pattern of unauthorized UAS activity at a specific location is relevant to the totality of the circumstances and may, in combination with a contemporaneous indicator—including, for example, a new detection event at the same location during a period consistent with the established pattern—support a credible threat determination. A contemporaneous indicator need not independently establish a threat. Considered with the totality of the circumstances, which may include an established pattern of unauthorized UAS activity, an intelligence indicator, or other contextual information, the contemporaneous indicator must provide a present-tense basis for concluding that the specific aircraft at issue poses a current risk. This operational standard governs individual mitigation decisions by authorized personnel in the application of reasonable force under the totality of the circumstances and does not limit the information or analysis that may be considered at the approval level in determining whether to authorize a C-UAS operation for a specific event or facility.

(c) Proportionality. Mitigation actions must be proportionate to the credible threat identified. Personnel must employ the least disruptive effective means of mitigation available under the totality of the circumstances. If equipment is available and time permits, a warning to the remote pilot-in-command should precede any mitigation action. Before taking any mitigation action that may result in the disabling, damage, or destruction of an unmanned aircraft, personnel must consider whether the threat posed by the UAS outweighs the risk of collateral harm to public safety. A mitigation action that creates a greater risk to public safety than the threat it is intended to address is not proportionate and must not be taken. Where a non-mitigation measure is sufficient to eliminate the threat, seizure or destruction of the aircraft should be avoided when feasible. The risk of collateral harm to public safety includes the risk of falling debris, damage to persons or property on the ground, disruption to communications systems, and risks to aviation safety, civilian aviation and aerospace operations, aircraft airworthiness, or the use of the airspace.

(d) Protective purpose limitation. The authority of 6 U.S.C. 124n(a)(2) is limited to the protection of people, facilities, and assets; a venue or set of venues used for large-scale public gatherings or events; critical infrastructure; and correctional facilities from credible threats posed by unmanned aircraft and UAS. C-UAS authority under this part may not be exercised for the sole purpose of collecting evidence for criminal prosecution or as a substitute for the authority provided by chapter 119 or 206 of title 18, United States Code. Evidence obtained incidental to lawful protective C-UAS operations may be used in subsequent criminal proceedings consistent with applicable law.

(e) Mitigation operator requirement. (1) The person who takes a mitigation action, including activating an RF-emitting system, executing a cyber-based takeover, or otherwise causing a C-UAS system to affect or otherwise impact the flight, control, or communications of a UAS or unmanned aircraft, must hold a current Mitigation Certification covering the technology category being employed, and must possess a valid 14 CFR part 107 remote pilot certificate. This requirement is not satisfied by supervision of an uncertified person by a certified operator; the certified operator must be the individual who directly executes the mitigation command or function.

(2) Support functions that do not involve the initiation of mitigation actions, such as detection system monitoring, threat triage and prioritization, ground intercept team dispatch, communications, and administrative functions, do not require Mitigation Certification, but must be performed by personnel trained in accordance with the agency's implementation policy and, where the support function involves operation of systems requiring the authority of 6 U.S.C. 124n(a)(2) or the relief it provides from certain laws, by personnel holding a current Detection and Warning Certification.

(3) For operations involving multiple personnel performing distinct roles, the agency's implementation policy must define the roles and responsibilities of each position, identify which positions require Mitigation Certification, and which require Detection and Warning Certification only, and establish the communication and concurrence procedures between the mitigation operator and other personnel.

(f) Independent professional judgment. (1) The certified mitigation operator retains independent professional judgment on whether to initiate a mitigation action.

(2) A supervisor, commander, or other official, regardless of rank, may provide operational direction, tactical context, and coordination guidance to the operator, and may direct the operator to withhold or cease mitigation when broader operational considerations warrant.

(3) A supervisor, commander, or other official may not direct a certified operator to initiate a mitigation action when the operator has determined that the credible threat standard is not met or that the proportionality requirement of paragraph (c) of this section is not satisfied.

(4) The agency's implementation policy must address the chain of command for mitigation decisions and must make clear that non-certified personnel, regardless of rank, may not direct mitigation actions that override the certified operator's professional judgment on whether the conditions for mitigation are present.

(5) An operator who declines to initiate mitigation based on a good-faith professional determination that the conditions for mitigation are not met may not be subjected to adverse employment action for that decision.

(g) Airspace awareness. (1) For operations where known authorized manned or unmanned aviation is operating or anticipated in or near the area of operations, the agency's implementation policy or C-UAS Operations Plan must designate a person or position responsible for maintaining real-time awareness of known authorized aviation within the operational area and for ensuring that this information is communicated to personnel authorized to initiate mitigation actions before any mitigation is executed. For purposes of this paragraph, known authorized aviation means any manned or unmanned aircraft that has been identified in the C-UAS Operations Plan, communicated to the C-UAS team during the operation, or otherwise confirmed as lawfully operating in or near the area of operations. The designated person, or the individual filling the designated position, must have the ability to communicate directly with the mitigation operator. No mitigation action may be initiated without reasonable efforts to confirm that the target is not a known authorized aircraft.

(2) The scope and formality of this role must be commensurate with the complexity of the aviation environment. For operations with minimal or no known authorized aviation, this role may be performed as an additional duty by the certified operator or other command post personnel; for operations with significant aviation activity, the agency must designate a dedicated individual with airspace awareness and coordination responsibilities. When a target cannot be correlated with any known, authorized aircraft and meets the credible threat standard, mitigation may proceed.

§ 124.4 Authorized personnel, contractors, and mutual aid.

(a) Officers and employees. The authority provided by 6 U.S.C. 124n(a)(2) may be exercised only by SLTT law enforcement or correctional agency personnel. No SLTT law enforcement or correctional agency may delegate or transfer the exercise of C-UAS mitigation authority to any person or entity that is not an officer or employee of the agency.

(b) Prohibition on contractor exercise. Contractors may provide technical support, system maintenance, and training assistance, but may not operate C-UAS mitigation systems, make credible threat determinations, or execute mitigation actions. An arrangement in which a contractor exercises de facto operational control of a C-UAS mitigation system during an operation, including an arrangement described as a turnkey, managed service, or operator-provided C-UAS service, constitutes an unauthorized delegation of authority and is grounds for suspension of accreditation or certification under § 124.5(i). Detection services that do not require the authority of the Act or the relief it provides from certain laws may be provided by contractors.

(c) Mutual aid and regional C-UAS support. (1) An SLTT law enforcement or correctional agency accredited under 6 U.S.C. 124n(d)(2) may provide C-UAS support to another SLTT law enforcement or correctional agency, including an agency that is not accredited under this part, under a mutual aid agreement, memorandum of understanding, request for assistance, task force arrangement, or other written arrangement authorized by applicable State, local, Tribal, or territorial law.

(2) When the requesting or host agency is not accredited under 6 U.S.C. 124n(d)(2), the accredited agency providing C-UAS support is the C-UAS operating agency for purposes of this part and is responsible for compliance with the applicable requirements of this part.

(3) Personnel of a non-accredited requesting or host agency may support the operation through ordinary law enforcement, correctional, public safety, evidence-handling, perimeter-security, ground-intercept, evacuation, traffic-control, or incident-command functions. Such personnel may not exercise C-UAS authority under 6 U.S.C. 124n(a)(2), operate systems whose operation requires the authority of or relief from certain laws under 6 U.S.C. 124n, make a credible-threat determination, or initiate any mitigation action, unless those personnel independently satisfy the requirements of this part, hold the applicable certification under § 124.5, and are expressly designated in the accredited C-UAS operating agency's C-UAS Operations Plan to perform that function. Personnel so designated operate under that agency's implementation policy, Agency Approving Official approval, supervision, and compliance responsibility. An individual certification does not, by itself, authorize personnel to exercise 6 U.S.C. 124n(a)(2) authority, and this designation must be established in advance through the C-UAS Operations Plan and the mutual-aid arrangement under paragraph (c)(4) of this section.

(4) The written mutual aid arrangement must identify the requesting or host agency, the accredited agency providing C-UAS support, the legal basis for the accredited agency's personnel to operate in the host jurisdiction, the allocation of operational responsibilities, and the handling of C-UAS-derived information consistent with §§ 124.14 and 124.15.

(5) For multi-jurisdictional operations, the participating agencies must identify a lead C-UAS agency for tactical C-UAS coordination. The lead C-UAS agency must be an accredited agency unless the operation is conducted under Federal authority pursuant to § 124.19. A non-accredited requesting or host agency may serve as the lead public safety, law enforcement, correctional, or incident-command agency for the overall event or incident, but may not serve as the lead C-UAS agency unless accredited under this part.

(6) An accredited agency may enter into standing regional, county, statewide, or other multi-jurisdictional arrangements to provide recurring or on-call C-UAS support to non-accredited agencies. A standing arrangement does not itself authorize a mitigation operation; each mitigation operation remains subject to the applicable requirements of this part.

(7) Nothing in this part requires a small, rural, or otherwise resource-limited SLTT law enforcement or correctional agency to acquire C-UAS equipment, obtain accreditation, or establish an independent C-UAS program in order to receive C-UAS support from an accredited agency.

(d) Anti-circumvention. (1) No SLTT law enforcement or correctional agency, officer, employee, contractor, vendor, or other person may structure or use a mutual aid, regional support, managed-service, technical-support, or other arrangement to evade the requirements of this part.

(2) Prohibited circumvention includes using an accredited agency as a nominal sponsor while a non-accredited agency, contractor, vendor, or other entity exercises de facto operational control of C-UAS activity requiring the authority of or relief from certain laws under 6 U.S.C. 124n; allowing personnel who lack the certifications required by § 124.5 to exercise C-UAS authority; using systems outside the requirements of § 124.7; avoiding the coordination, reporting, privacy, sensitive-information, or compliance requirements of this part; or acquiring third-party intercepted communications in a manner inconsistent with § 124.14(i).

(3) A mutual aid, regional support, statewide support, county support, or multi-jurisdictional C-UAS arrangement is not circumvention merely because the requesting or host agency is not accredited, provided that the C-UAS operating agency is accredited, the personnel exercising C-UAS authority hold the required certifications, and the operation is conducted in compliance with this part.

§ 124.5 Training and certification.

(a) Training and certification structure. This section establishes the training and certification structure implementing the requirements of 6 U.S.C. 124n(d)(2)(A). Detection and Warning Certification governs training for detection and warning operations under 6 U.S.C. 124n(b)(1)(A) and (B). Mitigation Certification governs training and certification for mitigation operations under 6 U.S.C. 124n(b)(1)(C), (D), and (F). A current Detection and Warning Certification is a prerequisite both for initial enrollment in the mitigation training course and for mitigation recertification.

(b) Agency implementation policy. Before conducting any operations under this part, an SLTT law enforcement or correctional agency must adopt an agency implementation policy or detection and warning policy and complete the portal attestation in accordance with § 124.6, and must authorize each operation by a C-UAS Operations Plan in accordance with § 124.8, consistent with the other requirements and obligations of this part and applicable laws and policies.

(c) Detection and Warning Certification. The Attorney General, acting through the Director of the Federal Bureau of Investigation, will develop and maintain through the NCUTC an online training curriculum for detection and warning operations, accessible through a secure web-based training portal. The curriculum includes the confiscation authority of 6 U.S.C. 124n(b)(1)(E), evidence preservation, and chain of custody. Only those personnel who have completed the curriculum and passed the post-course assessment may exercise the authorities described in 6 U.S.C. 124n(b)(1)(A), (B), and (E). Upon successful completion, the NCUTC training portal automatically issues a Detection and Warning Certification. Detection and Warning Certification is issued only by the NCUTC, and detection and warning training or certification obtained from another agency or a private entity does not satisfy this requirement. Detection and warning activity conducted using systems that do not require the authority of 6 U.S.C. 124n is not subject to this requirement. Upon successful completion, the training portal records the individual's name, agency, date of completion, and certification status in the NCUTC certification database, which is the system of record for all certifications issued under this section. Each agency must maintain a roster of its certified personnel drawn from the NCUTC certification database and must verify the certification status of personnel assigned to C-UAS operations. Vendor-specific and system-level operator training is the responsibility of each agency through its own training procedures and is not part of the detection and warning curriculum.

(d) Mitigation training and certification. (1) The Attorney General, acting through the Director of the Federal Bureau of Investigation, designates the NCUTC as the national schoolhouse and sole certifying authority for personnel exercising mitigation authorities under 6 U.S.C. 124n(b)(1)(C), (D), and (F), as required by 6 U.S.C. 124n(d)(2)(A)(i). Only personnel who hold a valid Mitigation Certification may exercise these authorities. The NCUTC mitigation training program consists of the mitigation training course and such advanced and supplemental courses as the Attorney General, acting through the Director of the Federal Bureau of Investigation, approves. Each course is evaluated on a pass or fail basis and requires demonstrated proficiency in each mitigation technology category it covers; a person who does not demonstrate proficiency in each category does not pass that course. A person obtains Mitigation Certification by passing the mitigation training course and may extend the scope of that certification to additional mitigation technology categories by passing an advanced or supplemental course covering those additional categories. Failure to pass a particular advanced or supplemental course does not affect the scope of a certification already held.

(2) A person who holds a current Mitigation Certification under this paragraph (d) may conduct mitigation operations at a correctional facility. An abbreviated Correctional Mitigation Certification, limited to correctional-facility operations, is available for personnel who will operate only at correctional facilities.

(3) The mitigation training course under this paragraph is delivered at the NCUTC. The Attorney General, acting through the Director of the Federal Bureau of Investigation, may authorize the Federal Law Enforcement Training Centers or another qualified Federal training provider to deliver the mitigation training course at one or more additional sites, provided the NCUTC retains approval authority over curriculum and standards, exercises oversight of the delivery, and issues all certifications upon verified completion. Any such authorization is at the sole discretion of the Attorney General, acting through the Director, confers no entitlement on any agency or training provider, and may be modified or withdrawn at any time.

(e) Correctional mitigation training and certification. The NCUTC offers an abbreviated Correctional Mitigation Certification for personnel who will conduct mitigation operations only at correctional facilities. The correctional course of instruction is shorter than the mitigation training course under paragraph (d) of this section because the fixed perimeter and persistent-threat environment of a correctional facility reduce the operational setup and mission-planning instruction required. The correctional course of instruction addresses the persistent-threat environment, perimeter operations, and the legal and safety considerations of correctional settings. A person who holds only the Correctional Mitigation Certification may conduct mitigation operations at a correctional facility but may not conduct other mitigation operations under this part. The NCUTC may arrange for the Federal Law Enforcement Training Centers or another qualified training provider to deliver the correctional curriculum, provided the NCUTC retains approval authority over curriculum and standards, exercises oversight of the delivery, and issues all certifications upon verified completion.

(f) Training standards. The mitigation training course, as administered by the NCUTC, will include instruction on the legal, operational, and technological aspects of C-UAS operations as required by section 8606(b)(1) of the SAFER SKIES Act, including FAA coordination and airspace procedures, spectrum coordination requirements, real-time air traffic control notification procedures, FBI and DHS notification requirements, and the operational use of authorized mitigation technologies. The Attorney General, in coordination with the Secretary of Homeland Security, the Secretary of Defense, the Secretary of Transportation, and the Administrator of the Federal Aviation Administration, will approve training program standards and may approve additional courses of instruction for specialized C-UAS operations. The mitigation training course must include scenario-based instruction on the application of the credible threat standard.

(g) Eligible personnel. Personnel eligible for Mitigation Certification or Detection and Warning Certification must have assigned duties that include the security or protection of people, facilities, or assets, as specified in 6 U.S.C. 124n(a)(2), and must be officers or employees of an SLTT law enforcement or correctional agency accredited by the Attorney General acting through the Director of the Federal Bureau of Investigation. The NCUTC, under the authority of the Attorney General, may establish additional attendance prerequisites.

(h) Sufficiency of certification. Successful completion of the applicable training requirement, combined with the use of systems within technology categories on the Authorized Technologies List and specific systems on the Authorized Systems List where populated, and compliance with the requirements of this part, satisfies the training and certification prerequisites of 6 U.S.C. 124n(d)(2)(A) for the exercise of the corresponding authorities under 6 U.S.C. 124n(a)(2).

(i) Suspension. The Attorney General, acting through the Director of the Federal Bureau of Investigation or the Director's designee, may suspend the Mitigation Certification or Detection and Warning Certification of any individual, or the accreditation of any SLTT law enforcement or correctional agency, for failure to comply with the requirements of this part, violation of the conditions of certification, or for any conduct that demonstrates unfitness to exercise C-UAS authority. Suspension of a certification or accreditation under this section is distinct from suspension of C-UAS authority by the Attorney General or the Secretary of Homeland Security under section 8605(f) of the SAFER SKIES Act, which is addressed in § 124.16. Neither a suspension of certification under this section nor an enforcement action against an individual under section 8605(f) of the SAFER SKIES Act prevents or bars the responsible agency from taking any additional actions it deems necessary to address the circumstances that led to suspension or enforcement action by the Attorney General or designee.

(j) Suspension notice. A suspension will be communicated in writing and will specify the basis for the action and any available remedial steps. The suspension notice must include the factual basis for the action in sufficient detail to enable the affected individual or agency to respond. In exigent circumstances, the Director of the Federal Bureau of Investigation or the Director's designee may immediately suspend a certification or accreditation pending administrative review without the requisite written notice when continued exercise of C-UAS authority poses a risk to aviation safety, public safety, or national security. In such cases, the Director or the Director's designee must provide the requisite notice within 3 days of the suspension.

(k) Administrative review. An individual or agency that receives a suspension notice may request administrative review within 30 calendar days of receipt. The Attorney General, acting through the Director of the Federal Bureau of Investigation, will designate a reviewing official of the Department of Justice who did not participate in or supervise the initial decision. The affected party may submit documentary evidence and written witness statements in support of its response. The reviewing official will consider the written submissions of both parties, may conduct an informal hearing at the reviewing official's discretion, and will issue a written determination within 60 calendar days of receipt of the request, stating the factual findings and the basis for the determination. The reviewing official may affirm the action, modify its terms, impose conditions for reinstatement, or reverse the action. A suspension that is affirmed remains in effect until reinstatement under paragraph (m) of this section or the expiration of the suspended certification or accreditation, whichever occurs first.

(l) Conditions. The Attorney General, acting through the Director of the Federal Bureau of Investigation, may issue a certification or accreditation subject to conditions, and may modify the conditions of a certification or accreditation, consistent with the standards and procedures applicable to suspension under this section.

(m) Reinstatement. An individual or agency whose certification or accreditation has been suspended may apply for reinstatement after completing the remedial steps specified in the suspension notice or the reviewing official's determination. An individual Mitigation Certification may alternatively be reinstated upon the successful recompletion of the full mitigation training course.

(n) Transition for previously trained personnel. Personnel holding a Mitigation Certification issued by the NCUTC before the effective date of this part must complete the detection and warning curriculum under paragraph (c) of this section by September 29, 2026. During that period, the Mitigation Certification remains valid, and the Detection and Warning Certification prerequisite for Mitigation Certification is deemed satisfied. An agency's accreditation is not affected while its personnel complete the curriculum during the transition period.

§ 124.6 Agency implementation policy.

(a) Requirement. Before conducting any operations under this part, each SLTT law enforcement or correctional agency must adopt and maintain an agency implementation policy governing the exercise of authority under 6 U.S.C. 124n(a)(2). The agency implementation policy is comprehensive. It governs all operations the agency conducts under this part, including detection and warning operations, and it addresses the detection and warning matters listed in paragraph (g) of this section. An agency that adopts and maintains an agency implementation policy under this paragraph is not required to adopt a separate policy under paragraph (g) of this section. An agency that conducts only detection and warning operations may instead adopt the abbreviated policy under paragraph (g) of this section. The agency implementation policy must, at a minimum:

(1) Designate an Agency Approving Official meeting the requirements of § 124.2;

(2) Designate the personnel authorized to exercise C-UAS authority and describe the recurrent training requirements applicable to such personnel;

(3) Establish procedures consistent with § 124.14 for the handling, retention, and dissemination of data acquired during C-UAS operations, including written anonymization standards specifying the aggregation thresholds, identifier suppression, and re-identification risk assessment used to qualify a data product as pattern data;

(4) Include provisions for public notification regarding the potential use of C-UAS authority within the agency's jurisdiction;

(5) Ensure compliance with the requirements of this part; and

(6) Detail standing tactical procedures governing the execution of C-UAS operations, including engagement protocols that account for the risk to persons and property on the surface and in the air before engagement, escalation procedures, use of force considerations, ground intercept team procedures, render safe procedures, evidence collection and chain-of-custody procedures, communications procedures, system operating procedures, data handling and purge procedures consistent with the retention requirements of this part, operation plan requirements, and post-operation procedures that incorporate data purge verification.

(b) Legal counsel review. The implementation policy must be reviewed and concurred in by the agency's legal counsel before adoption and upon each annual renewal. The review must specifically address the privacy and civil liberties requirements of this part, including the data retention, minimization, and dissemination provisions, and the interplay of proposed C-UAS operations and implementing policies with applicable State, local, Tribal, or territorial law. For an agency that has a designated official responsible for the agency's privacy and civil liberties compliance, regardless of title, the implementation policy must also be reviewed by that official.

(c) Alternative certification for agencies without in-house counsel. For an agency without in-house counsel, the review required by paragraph (b) of this section may alternatively be satisfied by review and certification by a State, local, territorial, or Tribal attorney's office that the implementation policy addresses each element required by paragraph (a) of this section. An agency obtaining a certification under this paragraph (c) must document the basis for using this paragraph (c). Certification pursuant to this paragraph (c) does not relieve the agency of any compliance obligation under this part.

(d) Portal attestation. Upon adoption of the implementation policy, the agency head or designee must certify compliance through the Federal C-UAS coordination portal by attesting that the agency has adopted an implementation policy addressing each element required by paragraph (a) of this section. The portal records the certifying official, agency, and date of attestation. The implementation policy is not subject to pre-approval by the NCUTC. The NCUTC retains authority to audit implementation policies and to suspend certification or accreditation under § 124.5. The attestation must be renewed annually.

(e) Retention and availability. The agency must retain the implementation policy and make it available to the Attorney General or the Secretary of Homeland Security, or their designee, upon request, including during compliance audits under § 124.16.

(f) Operating without attestation. An agency that conducts operations under this part without a current portal attestation is in violation of this part, and the absence of an attestation constitutes grounds for compliance action under § 124.16.

(g) Detection and warning policy. An SLTT law enforcement or correctional agency that conducts only detection and warning operations requiring the authority of, or the relief from certain laws provided by, 6 U.S.C. 124n may adopt a detection and warning policy in lieu of the implementation policy required by paragraph (a) of this section. A detection and warning policy must satisfy the requirements of this section, except that it need not include the standing tactical procedures of paragraph (a)(6) of this section. The agency must designate an Agency Approving Official under paragraph (a)(1) of this section and complete the portal attestation under paragraph (d) of this section, which must be renewed annually. For purposes of that attestation, a detection and warning policy need address only the elements of paragraph (a) of this section that apply to detection and warning operations.

§ 124.7 Authorized technologies.

(a) Two-list authorization framework. The technology authorization framework consists of two complementary lists. The Authorized Technologies List identifies the technology categories authorized for SLTT law enforcement and correctional agency C-UAS operations. The Authorized Systems List identifies specific systems, at the make and model level, that have completed interagency evaluation within those technology categories and stated operating restrictions. Both lists are maintained jointly by the Department of Justice, the Department of Homeland Security, the Department of Defense, the Department of Transportation and Federal Aviation Administration, the Federal Communications Commission, and the National Telecommunications and Information Administration, consistent with 6 U.S.C. 124n(d)(2)(A)(iii) and section 8606(a)(4) of the SAFER SKIES Act.

(b) General requirement. An SLTT law enforcement or correctional agency exercising authority under 6 U.S.C. 124n(a)(2) may deploy only systems within technology categories listed on the Authorized Technologies List. When the Authorized Systems List has been populated for a given technology category, the agency may deploy only specific systems listed on the Authorized Systems List within that category, subject to the advance coordination requirements of § 124.9. For technology categories on the Authorized Technologies List for which the Authorized Systems List has not yet been populated, the agency may deploy specific systems within those categories provided that an operator holds Mitigation Certification covering that technology category and has completed manufacturer or vendor training on the specific system to be deployed, subject to the advance coordination requirements of § 124.9.

(c) Scope of the list requirement. When operating under the authorities or statutory reliefs in 6 U.S.C. 124n(a)(2), SLTT law enforcement or correctional agencies may employ only listed technology categories, and, where the Authorized Systems List is populated, listed systems. Technology that an SLTT law enforcement or correctional agency may lawfully employ without the authorities or reliefs provided by 6 U.S.C. 124n(a)(2) is not subject to the requirements of this section and remains available to agencies on the same basis as before the SAFER SKIES Act. The detection and warning training curriculum will address the distinction between technology categories subject to and not subject to this section.

(d) Mitigation technology and training alignment. An SLTT law enforcement or correctional agency may employ mitigation systems only in those technology categories covered by the NCUTC mitigation courses completed by its mitigation-certified personnel. NCUTC may create an additional mitigation module covering the technology category when a new technology category is added to the Authorized Technologies List. Mitigation-certified personnel who completed the NCUTC mitigation course prior to the addition of this new content must successfully complete additional NCUTC training on the new technology category prior to using any system on the Authorized Systems List under that category.

(e) Scope of interception authority. Systems may be used to intercept communications to or from an unmanned aircraft or UAS only to the extent necessary to support an action described in 6 U.S.C. 124n(b)(1). Any interception, acquisition, maintenance, use of, or access to communications to or from an unmanned aircraft or UAS under this section must be conducted in a manner consistent with the First and Fourth Amendments to the Constitution of the United States and applicable provisions of Federal law.

(f) Maintenance of the lists. The Authorized Technologies List and Authorized Systems List, including the criteria and procedures for evaluating, listing, renewing, suspending, and removing technology categories and systems, are established and maintained through the interagency process described in 6 U.S.C. 124n(d)(2)(A)(iii) and section 8606(a)(4) of the SAFER SKIES Act. The Authorized Systems List is updated by that interagency process and published on the designated interagency C-UAS portal. Each RF-emitting system listed on the Authorized Systems List will have completed a system-level spectrum evaluation through the interagency process before listing, addressing potential interference with non-Federal spectrum users, compatibility with Federal spectrum users, and potential interference with aviation safety systems. System-level evaluations are reviewed and renewed at intervals determined through the interagency process and upon any system change to its operating capabilities, functions, radio frequency characteristics, or power levels that may alter its radio frequency characteristics, capabilities, functions, or assessed configurations. Minor updates that do not alter a system's performance, capabilities, functions, radio frequency characteristics, or assessed configurations do not require renewed evaluation.

(g) Emergency suspension. Upon receipt of an emergency suspension notice issued through the interagency process for the Authorized Technologies List and Authorized Systems List, an SLTT law enforcement or correctional agency must immediately cease deployment of the affected system or technology category. Grounds for emergency suspension include discovery of a critical safety defect, identification of a supply chain compromise or cybersecurity vulnerability, a determination that a system's radio frequency characteristics differ materially from those evaluated during spectrum evaluation, or a finding by any agency participating in the interagency process that continued deployment poses an unacceptable risk. The SLTT law enforcement or correctional agency may not resume deployment of the affected system or technology category until the suspension is lifted or the system or category is restored to the applicable list, and the agency must comply with any conditions attached to the lifting of the suspension or the restoration of the system or category to the applicable list.

§ 124.8 C-UAS Operations Plan.

(a) Requirement and function. Each mitigation operation, and each detection and warning operation conducted under this part using systems that require the authority of, or relief from certain laws under, 6 U.S.C. 124n, must be authorized by a C-UAS Operations Plan signed by the agency's Agency Approving Official. Section 124.12 sets out the conditions specific to detection and warning operations. The signed C-UAS Operations Plan is the instrument authorizing the operation on behalf of the SLTT law enforcement or correctional agency and certifies that the operation is consistent with the agency's implementation or detection and warning policy, that the operators are agency personnel who hold the required training and certification, and that the risk-based assessment factors of paragraph (e) of this section have been addressed. The agency may not commence mitigation operations until both the advance coordination process under § 124.9 and the signed C-UAS Operations Plan are complete.

(b) Legal counsel certification. The C-UAS Operations Plan must include a certification by the agency's legal counsel or, for an agency without in-house counsel, the applicable prosecuting authority, that the plan has been reviewed for legal sufficiency. The certification may take the form of a signature block, stamp, or attestation on the plan.

(c) Form. The C-UAS Operations Plan must be prepared on the standardized form prescribed by the Attorney General. The form is structured to use short-answer fields, selection-based fields, and map or diagram attachments, and does not require narrative legal analysis or repetition of standing procedures addressed in the agency's implementation policy. The form may use conditional fields keyed to the type of operation, so that each operation completes only the fields applicable to it; for a detection and warning operation, the fields specific to mitigation, such as mitigation-system parameters and render safe planning, do not apply.

(d) Content. The C-UAS Operations Plan must address, at a minimum and to the extent applicable to the operation:

(1) Operation identification, including the submitting agency, points of contact, the Agency Approving Official, the operation type, planned dates, geographic location, venue type, any Special Event Assessment Rating or National Special Security Event designation, and the identification of any mutual aid agencies;

(2) Systems and airspace, including the systems to be deployed by reference to the Authorized Systems List or Authorized Technologies List category; a description of each system's configuration and the hardware version, firmware revision, and software version of each system as deployed; RF-emitting system parameters; class of airspace; and anticipated flight restrictions;

(3) Coordination confirmation, including operator certification status, compliance with the agency implementation policy, the legal counsel certification, and compliance with the privacy and civil liberties requirements of this part; and

(4) Operational planning elements, including deployment configuration and spectrum deconfliction, personnel and team assignments, render safe and contingency planning, known authorized manned and unmanned aviation and deconfliction processes and procedures, communications, investigative response and data handling, and demobilization.

(e) Risk-based assessment. The C-UAS Operations Plan must address the following factors: potential impacts to aviation safety, civilian aviation and aerospace operations, aircraft airworthiness, or the use of the airspace; procedures to comply with any technical and siting limitations; options for mitigating identified potential impacts; potential consequences if potential impacts are not mitigated; the ability to provide reasonable advance notice to aircraft operators of both manned and unmanned aircraft; the setting and character of the facility or asset; for National Special Security Events and Special Event Assessment Rating events, the event characteristics; and the potential consequences to public safety if UAS threats are not mitigated. For National Special Security Events and Special Event Assessment Rating events, a plan that identifies the systems, airspace environment, and coordination elements from which the assessment can be derived satisfies this paragraph without separately addressing each factor in narrative form. Nothing in this part may be interpreted as limiting the authority of the Administrator of the Federal Aviation Administration to manage the navigable airspace, assess potential aviation safety risks, and implement such mitigations as the Administrator determines appropriate.

(f) Timing and submission. The C-UAS Operations Plan must be completed before the commencement of operations and submitted to the Federal Bureau of Investigation and Department of Homeland Security through the designated Federal C-UAS coordination portal as a supplement to the advance notification not fewer than 7 calendar days before the commencement of operations, or as early as practicable when the applicable notification timeline does not permit 7 calendar days. For a detection and warning operation that is not subject to the advance notification requirement of § 124.9, the C-UAS Operations Plan must be submitted through the designated Federal C-UAS coordination portal before the commencement of operations, for situational awareness and recordkeeping; such submission is not an advance notification under § 124.9 and does not trigger Federal Aviation Administration or Federal Communications Commission coordination. The plan may be updated after submission to reflect changes resulting from Federal Aviation Administration or Federal Communications Commission coordination. Material updates must be resubmitted promptly. Federal Aviation Administration and Federal Communications Commission coordination is valid for the system configuration and the firmware and software version coordinated for the operation. A change in configuration, firmware, or software version does not require re-coordination if it does not materially change the system's radio frequency emission characteristics, its operating frequencies and power levels, or other factors potentially impacting aviation safety from those previously coordinated. A change that would operate outside the frequencies or power levels coordinated for the operation requires re-coordination before deployment; a summary of the change must be provided to the Federal Aviation Administration and Federal Communications Commission to determine if re-coordination is necessary. The Federal Aviation Administration and the Federal Communications Commission may identify by guidance categories of configuration, firmware, or software changes that are deemed to materially affect radio frequency emission characteristics and require re-coordination. Federal review of the C-UAS Operations Plan is for deconfliction and situational awareness purposes and does not constitute approval or disapproval of the operation. For an event, area, or period in which a high volume of simultaneous operations is anticipated, the Federal Bureau of Investigation, in coordination with the Federal Aviation Administration, may establish an earlier submission deadline for affected operations and will communicate that deadline to affected agencies in advance through the designated portal or the lead C-UAS agency.

(g) Relationship to implementation policy. The C-UAS Operations Plan is an event-specific or operation-specific document. Standing tactical procedures required by § 124.6(a) must be addressed in the agency's implementation policy, and the C-UAS Operations Plan must reference the implementation policy by title and version rather than repeating standing procedures.

(h) Operational windows. (1) An individual C-UAS Operations Plan may authorize operations for a period not to exceed 30 consecutive calendar days, except as provided in paragraph (h)(2) of this section. For operations requiring a longer duration, the agency must submit a renewal plan before the expiration of the current operational window; the renewal plan may incorporate the prior plan by reference and address only material changes. The agency must submit a renewal plan, through the designated Federal C-UAS coordination portal under § 124.8(f), before the expiration of the current operational window.

(2) For fixed-site facilities for which SLTT law enforcement and correctional agencies conduct ongoing persistent-protection operations, including correctional facilities, critical infrastructure sites, other permanent facilities with a continuing C-UAS mission, and venues where the agency expects to provide recurring C-UAS coverage within the authorization period, the Agency Approving Official may authorize a standing operational window of up to 365 calendar days, renewable upon submission of a renewal plan. The advance notification for a standing operational window must specify the venue and anticipated events or coverage periods; for a detection and warning operation not subject to the advance notification requirement of § 124.9, the C-UAS Operations Plan must specify the venue, the area covered, which may be stated as a radius around the site, and the anticipated coverage periods. Material changes, including a new event, new systems, or a changed threat environment, require an update to the advance notification under § 124.9(a) or, for such a detection and warning operation, an updated C-UAS Operations Plan. Federal coordination requirements continue to apply to each event within a standing window, including lead C-UAS agency coordination under § 124.10 and per-event coordination among the Department of Transportation, the Federal Aviation Administration, and the Federal Communications Commission.

(3) No C-UAS Operations Plan may authorize an indefinite or open-ended operational window.

§ 124.9 Advance coordination, notification, and authorization.

(a) Advance notification. (1) Before conducting any mitigation operation under 6 U.S.C. 124n(a)(2), an SLTT law enforcement or correctional agency must submit an advance notification through the designated Federal C-UAS coordination portal not fewer than 30 calendar days before the commencement of the operational period. When 30 calendar days is not feasible, the agency must submit the advance notification as early as the circumstances permit, with sufficient lead time to allow the Federal Bureau of Investigation, the Department of Homeland Security, the Department of Transportation, the Federal Aviation Administration, and the Federal Communications Commission to complete their respective reviews, and must include a brief explanation of the circumstances that prevented submission within the 30-day standard.

(2) The advance notification is a coordination document that routes the relevant data elements to each recipient agency through a single submission. The advance notification is not a request for approval by the Department of Justice or the Department of Homeland Security, and the absence of a response from the Department of Justice or the Department of Homeland Security does not affect the agency's authority to proceed.

(3) The advance notification must identify the submitting SLTT law enforcement or correctional agency, the planned dates and geographic location of the operation, the systems to be deployed by reference to the Authorized Systems List or Authorized Technologies List category, RF-emitting system parameters, a characterization of the airspace and operational environment, and confirmation of operator certification status and compliance with the agency implementation policy and the privacy requirements of this part.

(b) C-UAS Operations Plan. Each mitigation operation must also be authorized by a C-UAS Operations Plan in accordance with § 124.8. The agency may not commence mitigation operations until both the advance coordination process under this section and the signed C-UAS Operations Plan are complete. The SLTT law enforcement or correctional agency must also submit a comparable advance notification to the State if required by State law or policy.

(c) FBI and DHS notification and routing. The Attorney General, through the Federal Bureau of Investigation and the Department of Homeland Security, receives the advance notification for purposes of deconflicting planned SLTT law enforcement or correctional agency C-UAS operations with any ongoing or planned Federal C-UAS, law enforcement, or national security operations. Until the portal is fully established, an SLTT law enforcement or correctional agency must notify the Federal Bureau of Investigation and Department of Homeland Security through a channel designated by the Federal Bureau of Investigation and Department of Homeland Security for that purpose.

(d) DOT/FAA coordination. Before conducting any mitigation operation, an SLTT law enforcement or correctional agency must coordinate with the Department of Transportation and the Federal Aviation Administration through the coordination mechanism the Federal Aviation Administration has designated. The agency must provide the systems to be deployed, the geographic coordinates of each proposed deployment and enforcement location, the expected duration of the operation, and a characterization of the airspace environment. The Administrator of the Federal Aviation Administration may establish such flight restrictions as the Administrator determines necessary in his sole discretion for reasons of aviation safety. The absence of a formal flight restriction does not preclude mitigation action in exigent circumstances when a credible threat exists and the requirements of this part are otherwise satisfied.

(e) Categorical FAA determinations. The Federal Aviation Administration may issue categorical determinations for specific combinations of authorized technologies, geographic locations, and airspace environments. When a proposed mitigation operation falls within the parameters of a categorical determination by the Federal Aviation Administration, individual case-by-case Federal Aviation Administration coordination is not required, provided the agency operates within the conditions specified in the determination and notifies the Federal Aviation Administration through the Federal Aviation Administration-designated coordination mechanism.

(f) FCC authorization. Before deploying any C-UAS system (whether detection and warning only or mitigation) that involves the emission of radio waves, an SLTT law enforcement or correctional agency must obtain authorization to use that system consistent with Title III of the Communications Act of 1934, as amended. The system must comply with any relevant regulations, policies, and guidance administered by the Federal Communications Commission, and an SLTT law enforcement or correctional agency must submit a request to the Federal Communications Commission through the advance notification process and as directed by the Federal Communications Commission. The Federal Communications Commission will also issue waivers, as appropriate, to C-UAS equipment vendors and manufacturers to allow them to import and sell C-UAS mitigation equipment that employs radio frequency interdiction technologies or electronic counter measures to authorized SLTT law enforcement and correctional agencies.

(g) Emergency exception. When a credible threat poses an imminent risk to human life and advance coordination under this section is not practicable, an SLTT law enforcement or correctional agency may take mitigation action. The agency must complete the notifications required by this section as soon as practicable, and in any event within two hours of the action. If the mitigation action involves an RF-emitting C-UAS system, the agency must additionally comply with the real-time notification requirements of § 124.11. Each invocation of this exception must be documented in the post-operation report with a specific explanation of why advance coordination was not feasible. This exception may not be invoked as a routine alternative to advance coordination, and a pattern of repeated invocations may result in compliance review under § 124.16, accreditation or certification suspension, and penalties under section 8605(f) of the SAFER SKIES Act. The compliance audit program will establish the criteria for identifying patterns of emergency invocations that warrant review.

(h) Federal coordination. Before conducting any operation under this part within a security or protection mission overseen by a Federal Government entity, or within an area, facility, waterway, or other area over which a Federal Government entity exercises a security or protection responsibility, the agency must coordinate with that Federal Government entity through the advance coordination process under § 124.9 before conducting the operation. The Federal Aviation Administration's general regulatory authority over the navigable airspace does not by itself trigger this requirement; airspace safety coordination is addressed in § 124.8 and § 124.11.

(i) Detection and warning operations. Detection and warning operations that do not actively transmit radio frequency energy and do not affect aviation safety are not subject to the advance coordination requirements of this section.

§ 124.10 Interagency and lead-agency coordination.

(a) Early coordination and notice of intent. For operations in support of National Special Security Events, events rated Special Event Assessment Rating 1 through 3, or other events where Federal C-UAS operations are anticipated, an SLTT law enforcement or correctional agency should notify the local FBI field office of its intent to provide C-UAS coverage as early as practicable and before the 30-day advance notification standard of § 124.9. The designated Federal C-UAS coordination portal includes a notice-of-intent function that allows an agency to register its intent to cover a future event without completing the full advance notification. A notice of intent is informational only and does not trigger the advance coordination process, the Federal Aviation Administration or Federal Communications Commission review, or any timeline obligation.

(b) Special event coordination. When the Federal Bureau of Investigation receives an SLTT law enforcement or correctional agency advance notification or notice of intent for an event at which Federal C-UAS operations are also planned or under consideration, the Federal Bureau of Investigation will present the notification to the interagency C-UAS coordination process maintained by the Department of Justice and the Department of Homeland Security, will serve as the conduit for SLTT law enforcement and correctional agency equities in that process, and will communicate the results to the SLTT law enforcement or correctional agency, including any Federal operational parameters or deconfliction requirements that may affect the SLTT law enforcement or correctional agency C-UAS operation. The interagency coordination process does not approve or disapprove SLTT law enforcement or correctional agency C-UAS operations.

(c) Tactical coordination under a lead C-UAS agency. An SLTT law enforcement or correctional agency conducting C-UAS operations at an event or location for which a lead C-UAS agency has been designated must operate under the tactical coordination of the lead C-UAS agency for the duration of the event. Tactical coordination includes the assignment of system deployment locations, operating frequencies, detection and mitigation sectors, ground intercept team sectors, render safe locations, communications channels, and risk to persons and property on the surface or in the air. The SLTT law enforcement or correctional agency's C-UAS Operations Plan for the event must be developed in coordination with the lead C-UAS agency and must conform to the lead agency's overall C-UAS operational framework for the event. An SLTT law enforcement or correctional agency coordinating with a lead C-UAS agency acts under its own certified authority under 6 U.S.C. 124n(a)(2); tactical coordination merely integrates the SLTT law enforcement or correctional agency C-UAS operation into a unified C-UAS posture. Where geographic responsibilities are divided among multiple Federal agencies, the SLTT law enforcement or correctional agency must coordinate with the sector-level lead Federal agency responsible for the geographic area in which the SLTT law enforcement or correctional agency intends to operate. Whenever Federal and SLTT operations will be conducted at the same event, or whenever the Federal and SLTT operations will overlap in geographic area and time, the Federal agency will be the lead C-UAS agency. An SLTT law enforcement or correctional agency may serve as the lead C-UAS agency only where multiple SLTT agencies are operating in the same area and no Federal agency is involved.

(d) Coordination required. An SLTT law enforcement or correctional agency that does not accept tactical coordination by the designated lead C-UAS agency may not conduct C-UAS operations, including detection and warning operations using systems requiring the authority of and relief from certain laws under the Act, within the geographic area and time period covered by the lead-agency designation.

(e) Overlapping SLTT operations. When the Federal Bureau of Investigation and Department of Homeland Security receive advance notifications from two or more SLTT law enforcement or correctional agencies for C-UAS operations that overlap in geographic area and time, the Federal Bureau of Investigation and Department of Homeland Security will notify all affected SLTT law enforcement and correctional agencies of the overlap. The affected agencies must designate a lead C-UAS agency for the overlapping area and time period, or establish a joint operational coordination arrangement, before any agency commences mitigation operations in the overlapping area. The designation or arrangement must be documented and provided to the Federal Bureau of Investigation and Department of Homeland Security. If the agencies cannot reach agreement within 48 hours of the Federal Bureau of Investigation and Department of Homeland Security's notification, the Federal Bureau of Investigation and Department of Homeland Security may designate operational parameters for the overlapping area, including frequency deconfliction assignments and geographic boundaries for each agency's mitigation operations.

(f) Deconfliction direction. If the deconfliction process identifies a conflict between a planned SLTT law enforcement or correctional agency C-UAS operation and an ongoing or planned Federal C-UAS, law enforcement, or national security operation that cannot be resolved through coordination, the Department of Justice, acting through the Federal Bureau of Investigation and in coordination with the Department of Homeland Security, may direct the SLTT law enforcement or correctional agency to modify the operational parameters of, or postpone, the planned operation until the conflict is resolved.

(g) Emergency exception preserved. This section does not affect an SLTT agency's authority to respond to an imminent risk to human life under § 124.9(g), including at an event with a designated lead C-UAS agency; however, the agency must notify the lead C-UAS agency immediately upon taking emergency action and must coordinate with the lead agency as soon as practicable thereafter.

(h) The requirements in paragraphs (a) through (g) of this section are established under the Attorney General's oversight authority pursuant to 6 U.S.C. 124n(d)(1) and the coordination obligations of 6 U.S.C. 124n(b)(4) and (d)(3); they do not transfer or diminish the SLTT agency's statutory authority and relief from certain laws under 6 U.S.C. 124n(a)(2).

§ 124.11 Real-time air traffic control notification.

(a) Notification required. Any SLTT law enforcement or correctional agency, or its personnel, that activates a C-UAS system for mitigation purposes must, within five minutes of activation or as soon as operationally practicable, provide verbal or electronic notification to the notification point designated by the Federal Aviation Administration for real-time C-UAS coordination, using the procedures established under paragraph (b) of this section. Detection and warning operations do not require notification or coordination under this section.

(b) Notification procedures. An SLTT law enforcement or correctional agency must comply with the notification and reporting procedures jointly established by the Department of Homeland Security, the Department of Justice, and the Federal Aviation Administration for real-time communication to air traffic control of C-UAS mitigation actions using a radio frequency-emitting C-UAS system. The notification must identify the type of C-UAS action, the time of activation, and the location. The NCUTC will include training on these notification procedures in the mitigation training course.

(c) Notification upon termination. Upon termination of the mitigation action, the SLTT law enforcement or correctional agency must provide a follow-up notification to the designated Federal Aviation Administration notification point confirming the time of termination.

(d) Non-RF mitigation. Mitigation actions that do not involve radio frequency-emitting systems do require notification under this section unless the Department of Transportation or Federal Aviation Administration's applicable notification procedures established under this section provide otherwise. Such actions remain subject to the advance coordination and post-operation reporting requirements of §§ 124.9 and 124.13.

§ 124.12 Detection and warning operations.

(a) Scope. This section governs detection and warning operations using systems whose operation requires the authority of and relief from certain laws under 6 U.S.C. 124n(a)(2). Detection and warning activity conducted using systems that do not require the authority of the Act or the relief it provides from certain laws is not subject to this part.

(b) Conditions. An SLTT law enforcement or correctional agency may conduct detection and warning operations under this section if:

(1) All personnel conducting detection and warning operations hold a current Detection and Warning Certification;

(2) The agency deploys only systems within technology categories listed on the Authorized Technologies List and, where populated, specific systems listed on the Authorized Systems List;

(3) The agency has adopted an implementation policy under § 124.6(a) or a detection and warning policy under § 124.6(g), has completed the applicable portal attestation, and has authorized the operation by a C-UAS Operations Plan under § 124.8; and

(4) The agency complies with the privacy, data handling, and retention requirements of § 124.14.

(c) Coordination. No per-operation (that is, for each individual deployment or activation of a C-UAS system) advance notification, Federal Aviation Administration coordination, or Federal Communications Commission coordination is required for detection and warning operations that employ only systems that do not emit radio frequency energy and do not affect aviation safety. Such operations must be authorized by a C-UAS Operations Plan under § 124.8, which documents operational authority, data handling and retention, and legal review. For detection and warning operations involving RF-emitting systems, such as active warning broadcast systems, the advance coordination requirements of § 124.9 apply, and the operation must be authorized by a C-UAS Operations Plan under § 124.8.

(d) Reporting. The 48-hour reporting requirement of § 124.13 does not require per-event reporting of detection and warning operations. Each SLTT law enforcement or correctional agency conducting detection and warning operations under this section must report detection activity in the semiannual operational summary required by § 124.13, including the detection systems deployed by Authorized Technologies List category, the locations at which systems were deployed, the total number of detection events recorded, instances of retention of records of communication beyond 180 days, and any data-sharing arrangements. A physical seizure or confiscation under 6 U.S.C. 124n(b)(1)(E) that results from a detection and warning operation is a 6 U.S.C. 124n action, but it is documented through the agency's normal evidence-handling procedures and is not separately reported under this part. The recovery of a crashed or abandoned unmanned aircraft that does not involve the use of 6 U.S.C. 124n authority is not a 6 U.S.C. 124n confiscation and is not subject to the reporting requirements of this part.

(e) Prohibition on mitigation. Personnel holding only a Detection and Warning Certification are not authorized to take any mitigation action or any other action that affects an unmanned aircraft in flight, regardless of the operator's ultimate objective. If a detection operation identifies a credible threat requiring mitigation, this rule requires that the agency respond through mitigation-certified personnel operating under §§ 124.8 and 124.9 or through coordination with Federal C-UAS assets. This prohibition is absolute and is not subject to the emergency exception of § 124.9(g), which is available only to an agency with mitigation-certified personnel and authorized mitigation capability.

§ 124.13 Post-operation reporting.

(a) Report required. Any SLTT law enforcement or correctional agency exercising authority under 6 U.S.C. 124n(a)(2) must submit a post-operation report as required by 6 U.S.C. 124n(d)(2)(C)(i) within 48 hours of whichever occurs first:

(1) Taking any mitigation action described in 6 U.S.C. 124n(b)(1)(C), (D), or (F);

(2) Any confiscation of an unmanned aircraft or UAS under 6 U.S.C. 124n(b)(1)(E); or

(3) The conclusion of an operation where notification was provided.

(b) Other confiscations. A confiscation that does not occur pursuant to 6 U.S.C. 124n(b)(1)(E) may be documented through the agency's normal evidence-handling procedures and does not need to be separately reported under this part.

(c) Content. The post-operation report must contain:

(1) Confirmation whether the planned operation did or did not occur as notified;

(2) The date, time, and geographic location of the reportable action;

(3) A brief description of the credible threat that a UAS or unmanned aircraft posed to the safety or security of people, a facility, or an asset; a venue or set of venues used for large-scale public gatherings or events; critical infrastructure; or a correctional facility necessitating the action;

(4) The type of capability employed, including the specific system or systems used by reference to the Authorized Systems List and Authorized Technologies List category, or where the Authorized Systems List had not yet been populated for a particular Authorized Technologies List category at the time of the action, the Authorized Technologies List category; and in all cases the make, model, hardware version, firmware revision, and software version of the system or systems as deployed;

(5) Any known operational effects, including the seizure, disabling, damage, or destruction of a UAS or unmanned aircraft; any reported effects on other aviation systems, spectrum users, or persons and property on the surface or in the air; any aviation accident; whether a temporary flight restriction was granted or denied; and any other harm, damage, or loss to a person or to private property;

(6) Any issues, anomalies, or deviations encountered during the operation; and

(7) Summary operational statistics, including the number of UAS detected, counted as confirmed detections attributable to a distinct unmanned aircraft and reported in good faith with reasonable deduplication; warnings issued; mitigation actions taken; UAS or unmanned aircraft seized or confiscated; and any criminal charges, citations, regulatory enforcement actions, or arrests resulting from the operation.

(d) Submission mechanism. Reports must be submitted through the designated Federal C-UAS coordination portal. Submission through the portal satisfies the notification requirement to both the Attorney General and the Secretary of Homeland Security, as the portal routes reports to the Federal Bureau of Investigation and Department of Homeland Security automatically.

(e) Immediate notification for unintended consequences. If a detection, warning, or mitigation action results in unintended consequences, including interference with manned aviation or lawfully operating UAS, property damage, injury, or system malfunction affecting third parties, the SLTT law enforcement or correctional agency must immediately notify the Federal Bureau of Investigation and Department of Homeland Security by the most expedient means available, in addition to the 48-hour post-operation report. The Federal Bureau of Investigation will notify the Office of the Deputy Attorney General, the Department of Transportation, the Federal Aviation Administration, the Federal Communications Commission, and other affected agencies as appropriate.

(f) Consolidated reporting. Where multiple reportable events occur within a 48 hour period, an SLTT law enforcement or correctional agency may submit a single consolidated post-operation report covering all actions taken during the period, due within 48 hours of the first reportable event, provided that each action is documented with the data elements required by paragraph (c) of this section and that any action resulting in unintended consequences is reported immediately under paragraph (e) of this section.

(g) Recurring venue reporting. For recurring venue operations conducted under a standing operational window authorized by § 124.8(h), each discrete event within the authorization period must be reported separately.

(h) Semiannual operational summary. Each SLTT law enforcement or correctional agency exercising authority under this part must submit a semiannual operational summary through the designated Federal C-UAS coordination portal, covering total operations conducted, mitigation actions taken, detection activity, instances of retention of records of communication beyond 180 days, instances in which control communications were disclosed outside the originating agency organized by the legal basis for their disclosure, compliance issues identified, and lessons learned. The summary must also report the requests the agency received for C-UAS protection from critical infrastructure or airport owners or operators that are not SLTT law enforcement or correctional agencies, the number of those requests to which it provided protection, and the number it was unable to support as well as the reasons it was unable to provide support.

(i) Reporting to support congressional and oversight requirements. The Federal Bureau of Investigation will compile information from post-operation reports and semiannual summaries to support the biannual report required by 6 U.S.C. 124n(d)(2)(D) and the semiannual briefings required by 6 U.S.C. 124n(g), in coordination with the Secretary of Homeland Security and the Secretary of Transportation. The compilation will include:

(1) The frequency, location, and circumstances of SLTT law enforcement and correctional agencies' mitigation deployments and the types of mitigation employed;

(2) A list of any aviation security or safety incidents, and any aviation accidents, that occurred due to SLTT law enforcement and correctional agencies' deployment of C-UAS technologies;

(3) Recommendations for improving SLTT law enforcement and correctional agencies' C-UAS training, oversight, compliance, and execution, and the compliance audits required by section 8606(b)(2) of the SAFER SKIES Act; and

(4) A determination whether SLTT law enforcement and correctional agencies are able to fully protect critical infrastructure from the UAS threat and, if not, recommendations on how to expand C-UAS authorities to critical infrastructure owners. This determination is informed by the protection-request data reported under paragraph (h) of this section.

(5) Instances in which records of communications were retained beyond 180 days, or in which control communications were disclosed outside the originating agency.

§ 124.14 Privacy and civil liberties.

(a) General. In exercising authority under 6 U.S.C. 124n(a)(2), an SLTT law enforcement or correctional agency and its personnel must comply with the requirements of 6 U.S.C. 124n(e), including the implementation of privacy protections with respect to the interception, acquisition, access, maintenance, use, and dissemination of communications, consistent with the First and Fourth Amendments to the Constitution of the United States and applicable provisions of Federal law. All operations under this part must comply with the requirements of the Fourth Amendment and the policies of the applicable SLTT law enforcement or correctional agency with respect to searches and seizures, and individual searches and seizures conducted during C-UAS operations remain subject to the Fourth Amendment reasonableness requirement.

(b) First Amendment. No C-UAS authority under this part may be used solely to seize, monitor, deter, interfere with, or disrupt individuals exercising rights protected by the First Amendment to the Constitution of the United States. When C-UAS operations are conducted at events or locations where individuals are exercising First Amendment rights, personnel must take affirmative steps to minimize the collection, retention, and dissemination of information about those individuals, and must not use C-UAS-derived information to identify, track, or build records on individuals based on their exercise of protected rights.

(c) Scope of interception. Communications may be intercepted or acquired only to the extent necessary to support an action described in 6 U.S.C. 124n(b)(1).

(1) Material captured that is not control communications is incidental capture. Agencies must configure systems to minimize incidental capture, and incidentally captured material determined not to be relevant to a C-UAS, law enforcement, or national security purpose must not be reviewed, retained, or disseminated and must be purged as soon as practicable.

(2) During the contemporaneous C-UAS operation, personnel may view incidentally captured material only to the extent necessary for C-UAS detection, tracking, identification, or mitigation purposes and may not use it for general surveillance or monitoring. If it becomes apparent that the captured video, audio, or other data stream is not control communications, the interception of such communications must be discontinued, and the interception of incidentally captured material must be documented in the post-operation report. When a system's configuration permits adjustment of the scope of interception, such as frequency range, geographic coverage, or signal type, operators must use the narrowest configuration consistent with operational effectiveness.

(3) For standing detection deployments exceeding 30 days, the agency must conduct a review, not less than quarterly, to confirm that the scope of interception remains proportionate to the operational need, that incidental collection of non-UAS communications is being minimized, and that data handling and purge procedures are being executed on schedule. The review may be conducted on a program-wide basis for facilities.

(4) Where identifying the threat requires processing the control signaling of all unmanned aircraft in range, the control communications of an unmanned aircraft determined not to pose a threat may not be retained or used beyond what is needed to make the threat determination and must be purged on the same schedule as other incidental material.

(d) Records of communications and retention. (1) Control communications captured, recorded, or maintained by SLTT C-UAS systems constitute records of communications to or from a UAS within the meaning of 6 U.S.C. 124n(e)(3) and must be maintained only for as long as necessary, and in no event for more than 180 days, unless the Agency Approving Official or the agency's chief legal officer determines that maintenance of such records is necessary to investigate or prosecute a violation of law, to directly support an ongoing security operation, for the purpose of any litigation, or is required under Federal, State, local, Tribal, or territorial law, consistent with 6 U.S.C. 124n(e)(3).

(2) Data retained under the ongoing security operation exception must be reviewed at 90-day intervals and purged when the operation concludes, unless another exception applies.

(3) When an agency determines that records of communications will be retained beyond 180 days under any exception, the agency must notify the Federal Bureau of Investigation through the portal within 30 days of the determination.

(4) Pattern data, once extracted and recorded independently, is not a record of communications and is not subject to the 180-day limit. Data generated by systems whose operation does not implicate the electronic surveillance laws referenced in the notwithstanding clause of 6 U.S.C. 124n(a)(2) is likewise not subject to the 180-day limit.

(5) For data retained under the investigation or prosecution exception, the existence of an open investigative or prosecutorial case file documenting the data as evidence satisfies the required determination. For data retained under any other exception, the Agency Approving Official or the agency's chief legal officer must document the specific basis for retention. If an agency has neither an Agency Approving Official nor a chief legal officer, an official holding a rank not below a Senior Executive or Senior Official, or its equivalent, must document the specific basis for retention.

(6) A standing operational window authorized under § 124.8(h) does not itself constitute an ongoing security operation for purposes of the retention exception; that exception applies only when a specific, identified threat or other intelligence justifies continued retention of specific records to support a discrete protective objective, and the 90-day review must assess whether the specific security basis for retention continues to exist.

(7) The exception for retention required under Federal, State, local, Tribal, or territorial law applies when a specific provision of law affirmatively requires retention of the particular type of data at issue, not when a general records retention schedule incidentally encompasses C-UAS data.

(e) Dissemination. (1) Control communications acquired under this part may be disclosed outside the disseminating agency only as authorized by 6 U.S.C. 124n(e)(4): when necessary to investigate or prosecute a violation of law; to support the Department of Defense, a Federal law enforcement agency, or the enforcement activities of a regulatory agency of the Federal Government in connection with a criminal or civil investigation of, or any regulatory, statutory, or other enforcement action relating to an action described in 6 U.S.C. 124n(b)(1); or as otherwise required by law.

(2) This part does not prohibit the use, as evidence in a subsequent proceeding, of information lawfully obtained incidental to an SLTT law enforcement or correctional agency C-UAS operation, consistent with applicable law.

(3) At the time of any dissemination of control communications, the disseminating agency must document, in the audit trail required by paragraph (g) of this section, the 6 U.S.C. 124n(e)(4) basis for the dissemination, the category of recipient, whether the handling caveat required by paragraph (f) of this section was conveyed, and whether the dissemination included control communications.

(4) A real-time detection feed is governed by the substantive character of the data it transmits. A feed that transmits control communications acquired under this part is subject to the requirements of this section applicable to such data and the limitations under 6 U.S.C. 124n(e)(1), (2), and (4). A feed that transmits only data described in paragraph (e)(6) of this section is not subject to those limitations.

(5) Pattern data that contains no control communications may be disseminated consistent with the agency's standard data handling and information sharing policies and applicable law. Before disseminating pattern data beyond the agency, the disseminating agency must verify anonymization in accordance with its implementation policy and screen the product for operationally sensitive information that would reveal specific coverage patterns, capabilities, gaps, or methods. Public release of pattern data products requires approval at the level designated by the agency's implementation policy.

(6) Data not acquired using the authorities or reliefs provided by 6 U.S.C. 124n, including data generated by systems whose operation does not implicate the electronic surveillance laws referenced in the notwithstanding clause of 6 U.S.C. 124n(a)(2), is not subject to the disclosure limitations of paragraph (e)(1) of this section and may be shared consistent with the agency's standard data handling and information sharing policies and applicable law. Sharing for situational awareness with recipients that are not law enforcement or correctional agencies, including critical infrastructure owners or operators and the public, is limited to data described in this paragraph, unless the disclosure of control communications is authorized under paragraph (e)(1) of this section.

(f) Protective purpose limitation. Because the authority of 6 U.S.C. 124n(a)(2) is limited to mitigation of a credible threat, an SLTT law enforcement or correctional agency may disseminate control communications acquired pursuant to the agency's authorities and statutory reliefs under 6 U.S.C. 124n(a)(2) only for law enforcement action arising from the UAS activity that prompted the C-UAS operation, or for aviation safety. An SLTT law enforcement or correctional agency may not disseminate such control communications for use in an investigation or enforcement action unrelated to UAS activity unless the communications are independently obtainable through lawful means not dependent on the authorities and statutory reliefs under 6 U.S.C. 124n(a)(2). At the time of dissemination, the disseminating agency must communicate the protective purpose for which the control communications are being shared.

(g) Audit trail. Each SLTT law enforcement or correctional agency exercising authority under this part must maintain an audit trail sufficient to document each instance in which C-UAS authority was exercised, the basis for the action, the disposition of any data acquired, and any dissemination of data under this part. The audit trail must be searchable and accessible to compliance auditors, protected against unauthorized modification or deletion, and retained for a minimum of 6 years. The agency's implementation policy must specify the format and system of records for the audit trail.

(h) State and local retention conflicts. When an SLTT law enforcement or correctional agency determines that a State, local, Tribal, or territorial records retention requirement applicable to law enforcement or correctional agency records encompasses C-UAS communications data and the agency cannot comply with both the 180-day retention limit and that retention requirement, the agency must retain the data for the period required by the applicable law and must apply the handling restrictions of this part, including the prohibition on use for unrelated law enforcement purposes and the dissemination restrictions of this section, for the full duration of retention.

(i) Third-party acquisition. An SLTT law enforcement or correctional agency may not request, purchase, subscribe to, or operationally rely on intercepted UAS control communications acquired by any actor lacking lawful authority and relief from certain otherwise applicable laws for the underlying interception, regardless of whether the agency directed or facilitated the original interception. An agency acquiring UAS intelligence from a third-party source must document the source's lawful authority and relief from otherwise applicable laws for any intercepted content and must apply the retention and dissemination requirements of this section to data so acquired. The agency's implementation policy must specify procedures for evaluating third-party source authority and relief from certain otherwise applicable laws, which must include review and concurrence by appropriate State, local, territorial, or Tribal legal counsel.

(j) Vendor data sharing. An SLTT law enforcement or correctional agency may provide operational raw sensor data to system vendors for purposes of system diagnostics, troubleshooting, and performance validation, provided that any communications content is removed before disclosure and the data is used solely for the specific purpose identified. The agency's implementation policy must establish the conditions for vendor data sharing consistent with this paragraph and applicable privacy protections.

§ 124.15 Protection of sensitive operational information.

(a) Sensitive system information. Information that links the specific capabilities, vulnerabilities, operating parameters, or countermeasure effectiveness of C-UAS systems to planned or completed operations, including deployment locations, operating radio frequencies, tactical employment methods, and threat-specific mitigation approaches, must be treated as law enforcement sensitive, protected from public disclosure to the extent permitted by applicable law, and, where the information reveals a capability gap of national security concern, evaluated for classification. Other operational coordination information associated with a planned or completed operation, such as the existence, general timing, or general coverage area of a deployment, must be handled as Controlled Unclassified Information and may be shared with covered Federal and SLTT law enforcement and correctional partners, including a State-designated aviation point of contact, for a lawful government purpose. General technical specifications and evaluation data not associated with a specific planned or completed operation are not subject to these handling requirements. All information described in this paragraph remains subject to any applicable classification, export control, or proprietary restriction.

(b) Protection from disclosure. An SLTT law enforcement or correctional agency must take the steps available under applicable State, local, Tribal, or territorial law to protect operationally sensitive information from disclosure through public records requests or civil discovery, and should coordinate with the prosecuting authority in criminal prosecutions arising from C-UAS operations to limit testimony and pleadings to the information necessary to establish the elements of the offense. Nothing in this section requires an agency to take any action inconsistent with applicable State, local, Tribal, or territorial public records law.

(c) Markings. Advance notifications, C-UAS Operations Plans, post-operation reports, and compliance audit records must be marked with appropriate sensitivity designations.

(d) Permitted disclosures. This section does not prohibit disclosure of sensitive system information to authorized Federal officials, to other participating SLTT agencies in the course of operational coordination, or to the public to the extent required by statute or court order.

§ 124.16 Compliance and enforcement.

(a) Compliance audits. The Attorney General, in coordination with the Secretary of Homeland Security and the Administrator of the Federal Aviation Administration, will periodically conduct compliance audits of SLTT law enforcement and correctional agencies exercising authority under 6 U.S.C. 124n(a)(2), as required by 6 U.S.C. 124n(d)(2)(B) and section 8606(b)(2) of the SAFER SKIES Act, to oversee compliance with this part and the privacy protections of 6 U.S.C. 124n(e) as well as to prevent misuse of C-UAS authority. The audit program will include review of post-operation reports, advance notification records, and agency implementation policies. The FAA will participate with respect to the aviation safety, airspace safety coordination, and deconfliction aspects of the compliance audits conducted under this section.

(b) Civil fines and penalties. An SLTT law enforcement or correctional agency, or its personnel authorized to take mitigation actions under 6 U.S.C. 124n(a)(2), that knowingly engages in such actions without Federal coordination as required by 6 U.S.C. 124n and the SAFER SKIES Act, including the advance coordination required by § 124.9, the real-time air traffic control notification required by § 124.11, and the post-action notification to the Attorney General and the Secretary of Homeland Security required by 6 U.S.C. 124n(d)(2)(C) and implemented by § 124.13(a), may be subject to a civil fine of up to $100,000 per violation, or suspension of C-UAS authority pending review by the Attorney General or the Secretary of Homeland Security, as provided in section 8605(f) of the SAFER SKIES Act. Civil penalties will be assessed in accordance with graduated penalty levels proportionate to the severity of the violation and the factors set forth in this part, including the agency's compliance history, the availability and quality of compliance assistance from Federal partners, whether the violation resulted in actual harm, and whether the agency took prompt corrective action. A civil penalty will not be assessed for a first violation of a procedural reporting or notification requirement when the agency demonstrates a good-faith effort to comply and voluntarily self-reports the deficiency. Violations of requirements of this part other than the Federal coordination requirements described in this paragraph do not give rise to civil penalties under section 8605(f) of the SAFER SKIES Act; they are addressed through the compliance audit program of this section, certification and accreditation suspension under § 124.5, and any other remedy available under law.

(c) Civil enforcement. The Attorney General is authorized to bring a civil action in a United States district court to collect fines and enforce civil penalties imposed under this section against any agency or individual, as provided in section 8605(g) of the SAFER SKIES Act.

(d) Relationship to certification or accreditation suspension. In addition to civil penalties, the Attorney General or designee may suspend a Mitigation Certification, Detection and Warning Certification, or accreditation under § 124.5(i) for violations of this part. Certification or accreditation suspension may be imposed independently of or in conjunction with other actions described in this section.

§ 124.17 Confiscation and forfeiture.

(a) Confiscation authority. (1) An SLTT law enforcement or correctional agency and its personnel may seize or otherwise confiscate a UAS or unmanned aircraft as described in 6 U.S.C. 124n(b)(1)(E). This authority is contingent on a credible threat and applies to the physical taking of possession of an unmanned aircraft that is no longer active in flight or any other UAS component, such as a ground control station.

(2) This authority does not require Mitigation Certification, the use of systems on the Authorized Technologies List or Authorized Systems List, or advance coordination under § 124.9. However, personnel exercising confiscation authority under 6 U.S.C. 124n(b)(1)(E) must hold a current Detection and Warning Certification issued by the NCUTC. An officer who seizes an unmanned aircraft or any other UAS component under traditional law enforcement authority, including an abandoned or crashed unmanned aircraft, does not require Detection and Warning Certification.

(3) Any action that employs C-UAS technology to disrupt or seize control of, damage, disable, or destroy the unmanned aircraft or UAS is an action under 6 U.S.C. 124n(b)(1)(C), (D), or (F) and requires Mitigation Certification.

(4) Personnel exercising confiscation authority should follow standard law enforcement evidence handling procedures, including maintaining chain of custody, preserving digital evidence stored on the aircraft or its flight controller, and observing applicable hazardous materials precautions.

(5) This part does not affect the authority of any law enforcement or correctional officer to take physical custody of an unmanned aircraft or UAS under traditional law enforcement authority independent of 6 U.S.C. 124n. Traditional law enforcement authority refers to the seizure authorities generally available to law enforcement under applicable Federal, State, local, Tribal, or territorial law, including seizure incident to arrest, seizure of evidence or contraband pursuant to a warrant or a recognized exception to the warrant requirement, and seizure of abandoned property. Once an unmanned aircraft or UAS is on the ground and confiscated, subsequent law enforcement actions, including threat assessment, render safe procedures, evidence collection, and search warrant execution, are governed by traditional legal authorities, including Fourth Amendment requirements and applicable exigency or emergency doctrines, rather than by 6 U.S.C. 124n.

(6) When a C-UAS operation involves a known or suspected unmanned aircraft being used as a delivery mechanism for a hazardous device, the response to the hazardous device must be conducted by a public safety bomb squad accredited through the Hazardous Devices School, consistent with the National Guidelines for Bomb Technicians or any successor publication.

(7) The physical act of interception of a third-party unmanned aircraft while it is in flight, such as catching or netting an aircraft by hand or using a non-electronic physical device to capture it in the air, implicates 6 U.S.C. 124n(b)(1)(D), (E), or (F). Personnel conducting such actions must therefore hold a Mitigation Certification. This does not apply to the erection of physical barriers that a drone operator has an obligation to avoid, such as netting affixed to a physical structure.

(b) Forfeiture. Any UAS or unmanned aircraft seized by an SLTT law enforcement or correctional agency pursuant to 6 U.S.C. 124n(a)(2) is subject to forfeiture under the laws of the seizing agency's jurisdiction, as provided in 6 U.S.C. 124n(c)(2).

§ 124.18 Activities for evaluation, testing, training, and pre-operational validation.

(a) Scope and legal basis. An SLTT law enforcement or correctional agency that holds current accreditation under this part may conduct operational acceptance testing of acquired systems and systems under procurement consideration, on-the-job proficiency training, and interoperability training exercises to maintain C-UAS operational readiness. Testing and training do not and must not involve the mitigation of a credible threat and are not conducted under the authority of 6 U.S.C. 124n(a)(2). The operation of RF-emitting systems during testing and training is conducted under applicable Federal Communications Commission authorization and Federal Aviation Administration coordination requirements, and only against controlled test targets owned or operated by, or operated with the consent of, the SLTT law enforcement or correctional agency. An SLTT law enforcement or correctional agency acting pursuant to this section may utilize only authorized technologies under § 124.7. The SLTT law enforcement or correctional agency is responsible for verifying that all necessary Federal Aviation Administration authorizations or regulatory relief for operation of any unmanned aircraft or UAS, including unmanned aircraft or UAS forming part of a C-UAS system, have been obtained prior to any testing, training, or exercises. Compliance with this section is a condition of maintaining certification and accreditation under this part.

(b) Personnel. Only personnel holding a current Mitigation Certification may operate mitigation systems during evaluation testing, training, and exercises. Testing, training, and exercises may not be used to train or evaluate uncertified personnel on the operation of mitigation systems. Contractors and vendor representatives may provide technical support and instruction on system-specific procedures but may not independently operate mitigation systems against test targets.

(c) Evaluation testing and training activities plan. Before conducting testing, training, or exercises involving RF-emitting C-UAS mitigation systems, the agency must prepare a written activities plan specifying the date, time, and location; the purpose; the systems and equipment to be used; the test, training, or exercise targets; the assigned operators; safety controls; privacy measures; the types of data to be collected and their planned disposition; documentation of Federal Aviation Administration and Federal Communications Commission spectrum coordination for the C-UAS activities, and documentation of any necessary Federal Aviation Administration authorizations or regulatory relief for the operator of the target unmanned aircraft or UAS and for the operation any unmanned aircraft or UAS that form part of the C-UAS system. The activities plan must be approved by the Agency Approving Official or designee and reviewed by the agency's legal counsel.

(d) Coordination. Testing, training, and exercises, involving RF-emitting systems, or systems that may affect aviation safety, civilian aviation and aerospace operations, aircraft airworthiness, or the use of the airspace, require advance coordination with the Federal Aviation Administration and, for spectrum authorization, with the Federal Communications Commission.

(e) Privacy within evaluation testing and training. The agency must favor testing, training, and exercise locations and activities that minimize exposure to non-participating third parties. The agency must not intentionally target, monitor, or collect the communications of non-participating third parties. Communications incidentally collected from non-participating third parties must be purged at the conclusion of the testing, training, or exercise activity, or as soon as practicable thereafter.

(f) Mitigation restriction. During testing, training, and exercises, the agency may not intentionally mitigate any UAS or unmanned aircraft that is not a controlled test target, unless necessary to protect against an imminent risk to human life or as part of an approved C-UAS Operations Plan. An action taken to protect against an imminent risk to human life must comply with the emergency exception set forth in § 124.9(g).

(g) Pre-operational validation. Before commencing mitigation operations at an event or facility, an agency may conduct pre-operational validation or equipment functional checks within the operational window and airspace restrictions already coordinated through the advance notification process under § 124.9. The C-UAS Operations Plan must document the pre-operational validation plan and required notifications. No separate authorization from the Department of Homeland Security or the Department of Justice beyond the advance notification is required.

(h) Participation in Federal RTTE. Personnel holding active Mitigation Certification may participate in research, testing, training, and evaluation (RTTE) events conducted by Federal components under 6 U.S.C. 124n(b)(3). Personnel may engage with systems in mitigation technology categories beyond those for which they hold an active Mitigation Certification or that are not on the ATL or ASL as part of the event. Participants act under the Federal component's authority and supervision.

§ 124.19 Task force arrangements and Federal support.

(a) Task force and deputization arrangements preserved. Task force and deputization arrangements under 6 U.S.C. 124n(a)(1) are not affected by this part. An SLTT law enforcement or correctional agency participating in such an arrangement may continue that participation indefinitely, so long as the deputizing Federal agency continues to have C-UAS authority and relief from certain laws under 6 U.S.C. 124n(a)(1). Nothing in this part requires an agency to seek accreditation under this part, conditions any task force or deputization arrangement on accreditation, or terminates or limits any such arrangement.

(b) Concurrent authority. The availability of independent SLTT law enforcement and correctional agency authority under 6 U.S.C. 124n(a)(2) does not preclude continued participation in C-UAS task forces or deputization arrangements under 6 U.S.C. 124n(a)(1). An SLTT law enforcement or correctional agency and its officers may exercise independent authority and participate in Federal task force operations concurrently or at different times as operational circumstances warrant. Task force operations are governed by the policies applicable to the sponsoring Federal component.

(c) Federal support. An SLTT law enforcement or correctional agency may request C-UAS support from an authorized Department of Justice or Department of Homeland Security component. Such support, when provided, constitutes a Federal operation under 6 U.S.C. 124n(a)(1) and is governed by the policies applicable to the supporting component, and the requesting agency's personnel participating in the operation do so under the Federal component's authority and supervision, consistent with applicable task force or deputization arrangements. No formal gubernatorial request is required under this part. Support from the Department of Defense, when available, is governed by the Department of Defense's own authorities, including 10 U.S.C. 130i and 2564, and applicable Department of Defense policies, not by this part.

§ 124.20 Construction.

(a) No private right. This part is not intended to, does not, and may not be relied upon to create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.

(b) Manned aircraft. Nothing in this part authorizes the use of C-UAS authority against any aircraft or aircraft system operated with a human pilot, crew, or passengers onboard.

(c) Mass gatherings. Consistent with 6 U.S.C. 124n(h)(5), nothing in this part provides a new basis of liability for any State, local, territorial, or Tribal law enforcement officer who participates in the protection of a mass gathering identified by the Secretary of Homeland Security or the Attorney General under 6 U.S.C. 124n(l)(3)(C)(iii)(II), acts within the scope of the officer's authority, and does not exercise the authority granted to the Secretary of Homeland Security and the Attorney General by 6 U.S.C. 124n.

(d) Statutory scope. Nothing in this part alters the scope of the authority of, or the statutory reliefs under 6 U.S.C. 124n(a)(2). A determination that an action does not comply with this part may give rise to administrative, civil, or other consequences provided by law, but does not by itself determine whether the action falls outside the scope of the statutory authorization in, or the relief from criminal liability available under, 6 U.S.C. 124n. Such a determination will be made by the Attorney General, in coordination with the Secretary of Homeland Security and other appropriate officials.

§ 124.21 Termination.

(a) Termination. Absent additional statutory authority, the authority of SLTT law enforcement and correctional agencies and their personnel under 6 U.S.C. 124n(a)(2) will terminate on December 31, 2031, as provided in 6 U.S.C. 124n(j)(2).

(b) Savings. Termination under paragraph (a) of this section does not affect any obligation, proceeding, or liability that arose before the termination date. Recordkeeping, retention, audit, reporting, and enforcement obligations with respect to operations conducted before the termination date, and any administrative or civil proceeding arising from those operations, survive the termination of authority under this part and remain in effect until satisfied or otherwise resolved.

§ 124.22 Severability.

If any provision of this part, or the application of any provision to any person, entity, or circumstance, is held to be invalid or unenforceable by a court of competent jurisdiction, the remainder of this part, and the application of its provisions to any other persons, entities, or circumstances, shall not be affected and shall remain in full force and effect.

§ 126.1 Purpose and scope.

This part establishes the procedures by which a Transportation Security Oversight Board (TSOB) Review Panel reviews and acts to resolve an appeal from an Administrative Law Judge (ALJ) decision regarding a Determination of Security Threat made by the Administrator of the Transportation Security Administration (TSA).

§ 126.3 Definitions.

Classified information has the meaning given to that term in Executive Order 13526 or any successor Executive Order.

Communication technology means telephone or a videoconferencing platform.

Other protected information means other information that the government is authorized by statute, regulation, or Executive order to withhold.

Sensitive Security Information (SSI) means information described in 49 CFR 1520.5.

Substantial evidence means such relevant evidence as a reasonable mind might accept as adequate to support a conclusion.

Transportation Security Oversight Board (TSOB) means the board established pursuant to 49 U.S.C. 115.

Transportation Security Oversight Board (TSOB) Review Panel means the panel established pursuant to 49 U.S.C. 46111(d) to consider an appeal from a decision of an administrative law judge as the result of a hearing under 49 U.S.C. 46111(b).

§ 126.5 Appointment of TSOB Review Panel and TSOB Docket Clerk.

(a) Upon request by the Chairman of the TSOB, TSOB members will designate at least one official who meets the criteria in paragraphs (a)(1) through (5) of this section to participate in a TSOB Review Panel pool for a period of two years. The Review Panel nominees must—

(1) Be a member of the Senior Executive Service (SES) or a Senior Level (SL) employee;

(2) Hold a security clearance commensurate with the record under review;

(3) Not be employed by TSA or the Federal Aviation Administration (FAA);

(4) To the extent practicable, have a legal background and be engaged in the practice of law on behalf of the United States Government; and

(5) To the extent practicable, be familiar with transportation security issues.

(b) Upon the expiration of each two-year period, TSOB members will again designate officials to participate in the TSOB Review Panel pool.

(c) The General Counsel of the Department of Homeland Security, or the General Counsel's designee, will appoint an individual from within the Office of the General Counsel to serve as the TSOB Docket Clerk. The TSOB Docket Clerk will serve as the TSOB Review Panel's point of contact for both the public and the parties to ALJ proceedings.

(d) When the TSOB Docket Clerk receives a properly and timely filed appeal from an ALJ's decision, the TSOB Chairperson selects at least three individuals from the TSOB Review Panel pool to serve on a Review Panel to review the ALJ's decision. The TSOB Chairperson has discretion to choose which individuals from the pool will serve on a TSOB Review Panel. In making selections for a TSOB Review Panel, the TSOB Chairperson will consider selecting at least one person with the qualifications set out in paragraph (a)(4) of this section to serve as a Panel Member, and will consider, based upon the composition of the pool as well as the issues raised in the appeal, appointing more than one person with the qualifications set out in paragraph (a)(4) to the TSOB Review Panel.

§ 126.7 Function of TSOB Review Panel.

A TSOB Review Panel reviews an ALJ's decision regarding a Determination of Security Threat issued by the TSA Administrator and may affirm, modify, or reverse the ALJ's decision. The TSOB Review Panel also may remand the matter to the ALJ with instructions to address particular issues or consider additional testimony or evidence.

§ 126.9 Scope of review.

(a) A TSOB Review Panel reviews an ALJ's decision to address whether the decision is supported by substantial evidence in the record before the TSOB Review Panel.

(b) A TSOB Review Panel will not consider the constitutionality of any statute, regulation, Executive order, or order issued by the TSA.

§ 126.11 Counsel.

(a)(1) Parties to proceedings before a TSOB Review Panel may be represented by an attorney who is in good standing with the bar of any State, district, territory, or possession of the United States. Parties desiring representation must obtain such representation at their own expense.

(2) TSA will designate counsel to represent TSA before a TSOB Review Panel. The attorney must hold a security clearance that enables access to all materials related to the appeal.

(b) The General Counsel of the Department of Homeland Security, or the General Counsel's designee, will appoint legal counsel to assist a TSOB Review Panel. Counsel appointed to assist the TSOB Review Panel will facilitate communication between the TSOB Docket Clerk and the TSOB Review Panel, and assist with legal research and drafting for the Panel, as needed. Appointed counsel must hold a security clearance that enables access to all materials related to the appeal.

§ 126.13 Notice of appeal and service.

(a) Notice of appeal. A party seeking review of the ALJ's decision must file a notice of appeal with the TSOB Docket Clerk electronically at TSOB_docket@hq.dhs.gov or via certified U.S. mail at ATTN: TSOB Docket Clerk, Office of the General Counsel, Department of Homeland Security, Washington, DC, 20528-0485. A notice of appeal must be filed within 60 calendar days of the date of issuance of the ALJ's written decision.

(b) Service. To file any document with a TSOB Review Panel, a party must send the document to the TSOB Docket Clerk electronically at TSOB_docket@hq.dhs.gov, or via certified U.S. mail at ATTN: TSOB Docket Clerk, Office of the General Counsel, Department of Homeland Security, Washington, DC, 20528-0485. Parties are strongly encouraged to file all documents and consent to electronic service. A party may consent to electronic service by filing a document expressly stating such a preference with the TSOB Docket Clerk and serving a copy on all other parties. Any document filed with the TSOB Docket Clerk (except a notice of protected information, the administrative record, ex parte motions, and documents containing classified information, Sensitive Security Information (SSI), or other protected information that accompanies a motion to supplement the record) must also be served on all other parties by certified U.S. mail or electronically/electronic service.

(c) Filing date. For purposes of all deadlines in this part, the date of filing of a notice of appeal or any document filed with a TSOB Review Panel is the date on which the document is received by the TSOB Docket Clerk.

(d) Untimely appeals. A TSOB Review Panel must reject and summarily dismiss a notice of appeal that is filed more than 60 calendar days after the date of issuance of the ALJ's written decision. A TSOB Review Panel may, in its discretion, accept an untimely notice of appeal upon a written showing of good cause for failure to meet the filing deadline.

(e) Failure to perfect the appeal. A TSOB Review Panel may dismiss an appeal, on its own initiative or upon motion of any party, when a party has filed a notice of appeal but failed to perfect the appeal by timely filing a brief in accordance with § 126.23.

(f) Effect of dismissal of appeal. Where an appeal is dismissed in accordance with paragraphs (d) or (e) of this section the ALJ's written decision becomes final.

§ 126.15 Entry of appearance.

(a) All parties to a proceeding before a TSOB Review Panel must enter their appearances in writing with the TSOB Docket Clerk within 15 calendar days after filing or being served with a notice of appeal. A party's written notice of entry of appearance must identify counsel, if applicable.

(b) Counsel beginning representation of a party after that party has already entered an appearance must file a separate notice of entry of appearance within 15 calendar days of beginning representation.

§ 126.17 Procedures for classified information, Sensitive Security Information (SSI), and other protected information.

(a) Notice of protected information. Within 30 calendar days of filing or being served with a notice of appeal, TSA must file a notice of protected information indicating whether the record of proceedings before the ALJ contains classified information, SSI, or other protected information. The notice of protected information must be filed with the TSOB Docket Clerk in accordance with § 126.13(b). If the TSA presented classified information, SSI, or other protected information to the ALJ at an ex parte proceeding or provided such information for in camera review during the ALJ proceedings, then the TSOB Review Panel will also consider that information at an ex parte proceeding or in camera.

(b) Access to protected information. A TSOB Review Panel may not disclose Classified Information or other protected information to any non-government party or counsel. A TSOB Review Panel may not disclose SSI to any non-government party or counsel unless the TSA has determined that the party had a preexisting need to know specific SSI as a covered person pursuant to 49 CFR 1520.7 and 1520.11.

§ 126.19 Filing and supplementing the record.

(a) Filing the record. The TSA must file a complete record of administrative proceedings, including a certified and unredacted transcript of all proceedings before the ALJ (including ex parte proceedings) and all material filed with the ALJ (including material containing classified information, SSI, or other protected information that was reviewed by the ALJ in camera), with the TSOB Docket Clerk within 30 calendar days after filing or being served with a notice of appeal. Upon motion filed by the TSA, or on its own initiative, the TSOB Review Panel may extend the time to file the record. The TSOB Docket Clerk notifies all parties of the date when the record is filed. Within 30 calendar days of the date the record is filed, non-government parties may file a motion requesting that the TSA provide them with a redacted copy of any part of the record (excluding ex parte proceedings and materials reviewed in camera) that they do not possess. The TSA redacts classified information or other protected information from any part of the record it provides to non-government parties, except to the extent that the TSA has determined that the party had a preexisting need to know specific SSI as a covered person pursuant to 49 CFR 1520.7 and 1520.11.

(b) Supplementing the record. (1) A party may file a motion to supplement the record when anything relevant to an issue on appeal occurs after the ALJ issued a decision, or the party can show good cause, as determined by the TSOB Review Panel, for failing to submit material for the record at an earlier stage of the administrative proceedings. When the TSA seeks to supplement the record with material that contains classified information, SSI or other protected information, it may file a motion to supplement the record ex parte.

(2) A TSOB Review Panel may grant a motion to supplement the record when it finds that the supplemental material is relevant to an issue on appeal and that a condition described in paragraph (b)(1) of this section applies.

(3) A TSOB Review Panel may grant a motion to supplement the record by remanding the case to the ALJ for additional proceedings, where good cause is shown.

§ 126.21 Motions.

(a) Form of motions. (1) A motion filed with a TSOB Review Panel must comply with the requirements set forth in § 126.23(c)(1) through (4).

(2) Motions must be filed with the TSOB Docket Clerk and served on all parties in accordance with § 126.13(b). The TSOB Docket Clerk provides all motions to the TSOB Review Panel.

(b) Duty to confer. Before filing any motion, a party must confer or make reasonable, good-faith efforts to confer with all other parties to resolve the issues that are the subject of the motion. The moving party must state in the motion, or in a certificate attached to the motion, the specific efforts made to comply with this duty to confer. The moving party must also state in the motion the other parties' positions with regard to the relief requested. If no party opposes the relief requested in a motion, the moving party includes “Unopposed” in the motion's title. TSA does not have a duty to confer before filing an ex parte motion, but must provide notice to all parties that it has made an ex parte filing.

(c) Motion hearings. Upon request of any party, or on its own initiative, a TSOB Review Panel may order the parties to appear for a hearing on any motion that was not filed ex parte. Motion hearings may be conducted via communication technology unless all parties agree to appear in person or the TSOB Review Panel in its discretion determines that an in person appearance is necessary for efficient administration of the hearing. The Review Panel considers expense and inconvenience to the parties, the importance of information security, and the quality and reliability of available communication technology when making these determinations.

(d) Disposition. A TSOB Review Panel may, consistent with the requirements of due process and after providing the opposing party with an opportunity to review and respond, grant or deny a motion at any time after it is filed.

(e) Additional procedural requirements for motion practice. A TSOB Review Panel has discretion to establish via order served on the parties, additional procedural requirements regarding motion practice in response to the exigencies of a particular appeal. Such requirements may include, for example, time periods for filing responses and replies, a deadline for concluding all motion practice, and page limitations different from the default 35-page limit established in § 126.23(c)(3). A TSOB Review Panel may not require disclosure of classified information, SSI, or other protected information.

§ 126.23 Briefs.

(a) Appellant brief. (1) A party appealing the ALJ's decision must perfect the appeal by filing an appellant brief with the TSOB Docket Clerk and serving that brief on all other parties in accordance with § 126.13(b) within 60 calendar days after the date on which TSA files the record in accordance with § 126.19(a), unless all parties consent to an extension of the filing deadline and provide notice of such agreement to the TSOB Docket Clerk or the TSOB Review Panel extends the filing deadline upon a motion by the appellant.

(2) The appellant brief must enumerate the appellant's objections to the ALJ's decision.

(b) Appellee brief. Within 30 calendar days after being served with an appellant brief, a party may file an appellee brief in response with the TSOB Docket Clerk. Any such brief must be served on all other parties in accordance with § 126.13(b) at the same time it is filed with the TSOB Docket Clerk. The parties may consent to an extension of the filing deadline and provide notice of such agreement to the TSOB Docket Clerk or the TSOB Review Panel may extend the deadline for filing an appellee brief upon a motion by the appellee.

(c) Brief requirements. A brief submitted to a TSOB Review Panel must adhere to the following specifications:

(1) The brief must be typewritten in Times New Roman, 12-point font, double-spaced, and, if submitted as a hard copy via certified U.S. mail, must be printed single-sided on 8 1/2-by-11 inch paper;

(2) The brief must set forth the name, address, email address, and telephone number of the party or attorney filing it;

(3) The brief must contain no more than 35 pages of text (excepting any tables, appendices, or cover sheets) unless prior permission to file excess pages has been granted by the TSOB Review Panel after consideration of a duly filed motion showing good cause as determined by the TSOB Review Panel;

(4) If submitted as a hard copy via certified U.S. mail, the brief must be bound in any manner that is secure, does not obscure the text, and permits easy reproduction; and

(5) If oral argument is desired, the brief should contain a request for oral argument that explains why oral argument will contribute substantially to the development of an issue on appeal.

§ 126.25 Oral argument.

(a) Upon receipt of a request from any party contained in a brief or in a motion, or on its own initiative, a TSOB Review Panel may order the parties to present oral argument. The Review Panel orders oral argument if it determines that oral argument will contribute substantially to the development of an issue on appeal.

(b) A TSOB Review Panel has discretion, within the requirements of all relevant statutory and regulatory provisions for information security, to choose the method and location of oral argument. The Review Panel will consider expense and inconvenience to the parties, the importance of information security, the quality and reliability of available communication technology, and concern for the efficient administration of proceedings when establishing the method and location of oral argument.

(c) A TSOB Review Panel has discretion to structure and establish procedural rules for oral argument via order served on the parties. Such rules may include time limits for argument and the order in which parties present argument.

(d) Classified information, SSI, or other protected information may not be disclosed during oral argument. A TSOB Review Panel may hold ex parte proceedings to allow for the presentation of classified information, SSI, or other protected information.

§ 126.27 Deliberations and action.

(a) Deliberations. TSOB Review Panel deliberations are closed proceedings. Any materials created by Review Panel members, the TSOB Docket Clerk, and the Review Panel's appointed counsel for use in deliberations are not part of the final administrative record.

(b) Action. A TSOB Review Panel may affirm, modify, or reverse the ALJ's decision. It may also remand the matter to the ALJ with instructions to address particular issues or consider additional testimony or evidence.

(1) A TSOB Review Panel requires a simple majority to decide an action.

(2) In case of a disagreement among TSOB Review Panel members, a dissenting report may be served with the written explanation of the Review Panel's action. A dissenting report must be prepared in accordance with the requirements for the Review Panel's written explanation.

(c) Written explanation. A TSOB Review Panel will explain its action in writing to the maximum extent permitted by prudent concern for the national security interests of the United States and applicable laws and regulations governing information disclosure. If necessary, the Review Panel may prepare its written explanation in both a protected format (which may contain classified information, SSI, and other protected information) and a non-protected format (which must not contain classified information, SSI, and other protected information). The Review Panel serves non-government parties with the non-protected written explanation and government parties with the protected written explanation. The Review Panel is prohibited from providing the protected written explanation to non-government parties; however, the protected written explanation, if any, is part of the final administrative record that TSA must submit to a U.S. Court of Appeals in the event that a party seeks judicial review of the Review Panel's action.

(d) Timing. A TSOB Review Panel endeavors to resolve an appeal and issue a written explanation of its action to the parties no later than 60 calendar days after the last of the following events:

(1) Receipt of a timely filed appellant brief;

(2) receipt of a timely filed appellee brief; or

(3) Oral argument.

§ 126.29 Effect of TSOB Review Panel action.

(a) Any person substantially affected by a TSOB Review Panel's action, or the TSA Administrator when he or she decides that the Panel's action will have a significant adverse impact on carrying out 49 U.S.C. subtitle VII, part A, may obtain judicial review in an appropriate U.S. Court of Appeals in accordance with 49 U.S.C. 46110. The Administrators of the FAA and TSA must be made parties to any civil action filed in a U.S. Court of Appeals seeking review of a TSOB Review Panel action.

(b) If judicial review is not obtained, the action of the TSOB Review Panel is final and binding on the parties for the purpose of resolving the particular decision under review.

§ 126.31 Administration of proceedings.

(a) A TSOB Review Panel has authority to govern the conduct of its proceedings and internal operations by establishing any additional rules or procedures that are not inconsistent with this part.

(b) If TSA withdraws its Determination of Security Threat at any time after a notice of appeal has been filed pursuant to § 126.13(a), the proceedings before the TSOB Review Panel are rendered moot and closed. TSA must file a notice of withdrawal of the Determination of Security Threat with the TSOB Docket Clerk within five calendar days of such withdrawal.

(c) TSOB Review Panel proceedings will generally be closed to the public. A TSOB Review Panel may, in its discretion, open its proceedings to the public. Classified information, SSI, or other protected information shall not be disclosed during administrative proceedings, in accordance with § 126.25(d).

§ 139.1 Purpose.

The regulations in this part provide for the protection and administration of the buildings, grounds, and property or portions thereof that are owned, occupied, or secured by the Federal Government (including any agency, instrumentality, or wholly owned or mixed-ownership corporation thereof) and the persons on the property.

§ 139.5 Scope, applicability, and agency cooperation.

(a) Scope. This part applies to all Federal property under the protection responsibility of the Secretary of Homeland Security and all persons on such property, as well as areas outside such Federal property to the extent necessary to protect the property and persons on the property.

(b) Applicability. This part shall not be construed to nullify any other Federal, state, or local laws or regulations applicable to any area in which Federal property is situated; preclude or limit the authority of any Federal law enforcement agency; or restrict the authority of the Administrator of General Services or other Federal Government entity to promulgate regulations affecting property under its jurisdiction, custody, or control.

(c) Cooperation. Federal tenants must cooperate to the fullest extent possible with all applicable provisions set out in this part; promptly report all crimes and suspicious circumstances occurring on Federal property first to the Federal Protective Service MegaCenter at 1-877-4FPS-411, and, as appropriate, the local responding law enforcement authority; provide training to employees regarding protection and responses to emergency situations; and make recommendations for improving the effectiveness of protection on Federal property.

(d) Notice. The Facility Security Committee or highest-ranking official of the sole Federal agency occupant or a designee must ensure a notice is posted in a conspicuous place at each Federal facility under the protection responsibility of the Secretary of Homeland Security. The posted notice:

(1) Shall be 11 inches by 14 inches;

(2) Shall describe the rules and regulations governing personal conduct contained in this part; and

(3) Shall be prescribed in accordance with directions provided by the Department of Homeland Security (DHS) and found on its website at: https://www.dhs.gov/fps-visitors.

(e) Effective Date. The regulations in this part are effective Nov. 5, 2025.

[90 FR 24218, June 9, 2025, as amended at 90 FR 49248, Nov. 5, 2025]

§ 139.10 Assessments for protective services.

The Secretary of Homeland Security is authorized to charge Federal agencies under the Secretary's protection responsibility for security services provided by the Federal Protective Service.

§ 139.15 Definitions.

For purposes of this part—

Aircraft means any contrivance invented, used, or designed to navigate, or fly in, the air.

Audio recording means the use of any microphone, device, material, or equipment to capture a sound, including any tape recorder, digital recorder, or other recording device.

Building means an enclosed structure (above or below grade).

Building manager/property manager/facility manager means the individual employed by or through contract with a Federal agency that has real property management and operations authority.

Camping means the use of Federal property for living accommodation purposes. The following activities constitute camping when it reasonably appears, based on the totality of the circumstances, that the participant, in conducting these activities, is in fact using the area as a living accommodation: sleeping or preparing to sleep, including the laying down of bedding for the purpose of sleeping; storing personal belongings; making any fire; using a tent, shelter, other structure, or vehicle for sleeping; doing any digging or earth breaking; or carrying on cooking activities.

Commercial purpose means to undertake an activity with the objective of furthering, promoting, or selling a good or service regardless of whether the activity is intended to produce a profit.

Crime of violence means any offense that has as an element the use, attempted use, or threatened use of physical force against the person or property of another.

Damaging means injuring, mutilating, defacing, destroying, or impairing the use of any property owned, occupied, or secured by the Federal Government without the consent of the Federal Government.

Dangerous weapon means a weapon, device, instrument, material, or substance, animate or inanimate, that is used for, or is readily capable of causing, death or serious bodily injury, except that a pocketknife with a blade of less than two and a half inches in length is not a dangerous weapon.

Designated Official is the highest-ranking official of the primary Federal occupant agency of a Federal facility, or, alternatively, a designee selected by agreement of Federal occupant agency officials.

Emergency means a situation that causes or has the potential to cause imminent danger to life or property, including, but not limited to, terrorist attacks, bombings and bomb threats, shootings, civil disturbances, fires, explosions, electrical failures, loss of water pressure or other critical infrastructure failures, chemical and gas leaks, medical emergencies, natural disasters, or other threats to public safety and security.

Facility Security Committee means a group of representatives from Federal tenants in the facility responsible for addressing facility-specific security issues and approving the implementation of security measures and practices. The Facility Security Committee (FSC) consists of representatives of all Federal tenants in the facility, the Federal Protective Service or the Government agency or internal agency component responsible for physical security for the specific facility, and the owning or leasing department or agency with jurisdiction, custody, or control over the property. In the case of new construction or pending lease actions, the FSC will also include the project team and the planned tenant(s).

Federal facility means a federally owned or leased building, structure, or the land it resides on, in whole or in part, that is regularly occupied by Federal employees or Federal contractor workers for nonmilitary activities. The term “Federal facility” also means any building or structure acquired by a contractor through ownership or leasehold interest, in whole or in part, solely for the purpose of executing a nonmilitary Federal mission or function under the direction of an agency. The term “Federal facility” does not include public domain land, including improvements thereon; withdrawn lands; or buildings or facilities outside of the United States.

Federal Government means the United States Government, including any agency, instrumentality, or wholly owned or mixed-ownership corporation thereof.

Federal grounds mean all parts outside a Federal facility (e.g., lands, walkways, and roadways) that are owned, occupied, or secured by the Federal Government.

Federal property means any facility, grounds, or other property, to include vehicles, equipment, and any movable article, that is owned, occupied, or secured by the Federal Government and under the protection responsibility of the Secretary of Homeland Security.

Federal tenant means a Federal department or agency that occupies space and pays rent on space in any Federal facility under the protection responsibility of the Secretary of Homeland Security.

Gambling per se means a game of chance where the participant risks something of value for the chance to gain or win a prize.

Image recording means use of any camera, device, material, or equipment to capture an image, including any photograph, sketch, picture, drawing, map, or graphical representation.

Littering means discarding wastepaper, cans, bottles, or other refuse or rubbish on the ground or in any other area not designated for disposal.

Nuisance means a condition, activity, or situation, to include a loud noise or foul odor, that interferes with the use or enjoyment of Federal property.

Open container means a bottle, can, or any other receptacle containing an alcoholic beverage that is open, has a broken seal, or from which the contents are partially removed.

Personal property means any article or item, including but not limited to outer clothing, purses, backpacks, briefcases, suitcases, packages, and other containers within the possession, custody, or control of a person.

Personal transportation device means any method of conveyance, whether motorized or non-motorized, including but not limited to any personal transportation vehicle, skateboards, roller skates (including inline skates), roller shoes, roller skis, scooters, bicycles, non-medical use personal transporters, and similar devices or vehicles.

Protective Security Officer means a security guard employed by a private security contractor who provides contract security services to the Federal Protective Service (FPS) The contract security services provided by a Protective Security Officer include, but are not limited to, the performance of security screenings and inspections of persons, personal property, and vehicles entering Federal property; confronting individuals who have violated or are suspected of violating building rules and regulations; and reporting all such security-related information to FPS.

Public area means any part or section on Federal property that is ordinarily open to members of the public.

Secretary means the Secretary of the Department of Homeland Security or any person, officer, or entity within the Department to whom the Secretary's authority under 40 U.S.C. 1315 is delegated.

Secure area means any part or section on Federal property marked by signage where persons present themselves to enter the property and submit to the security inspection and screening process.

Security personnel means persons authorized to ensure compliance with this part, including FPS law enforcement officers, protective security officers (PSO), court security officers, or other security personnel charged by the Federal Government with security duties under this part such as other DHS component armed security guards performing similar duties as contract PSOs.

Service animal has the meaning given in 28 CFR 35.104. Generally, service animal means any dog that is individually trained to do work or perform tasks for the benefit of an individual with a disability, including a physical, sensory, psychiatric, intellectual, or other mental disability.

Tobacco product means any item made or derived from tobacco that is intended for human consumption, including any component, part, or accessory of a tobacco product (except for raw materials other than tobacco used in manufacturing a component, part, or accessory of a tobacco product). Tobacco product does not mean any item specifically excluded by the Food, Drug, and Cosmetic Act, 21 U.S.C. 301 et seq.

Unmanned aircraft means an aircraft that is operated without the possibility of direct human intervention from within or on the aircraft.

Unmanned aircraft system means an unmanned aircraft and associated elements (including communication links and components that control the unmanned aircraft) that are required for the operator to operate safely and efficiently in the national airspace system.

Vehicle means any method of conveyance, whether motorized or non-motorized, including but not limited to any motorcycle, automobile, truck, tractor, bus, motorhome, agricultural machinery, construction equipment, and other similar vehicle, even if autonomously operated.

Water area means any area where water is retained or collected such as a fountain, basin, pool, pond, septic or sewer, reservoir, or other manmade water feature maintained on Federal property.

§ 139.20 Admissions and inspections related to Federal property.

When a Facility Security Committee (FSC) or the highest-ranking official of the sole Federal agency occupant or designee requires inspections at a Federal facility, then no person required to be screened may enter a secure area without submitting to the screening and inspection of that person and all accessible personal property or vehicles. Security personnel shall conduct inspections and screening as follows:

(a) Security personnel shall inspect any person, article of personal property, or vehicle, when entering in or present on Federal property, for firearms, explosives, dangerous weapons, and the component parts thereof.

(b) Once a person, article of personal property, or vehicle enters a secure area, the inspection process will not terminate until completed by security personnel.

(c) Security personnel may deny admission, remove, or take other appropriate law enforcement action with respect to any person, article of personal property, or vehicle that fails to comply with security procedures, delays or impairs the inspection process, or presents a threat to either security personnel or other persons in or on Federal property.

§ 139.25 Preservation of Federal property.

All persons are prohibited from the following conduct affecting Federal property:

(a) Littering;

(b) Damaging or otherwise changing the appearance of Federal property in any way except through authorized normal and customary use;

(c) Removing Federal property without proper authority;

(d) Creating any hazard or threat of hazard on Federal property to persons or things;

(e) Throwing articles of any kind from or at Federal property;

(f) Climbing on any statue, fountain, or part of a Federal facility, or any tree, shrub, or plant on Federal property; and

(g) Using, operating, parking, locking, or storing any vehicle or personal transportation device on Federal property, except as either required by individuals with mobility impairments, or otherwise specifically allowed in designated areas.

§ 139.30 Conformance with signs and directions.

Any person on Federal property must at all times comply with official signs of a prohibitory, regulatory, or directive nature and with the lawful direction of security personnel.

§ 139.35 Prohibited conduct.

All persons are prohibited from engaging in the following conduct, on Federal property or in areas outside Federal property, that affects, threatens, or endangers Federal property or persons on the Federal property—

(a) Disorderly conduct, which includes, but is not limited to, assaulting, fighting, harassing, intimidating, threatening or other violent behavior, lewd acts, or the inappropriate disposal of feces, urine, and other bodily fluids.

(b) Wearing a mask, hood, disguise, or device that conceals the identity of the wearer when attempting to avoid detection or identification while violating any Federal, state, or local law, ordinance, or regulation.

(c) Creating a loud or unusual noise, noxious odor, or other nuisance.

(d) Obstructing the usual use, enjoyment, or access to Federal property, including but not limited to use of entrances, exits, exterior areas, plazas, courtyards, foyers, lobbies, corridors, offices, elevators, escalators, stairways, parking areas, garages, loading docks, and areas on Federal property designated as closed during an emergency.

(e) Impeding or disrupting the security inspection process administered by security personnel, the performance of official duties by Federal employees, or the ability of the general public to obtain services provided by the Federal Government.

(f) Threatening by any means, including but not limited to by mail, facsimile, telephone, or electronic communications, to commit any crime of violence.

(g) Bathing, wading, or swimming in or polluting any water area, except where authorized by the Federal agency responsible for the property.

(h) Camping, except in designated areas and as expressly authorized by the Facility Security Committee, Designated Official, or Federal agency responsible for the property.

(i) Trespassing, entering, or remaining in or upon areas of Federal property closed to the public.

(j) Consuming a tobacco product in all interior space owned, rented, or leased by the Federal Government, as well as all courtyards, terraces, and plazas within 25 feet of doorways and air intake ducts under the custody, control, or jurisdiction of the Federal Government.

(k) Causing an unmanned aircraft or system to take off or land on Federal property without express permission from the Facility Security Committee, Designated Official, or Federal agency responsible for the property.

(l) Using an unmanned aircraft or system to cause interference, damage, destruction, harm, or a hazard to Federal property or persons on the property.

(m) Tampering with, accessing, damaging, or interfering with the operation of a computer, digital network, industrial control system or Supervisory Control and Data Acquisition (SCADA) system without proper authorization.

(n) No person, except authorized security personnel or sworn law enforcement officers, may wear, display, present, or possess any indicia of law enforcement or security authority, to include any badge, insignia, emblem, identification card, uniform or part of a uniform, or any imitation thereof.

§ 139.40 Gambling.

(a) General rule. Any person on Federal property is prohibited from—

(1) Participating in games for money or other personal property;

(2) Operating gambling devices;

(3) Conducting a lottery or pool; or

(4) Selling or purchasing gambling tickets.

(b) Exceptions. This section is not intended to prohibit:

(1) Vending or exchange of chances by licensed blind operators of vending facilities for any lottery set forth in a State law and authorized by section 2(a)(5) of the Randolph-Sheppard Act (20 U.S.C. 107 et seq.); and

(2) Prize drawings for personal property at otherwise permitted functions on Federal property, provided that the game or drawing does not constitute gambling per se.

§ 139.45 Narcotics, other drugs, and drug paraphernalia.

(a) Narcotics and other drugs. Except when a patient uses a narcotic or drug as prescribed by a licensed health care provider in accordance with Federal law, any person on Federal property is prohibited from being under the influence of, using, possessing, or operating a vehicle while under the influence of any controlled substance as defined in 21 U.S.C. 802, 812, 841.

(b) Drug paraphernalia. Any person on Federal property is prohibited from possessing drug paraphernalia as defined in 21 U.S.C. 863.

§ 139.50 Alcoholic beverages.

(a) General rule. Any person on Federal property is prohibited from either consuming, or otherwise being under the influence of alcoholic beverages, possessing an open container of alcohol, or operating a vehicle while under the influence of alcohol.

(b) Exception. The head of the occupant agency for the designee in the space where the alcohol is to be served may grant a written exemption to the prohibition against the consumption of alcoholic beverages on Federal property. A copy of any granted exemption must be provided to the building manager and the officials responsible for the security of the property before the event at which alcohol will be consumed is held.

§ 139.55 Soliciting, vending, and debt collection.

(a) General rule. Soliciting, begging, or demanding gifts, money, goods, or services on Federal property is prohibited, unless otherwise provided in paragraph (b) of this section. Any person on Federal property is specifically prohibited from:

(1) Soliciting on behalf of:

(i) Charitable organizations.

(ii) Political campaigns.

(iii) Commercial enterprises.

(2) Vending merchandise of any kind.

(3) Displaying or distributing commercial advertising.

(4) Collecting private debts, including repossession of vehicles.

(b) Exceptions. The following activities are allowed:

(1) Soliciting on behalf of charitable organizations as authorized by 5 CFR part 950 and sponsored or approved by the occupant agency.

(2) Posting concessions or personal notices by employees on authorized bulletin boards.

(3) Lessee, or its agents and employees, with respect to space leased for commercial, cultural, educational, or recreational use under 40 U.S.C. 581(h). Public areas of General Services Administration (GSA)-controlled property may be used for other activities as prescribed by GSA.

(4) Collection of non-monetary items that are sponsored or approved by the Federal occupant agencies.

(5) Commercial activities sponsored by recognized Federal employee associations and on-site childcare centers.

[90 FR 24218, June 9, 2025, as amended at 91 FR 5665, Feb. 9, 2026]

§ 139.60 Posting and distributing materials.

(a) General rule. Any person on Federal property is prohibited from the following activities:

(1) Posting or affixing materials, such as pamphlets, handbills, or flyers on Federal property, including vehicles, bulletin boards, and other equipment.

(2) Distributing materials, such as pamphlets, handbills or flyers, or free samples, including samples of tobacco products.

(b) Exceptions. (1) The posting or distribution of materials is allowed when conducted as part of an authorized Federal activity.

(2) An individual may distribute materials in public areas on Federal property, provided the person first obtains a permit from the building manager, and the person does not leave behind any of the materials.

[90 FR 24218, June 9, 2025, as amended at 91 FR 5665, Feb. 9, 2026]

§ 139.65 Photography and recording.

(a) General. Any person on Federal property is prohibited from photographing or creating video, image, or audio recordings of Federal facilities and grounds in contravention of any security regulation, rule, order, or directive, including any Federal Court Order or Rule; or in a manner that impedes or disrupts access to, or operations on, Federal property.

(b) Exceptions. When not prohibited by a security regulation, rule, order, or directive, including any Federal Court Order or Rule, the following activities are allowed:

(1) Any person, including persons affiliated with the media and commercial entities, may photograph or record video, images, and audio of publicly accessible exterior areas of Federal facilities and grounds from public areas, including public streets, sidewalks, parks, and plazas, when not impeding or disrupting access to or operations on the Federal property.

(2) Any person, including persons affiliated with the media and commercial entities, may photograph or record video, images, and audio of publicly accessible interior areas of Federal facilities and grounds from public areas, including public entrances, lobbies, foyers, corridors, or auditoriums, when not impeding or disrupting access to or operations on the Federal property.

(3) Any person, including persons affiliated with the media and commercial entities, may only photograph or record video, images, and audio of interior areas occupied by a Federal tenant with the express permission of the occupying tenant. Persons must obtain written permission in advance from the occupying tenant when photographing or recording tenant-occupied space for a commercial purpose.

[90 FR 24218, June 9, 2025, as amended at 91 FR 5665, Feb. 9, 2026]

§ 139.70 Vehicle operation and removal.

(a) Safe operation. All vehicle operators on Federal property must:

(1) Drive/operate in a careful and safe manner at all times;

(2) Possess a valid driver's/operator's license;

(3) Comply with the lawful signals and directions of security personnel; and

(4) Comply with traffic and safety signals and posted signs.

(b) Prohibited operations. All vehicle operators on Federal property or in areas outside Federal property that affect, threaten, or endanger Federal property or persons on the property, are prohibited from:

(1) Blocking entrances, driveways, walks, loading platforms, fire hydrants, docking areas, or other passageways; and

(2) Parking on or adjacent to Federal property in unauthorized locations, or contrary to the direction of posted signs.

(c) Responsibility. Registered vehicle owners will be responsible for violations of this section when the vehicle operator is not present.

(d) Enforcement. Security personnel may stop any vehicle that is observed operating on Federal property in violation of this section.

(e) Removal and seizure. Any vehicle used in violation of this section may be seized, removed, immobilized, towed, stored, marked with warning tags or notices, and booted in addition to any law enforcement actions or citations. All expenses incurred because of any seizure, removal, immobilization, towing, storage, marking, booting, or other law enforcement actions will be the responsibility of the owner, driver, operator, or other person using or operating the vehicle that is in violation of this section.

[90 FR 24218, June 9, 2025, as amended at 91 FR 5665, Feb. 9, 2026]

§ 139.75 Firearms, dangerous weapons, and explosives.

(a) Any person on Federal property is prohibited from knowingly carrying or otherwise possessing a firearm or other dangerous weapon, as defined by 18 U.S.C. 921 and 930, whether carried or otherwise possessed either openly or concealed, unless authorized by 18 U.S.C. 930(d).

(b) Any person on Federal property is prohibited from knowingly carrying or otherwise possessing explosives, as defined by 18 U.S.C. 841, or items intended to be used to fabricate an explosive or incendiary device, whether carried or otherwise possessed either openly or concealed, except for official purposes as authorized by the Facility Security Committee, Designated Official, FPS, or other primary law enforcement agency responsible for the security of the Federal property.

§ 139.80 Animals.

(a) General rule. All persons are prohibited from bringing animals in or on Federal property for other than official purposes.

(b) Exception. Persons with disabilities, as defined under the Americans with Disabilities Act of 1990, may, consistent with 28 CFR 35.136, bring a service animal or miniature horse that is trained to do work or perform tasks for the benefit of that individual. The work or tasks performed by a service animal must be directly related to the individual's disability. Examples of work or tasks include, but are not limited to, assisting individuals who are blind or have low vision with navigation and other tasks, alerting individuals who are deaf or hard of hearing to the presence of people or sounds, providing non-violent protection or rescue work, pulling a wheelchair, assisting an individual during a seizure, alerting individuals to the presence of allergens, retrieving items such as medicine or the telephone, providing physical support and assistance with balance and stability to individuals with mobility disabilities, and helping persons with psychiatric and neurological disabilities by preventing or interrupting impulsive or destructive behaviors. The crime deterrent effects of an animal's presence and the provision of emotional support, well-being, comfort, or companionship do not constitute work or tasks for purposes of the exception in this paragraph (b). Persons with disabilities may be required to state whether the animal is a service animal required because of a disability.

§ 139.85 Penalties.

A person who violates any provision of this subpart may be punished by a fine under title 18, United States Code, imprisoned for not more than 30 days, or both.

§ 158.101 Purpose.

(a) Cybersecurity Talent Management System. This part contains regulations establishing the Cybersecurity Talent Management System (CTMS) and the resulting DHS Cybersecurity Service (DHS-CS). CTMS is designed to recruit and retain individuals with the qualifications necessary to execute the DHS cybersecurity mission and is also designed to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission.

(b) DHS Cybersecurity Service. Under this part, the Secretary or designee establishes and manages the DHS Cybersecurity Service (DHS-CS) described in subpart B of this part.

(c) Regulations & policy. The regulations in this part provide the policy framework for establishing and administering CTMS, and establishing and managing the DHS-CS. The Secretary or designee implements this part through CTMS policy defined in § 158.104.

§ 158.102 Scope of authority.

(a) Authority. This part implements the Secretary's authority in 6 U.S.C. 658 and governs talent management involving the individuals described in § 158.103.

(b) Other laws superseded. Unless explicitly stated otherwise in this part or explicitly provided otherwise by Congress, this part supersedes all other provisions of law and policy relating to appointment, number, classification, or compensation of employees that the Secretary deems are incompatible with the approach to talent management under this part. For compensation authorized under this part, the Department provides all such compensation under the authority in 6 U.S.C. 658, and also provides some types of such compensation in accordance with relevant provisions of other laws, including provisions in 5 U.S.C. and 5 CFR, to the extent compatible with the approach to talent management under this part.

(c) Preservation of authority. Nothing in this part shall be deemed or construed to limit the Secretary's authority in 6 U.S.C. 658.

§ 158.103 Coverage.

(a) Talent management. This part covers:

(1) Establishing and administering CTMS; and

(2) Establishing and managing the DHS-CS.

(b) Individuals. This part applies to any individual:

(1) Being recruited for employment under this part;

(2) Applying for employment under this part;

(3) Serving in a qualified position under this part;

(4) Managing, or participating in the management of, any DHS-CS employee under this part, including as a supervisor or any other employee of the Department who has the authority to take, direct others to take, recommend, or approve any talent management action under this part; or

(5) Serving on the Cybersecurity Talent Management Board described in § 158.302.

§ 158.104 Definitions.

As used in this part:

Additional compensation means the compensation described in § 158.603(c).

Advisory appointment means an appointment to a qualified position under subpart J of this part.

Annuitant has the same meaning as that term in 5 CFR 553.102.

Anticipated mission impact means the influence the Department anticipates an individual will have on execution of the DHS cybersecurity mission based on the individual's CTMS qualifications and application of those qualifications to successfully and proficiently perform DHS-CS cybersecurity work.

Assignment means a description of a specific subset of DHS-CS cybersecurity work and a specific subset of CTMS qualifications necessary to perform that work, the combination of which is associable with a qualified position.

Break in service means the time when an employee is no longer on the payroll of a Federal agency.

Continuing appointment means an appointment for an indefinite time period to a qualified position.

CTMS policy means the Department's decisions implementing and operationalizing the regulations in this part, and includes directives, instructions, and operating guidance and procedures.

CTMS qualifications means qualifications identified under § 158.402(c).

Cybersecurity incident has the same meaning as the term “incident” in 6 U.S.C. 659.

Cybersecurity risk has the same meaning as that term in 6 U.S.C. 659.

Cybersecurity Talent Management Board or CTMB means the group of officials described in § 158.302.

Cybersecurity Talent Management System or CTMS means the approach to talent management, which encompasses the definitions, processes, systems, and programs, established under this part.

Cybersecurity talent market means the availability, in terms of supply and demand, of talent relating to cybersecurity and employment relating to cybersecurity, including at other Federal agencies such as the Department of Defense.

Cybersecurity threat has the same meaning as that term in 6 U.S.C. 1501(5).

Cybersecurity work means activity involving mental or physical effort, or both, to achieve results relating to cybersecurity.

Department or DHS means the Department of Homeland Security.

DHS cybersecurity mission means the cybersecurity mission described in § 158.201. As stated in that section, the DHS cybersecurity mission encompasses all responsibilities of the Department relating to cybersecurity.

DHS Cybersecurity Service or DHS-CS means the qualified positions designated and established under this part and the employees appointed to those positions under this part.

DHS-CS advisory appointee means a DHS-CS employee serving in an advisory appointment under this part.

DHS-CS cybersecurity work means cybersecurity work identified under § 158.402(b).

DHS-CS employee means an employee serving in a qualified position under this part.

Employee has the same meaning as that term in 5 U.S.C. 2105.

Excepted service has the same meaning as that term in 5 U.S.C. 2103.

Executive Schedule means the pay levels described in 5 U.S.C. 5311.

Former DHS-CS employee means an individual who previously served, but is not currently serving, in a qualified position.

Functions has the same meaning as that term in 6 U.S.C. 101(9).

Mission impact means a DHS-CS employee's influence on execution of the DHS cybersecurity mission by applying the employee's CTMS qualifications to successfully and proficiently perform DHS-CS cybersecurity work.

Mission-related requirements means characteristics of an individual's expertise or characteristics of cybersecurity work, or both (including cybersecurity talent market-related information), that are associated with successful execution of the DHS cybersecurity mission, and that are determined by officials with appropriate decision-making authority.

Preference eligible has the same meaning as that term in 5 U.S.C. 2108.

Qualification means a quality of an individual that correlates with the successful and proficient performance of cybersecurity work, such as capability, experience and training, and education and certification. A capability is a cluster of interrelated attributes that is measurable or observable or both. Interrelated attributes include knowledge, skills, abilities, behaviors, and other characteristics.

Qualified position means CTMS qualifications and DHS-CS cybersecurity work, the combination of which is associable with an employee.

Renewable appointment means a time-limited appointment to a qualified position.

Salary means an annual rate of pay under this part and is basic pay for purposes under 5 U.S.C. and 5 CFR. The salary for a DHS-CS employee is described in § 158.603.

Secretary means the Secretary of Homeland Security.

Secretary or designee means the Secretary or an official or group of officials authorized to act for the Secretary in the matter concerned.

Strategic talent priorities means the priorities for CTMS and the DHS-CS set under § 158.304.

Supervisor means an employee of the Department who has authority to hire, direct, assign, promote, reward, transfer, furlough, layoff, recall, suspend, discipline, or remove employees, or to effectively recommend such actions. A supervisor for a DHS-CS employee may be a DHS-CS employee or may be an employee of the Department serving in a position outside the DHS-CS.

Talent management means a systematic approach to linking employees to mission and organizational goals through intentional strategies and practices for hiring, compensating, and developing employees.

Talent management action has the same meaning as the term personnel action in 5 U.S.C. 2302(a)(2) for applicable actions, and the terms talent management action and personnel action may be used interchangeably in this part.

Veteran has the same meaning as that term in 5 U.S.C. 2108.

Work level means a grouping of CTMS qualifications and DHS-CS cybersecurity work with sufficiently similar characteristics to warrant similar treatment in talent management under this part.

Work valuation means a methodology through which an organization defines and evaluates the value of work and the value of individuals capable of performing that work.

§ 158.201 Cybersecurity mission.

Cybersecurity is a matter of homeland security and one of the core missions of the Department. Congress and the President charge the Department with responsibilities relating to cybersecurity and grant the Secretary and other officials authorities to carry out those cybersecurity responsibilities. The Department's cybersecurity mission is dynamic to keep pace with the evolving cybersecurity risks and cybersecurity threats facing the Nation and to adapt to any changes in the Department's cybersecurity responsibilities. The DHS cybersecurity mission encompasses all responsibilities of the Department relating to cybersecurity.

§ 158.202 Cybersecurity Service (DHS-CS).

The Secretary or designee establishes and manages the DHS-CS to enhance the cybersecurity of the Nation through the most effective execution of the DHS cybersecurity mission.

§ 158.203 Positions in the DHS-CS.

(a) Qualified positions. The Secretary or designee designates and establishes qualified positions in the excepted service as the Secretary or designee determines necessary for the most effective execution of the DHS cybersecurity mission.

(b) Designating qualified positions. The Secretary or designee designates qualified positions under the deployment program, described in § 158.701, as part of determining when the Department uses CTMS to recruit and retain individuals possessing CTMS qualifications.

(c) Establishing qualified positions. The Secretary or designee establishes a qualified position under the talent acquisition system, described in § 158.501 of this part, by the appointment of an individual to a qualified position previously designated.

§ 158.204 Employees in the DHS-CS.

(a) DHS-CS employees. DHS-CS employees serve in the excepted service, and the Department hires, compensates, and develops DHS-CS employees using CTMS.

(b) Mission execution and assignments. DHS-CS employees execute the DHS cybersecurity mission by applying their CTMS qualifications to perform the DHS-CS cybersecurity work of their assignments.

(c) Mission impact and recognition. Application of a DHS-CS employee's CTMS qualifications to successfully and proficiently perform DHS-CS cybersecurity work results in mission impact attributable to that employee. The Department reviews a DHS-CS employee's mission impact as described in § 158.805, which may result in recognition as described in § 158.630.

(d) Compensation. In alignment with the compensation strategy described in § 158.601, the Department provides compensation to a DHS-CS employee as described in § 158.603.

(e) Recruitment and development. The Department strategically and proactively recruits individuals as described in § 158.510 and develops DHS-CS employees under the career development program, described in § 158.803, that emphasizes continual learning.

(f) Core values. The Department uses the core values, described in § 158.305, to manage the DHS-CS.

§ 158.205 Assignments in the DHS-CS.

(a) Assignments generally. Each DHS-CS employee has one or more assignments during the employee's service in the DHS-CS. The Department designates and staffs assignments under the deployment program, described in § 158.701.

(b) Initial and subsequent assignments. The Department matches an individual appointed to a qualified position with an initial assignment as described in § 158.703(c). The Department may match DHS-CS employees with one or more subsequent assignments as described in § 158.703(d).

§ 158.301 Administering CTMS and Managing the DHS-CS.

(a) The Secretary or designee is responsible for administering CTMS and managing the DHS-CS, including establishing and maintaining CTMS policy.

(b) The Cybersecurity Talent Management Board (CTMB) is responsible for assisting the Secretary or designee in administering CTMS and managing the DHS-CS.

(c) The Secretary or designee, with assistance from the CTMB, administers CTMS and manages the DHS-CS based on:

(1) Talent management principles described in § 158.303;

(2) Strategic talent priorities described in § 158.304; and

(3) DHS-CS core values described in § 158.305.

§ 158.302 Cybersecurity Talent Management Board (CTMB).

(a) Purpose. As part of assisting the Secretary or designee in administering CTMS and managing the DHS-CS, the CTMB periodically evaluates whether CTMS is recruiting and retaining individuals with the qualifications necessary to execute the DHS cybersecurity mission.

(b) Composition. The CTMB comprises:

(1) Officials representing DHS organizations involved in executing the DHS cybersecurity mission; and

(2) Officials responsible for developing and administering talent management policy within the Department.

(c) Membership. The Secretary or designee:

(1) Appoints officials to serve as members of the CTMB;

(2) Designates the Co-Chairs of the CTMB; and

(3) Ensures CTMB membership fulfills the membership requirements in this section and includes appropriate representation, as determined by the Secretary or designee, from across the Department.

(d) Operation. The Secretary or designee establishes the CTMB and minimum requirements for CTMB operation.

(e) External Assistance. The CTMB may periodically designate an independent evaluator to conduct an evaluation of CTMS.

§ 158.303 Talent management principles.

(a) Merit system principles. CTMS is designed and the Secretary or designee, with assistance from the CTMB, administers CTMS based on the principles of merit and fairness embodied in the merit system principles in 5 U.S.C. 2301(b).

(b) Prohibited personnel practices. Any employee of the Department who has the authority to take, direct others to take, recommend, or approve any talent management action under this part must comply with 5 U.S.C. 2302(b) regarding talent management actions under this part.

(c) Equal employment opportunity principles. CTMS is designed and the Secretary or designee, with assistance from the CTMB, administers CTMS and manages the DHS-CS in accordance with applicable anti-discrimination laws and policies. Thus, talent management actions under this part that materially affect a term or condition of employment must be free from discrimination.

§ 158.304 Strategic talent priorities.

The Secretary or designee, with assistance from the CTMB, administers CTMS and manages the DHS-CS based on strategic talent priorities, which the Secretary or designee sets on an ongoing basis using:

(a) Information from strategic talent planning described in § 158.401(c);

(b) The Department's financial and resources planning functions, including the functions described in 6 U.S.C. 342(b);

(c) The Department's comprehensive strategic planning, including the plan described in 5 U.S.C. 306; and

(d) Departmental priorities.

§ 158.305 DHS-CS core values.

The Secretary or designee, with assistance from the CTMB, manages the DHS-CS based on the following core values:

(a) Expertise, including enhancing individual and collective expertise regarding cybersecurity through continual learning;

(b) Innovation, including pursuing new ideas and methods regarding cybersecurity work and cybersecurity generally; and

(c) Adaptability, including anticipating and adjusting to emergent and future cybersecurity risks and cybersecurity threats.

§ 158.401 Strategic talent planning process.

(a) Purpose. On an ongoing basis, the Secretary or designee engages in a strategic talent planning process to ensure CTMS adapts to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission.

(b) Process. The Secretary or designee establishes and administers a strategic talent planning process that comprises:

(1) Identifying DHS-CS cybersecurity work and CTMS qualifications based on the DHS cybersecurity mission as described in § 158.402;

(2) Analyzing the cybersecurity talent market as described in § 158.403;

(3) Describing and valuing DHS-CS cybersecurity work under the work valuation system described in § 158.404; and

(4) Ensuring CTMS administration and DHS-CS management is continually informed by current, relevant information as described in paragraph (c) of this section.

(c) Informing CTMS administration and DHS-CS management. The Secretary or designee aggregates information generated in the processes described in paragraphs (b)(1) through (3) of this section and information from administering CTMS, and uses that aggregated information to inform all other CTMS processes, systems, and programs under this part.

§ 158.402 DHS-CS cybersecurity work and CTMS qualifications identification.

On an ongoing basis, the Secretary or designee analyzes the DHS cybersecurity mission to identify:

(a) The functions that execute the DHS cybersecurity mission;

(b) The cybersecurity work required to perform, manage, or supervise those functions; and

(c) The set of qualifications, identified in accordance with applicable legal and professional guidelines, necessary to perform that work.

§ 158.403 Talent market analysis.

On an ongoing basis, the Secretary or designee conducts an analysis of the cybersecurity talent market, using generally recognized compensation principles and practices to:

(a) Identify and monitor trends in both employment for and availability of talent related to cybersecurity, including variations in the cost of talent in local cybersecurity talent markets, defined in § 158.612(b)(1), or variations in the cost of living in those markets, or both; and

(b) Identify leading strategies for recruiting and retaining talent related to cybersecurity.

§ 158.404 Work valuation system.

(a) The Secretary or designee establishes and administers a person-focused work valuation system to facilitate systematic management of the DHS-CS and to address internal equity among DHS-CS employees. The work valuation system is designed to reflect that:

(1) The DHS cybersecurity mission is dynamic;

(2) Cybersecurity work is constantly evolving; and

(3) Individuals, through application of their qualifications, significantly influence how cybersecurity work is performed.

(b) The work valuation system is based on:

(1) CTMS qualifications; and

(2) DHS-CS cybersecurity work.

(c) The Department uses the work valuation system to establish work and career structures, such as work levels, titles, ranks, and specializations, and the Department uses these work and career structures for purposes of talent management under this part, such as:

(1) Describing and categorizing DHS-CS employees, qualified positions, and assignments;

(2) Assessing and selecting individuals for appointment to qualified positions; and

(3) Compensating DHS-CS employees under this part, including establishing and administering one or more salary structures, described in § 158.611.

(d) The Department may also use the work and career structures described in paragraph (c) of this section for budget and fiscal purposes related to administering CTMS and managing the DHS-CS.

§ 158.405 Exemption from General Schedule position classification.

The provisions of 5 U.S.C. Chapter 51 regarding classification and 5 CFR part 511 regarding classification under the General Schedule, among other similar laws, do not apply under CTMS, to the DHS-CS, or to talent management involving the individuals described in § 158.103.

§ 158.501 Talent acquisition system.

(a) The Secretary or designee establishes and administers a talent acquisition system, in accordance with applicable legal and professional guidelines governing the assessment and selection of individuals, to identify and hire individuals possessing CTMS qualifications.

(b) The talent acquisition system comprises the strategies, programs, and processes described in this subpart and in CTMS policy for proactively and strategically recruiting individuals, assessing qualifications of individuals, and considering and selecting individuals for employment in the DHS-CS and appointment to qualified positions.

§ 158.502 Exemption from other laws regarding appointment.

The provisions of the following laws, among other similar laws, do not apply under CTMS, to the DHS-CS, or to talent management involving the individuals described in § 158.103:

(a) The following provisions of 5 U.S.C.:

(1) Section 3320 regarding selection and appointment in the excepted service; and

(2) Chapter 51 regarding classification; and

(b) The following provisions of 5 CFR:

(1) Part 211 regarding veteran preference;

(2) Part 302 regarding employment in the excepted service (except § 302.203 regarding disqualifying factors);

(3) Part 352 regarding reemployment rights (except subpart C regarding detail and transfer of Federal employees to international organizations); and

(4) Part 511 regarding classification under the General Schedule.

§ 158.510 Strategic recruitment.

(a) On an ongoing basis, the Department develops and implements strategies for publicly communicating about the DHS cybersecurity mission and the DHS-CS and for proactively recruiting individuals likely to possess CTMS qualifications.

(b) The Department develops and implements strategies described in paragraph (a) of this section based on:

(1) CTMS qualifications and DHS-CS cybersecurity work; and

(2) Strategic talent priorities.

(c) In developing and implementing strategies described in paragraph (a) of this section, the Department may collaborate with:

(1) Other Federal agencies including the Department of Defense, the Office of Personnel Management, and the Department of Veterans Affairs;

(2) Institutions of higher education, as defined in 20 U.S.C. 1001, including historically Black colleges or universities, as described in 20 U.S.C. 1061(2), and other minority-serving institutions, as described in 20 U.S.C. 1067q(a);

(3) National organizations, including veterans service organizations recognized by the Department of Veterans Affairs, and professional associations chartered by Congress under 36 U.S.C. Part B; and

(4) Other similar organizations and groups.

(d) The Department considers the availability of preference eligibles and veterans for appointment under this part, and develops and implements specific strategies to proactively recruit such individuals.

§ 158.511 Outreach and sourcing.

(a) The Department uses a variety of sources, including publicly available information, to identify individuals or groups of individuals for recruitment under this subpart.

(b) CTMS policy implementing this subpart addresses:

(1) Communication of opportunities for employment in the DHS-CS;

(2) Communication of the application processes to individuals being recruited under this part or applying for employment under this part; and

(3) Acceptance and treatment of applications for employment in the DHS-CS, including minimum application requirements established under this part.

§ 158.512 Interview expenses.

(a) An individual being considered for employment in the DHS-CS may receive payment or reimbursement for travel to and from preemployment interviews, which may include participating in the assessment program described in § 158.520.

(b) The Department pays or reimburses interview expenses, described in paragraph (a) of this section, in accordance with 5 U.S.C. 5706b and the Federal Travel Regulations at 41 CFR chapters 301 through 304.

§ 158.520 Assessment.

(a) The Department determines individuals' CTMS qualifications under the assessment program described in this section. To be considered for employment in the DHS-CS, an individual must participate in the assessment program and meet applicable rating or scoring thresholds in each assessment process in which that individual participates.

(b) The Department establishes and administers an assessment program, with one or more assessment processes, based on CTMS qualifications. The assessment program is designed to efficiently and accurately determine individuals' CTMS qualifications.

(c) Each assessment process compares the qualifications of an individual to CTMS qualifications. The Department develops and administers each assessment process in accordance with applicable legal and professional guidelines governing the assessment and selection of individuals.

(d) An assessment process may use standardized instruments and procedures to measure qualifications. An assessment process may also use demonstrations of qualifications determined appropriate by the Secretary or designee, such as rewards earned from the cybersecurity competition described in Executive Order 13870, published, peer-reviewed cybersecurity research, or a cybersecurity invention or discovery granted a patent under 35 U.S.C. Part II.

(e) The Department makes available information to assist individuals in understanding the purpose of, and preparing for participation in, an assessment process.

(f) To maintain the objectivity and integrity of the assessment program, the Department maintains control over the security and release of materials relating to the assessment program, including assessment plans, validation studies, and other content. Except as otherwise required by law, the Department does not release the following:

(1) Sensitive materials relating to the design and administration of the assessment program;

(2) Names or lists of individuals applying for employment in the DHS-CS; and

(3) Results or relative ratings of individuals who participated in the assessment program.

§ 158.521 Employment eligibility requirements and employment-related criteria.

(a) Employment eligibility requirements. To be eligible for employment in the DHS-CS, an individual must:

(1) Meet U.S. citizenship requirements as described in governing Appropriation Acts; and

(2) Comply with Selective Service System requirements described in 5 U.S.C. 3328.

(b) Employment-related criteria. The Department determines criteria related to employment in the DHS-CS, reviews individuals applying for employment in the DHS-CS using such criteria, and, as part of an offer of appointment to a qualified position, provides written notice of specific, applicable employment-related criteria necessary to obtain and maintain, employment in the DHS-CS. Employment-related criteria include:

(1) Fitness standards and similar factors described in Executive orders, 5 CFR 302.203, and policies of the Department;

(2) Personnel security requirements related to fitness standards and similar factors described in paragraph (b)(1) of this section;

(3) Geographic mobility requirements; and

(4) Other criteria related to any aspect of appointment or employment, including selection, appointments, qualified positions, or assignments, or some or all of the foregoing.

(c) Accepting and maintaining employment-related criteria. To be appointed to a qualified position, an individual must accept and satisfy the specific, applicable employment-related criteria associated with the individual's offer of appointment concurrent with the individual's acceptance of the offer of appointment. An individual's acceptance of an appointment to a qualified position constitutes acceptance of applicable employment-related criteria for that qualified position and the individual's agreement to satisfy and maintain those criteria.

(d) Changes to employment-related criteria. Employment-related criteria may change, and DHS-CS employees may be required to accept and satisfy such changes to maintain employment in the DHS-CS.

(e) Disqualification. The Department may disqualify an individual from consideration for employment in the DHS-CS or from appointment to a qualified position for: Providing false information to the Department, engaging in dishonest conduct with the Department, unauthorized disclosure of assessment materials for purposes of giving any applicant an advantage in the assessment process, or other actions related to an individual's character or conduct that may negatively impact the integrity or efficiency of the DHS-CS.

§ 158.522 Selection and appointment.

(a) The Department selects an individual for employment in the DHS-CS based on the individual's CTMS qualifications, as determined under the assessment program described in § 158.520.

(b) Prior to finalizing the selection of an individual for employment in the DHS-CS, the Department considers the availability of preference eligibles for appointment under this part, including those recruited based on specific strategies described in § 158.510(d), who have participated in the assessment program and met applicable rating or scoring thresholds, as described in § 158.520(a). When a selection is imminent and there are both preference eligibles and non-preference eligibles undergoing final consideration, the Department regards status as a preference eligible as a positive factor in accordance with CTMS policy.

(c) The Department appoints an individual to a qualified position under the authority in 6 U.S.C. 658 and this part, and all such appointments are in the excepted service and are one of the following types of appointment:

(1) A renewable appointment under § 158.523(a);

(2) A continuing appointment under § 158.523(b); or

(3) An advisory appointment under § 158.523(c).

(d) As part of selecting an individual for employment in the DHS-CS and appointing an individual to a qualified position under this part, the Department:

(1) Determines applicable work and career structures, including the individual's initial work level, using the work valuation system described in § 158.404;

(2) Sets the individual's initial salary using the salary system as described in § 158.620; and

(3) Matches the individual with an initial assignment as described in § 158.703(c).

(e) No qualified position may be established through the non-competitive conversion of a current Federal employee from an appointment made outside the authority of this part to an appointment made under this part.

(f) An individual who accepts an appointment to a qualified position under this part voluntarily accepts an appointment in the excepted service.

(g) A DHS-CS employee serves in the same qualified position throughout a single continuing appointment under this part and throughout multiple, consecutive renewable or continuing appointments under this part, regardless of any changes in the employee's assignments, including primary DHS organization, or changes in the employee's official worksite.

§ 158.523 Appointment types and circumstances.

(a) Renewable appointment. Appointment of an individual to a renewable appointment is for up to three years. The Department may renew a renewable appointment for any time period of up to three years, subject to any limitation in CTMS policy regarding the number of renewals. Subject to any additional limitation in CTMS policy, the Department may change an unexpired renewable appointment to a continuing appointment for a DHS-CS employee receiving a salary in the standard range described in § 158.613(b). The following types of renewable appointments include special conditions:

(1) Reemployed annuitant. Under this part, the Department may appoint an annuitant to a qualified position and must appoint the annuitant to a renewable appointment. An annuitant appointed to a qualified position serves at the will of the Secretary.

(2) Uncompensated service. Under this part, the Department may appoint to a qualified position an individual to provide uncompensated service, any such service is gratuitous service, and the Department must appoint such an individual to a renewable appointment. The gratuitous nature of service must be a condition of employment of such an appointment. The Secretary or designee must approve the appointment of each individual providing uncompensated service by name, and such individual if not providing gratuitous service would otherwise be eligible to receive a salary under this part at or above the amount described in § 158.614(a)(2). An individual providing uncompensated service serves at the will of the Secretary. An individual for appointment to a qualified position to provide uncompensated service need not be assessed under this part, and the documentation associated with that individual's qualified position need not include all the information listed in § 158.706(c).

(b) Continuing appointment. Appointment of an individual to a continuing appointment is for an indefinite time period.

(c) Advisory appointment. Appointment of an individual, including a former DHS-CS employee, to an advisory appointment is governed by subpart J of this part.

(d) Former DHS-CS employee. Appointment under this part of a former DHS-CS employee is governed by § 158.525.

(e) Restoration to duty from uniformed service or compensable injury. In accordance with 5 CFR part 353, the Department restores to duty a DHS-CS employee who is a covered person described in 5 CFR 353.103.

(f) Current and former political appointees. Appointment under this part of a current political appointee and a former political appointee, both as defined by OPM, may be subject to additional requirements outside of this part, including coordination with OPM.

§ 158.524 Initial service period.

(a) All individuals appointed under this part serve an initial service period that constitutes a probationary period of three years beginning on the date of appointment.

(b) Except as stated in paragraph (c) of this section, service in the DHS-CS counts toward completion of a current initial service period under paragraph (a) of this section. No other service in an appointment made outside the authority of this part may count toward completion of an initial service period under paragraph (a) of this section.

(c) Service as a DHS-CS advisory appointee, as a reemployed annuitant described in § 158.523(a)(1), or providing uncompensated service described in § 158.523(a)(2) does not count towards completion of an initial service period in a subsequent appointment to a qualified position.

(d) CTMS policy implementing this section addresses computation of each DHS-CS employee's initial service period, including accounting for working schedules other than full-time schedules described in § 158.705 and for periods of absence while in pay and nonpay statuses.

§ 158.525 Hiring of former DHS-CS employees.

(a) Rejoining the DHS-CS. To facilitate future service in the DHS-CS by former DHS-CS employees, the Department aims to:

(1) Maintain communication with former DHS-CS employees to understand their interest in future service in the DHS-CS;

(2) Provide opportunities for former DHS-CS employees to be considered for appointment again to qualified positions; and

(3) Acknowledge former DHS-CS employees' enhancements to qualifications while outside the DHS-CS.

(b) Rehiring. Except as provided in paragraphs (c) through (e) of this section, to be appointed again to a qualified position a former DHS-CS employee must:

(1) Participate again in the assessment program described in § 158.520 for the Department to determine the former DHS-CS employee's current CTMS qualifications; and

(2) Meet employment eligibility and accept and satisfy applicable employment-related criteria as described in § 158.521.

(c) Reassessment. A former DHS-CS employee whose most recent appointment to a qualified position was a renewable appointment or a continuing appointment must participate again in the assessment program described in § 158.520 unless the Department determines otherwise based on factors relevant to the former DHS-CS employee, such as:

(1) Time elapsed since the former DHS-CS employee's most recent appointment to a qualified position under this part;

(2) Similarity of cybersecurity work performed by the former DHS-CS employee since that individual's most recent appointment to a qualified position under this part; or

(3) Similarity of the former DHS-CS employee's CTMS qualifications during the former employee's most recent appointment under this part to the CTMS qualifications of a newly identified assignment under the deployment program in § 158.701.

(d) Former advisory and political appointees. Appointment under this part of a former DHS-CS employee who previously served in an advisory appointment or other political appointment may be subject to additional requirements, including coordination with the Office of Personnel Management.

(e) Prospective advisory appointees. Appointment of any former DHS-CS employee to an advisory appointment is governed by subpart J of this part.

§ 158.601 Compensation strategy.

To ensure the DHS-CS fulfills its purpose, as stated in § 158.202, the Secretary or designee aims to establish and administer a compensation system, described in § 158.602, that:

(a) Ensures the compensation for DHS-CS employees is sufficiently competitive to recruit and retain individuals possessing CTMS qualifications;

(b) Values, encourages, and recognizes, in alignment with the DHS-CS core values described in § 158.305:

(1) Exceptional CTMS qualifications and mission impact,

(2) Excellence and innovation in the performance of DHS-CS cybersecurity work, and

(3) Continual learning to adapt to evolving cybersecurity risks and cybersecurity threats; and

(c) Acknowledges the unpredictable nature of cybersecurity work and the expectation that DHS-CS employees occasionally work unusual hours and extended hours, as needed, to execute the DHS cybersecurity mission, especially in response to exigent circumstances and emergencies, including cybersecurity incidents; and

(d) Reflects an understanding of the cybersecurity talent market, including:

(1) Leading compensation practices and trends,

(2) Current cybersecurity work expectations and arrangements, and

(3) An understanding of the concepts of total compensation and total rewards.

§ 158.602 Compensation system.

(a) The Secretary or designee establishes and administers a compensation system based on:

(1) The compensation strategy in § 158.601;

(2) Information from strategic talent planning described in § 158.401(c);

(3) Generally recognized compensation principles and practices; and

(4) Strategic talent priorities.

(b) The compensation system comprises:

(1) The salary system described in § 158.610; and

(2) Additional compensation described in § 158.603.

§ 158.603 Employee compensation.

(a) Compensation. As compensation for service in the DHS-CS, a DHS-CS employee receives a salary as described in paragraph (b) of this section. A DHS-CS employee may also receive additional compensation as described in paragraph (c) of this section.

(b) Salary. Except as provided in paragraphs (b)(1) and (2) of this section, a DHS-CS employee receives a salary under the salary system described in § 158.610. The Department sets a DHS-CS employee's salary as described in § 158.620, and salary may include a local cybersecurity talent market supplement described in § 158.612. The Department adjusts a DHS-CS employee's salary as described in § 158.621.

(1) Uncompensated service. A DHS-CS employee providing uncompensated service described in § 158.523(a)(2) does not receive a salary under this part.

(2) Advisory appointees. A DHS-CS advisory appointee receives a salary as described under subpart J of this part.

(c) Additional compensation. In alignment with the compensation strategy in § 158.601 and subject to the requirements of this subpart F, the Department may provide the additional compensation described in paragraph (c)(1) of this section to DHS-CS employees, unless a DHS-CS employee is providing uncompensated service under § 158.523(a)(2).

(1) Types. Additional compensation under CTMS is:

(i) Recognition under §§ 158.632 through 158.634;

(ii) Other special payments under §§ 158.640 through 158.643; and

(iii) Other types of compensation, including leave and benefits, authorized under §§ 158.650 through 158.654 and provided in accordance with relevant provisions of other laws.

(2) Combining types. A DHS-CS employee, except such an employee providing uncompensated service and a DHS-CS advisory appointee, may receive any type of additional compensation described in paragraph (c)(1) of this section in combination with any other such type subject to the requirements of this subpart F, and subject to the limit described in paragraph (c)(3) of this section.

(3) Limit. Additional compensation described in paragraph (c)(1) of this section is subject to, and may be limited by, the aggregate compensation limit described in § 158.604.

(4) Advisory appointees. A DHS-CS advisory appointee may receive additional compensation as described in subpart J of this part.

(5) Department discretion. Any payment or nonpayment of additional compensation under this part, or the amount of any such compensation, is under the Department's discretion, and may be reviewable only as provided for under subpart I of this part.

§ 158.604 Aggregate compensation limit.

(a) Limiting aggregate compensation. A DHS-CS employee may not receive additional compensation listed in in paragraphs (b)(1)(i) through (iv) of this section if such receipt would cause a DHS-CS employee's aggregate compensation for a calendar year to exceed the aggregate compensation limit applicable to that employee. A DHS-CS employee's applicable aggregate compensation limit is the limit amount assigned to the subrange of a salary structure, described in § 158.611, that contains the employee's salary. The Department assigns an aggregate compensation limit to each subrange in a salary structure by assigning the amounts referenced in 5 U.S.C. 5307(d)(1) in ascending order to the subranges, such that each subrange has an aggregate compensation limit that is greater than or equal to the salary maximum of that subrange.

(b) Aggregate compensation. For purposes of this part—

(1) A DHS-CS employee's aggregate compensation means the total of the employee's salary, including any local cybersecurity talent market supplement, and the following types of additional compensation the employee receives under this part:

(i) Recognition payments;

(ii) Payments for special working conditions;

(iii) Payments for quarters allowances, overseas differentials and allowances, and remote worksite allowances, foreign currency allowances, and hostile fire pay; and

(iv) Other similar payments described in CTMS policy as being authorized under this part and provided in accordance with other relevant provisions of law.

(2) The following types of compensation a DHS-CS employee receives under this part are excluded from the employee's aggregate compensation:

(i) Payments or reimbursements for professional development and training;

(ii) CTMS student loan repayments;

(iii) CTMS allowances in nonforeign areas;

(iv) Back pay because of an unjustified or unwarranted talent management action;

(v) Severance pay;

(vi) Lump-sum payments for accumulated and accrued annual leave;

(vii) Voluntary separation incentive payments;

(viii) Payments for reservist differentials; and

(ix) Monetary value of any honorary recognition, leave, or other benefits.

(c) Forfeiture of compensation exceeding limit amount. Except under corrective action described in paragraph (d) of this section, a DHS-CS employee may not receive any portion of a payment for the additional compensation listed in paragraphs (b)(1)(i) through (iv) of this section that would cause the employee's aggregate compensation in any calendar year to exceed the applicable limit amount for that employee described in paragraph (a) of this section and the DHS-CS employee forfeits any such portion of a payment.

(d) Corrective actions. The Department may make a corrective action if the Department underestimated or overestimated a DHS-CS employee's aggregate compensation in a calendar year, including if an applicable aggregate compensation limit amount changed, resulting in the employee receiving aggregate compensation in excess of the applicable limit amount for a DHS-CS employee or the Department limiting or prohibiting an employee's aggregate compensation incorrectly. Corrective actions may include the Secretary or designee waiving a debt to the Federal Government for a DHS-CS employee under 5 U.S.C. 5584, if warranted, or making appropriate corrective payments to a DHS-CS employee.

§ 158.605 Exemption from other laws regarding compensation.

The provisions of the following laws, among other similar laws, do not apply under CTMS, to the DHS-CS, or to talent management involving the individuals described in § 158.103:

(a) The following provisions of 5 U.S.C.:

(1) Chapter 51 regarding classification,

(2) Chapter 53 regarding pay rates and systems (except section 5379 regarding student loan repayments),

(3) Chapter 55, Subchapter V regarding premium pay (except section 5550a regarding compensatory time off for religious observances),

(4) Chapter 61 regarding work schedules (except sections 6103-6104 regarding holidays),

(5) Section 4502 regarding cash awards and time-off awards,

(6) Section 4503 regarding agency awards (except regarding honorary recognition),

(7) Section 4505a regarding performance-based cash awards,

(8) Sections 4507 and 4507a regarding presidential rank awards,

(9) Section 5307 regarding limitation on certain payments,

(10) Section 5384 regarding performance awards for the Senior Executive Service,

(11) Section 5753 regarding recruitment and relocation bonuses,

(12) Section 5754 regarding retention bonuses,

(13) Section 5755 regarding supervisory differentials, and

(14) Section 5757 regarding extended assignment incentives;

(b) The provisions of 29 U.S.C. 206 and 207 regarding minimum wage payments and overtime pay under the Fair Labor Standards Act of 1938, as amended; and

(c) The following provisions of 5 CFR:

(1) Part 451 regarding awards (except regarding honorary recognition);

(2) Part 511 regarding classification under the General Schedule;

(3) Part 530 regarding pay rates and systems;

(4) Part 531 regarding pay under the General Schedule;

(5) Part 534 regarding pay under other systems;

(6) Part 536 regarding grade and pay retention;

(7) Part 550, subparts A regarding premium pay, I regarding pay for duty involving physical hardship or hazard, M regarding firefighter pay, N regarding compensatory time off for travel, and P regarding overtime pay for border patrol agents;

(8) Part 551 regarding pay administration under the Fair Labor Standards Act;

(9) Part 575 regarding recruitment, relocation, and retention incentives, supervisory differentials; and extended assignment incentives; and

(10) Part 610 regarding hours of duty (except subpart B regarding holidays).

§ 158.610 Salary system.

(a) Under the compensation system, described in § 158.602 of this part, the Department establishes and administers a salary system with the goals of maintaining:

(1) Sufficiently competitive salaries for DHS-CS employees as stated in § 158.601(a); and

(2) Equitable salaries among DHS-CS employees.

(b) The salary system comprises:

(1) At least one salary structure, described in § 158.611 of this part, bounded by the salary range described in § 158.613 and incorporating the salary limitations described in § 158.614;

(2) The process for providing a local cybersecurity talent market supplement described in § 158.612; and

(3) The salary administration framework described in §§ 158.620 through 158.622.

§ 158.611 Salary structure.

(a) Under the salary system, described in § 158.610, the Department establishes and administers one or more salary structures based on the strategy, information, principles and practices, and priorities listed in § 158.602(a).

(b) A salary structure:

(1) Is bounded by the salary range described in § 158.613;

(2) Incorporates, as described in paragraph (d) of this section, the salary limitations described in § 158.614; and

(3) May incorporate other salary and cost control strategies, such as control points.

(c) A salary structure includes subranges, within the salary range described in § 158.613 that are associated with work levels established by the work valuation system, described in § 158.404. Each such subrange is associated with at least one such work level.

(d) The Department incorporates the salary limitations described in § 158.614 into a salary structure by assigning each such salary limitation to at least one subrange of the salary structure. The Department assigns such salary limitations in ascending order to the subranges such that each subrange has a salary limitation that is greater than or equal to the salary maximum of that subrange.

(e) The Department may adjust a salary structure annually, or as the Secretary or designee determines necessary, based on the strategy, information, principles and practices, and priorities listed in § 158.602(a).

§ 158.612 Local cybersecurity talent market supplement (LCTMS).

(a) General. The Department may provide a DHS-CS employee a LCTMS to ensure the employee receives a sufficiently competitive salary, as described in § 158.610(a). A LCTMS accounts for the difference between a salary as determined under a salary structure, described in § 158.611, and the Department's determination as to what constitutes a sufficiently competitive salary for that local cybersecurity talent market. The Department determines whether a LCTMS is necessary, and establishes and periodically adjusts local cybersecurity talent markets and local cybersecurity talent market supplement percentages, based on the strategy, information, principles and practices, and priorities listed in § 158.602(a).

(b) Definitions. As used in this section:

(1) Local cybersecurity talent market means the cybersecurity talent market in a geographic area that the Department defines based on the talent market analysis described in § 158.403, and that may incorporate any pay locality established or modified under 5 U.S.C. 5304.

(2) Local cybersecurity talent market supplement percentage means a percentage the Department assigns to a local cybersecurity talent market to increase the amount of a salary provided under a salary structure.

(c) Salary supplement. A LCTMS is considered part of salary under this part and for purposes of applying the aggregate compensation limit described in § 158.604. A LCTMS is also basic pay for purposes under 5 U.S.C. and 5 CFR, except for purposes of determining pay under 5 U.S.C. 7511 and 7512 and 5 CFR part 752.

(d) Eligibility and termination. (1) The Department determines eligibility for a LCTMS under this section and CTMS policy implementing this section. A DHS-CS employee is eligible for a LCTMS if the employee's official worksite, as determined under § 158.704, is located in a local cybersecurity talent market with an assigned local cybersecurity talent market supplement percentage for the salary structure under which the employee's salary is provided.

(2) The Department terminates a LCTMS a DHS-CS employee receives when the employee's official worksite, as determined under § 158.704, is no longer in a local cybersecurity talent market with an assigned local cybersecurity talent market supplement percentage, or the salary structure under which the employee's salary is provided no longer has an assigned local cybersecurity labor market supplement, or both.

(3) A reduction in salary for a DHS-CS employee because of a change in any LCTMS for that employee is not a reduction in pay for the purposes of 5 U.S.C. 7512 and 5 CFR part 752.

(e) Limitation. A DHS-CS employee may not receive, and is not entitled to, any portion of a LCTMS that would cause the employee's salary to exceed the applicable salary limitation assigned to the subrange of a salary structure as described in § 158.611 that contains the employee's salary, but the employee may receive the portion of such a LCTMS that would not cause the employee's salary to exceed the applicable salary limitation. A DHS-CS employee may receive a LCTMS that would cause the employee's salary to be in the extended range, described in § 158.613(c), only if the Secretary or designee invokes the extended range under § 158.613(c)(2) for that employee.

§ 158.613 Salary range.

(a) Range. The salary range provides the boundaries of the salary system described in § 158.610. The salary range comprises a standard range and an extended range, and the standard range applies unless the Secretary or designee invokes the extended range under paragraph (c) of this section.

(b) Standard range. The upper limit of the standard range is equal to the amount of total annual compensation payable to the Vice President under 3 U.S.C. 104.

(c) Extended range. The upper limit of the extended range is 150 percent of the annual rate of basic pay for level I of the Executive Schedule (150% of EX-I). Only DHS-CS employees serving in renewable appointments may receive a salary amount in the extended range, and only if the Secretary or designee invokes the extended range for those employees as described in this paragraph (c).

(1) The Secretary or designee may invoke the extended range for a DHS-CS employee when the Secretary or designee determines, based on the compensation strategy in § 158.601, that the employee's qualifications, the employee's mission impact, and mission-related requirements warrant adjusting the employee's salary beyond the standard range. The Secretary or designee must approve the salary adjustment of each such employee by name, and to receive a salary in the extended range the employee must either already be in a renewable appointment or accept a renewable appointment. While the employee is receiving a salary in an amount in the extended range, the Department may not change that employee's appointment to a continuing appointment.

(2) The Secretary or designee may invoke the extended range for an individual selected for appointment to a qualified position when the Secretary or designee determines, based on the compensation strategy in § 158.601, that the individual's qualifications, the individual's anticipated mission impact, and mission-related requirements warrant setting the individual's salary beyond the standard range. The Secretary or designee must approve the appointment of each such individual to a qualified position by name, and the individual must be appointed to a renewable appointment only. While that individual is receiving a salary under this part in an amount in the extended range, the Department may not change that individual's appointment to a continuing appointment at any time.

(d) Maximum. No DHS-CS employee may receive a salary under this part in excess of 150% of EX-I.

§ 158.614 Salary limitations.

(a) The salary system, described in § 158.610, has the following limitations on maximum rates of salary that apply within the CTMS salary range described in § 158.613 of this part:

(1) The annual rate of basic pay for GS-15, step 10 under the General Schedule (excluding locality pay or any other additional pay as defined in 5 CFR chapter 1);

(2) The annual rate of basic pay for level IV of the Executive Schedule;

(3) The annual rate of basic pay for level II of the Executive Schedule;

(4) The annual rate of basic pay for level I of the Executive Schedule; and

(5) The total annual compensation payable to the Vice President under 3 U.S.C. 104.

(b) The Department may establish additional limitations on maximum rates of salary for the salary system.

(c) The salary system incorporates each limitation on maximum rates of salary described in this section into each salary structure established under § 158.611.

§ 158.620 Setting salaries.

(a) The Department sets the salary for an individual accepting an appointment to a qualified position as part of selection and appointment of the individual, described in § 158.522. The Department sets the individual's salary within a subrange of a salary structure described in § 158.611 based on consideration of:

(1) The individual's CTMS qualifications, determined under the assessment program described in § 158.520;

(2) Applicable work and career structures, including the individual's initial work level, determined as part of selection and appointment under § 158.522;

(3) The individual's anticipated mission impact;

(4) Mission-related requirements; and

(5) Strategic talent priorities.

(b) In setting the salary for an individual appointed to a qualified position under this part, the Department may set the individual's salary without regard to any prior salary of the individual, including any salary or basic pay while serving in a previous appointment under this part or in another previous Federal appointment made outside the authority of this part.

(c) In setting the salary for an individual appointed to a qualified position under this part, the Department may provide a local cybersecurity talent market supplement described in § 158.612.

§ 158.621 Adjusting salaries.

(a) The Department adjusts a DHS-CS employee's salary, or the salaries of a group of DHS-CS employees, by paying a recognition adjustment under § 158.631, or paying a local cybersecurity talent market supplement under § 158.612, or both.

(b) The Department does not provide DHS-CS employees with any automatic salary increase or any salary increase based on length of service in the DHS-CS or in any position outside the DHS-CS.

(c) If the Department adjusts a salary structure under § 158.611(e) that results in an increase to the salary minimum for one or more subranges of the salary structure, for any DHS-CS employee receiving a salary in an affected subrange at the affected salary minimum, DHS adjusts the employee's salary to reflect the adjustment to the salary structure and the new salary minimum for the affected subrange. Such a salary adjustment is not considered a recognition adjustment under § 158.631.

§ 158.622 Administering salary in accordance with relevant provisions of other laws.

(a) Except as stated in paragraph (b) of this section, the Department administers salary under this part in accordance with the provisions of 5 CFR part 550 regarding pay administration generally.

(b) The following provisions of 5 CFR part 550 do not apply to administering salary under this part and do not apply under CTMS, to the DHS-CS, or to talent management involving the individuals described in § 158.103 of this part:

(1) Subpart A regarding premium pay;

(2) Subpart I regarding pay for duty involving physical hardship or hazard;

(3) Subpart M regarding firefighter pay;

(4) Subpart N compensatory time-off for travel; and

(5) Subpart P regarding overtime for board patrol agents.

(c) The Department also administers salary under this part in accordance with the provisions of the following:

(1) 5 U.S.C. 5520, 42 U.S.C. 659 and 5 CFR parts 581 and 582, regarding garnishment;

(2) 31 U.S.C. 3702 and 5 CFR part 178 regarding claims settlement;

(3) 31 U.S.C. 3711 and 3716 and 31 CFR chapter IX parts 900 through 904 regarding debt collection;

(4) 5 U.S.C. Chapter 55 Subchapter VII regarding payments to missing employees; and

(5) Other relevant provisions of other laws specifically adopted in CTMS policy.

(d) For purposes of salary administration under this section, the Department administers salary based on consideration of a DHS-CS employee's work schedule under the work scheduling system, described in § 158.705, and may convert the employee's salary into an hourly rate, biweekly rate, or other rate.

§ 158.630 Employee recognition.

(a) DHS-CS employees. In alignment with the compensation strategy in § 158.601 and the performance management program described in § 158.802 of this part, the Department may provide recognition under §§ 158.631 through 158.634, on a periodic or ad hoc basis, to a DHS-CS employee based on the employee's mission impact. In providing such recognition, the Department may also consider mission-related requirements and strategic talent priorities.

(b) Prospective employees. In alignment with the compensation strategy in § 158.601, the Department may offer, and provide upon appointment, recognition payments under § 158.632(b) and recognition time-off under § 158.633(b), on a periodic or ad hoc basis, to an individual selected for employment in the DHS-CS based on:

(1) The individual's CTMS qualifications determined under the assessment program described in § 158.520;

(2) The individual's anticipated mission impact;

(3) Mission-related requirements; and

(4) Strategic talent priorities.

(c) Eligibility. The Department determines eligibility for recognition under this section, §§ 158.631 through 158.634, and CTMS policy implementing this section. The Department may defer providing recognition to a DHS-CS employee under this part if the Department is in the process of determining whether the employee's performance is unacceptable, as defined in 5 U.S.C. 4301(3), or whether the employee has engaged in misconduct. If the Department determines a DHS-CS employee's performance is unacceptable, as defined in 5 U.S.C. 4301(3), or the employee receives an unacceptable rating of record under § 158.804, or the Department determines the employee has engaged in misconduct, the employee is ineligible to receive recognition under this part.

(d) Policy. CTMS policy implementing this section addresses:

(1) Eligibility criteria;

(2) Requirements for documenting the reason and basis for recognition provided to a DHS-CS employee;

(3) Appropriate levels of review and approval for providing recognition;

(4) Any limitations on the total number, frequency, or amount of recognition a DHS-CS employee may receive within any specific time period;

(5) Any service agreement requirements; and

(6) Processes for evaluating the effectiveness of recognition in supporting the purpose of CTMS described in § 158.101, the purpose of the DHS-CS described in § 158.202, and the operationalization of the compensation strategy described in § 158.601.

(e) Advisory appointees. Recognition under this part for a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.631 Recognition adjustments.

(a) Under this section and § 158.630, the Department may provide a recognition adjustment to a DHS-CS employee for the reasons and bases stated in § 158.630(a). A recognition adjustment is an adjustment to the DHS-CS employee's salary provided under a salary structure described in § 158.611. A recognition adjustment does not alter any local cybersecurity talent market supplement for that employee.

(b) No DHS-CS employee may receive a recognition adjustment that would cause the employee's salary to exceed the salary range maximum described in § 158.613(d) or the applicable salary limitation assigned to the subrange of a salary structure as described in § 158.611(d) that contains the employee's salary. A DHS-CS employee may not receive a recognition adjustment that would cause the employee's salary amount to be in the extended range, described in § 158.613(c), unless the Secretary or designee invokes the extended range for that employee under § 158.613(c)(1).

(c) A recognition adjustment under this section is not a promotion for any purpose under Title 5 U.S.C. or 5 CFR.

(d) A recognition adjustment under this section for a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.632 Recognition payments.

(a) Under this section and § 158.630, and for the reasons and bases stated in § 158.630(a), the Department may provide a recognition payment to a DHS-CS employee in an amount of up to 20 percent, or up to 50 percent with approval of the Secretary or designee, of the receiving DHS-CS employee's salary. The Department may require a service agreement of not less than six months and not more than three years as part of providing a recognition payment to a DHS-CS employee.

(b) Under this section and § 158.630, and for the reasons and bases stated in § 158.630(b) and as part of an offer of employment in the DHS-CS, the Department may offer a recognition payment to an individual selected for employment in the DHS-CS in an amount of up to 20 percent of the receiving individual's initial salary in the DHS-CS. The Department requires a service agreement of not less than six months and not more than three years as part of providing, upon appointment, a recognition payment to an individual selected for employment in the DHS-CS.

(c) The Department may provide a recognition payment as a lump sum payment, an installment payment, or a recurring payment.

(d) The Department may provide a recognition payment under this section to a former DHS-CS employee or to the legal heirs or estate of a former DHS-CS employee in accordance with 5 U.S.C. 4505.

(e) Acceptance of a recognition payment constitutes agreement for Federal Government use of any idea, method, device, or similar that is the basis of the payment.

(f) A recognition payment under this section is subject to and may be limited by the aggregate compensation limit described in § 158.604.

(g) A recognition payment is not salary under this part and is not basic pay for any purpose under 5 U.S.C. or 5 CFR.

(h) A recognition payment under this section is based on the following types of awards and incentives provided under 5 U.S.C.:

(1) Cash awards under 5 U.S.C. 4502;

(2) Agency awards under 5 U.S.C. 4503;

(3) Performance-based cash awards under 5 U.S.C. 4505a and 5384;

(4) Presidential rank awards under 5 U.S.C. 4507 and 4507a; and

(5) Recruitment, relocation, and retention incentives 5 U.S.C. 5753 and 5754.

(i) A recognition payment under this section is in lieu of the types of awards and incentives provided under 5 U.S.C. listed in paragraph (h) of this section, and a DHS-CS employee is ineligible to receive any such awards or incentives.

(j) An individual selected for employment in the DHS-CS is ineligible to receive, as part of the offer of employment, any other offer of a monetary award or incentive, a payment in addition to salary, or other monetary recognition from the Department except as provided in this section and § 158.630. An individual appointed to an advisory appointment is also ineligible to receive, as part of an offer of employment in the DHS-CS, any offer of recognition under this section.

(k) A recognition payment under this section for a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.633 Recognition time-off.

(a) Under this section and § 158.630, and for the reasons and bases stated in § 158.630(a), the Department may provide recognition time-off to a DHS-CS employee for use within a designated timeframe not to exceed 26 work periods, as defined in § 158.705(c). Recognition time-off is time-off from duty without charge to leave or loss of compensation.

(b) Under this section and § 158.630, and for the reasons and bases stated in § 158.630(b) and as part of an offer of employment in the DHS-CS, the Department may offer up to 40 hours of recognition time-off to an individual selected for employment in the DHS-CS for use within a designated timeframe not to exceed 26 work periods, as defined in § 158.705(b). The Department may require a service agreement as part of providing, upon appointment, recognition time-off to an individual selected for employment in the DHS-CS.

(c) All recognition time-off provided, and the use of such time-off, must be recorded in a timekeeping system for purposes of salary administration and leave administration under this part.

(d) Recognition time-off provided under this section may not, under any circumstances, be converted to a cash payment to the receiving DHS-CS employee or any other type of time-off or leave.

(e) Recognition time-off under this section is based on time-off awards provided under the provisions of 5 U.S.C. 4502(e).

(f) Recognition time-off under this section is in lieu of the time-off awards provided under 5 U.S.C. 4502(e), and a DHS-CS employee is ineligible to receive any such awards.

(g) An individual selected for employment in the DHS-CS is ineligible to receive, as part of the offer of employment, any other offer of time-off or time-off award from the Department except as provided in this section and §§ 158.630 and 158.651. An individual appointed to an advisory appointment is also ineligible to receive, as part of an offer of employment in the DHS-CS, any offer of recognition under this section.

(h) A recognition time-off provided under this section to a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.634 Honorary recognition.

(a) Under this section and § 158.630, the Department may establish one or more honorary recognition programs to provide honorary recognition to DHS-CS employees for the reasons and bases stated in § 158.630(a). The Department may incur necessary expenses for honorary recognition under an honorary recognition program established under this section.

(b) Honorary recognition under this section is based on honorary recognition provided under the provisions of 5 U.S.C. 4503, and a DHS-CS employee may be eligible to receive honorary recognition under 5 U.S.C. 4503 and 5 CFR part 451 in addition to any honorary recognition under this section.

(c) The Department may provide honorary recognition under this section to a former DHS-CS employee or to the legal heirs or estate of a former DHS-CS employee in accordance with 5 U.S.C. 4505.

(d) Honorary recognition under this section for a DHS-CS advisory appointee is subject to additional requirements in subpart J of this part.

§ 158.640 Professional development and training.

(a) In alignment with the compensation strategy described in § 158.601 and the career development program described in § 158.803, the Department may provide professional development and training opportunities, payments, and reimbursements for DHS-CS employees.

(b) CTMS policy implementing this section addresses:

(1) Eligibility criteria;

(2) Requirements for documenting the reason and basis for professional development and training opportunities, payments, and reimbursements provided to a DHS-CS employee;

(3) Appropriate levels of review and approval for providing professional development and training opportunities, payments, and reimbursements;

(4) Any limitations on the total number or frequency of professional development and training opportunities, and any limitations on the total number, frequency, or amount of professional development and training payments and reimbursements a DHS-CS employee may receive, within any specific time period;

(5) Any service agreement requirements;

(6) Requirements for communicating to DHS-CS employees and their supervisors about professional development and training opportunities; and

(7) Processes for evaluating the effectiveness of the professional development and training in supporting the purpose of CTMS described in § 158.101, the purpose of the DHS-CS described in § 158.202, and the operationalization of the compensation strategy described in § 158.601.

(c) Any payment or reimbursement under this section is excluded from the aggregate compensation limit described in § 158.604.

(d) Any payment or reimbursement under this section is not salary under this part and is not basic pay for any purpose under 5 U.S.C. or 5 CFR.

(e) Professional development and training under this section is based on the following training and professional development opportunities, payments, and reimbursements provided under 5 U.S.C.:

(1) Sabbaticals under 5 U.S.C. 3396;

(2) Academic degree training under 5 U.S.C. 4107;

(3) Expenses of training under 5 U.S.C. 4109;

(4) Expenses of attendance at meetings under 5 U.S.C. 4110; and

(5) Payment of expenses to obtain professional credentials under 5 U.S.C. 5757.

(f) In addition to any professional development and training under this section, a DHS-CS employee may be eligible to receive the training and professional development opportunities, payments, and reimbursements provided under 5 U.S.C. listed in paragraph (e) of this section.

(g) Professional development and training under this section for a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.641 Student loan repayments.

(a) In alignment with the compensation strategy described in § 158.601, the Department may provide a student loan repayment to a DHS-CS employee under this section and in accordance with 5 U.S.C. 5379 and 5 CFR part 537, except that:

(1) The maximum payment amounts under 5 U.S.C. 5379 and 5 CFR part 537 do not apply, and the Department may provide and a DHS-CS employee may receive a student loan repayment under this section so long as such repayment does not exceed $16,500 per employee per calendar year and a total of $90,000 per employee;

(2) The minimum service period length of three years under 5 U.S.C. 5379 and 5 CFR part 537 does not apply, and instead the length of a minimum service period for a DHS-CS employee receiving a student loan repayment under this section is determined under CTMS policy and based on the amount of the repayment received by the employee; and

(3) Eligibility criteria related to time-limited appointments under 5 U.S.C. 5379 and 5 CFR part 537 do not apply, and a DHS-CS employee in a renewable appointment may receive a student loan payment under this section.

(b) In alignment with eligibility criteria under 5 U.S.C. 5379 and 5 CFR part 537:

(1) If the Department determines a DHS-CS employee's performance is unacceptable, as defined in 5 U.S.C. 4301(3), or the employee receives an unacceptable rating of record under § 158.804, or the Department determines the employee has engaged in misconduct, the employee is ineligible to receive a student loan repayment under this section.

(2) A DHS-CS advisory appointee is ineligible to receive a student loan repayment under this section.

(c) CTMS policy implementing this section addresses:

(1) Eligibility criteria;

(2) Requirements for documenting the reason and basis for a student loan repayment provided to a DHS-CS employee;

(3) Appropriate levels of review and approval for providing a student loan repayment;

(4) Service agreement requirements, including minimum service periods;

(5) Any additional limitations on student loan repayments; and

(6) Processes for evaluating the effectiveness of student loan repayments in supporting the purpose of CTMS described in § 158.101, the purpose of the DHS-CS described in § 158.202, and the operationalization of the compensation strategy described in § 158.601.

(d) Any student loan repayment provided under this section is excluded from the aggregate compensation limit described in § 158.604.

(e) Any student loan repayment provided under this section is not salary under this part and is not basic pay for any purpose under 5 U.S.C. or 5 CFR.

§ 158.642 Special working conditions payment program.

(a) In alignment with the compensation strategy described in § 158.601, the Department may establish a program to provide payments to DHS-CS employees to address special working conditions that are otherwise unaccounted for or the Department determines are accounted for insufficiently in DHS-CS employees' other types of additional compensation and salary.

(b) Special working conditions include circumstances in which a supervisor or other appropriate official requires a DHS-CS employee to perform DHS-CS cybersecurity work that involves, as determined by the Department:

(1) Unusual physical or mental hardship;

(2) Performing work at atypical locations, at unexpected times, or for an uncommon duration of time exceeding the expectation described in § 158.601(c) about working unusual hours and extended hours; or

(3) A combination of the conditions described in paragraphs (b)(1) and (2) of this section.

(c) A payment for special working conditions is a payment of up to 25 percent of the receiving DHS-CS employee's salary as computed for a work period, defined in § 158.705(b), or a series of work periods.

(d) The Department determines whether to establish, adjust, or cancel a program under this section based on information from:

(1) The work scheduling system described in § 158.705; and

(2) Strategic talent planning described in § 158.401(c), including information about current compensation practices of other cybersecurity employers analyzed under the talent market analysis described in § 158.403.

(e) The Department determines eligibility for a payment for special working conditions under this section and CTMS policy implementing this section.

(1) A DHS-CS employee who receives a payment for special working conditions under a program established under this section is not automatically eligible or entitled to receive any additional such payments.

(2) A DHS-CS employee receiving a salary equal to or greater than EX-IV is ineligible to receive a payment under this section.

(3) A DHS-CS advisory appointee is ineligible to receive a payment for special working conditions under this section.

(f) CTMS policy implementing this section addresses:

(1) Eligibility criteria;

(2) Requirements for documenting the reason and basis for payments for special working conditions provided to a DHS-CS employee;

(3) Appropriate levels of review and approval for providing payments for special working conditions;

(4) Any limitations on payments for special working conditions;

(5) Requirements for determining whether a payment for special working conditions is a lump sum payment, paid in installments, or a recurring payment; and

(6) Processes for evaluating the effectiveness of any special working conditions payment program in supporting the purpose of CTMS described in § 158.101, the purpose of the DHS-CS described in § 158.202, and the operationalization of the compensation strategy described in § 158.601.

(g) Any payment under this section is subject to and may be limited by the aggregate compensation limit described in § 158.604.

(h) Any payment under this section is not salary under this part and is not basic pay for any purpose under Title 5 U.S.C. or 5 CFR.

(i) A payment for special working conditions under this section is based on the following types of payments provided under 5 U.S.C.:

(1) Night, standby and hazardous duty differential under 5 U.S.C. 5545;

(2) Pay for Sunday and holiday work under 5 U.S.C. 5546; and

(3) Extended assignment incentives under 5 U.S.C. 5757.

(j) A payment for special working conditions under this section is in lieu of the types of payment provided under 5 U.S.C. listed in paragraph (g) of this section, and a DHS-CS employee is ineligible to receive any such payments under 5 U.S.C.

§ 158.643 Allowance in nonforeign areas.

(a) A DHS-CS employee is eligible for and may receive an allowance under 5 U.S.C. 5941 and implementing regulations in 5 CFR part 591, subpart B, on the same basis and to the same extent as if the employee is an employee covered by those authorities.

(b) The Department provides an allowance described in paragraph (a) of this section to any DHS-CS employee who is eligible, as described in paragraph (a), for such allowance.

(c) Any allowance provided under this section is excluded from the aggregate compensation limit described in § 158.604.

(d) Any allowance provided under this section is not salary under this part and is not basic pay for any purpose under 5 U.S.C. or 5 CFR.

(e) Any allowance under this section for a DHS-CS advisory appointee is subject to additional requirements and restrictions in subpart J of this part.

§ 158.650 Holidays.

In alignment with salary administration under § 158.622 and work scheduling under § 158.705, the Department provides holidays to a DHS-CS employee under this section and in accordance with 5 U.S.C. 6103-6104 and 5 CFR part 610, subpart B.

§ 158.651 Leave.

(a) Leave. In alignment with salary administration under § 158.622 and work scheduling under § 158.705, the Department provides leave to a DHS-CS employee under this section and in accordance with 5 U.S.C. Chapter 63 and 5 CFR part 630, including:

(1) Annual leave, as described in 5 U.S.C. Chapter 63, Subchapter I;

(2) Sick leave, as described in 5 U.S.C. Chapter 63, Subchapter I;

(3) Other paid leave, as described in 5 U.S.C. Chapter 63, Subchapter II;

(4) Voluntary transfers of leave, as described in 5 U.S.C. Chapter 63, Subchapter III;

(5) Voluntary leave bank programs, as described in 5 U.S.C. Chapter 63, Subchapter IV;

(6) Family and medical leave, as described in 5 U.S.C. Chapter 63, Subchapter V; and

(7) Leave transfer in disasters and emergencies, as described in 5 U.S.C. Chapter 63, Subchapter VI.

(b) Annual leave accrual. A DHS-CS employee's annual leave accrual amount is determined under 5 U.S.C. 6303.

(c) Annual leave accumulation. A DHS-CS employee's annual leave accumulation amount is determined under 5 U.S.C. 6304, except that the Department may apply 5 U.S.C. 6304(f)(2)(A) to DHS-CS employees receiving a salary under this part that exceeds 120 percent of the minimum annual rate of basic pay for GS-15 under the General Schedule.

(d) Leave credits. The annual leave and sick leave accrued to the credit of a current Federal employee who is appointed to a qualified position under this part without a break in service of more than three calendar days is transferred to the employee's credit in accordance with 5 U.S.C. 6308.

(e) Annual leave balance upon leaving the DHS-CS. When a DHS-CS employee moves to a position outside of the DHS-CS, any leave balance for the employee is addressed in accordance with 5 CFR 630.209 and 630.501.

(f) Leave administration. The Department administers leave under this section as described in this section and in § 158.655, and in accordance with the relevant provisions of other laws referenced in this section and CTMS policy.

§ 158.652 Compensatory time-off for religious observance.

In alignment with salary administration under § 158.622 of this part and work scheduling under § 158.705, the Department provides compensatory time-off for religious observance to a DHS-CS employee under this section and in accordance with 5 U.S.C. 5550a and 5 CFR 550, subpart J.

§ 158.653 Other benefits.

(a) In alignment with salary administration under § 158.622, leave administration under § 158.651, and work scheduling under § 158.705, the Department provides benefits, including retirement, health benefits, and insurance programs, to a DHS-CS employee under this section and in accordance with 5 U.S.C. Chapters 81-90 and 5 CFR parts 831 and 838-894.

(b) The Department administers the benefits of an annuitant appointed to a qualified position in accordance with 5 U.S.C. 8344, 5 U.S.C. 8468, 5 CFR 553.203, or 5 CFR part 837, as applicable.

(c) The Department provides a transportation subsidy to a DHS-CS employee under this section and in accordance with 5 U.S.C. 7905.

§ 158.654 Other payments.

(a) The Department provides the following other types of payments to a DHS-CS employee under this section and in accordance with the relevant provisions of law referenced in this section:

(1) Severance pay under this section, and the Department provides any severance pay in accordance with 5 U.S.C. 5595 and 5 CFR part 550, subpart G, except that separation from the DHS-CS because of a lapse or nonrenewal of a DHS-CS employee's appointment under this part or because of a DHS-CS employee's refusal to accepted a directed subsequent assignment, described in § 158.708, is not an involuntary separation, and the former DHS-CS employee is not entitled to severance pay.

(2) Lump-sum leave payouts under this section, and the Department provides any lump-sum leave payouts in accordance with 5 U.S.C. 5551 and 5552 and 5 CFR part 550, subpart L.

(3) Voluntary separation incentive payments under this section, and the Department provides any such payments in accordance with 5 U.S.C. 3521-3525 and 5 CFR part 576.

(4) Reservist differential under this section, and the Department provides any such differential in accordance with 5 U.S.C. 5538.

(5) Quarters allowances under this section, and the Department provides any such allowances in accordance with 5 U.S.C. Chapter 59, Subchapter II, the Department of State Standardized Regulations and any implementing supplements issued by the Department of State, and 5 CFR part 591, subpart C.

(6) Overseas differentials and allowances under this section, and the Department provides any such differentials and allowances in accordance with 5 U.S.C. Chapter 59, Subchapter III, the Department of State Standardized Regulations and any implementing supplements issued by the Department of State, and 5 CFR part 591, subpart C.

(7) Remote worksite allowances, foreign currency allowances, and hostile fire pay under this section, and the Department provides any such allowances and pay in accordance with 5 U.S.C. Chapter 59, Subchapter IV.

(8) Other similar payments described in CTMS policy as being authorized under this part and provided in accordance with relevant provisions of other laws.

(b) A payment for any quarter allowances, overseas differentials and allowances, and remote worksite allowances, foreign currency allowances, and hostile fire pay under paragraphs (a)(5) through (7) of this section is subject to and may be limited by the aggregate compensation limit described in § 158.604. A payment for any severance pay, lump-sum leave payout, voluntary separation inventive payment, and reservist differential under paragraphs (a)(1) through (4) of this section is not subject to the aggregate compensation limit described in § 158.604. A payment under paragraph (a)(8) of this section may be subject to and limited by the aggregate compensation limit described in § 158.604, as described in CTMS policy.

(c) Any payment under this section is not salary under this part and is not basic pay for any purpose under Title 5 U.S.C. or 5 CFR.

§ 158.655 Administering compensation in accordance with relevant provisions of other laws.

(a) For purposes of administering compensation authorized under §§ 158.650 through 158.654 in accordance with relevant provisions of other laws:

(1) The Department may convert a DHS-CS employee's salary into an hourly rate, biweekly rate, or other rate, and administer compensation based on consideration of the DHS-CS employee's work schedule under the work scheduling system described in § 158.705;

(2) A DHS-CS employee's hours of work and related computations are determined under the relevant provisions of law referenced in §§ 158.650 through 158.654 and CTMS policy implementing this section;

(3) A DHS-CS employee on a part-time schedule described in § 158.705 is treated as if the employee is serving “part-time career employment” defined in 5 CFR 340.101; and

(4) A DHS-CS employee on a contingent schedule described in § 158.705 is treated as if the employee is serving “intermittent employment” defined in 5 CFR 340.401.

(b) If, in administering compensation under §§ 158.650 through 158.654, the Department determines it is necessary to clarify the relationship between those sections and the relevant provisions of law referenced in those sections and any other relevant provisions of other laws, the Department will address the issue in new or revised CTMS policy.

§ 158.701 Deployment program.

(a) Deployment program. The Secretary or designee establishes and administers a deployment program to:

(1) Guide when the Department uses CTMS to recruit and retain individuals possessing CTMS qualifications; and

(2) Operationalize aspects of the work valuation system, the talent acquisition system and the compensation system, described in §§ 158.404, 158.501, and 158.602 respectively.

(b) Under the deployment program, the Department:

(1) Designates qualified positions as described in § 158.702;

(2) Designates and staffs assignments as described in § 158.703;

(3) Determines and documents a DHS-CS employee's official worksite as described in § 158.704;

(4) Administers a work scheduling system as described in § 158.705; and

(5) Performs necessary recordkeeping as described in § 158.706.

§ 158.702 Designating qualified positions.

(a) When a DHS organization requires individuals possessing CTMS qualifications to ensure the most effective execution of the DHS cybersecurity mission and the recruitment and retention of such individuals would likely be enhanced by using CTMS, the Secretary or designee designates qualified positions.

(b) CTMS policy implementing this section addresses:

(1) Procedures for DHS organizations to request using CTMS;

(2) Requirements for DHS organization using CTMS; and

(3) Information necessary to designate qualified positions.

(c) Designating qualified positions may result in:

(1) Establishing one or more qualified positions under the talent acquisition system, described in § 158.501; or

(2) Designating and staffing one or more assignments as described in § 158.703; or

(3) Both results described in paragraphs (c)(1) and (2) of this section.

(d) Designating qualified positions involves budget and fiscal considerations related to establishing one or more qualified positions under the talent acquisition system, described in § 158.501.

§ 158.703 Designating and staffing assignments.

(a) Designating assignments. The Department designates assignments by defining combinations of CTMS qualifications and DHS-CS cybersecurity work associable with qualified positions. CTMS policy implementing this section addresses procedures for DHS organizations to designate assignments, including as a result of designating qualified positions as described in § 158.702.

(b) Staffing assignments. The Department staffs assignments by:

(1) Matching assignments with DHS-CS employees as described in paragraph (d) of this section;

(2) Matching assignments with newly appointed individuals as described in paragraph (c) of this section; or

(3) Seeking to recruit individuals and establish new qualified positions under the talent acquisition system described in § 158.501 and then matching assignments with newly appointed individuals as described in paragraph (c) of this section.

(c) Initial assignment. Upon appointment of an individual to a qualified position, the Department matches the individual with an assignment based on the alignment of the individual's CTMS qualifications, determined under the assessment program described in § 158.520, to the CTMS qualifications of an assignment. In matching an individual with an initial assignment, the Department may also consider:

(1) Input from the individual;

(2) Input from DHS organizations;

(3) Mission-related requirements; and

(4) Strategic talent priorities.

(d) Subsequent assignments. The Department matches DHS-CS employees with assignments subsequent to employees' initial assignments, as necessary.

(1) The Department matches a DHS-CS employee with a subsequent assignment based on the alignment of the employee's CTMS qualifications with the CTMS qualifications of an assignment. In matching a DHS-CS employee with a subsequent assignment, the Department may also consider:

(i) Input from the employee;

(ii) Input from DHS organizations, especially the primary DHS organization of the employee's current assignment;

(iii) Information about the employee from the performance management program described in § 158.802 and the career development program described in § 158.803;

(iv) Mission-related requirements; and

(v) Strategic talent priorities.

(2) A DHS-CS employee may have multiple assignments throughout the employee's service in a qualified position, but may only have one assignment at a time. A DHS-CS employee's subsequent assignments may have assignment information, described in § 158.706(e), that is different than the assignment information of the employee's initial assignment, including primary DHS organization.

(3) In alignment with the career development program described in § 158.803 and based on information from development reviews described in § 158.806 the Department communicates with DHS-CS employees on an ongoing basis about subsequent assignment opportunities;

§ 158.704 Official worksite.

(a) Definition. A DHS-CS employee's official worksite is the geographic location where the employee regularly performs DHS-CS cybersecurity work or where the employee's DHS-CS cybersecurity work is based, as determined and documented by the Department under this section.

(b) Determination. The Department determines a DHS-CS employee's official work site for purposes of administering compensation under this part, especially eligibility for any compensation described in §§ 158.612 and 158.643. The Department's determination of a DHS-CS employee's official worksite includes consideration of any of the following for the employee: Telework, variation in location where the employee performs DHS-CS cybersecurity work, and temporary situations affecting the location where the employee performs DHS-CS cybersecurity work.

(c) Documentation. Upon appointment of an individual to a qualified position, the Department documents the individual's official worksite as part of documenting the employee's appointment to a qualified position and the employee's assignment, as described in § 158.706. The Department updates documentation of a DHS-CS employee's official worksite, if the geographic location where the DHS-CS employee regularly performs DHS-CS cybersecurity work changes and such change impacts the determination of the DHS-CS employee's official worksite under paragraph (a) of this section and such change is expected to last, or does last, for six months or more.

§ 158.705 Work scheduling.

(a) Work scheduling system. The Secretary or designee establishes and administers a work scheduling system for DHS-CS employees to ensure:

(1) Agility for the Department in scheduling DHS-CS cybersecurity work to execute the DHS cybersecurity mission;

(2) Availability of DHS-CS employees to perform the DHS-CS cybersecurity work of their assignments;

(3) Clear expectations for DHS-CS employees about when they are expected to perform DHS-CS cybersecurity work associated with their assignments;

(4) Flexibility for DHS-CS employees in scheduling and performing DHS-CS cybersecurity work associated with their assignments; and

(5) Recording of, accounting for, and monitoring of hours worked by DHS-CS employees.

(b) Definitions. For purposes of this section—

(1) Work period means a two-week period of 14 consecutive days that begins on a Sunday and ends on a Saturday, and is the equivalent of a biweekly pay period defined in 5 U.S.C. 5504 and 5 CFR part 550, subpart F.

(2) Minimum hours of work means the minimum number of hours that a DHS-CS employee is required to work, or account for with time-off, during a work period, and is the equivalent to the term basic work requirement defined in 5 U.S.C. 6121.

(3) Time-off means leave under § 158.651, time-off under § 158.652, and recognition time-off under § 158.633, or other time-off of duty available for DHS-CS employees.

(4) Full-time schedule means 80 hours per work period.

(5) Part-time schedule means a specified number of hours less than 80 hours per work period. When DHS-CS cybersecurity work associated with a DHS-CS employee's assignment regularly requires the DHS-CS employee to exceed that employee's specified number of hours per work period, the Department considers, with input from the employee and the employee's supervisor, whether to change the employee's work schedule from part-time to full-time to ensure appropriate compensation under this part, including accrual of leave under § 158.651 and the DHS-CS employee's share of health benefits premiums provided under § 158.653.

(6) Contingent schedule means an irregular number of hours up to 80 hours per work period. A contingent schedule is appropriate only when the DHS-CS cybersecurity work associated with a DHS-CS employee's assignment is sporadic and cannot be regularly scheduled in advance. When DHS-CS cybersecurity work associated with a DHS-CS employee's assignment is able to be scheduled in advance on a regular basis, the Department changes the employee's work schedule from contingent to part-time or full-time, as appropriate, to ensure appropriate compensation under this part, including accrual of leave under § 158.651 and the DHS-CS employee's share of health benefits premiums provided under § 158.653.

(c) Employee work schedules. (1) A DHS-CS employee's work schedule, and any minimum hours of work associated with the employee's schedule, is determined at the time of appointment and recorded as part of documenting the employee's appointment to a qualified position under § 158.706. A DHS-CS employee on a contingent schedule does not have a minimum number of hours of work but has a maximum number of total hours for the employee's appointment that is determined at the time of appointment and recorded as part of documenting the employee's appointment to a qualified position under § 158.706.

(2) A DHS-CS employee's work schedule, and any minimum hours of work, may change during the employee's service in a qualified position and the Department records any such changes in the documentation associated with the employee's qualified position under § 158.706.

(d) Work schedule requirements. (1) DHS-CS employees are expected to perform DHS-CS cybersecurity work associated with their assignments to execute the DHS cybersecurity mission, especially in response to exigent circumstances and emergencies, including cybersecurity incidents defined in 6 U.S.C. 659, without entitlement to more compensation than the employee's salary described in § 158.603. Hours worked by a DHS-CS employee that exceed the employee's minimum hours of work do not affect the employee's salary or result in any automatic compensation, including a type of additional compensation.

(2) A DHS-CS employee on a full-time schedule is expected to work at least 80 hours per work period.

(3) A DHS-CS employee on a part-time schedule is expected to work at least the employee's specified number of hours of work per work period.

(4) A DHS-CS employee on a contingent schedule is expected to work as necessary to perform the DHS-CS cybersecurity work associated with the employee's assignment, not to exceed the maximum number of total hours for the employee's appointment.

(5) DHS-CS employees must report hours worked by the employee. The Department monitors such hours for purposes of managing the DHS-CS, including considering any changes to DHS-CS employees' schedules, and administering compensation, including assisting in consideration of any additional compensation for DHS-CS employees under § 158.642.

(6) A DHS-CS employee on a full-time schedule or a part-time schedule must account for minimum hours of work by the conclusion of the last day of the work period. If the hours worked by the employee are less than the employee's minimum hours of work, the employee must use time-off approved by the employee's supervisor, or must be placed in an appropriate non-pay status for the purposes described in paragraphs (a)(1) and (2) of this section, to account for the difference between hours actually worked by the employee and the employee's minimum hours of work.

(7) A DHS-CS employee on a full-time schedule or a part-time schedule, in coordination with the employee's supervisor, may adjust when work hours are completed in a given work period, to ensure time-off for religious observance, while also completing minimum hours of work. A DHS-CS employee on a contingent schedule, in coordination with the employee's supervisor, may adjust when work hours are completed to ensure time-off for religious observance.

(e) Hours worked and compensation. The Department uses the work scheduling system described in this section in administering compensation under this part, especially salary administration described in § 158.622 and the compensation described in §§ 158.642, 158.650, 158.651, and 158.652. In alignment with the compensation strategy, described in § 158.601, the work scheduling system:

(1) Acknowledges the unpredictable nature of cybersecurity work and the expectation described in § 158.601(c) about working unusual hours and extended hours as needed; and

(2) Reflects an understanding of the cybersecurity talent market, especially current work expectations and arrangements.

(f) Policy. CTMS policy implementing this section addresses:

(1) Procedures for determining, recording, and updating as necessary, DHS-CS employees' work schedules;

(2) Procedures for selecting and communicating anticipated work hours in advance and communicating variances from those work hours;

(3) Requirements regarding reporting and monitoring hours worked;

(4) Procedures for accounting for minimum hours of work; and

(5) Other work scheduling requirements for DHS-CS employees, including DHS-CS employees supporting specific DHS organizations. Such requirements may include designated days, hours, core hours, or limits on the number of work hours per day;

§ 158.706 Recordkeeping.

(a) Generally. The Department documents an individual's appointment to a qualified position and creates records of a DHS-CS employee's employment in the DHS-CS in compliance with 5 U.S.C. 2951 and 5 CFR subchapter A, part 9, and subchapter B, parts 293 and 297.

(b) Documenting a qualified position. The Department documents a qualified position established under this part by documenting an individual's appointment to a qualified position. Such documentation includes a description of the individual's:

(1) CTMS qualifications and the DHS-CS cybersecurity work that can be performed through application of those qualifications;

(2) Applicable work and career structures established under the work valuation system described in § 158.404;

(3) Salary under the compensation system described in § 158.602;

(3) Assignment information described in paragraph (e) of this section;

(4) Official worksite described in § 158.704; and

(5) Work schedule described in § 158.705.

(c) Updating qualified position documentation. The Department updates the documentation associated with a DHS-CS employee's qualified position, described in paragraph (a) of this section, to reflect changes affecting the employee's qualified position, including any changes to the description of information listed in paragraph (a), such as enhancements to the employee's CTMS qualifications. Except as necessary for purposes of recordkeeping under this section, any update to the documentation associated with a DHS-CS employee's qualified position is not a promotion, transfer, or reassignment for any other purpose under 5 U.S.C. or 5 CFR.

(d) Documenting an assignment. The Department documents a DHS-CS employee's initial assignment as part of documenting the employee's qualified position under this section. The Department updates the documentation associated with a DHS-CS employee's qualified position for each of the employee's subsequent assignments described in § 158.703.

(e) Assignment information. Documentation of each assignment under this section includes the following operational information:

(1) Statement of cybersecurity work activities;

(2) Timeframe, such as anticipated duration;

(3) Primary DHS organization;

(4) Personnel security requirements;

(5) Location, such as official worksite determined under § 158.704;

(6) Information related to work scheduling under § 158.705; and

(7) Information related to the performance management program, including information relevant to appraisal reviews, mission impact reviews, and development reviews, described in subpart H of this part.

(f) Integrating with existing processes. For purposes of recordkeeping for DHS-CS employees, including documenting positions and assignments under this section, the Department uses existing Federal personnel recordkeeping processes, standards, requirements, and systems of record. CTMS policy implementing this section addresses integration of the approach to talent management under this part, including definitions used in this part, with existing Federal personnel recordkeeping processes, standards, requirements, and systems of record, as necessary.

§ 158.707 Details and opportunities outside DHS.

(a) DHS-CS employees serving in renewable appointments or continuing appointments may be detailed to:

(1) A position in the excepted service in another agency under 31 U.S.C. 1535;

(2) A position in the SES in another agency under 5 CFR 317.903;

(3) A position in the competitive service in another agency under 31 U.S.C. 1535 and 5 CFR 300.301, if approved by the Director of the Office of Personnel Management;

(4) Certain offices of the White House under 3 U.S.C.112;

(5) The Congress under 2 U.S.C. 4301(f);

(6) An international organization under 5 U.S.C. 3343; or

(7) Another detail opportunity under other provisions of applicable law.

(b) Individuals from outside the DHS-CS may not be detailed to a qualified position.

(c) DHS-CS employees serving in continuing appointments may be assigned to eligible non-Federal organizations under the Intergovernmental Personnel Act in accordance with 5 U.S.C. 3371-3375 and 5 CFR part 334.

§ 158.708 Directed assignments.

(a) Occasionally, the Department may direct a subsequent assignment of a DHS-CS employee, and such a directed subsequent assignment may require a change in the employee's official worksite, determined under § 158.704. For such directed subsequent assignments of a DHS-CS employee, the Department pays or reimburses expenses or allowances under and in accordance with the Federal Travel Regulations at 41 CFR chapters 301 and 302, and for such directed assignments that are not temporary, DHS provides notice to and consultation with the employee as described in this paragraph.

(b) Directed subsequent assignments expected to last less than six months are considered temporary, and for purposes under the Federal Travel Regulations at 41 CFR chapters 301 and 302, are temporary duty.

(c) For such directed subsequent assignments expected to last six months or more and with an official worksite in a DHS-CS employee's current commuting area, defined in 5 CFR 550.703, the Department provides the employee written notice at least 30 calendar days before the effective date of the subsequent assignment. This notice requirement may be waived only when the employee consents in writing.

(d) For such directed subsequent assignments expected to last six months or more and with an official worksite outside of a DHS-CS employee's current commuting area, defined in 5 CFR 550.703, DHS consults with the employee on the reasons for, and the employee's preferences regarding, the proposed change in assignment. Following such consultation, the Department provides the employee written notice at least 90 calendar days before the effective date of the assignment. This notice requirement may be waived only when the employee consents in writing.

§ 158.709 Exemption from other laws regarding deployment.

The provisions of laws, among other similar laws, listed in §§ 158.405, 158.502, and 158.605 do not apply under CTMS, to the DHS-CS, or to talent management involving the individuals described in § 158.103.

§ 158.801 Definitions.

As used in this subpart:

Appraisal has the same meaning as that term in 5 CFR 430.203.

Appraisal period has the same meaning as that term in 5 CFR 430.203.

Appraisal program has the same meaning as that term in 5 CFR 430.203.

Appraisal system and performance appraisal system have the same meanings as those terms in 5 CFR 430.203.

Mission impact has the same meaning as defined in § 158.104.

Performance has the same meaning as that term in 5 CFR 430.203.

Performance rating has the same meaning as that term in 5 CFR 430.203.

Progress review has the same meaning as that term in 5 CFR 430.203.

Rating of record has the same meaning as that term in 5 CFR 430.203.

§ 158.802 Performance management program.

(a) In alignment with the DHS-CS's core values described in § 158.305 and the compensation strategy described in § 158.601, the Secretary or designee establishes and administers a systematic performance management program to:

(1) Establish and maintain individual accountability among DHS-CS employees;

(2) Manage, recognize, and develop the performance of each DHS-CS employee; and

(3) Improve effectiveness of DHS-CS employees in executing the DHS cybersecurity mission.

(b) The performance management program comprises the following ongoing reviews:

(1) Appraisal reviews described in § 158.804;

(2) Mission impact reviews described in § 158.805; and

(3) Development reviews described in § 158.806.

(c) To complete appraisal reviews, mission impact reviews, and development reviews for a DHS-CS employee, the Department may collect, on a periodic or ongoing basis, information and input from:

(1) The DHS-CS employee;

(2) Other DHS-CS employees;

(3) The employee's supervisor; and

(4) Other appropriate officials.

§ 158.803 Career development program.

(a) Career development program. In alignment with the DHS-CS's core values described in § 158.305 and the compensation strategy described in § 158.601, the Secretary or designee establishes and administers a career development program to:

(1) Guide the career progression of each DHS-CS employee;

(2) Ensure development of the collective expertise of DHS-CS employees through continual learning; and

(3) Ensure continued alignment between the qualifications of DHS-CS employees and CTMS qualifications.

(b) Career progression. Career progression in the DHS-CS is based on enhancement of CTMS qualifications and salary progression resulting from recognition adjustments under § 158.631. Career progression in the DHS-CS is not based on length of service in the DHS-CS or the Federal Government. The Department guides the career progression of DHS-CS employees using development strategies based on:

(1) Information from development reviews, described in § 158.806;

(2) Mission-related requirements; and

(3) Strategic talent priorities.

(c) Commitment to continual learning. The Department establishes, maintains, and communicates criteria for continual learning. Such criteria include recommended and required learning activities, including completion of specific courses of study, completion of mission-related training defined in 5 CFR 410.101, performance of certain DHS-CS cybersecurity work as part of assignments, and participation in opportunities for professional development and training described in § 158.640. The Department aims to utilize all available opportunities for DHS-CS employee development, including opportunities under this part and under or based on authorities in 5 U.S.C. and 5 CFR relating to continual learning, professional development, and training, as appropriate.

(d) Verification of qualifications enhancements. The Department verifies DHS-CS employees' enhancement of CTMS qualifications, which may include review by the CTMB or assessment using standardized instruments and procedures designed to measure the extent to which a DHS-CS employee has enhanced the employee's qualifications. Verification of enhancement to CTMS qualifications may require updating the documentation associated with the employee's qualified position, as described in § 158.706.

§ 158.804 Appraisal reviews.

(a) Under 5 U.S.C. Chapter 43 and 5 CFR part 430, the Department establishes an appraisal program to review and evaluate the performance of DHS-CS employees to ensure DHS-CS employees' individual accountability.

(b) The appraisal program for DHS-CS employees includes one or more progress reviews, as defined in 5 CFR 430.203, and an appraisal of an employee's performance that results in a rating of record, as defined in 5 CFR 430.203.

(c) The Department addresses unacceptable performance, as defined in 5 U.S.C. 4301(3), under the provisions of 5 CFR part 432 or part 752. The CTMB may assist with any decision, or action, or both, made under the authority in this section and 5 CFR part 430 and 5 CFR part 432 or 752.

(d) If the Department determines a DHS-CS employee's performance is unacceptable or the employee receives an unacceptable rating of record, the employee is ineligible to receive recognition under §§ 158.630 through 158.634 and the employee may be excluded from mission impact reviews under § 158.805.

§ 158.805 Mission impact reviews.

(a) The Department reviews a DHS-CS employee's mission impact throughout the employee's service in the DHS-CS and generates a mission impact summary at least annually. The Department may conduct mission impact reviews concurrently with development reviews.

(b) In reviewing a DHS-CS employee's mission impact, individually or as part of a group of DHS-CS employees, or both, the Department considers factors such as:

(1) Superior application of CTMS qualifications to perform DHS-CS cybersecurity work;

(2) Significant enhancements to CTMS qualifications;

(3) Special contributions to cybersecurity technologies, techniques, tactics, or procedures; and

(4) Notable improvements to execution of the DHS cybersecurity mission.

(c) The Department uses mission impact summary information to make distinctions among DHS-CS employees, such as comparing, categorizing, and ranking DHS-CS employees on the basis of mission impact to support decisions related to recognition for DHS-CS employees under §§ 158.630 through 158.634.

§ 158.806 Development reviews.

(a) The Department reviews a DHS-CS employee's career progression, as described in § 158.803(b) throughout the employee's service in the DHS-CS. The Department generates a development summary, at least annually, which may include plans for a DHS-CS employee's continual learning in alignment with the criteria for continual learning under the career development program described in § 158.803.

(b) As part of development reviews, the Department may compare, categorize, and rank DHS-CS employees to support decisions related to professional development and training under § 158.640. The Department may also use information from development reviews in matching subsequent assignments under § 158.703. The Department may conduct development reviews concurrently with mission impact reviews.

§ 158.901 Federal employee rights and processes.

(a) Adverse actions: Nothing in this part affects the rights of CS employees under 5 U.S.C. Chapter 75, 5 U.S.C. 4303, and 5 CFR parts 432 and 752.

(b) Reductions in force. The provisions of 5 U.S.C. Chapter 35, Subchapter I and 5 CFR part 351 regarding reductions in force apply to talent management actions taken under this part.

(c) Redress with third parties. Nothing in this part affects the rights, as provided by law, of a DHS-CS employee to seek review before a third party of a talent management action taken under this part involving that employee, including seeking review before the:

(1) Equal Employment Opportunity Commission, regarding discrimination under Federal anti-discrimination laws;

(2) Merit Systems Protection Board, regarding matters such as adverse actions under 5 U.S.C. Chapter 75 or Chapter 43 and individual rights of action under 5 U.S.C. Chapter 12;

(3) Office of Special Counsel, regarding matters such as whistleblower retaliation and other prohibited personnel practices under 5 U.S.C. 2302 and the Hatch Act (5 U.S.C. 7321 et seq.); and

(4) Department of Labor, regarding matters covered by the Uniformed Services Employment and Reemployment Rights Act (38 U.S.C. 4301 et seq.).

(d) Back pay. Back pay remains available under 5 U.S.C. 5596 and 5 CFR part 550, subpart H, for unjustified or unwarranted talent management actions.

§ 158.902 Ethics requirements.

(a) DHS-CS employees, including such employees providing uncompensated service and DHS-CS advisory appointees, are employees covered by the Ethics in Government Act section 101(f)(3), and are subject to the criminal conflict of interest rules as well as government ethics requirements applicable to Federal employees, including:

(1) Criminal conflict of interest provisions in 18 U.S.C. 201-209;

(2) Ethics in Government Act, as amended, and implementing regulations in 5 CFR, Chapter XVI, Subchapter B, including financial disclosure reporting in 5 CFR part 2634 and the Standards of Ethical Conduct for Employees of the Executive Branch in 5 CFR part 2635;

(3) Supplemental Standards of Ethical Conduct for Employees of the Department of Homeland Security in 5 CFR part 4601; and

(4) Department policy.

(b) Under the ethics requirements described in paragraph (a) of this section, DHS-CS employees must seek approval for certain outside activities, comply with ethics program requirements, and other applicable laws, including post-government employment restrictions.

§ 158.903 Employee input program.

(a) Program. The Department establishes and administers a program for DHS-CS employees to express employment-related concerns and recommendations for enhancing CTMS administration and DHS-CS management. Under such a program, a DHS-CS employee may request review of certain talent management actions related to the employee's employment in the DHS-CS or related to the processes, systems, and programs established under this part, or both. The Cybersecurity Talent Management Board may use information from this program for the periodic evaluation of CTMS described in § 158.302.

(b) Policy. CTMS policy implementing this section addresses:

(1) Talent management actions covered by the employee input program;

(2) The process for DHS-CS employees to express input; and

(3) The interaction of the employee input program with relevant processes for redress with third parties of employment-related actions, including those described in § 158.901.

§ 158.1001 Advisory appointments and advisory appointees.

(a) An advisory appointment is an appointment to a qualified position that:

(1) The Secretary determines is of a policy-determining, policy-making, or policy-advocating character or involves a close and confidential working relationship with the Secretary or other key appointed officials;

(2) Does not have a salary set by statute; and

(3) Is not required to be filled by an appointment by the President.

(b) An advisory appointment to a qualified position is treated as a Schedule C position under 5 CFR 213.3301 except regarding appointment and compensation. Talent management for a DHS-CS advisory appointee is in accordance with the provisions of 5 CFR applicable to Schedule C appointees, except that appointment and compensation for a DHS-CS advisory appointee is governed by this part.

(c) Employment restrictions such as those concerning the criminal conflict of interest statutes, standards of ethical conduct, partisan political activity, and contained in laws such as Executive Orders, government-wide ethics regulations and the Hatch Act (5 U.S.C. 7321 et seq.), apply to a DHS-CS advisory appointee as if the employee were a Schedule C appointee.

(d) The Department tracks and coordinates advisory appointments with the Executive Office of the President and the Office of Personnel Management (OPM), as appropriate.

§ 158.1002 Appointment of advisory appointees.

(a) Appointment of an individual, including a former DHS-CS employee, to an advisory appointment is governed by this subpart J and subpart E of this part.

(b) An individual for appointment to an advisory appointment must participate in the assessment program described in § 158.520. The Secretary or designee must approve the appointment of an individual to an advisory appointment by name, and an individual appointed to an advisory appointment serves at the will of the Secretary.

(c) A DHS-CS advisory appointee may be removed at any time. In accordance with 5 U.S.C. 7511(b), the provisions of 5 U.S.C. Chapter 75, subchapter II do not apply to talent management actions taken under this part for a DHS advisory appointee.

(d) An advisory appointment terminates no later than the end of the term of the U.S. President under which the advisory appointee was appointed.

(e) The Secretary or designee establishes a limit on the number of advisory appointments under this subpart J, and the total number of advisory appointments under this subpart may not exceed that limit at any time.

(f) The Department may not change an advisory appointment to a renewable appointment or continuing appointment.

(g) The Department may not use an advisory appointment solely or primarily for the purpose of detailing any individual to the White House.

§ 158.1003 Compensation for advisory appointees.

(a) General. Compensation for a DHS-CS advisory appointee is governed by this subpart J and subpart F of this part. A DHS-CS advisory appointee may provide uncompensated service and any such service is gratuitous service.

(b) Compensation. As compensation for service in the DHS-CS, a DHS-CS advisory appointee receives a salary as described in paragraph (c) this section, unless the appointee is providing uncompensated service. A DHS-CS advisory appointee, except such an employee providing uncompensated service, may also receive additional compensation as described in paragraph (d) of this paragraph.

(c) Salary. A DHS-CS advisory appointee receives a salary under the salary system described in § 158.610.

(1) Setting salary. The Department determines the salary for an individual accepting an advisory appointment to a qualified position under § 158.620.

(2) Adjusting salary. The Department determines any adjustments to salary of a DHS-CS advisory appointee under § 158.621.

(3) Extended range. A DHS-CS advisory appointee is ineligible for a salary in the extended range.

(4) Local cybersecurity talent market supplement. The Department may provide a DHS-CS advisory appointee a local cybersecurity talent market supplement under § 158.612.

(d) Additional compensation. In alignment with the compensation strategy in § 158.601, the Department may provide the following types of additional compensation to a DHS-CS advisory appointee for the purposes of each such type as described under this part and subject to the requirements of this section. An individual appointed to an advisory appointment is ineligible to receive any type of additional compensation under this part as part of an offer of employment in the DHS-CS.

(1) Types. Additional compensation under CTMS for a DHS-CS advisory appointee is:

(i) Recognition adjustments under § 158.631, except the Secretary or designee must approve any such recognition for a DHS-CS advisory appointee;

(ii) Recognition payments under § 158.632, except the Secretary or designee must approve any such recognition for a DHS-CS advisory appointee;

(iii) Recognition time-off under § 158.633, except the Secretary or designee must approve any such recognition for a DHS-CS advisory appointee;

(iv) Honorary recognition under § 158.634;

(v) Professional development and training under § 158.640, so long as a professional development and training program described in § 158.640 explicitly covers DHS-CS advisory appointee and prohibits such employees from receiving any payment or reimbursement for costs of academic degree training or expenses to obtain professional credentials, including examinations to obtain such credentials;

(vi) Allowances in nonforeign areas under § 158.643; and

(vii) Other types of compensation, including leave and benefits, authorized under §§ 158.650 through 158.655 and provided in accordance with relevant provisions of other laws.

(2) Combining types. A DHS-CS advisory appointee may receive any type of additional compensation described in paragraph (c)(1) of this section in combination with any other such type subject to the requirements of subpart F of this part and the requirements and restrictions of this section.

(3) Restrictions. Additional compensation described in paragraph (d)(1) of this section is subject to, and may be limited by:

(i) The aggregate compensation limit described in § 158.604;

(ii) Prohibitions in 5 U.S.C. 4508, guidance from the Office of Management and Budget and Office of Personnel Management, and any other provisions of law governing compensation for political appointees; and

(iii) Other requirements and restrictions in CTMS policy.

(e) Compensation administration. For purposes of administering compensation under this part for a DHS-CS advisory appointee, the Department administers salary and other compensation, including leave, based on consideration of the employee's work schedule under the work scheduling system described in § 158.705, and may convert the appointee's salary into an hourly rate, biweekly rate, or other rate.

§ 1000.1 Purpose.

This part describes the organization of the Board, and the assignment of authorities and the responsibilities of the Board, individual Board members, and employees.

§ 1000.2 Definitions.

As used in this part:

Board means the Privacy and Civil Liberties Oversight Board, established by the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53.

Chairman means the Chairman of the Board, as appointed by the President and confirmed by the Senate under section 801(a) of the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53.

Executive Director means the individual appointed by the Chairman to act as the Executive Director (or, in the event the Chairman position is vacant, by the Board) to discharge the responsibilities assigned to the Executive Director.

General Counsel means the individual appointed by the Chairman to act as the chief legal officer of the Board or, if the General Counsel is absent or unavailable, the Deputy General Counsel, or in the event both positions are vacant, the individual(s) designated by the Chairman (or, in the event the Chairman position is vacant, by the Board) to discharge the responsibilities assigned to the General Counsel. If both the General Counsel and Deputy General Counsel are absent and unavailable for a prolonged period of time, the Chairman (or the Board in the event the Chairman position is vacant) may designate any Staff Member who is an active member of the bar of any state, territory, or the District of Columbia to temporarily discharge the responsibilities assigned to the General Counsel until the General Counsel or Deputy General Counsel is again available or a successor has been duly appointed.

Member means an individual appointed by the President, with the advice and consent of the Senate, to be a member of the Board.

[78 FR 33689, June 5, 2013, as amended at 84 FR 36456, July 29, 2019]

§ 1000.3 Organization.

(a) The Board is comprised of four part-time Board members and a full-time Chairman, each appointed by the President with the advice and consent of the Senate.

(b) The Board's staff is comprised of the following:

(1) Mission staff who assist the Board with its advice, oversight, and other mission functions, as described in 42 U.S.C. 2000ee(d) and 6 CFR 1000.4; and

(2) Administrative staff who support the Board's operations on a variety of administrative matters, such as budget, contracts, information technology and information assurance, and security; and

(3) Legal staff who provide the Board and agency employees with legal advice and ethical guidance.

[78 FR 33689, June 5, 2013, as amended at 84 FR 36456, July 29, 2019]

§ 1000.4 Functions.

(a) The Board provides advice and counsel to the President and executive departments and agencies to ensure that privacy and civil liberties are appropriately considered in proposed legislation, regulations, and policies, and in the implementation of new and existing legislation, regulations, and policies, related to efforts to protect the Nation from terrorism;

(b) The Board oversees actions by the executive branch relating to efforts to protect the Nation from terrorism to determine whether such actions appropriately protect privacy and civil liberties and are consistent with governing laws, regulations, and policies regarding privacy and civil liberties; and

(c) The Board receives and reviews reports and other information from privacy and civil liberties officers under 42 U.S.C. 2000ee-1 and, when appropriate, makes recommendations to and coordinates the activities of privacy and civil liberties officers on relevant interagency matters.

§ 1000.5 Delegations of authority.

(a) The Board. The Board is the head of the agency. The Board is responsible for the overall planning, direction, and control of the agency's agenda. The delegations of authority in this part do not extend to the following actions which are reserved to the Board:

(1) Disposition of all rulemaking and similar proceedings involving the promulgation of rules or the issuance of statements of general policy.

(2) Determination of advice or recommendations to the President or executive departments and agencies regarding the matters described in 42 U.S.C. 2000ee(d).

(3) Determination of the Board's annual agenda or other statement of operational priorities; and

(4) Redelegation to one or more Board members or staff of those responsibilities delegated to the Chairman in § 1000.3(b), in the event of a vacancy.

(5) Formulation and implementation of policies designed to assure the effective administration of the Board's operations and the efficient operations of the staff.

(6) Any authority that is not delegated by the Board in this part, or otherwise vested in officials other than the Board, is reserved to the Board. The Board may reverse delegations at any time, and all delegated authority reverts to the Board upon the termination or expiration of the delegation.

(b) The Chairman. The Chairman is the executive and administrative head of the Board. The Chairman has the authority, duties, and responsibilities assigned to the Chairman under 42 U.S.C. 2000ee(h)(5) and (j)(1) and is responsible for the agency's day-to-day operations. The Chairman is delegated the authority to:

(1) Exercise control over the Board's management and functioning;

(2) Implement and execute the Board's budget;

(3) Develop and effectively use staff support to carry out the functions of the Board, including, but not limited to, the supervision and removal of Board employees and the assignment and distribution of work among staff;

(4) Convene and preside at all meetings of the Board and ensure that every vote and official act of the Board required by law to be recorded is accurately and promptly recorded by the General Counsel;

(5) Redelegate to one or more Board staff persons those responsibilities to the Executive Director or General Counsel under this part, in the event that either position is unfilled.

(6) Authorize any officer or employee of the Board to perform a function vested in, delegated, or otherwise designated to the Chairman.

(c) Executive Director. The Executive Director manages the staff and assists with the day-to-day operation of the agency. The Executive Director is delegated authority to—

(1) Manage the Board's mission-related projects in accordance with the priorities set by the Board;

(2) Supervise the Board's mission staff; and

(3) Authorize any officer or employee of the Board to perform a function vested in, delegated, or otherwise designated to the Executive Director.

(d) General Counsel. The General Counsel is the Board's chief legal officer, and serves as the Board's legal advisor. The General Counsel is delegated authority to—

(1) Serve as the Board's Designated Ethics Official in accordance with 5 CFR 2638.202;

(2) Certify Board votes and conduct other necessary corporate secretary functions consistent with Board policies and procedures; and

(3) Authorize any officer or employee of the Board to perform a function vested in, delegated, or otherwise designated to the General Counsel.

(e) Individual Board Members. Any member delegated authority vested in the Chairman under paragraph (a) of this section may redelegate that authority to one or more Board employees.

(f) Exercise of authority. In carrying out any functions delegated under this part, members and staff are governed in the exercise of those functions by all applicable Federal statutes and regulations, and by the regulations, orders, and rules of the Board.

[78 FR 33689, June 5, 2013, as amended at 78 FR 38811, June 28, 2013; 84 FR 36456, July 29, 2019]

§ 1001.1 Purpose and scope.

The regulations in this part implement the provisions of the FOIA.

§ 1001.2 Definitions.

The following definitions apply to this part:

Board means the Privacy and Civil Liberties Oversight Board, established by the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53.

Chairman means the Chairman of the Board, as appointed by the President and confirmed by the Senate under section 801(a) of the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53, or any person to whom the Board has delegated authority for the matter concerned.

Chief FOIA Officer means the senior official to whom the Board delegated responsibility for efficient and appropriate compliance with the FOIA.

Commercial use request means a FOIA request from or on behalf of a person who seeks information for a use or purpose that furthers his or her commercial, trade, or profit interests, including pursuit of those interests through litigation.

Confidential business information means trade secrets and confidential, privileged, or proprietary business or financial information submitted to the Board by a person.

Direct costs mean in the case of commercial use requesters those expenses the Board has actually incurred to search for, duplicate, and review documents in response to a FOIA request. Direct costs include, but are not limited to, the salary of the employee performing the work and costs associated with duplication.

Educational institution means a preschool, a public or private elementary or secondary school, an institution of undergraduate or graduate higher education, an institution of professional education, or an institution of vocational education, which operates a program or programs of scholarly research.

Fee waiver means the waiver or reduction of processing fees if a requester can demonstrate that OMB's Fee Guidelines' standards are satisfied, including that the information is in the public interest and is not a commercial interest.

FOIA means the Freedom of Information Act, 5 U.S.C. 552, as amended. The FOIA applies to third-party requests for documents concerning the general activities of the government and the Board in particular. A request by a U.S. citizen or an individual lawfully admitted for permanent residence for access to his or her own records is considered a Privacy Act request, under the Privacy Act of 1974, 5 U.S.C. 552a, as amended. See 6 CFR 1002.3.

FOIA Officer means the individual to whom the Board has delegated authority to carry out the Board's day-to-day FOIA administration.

FOIA Public Liaison means the individual designated by the Chairman to assist FOIA requesters with concerns about the Board's processing of their FOIA request, including assistance in resolving disputes.

Non-commercial scientific institution means an organization operated solely for the purpose of conducting scientific research, the results of which are not intended to promote any product or research, and not operated on a commercial basis.

Person includes an individual, partnership, corporation, association, or public or private organization other than an agency.

Record means any writing, drawing, map, recording, diskette, DVD, CD-ROM, tape, film, photograph, or other documentary material, regardless of medium, by which information is preserved, including documentary material stored electronically.

Redact means delete or mark over.

Representative of the news media means any person or entity that gathers information of potential public interest to a segment of the public, uses its editorial skills to turn the raw materials into a distinct work, and distributes that work to an audience.

Requester category means one of the three categories in which requesters will be placed for the purpose of determining whether a requester will be charged fees for search, review, or duplication. They are:

(1) Commercial requestors,

(2) Non-commercial scientific or educational institutions or news media requestors, and

(3) All other requestors.

Submitter means any person or entity from whom the Board obtains confidential business information, directly or indirectly.

Unusual circumstances means, to the extent reasonably necessary for the proper processing of a FOIA request:

(1) The need to search for and collect the requested records from physically separate facilities;

(2) The need to search for, collect and appropriately examine a voluminous amount of separate and distinct records which are demanded in a single request; or

(3) The need for consultation, which shall be conducted with all practicable speed, with another agency having a substantial interest in the determination of the request.

[78 FR 66997, Nov. 8, 2013, as amended at 82 FR 34835, July 27, 2017]

§ 1001.3 Availability of records.

(a) In accordance with 5 U.S.C. 552(a)(1), the Board publishes the following records in the Federal Register and makes an index of the records publicly available:

(1) Descriptions of the Board's organization and the established places at which, the employees from whom, and the methods by which, the public may obtain information, submit documents, or obtain decisions;

(2) Statements of the general course and method by which the Board's functions are channeled and determined, including the nature and requirements of all formal and informal procedures available;

(3) Rules of procedure, descriptions of forms available or the places at which forms may be obtained, and instructions as to the scope and contents of all papers, reports, or examinations;

(4) Substantive rules of general applicability adopted as authorized by law and statements of general policy or interpretations of general applicability formulated and adopted by the Board; and

(5) Each amendment, revision, or repeal of any material listed in paragraphs (a)(1) through (4) of this section.

(b) In accordance with 5 U.S.C. 552(a)(2), the Board shall make the following materials available for public inspection and copying:

(1) Statements of policy and interpretation that have been adopted by the Board and not published in the Federal Register;

(2) Administrative staff manuals and instructions to staff that affect a member of the public;

(3) Copies of all records, regardless of the form or format, which have been released to any person under paragraph (c) of this section and that, because of their nature or subject matter, the Board determines have become or are likely to become the subject of subsequent requests for substantially the same records; and

(4) A general index of the records referred to in paragraph (b)(3) of this section.

(c) In accordance with 5 U.S.C. 552(a)(3), the Board shall make available, upon proper request, as described in section 5 of this part, all non-exempt Board records, or portions of records, not previously made public under paragraphs (a) and (b) of this section.

(d) The FOIA applies only to Board records in existence at the time of the request; the FOIA does not require that the Board create new records in order to respond to FOIA requests. When responsive records are located, the Board adopts a presumption of disclosure and openness.

§ 1001.4 Categories of exemptions.

(a) The FOIA does not require disclosure of matters that are:

(1) Specifically authorized under criteria established by an executive order to be kept secret in the interest of national defense or foreign policy and are, in fact, properly classified under executive order;

(2) Related solely to the internal personnel rules and practices of the Board;

(3) Specifically exempted from disclosure by statute (other than the Government in the Sunshine Act, 5 U.S.C. 552b, as amended), provided that such statute:

(i) Requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, establishes particular criteria for withholding, or refers to particular types of matters to be withheld; and

(ii) If enacted after October 28, 2009, specifically cites to Exemption 3 of the FOIA, 5 U.S.C. 552(b)(3);

(4) Trade secrets and commercial or financial information obtained from a person and privileged or confidential;

(5) Inter-agency or intra-agency memoranda or letters, which would not be available at law to a party other than an agency in litigation with the Board;

(6) Personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy;

(7) Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information:

(i) Could reasonably be expected to interfere with enforcement proceedings;

(ii) Would deprive a person of a right to a fair trial or impartial adjudication;

(iii) Could reasonably be expected to constitute an unwarranted invasion of personal privacy;

(iv) Could reasonably be expected to disclose the identity of a confidential source, including a state, local, or foreign agency or authority or any private institution that furnished information on a confidential basis, and, in the case of a record or information compiled by a criminal investigation, or by an agency conducting a lawful national security intelligence investigation, information furnished by a confidential source;

(v) Would disclose techniques and procedures for law enforcement investigations or prosecutions or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law; or

(vi) Could reasonably be expected to endanger the life or physical safety of any individual.

(8) Contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions; or

(9) Geological and geophysical information and data, including maps, concerning wells.

(b) [Reserved]

§ 1001.5 Requests for records.

(a) You may request copies of records under this part by email to FOIA@pclob.gov or in writing addressed to FOIA Officer, Privacy and Civil Liberties Oversight Board. Requestors should check the Board's Web site at https://www.pclob.gov for the Board's current mailing address. Please provide contact information, such as your phone number, email address, and/or mailing address, to assist the Board in communicating with you and providing released records.

(b) Your request shall reasonably describe the records sought with sufficient specificity, and when possible, include names, dates, and subject matter, in order to permit the FOIA Officer to locate the records with a reasonable amount of effort. If the FOIA Officer cannot locate responsive records based on your written description, you will be notified and advised that further identifying information is necessary before the request can be fulfilled. Requesters who are attempting to reformulate or modify such a request may discuss their request with the Board's FOIA Officer or FOIA Public Liaison. If a request does not reasonably describe the records sought, the Board's response to the request is likely to be delayed.

(c) Although requests are considered either FOIA or Privacy Act requests, the Board processes requests for records in accordance with both laws so as to provide the greatest degree of lawful access while safeguarding an individual's personal privacy.

(d) Your request should specify your preferred form or format (including electronic formats) for the records you seek. We will accommodate your request if the record is readily available in that form or format. When you do not specify the form or format of the response, we will provide responsive records in the form or format most convenient to us.

[82 FR 34835, July 27, 2017]

§ 1001.6 Responsibility for responding to requests.

(a) In general. The Board delegates authority to grant or deny FOIA requests in whole or in part to the FOIA Officer. When conducting a search for responsive records, the FOIA Officer generally will search for records in existence on the date of the search. If another date is used, the FOIA Officer shall inform the requester of the date used.

(b) Responses. The FOIA Officer will notify you of his or her determination to grant or deny your FOIA request in the time frame stated in § 1001.8. The Board will release reasonably segregable non-exempt information. For any adverse determination, including those regarding any disputed fee matter; a denial of a request for a fee waiver; or a determination to withhold a record, in whole or in part, that a record does not exist or cannot be located; or to deny a request for expedited processing; the notice shall include the following information:

(1) The name(s) of any person responsible for the determination to deny the request in whole or in part;

(2) A brief statement of the reason(s) for the denial, including any FOIA exemption applied in denying the request. The FOIA Officer will indicate, if technically feasible, the amount of information deleted and the exemption under which a deletion is made on the released portion of the record, unless including that indication would harm an interest protected by the exemption;

(3) An estimate of the volume of information withheld, if applicable. This estimate does not need to be provided if it is ascertainable based on redactions in partially disclosed records or if the disclosure of the estimate would harm an interest protected by an applicable FOIA exemption;

(4) A statement that the adverse determination may be appealed and a description of the requirements for an appeal under § 1001.7; and

(5) A statement notifying you of the assistance available from the Board's FOIA Public Liaison and the dispute resolution services offered by OGIS.

(c) Consultations and referrals. (1) Upon receipt of a FOIA request for a record within the Board's possession, the FOIA Officer should determine if the Board or another federal agency is best able to determine eligibility for disclosure under the FOIA. If the FOIA Officer determines that another agency is better able to evaluate the releasibility of the record, the FOIA Officer shall:

(1) Upon receipt of a FOIA request for a record within the Board's possession, the FOIA Officer should determine if the Board or another federal agency is best able to determine eligibility for disclosure under the FOIA. As to any such record, the FOIA Officer must proceed in one of the following ways:

(i) Consultation. When records originated with the Board, but contain within them information of interest to or originated by another agency or Federal Government office, the FOIA Officer must consult with that other entity prior to making a release determination.

(ii) Referral. When the FOIA Officer believes that a different agency is best able to determine whether to disclose the record the FOIA Officer will refer the responsibility for responding to the request regarding that record to that agency (but only if that other department or agency is subject to FOIA). Ordinarily, the department or agency that originated the record will be presumed best able to determine whether to disclose it. However, if the FOIA Officer and the originating agency jointly agree that the Board is in the best position to respond regarding the record, then the record may be handled as a consultation.

(2) Whenever a request is made for information that is classified, the FOIA Officer shall refer the responsibility for responding to that portion of the request to the agency that originated the information, or has the primary interest in it, as appropriate. Whenever a record contains information that the Board has derivatively classified because it contains information classified by another agency, the FOIA Officer shall refer the responsibility for responding to the request regarding that information to the agency that classified the underlying information or originated the record.

(3) If responsibility for responding to a request is referred to another department or agency, the FOIA Officer shall notify you of the referral. This notice shall identify the part of the request that has been referred and the name of each department or agency to which the request, or part of the request, has been referred, when appropriate and available, the notice will include a point of contact for the referral agency or department.

(d) Coordination. The standard referral procedure is not appropriate where disclosure of the identity of the agency to which the referral would be made is classified for national security reasons or otherwise could harm an interest protected by an applicable exemption, such as the exemptions that protect personal privacy or national security interests. For instance, if the Board locates within its files materials originating with an Intelligence Community agency, and the involvement of that agency in the matter is classified and not publicly acknowledged, then to disclose or give attribution to the involvement of that Intelligence Community agency could cause national security harms. In such an instance, in order to avoid harm to an interest protected by an applicable exemption, the Board will coordinate with the originating agency to seek its views on the disclosability of the record. The release determination for the record that is the subject of the coordination will then be conveyed to the requester by the Board.

[78 FR 66997, Nov. 8, 2013, as amended at 82 FR 34836, July 27, 2017]

§ 1001.7 Administrative appeals.

(a) You may appeal an adverse determination related to your FOIA request, or the Board's failure to respond to your FOIA request within the prescribed time limits, to the Chief FOIA Officer, Privacy and Civil Liberties Oversight Board. Requestors should check the Board's Web site at https://www.pclob.gov for the Board's current mailing address.

(b) Your appeal must be in writing, sent to the address posted on the Board's Web site in accordance with paragraph (a) of this section, and it must be postmarked, or in the case of electronic submissions, transmitted, within 90 calendar days after the date of the letter denying your request, in whole or in part. The appeal should clearly identify the agency determination that is being appealed and the assigned case request number. In case of the Board's failure to respond within the statutory time frame, you may submit an administrative appeal at any time until an agency response has been provided. For the most expeditious handling, your appeal letter and envelope, or subject line of the electronic transmission, should be marked “Freedom of Information Act appeal.”

(c) Your appeal letter should state facts and may cite legal or other authorities in support of your request.

(d) On receipt of any appeal involving classified information, the Chief FOIA Officer must take appropriate action to ensure compliance with applicable classification rules.

(e) The Chief FOIA Officer shall respond to all administrative appeals in writing and within the time frame stated in § 1001.8(d). If the decision affirms, in whole or in part, the FOIA Officer's determination, the letter shall contain a statement of the reasons for the affirmance, including any FOIA exemption(s) applied, and will inform you of the FOIA's provisions for court review. If the Chief FOIA Officer reverses or modifies the FOIA Officer's determination, in whole or in part, you will be notified in writing and your request will be reprocessed in accordance with that decision. The Board may work with Office of Government Information Services (OGIS) to resolve disputes between FOIA requestors and the Board. A requester may also contact OGIS in the following ways: Via mail to OGIS, National Archives and Records Administration, 8601 Adelphi Road—OGIS, College Park, MD 20740 (ogis.archives.gov), via email at ogis@nara.gov, or via the telephone at 202-741-5770 or 877-684-6448. Facsimile is also available at 202-741-5769.

[82 FR 34836, July 27, 2017]

§ 1001.8 Time frame for Board response.

(a) In general. The Board ordinarily shall respond to requests according to their order of receipt.

(b) Multi-track processing. The Board may use two or more processing tracks by distinguishing between simple and more complex requests based on the amount of work or time needed to process the request.

(c) Initial decisions. The Board shall determine whether to comply with a FOIA request within 20 working days after our receipt of the request, unless the time frame for response is extended due to unusual circumstances as further described in paragraph (f) of this section. A request is received by the Board, for purposes of commencing the 20-day timeframe for its response, on the day it is received by the FOIA Officer or, in any event, not later than ten days after the request is first received by any Board office.

(d) Administrative appeals. The Chief FOIA Officer shall determine whether to affirm or overturn a decision subject to administrative appeal within 20 working days after receipt of the appeal, unless the time frame for response is extended in accordance with subsection (e) of this section.

(e) Tolling timelines. We may toll the 20-day timeframe set forth in paragraphs (c) or (d) of this section:

(1) One time to await information that we reasonably requested from you, as permitted by 5 U.S.C. 552(a)(6)(A)(iii)(I);

(2) As necessary to clarify with you issues regarding the fee assessment.

(3) If we toll the time frame for response under paragraphs (e)(1) or (2) of this section, the tolling period ends upon our receipt of your response.

(f) Unusual circumstances. In the event of unusual circumstances, we may extend the time frame for response provided in paragraphs (c) or (d) of this section by providing you with written notice of the unusual circumstances and the date on which a determination is expected to be made. Where the extension is for more than ten working days, we will provide you with an opportunity either to modify your request so that it may be processed within the statutorily-prescribed time limits or to arrange an alternative time period for processing your request or modified request.

(g) Aggregating requests. When we reasonably believe that multiple requests submitted by a requester, or by a group of requesters acting in concert, involving clearly related matters, can be viewed as a single request that involves unusual circumstances, we may aggregate the requests for the purposes of fees and processing activities, which may result in an extension of the processing time.

(h) Expedited processing. You may request that the Board expedite processing of your FOIA request. To receive expedited processing, you must demonstrate a compelling need for such processing.

(1) For requests for expedited processing, a “compelling need” involves:

(i) Circumstances in which the lack of expedited treatment could reasonably be expected to pose an imminent threat to the life or physical safety of an individual; or

(ii) A request made by a person primarily engaged in disseminating information, with a time urgency to inform the public of actual or alleged federal government activity.

(2) Your request for expedited processing must be in writing and may be made at the time of the initial FOIA request or at any later time.

(3) Your request for expedited processing must include a statement, certified to be true and correct to the best of your knowledge and belief, explaining in detail the basis for requesting expedited processing. If you are a person primarily engaged in disseminating information, you must establish a particular urgency to inform the public about the federal government activity involved in the request.

(4) The FOIA Officer will decide whether to grant or deny your request for expedited processing within ten calendar days of receipt. You will be notified in writing of the determination. Appeals of adverse decisions regarding expedited processing shall be processed expeditiously.

§ 1001.9 Business information.

(a) Designation of confidential business information. In the event a FOIA request is made for confidential business information previously submitted to the Government by a commercial entity or on behalf of it (hereinafter 'submitter'), the regulations in this section apply. When submitting confidential business information, you must use a good-faith effort to designate, by use of appropriate markings, at the time of submission or at a reasonable time thereafter, any portions of your submission that you consider to be exempt from disclosure under FOIA Exemption 4, 5 U.S.C. 552(b)(4). Your designation will expire ten years after the date of submission unless you request, and provide justification for, a longer designation period.

(b) Notice to submitters. Whenever you designate confidential business information as provided in paragraph (a) of this section, or the Board has reason to believe that your submission may contain confidential business information, we will provide you with prompt written notice of a FOIA request that seeks your business information. The notice shall:

(1) Give you an opportunity to object to disclosure of your information, in whole or in part;

(2) Describe the business information requested or include copies of the requested records or record portions containing the information; and

(3) Inform you of the time frame in which you must respond to the notice.

(c) Opportunity to object to disclosure. The Board shall allow you a reasonable time to respond to the notice described in paragraph (b) of this section. If you object to the disclosure of your information, in whole or in part, you must provide us with a detailed written statement of your objection. The statement must specify all grounds for withholding any portion of the information under any FOIA exemption and, when relying on FOIA Exemption 4, it must explain why the information is a trade secret or commercial or financial information that is privileged and confidential. If you fail to respond within the time frame specified in the notice, the Board will conclude that you have no objection to disclosure of your information. The Board will only consider information that we receive within the time frame specified in the notice. Any information provided by a submitter under this subpart may itself be subject to disclosure under the FOIA.

(d) Notice of intent to disclose. The Board will consider your objection and specific grounds for non-disclosure in deciding whether to disclose business information. Whenever the Board decides to disclose business information over your objection, we will provide you with written notice that includes:

(1) A statement of the reasons why each of your bases for withholding were not sustained;

(2) A description of the business information to be disclosed; and

(3) A specified disclosure date, which shall be a reasonable time after the notice.

(e) Exceptions to the notice requirement. The notice requirements of paragraphs (c) and (d) of this section shall not apply if:

(1) The Board determines that the information shall not be disclosed;

(2) The information lawfully has been published or has been officially made available to the public;

(3) Disclosure of the information is required by statute (other than the FOIA) or by a regulation issued in accordance with the requirements of Executive Order 12600;

(4) The designation made by the submitter under paragraph (a) of this section appears obviously frivolous, except that, in such a case, the Board shall, within a reasonable time prior to the date the disclosure will be made, give the submitter written notice of the final decision to disclose the information.

(f) Notice to requesters. Whenever we provide a submitter with the notice described in paragraph (b) of this section, we also will provide notice to the requester that notice and opportunity to object to the disclosure are being provided to the submitter. The Board also must notify the requester when it notifies the submitter of its intent to disclose the requested information, and whenever a submitter files a lawsuit to prevent the disclosure of the information.

[78 FR 66997, Nov. 8, 2013, as amended at 82 FR 34836, July 27, 2017]

§ 1001.10 Fees.

(a) We will charge fees that recoup the full allowable direct costs we incur in processing your FOIA request. Fees may be charged for search, review or duplication. As a matter of administrative discretion, the Board may release records without charge or at a reduced rate whenever the Board determines that the interest of the United States government would be served. We will use the most efficient and least costly methods to comply with your request. The Board may charge for search time even if no records are located or the records located are exempt from disclosure. If the Board fails to comply with the FOIA's time limits in which to respond to a request, it may not charge search fees, unless the circumstances outlined in paragraph (o) of this section are met.

(b) With regard to manual searches for records, we will charge the salary rate(s) (calculated as the basic rate of pay plus 16 percent of that basic rate to cover benefits) of the employee(s) performing the search.

(c) In calculating charges for computer searches for records, we will charge at the actual direct cost of providing the service, including the cost of operating computers and other electronic equipment, such as photocopiers and scanners, directly attributable to searching for records potentially responsive to your FOIA request and the portion of the salary of the operators/programmers performing the search.

(d) We may only charge requesters seeking documents for commercial use for time spent reviewing records to determine whether they are exempt from mandatory disclosure. Charges may be assessed only for the initial review—that is, the review undertaken the first time we analyze the applicability of a specific exemption to a particular record or portion of a record. Records or portions of records withheld in full under an exemption that is subsequently determined not to apply may be reviewed again to determine the applicability of other exemptions not previously considered. We may assess the costs for such subsequent review. No charge will be made for review at the administrative appeal stage of exemptions applied at the initial review stage.

(e) Records will be duplicated at a rate of $.10 per page, except that the Board may adjust this rate from time to time by rule published in the Federal Register. For copies prepared by computer, such as tapes, CDs, DVDs, or printouts, we will charge the actual cost, including operator time, of production. For other methods of reproduction or duplication, we will charge the actual direct costs of producing the document(s). If we estimate that duplication charges are likely to exceed $25, we will notify you of the estimated amount of fees, unless you indicated in advance your willingness to pay fees as high as those anticipated. Our notice will offer you an opportunity to confer with Board personnel to reformulate the request to meet your needs at a lower cost. If the Board notifies you that the actual or estimated fees are in excess of $25.00, your request will not be considered received and further work will not be completed until you commit in writing to pay the actual or estimated total fee, or designate some amount of fees you are willing to pay, or in the case of a noncommercial use requester who has not yet been provided with your statutory entitlements, you designate that you seek only that which can be provided by the statutory entitlements. The Board's FOIA Officer or Public Liaison are available to assist you in reformulating your request to meet your needs at a lower cost.

(f) We will charge you the full costs of providing you with the following services:

(1) Certifying that records are true copies; or

(2) Sending records by special methods such as express mail.

(g) We may assess interest charges on an unpaid bill starting on the 31st calendar day following the day on which the billing was sent. Interest shall be at the rate prescribed in 31 U.S.C. 3717 and will accrue from the date of the billing until payment is received by the Board.

(h) We will not charge a search fee for requests by educational institutions, non-commercial scientific institutions, or representatives of the news media. A search fee will be charged for a commercial use request.

(i) The Board will not charge duplication fees for requests by educational institutions, non-commercial scientific institutions, or representatives of the news media for a non-commercial use request if the agency fails to comply with the FOIA's time limits in which to respond to a request.

(j) Except for a commercial use request, we will not charge you for the first 100 pages of duplication and the first two hours of search.

(k) You may not file multiple requests, each seeking portions of a document or documents, solely for the purpose of avoiding payment of fees. When the Board reasonably believes that a requester, or a group of requesters acting in concert, has submitted requests that constitute a single request involving clearly related matters, we may aggregate those requests and charge accordingly.

(l) We may not require you to make payment before we begin work to satisfy the request or to continue work on a request, unless:

(1) We estimate or determine that the allowable charges that you may be required to pay are likely to exceed $250; or

(2) You have previously failed to pay a fee charged within 30 calendar days of the date of billing.

(m) In cases in which the Board requires advance payment, the request will not be considered received and further work will not be completed until the required payment is received. If you do not pay the advance payment within 30 calendar days after the date of the Board's fee determination, the request will be closed.

(n) Upon written request, we may waive or reduce fees that are otherwise chargeable under this part. If you request a waiver or reduction in fees, you must demonstrate that a waiver or reduction in fees is in the public interest because disclosure of the requested records is likely to contribute significantly to the public understanding of the operations or activities of the government and is not primarily in your commercial interest. After processing, actual fees must exceed $25, for the Board to require payment of fees.

(o) If the Board has determined that unusual circumstances, as defined by the FOIA, apply and more than 5,000 pages are necessary to respond to the request, the Board may charge search fees, or, in the case of requesters described in paragraph (h) of this section, may charge duplication fees, if the following steps are taken. The Board must have provided timely written notice of unusual circumstances to the requester in accordance with the FOIA and the agency must have discussed with the requester via written mail, email, or telephone (or made not less than three good-faith attempts to do so) how the requester could effectively limit the scope of the request in accordance with 5 U.S.C. 552(a)(6)(B)(ii). If this exception is satisfied, the Board may charge all applicable fees incurred in the processing of the request.

[82 FR 34847, July 27, 2017]

§ 1001.11 Other rights and services.

Nothing in this subpart shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under the FOIA.

[82 FR 34837, July 27, 2017]

§ 1002.1 Purpose and scope.

The regulations in this part implement the provisions of the Privacy Act.

§ 1002.2 Definitions.

The following terms used in this part are defined in the Privacy Act: Individual, maintain, record, system of records, statistical record, and routine use. The following definitions also apply in this part:

Board means the Privacy and Civil Liberties Oversight Board, established by the Implementing Recommendations of the 9/11 Commission Act of 2007, Pub. L. 110-53.

Chairman means the Chairman of the Board, as appointed by the President and confirmed by the Senate under section 801(a) of the Implementing Recommendations of the 9/11 Commission Act of 2007, Pub. L. 110-53, or any person to whom the Board has delegated authority in the matter concerned.

General Counsel means the Board's principal legal advisor, or his or her designee.

Privacy Act means the Privacy Act of 1974, 5 U.S.C. 552a, as amended.

Privacy Act Officer means the person designated by the Board to be responsible for the day-to-day administration of the Privacy Act.

§ 1002.3 Privacy Act requests.

(a) Requests to determine if you are the subject of a record. You may request that the Board inform you if we maintain a system of records that contains records about you. Your request must follow the procedures described in paragraph (b) of this section.

(b) Requests for access. You may request access to a Board record about you in writing or by appearing in person. You should direct your request to the Privacy Act Officer. Written requests may be sent to: Privacy Act Officer, Privacy and Civil Liberties Oversight Board, 2100 K Street NW., Suite 500, Washington, DC 20427. Your request should include the following information:

(1) Your name, address, and telephone number;

(2) The system(s) of records in which the requested information is contained; and

(3) At your option, authorization for copying expenses.

(4) Written requests. In addition to the information described in paragraphs (b)(1) through (3) of this section, written requests must include a statement affirming your identity, signed by you and witnessed by two persons (including witnesses' addresses) or notarized.

(i) Witnessed. If your statement is witnessed, it must include a sentence above the witnesses' signatures attesting that they personally know you or that you have provided satisfactory proof of your identity.

(ii) Notarized. If your statement is notarized, you must provide the notary with adequate proof of your identity in the form of a drivers' license, passport, or other identification acceptable to the notary.

(iii) The Board, in its discretion, may require additional proof of identification depending on the nature and sensitivity of the records in the system of records.

(iv) For the quickest possible handling, your letter and envelope should be marked “Privacy Act Request”.

(5) In person requests. In addition to the information described in paragraphs (b)(1) through (3) of this section, if you make your request in person, you must provide adequate proof of identification at the time of your request. Adequate proof of identification includes a valid drivers' license, valid passport, or other current identification that includes your address and photograph.

(c) Requests for amendment or correction of records. You may request an amendment to or correction of a record about you in person or by writing to the Privacy Act Officer following the procedures described in paragraph (b) of this section. Your request for amendment or correction should identify each particular record at issue, state the amendment or correction sought, and describe why the record is not accurate, relevant, timely, or complete.

(d) Requests for an accounting of disclosures. Except for those disclosures for which the Privacy Act does not require an accounting, you may request an accounting of any disclosure by the Board of a record about you. Your request for an accounting of disclosures must be made in writing following the procedures described in subsection (b) of this section.

(e) Requests for access on behalf of someone else. (1) If you are making a request on behalf of someone else, your request must include a statement from that individual verifying his or her identity, as provided in paragraph (b)(4) of this section. Your request also must include a statement certifying that individual's agreement that records about him or her may be released to you.

(2) If you are the parent or guardian of the individual to whom the requested record pertains, or the individual to whom the record pertains has been deemed incompetent by a court, your request for access to records about that individual must include:

(i) The identity of the individual who is the subject of the record, including his or her name, current address, and date and place of birth;

(ii) Verification of your identity in accordance with paragraph (b)(4) of this section;

(iii) Verification that you are the subject's parent or guardian, which may be established by a copy of the subject's birth certificate identifying you as his or her parent, or a court order establishing you as guardian; and

(iv) A statement certifying that you are making the request on the subject's behalf.

§ 1002.4 Responses to Privacy Act requests.

(a) Acknowledgement. The Privacy Act Officer shall provide you with a written acknowledgment of your written request under section 3 within ten business days of our receipt of your request.

(b) Grants of requests. If you make your request in person, the Privacy Act Officer shall respond to your request directly, either by granting you access to the requested records, upon payment of any applicable fee and with a written record of the grant of your request and receipt of the records, or by informing you when a response may be expected. If you are accompanied by another person, you must authorize in writing any discussion of the records in the presence of the third person. If your request is in writing, the Privacy Act Officer shall provide you with written notice of the Board's decision to grant your request and the amount of any applicable fee. The Privacy Act Officer shall disclose the records to you promptly, upon payment of any applicable fee.

(c) Denials of requests in whole or in part. The Privacy Act Officer shall notify you in writing of his or her determination to deny, in whole or in part, your request. This writing shall include the following information:

(1) The name and title or position of the person responsible for the denial;

(2) A brief statement of the reason for the denial(s), including any applicable Privacy Act exemption;

(3) A statement that you may appeal the denial and a brief description of the requirements for appeal under § 1002.5.

(d) Request for records not covered by the Privacy Act or subject to Privacy Act exemption. If the Privacy Act Officer determines that a requested record is not subject to the Privacy Act or the records are subject to Privacy Act exemption, your request will be processed in accordance with the Board's Freedom of Information Act procedures at 6 CFR part 1001.

§ 1002.5 Administrative appeals.

Appeal procedures.

(1) You may appeal any decision by the Board to deny, in whole or in part, your request under § 1002.3 no later than 60 days after the decision is rendered.

(2) Your appeal must be in writing, sent to the General Counsel at the address specified in § 1002.3(b) and contain the following information:

(i) Your name;

(ii) Description of the record(s) at issue;

(iii) The system of records in which the record(s) is contained;

(iv) A statement of why your request should be granted.

(3) The General Counsel shall determine whether to uphold or reverse the initial determination within 30 working days of our receipt of your appeal. The General Counsel shall notify you of his or her decision, including a brief statement of the reasons for the decision, in writing. The General Counsel's decision will be the final action of the Board.

(b) Statement of disagreement. If your appeal of our determination related to your request for amendment or correction is denied in whole or in part, you may file a Statement of Disagreement that states the basis for your disagreement with the denial. Statements of Disagreement must be concise and must clearly identify each part of any record that is disputed. The Privacy Act Officer will place your Statement of Disagreement in the system of records in which the disputed record is maintained and shall mark the disputed record to indicate that a Statement of Disagreement has been filed and where it may be found.

(c) Notification of amendment, correction, or disagreement. Within 30 working days of the amendment or correction of a record, the Privacy Act Officer shall notify all persons, organizations, or agencies to which the Board previously disclosed the record, if an accounting of that disclosure was made, that the record has been corrected or amended. If you filed a Statement of Disagreement, the Privacy Act Officer shall append a copy of it to the disputed record whenever it is disclosed and also may append a concise statement of its reason(s) for denying the request to amend or correct the record.

§ 1002.6 Fees.

We will not charge a fee for search or review of records requested under this part, or for the correction of records. If you request copies of records, we may charge a fee of $.10 per page.

§ 1002.7 Penalties.

Any person who makes a false statement in connection with any request for a record or an amendment or correction thereto under this part is subject to the penalties prescribed in 18 U.S.C. 494 and 495 and 5 U.S.C. 552a(i)(3).

§ 1003.1 Purpose and scope.

(a) The regulations in this part implement the provisions of the Sunshine Act.

(b) Requests for all records other than those described in § 1003.9, shall be governed by the Board's Freedom of Information Act procedures at 6 CFR part 1001.

§ 1003.2 Definitions.

The following definitions apply in this part:

Board means the Privacy and Civil Liberties Oversight Board, established by the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53.

Chairman means the Chairman of the Board, as appointed by the President and confirmed by the Senate under section 801(a) of the Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53, or any person to whom the Board delegated authority in the matter concerned.

General Counsel means the Board's principal legal advisor, or his or her designee.

Meeting means the deliberations of three or more Board members that determine or result in the joint conduct or disposition of official Board business. A meeting does not include:

(1) Notational voting or similar consideration of business for the purpose of recording votes, whether by circulation of material to members' individually in writing or by a polling of the members individually by phone.

(2) Action by three or more members to:

(i) Open or close a meeting or to release or withhold information pursuant to section 1003.6 of this part;

(ii) Set an agenda for a proposed meeting;

(iii) Call a meeting on less than seven days' notice, as permitted by § 1003.4; or

(iv) Change the subject matter or the determination to open or to close a publicly announced meeting under § 1003.7.

(3) A session attended by three or more members for the purpose of having the Board's staff or expert consultants, another federal agency, or other persons or organizations brief or otherwise provide information to the Board concerning any matters within the purview of the Board, provided that the members do not engage in deliberations that determine or result in the joint conduct or disposition of official business on such matters.

(4) A gathering of members for the purpose of holding informal, preliminary discussions or exchanges of views which do not effectively predetermine official action.

Member means an individual duly appointed and confirmed to the Board.

Public observation means attendance by the public at a meeting of the Board, but does not include public participation.

Public participation means the presentation or discussion of information, raising of questions, or other manner of involvement in a meeting of the Board by the public in a manner that contributes to the disposition of official Board business.

Sunshine Act means the Government in the Sunshine Act, 5 U.S.C. 552b.

§ 1003.3 Open meetings.

(a) Except as otherwise provided in this part, every portion of a Board meeting shall be open to public observation.

(b) Board meetings, or portions thereof, shall be open to public participation when an announcement to that effect is published under § 1003.4. Public participation shall be conducted in an orderly, non-disruptive manner and in accordance with any procedures the Chairman may establish. Public participation may be terminated for good cause as determined by the Board upon the advice of the General Counsel based on unanticipated developments.

§ 1003.4 Procedures for public announcement of meetings.

(a) Except as otherwise provided in this section, the Board shall make a public announcement at least seven days prior to a meeting. The public announcement shall include:

(1) The time and place of the meeting;

(2) The subject matter of the meeting;

(3) Whether the meeting is to be open, closed, or portions of a meeting will be closed;

(4) Whether public participation will be allowed;

(5) The name and telephone number of the person who will respond to requests for information about the meeting;

(b) The seven day prior notice required by paragraph (a) of this section may be reduced only if:

(1) A majority of all members determine by recorded vote that Board business requires that such meeting be scheduled in less than seven days; and

(2) The public announcement required by this section is made at the earliest practicable time.

(c) When a meeting has been called by the Chairman, the notice shall contain such agenda items as the Chairman designates. The notice shall be circulated to Members in advance of publication and Members, by majority vote, may add additional agenda items.

(d) When a meeting is called by a majority of Members, the notice shall contain such agenda items as have been approved by a majority of the Board.

(e) The Executive Director will ensure that the final agenda for the meeting conforms to the notice published in the Federal Register.

(f) If public notice is provided by means other than publication in the Federal Register, notice will be promptly submitted to the Federal Register for publication.

[78 FR 67002, Nov. 8, 2013, as amended at 82 FR 34838, July 27, 2017]

§ 1003.5 Grounds on which meetings may be closed or information withheld.

A meeting, or portion thereof, may be closed and information pertinent to such meeting withheld if the Board determines that the meeting or release of information is likely to disclose matters that are:

(a) Specifically authorized under criteria established by an executive order to be kept secret in the interests of national defense or foreign policy; and, in fact, are properly classified pursuant to such executive order. In making the determination that this exemption applies, the Board shall rely on the classification assigned to the document or assigned to the information from the federal agency from which the document was received.

(b) Related solely to the internal personnel rules and practices of the Board;

(c) Specifically exempt from disclosure by statute (other than 5 U.S.C. 552), provided that such statute:

(1) Requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue; or

(2) Establishes particular criteria for withholding or refers to particular types of matters to be withheld;

(d) Trade secrets and commercial or financial information obtained from a person and privileged or confidential;

(e) Involved with accusing any person of a crime or formally censuring any person;

(f) Of a personal nature, if disclosure would constitute a clearly unwarranted invasion of personal privacy;

(g) Either investigatory records compiled for law enforcement purposes or information which, if written, would be contained in such records, but only to the extent that the production of records or information would:

(1) Interfere with enforcement proceedings;

(2) Deprive a person of a right to either a fair trial or an impartial adjudication;

(3) Constitute an unwarranted invasion of personal privacy;

(4) Disclose the identity of a confidential source or sources and, in the case of a record compiled either by a criminal law enforcement authority or by an agency conducting a lawful national security intelligence investigation, confidential information furnished only by the confidential source(s);

(5) Disclose investigative techniques and procedures; or

(6) Endanger the life or physical safety of law enforcement personnel;

(h) Contained in or relating to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions;

(i) If prematurely disclosed, likely to significantly frustrate implementation of a proposed action of the Board, except that this subsection shall not apply in any instance where the Board has already disclosed to the public the content or nature of its proposed action or is required by law to make such disclosure on its own initiative prior to taking final action on such proposal; and

(j) Specifically concerned with the Board's issuance of a subpoena, or its participation in a civil action or proceeding, an action in a foreign court or international tribunal, or an arbitration, or the initiation, conduct, or disposition by the Board of a particular case or formal agency adjudication pursuant to the procedures in 5 U.S.C. 554 or otherwise involving a determination on the record after opportunity for a hearing.

§ 1003.6 Procedures for closing meetings or withholding information, and requests by affected persons to close a meeting.

(a) A meeting or portion of a meeting may be closed and information pertaining to a meeting withheld under § 1003.5 only by vote of a majority of members.

(b) A separate vote of the members shall be taken with respect to each meeting or portion of a meeting proposed to be closed and with respect to information which is proposed to be withheld. A single vote may be taken with respect to a series of meetings or portions of a meeting that are proposed to be closed, so long as each meeting or portion thereof in the series involves the same particular matter and is scheduled to be held no more than 30 days after the initial meeting in the series. The vote of each member shall be recorded and no proxies shall be allowed.

(c) A person whose interests may be directly affected by a portion of a meeting may request in writing that the Board close that portion for any of the reasons referred to in § 1003.5(e), (f) and (g). Upon the request of a member, a recorded vote shall be taken whether to close such meeting or portion thereof.

(d) For every meeting closed, the General Counsel shall publicly certify that, in his or her opinion, the meeting may be closed to the public and shall state each relevant basis for closing the meeting. If the General Counsel invokes the bases set forth in § 1003.5(a) or (c), he/she shall rely upon the classification or designation assigned to the information by the originating agency. A copy of such certification, together with a statement by the presiding officer setting forth the time and place of the meeting and the persons present, shall be retained by the Board as part of the transcript, recording, or minutes required by § 1003.8.

§ 1003.7 Changes following public announcement.

(a) The time, place, and agenda items of a meeting following the public announcement described in § 1003.4, or the determination of the Board to open or close a meeting, or a portion thereof, to the public may be changed following public announcement only if:

(1) A majority of all members determine by recorded vote that Board business so requires and that no earlier announcement of the change was possible; and

(2) The Board publicly announces such change and the vote of each member thereon at the earliest practicable time.

(b) Changes to the time, place and agenda items of a meeting called by the Chairman pursuant to § 1003.4(c) must be made with the concurrence of the Chairman, except that when Members have, by majority vote, added additional agenda items, the addition of those agenda items does not require the Chairman's concurrence.

[82 FR 34838, July 27, 2017]

§ 1003.8 Transcripts, recordings, or minutes of closed meetings.

Along with the General Counsel's certification and presiding officer's statement referred to in § 1003.6(d), the Board shall maintain a complete transcript or electronic recording adequate to record fully the proceedings of each meeting, or a portion thereof, closed to the public. Alternatively, for any meeting closed pursuant to § 1003.5(h) or (j), the Board may maintain a set of minutes adequate to record fully the proceedings, including a description of each of the views expressed on any item and the record of any roll call vote.

§ 1003.9 Public availability and retention of transcripts, recordings, and minutes, and applicable fees.

(a) The Board shall make available, in a place easily accessible, such as www.pclob.gov, to the public the transcript, electronic recording, or minutes of a meeting, except for items of discussion or testimony related to matters the Board determines may be withheld under § 1003.6.

(b) Copies of the nonexempt portions of the transcripts or minutes shall be provided upon receipt of the actual costs of the transcription or duplication.

(c) The Board shall maintain meeting transcripts, recordings, or minutes of each meeting closed to the public for a period ending at the later of two years following the date of the meeting, or one year after the conclusion of any Board proceeding with respect to the closed meeting.