Your office manager's security-plan review is on the calendar this week. A senior title may belong to someone who left, or a revision may sit on the log with no 90-day date. The owner question of whether you need a plan is settled elsewhere.
What 172.802(c) and (d) ask the office to keep current
Under 49 CFR 172.802(c), the written plan includes the transportation security risk assessment. The plan is retained while it remains in effect and is reviewed at least annually. The plan is "revised and/or updated as necessary to reflect changing circumstances."
The dated log is what shows the plan still matches the plant. A senior title that left, or a gate you dropped last spring, is the finding the log should catch. Keep every copy "as of the date of the most recent revision." The shop binder and the office file share that one revision date.
Under 172.802(d), after a revision the current copy is the one reachable at or through your principal place of business. You make that copy "available upon request, at a reasonable time and location," to an authorized official of DOT or DHS.
Name the senior manager by job title
Section 172.802(b)(1) calls for this line. "Identification by job title of the senior management official responsible for overall development and implementation of the security plan." The 172.802(b)(1) line is a job title printed on the plan. Match the title to the person in the seat this week, and fix a title that left. Fix two titles when both claim the plan.
Section 172.802(b)(2) calls for duties for each job that implements the plan or a portion of it. The same paragraph calls for a process that tells those employees when a plan element must be implemented. Write those duties next to real jobs at your plant. Name who holds the plant keys, who clears a covered new hire, and who opens the bulkhead after hours.
Checks that can make a plan out of date
The yearly review is the minimum. Between reviews, check plant changes against the written risk assessment. The security-plans page lists new drivers, a new truck, a moved plant, a new product, or a new security manager. The page says each of those "can make a plan out of date before the year is up."
On the annual pass, read personnel security against how you confirm what applicants report for covered jobs. The same pass reads unauthorized access against who can reach a transport conveyance being prepared for a load. En route security on that pass is checked against the path from your plant to the customer tank. As a recommended office practice, put any gap on the revision log the same day you find it.
As a recommended habit from our security-plans page, keep a quiet-year log line: "If nothing changed, write "No changes" and sign it anyway." Initial that line with the review date. A blank year on the sheet is the gap, even when the trucks stayed put. The annual review itself is the 172.802(c) duty; the "No changes" wording is how we suggest you prove you looked.
Portions of the plan and notice of an update
Employees who implement the plan get the most recent version, or the portions they implement. Under 172.802(c), need-to-know access stays "consistent with personnel security clearance or background investigation restrictions and a demonstrated need to know." Keep the full risk assessment with the senior title, and other jobs get only the portion that job uses. When the plan is updated or revised, 172.802(c) requires notice to every employee who implements it. Hand over the new portion and put the new revision date in that notice. The rule sets no notice deadline; as a recommended office practice, send the notice the same day the revision is signed so the crew is not still on the old pages.
Tie in-depth security training to the revision date
Section 172.802(b)(3) calls for a plan to train hazmat employees under 172.704(a)(4) and (a)(5). In-depth security training under 172.704(a)(5) covers a hazmat employee who handles hazardous materials the plan covers. In-depth training also covers an employee who performs a regulated function tied to those materials, or who implements the plan. The class is about the security plan and how the company carries it out.
Recurrent in-depth training under 172.704(c)(2) comes at least once every three years. If the plan is revised during that cycle, in-depth training is due "within 90 days of implementation of the revised plan." Calendar that 90-day clock the same day the revision is signed.
You decide who owns the file and who schedules the class before the review line is written. A Policies and Procedures manual names who owns the company safety policy, by name and title, and how you document employee training. You get one intake form for a written DOT security plan. That form lists "Your plant, your trucks, your keys and gates, your hiring steps, your routes."
Keep the training record beside the plan so the revision date and the class date sit in one office file. Both dates should be visible without a second search through old email. Monday, open the plan and write the review date and one change or a no-change initial. If the page changed, that same line also gets the 90-day in-depth date.
Common questions
Who initials the security-plan review when nothing changed?
Have the office manager initial the review date and a no-change line when the plant is the same. Under 172.802(c), the plan must be reviewed at least annually. You still own the file if that job is vacant on review day.
Which employees should get a portion of the hazmat security plan?
Write each job next to the portion that job needs. Under 172.802(c), the most recent version, or portions of it, must be available to employees who implement it, consistent with need-to-know restrictions. Confirm that list still matches the jobs working this week.
Who belongs on the in-depth list when the security plan changes?
Write the names of the hazmat employees who must take in-depth security training for that revision. Under 172.704(c)(2), if the plan is revised during the three-year cycle, in-depth training is due within 90 days of implementation of the revised plan. The list holds the names and a due date.
Sources
- U.S. Government Publishing Office (GovInfo), 49 CFR § 172.802 Components of a security plan (CFR title 49 vol. 2), Date on granule: 2025-10-01 — www.govinfo.gov
- U.S. Government Publishing Office (GovInfo), 49 CFR § 172.704 Training requirements (CFR title 49 vol. 2), Date on granule: 2025-10-01. (a)(5) and (c)(2) match eCFR versioner XML for 2026-09-09. That versioner note adds 91 FR 1446, Jan. 14, 2026; this GovInfo granule's note stops at 80 FR 72923, Nov. 23, 2015. eCFR HTML returned empty this run. — www.govinfo.gov
- Cornell Law School Legal Information Institute, 49 CFR § 172.802 Components of a security plan, corroboration; (c) writing/retain/annual/revise/need-to-know/notify; (d) principal place + DOT/DHS — www.law.cornell.edu
- Cornell Law School Legal Information Institute, 49 CFR § 172.704 Training requirements, last-modified 2026-09-09; corroboration only; amendment note includes 91 FR 1446, Jan. 14, 2026 — www.law.cornell.edu
This page is general information for propane marketers in the United States. It is not legal advice and it does not certify compliance. Confirm the current rule text, your state's adopted code, and your insurer's requirements before you rely on any example here.
Propane Safety Pro writes the written programs linked above, built to how your company actually runs. Call 610-228-0887 and ask for the written program. We sell to propane companies, not homeowners.