RM.10_Authority_Safety_and_Security_Plan.pdf

California High-Speed Rail Authority PLAN-1004, Revision 8 2023-01-06 Page 1 of 105

CALIFORNIA HIGH-SPEED RAIL

AUTHORITY

PLAN

PLAN-1004

TITLE: Safety and Security Management Plan

2023-01-06 Page 2 of 105

TABLE OF CONTENTS

1 MANAGEMENT COMMITMENT AND PHILOSOPHY

1.1 SAFETY AND SECURITY POLICY STATEMENT

1.2 BACKGROUND

1.3 PURPOSE OF THE SAFETY AND SECURITY MANAGEMENT PLAN

1.4 APPLICABILITY AND SCOPE OF SAFETY AND SECURITY MANAGEMENT PLAN

1.5 SAFETY AND SECURITY MANAGEMENT PLAN GOALS AND OBJECTIVES

1.6 SAFETY AND SECURITY MANAGEMENT PLAN REVIEW AND UPDATES

1.7 SAFETY AND SECURITY MANAGEMENT PLAN APPLICABILITY TO THIRD PARTIES

1.8 SYSTEM SAFETY PROGRAM PLAN AND SECURITY PROGRAM PLAN

2 SAFETY AND SECURITY INTEGRATION INTO THE PROGRAM DEVELOPMENT

PROCESS

2.1 SAFETY AND SECURITY ACTIVITIES

2.2 PROCEDURES AND RESOURCES

2.3 INTERFACING WITH MANAGEMENT

2.4 PROCEDURES FOR MANAGING SENSITIVE SECURITY INFORMATION

3 SAFETY AND SECURITY RESPONSIBILITIES

3.1 ROLES AND RESPONSIBILITIES

3.2 AUTHORITY ORGANIZATION

3.3 RAIL DELIVERY PARTNER (RDP), PROGRAM DELIVERY SUPPORT (PDS) ORGANIZATIONS AND RAIL SYSTEMS

ENGINEERING SERVICES (RSES)

3.4 CONTRACT/PROCUREMENT SAFETY AND SECURITY

3.5 COMMITTEE STRUCTURE

3.6 SAFETY AND SECURITY RESPONSIBILITIES MATRIX

4 HAZARD MANAGEMENT

4.1 OVERVIEW

4.2 RISK-BASED SAFETY HAZARD MANAGEMENT

4.3 SECURITY RISK ASSESSMENT PROCESS

4.4 VERIFICATION AND VALIDATION DOCUMENTATION

5 DEVELOPMENT OF SAFETY AND SECURITY DESIGN CRITERIA

5.1 PREVENTION THROUGH DESIGN

5.2 DESIGN CRITERIA

5.3 DESIGN REVIEWS

5.4 DEVIATIONS AND CHANGES

6 OPERATIONS AND MAINTENANCE

6.1 OPERATIONS AND MAINTENANCE REQUIREMENTS

6.2 OPERATIONAL PLANS, RULES, AND PROCEDURES

6.3 TRAINING PROGRAM

6.4 EMERGENCY PREPAREDNESS

6.5 PUBLIC AWARENESS ACTIVITIES

7 SAFETY AND SECURITY CERTIFICATION PROGRAM

7.1 OVERVIEW

7.2 RESPONSIBILITIES

7.3 SAFETY AND SECURITY CERTIFICATION PROCESS

8 CONSTRUCTION SAFETY AND SECURITY

8.1 OVERVIEW

2023-01-06 Page 3 of 105

8.2 PROGRAM ELEMENTS

8.3 CONSTRUCTION RISK MANAGEMENT

9 STATE SAFETY OVERSIGHT REGULATIONS

9.1 Applicability……………………………………………………………………………...96

10 COORDINATION WITH FEDERAL RAILROAD ADMINISTRATION

10.1 ACTIVITIES

10.2 IMPLEMENTATION

10.3 COORDINATION PROCESS

11 DEPARTMENT OF HOMELAND SECURITY COORDINATION

Figures

Figure 3-1 Program Organization for Safety and Security Activities Figure 4-1 The Common Safety Method Process Figure 4-2 Security Risk Assessment Process Figure 4-3 Scenario Development Figure 4-4 Security Risk Worksheet Example Figure 6-1 CIL (Sample) Figure 6-2 Certificate of Conformance (Sample)

Tables

Table 2-1 Project Safety and Security Activities Matrix Table 3-1 Safety and Security Responsibilities Matrix Table 4-1 Hazard Severity Categories Table 4-2 Hazard Frequency Categories Table 4-3 Risk Assessment Matrix Table 4-4 Risk Acceptance Matrix Table 4-5 Disproportion Factors for Risk Table 4-6 Threat Category Examples Table 4-7 General Crime Categories and Examples Table 4-8 Threat or Attack Types Examples Table 4-9 Threat Rating Matrix (Intent x Capability) Table 4-10 Threat Rating and Definitions Table 4-11 Vulnerability Levels and Description Table 4-12 Likelihood Determination Matrix (Threat x Vulnerability) Table 4-13 Likelihood Rating and Definitions Table 4-14 Consequence Ratings and Assessment Criteria Table 4-15 Security Risk Rating Matrix (Likelihood x Consequence) Table 4-16 Security Risk Index

TERMS AND DEFINITIONS

2023-01-06 Page 4 of 105

Term Definition

ALARP As Low as Reasonably Practicable

ANSI American National Standards Institute

AREMA American Railway Engineering and Maintenance-of-Way Association

ARHRAM Adjacent Railroad Hazard Risk Assessment Model

ATC Automatic Train Control

Authority California High-Speed Rail Authority

CAPs Corrective Action Plans

CFR Code of Federal Regulations

CIL Certifiable Items List

CPUC California Public Utilities Commission

CPTED Crime Prevention Through Environmental Design

CSM Common Safety Method

DF Disproportionate Factor

DHS Department of Homeland Security

DOORS Dynamic Object-Oriented Requirements Management System (Verification and Validation database)

DOT Department of Transportation

EMP Emergency Management Plan

EOS Early Operating Segment: Merced to Bakersfield

ETO Early Train Operator

FLSSC Fire and Life Safety and Security Committee

FMEA Failure Mode Effects Analysis

FRA Federal Railroad Administration

2023-01-06 Page 5 of 105

Term Definition

FTA Federal Transit Administration

FTAn Fault Tree Analysis

FCS First Construction Segment: Madera to Poplar Ave.

IED Improvised Explosive Device

IHA Interface Hazard Analysis

ISO International Organization for Standardization

JHA Job Hazard Assessment

MTTHE Mean Time to Hazardous Event

OCS Overhead Contact System

OHA Operating Hazard Analysis

OSHA Occupational Safety and Health Administration

PBIED Person-borne Improvised Explosive Device

PCM Project Construction Management

PDS Program Delivery Support

PHA Preliminary Hazard Analysis

PMP Program Management Plan

Program Refers to all staff (Authority, RDP/PDS/RSES, and subcontractors), propert,y, and systems

PTEPP Passenger Train Emergency Preparedness Plan

RAM Reliability Availability Maintainability

RC Regional Consultants

RDP Rail Delivery Partner. This role is expected to expire on December 31, 2023.

RSES Rail Systems Engineering Services

2023-01-06 Page 6 of 105

Term Definition

SHA Software Hazard Analysis

SHEA Software Hazard Effects Analysis

SiSHA Site-Specific Hazard Analysis

SiSTVA Site-Specific Threat and Vulnerability Assessment

SONO Statement of No Objection

SPP Security Program Plan

SSC Safety and Security Certification

SSOC Safety and Security Oversight Committee

SSHASP Site-Specific Health and Safety Plan

SSI Sensitive Security Information

SSMP Safety and Security Management Plan

SSPP System Safety Program Plan

SSSP Site-Specific Security Plan

TVA Threat and Vulnerability Assessment

TSA Transportation Security Administration

2023-01-06 Page 7 of 105

1 MANAGEMENT COMMITMENT AND PHILOSOPHY

1.1 Safety and Security Policy Statement

1.2 Background

The Federal Railroad Administration (FRA) requires the California High-Speed Rail Authority (Authority) to implement safety and security principles and processes throughout the development and operation of the Program. The FRA uses Federal Transit Administration (FTA) regulations found in the 49 Code of Federal Regulations https://ecfr.io/Title-49/pt49.7.633

2023-01-06 Page 8 of 105

(CFR) Part 633, which requires the development of a Program Management Plan (PMP) for every major capital transit project. As described in FTA circular 5800.1 – Safety and Security Management Guidance for Major Capital Projects (dated 8/1/07), a Safety and Security Management Plan (SSMP) is the element of the PMP that manages project safety and security activities, responsibilities, and verification processes throughout the project life cycle. The SSMP fulfills one of the FRA requirements for managing safety and security in the development and operation of the Program.

The SSMP does not carry over into revenue operations. However, it does lay the groundwork and requirements for the development of a System Safety Program Plan (SSPP), Security Program Plan (SPP), and Emergency Management Plan (EMP) to govern safety and security for the operating system prior to the start of revenue service.

The FRA has regulations that require the application of an SSPP to inter-city passenger railroad operations.

1.3 Purpose of The Safety and Security Management Plan

The SSMP formalizes management principles and strategies for determining safety and security identification and risk acceptance from the design stage through the start of revenue service. The SSMP defines the process for identifying, evaluating, and resolving safety hazards and security vulnerabilities associated with future railroad operations of the system prior to the start of revenue service. This process helps achieve the highest practical level of operational safety and security for the riding public, employees, and anyone coming into contact with the Program.

The purpose of the SSMP is to define the safety and security activities of the Program and methods for identifying, evaluating, and resolving potential safety hazards and security vulnerabilities. It establishes responsibility and accountability for safety and security during Preliminary Engineering, Final design (Ready for Construction), construction, testing, trial operations, and start-up stages of Program development.

Specifically, the SSMP:

• Establishes the Authority’s commitment and philosophy to achieve the highest practical level of safety and security for the Authority’s staff, the Authority’s integrated team that includes Program Delivery Support (PDS), Rail Systems Engineering Support (RSES), and Rail Delivery Partner (RDP) staff, contractors, emergency responders, and members of the public who come into contact with the Program;

• Establishes processes for managing safety and security activities intended to minimize the risk of injury and property damage and to maximize safety and security for Program passengers, employees, and the public;

https://ecfr.io/Title-49/pt49.7.633 https://www.transit.dot.gov/regulations-and-guidance/fta-circulars/safety-and-security-management-guidance-major-capital https://www.transit.dot.gov/regulations-and-guidance/fta-circulars/safety-and-security-management-guidance-major-capital

2023-01-06 Page 9 of 105

• Integrates safety and security functions and activities throughout the Program and its organizational structure;

• Defines safety and security roles and responsibilities and required committees across the Program, including between the Authority and Program design, construction, and start-up teams;

• Defines the processes for documenting and certifying the design, construction, testing, and start-up stages of the program;

• Evaluates project stages and activities to ensure continued development and advancement of safety and security principles; and

• Establishes the framework for construction and operational safety and security.

1.4 Scope and Applicability

The SSMP applies to all stages of Program development, from preliminary engineering through final design, construction, testing, and start-up stages. The SSMP encompasses all equipment, infrastructure, operation, and maintenance plans and procedures associated with the Program.

1.4.1 Project Description

The Program is constructing a state-of-the-art, statewide, high-speed performance passenger railroad based on operating practices and designs of existing high-speed rail networks in Europe and Asia that have had extraordinary performance and safety records. The Program requires certification by federal agencies. These agencies have indicated they are open to approaches that provide equivalent or better safety than existing rail regulations in the United States. The Authority’s objective is to develop a system of more than 800 route-miles that provides electrified high-speed rail service between the major metropolitan centers within the San Francisco Bay Area and Sacramento in the north, through the Central Valley, to Los Angeles, Anaheim, and San Diego in the south.

1.4.1.1 Dedicated and Blended Corridor

Authority trains will operate at speeds up to 220 mph within its dedicated corridors where the Program has sole use of a track, and up to 125 mph in shared-use/blended conditions with other rail carriers. No hazardous materials will be transported or permitted to be transported on Authority trains or by others on Authority-dedicated tracks. However, blended corridors may include freight that could carry hazardous materials on adjacent tracks.

2023-01-06 Page 10 of 105

The SSMP applies to both the dedicated and blended corridors. However, the application of the SSMP in the blended corridor is contingent on the Authority’s level of control over blended corridor infrastructure and/or operating conditions.

1.4.1.2 System Technology and Hazard Response

Authority service will use high-speed steel-wheel on steel-rail technology, which has been service-proven in Asia and Europe and provides a high level of safety, comfort, and reliability. The system will operate on standard gage track with electric trains powered using an overhead contact system (OCS). The right-of-way will make use of tunneling and elevated structures to achieve an ideal alignment and profile. Automotive, animal, other railroad, and non-railroad equipment crossings will be accomplished using an underpass or overpass, except in portions of the blended corridor.

The system will include an Automatic Train Control (ATC) system based on designs for similar high-speed environments in Europe and Asia, modified only where necessary to meet regulatory requirements and functional and performance needs specific to the Program. The ATC system will cover all functions of a train control system, including both safety-critical and non-safety-critical operations, and will incorporate Positive Train Control in compliance with 49 CFR Part 236. A hazard detection system will be applied throughout the System, where supported by hazard analysis, to alert the operating control center of events that warrant a system response. Hazards may result from natural events such as seismic activity, excessive wind speeds, high water levels, and excessive ambient temperature levels that trigger a system response, and other events such as vehicle or rail car intrusion and trespassers.

1.4.2 Staged Implementation

Although preliminary engineering stage activities occur simultaneously for the entire system, due to the size of the eventual system, final design and construction stage activities are being developed in stages per geographic segments. The First Construction Segment (FCS) will encompass three construction packages covering 119 miles between Madera and Popular Ave north of Shafter. The Board-adopted 2022 Business Plan includes extensions south to Bakersfield and north to Merced, where passengers will transfer to and from regional and inter-city rail services. The Authority is presently working to develop agreements with other State and Regional agencies to provide initial revenue operations on this Early Operating Segment. The SSMP has been developed with processes that will ensure conformance to system safety goals and requirements throughout the life cycle of the Program and while various segments are under different development stages simultaneously.

https://ecfr.io/Title-49/cfr236_main

2023-01-06 Page 11 of 105

1.4.3 Safety and Security Management Plan Scope

This SSMP encompasses the following equipment, facilities, plans, and procedures as they relate to the system:

• System-Wide Elements − includes passenger vehicles; train control and signaling; voice and data communications; closed-circuit television cameras and recorders; OCS; traction power substations; track; and auxiliary vehicles and equipment.

• Fixed Facilities − includes rail stations; pedestrian overpasses and underpasses; highway overpasses and underpasses; aerial and other elevated structures; below-grade structures and tunnels; operations and maintenance facilities including storage yards, shops, and sidings;

administrative facilities; and the central control facility.

• Safety and Security Plans and Procedures − includes items such as Safety and Security Certification (SSC) Plan, Safety and Security related Design Criteria, Passenger Train Emergency Preparedness Plan (PTEPP), SSPP, SPP, and EMP.

Procedures and Instructions − includes items such as hazard management, operations, and maintenance plans and procedures; rulebooks and manuals;

and training programs for operating, maintenance, and management employees; employee qualifications; contractor training; and emergency responder training.

1.5 Safety and Security Management Plan Goals and Objectives

1.5.1 Goals

The goals of the SSMP are as follows:

• Ensure the system initiated into revenue service is safe and secure for passengers, employees, emergency response personnel, and the general public through a formal safety and security hazard management program.

• Ensure the design, procurement, construction, fabrication, installation, inspection, and testing of critical elements of the Program will be verified and validated for conformance, through federally mandated certification, with the established safety and security requirements to achieve an acceptable level of safety and security.

• Ensure a mechanism is in place for the resolution of any restriction to full safety and security certification.

• Ensure development and implementation of a Construction Safety and Security Program that provides appropriate safeguards during all Authority

2023-01-06 Page 12 of 105 work activities against injuries to employees and the public, damage to property and the environment, as well as minimizes security breaches.

• Achieve a level of risk that is acceptable to the Authority through a systematic approach to hazard and threat/vulnerabilities management.

1.5.2 Objectives

The SSMP goals will be achieved by meeting the following objectives:

• Identifying, evaluating, resolving, and documenting safety hazards and security vulnerabilities at the earliest possible project stage of Program development, applying the Prevention through Design principle where possible;

• Continue as needed to establish specific safety and security requirements for the Program based on applicable safety and security regulations, codes, standards, guidelines, and recognized domestic and international best practices;

• Certifying that all Program facilities, systems, and equipment have been designed, built, procured, installed, inspected, and tested in accordance with identified safety and security requirements, prior to the start of revenue operations;

• Providing oversight of each contractor’s construction safety and security program by monitoring contractor adherence to all program, contractual, local, state, and federal regulations and requirements, including established construction safety and security requirements and the California Occupational Safety and Health Administrative safety regulations for construction projects;

• Establishing a program for completing the training of personnel who will respond to emergencies, including Program personnel and emergency responders, on the Program emergency procedures, equipment, and operations;

• Establishing and documenting the qualifications and training programs for all personnel who will operate and maintain the Program in revenue service;

• Conducting and documenting emergency exercises and drills prior to the start of revenue service;

• Documenting safety, security, and emergency rules and procedures for Program employees, staff, and contractors in the form of rulebooks, standard operating procedures, emergency operating procedures, and other documents;

• Maintaining a process to manage and track open safety and security issues resulting from design deviations, change orders, and non-conformances from inception through closure and acceptance;

2023-01-06 Page 13 of 105

• Documenting final Safety and Security Certification for each Program element under consideration by means of a Final Safety and Security Certification Report to the FRA prior to placing that element into revenue service; and

• Ensuring compliance and coordination with the FRA, California Public Utilities Commission (CPUC), the Transportation Security Administration (TSA), the Office of the State Fire Marshal, and other external agencies as applicable.

1.6 Safety and Security Management Plan Review and Updates

The SSMP is reviewed at least annually, whenever the PMP or other reference documents are modified, and following any SSMP audit to ensure the safety and security management program remains current and applicable. If revised, the SSMP is re-issued to all SSMP recipients. The SSMP is updated to reflect changes in the Program, the Authority’s organizational makeup, and/or the safety and security management program requirements. The Authority is responsible for the review and update process with oversight and coordination from the Director of System Safety and Security.

FRA has developed regulations for inter-city passenger rail system safety programs, codified under 49 CFR Part 270. This SSMP is written to be in conformance with 49 CFR Part 270 Final Rule, effective May 4, 2020, and supports the implementation of an

SSPP.

1.7 Safety and Security Management Plan Applicability to Third Parties

The safety and security requirements for third-party assets (e.g., adjacent infrastructure or operations, shared-use corridors, utility interfaces, etc.) are developed following the safety and security management program of the applicable third party but in conformance to the processes and requirements of this SSMP. Safety and security certification of third-party elements conforms to the third party’s (SSC Program) requirements and Section 7 of this SSMP.

1.8 System Safety Program Plan and Security Program Plan

An SSPP will be developed prior to the start of revenue operations. The SSPP will comply with all FRA and other applicable regulatory requirements and will be appropriate in scope and content to manage the safety program’s transition from the project to an operating system.

An SPP will also be developed prior to the start of revenue operations. The SPP will comply with all Department of Homeland Security (DHS) and other applicable regulatory https://ecfr.io/Title-49/pt49.4.270

2023-01-06 Page 14 of 105 requirements and will be appropriate in scope and content to manage the security program’s transition from the project to an operating system.

2023-01-06 Page 15 of 105

2 SAFETY AND SECURITY INTEGRATION INTO THE PROGRAM

DEVELOPMENT PROCESS

2.1 Safety and Security Activities

This section describes the Safety and Security activities that have been or will be performed during major stages of the project. A list of basic activities and desired milestone goals are presented in Table 2-1.

The Program has seven stages:

• Stage 1 – Project Initiation

• Stage 2 - Identify Preferred Alternative and Begin Preliminary Design

• Stage 3 - Environmental Clearance, Prepare for Pre-Construction and

Generate Configuration Footprint

• Stage 4 – Early Works and Right-of-Way- Acquisition

• Stage 5 – Procurement for Construction

• Stage 6 – Construction, Testing and Commissioning

• Stage 7 – Project Closeout

Although preliminary engineering stage activities occur simultaneously for the entire system, the Final design and Construction stage activities are developed in stages per geographic segments, due to the size of the eventual system. The SSMP is developed with processes that will ensure conformance to system safety goals and requirements throughout the life cycle of the Program and while various segments are simultaneously under different development stages.

Within each stage of the Program, activities are evaluated to determine the safety and security-related certification actions expected to be accomplished at each project milestone. The Authority applies a detailed and thorough SSC Program. The SSC Program, as described in Section 7.4 of this SSMP, ensures that the project achieves all safety and security requirements in design criteria and specifications and that the safety and security contents of the plans, procedures, and training materials are systematically reviewed and revised as required.

Leading up to and through the preliminary engineering stage of the project, Safety and Security activities encompass the following:

• Develop the SSMP, including a process for achieving safety and security certification, to meet all FRA requirements for an SSMP in a major capital project, and in conformance with the FTA’s Circular 5800.1 Safety and Security Management guidance for Major Capital Projects.

2023-01-06 Page 16 of 105

• Specify safety and security certification requirements, in conformance with the process identified in the Program Safety and Security Management Plan, in contract documents. Safety and security certification requirements will be included in the scope of work for the design/build contractors during the final design and construction stages of the project.

• Maintain the certification tracking system

• Perform a PHA (Preliminary Hazard Analysis) and a TVA (Threat and

Vulnerability Assessment) to identify certifiable elements and hazards/vulnerabilities requiring mitigation. Identify hazard/vulnerability mitigation from the PHA and TVA to incorporate into Preliminary engineering and Final design and construction. Perform additional analysis as required.

• Continue to develop safety and security conformance checklists, known as Certifiable Items Lists (CILs). The tracking system will be an integrated subset of the Verification and Validation program applied throughout the Program.

2023-01-06 Page 17 of 105

Table 2-1 Project Safety and Security Activities Matrix

2023-01-06 Page 18 of 105

2.2 Procedures and Resources

2.2.1 Procedures

A Program Management Plan (PLAN-PD-01) for the system was prepared that establishes the framework for managing and administering all activities related to implementation of the system and provides guidance for the coordination of activities.

The PMP identifies the RDP primary responsibilities include: providing program and project management technical expertise and leadership, including Commercial Oversight, Engineering, Environmental, Capital Planning, Sustainability, Rail Development and Operations, Risk Management, Program Baseline Development, Configuration Management, Program Development, and Program and Project Controls;

delivering administrative and technical support in other areas, including Finance, Communications, IT, Safety, Quality, Document Control, and other functional tasks, as requested; managing program implementation, strategy development, and policy formulation; and providing the staffing and resources necessary for program and headquarters project management.

A major component of the PMP, is this SSMP, describing processes for identifying and managing hazards and vulnerabilities associated with the Program. The Authority is responsible for ensuring the management of identified safety hazards and security threats, and vulnerabilities is effective and integrated throughout the design, construction, testing, and startup stages of the Program.

The Verification and Validation process is applied throughout the Program to track and verify that critical elements are incorporated into all project stages. Critical elements include safety-critical and security-critical elements as identified through the hazard management processes described in this SSMP.

2.2.2 Resources

The Authority Chief Executive Officer (CEO) authorizes the SSMP, ensuring it is applied throughout the Program. The Chief Operating Officer (COO) administers and oversees the implementation of the SSMP through the Director of Systems Safety and Security (DSSS). The Authority provides additional safety and security management resources for executing system safety and security activities during the Preliminary engineering stage. Further resources and responsibilities will be identified as the system progresses into later stages, culminating in startup and commissioning.

The budget and schedule for implementation of the SSMP is revised each year and is managed by the Program DSSS. This assures the requirements of the SSMP are being executed by the Authority and supported by the Program and other contractors during https://calhsr.sharepoint.com/sites/theterminal/pp/PLAN-PD-01_Program_Management_Plan.pdf

2023-01-06 Page 19 of 105 the Preliminary engineering stage and in subsequent stages of the project. This includes, but is not limited to: 1) the performance of safety analyses and security assessments at the appropriate stages of the project; 2) implementation of a SSC Program beginning at preliminary engineering and continuing through each subsequent stage of the project; 3) a process to ensure that safety issues and security concerns are addressed and tracked to resolution; and, 4) construction safety oversight activities, as appropriate to the construction stages and contracts underway at the time.

2.3 Interfacing with Management

The Authority CEO, through the Authority COO, has the ultimate decision-making authority for Program safety and security issues and is responsible for communicating safety and security issues to the Authority Board of Directors. See the Organizational Chart in Appendix A. The DSSS directly oversees the overall implementation of the safety and security program and reports the progress and challenges in its implementation to the Safety and Security Oversight Committee (SSOC). The SSOC communicates safety and security issues to the Authority executive management.

Successful implementation of the SSMP also requires significant interaction between various members of the Authority and its integrated team, Contractors, RC, Engineering/Construction Managers, and Emergency Response Agencies. These interactions occur during regularly scheduled meetings of the SSOC, that focus on the safety and security aspects of the system.

2.4 Procedures for Managing Sensitive Security Information

Sensitive Security Information (SSI) is information about security, operations, facilities, or other assets or capital projects whose disclosure would be detrimental to the security of transit employees or customers. By law, transit agencies are required to categorize and protect SSI. Protecting SSI means restricting its distribution and controlling access to it. Currently, there are three types of SSI that apply to transit agencies:

Security programs and contingency plans issued, established, required, received, or approved by DOT (Department of Transportation) or DHS.

Vulnerability assessments that are directed, created, held, funded, or approved by DOT or DHS, or that will be provided to either agency in support of Federal security program.

Threat information held by the federal government concerning transportation, transportation systems, and cyber infrastructure, including sources and methods used to gather or develop the information.

2023-01-06 Page 20 of 105

By law, SSI is not subject to disclosure under the Freedom of Information Act (FOIA) or state “Sunshine Laws.” It is also not available under discovery in civil litigation, and it is not required to be part of the record in a federal rulemaking. The FTA developed the “Sensitive Security Information (SSI): Designation, Markings, and Control” resource document for transit agencies that covers how to identify, mark, store, control, transmit, destroy, and manage the release or withholding of SSI. It covers SSI in every form in which it is stored, including paper, electronic, magnetic, and other media. It also contains the minimum standards for employees and contractors to mark, store, control, transmit, and destroy SSI. Project managers must follow the resource document to ensure SSI is being handled correctly.

To protect SSI, the Authority has implemented the following business practices:

Information Assessment and Categorization: The Authority has designated the COO as the position responsible for implementing the SSI business practices. The COO will assess the documentation and determine what information is SSI.

Proper Labeling of SSI: SSI will be clearly labeled in order to inform users of SSI as to the security sensitive nature of the information. The notice will appear on the top of every page of a document containing SSI. All SSI electronic files will be password protected.

Limitation of Access: Only the Authority’s program staff with a “need to know” may have access to SSI. The Authority’s COO or designee will be responsible for identifying those persons with a “need to know”.

Storage of SSI: The COO designee will be responsible for storing SSI. A lockable file cabinet located in the admin office will be designated and labeled as SSI for paper records. All SSI will be stored in the SSI file cabinet.

3 SAFETY AND SECURITY RESPONSIBILITIES

3.1 Roles and Responsibilities

The DSSS, under the direction of the Authority COO, administers and oversees the implementation and activities of the Safety and Security Program. See Safety and Security Organizational Chart in Appendix A. The Authority’s primary vehicle for

2023-01-06 Page 21 of 105 oversight of the safety and security activities is a tiered organization of safety and security committees (explained in detail in Section 3.3).

The FRA has granted California High-Speed Rail lead agency status for the Federal Environmental Impact Statement. The FRA is also the primary regulatory agency responsible for approving and certifying the system safety and security aspects of the Program. At the state level, the CPUC has regulatory authority over rail safety. The California Office of the State Fire Marshal has regulatory authority over the fire and life safety aspects of the occupied structures, including right-of-way access ingress/egress facilities.

The Program and System Safety and Security Managers and staff will support the DSSS in the application of safety and security in all aspects and stages of the project coordinating with the Program Deputy Directors, Discipline Managers, and Regional Managers. This support will ensure that other individual project staff members perform in accordance with the SSMP in establishing and overseeing the safety and security management tasks. The Program’s primary vehicle for input to and support of the safety and security activities is the SSOC (explained in detail in Section 3.3.2).

Staff members assigned to the Program by the Authority, contractors, consultants, emergency response agencies, FRA, and CPUC are responsible for ensuring that the design, construction, installation, and testing of all safety-critical and security-critical system elements of the system are evaluated for conformance with the safety and security requirements and verified for operational readiness before completing each stage of the project.

Refer to Figure 3-1 for the Program organizational chart for safety and security activities. This SSMP is updated to reflect any significant changes in the organizational structure or definition of responsibilities with respect to safety and security in the Program.

2023-01-06 Page 22 of 105

Figure 3-1 Program Organization for Safety and Security Activities

3.2 Authority Organization

The Authority has a core staff, supported by contract with private consulting firms (the RDP/PDS, RSES, ETO (Early Train Operator), Regional Consultants, and other specialty firms) to carry out the project’s system safety and security programs, environmental studies, project planning and engineering work under the supervision and guidance of Authority staff. The Authority’s COO is responsible for safety and security activities, reporting directly to the CEO.

The project organization will remain in place throughout the Program development process; however, the composition of the project organization may be revised to respond appropriately to the changing project needs as the project proceeds through from the Preliminary engineering stage through to the start of revenue service. The Authority’s project organization during the initial project stages is comprised of the Authority’s integrated team and staff supplemented by Regional Consultant staff. In each stage, the Authority will use the assistance of the its integrated team to manage project-related activities, as well as further assistance from professional engineering and other project management consulting firms. The current Authority organization is shown in Appendix A.

3.2.1 Authority Chief Executive Officer (CEO)

The Authority CEO oversees and directs the management of all Authority staff and the integrated team. The day-to-day management of the development activities for the

FIRE/LIFE SAFETY &

SECURITY COMMITTEE

(SYSTEM)

AUTHORITY

EXECUTIVE STAFF

SAFETY & SECURITY

OVERSIGHT

COMMITTEE

REGIONAL FIRE/LIFE

SAFETY & SECURITY

COMMITTEE

(REGION)

2023-01-06 Page 23 of 105

Program is the functional responsibility of the Authority COO under the direction of the Authority CEO.

3.2.2 Authority Director of Risk Management and Project Controls

The Authority Director of Risk Management and Project Controls reports directly to the Authority Board of Directors and CEO and is responsible for identifying, managing, and tracking risks and risk mitigation/contingencies. Their duties also include maintaining the risk management tool and documentation information, leading risk identification sessions for the project, monitoring prime contractor risk management efforts, and participating in risk management activities for risks that cross project boundaries or are beyond the project’s control. Additional responsibilities from the Enterprise Risk Management (ERM) Plan: is responsible for developing and implementing the ERM program, promoting, and supporting our risk-aware culture, establishing a dynamic, agile enterprise-wide risk management strategy to guide decision making across the organization. In addition, the DRM is responsible for operationalizing the ERM Program

3.2.3 Authority Chief Operating Officer (COO)

The Authority’s COO ensures that Authority resources are allocated to meet the SSMP goals and objectives, and is ultimately responsible for execution of the Safety and Security Management Plan through the Director of System Safety and Security. The Authority COO reports to the Authority CEO.

3.3 Rail Delivery Partner (RDP),Program Delivery Support (PDS) and Rail Systems Engineering (RSES) Organizations

The Authority has engaged the RDP, PDS and RSES to assist with the Authority’s delivery management. As an integrated member of the Authority’s staff, the RDP, PDS and RSES organizations each provides technical expertise, advice, and support to the Authority with regards to safety and security.

3.3.1 Director of System Safety and Security (DSSS)

The DSSS reports directly to the Authority COO and is responsible for identifying, managing and tracking risks and risk mitigation/contingencies, and all responsibilities related to safety and security management on the project. Their duties also include maintaining the risk management tool and documentation information, leading risk identification sessions for the project, monitoring prime Contractor risk management efforts, and participating in risk management activities for risks that cross project boundaries or are beyond the project’s control. The DSSS chairs the SSOC and reports its activities to HSRA executive management. The active management of all safety and security efforts and personnel for the project are the responsibility of the DSSS.

2023-01-06 Page 24 of 105

The DSSS has the responsibility for, but is not limited to, the following:

• Provides senior level leadership, expertise, and vision to assist in the development of a safety and security culture for the program;

• Ensures the Safety and Security team performs hazard management of Program elements and design criteria to determine any potential hazards that may be created by system development, expansion or modification, and supporting the development of mitigating and controlling factors to address such hazards;

• Participates in project design reviews, including overseeing and administering the SSC Program;

• Ensures monitoring compliance regarding construction site safety and security program wide;

• Partners with the Authority’s engineering, operations and maintenance staff to ensure the system is being designed to meet all safety and security criteria;

• Fulfills a key advisory role to the Authority executive management SSOC;

• Directs the Authority’s outreach efforts to local, regional, and State emergency response agencies;

• Ensures SSMP requirements and processes are being implemented and

SSMP goals and objectives are being achieved;

• Oversight of the Authority’s safety and security activities;

• Develops corrective action plans that result from accident/incident investigations, hazard analyses, certification of CILs, and safety and security reviews and audits;

• Tracks corrective actions through closeout to ensure all identified deficiencies are adequately mitigated or controlled;

• Reviews the Authority decision for Contractor’s safety submittals;

• Investigates accidents and incidents on behalf of the Authority;

• Reports unacceptable hazardous conditions to executive management as soon as possible;

• Fulfills the role of Chair for the statewide Fire and Life Safety and Security

Committees (FLSSCs); and

• Performs other safety-related activities as requested by the Authority.

3.3.2 System Safety Manager

The System Safety Manager will support the implementation and completion of all safety activities associated with the development of the Program. The System Safety Manager will coordinate safety activities and sits on the SSOC, and FLSSCs as requested. The System Safety Manager’s role on the Committees is to ensure that safety is not compromised by other priorities of the design and construction teams.

2023-01-06 Page 25 of 105

The System Safety Manager has the responsibility for, but is not limited to, the following:

• Performs hazard management of the Authority elements and design criteria to determine any potential hazards that may be created by system development, expansion or modification, and supporting the development of mitigating and controlling factors to address such hazards;

• Participates in project design reviews,;

• Partners with the Authority’s engineering, operations and maintenance staff to ensure the system is being designed in accordance with the safety and security criteria;

• Fulfills the role of Coordinator for the SSOC, and the statewide and regional FLSSCs;

• Supports Authority outreach efforts to local, regional, and State emergency response agencies; and

• Performs other safety-related activities as requested by the Authority.

3.3.3 System Security Manager

The System Security Manager will support the implementation and completion of all security activities associated with development of the Program. The System Security Manager will coordinate security activities and sit on the SSOC, and FLSSCs, as requested. The Security Manager’s role on each Committee is to ensure security requirements are not compromised by other priorities of the design and construction teams.

The System Security Manager has the responsibility for, but is not limited to, the following:

• Performs threat and vulnerability assessments of Program operating environments and design criteria to determine any potential vulnerabilities that may be created by system development, expansion or modification, and supporting the development of mitigating and controlling factors to address such vulnerabilities;

• Participates in the project design reviews;

• Partners with the Authority’s engineering, operations and maintenance staff to ensure that the system is being designed in accordance with the safety and security criteria;

• Supports Authority outreach efforts to local, regional, and State emergency response agencies and law enforcement agencies; and

• Performs other security-related activities as requested by the Authority.

2023-01-06 Page 26 of 105

3.3.4 Construction Program Safety Manager

The Construction Program Safety Manager (CPSM) will support the Director Systems Safety and Security (DSSS) and Project Delivery and is responsible for construction safety monitoring and oversight activities related to the Program. The CPSM has the responsibility and accountability to develop, make recommendations, and implement new and current safety programs for construction related to the Program and the Authority its consultants.

The CPSM has the responsibility for, but is not limited to, the following:

• Provides senior level leadership, expertise, and vision to assist in the development of a safety culture for the construction stage of the program;

• Develops, makes recommendations for improvement, and implements existing and new safety programs and processes;

• Integrates teams and provides training for Authority and consultant staff;

• Reviews future contracts and makes recommendations regarding construction program safety;

• Coordinates construction safety meetings amongst PCM (Project

Construction Management) and DB projects;

• Monitors compliance and provides recommendations regarding construction site safety program wide;

• Responds to incidents and coordinates the Authority’s response while working with the PCMs and DB contractors;

• Monitors and tracks reported observations, incidents, and other field data to provide recommendations regarding continuous improvement for safe program delivery;

• Coordinate safety and security management of state-owned properties with the Authority’s Real Property branch: and

• Recommends staffing levels and manages field support staff.

3.3.5 Safety and Security Certification Manager

The Safety and Security Certification Manager will support the Director of System Safety and Security in the implementation and completion of all safety and security certification activities associated with the development of the Program. The Safety and Security Certification Manager will coordinate safety and security certification responsibilities with the PCMs and Design Builders as required by the respective contracts. The Safety and Security Certification Manager’s role on the Safety and Security Oversight Committee is to ensure that safety and security certification is not compromised by other priorities of the design and construction teams.

2023-01-06 Page 27 of 105

The Safety and Security Certification Manager has the responsibility for, but is not limited to, the following:

• Oversight and administration of the Safety and Security Certification Program system wide;

• Fulfilling the 100% technical review requirements of the Safety and Security Certification packages submitted by the design-builders, and recommending dispositions in accordance with contract requirements;

• Developing and proposing Records of Decision (ROD) for approval through the SSOC;

• Working with Authority’s engineering, operations and maintenance, PCM staff and other disciplines to ensure the system is being designed to meet the safety and security criteria set forth in the design criteria manual, and constructed in conformance with the design;

• Supporting Authority outreach efforts to local, regional, and State emergency response agencies; and

• Performing other safety-related activities as requested by the Authority.

3.3.6 Other Authority and Rail Delivery Partner/ Program Delivery Support Managers and Rail System Engineering

The managers of the following disciplines are responsible for implementing SSMP requirements and process in their respective areas, participating in the SSOC, and supporting the Program Safety Director and designees, as required:

• Engineering, including Infrastructure and Systems;

• Operations and Maintenance;

• Rolling Stock;

• Integration and Regulatory Approvals;

• Project Risk;

• Contracts and Procurement;

• Environmental;

• Right of Way;

• Verification and Validation; and

• Early Train Operator.

The large number of disciplines and players involved in implementing safety protocols as well as preparing required plans and meeting other regulatory requirements underscores the importance of effective coordination among all parties throughout the process. The Authority may direct additions and changes to this list as necessary.

2023-01-06 Page 28 of 105

3.4 Contract/Procurement Safety and Security

The complexity of the Program necessitates varied approaches to design and construction for project elements such as infrastructure, rolling stock, track, and systems. All procurements for project elements, regardless of the procurement type, contain safety and security requirements that support the safety and security program of the Program. All contractors will be required to manage their programs pursuant to the hazard management approach and certification contained within the Authority’s SSMP and other safety and security requirements, such as the Design Criteria Manual Chapter

5. Each contractor has the responsibility to provide employees, visitors, and the public with a safe and healthy environment and must demonstrate that effective mitigations are in place to reduce the risk of injury, illness, and incidents on each project site.

3.5 Committee Structure

Chapter two of the PMP describes the function of various project committees. In addition, safety and security committees listed below have been established to facilitate the review of issues and to provide a forum for discussion and resolution.

3.5.1 Safety and Security Oversight Committee

Working at the project delivery level, the (SSOC) ensures the Program is designed, built, and implemented in a safe and secure manner. The SSOC will achieve this goal by overseeing the application of the SSMP through all stages of Program development.

This includes informing and assuring Authority executive management of safety and security issues affecting the project.

The SSOC addresses safety and security issues assigned to it by the Authority’s executive management. If unable to resolve an issue, the committee will elevate it to Program Delivery or back to the Authority’s executive management for directed resolution. The SSOC will provide the final review and acceptance of all Statements of No Objection (SONO) for Safety and Security Certifications.

The duties and responsibilities of the SSOC are as follows:

• Review revisions and updates to the SSMP and forward for Executive Management approval;

• Oversee the application of the SSMP through all Program development project stages;

• Provide regular updates of safety and security activities to the Authority’s executive management;

2023-01-06 Page 29 of 105

• Forward any safety and security items that cannot be approved at the SSOC level to Communication, Legal, or any appropriate department, and Chief Operating Officer for approval;

• Review the final Safety and Security Certification of Conformance Report for each project stage;

• Review and discuss construction field safety and security…