text:
s. 21

#### Baggage Handling Systems

**No change without agreement**

**282** If the operator of an aerodrome is responsible for a baggage handling system, the operator must not make any change to the system that may affect screening operations unless the change is agreed to by CATSA.
> SOR/2012-48, s. 15

**DIVISION 6**
### Access Controls

#### Overview

**Division overview**

**283** This Division sets out the regulatory framework for the protection of security-sensitive areas of aerodromes.

#### Signs

**Sign requirements**

**284**

- **(1)** The operator of an aerodrome must post signs on the outside of each restricted area access point and each security barrier. Each sign must
	- **(a)** be in at least both official languages;
	- **(b)** identify the restricted area as a restricted area; and
	- **(c)** state that access to the area is restricted to authorized persons.

**Signs on security barriers**

- **(2)** The signs posted on a security barrier must be no more than 150 m apart.

#### Restricted Area Access Points

**Access control system**

**285** The operator of an aerodrome must ensure that each restricted area access point that allows access from a non-restricted area to a restricted area has an access control system consisting of one or more of the following elements:
- **(a)** surveillance by a person authorized by the operator of the aerodrome to control access to the restricted area;
- **(b)** manual locking equipment; and
- **(c)** automated access control equipment.
> SOR/2012-48, s. 16

**Passenger loading bridge**

**286** The operator of an aerodrome must ensure that each restricted area access point that is located between an air terminal building and a passenger loading bridge has a door that can be locked.
> SOR/2012-48, s. 16

**Prohibition**

**287** A person must not enter a restricted area at an aerodrome except through a restricted area access point.

#### Baggage Handling Systems

**Prevention of unauthorized access**

**288** The operator of an aerodrome must take measures to prevent unauthorized access to a baggage handling system that is in a restricted area.
> SOR/2012-48, s. 17

#### Doors, Gates, Emergency Exits and Other Devices

**Duty to close and lock — operators**

**289**

- **(1)** The operator of an aerodrome must close and lock any door, gate or other device, other than an emergency exit, if
	- **(a)** the operator has control of and responsibility for the door, gate or other device; and
	- **(b)** the door, gate or other device allows access between a restricted area and a non-restricted area.

**Emergency exit system**

- **(2)** The operator of an aerodrome must institute a system, on or near an emergency exit, that prevents access by unauthorized persons to a restricted area, if
	- **(a)** the operator has control of and responsibility for the emergency exit; and
	- **(b)** the emergency exit allows access between a restricted area and a non-restricted area.

**Duty to close and lock — partners and lessees**

**290**

- **(1)** A primary security line partner, or a lessee other than a primary security line partner, at an aerodrome must close and lock any door, gate or other device, other than an emergency exit, if
	- **(a)** the partner or lessee has control of and responsibility for the door, gate or other device; and
	- **(b)** the door, gate or other device allows access between a restricted area and a non-restricted area.

**Emergency exit system**

- **(2)** A primary security line partner who occupies an area on an aerodrome’s primary security line must institute a system, on or near an emergency exit, that prevents access by unauthorized persons to a restricted area, if
	- **(a)** the partner has control of and responsibility for the emergency exit; and
	- **(b)** the emergency exit allows access between a restricted area and a non-restricted area.

**Temporary use or control**

**291** Any person at an aerodrome who has temporary use or control of a door, gate or other device that allows access between a restricted area and a non-restricted area must prevent access to or from the restricted area by unauthorized persons.

**Uncontrolled restricted area access point**

**292** Unless an authorized person is controlling access between a restricted area and a non-restricted area at an aerodrome, a person who enters or leaves the restricted area must
- **(a)** lock the door, gate or other device that allows access to or from the restricted area; and
- **(b)** prevent access to or from the restricted area by unauthorized persons while the door, gate or other device is open or unlocked.

**Preventing locking**

**293** A person at an aerodrome must not prevent a door, gate or other device, other than an emergency exit, that allows access between a restricted area and a non-restricted area from being locked.

**Emergency exits**

**294** A person at an aerodrome must not open any door that is designated as an emergency exit and that is also a restricted area access point unless
- **(a)** the person is authorized by the operator of the aerodrome to open it; or
- **(b)** there is an emergency.

#### Unauthorized Access

**Prohibition**

**295**

- **(1)** If a person has been given notice, orally, in writing or by a sign, that access to a part of an aerodrome is prohibited or is limited to authorized persons, the person must not enter or remain in that part of the aerodrome without authorization.

**Restricted areas**

- **(2)** The operator of an aerodrome may authorize a person to enter or remain in a restricted area if the requirements of Divisions 6 to 8 are met.

**Non-public areas other than restricted areas**

- **(3)** The operator of an aerodrome may authorize a person to enter or remain in a part of the aerodrome that is not a public area but is not a restricted area if the safety of the aerodrome, persons at the aerodrome and aircraft is not jeopardized.

**Non-public areas other than restricted areas**

- **(4)** A lessee at an aerodrome who has the use of, or is responsible for, a part of the aerodrome that is not a public area but is not a restricted area may authorize a person to enter or remain in that part of the aerodrome if the safety of the aerodrome, persons at the aerodrome and aircraft is not jeopardized.
> SOR/2014-153, s. 22

#### Inspectors

**Requirement to allow access**

**296** The operator of an aerodrome must allow an inspector to enter or remain in a restricted area if the inspector is acting in the course of their employment and presents their credentials.
> SOR/2012-48, s. 18

**DIVISION 7**
### Documents of Entitlement

**Division overview**

**297** This Division sets out provisions respecting documents of entitlement. Requirements respecting the issue and use of restricted area identity card are set out in Division 8.
> SOR/2012-48, s. 19

**List of documents**

**298**

- **(1)** Only the following documents are documents of entitlement at an aerodrome:
	- **(a)** a restricted area identity card;
	- **(b)** a temporary pass issued by the operator of the aerodrome;
	- **(c)** a boarding pass, a ticket, or any other document accepted by an air carrier that confirms the status of the person to whom it was issued as a passenger on a flight and that is approved by the operator of the aerodrome;
	- **(d)** a passenger escort form that is approved by the operator of the aerodrome;
	- **(e)** a courtesy-lounge or conference-room pass that is issued by an air carrier and that is approved by the operator of the aerodrome; and
	- **(f)** a document that is issued or approved by the operator of the aerodrome in accordance with a security measure.

**Pilot’s licence**

- **(2)** A pilot’s licence issued under the [Canadian Aviation Regulations](/en/Regulations/Statutory%20Orders%20and%20Regulations/96/433.md) is a document of entitlement for a restricted area that is used by general aviation, if the holder of the licence also holds a valid medical certificate of a category that is appropriate for that licence and
	- **(a)** is acting in the course of their employment; or
	- **(b)** requires access to an aircraft that they own or operate.
> SOR/2012-48, s. 19; SOR/2014-153, s. 23

**DIVISION 8**
### Enhanced Access Controls

#### Overview

**Division overview**

**299** This Division sets out enhanced access control requirements, including requirements respecting the identity verification system referred to in section 56.

#### Identity Verification System

**Disclosure of information**

**300**

- **(1)** The operator of an aerodrome is authorized to disclose to the Minister or CATSA any information that is necessary for the proper operation of the identity verification system.

**Identity protection**

- **(2)** Despite subsection (1), the operator of an aerodrome must not disclose to CATSA the identity of an applicant for a restricted area identity card or the identity of a person to whom a restricted area identity card has been issued unless the operator grants CATSA access to its databases to maintain or repair the identity verification system and CATSA’s access to the person’s identity is incidental to the maintenance or repairs.

#### Information To Be Displayed on a Restricted Area Identity Card

**Required information**

**301**

- **(1)** The operator of an aerodrome must ensure that the following information is displayed on each restricted area identity card that it issues:
	- **(a)** the full name of the person to whom the card is issued;
	- **(b)** the person’s height;
	- **(c)** a photograph depicting a frontal view of the person’s face;
	- **(d)** the expiry date of the card;
	- **(e)** the name of the aerodrome where the card is issued;
	- **(f)** the name of the person’s employer, if the person has a single employer;
	- **(g)** the terms “multi-employer” and “employeur multiple”, if the person has more than one employer;
	- **(h)** the person’s occupation, if the person has a single occupation; and
	- **(i)** the terms “multi-occupation” and “emplois multiples”, if the person has more than one occupation.

**Expiration date**

- **(2)** A restricted area identity card expires no later than five years after the day on which it is issued or on the day on which the security clearance of the person to whom the card is issued expires, whichever is earlier.

**Expiration date — multi-aerodrome card**

- **(3)** Despite subsection (2), a restricted area identity card that is issued to a person who requires access to restricted areas at more than one aerodrome, but who is not a crew member, expires no later than one year after the day on which it is issued or on the day on which the person’s security clearance expires, whichever is earlier.

**Official languages**

- **(4)** The operator of an aerodrome must ensure that all information that is displayed on a restricted area identity card is in both official languages.

#### Issuance of Restricted Area Identity Cards

**Issuance criteria**

**302**

- **(1)** The operator of an aerodrome must not issue a restricted area identity card to a person unless the person
	- **(a)** applies in writing;
	- **(b)** is sponsored in writing by their employer;
	- **(c)** has a security clearance;
	- **(d)** consents in writing to the collection, use, retention, disclosure and destruction of information for the purposes of this Division; and
	- **(e)** confirms that the information displayed on the card is correct.

**Activation requirement**

- **(2)** The operator of an aerodrome must not issue a restricted area identity card to a person unless the card has been activated.

**False information**

**303** A person must not provide false information for the purpose of obtaining a restricted area identity card.

**Sponsorship**

**304** An employer must not
- **(a)** sponsor an employee who does not require ongoing access to restricted areas in the course of their employment; or
- **(b)** knowingly sponsor an employee for more than one restricted area identity card at a time.

**Issuance of multiple cards**

**305** The operator of an aerodrome must not issue more than one restricted area identity card at a time to a person.

**Replacement of cards**

**306** Before replacing a lost, stolen or non-functional restricted area identity card, the operator of an aerodrome must ensure that
- **(a)** the person applying for the replacement card is the person to whom the lost, stolen or non-functional card has been issued; and
- **(b)** the person still has a security clearance.

**Requirement to inform**

**307** Before collecting information from an applicant under this Division, the operator of an aerodrome must bring to the applicant’s attention the purposes for which the information is collected and the manner in which the information will be used, retained, disclosed and destroyed.

**Collection of information**

**308**

- **(1)** For the purpose of creating a restricted area identity card for an applicant, the operator of an aerodrome must collect the following information from the applicant:
	- **(a)** the applicant’s full name;
	- **(b)** the applicant’s height;
	- **(c)** a photograph depicting a frontal view of the applicant’s face;
	- **(d)** the applicant’s fingerprint images and iris images;
	- **(e)** the name of the applicant’s employer; and
	- **(f)** the applicant’s occupation.

**Destruction of images and templates**

- **(2)** The operator of the aerodrome must, immediately after issuing the restricted area identity card, destroy all fingerprint images and iris images that the operator collected from the applicant and any biometric template created from those images that is not stored on the card.

**Quality control**

**309** For the purpose of allowing CATSA to monitor the quality of biometric templates and determining if a restricted area identity card is already active in respect of an applicant, the operator of an aerodrome must, before issuing the card, disclose to CATSA any biometric templates created from the fingerprint images and iris images collected from the applicant.

**Protection of information**

**310** The operator of an aerodrome must take appropriate measures to protect information that is collected, used, retained or disclosed in accordance with this Division from loss or theft and from unauthorized access, use, disclosure, duplication or alteration.

#### Deactivation of Restricted Area Identity Cards

**Deactivation request**

**311**

- **(1)** The operator of an aerodrome who has issued a restricted area identity card must immediately ask CATSA to deactivate the card if
	- **(a)** the card expires;
	- **(b)** the person to whom the card has been issued or their employer informs the operator that the card is lost, stolen or no longer functional; or
	- **(c)** the person to whom the card has been issued fails, on demand, to present or surrender the card to a screening officer.

**Reason for deactivation**

- **(1.1)** If the operator of an aerodrome asks CATSA to deactivate a restricted area identity card, the operator must inform CATSA of the reason for the request.

**Prohibition**

- **(2)** The operator of an aerodrome must not ask CATSA to deactivate a restricted area identity card for a reason other than a reason set out in subsection (1).

**Notification of Minister**

- **(3)** The operator of an aerodrome must notify the Minister if the operator asks CATSA to deactivate a restricted area identity card.
> SOR/2014-153, s. 24

**Change in employment**

**312** The operator of an aerodrome who has issued a restricted area identity card must notify the Minister immediately if
- **(a)** in the case of a person who has a single employer, the person to whom the card has been issued ceases to be employed or no longer requires ongoing access to restricted areas in the course of their employment; and
- **(b)** in the case of a person who has more than one employer, the person to whom the card has been issued ceases to be employed by all of their employers or no longer requires ongoing access to restricted areas in the course of their employment.

**Duty of employer**

**313** The employer of a person to whom a restricted area identity card has been issued must immediately notify the operator of an aerodrome who issued the card if the person ceases to be an employee or no longer requires ongoing access to restricted areas in the course of their employment.

**Retrieval of cards**

**314**

- **(1)** The operator of an aerodrome who has issued a restricted area identity card must take reasonable steps to retrieve the card if it has been deactivated and must notify CATSA if the card is not retrieved.

**Return of cards**

- **(2)** If a restricted area identity card has been deactivated, the person to whom the card has been issued must immediately return it to the operator of an aerodrome who issued it unless the card was surrendered in accordance with this Division or was lost or stolen.

#### Keys, Combination Codes and Personal Identification Codes

**Issuance or assignment**

**315** The operator of an aerodrome must not issue a key or assign a combination code or personal identification code to a person for a restricted area unless
- **(a)** the person is a person to whom a restricted area identity card has been issued and the card is active; or
- **(b)** the person is in possession of a document that is issued or approved by the operator of the aerodrome in accordance with a security measure as authorization for the person to enter or remain in the restricted area.

**Addition of key**

**316** The operator of an aerodrome may add a key to a restricted area identity card only if it is possible to cancel or remove the key without damaging or altering any other elements of the card.

**Protection of information**

**317** The operator of an aerodrome must not add to or modify a restricted area identity card in any way that might allow the disclosure to CATSA of information about the person to whom the card has been issued.

**Cancellation, withdrawal or retrieval**

**318** The operator of an aerodrome must cancel, withdraw or retrieve a key that has been issued to a person who has been issued a restricted area identity card, or a combination code or personal identification code that has been assigned to that person, if
- **(a)** the person’s restricted area identity card has been deactivated; or
- **(b)** the person no longer requires ongoing access to the restricted area in the course of their employment.

#### Records

**General requirement**

**319**

- **(1)** The operator of an aerodrome and any person designated by the operator to issue restricted area identity cards or keys or to assign combination codes or personal identification codes must keep updated records at the aerodrome respecting
	- **(a)** restricted area identity cards and keys that have been issued;
	- **(b)** the names of the persons to whom restricted area identity cards or keys have been issued;
	- **(c)** the names of the persons to whom combination codes or personal identification codes have been assigned;
	- **(d)** blank restricted area identity cards in the operator’s possession;
	- **(e)** restricted area identity cards that have been deactivated;
	- **(f)** keys, combination codes or personal identification codes that have been cancelled, withdrawn or retrieved;
	- **(g)** deactivated restricted area identity cards that have not been retrieved by the operator;
	- **(h)** restricted area identity cards that have been reported as lost or stolen;
	- **(i)** steps taken to retrieve deactivated restricted area identity cards; and
	- **(j)** compliance with section 307.

**Deactivated cards**

- **(2)** Subject to subsection (3), a record respecting a restricted area identity card that has been deactivated must be retained for at least one year from the day on which the card was deactivated.

**Lost or stolen cards**

- **(3)** A record respecting a restricted area identity card that has been reported as lost or stolen must be retained for at least one year from the card’s expiry date.

**Provision to Minister**

- **(4)** The operator of the aerodrome must provide the Minister with the records on reasonable notice given by the Minister.

#### Restricted Area Access Control Process

**Use of identity verification system**

**320** The operator of an aerodrome must implement and maintain a restricted area access control process that uses the identity verification system.

#### Control of Access to Restricted Areas

**Unauthorized access prohibition**

**321** A person must not enter or remain in a restricted area unless the person
- **(a)** is a person to whom a restricted area identity card has been issued; or
- **(b)** is in possession of a document of entitlement, other than a restricted area identity card, for the restricted area.
> SOR/2012-48, s. 20

**Restricted area identity cards — conditions of use**

**322**

- **(1)** A person to whom a restricted area identity card has been issued must not enter or remain in a restricted area unless
	- **(a)** they are acting in the course of their employment;
	- **(b)** the card is in their possession;
	- **(c)** the card is active; and
	- **(d)** as applicable, they are in possession of a key that has been issued to them for the restricted area, or a combination code or personal identification code that has been assigned to them for the restricted area.

**Exception**

- **(2)** Paragraph (1)(d) does not apply to crew members.

**Display of restricted area identity cards**

**323**

- **(1)** A person to whom a restricted area identity card has been issued must not enter or remain in a restricted area unless they visibly display the card on their outer clothing at all times.

**Display of temporary passes**

- **(2)** A person to whom a temporary pass has been issued must not enter or remain in a restricted area unless they visibly display the pass on their outer clothing at all times.
> SOR/2014-153, s. 25

**Oversight**

**324** The operator of an aerodrome must ensure that a person is not allowed to enter or remain in a restricted area at the aerodrome unless the person is in possession of
- **(a)** an active restricted area identity card that has been issued to the person; or
- **(b)** a document of entitlement, other than a restricted area identity card, for the restricted area.
> SOR/2012-48, s. 21

#### Business Continuity Plans

**Business continuity plans**

**325**

- **(1)** The operator of an aerodrome must develop and maintain a business continuity plan that, at a minimum, sets out how the operator will re-establish normal operations and comply with section 324 in the event that the operator is unable to use its restricted area access control process to comply with that section.

**Implementation**

- **(2)** The operator of the aerodrome must immediately implement its business continuity plan and notify the Minister and CATSA if the operator discovers that it is unable to use its restricted area access control process to comply with section 324.

**Notification of delay**

- **(3)** The operator of the aerodrome must immediately notify the Minister if the operator discovers that it will be unable, for more than 24 hours, to use its restricted area access control process to comply with section 324.

**Ministerial access**

- **(4)** The operator of the aerodrome must make its business continuity plan available to the Minister on reasonable notice given by the Minister.

**Database backup**

**326** The operator of an aerodrome must regularly back up any database that the operator uses as part of the identity verification system.

#### Use of Restricted Area Identity Cards, Keys, Combination Codes and Personal Identification Codes

**General prohibitions**

**327**

- **(1)** A person must not
	- **(a)** lend or give a restricted area identity card or a key that has been issued to them to another person;
	- **(b)** use a restricted area identity card or a key that has been issued to them to allow access to a restricted area at an aerodrome to another person without authorization from the operator of the aerodrome;
	- **(c)** intentionally alter or otherwise modify a restricted area identity card or a key unless they are the operator of an aerodrome or a person designated by the operator;
	- **(d)** use a restricted area identity card or a key that has been issued to another person;
	- **(e)** have in their possession, without reasonable excuse, a restricted area identity card or a key that has been issued to another person;
	- **(f)** use a counterfeit restricted area identity card or a counterfeit key; or
	- **(g)** make a copy of a restricted area identity card or a key.

**Disclosure or use of codes**

- **(2)** A person, other than the operator of an aerodrome or a person designated by the operator, must not
	- **(a)** disclose a combination code or personal identification code; or
	- **(b)** use another person’s combination code or personal identification code.

**Report of loss or theft**

**328**

- **(1)** A person to whom a restricted area identity card or a key has been issued must immediately report its loss or theft to their employer or to the operator of an aerodrome who issued the card or key.

**Employer’s duty to report**

- **(2)** An employer who is informed by an employee of the loss or theft of a restricted area identity card or a key must immediately report the loss or theft to the operator of an aerodrome who issued the card or key.

**Report of non-functioning card**

**329** An employer who is informed by an employee that a restricted area identity card is not functioning must immediately notify the operator of an aerodrome who issued the card.

**330** [Repealed, SOR/2014-153, s. 26]

#### Presentation and Surrender of Restricted Area Identity Cards

**Presentation on demand**

**331**

- **(1)** A person in possession of a restricted area identity card who is in a restricted area at an aerodrome must, on demand, present the card to the Minister, the operator of the aerodrome, the person’s employer or a peace officer.

**Presentation during screening**

- **(2)** A person in possession of a restricted area identity card who is being screened by a screening officer at a restricted area access point or at a location in a restricted area must, on demand, present the card to the screening officer.

**Surrender on demand**

**332**

- **(1)** A person in possession of a restricted area identity card must, on demand, surrender it to the Minister, the operator of an aerodrome, a screening officer or a peace officer.

**Demand by Minister or operator**

- **(2)** The Minister or the operator of an aerodrome may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen;
	- **(b)** the card has been deactivated; or
	- **(c)** the surrender of the card is required to ensure aviation security.

**Demand by screening officer**

- **(3)** A screening officer may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen;
	- **(b)** the card has been deactivated; or
	- **(c)** the screening officer is carrying out screening at a restricted area access point or at a location in a restricted area and the person who is in possession of the card refuses to be screened or refuses to submit goods in their possession or control for screening.

**Demand by peace officer**

- **(4)** A peace officer may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen; or
	- **(b)** there is an immediate threat to aviation security, the security of any aircraft or aerodrome or other aviation facility or the safety of the public, passengers or crew members, and the surrender of the card is required to respond to the threat.

**Return of cards**

**333** A screening officer or a peace officer to whom a person surrenders a restricted area identity card must return the card to the operator of the aerodrome where the card is surrendered or to the operator of an aerodrome who issued the card.

**Notification of Minister**

**334** The operator of an aerodrome to whom a person surrenders a restricted area identity card must notify the Minister if the operator demanded the surrender in accordance with paragraph 332(2)(c).

#### Escort and Surveillance

**General requirement**

**335**

- **(1)** The operator of an aerodrome must ensure that any person who is in a restricted area at the aerodrome and is not in possession of a restricted area identity card
	- **(a)** is escorted by a person in possession of an active restricted area identity card that has been issued to them; or
	- **(b)** is kept under surveillance by a person in possession of an active restricted area identity card that has been issued to them, in the case of an area the limits of which are defined for a specific purpose, such as construction or maintenance.

**Exceptions**

- **(2)** This section does not apply in respect of the following persons:
	- **(a)** passengers who have been screened; and
	- **(b)** inspectors.

**Escort ratio**

**336**

- **(1)** The operator of an aerodrome must ensure that at least one escort is provided for every 10 persons who require escort.

**Surveillance ratio**

- **(2)** The operator of an aerodrome must ensure that no more than 20 persons at a time are kept under surveillance by one person.

**Requirement to remain together**

**337**

- **(1)** A person under escort must remain with the escort while the person is in a restricted area.

**Idem**

- **(2)** An escort must remain with the person under escort while the person is in a restricted area.

**Requirement to inform**

- **(3)** The person who appoints an escort must inform the escort of the requirement to remain with the person under escort while that person is in a restricted area.

**Screening requirement**

**338** The operator of an aerodrome must ensure that a person under escort or surveillance at the aerodrome and any goods in the person’s possession or control are screened at a screening checkpoint before the person enters a sterile area.

**Exception — conveyances**

**339**

- **(1)** The operator of an aerodrome is not required to place an escort or surveillance personnel in a conveyance that is in a restricted area at the aerodrome and is carrying persons who require escort or surveillance if the conveyance travels in a convoy with an escort conveyance that contains at least one person in possession of an active restricted area identity card that has been issued to them.

**Exception to exception**

- **(2)** The operator of the aerodrome must ensure that, if a person who requires escort or surveillance disembarks from a conveyance in a restricted area at the aerodrome, the person is escorted or kept under surveillance in accordance with section 336.

**Escort conveyances**

**340** The operator of an aerodrome must ensure that, at the aerodrome, at least one escort conveyance is provided for
- **(a)** every three conveyances requiring escort to or from an air terminal building apron area for a purpose other than snow removal operations;
- **(b)** every six conveyances requiring escort to or from an air terminal building apron area for snow removal operations; and
- **(c)** every six conveyances requiring escort to or from a restricted area other than an air terminal building apron area.

#### Inspectors

**Exemption**

**341** Nothing in this Division requires an inspector acting in the course of their employment to be in possession of a restricted area identity card or any other document issued or approved by the operator of an aerodrome as authorization for the inspector to enter or remain in a restricted area.

**Inspector’s credentials**

**342** The credentials issued by the Minister to an inspector do not constitute a restricted area identity card even if the credentials are compatible with the identity verification system or with an access control system established by the operator of an aerodrome.

**Escort privileges**

**343** Nothing in this Division prohibits an inspector from escorting a person who is in a restricted area and is not in possession of a restricted area identity card if the inspector
- **(a)** is acting in the course of their employment;
- **(b)** does not escort more than 10 persons at one time;
- **(c)** remains with the person while the person is in the restricted area;
- **(d)** ensures that the person remains with the inspector while the person is in the restricted area; and
- **(e)** ensures that the person and any goods in their possession or control are screened at a screening checkpoint before the person enters a sterile area.

**Conveyance escort privileges**

**344**

- **(1)** Nothing in this Division prohibits an inspector from escorting a person who is in a conveyance in a restricted area and is not in possession of a restricted area identity card if the inspector
	- **(a)** is acting in the course of their employment;
	- **(b)** does not escort more than 10 persons at one time; and
	- **(c)** is either in the conveyance or in an escort conveyance that is travelling in a convoy with the conveyance.

**Additional conditions**

- **(2)** If a person under escort disembarks from a conveyance in a restricted area, the inspector must
	- **(a)** remain with the person; and
	- **(b)** ensure that the person remains with the inspector.

**Idem**

- **(3)** If a person under escort is travelling to or from an air terminal building apron area, the Minister must ensure that at least one escort conveyance is provided for every three conveyances requiring escort in a convoy and that at least one inspector is in each escort conveyance.

**Idem**

- **(4)** If a person under escort is travelling to or from a restricted area other than an air terminal building apron area, the Minister must ensure that at least one escort conveyance is provided for every six conveyances requiring escort in a convoy and that at least one inspector is in each escort conveyance.

**DIVISION 9**
### Airport Security Programs

#### Overview

**Division overview**

**345** This Division sets out the regulatory framework for promoting a comprehensive, coordinated and integrated approach to airport security. The processes required under this Division are intended to facilitate the establishment and implementation of effective airport security programs that reflect the circumstances of each aerodrome.
> SOR/2014-153, s. 27

#### Interpretation

**Processes and procedures**

**346** For greater certainty, any reference to a process in this Division includes the procedures, if any, that are necessary to implement that process.
> SOR/2014-153, s. 27

#### Airport Security Program Requirements

**Requirement to establish and implement**

**347**

- **(1)** The operator of an aerodrome must establish and implement an airport security program.

**Program requirements**

- **(2)** As part of its airport security program, the operator of an aerodrome must
	- **(a)** define and document the aerodrome-related security roles and responsibilities assigned to each of the operator’s employee groups and contractor groups;
	- **(b)** communicate the information referred to in paragraph (a) to the employees and contractors in those groups;
	- **(c)** have a security policy statement that establishes an overall commitment and direction for aerodrome security and sets out the operator’s security objectives;
	- **(d)** communicate the security policy statement in an accessible manner to all persons who are employed at the aerodrome or who require access to the aerodrome in the course of their employment;
	- **(e)** establish and implement a process for responding to aerodrome-related security incidents and breaches in a coordinated manner that is intended to minimize their impact;
	- **(f)** establish and implement a security awareness program that promotes a culture of security vigilance and awareness among the following persons:
		- **(i)** persons who are employed at the aerodrome,
		- **(ii)** crew members who are based at the aerodrome, and
		- **(iii)** persons, other than crew members, who require access to the aerodrome in the course of their employment;
	- **(g)** assess risk information and disseminate it within the operator’s organization for the purpose of informed decision-making about aviation security;
	- **(h)** establish and implement a process for receiving, retaining, disclosing and disposing of sensitive information respecting aviation security in order to protect the information from unauthorized access;
	- **(i)** identify sensitive information respecting aviation security and receive, retain, disclose and dispose of sensitive information respecting aviation security in a manner that protects the information from unauthorized access;
	- **(j)** disclose sensitive information respecting aviation security to the following persons if they have been assigned aerodrome-related security roles and responsibilities and require the information to carry out those roles and responsibilities:
		- **(i)** persons who are employed at the aerodrome, and
		- **(ii)** persons who require access to the aerodrome in the course of their employment;
	- **(k)** have a current scale map of the aerodrome that identifies all restricted areas, security barriers and restricted area access points; and
	- **(l)** document how the operator achieves compliance with the aviation security provisions of the Act and the regulatory requirements that apply to the operator.

**Other program requirements**

- **(3)** The following also form part of the airport security program:
	- **(a)** the security official referred to in section 270;
	- **(b)** the aerodrome security personnel training referred to in sections 271 and 272;
	- **(c)** the security committee or other working group or forum referred to in section 350;
	- **(d)** if applicable, the multi-agency advisory committee referred to in section 353;
	- **(e)** if applicable, the airport security risk assessment referred to in section 354;
	- **(f)** if applicable, the strategic airport security plan referred to in section 359;
	- **(g)** the menu of additional safeguards referred to in section 365;
	- **(h)** the emergency plan referred to in section 367; and
	- **(i)** the security exercises referred to in sections 368 and 369.
> SOR/2012-48, ss. 22, 65(F); SOR/2014-153, s. 27

**Documentation**

**348**

- **(1)** The operator of an aerodrome must
	- **(a)** keep documentation related to its menu of additional safeguards and any amendment to it for at least five years;
	- **(b)** if applicable, keep documentation related to its airport security risk assessment and any review of it for at least five years;
	- **(c)** if applicable, keep documentation related to its strategic airport security plan and any amendment to it for at least five years; and
	- **(d)** keep all other documentation related to its airport security program for at least two years.

**Ministerial access**

- **(2)** The operator of the aerodrome must make the documentation available to the Minister on reasonable notice given by the Minister.
> SOR/2014-153, s. 27

**Requirement to amend**

**349** The operator of an aerodrome must amend its airport security program if the operator identifies, at the aerodrome, an aviation security risk that is not addressed by the program.
> SOR/2014-153, s. 27

#### Security Committee

**Security committee**

**350**

- **(1)** The operator of an aerodrome must have a security committee or other working group or forum that
	- **(a)** advises the operator on the development of controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator;
	- **(b)** helps coordinate the implementation of the controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator; and
	- **(c)** promotes the sharing of information respecting the airport security program.

**Terms of reference**

- **(2)** The operator of the aerodrome must manage the security committee or other working group or forum in accordance with written terms of reference that
	- **(a)** identify its membership; and
	- **(b)** define the roles and responsibilities of each member.

**Records**

- **(3)** The operator of the aerodrome must keep records of the activities and decisions of the security committee or other working group or forum.
> SOR/2014-153, s. 27

#### Requirements that Apply only if an Amendment to Schedule 2 or a Ministerial Order is made: Multi-agency Advisory Committee; Airport Security Risk Assessments; and Strategic Airport Security Plans

**Application**

**351**

- **(1)** Subject to section 352, sections 353 to 364 apply to the operator of an aerodrome if
	- **(a)** the Governor in Council makes an aviation security regulation adding an asterisk in Schedule 2 after the name of the aerodrome; or
	- **(b)** the Minister makes an order stating that sections 353 to 364 apply to the operator.

**Minister’s authority**

- **(2)** The Minister is authorized to make orders stating that sections 353 to 364 apply to operators of aerodromes listed in Schedule 2.
> SOR/2014-153, s. 27

**Transition**

**352**

- **(1)** Sections 353 and 356 do not apply to the operator of an aerodrome until the day that is six months after the earlier of
	- **(a)** the day on which an aviation security regulation adding an asterisk in Schedule 2 after the name of the aerodrome comes into force, and
	- **(b)** the day on which a ministerial order stating that sections 353 to 364 apply to the operator comes into force.

**Transition**

- **(2)** Sections 354 and 355 do not apply to the operator of an aerodrome until the day that is 10 months after the earlier of
	- **(a)** the day on which an aviation security regulation adding an asterisk in Schedule 2 after the name of the aerodrome comes into force, and
	- **(b)** the day on which a ministerial order stating that sections 353 to 364 apply to the operator comes into force.

**Transition**

- **(3)** Sections 359 and 361 do not apply to the operator of an aerodrome until the day that is 22 months after the earlier of
	- **(a)** the day on which an aviation security regulation adding an asterisk in Schedule 2 after the name of the aerodrome comes into force, and
	- **(b)** the day on which a ministerial order stating that sections 353 to 364 apply to the operator comes into force.
> SOR/2014-153, s. 27

**Multi-agency advisory committee**

**353**

- **(1)** The operator of an aerodrome must have a multi-agency advisory committee.

**Membership**

- **(2)** The operator of the aerodrome must invite at least the following persons and organizations to be members of the multi-agency advisory committee:
	- **(a)** the Department of Transport;
	- **(b)** CATSA;
	- **(c)** the police service with jurisdiction at the aerodrome;
	- **(d)** the Royal Canadian Mounted Police;
	- **(e)** the Canadian Security Intelligence Service; and
	- **(f)** the Canada Border Services Agency.

**Terms of reference**

- **(3)** The operator of the aerodrome must manage the multi-agency advisory committee in accordance with written terms of reference.

**Objectives**

- **(4)** The objectives of the multi-agency advisory committee are
	- **(a)** to advise the operator of the aerodrome on its airport security risk assessment and its strategic airport security plan; and
	- **(b)** to promote the sharing of sensitive information respecting aviation security at the aerodrome.

**Records**

- **(5)** The operator of the aerodrome must keep records of the activities and decisions of the multi-agency advisory committee.
> SOR/2014-153, s. 27

**Airport security risk assessments**

**354** The operator of an aerodrome must have an airport security risk assessment that identifies, assesses and prioritizes aviation security risks and that includes the following elements:
- **(a)** a threat assessment that evaluates the probability that aviation security incidents will occur at the aerodrome;
- **(b)** a criticality assessment that prioritizes the areas, assets, infrastructure and operations at or associated with the aerodrome that most require protection from acts and attempted acts of unlawful interference with civil aviation;
- **(c)** a vulnerability assessment that considers the extent to which the areas, assets, infrastructure and operations at or associated with the aerodrome are susceptible to loss or damage and that evaluates this susceptibility in the context of the threat assessment; and
- **(d)** an impact assessment that, at a minimum, measures the consequences of an aviation security incident or potential aviation security incident in terms of
	- **(i)** a decrease in public safety and security,
	- **(ii)** financial and economic loss, and
	- **(iii)** a loss of public confidence.
> SOR/2014-153, s. 27

**Submission for approval**

**355** The operator of an aerodrome must submit its airport security risk assessment to the Minister for approval, and must submit a new airport security risk assessment to the Minister within five years after the date of the most recent approval.
> SOR/2014-153, s. 27

**Requirement to consult**

**356** The operator of an aerodrome must consult its multi-agency advisory committee when the operator is
- **(a)** preparing its airport security risk assessment for submission to the Minister for approval; and
- **(b)** conducting a review of its airport security risk assessment.
> SOR/2014-153, s. 27

**Airport security risk assessment — annual review**

**357**

- **(1)** The operator of an aerodrome must conduct a review of its airport security risk assessment at least once a year.

**Airport security risk assessment — other reviews**

- **(2)** The operator of the aerodrome must also conduct a review of its airport security risk assessment if
	- **(a)** a special event that is scheduled to take place at the aerodrome could affect aerodrome security;
	- **(b)** the operator is planning a change to the physical layout or operation of the aerodrome that could affect aviation security at the aerodrome;
	- **(c)** an environmental or operational change at the aerodrome could affect aerodrome security;
	- **(d)** a change in regulatory requirements could affect aerodrome security;
	- **(e)** the operator identifies, at the aerodrome, a vulnerability that is not addressed in the assessment, or the Minister identifies such a vulnerability to the operator; or
	- **(f)** the Minister informs the operator that there is a change in the threat environment that could result in a new or unaddressed medium to high risk.

**Equivalency**

- **(3)** For greater certainty, a review conducted under subsection (2) counts as a review required under subsection (1).

**Documentation**

- **(4)** When the operator of the aerodrome conducts a review of its airport security risk assessment, the operator must document
	- **(a)** any decision to amend or to not amend the assessment or the operator’s risk-management strategy;
	- **(b)** the reasons for that decision; and
	- **(c)** the factors that were taken into consideration in making that decision.

**Notification**

- **(5)** The operator of the aerodrome must notify the Minister if, as a result of a review of its airport security risk assessment, the operator amends the assessment
	- **(a)** to include a new medium to high risk; or
	- **(b)** to raise or lower the level of a risk within the medium to high range.
> SOR/2014-153, s. 27

**Approval**

**358** The Minister must approve an airport security risk assessment submitted by the operator of an aerodrome if
- **(a)** the assessment meets the requirements of section 354;
- **(b)** the assessment has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the operator has considered risk information provided by its multi-agency advisory committee;
- **(d)** the operator has considered all available and relevant information; and
- **(e)** the operator has not overlooked an aviation security risk that could affect the operation of the aerodrome.
> SOR/2014-153, s. 27

**Strategic airport security plans**

**359** The operator of an aerodrome must establish a strategic airport security plan that
- **(a)** summarizes the operator’s strategy to prepare for, detect, prevent, respond to and recover from acts or attempted acts of unlawful interference with civil aviation; and
- **(b)** includes a risk-management strategy that addresses the medium to high aviation security risks identified and prioritized in the operator’s airport security risk assessment.
> SOR/2014-153, s. 27

**Requirement to consult**

**360** The operator of an aerodrome must consult its multi-agency advisory committee when the operator
- **(a)** establishes its strategic airport security plan; and
- **(b)** amends its strategic airport security plan under subsection 364(1).
> SOR/2014-153, s. 27

**Requirement to submit**

**361** The operator of an aerodrome must submit its strategic airport security plan to the Minister for approval.
> SOR/2014-153, s. 27

**Requirement to implement**

**362** The operator of an aerodrome must, as soon as its strategic airport security plan is approved, implement its risk-management strategy.
> SOR/2014-153, s. 27

**Approval of plan**

**363** The Minister must approve a strategic airport security plan submitted by the operator of an aerodrome if
- **(a)** the plan meets the requirements of section 359;
- **(b)** the plan has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the plan is likely to enable the operator to prepare for, detect, prevent, respond to and recover from acts or attempted acts of unlawful interference with civil aviation;
- **(d)** the risk-management strategy is in proportion to the risks it addresses;
- **(e)** the operator has considered the advice of its multi-agency advisory committee;
- **(f)** the operator has not overlooked an aviation security risk that could affect the operation of the aerodrome; and
- **(g)** the plan can be implemented without compromising aviation security.
> SOR/2014-153, s. 27

**Amendments**

**364**

- **(1)** The operator of an aerodrome may amend its strategic airport security plan at any time, but must do so if
	- **(a)** the plan does not reflect the operator’s airport security risk assessment;
	- **(b)** the Minister informs the operator that there is a change in the threat environment that could result in a new or unaddressed medium to high risk;
	- **(c)** the Minister informs the operator that its risk-management strategy is not in proportion to a medium to high risk set out in the operator’s airport security risk assessment; or
	- **(d)** the operator identifies a deficiency in the plan.

**Documentation — risk-management strategy**

- **(2)** If the operator of the aerodrome amends its risk-management strategy, the operator must document
	- **(a)** the reason for the amendment; and
	- **(b)** the factors that were taken into consideration in making that amendment.

**Documentation — strategic airport security plan**

- **(3)** If the operator of the aerodrome amends its strategic airport security plan, the operator must document
	- **(a)** the reason for the amendment; and
	- **(b)** the factors that were taken into consideration in making that amendment.

**Submission of amendment**

- **(4)** If the operator of the aerodrome amends its strategic airport security plan, the operator must, as soon as possible, submit the amendment to the Minister for approval.

**Approval**

- **(5)** The Minister must approve an amendment if
	- **(a)** in the case of an amendment to the summary required under paragraph 359(a), the conditions set out in paragraphs 363(a) to (c) have been met; and
	- **(b)** in the case of an amendment to the risk-management strategy required under paragraph 359(b), the conditions set out in section 363 have been met.

**Implementation**

- **(6)** If the operator of the aerodrome amends its risk-management strategy, the operator must implement the amended version of the strategy once it is approved by the Minister.
> SOR/2014-153, s. 27

#### Menu of Additional Safeguards

**Requirement to establish**

**365**

- **(1)** The operator of an aerodrome must establish a menu of additional safeguards that are
	- **(a)** intended to mitigate heightened risk conditions in a graduated manner; and
	- **(b)** consistent with the operator’s legal powers and obligations.

**Menu requirements**

- **(2)** The menu of additional safeguards must
	- **(a)** describe, by activity type and location, the safeguards in place at the aerodrome in respect of AVSEC level 1 operating conditions;
	- **(b)** allow the rapid selection of additional safeguards by activity type or location; and
	- **(c)** indicate the persons and organizations responsible for implementing each additional safeguard.

**Activity types**

- **(3)** For the purposes of paragraphs (2)(a) and (b), the activity types must include
	- **(a)** access controls;
	- **(b)** monitoring and patrolling;
	- **(c)** communications; and
	- **(d)** other operational controls.

**Locations**

- **(4)** For the purposes of paragraphs (2)(a) and (b), the locations must include
	- **(a)** public areas of the aerodrome;
	- **(b)** areas of the aerodrome that are not public areas but are not restricted areas; and
	- **(c)** restricted areas.
> SOR/2014-153, s. 27

**Requirement to submit**

**366** The operator of an aerodrome must submit its menu of additional safeguards to the Minister for approval.
> SOR/2014-153, s. 27

**Approval**

**366.1** The Minister must approve a menu of additional safeguards submitted by the operator of an aerodrome if
- **(a)** the menu meets the requirements of section 365;
- **(b)** the menu has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the additional safeguards can be implemented rapidly and consistently;
- **(d)** the additional safeguards are consistent with existing rights and freedoms; and
- **(e)** the additional safeguards can be implemented without compromising aviation security.
> SOR/2014-153, s. 27

**Amendments**

**366.2**

- **(1)** The operator of an aerodrome may amend its menu of additional safeguards at any time, but must do so if
	- **(a)** the Minister informs the operator that there is a change in the threat environment that requires the addition or deletion of additional safeguards;
	- **(b)** the operator identifies a deficiency in the menu; or
	- **(c)** a change is made in the aviation security provisions of the Act or in regulatory requirements and the change affects the additional safeguards.

**Requirement to consult**

- **(2)** If applicable, the operator of the aerodrome must consult its multi-agency advisory committee when amending its menu of additional safeguards.

**Submission of amendment**

- **(3)** If the operator of the aerodrome amends its menu of additional safeguards, the operator must, as soon as possible, submit the amendment to the Minister for approval.

**Approval**

- **(4)** The Minister must approve the amendment if the conditions set out in section 366.1 continue to be met.
> SOR/2014-153, s. 27

#### Emergency Plans

**Plan requirements**

**367**

- **(1)** The operator of an aerodrome must establish an emergency plan that sets out the response procedures to be followed at the aerodrome for coordinated responses to the following emergencies:
	- **(a)** bomb threats;
	- **(b)** hijackings of aircraft; and
	- **(c)** other acts of unlawful interference with civil aviation.

**Response procedures**

- **(2)** The response procedures must
	- **(a)** set out in detail the actions to be taken by the employees and contractors of the operator of the aerodrome and identify the responsibilities of all other persons or organizations involved, including, as applicable, the police, emergency response providers, air carriers, emergency coordination centre personnel and control tower or flight service station personnel;
	- **(b)** include detailed procedures for the evacuation of air terminal buildings;
	- **(c)** include detailed procedures for the search of air terminal buildings;
	- **(d)** include detailed procedures for the handling and disposal of a suspected bomb; and
	- **(e)** include detailed procedures for the detention on the ground of any aircraft involved in a bomb threat or hijacking.
> SOR/2012-48, s. 23; SOR/2014-153, s. 27

#### Security Exercises

**Operations-based security exercise**

**368**

- **(1)** The operator of an aerodrome must, at least once every two years, carry out an operations-based security exercise that
	- **(a)** tests the effectiveness of the operator’s emergency plan in response to an act of unlawful interference with civil aviation and involves the persons and organizations referred to in the plan; and
	- **(b)** tests the effectiveness of additional safeguards that the operator chooses from its menu of additional safeguards.

**Equivalency**

- **(2)** If, in response to an aviation security incident, the Minister raises the AVSEC level for an aerodrome or any part of an aerodrome, the implementation of additional safeguards by the operator of the aerodrome counts as an operations-based security exercise for the purposes of subsection (1).
> SOR/2012-48, s. 23; SOR/2014-153, s. 27

**Discussion-based security exercise**

**369**

- **(1)** The operator of an aerodrome must, at least once a year, carry out a discussion-based security exercise that
	- **(a)** tests the effectiveness of the operator’s emergency plan in response to an act of unlawful interference with civil aviation and involves the persons and organizations referred to in the plan; and
	- **(b)** tests the effectiveness of additional safeguards that the operator chooses from its menu of additional safeguards.

**Exception**

- **(2)** Despite subsection (1), the operator of an aerodrome is not required to carry out a discussion-based security exercise in any year in which it carries out an operations-based security exercise.
> SOR/2012-48, s. 23; SOR/2014-153, s. 27

**Notice**

**370** The operator of an aerodrome must give the Minister 60 days’ notice of any security exercise that the operator plans to carry out.
> SOR/2014-153, s. 27

#### Records

**Additional safeguards**

**371**

- **(1)** Each time additional safeguards are implemented at an aerodrome in order to mitigate heightened risk conditions related to aviation security, the operator of the aerodrome must create a record that includes
	- **(a)** a description of the additional safeguards that were implemented;
	- **(b)** an evaluation of the effectiveness of those additional safeguards; and
	- **(c)** a description of any actions that are planned in order to address deficiencies identified during the implementation of those additional safeguards.

**Emergencies**

- **(2)** Each time an emergency referred to in subsection 367(1) occurs at an aerodrome, the operator of the aerodrome must create a record that includes
	- **(a)** a description of the emergency;
	- **(b)** an evaluation of the effectiveness of the operator’s emergency plan; and
	- **(c)** a description of any actions that are planned in order to address deficiencies identified during the emergency.

**Exercises**

- **(3)** Each time a security exercise is carried out at an aerodrome, the operator of the aerodrome must create a record that includes
	- **(a)** an outline of the exercise scenario;
	- **(b)** an evaluation of the effectiveness of the exercise; and
	- **(c)** a description of any actions that are planned in order to address deficiencies identified during the exercise.
> SOR/2012-48, s. 23; SOR/2014-153, s. 27

#### Corrective Actions

**Corrective actions**

**372** Subject to section 373, the operator of an aerodrome must immediately take corrective actions to address a vulnerability that contributes to a heightened aviation security risk at the aerodrome and that
- **(a)** is identified to the operator by the Minister; or
- **(b)** is identified by the operator.
> SOR/2014-153, s. 27

**Corrective action plan**

**373** If a corrective action to be taken by the operator of an aerodrome under section 372 involves a phased approach, the operator must include in its airport security program a corrective action plan that sets out
- **(a)** the nature of the vulnerability to be addressed;
- **(b)** a rationale for the phased approach; and
- **(c)** a timetable setting out when each phase of the corrective action plan will be completed.
> SOR/2014-153, s. 27

#### Primary Security Line Partners

**Provision of information to operator of aerodrome**

**374**

- **(1)** For the purpose of supporting the establishment and implementation of an airport security program by the operator of an aerodrome, a primary security line partner at the aerodrome must, on reasonable notice given by the operator, provide the operator with
	- **(a)** information respecting the measures, procedures and processes that the partner has in place at the aerodrome to protect the security of restricted areas and to prevent breaches of the primary security line; and
	- **(b)** a document that
		- **(i)** describes each area on the aerodrome’s primary security line that is occupied by the partner,
		- **(ii)** indicates the location of each restricted area access point in those areas, and
		- **(iii)** describes those restricted area access points.

**Provision of information to Minister**

- **(2)** The primary security line partner must provide the Minister with the information and the document on reasonable notice given by the Minister.
> SOR/2014-153, s. 27

[**375** to **379** reserved]

#### Disclosure of Information

**Prohibition**

**380** A person other than the Minister must not disclose security-sensitive information that is created or used under this Division unless the disclosure is required by law or is necessary to comply or facilitate compliance with the aviation security provisions of the Act, regulatory requirements or the requirements of an emergency direction.
> SOR/2014-153, s. 27

**DIVISION 10**
### Reserved

[**381** to **390** reserved]

**DIVISION 11**
### Other Aerodrome Operations

#### Overview

**Division overview**

**391** This Division sets out requirements respecting aerodrome operations that are not dealt with in any other Division of this Part.
> SOR/2012-48, s. 24

#### Construction Plans

**Requirement to notify Minister**

**392**

- **(1)** The operator of an aerodrome must notify the Minister of all plans to begin new construction or to make a change to the physical security of the aerodrome, if the construction or change relates to regulatory requirements respecting passengers, aircraft, baggage, cargo or mail.

**Notice requirements**

- **(2)** The notice must
	- **(a)** be in writing;
	- **(b)** state the date on which the construction will begin or the change will be made; and
	- **(c)** set out a description of the construction or change and the safeguards that will be implemented to maintain security in the areas of the aerodrome that will be affected by the construction activities.
> SOR/2012-48, s. 24

[**393** to **400** reserved]

**PART 6**
## Class 3 Aerodromes

### Overview

**Part overview**

**401** This Part sets out the basic regulatory framework for security at aerodromes listed in Schedule 3 and at any other place designated by the Minister under subsection 6(1) of the [Canadian Air Transport Security Authority Act](/en/Acts/Statutes%20of%20Canada/2002/c.%209,%20s.%202.md).
> SOR/2015-196, s. 4

### Application

**Application**

**402** This Part applies in respect of aerodromes listed in Schedule 3 and in respect of any other place designated by the Minister under subsection 6(1) of the [Canadian Air Transport Security Authority Act](/en/Acts/Statutes%20of%20Canada/2002/c.%209,%20s.%202.md).
> SOR/2015-196, s. 5

**DIVISION 1**
### Prohibited Items

#### Overview

**Division overview**

**403** This Division completes and supplements the regulatory framework set out in Part 3.

#### Authorization for Carriage of or Access to Explosive Substances and Incendiary Devices

**Authorization**

**404** The operator of an aerodrome may authorize a person to carry or have access to an explosive substance or an incendiary device at the aerodrome if
- **(a)** the explosive substance or incendiary device is to be used at the aerodrome
	- **(i)** for excavation, demolition or construction work,
	- **(ii)** in fireworks displays,
	- **(iii)** by persons operating explosives detection equipment or handling explosives detection dogs,
	- **(iv)** by a police service, or
	- **(v)** by military personnel; and
- **(b)** the operator has reasonable grounds to believe that the safety of the aerodrome and the safety of persons and aircraft at the aerodrome will not be jeopardized by the presence of the explosive substance or incendiary device.

#### Availability of Prohibited Items

**Prohibition — sterile area**

**405**

- **(1)** The operator of an aerodrome must not permit goods listed or described in the general list of prohibited items or, as applicable, the specific list of prohibited items to be made available to persons in a sterile area.

**Exception — liquids, aerosols and gels**

- **(2)** Subsection (1) does not apply in respect of liquids, aerosols and gels that are made available to persons in accordance with a security measure.

**Exception — knives**

- **(3)** Subsection (1) does not apply in respect of rounded, dull-blade knives and plastic knives that are made available to the customers of a concessionaire with the permission of the operator of the aerodrome.
> SOR/2012-48, s. 25

[**406** reserved]

**DIVISION 2**
### Threats and Incidents

#### Overview

**Division overview**

**407** This Division sets out the regulatory framework for dealing with threats and incidents at an aerodrome.

#### Threat Response

**Area under operator’s control**

**408** The operator of an aerodrome who is made aware of a threat against an aviation facility, or a part of the aerodrome, that is under the operator’s control must immediately determine whether there is a threat that jeopardizes the security of the facility or that part of the aerodrome.
> SOR/2019-149, s. 3

**Area under control of other person**

**409** The operator of an aerodrome who is made aware of a threat against an aviation facility, or a part of the aerodrome, that is under the control of a person carrying on any activity at the aerodrome, other than the operator, must immediately
- **(a)** notify the person of the nature of the threat; and
- **(b)** determine whether there is a threat that jeopardizes the security of the aerodrome.
> SOR/2019-149, s. 3

**Threats**

**410** The operator of an aerodrome who determines that there is a threat that jeopardizes the security of the aerodrome must immediately take all of the measures necessary to ensure the safety of the aerodrome and persons at the aerodrome, including informing the appropriate police service of the nature of the threat.
> SOR/2019-149, s. 3

**Duties of other person**

**411** A person, other than a screening authority, who is carrying on any activity at an aerodrome and who is made aware of a threat against the aerodrome must
- **(a)** immediately notify the operator of the aerodrome of the nature of the threat; and
- **(b)** assist the operator of the aerodrome in determining whether there is a threat that jeopardizes the security of the aerodrome.
> SOR/2019-149, s. 3

**Threats identified by other person**

**412** If it is determined under paragraph 15(b), 409(b) or 411(b) that there is a threat that jeopardizes the security of an aerodrome, the operator of the aerodrome must immediately take all of the measures necessary to ensure the safety of the aerodrome and persons at the aerodrome, including informing the appropriate police service of the nature of the threat.
> SOR/2019-149, s. 3

#### Information Reporting

**Security incidents**

**413** The operator of an aerodrome must immediately notify the Minister when any of the following incidents occur:
- **(a)** the discovery, at the aerodrome, of a weapon, explosive substance or incendiary device that is not permitted under subsection 78(2);
- **(b)** an explosion at the aerodrome, unless the explosion is known to be the result of an accident, excavation, demolition or construction work, or the use of fireworks displays;
- **(c)** a threat against the aerodrome; and
- **(d)** an aviation security incident that involves a peace officer anywhere at the aerodrome other than areas under an air carrier’s control.
> SOR/2019-149, s. 3

**Commercial air service information**

**414** The operator of an aerodrome must provide the Minister with written notice of any new commercial air service that is to begin at an air terminal building.

**DIVISION 3**
### AVSEC Levels

#### Overview

**Division overview**

**415** This Division sets out requirements respecting the implementation of additional safeguards in the event of heightened risk conditions.
> SOR/2014-153, s. 28

#### AVSEC Level Requirements

**Additional safeguards**

**416** If the AVSEC level is raised or maintained above level 1 for an aerodrome or any part of an aerodrome, the operator of the aerodrome must immediately take the following actions:
- **(a)** determine which additional safeguards are likely to mitigate the heightened risk condition;
- **(b)** notify any persons or organizations that have aviation security roles and responsibilities at the aerodrome and are affected by the heightened risk condition;
- **(c)** implement or continue to implement the additional safeguards; and
- **(d)** notify the Minister of the additional safeguards that are being or will be implemented.
> SOR/2014-153, s. 28

**Notification**

**417** When the AVSEC level is lowered for an aerodrome or any part of an aerodrome, the operator of the aerodrome must immediately notify the persons and organizations that were notified under paragraph 416(b).
> SOR/2014-153, s. 28

**Legal powers and obligations**

**418** For greater certainty, nothing in these Regulations authorizes the operator of an aerodrome to implement additional safeguards that are inconsistent with the operator’s legal powers and obligations.
> SOR/2014-153, s. 28

[**419** and **420** reserved]

**DIVISION 4**
### Personnel and Training

#### Overview

**Division overview**

**421** This Division sets out requirements respecting aerodrome security personnel and other persons who are assigned aerodrome-related security roles and responsibilities at an aerodrome.
> SOR/2014-153, s. 75

[**422** and **423** reserved]

#### Security Official
> SOR/2014-153, s. 29

**Interpretation**

**424** A security official of an aerodrome is an individual who is responsible for
- **(a)** coordinating and overseeing security controls and procedures at the aerodrome; and
- **(b)** acting as the principal contact between the operator of the aerodrome and the Minister with respect to security matters, including the airport security program.

**Requirement**

**425**

- **(1)** The operator of an aerodrome must have, at all times, at least one security official or acting security official.

**Contact information**

- **(2)** The operator of the aerodrome must provide the Minister with
	- **(a)** the name of each security official and acting security official; and
	- **(b)** 24-hour contact information for those officials.

#### Aerodrome Security Personnel

**Initial training**

**426**

- **(1)** The operator of an aerodrome must ensure that a member of the aerodrome security personnel does not carry out an aerodrome-related security role or responsibility at the aerodrome unless the member has received initial training in relation to that role or responsibility.

**Training elements**

- **(2)** Initial training for aerodrome security personnel must include instruction and evaluation in relation to the topics set out below that are relevant to the aerodrome-related security roles and responsibilities of the personnel:
	- **(a)** international instruments respecting aviation security, the aviation security provisions of the Act and regulatory requirements;
	- **(b)** the security controls and procedures at the aerodrome where the personnel are employed;
	- **(c)** systems and equipment at the aerodrome;
	- **(d)** an overview of threats to aviation security and acts or attempted acts of unlawful interference with civil aviation;
	- **(e)** the recognition of goods that are listed or described in TP 14628 or that pose an immediate threat to aviation security; and
	- **(f)** the actions to be taken by the personnel in response to a threat to aviation security or an act or attempted act of unlawful interference with civil aviation.

**Grandfathering**

- **(3)** Aerodrome security personnel who are employed at the aerodrome on the day on which this section comes into force are exempted from initial training in relation to any topic for which they have already received training.
> SOR/2014-153, s. 30

**Follow-up training**

**427**

- **(1)** The operator of an aerodrome must ensure that aerodrome security personnel receive follow-up training when any of the following circumstances arise:
	- **(a)** a change is made in the aviation security provisions of the Act or in regulatory requirements and the change is relevant to the aerodrome-related security roles and responsibilities of the personnel;
	- **(b)** a change is made in the security controls and procedures at the aerodrome where the personnel are employed and the change is relevant to the aerodrome-related security roles and responsibilities of the personnel;
	- **(c)** a new or modified action is to be taken by the personnel in response to a threat to aviation security or an act or attempted act of unlawful interference with civil aviation; and
	- **(d)** a significant risk or an emerging trend in aviation security is identified to the operator by the Minister and the risk or trend is relevant to the aerodrome-related security roles and responsibilities of the personnel.

**Follow-up training**

- **(2)** The operator of an aerodrome must ensure that a member of the aerodrome security personnel receives follow-up training when the Minister or the operator identifies a shortcoming in the member’s performance when the member is carrying out security controls or following security procedures at the aerodrome.

**Training elements**

- **(3)** Follow-up training must include
	- **(a)** a review of any initial-training element related to the circumstance set out in subsection (1) or (2) that gave rise to the follow-up training; and
	- **(b)** instruction and evaluation in relation to that circumstance.
> SOR/2014-153, s. 30

**On-the-job training**

**428** If, at an aerodrome, the initial or follow-up training of aerodrome security personnel includes on-the-job training, the operator of the aerodrome must ensure that the on-the-job training is provided by a person who has received that same training or has significant experience working as a member of the aerodrome security personnel at an aerodrome listed in Schedule 1, 2 or 3.
> SOR/2014-153, s. 30

**Training records**

**429**

- **(1)** The operator of an aerodrome must ensure that, for each individual who receives training in accordance with section 426 or 427, there is a training record that includes
	- **(a)** the individual’s employee group or contractor group, if applicable, and a description of the individual’s aerodrome-related security roles and responsibilities;
	- **(b)** a description of all the training that the individual has received in accordance with section 426 or 427; and
	- **(c)** evaluation results for all the training that the individual has received in accordance with section 426 or 427.

**Record keeping**

- **(2)** The operator of the aerodrome must keep the training record for at least two years.

**Ministerial access**

- **(3)** The operator of the aerodrome must make the training record available to the Minister on reasonable notice given by the Minister.
> SOR/2014-153, s. 30

[**430** reserved]

**DIVISION 5**
### Facilitation of Screening

#### Overview

**Division overview**

**431** This Division sets out requirements respecting the facilitation of screening operations at an aerodrome.
> SOR/2012-48, s. 26

#### Screening of Passengers

**Passenger screening facilities**

**432** The operator of an aerodrome must make facilities available for passenger screening checkpoints and must make at least one facility available for the private screening of passengers.
> SOR/2012-48, s. 26; SOR/2014-153, s. 31

**False declaration notice**

**433**

- **(1)** The operator of an aerodrome must post a notice at each passenger screening checkpoint stating that it is an offence for a person at the aerodrome to falsely declare
	- **(a)** that the person is carrying a weapon, an explosive substance, an incendiary device or any other item that could be used to jeopardize the security of an aerodrome or aircraft, or that such an item is contained in goods in the person’s possession or control or in goods that the person has tendered or is tendering for screening or transportation; or
	- **(b)** that another person who is at an aerodrome or on board an aircraft is carrying a weapon, an explosive substance, an incendiary device or any other item that could be used to jeopardize the security of an aerodrome or aircraft, or that such an item is contained in goods in the other person’s possession or control or in goods that the other person has tendered or is tendering for screening or transportation.

**Official languages**

- **(2)** The notice must be clearly visible and be in at least both official languages.
> SOR/2012-48, s. 26; SOR/2014-153, s. 31

#### Notice for Non-passengers

**Notice — Liquids, aerosols or gels**

**434** The operator of an aerodrome must ensure that non-passengers who access sterile areas are notified of any restrictions on the possession of liquids, aerosols or gels in sterile areas.
> SOR/2012-48, s. 26

#### Screening of Checked Baggage

**Checked baggage screening facilities**

**435** The operator of an aerodrome must make facilities available for the screening of checked baggage and baggage intended to be checked baggage.
> SOR/2012-48, s. 26; SOR/2014-153, s. 32

#### Baggage Handling Systems

**No change without agreement**

**436** If the operator of an aerodrome is responsible for a baggage handling system, the operator must not make any change to the system that may affect screening operations unless the change is agreed to by CATSA.
> SOR/2012-48, s. 26

**DIVISION 6**
### Access Controls

#### Overview

**Division overview**

**437** This Division sets out the regulatory framework for the protection of security-sensitive areas of aerodromes.

#### Signs

**Sign requirements**

**438**

- **(1)** The operator of an aerodrome must post signs on the outside of each restricted area access point and each security barrier. Each sign must
	- **(a)** be in at least both official languages;
	- **(b)** identify the restricted area as a restricted area; and
	- **(c)** state that access to the area is restricted to authorized persons.

**Signs on security barriers**

- **(2)** The signs posted on a security barrier must be no more than 150 m apart.
> SOR/2012-48, s. 27

#### Restricted Area Access Points

**Access control system**

**439** The operator of an aerodrome must ensure that each restricted area access point that allows access from a non-restricted area to a restricted area has an access control system consisting of one or more of the following elements:
- **(a)** surveillance by a person authorized by the operator of the aerodrome to control access to restricted area;
- **(b)** manual locking equipment; and
- **(c)** automated access control equipment.
> SOR/2012-48, s. 28

**Passenger loading bridge**

**440** The operator of an aerodrome must ensure that each restricted area access point that is located between an air terminal building and a passenger loading bridge has a door that can be locked.
> SOR/2012-48, s. 28

**Prohibition**

**441** A person must not enter a restricted area at an aerodrome except through a restricted area access point.

#### Baggage Handling Systems

**Prevention of unauthorized access**

**442** The operator of an aerodrome must take measures to prevent unauthorized access to a baggage handling system that is in a restricted area.
> SOR/2012-48, s. 29

#### Doors, Gates, Emergency Exits and Other Devices

**Duty to close and lock — operators**

**443**

- **(1)** The operator of an aerodrome must close and lock any door, gate or other device, other than an emergency exit, if
	- **(a)** the operator has control of and responsibility for the door, gate or other device; and
	- **(b)** the door, gate or other device allows access between a restricted area and a non-restricted area.

**Emergency exit system**

- **(2)** The operator of an aerodrome must institute a system, on or near an emergency exit, that prevents access by unauthorized persons to a restricted area, if
	- **(a)** the operator has control of and responsibility for the emergency exit; and
	- **(b)** the emergency exit allows access between a restricted area and a non-restricted area.

**Duty to close and lock — partners and lessees**

**444**

- **(1)** A primary security line partner, or a lessee other than a primary security line partner, at an aerodrome must close and lock any door, gate or other device, other than an emergency exit, if
	- **(a)** the partner or lessee has control of and responsibility for the door, gate or other device; and
	- **(b)** the door, gate or other device allows access between a restricted area and a non-restricted area.

**Emergency exit system**

- **(2)** A primary security line partner who occupies an area on an aerodrome’s primary security line must institute a system, on or near an emergency exit, that prevents access by unauthorized persons to a restricted area, if
	- **(a)** the partner has control of and responsibility for the emergency exit; and
	- **(b)** the emergency exit allows access between a restricted area and a non-restricted area.

**Temporary use or control**

**445** Any person at an aerodrome who has temporary use or control of a door, gate or other device that allows access between a restricted area and a non-restricted area must prevent access to or from the restricted area by unauthorized persons.

**Uncontrolled restricted area access point**

**446** Unless an authorized person is controlling access between a restricted area and a non-restricted area at an aerodrome, a person who enters or leaves the restricted area must
- **(a)** lock the door, gate or other device that allows access to or from the restricted area; and
- **(b)** prevent access to or from the restricted area by unauthorized persons while the door, gate or other device is open or unlocked.

**Preventing locking**

**447** A person at an aerodrome must not prevent a door, gate or other device, other than an emergency exit, that allows access between a restricted area and a non-restricted area from being locked.

**Emergency exits**

**448** A person at an aerodrome must not open any door that is designated as an emergency exit and that is also a restricted area access point unless
- **(a)** the person is authorized by the operator of the aerodrome to open it; or
- **(b)** there is an emergency.

#### Unauthorized Access

**Prohibition**

**449**

- **(1)** If a person has been given notice, orally, in writing or by a sign, that access to a part of an aerodrome is prohibited or is limited to authorized persons, the person must not enter or remain in that part of the aerodrome without authorization.

**Restricted areas**

- **(2)** The operator of an aerodrome may authorize a person to enter or remain in a restricted area if the requirements of Divisions 6 and 7 are met.

**Non-public areas other than restricted areas**

- **(3)** The operator of an aerodrome may authorize a person to enter or remain in a part of the aerodrome that is not a public area but is not a restricted area if the safety of the aerodrome, persons at the aerodrome and aircraft is not jeopardized.

**Non-public areas other than restricted areas**

- **(4)** A lessee at an aerodrome who has the use of, or is responsible for, a part of the aerodrome that is not a public area but is not a restricted area may authorize a person to enter or remain in that part of the aerodrome if the safety of the aerodrome, persons at the aerodrome and aircraft is not jeopardized.
> SOR/2014-153, s. 33

#### Inspectors

**Requirement to allow access**

**450** The operator of an aerodrome must allow an inspector to enter or remain in a restricted area if the inspector is acting in the course of their employment and presents their credentials.
> SOR/2012-48, s. 30

**DIVISION 7**
### Documents of Entitlement

**Division overview**

**451** This Division sets out provisions respecting documents of entitlement.
> SOR/2012-48, s. 31

**List of documents**

**452**

- **(1)** Only the following documents are documents of entitlement at an aerodrome:
	- **(a)** a restricted area pass;
	- **(a.1)** a restricted area identity card;
	- **(b)** a boarding pass, a ticket, or any other document accepted by an air carrier that confirms the status of the person to whom it was issued as a passenger on a flight and that is approved by the operator of the aerodrome;
	- **(c)** a passenger escort form that is approved by the operator of the aerodrome;
	- **(d)** a courtesy-lounge or conference-room pass that is issued by an air carrier and that is approved by the operator of the aerodrome; and
	- **(e)** a document that is issued or approved by the operator of the aerodrome in accordance with a security measure.

**Pilot’s licence**

- **(2)** A pilot’s licence issued under the [Canadian Aviation Regulations](/en/Regulations/Statutory%20Orders%20and%20Regulations/96/433.md) is a document of entitlement for a restricted area that is used by general aviation, if the holder of the licence also holds a valid medical certificate of a category that is appropriate for that licence and
	- **(a)** is acting in the course of their employment; or
	- **(b)** requires access to an aircraft that they own or operate.
> SOR/2012-48, s. 31; SOR/2014-153, s. 34; SOR/2016-39, s. 2

**DIVISION 7.1**
### Enhanced Access Controls

#### Overview

**Division overview**

**452.01** This Division sets out enhanced access control requirements, including requirements respecting the identity verification system referred to in section 56.
> SOR/2016-39, s. 3

#### Identity Verification System

**Disclosure of information**

**452.02**

- **(1)** The operator of an aerodrome is authorized to disclose to the Minister or CATSA any information that is necessary for the proper operation of the identity verification system.

**Identity protection**

- **(2)** Despite subsection (1), the operator of an aerodrome must not disclose to CATSA the identity of an applicant for a restricted area identity card or the identity of a person to whom a restricted area identity card has been issued unless the operator grants CATSA access to its databases to maintain or repair the identity verification system and CATSA’s access to the person’s identity is incidental to the maintenance or repairs.
> SOR/2016-39, s. 3

#### Information To Be Displayed on a Restricted Area Identity Card

**Required information**

**452.03**

- **(1)** The operator of an aerodrome must ensure that the following information is displayed on each restricted area identity card that it issues:
	- **(a)** the full name of the person to whom the card is issued;
	- **(b)** the person’s height;
	- **(c)** a photograph depicting a frontal view of the person’s face;
	- **(d)** the expiry date of the card;
	- **(e)** the name of the aerodrome where the card is issued;
	- **(f)** the name of the person’s employer, if the person has a single employer;
	- **(g)** the terms “multi-employer” and “employeur multiple”, if the person has more than one employer;
	- **(h)** the person’s occupation, if the person has a single occupation; and
	- **(i)** the terms “multi-occupation” and “emplois multiples”, if the person has more than one occupation.

**Expiration date**

- **(2)** A restricted area identity card expires no later than five years after the day on which it is issued or on the day on which the security clearance of the person to whom the card is issued expires, whichever is earlier.

**Expiration date — multi-aerodrome card**

- **(3)** Despite subsection (2), a restricted area identity card that is issued to a person who requires access to restricted areas at more than one aerodrome, but who is not a crew member, expires no later than one year after the day on which it is issued or on the day on which the person’s security clearance expires, whichever is earlier.

**Official languages**

- **(4)** The operator of an aerodrome must ensure that all information that is displayed on a restricted area identity card is in both official languages.
> SOR/2016-39, s. 3

#### Issuance of Restricted Area Identity Cards

**Issuance criteria**

**452.04**

- **(1)** The operator of an aerodrome must not issue a restricted area identity card to a person unless the person
	- **(a)** applies in writing;
	- **(b)** is sponsored in writing by their employer;
	- **(c)** has a security clearance;
	- **(d)** consents in writing to the collection, use, retention, disclosure and destruction of information for the purposes of this Division; and
	- **(e)** confirms that the information displayed on the card is correct.

**Activation requirement**

- **(2)** The operator of an aerodrome must not issue a restricted area identity card to a person unless the card has been activated.
> SOR/2016-39, s. 3

**False information**

**452.05** A person must not provide false information for the purpose of obtaining a restricted area identity card.
> SOR/2016-39, s. 3

**Sponsorship**

**452.06** An employer must not
- **(a)** sponsor an employee who does not require ongoing access to restricted areas in the course of their employment; or
- **(b)** knowingly sponsor an employee for more than one restricted area identity card at a time.
> SOR/2016-39, s. 3

**Issuance of multiple cards**

**452.07** The operator of an aerodrome must not issue more than one restricted area identity card at a time to a person.
> SOR/2016-39, s. 3

**Replacement of cards**

**452.08** Before replacing a lost, stolen or non-functional restricted area identity card, the operator of an aerodrome must ensure that
- **(a)** the person applying for the replacement card is the person to whom the lost, stolen or non-functional card has been issued; and
- **(b)** the person still has a security clearance.
> SOR/2016-39, s. 3

**Requirement to inform**

**452.09** Before collecting information from an applicant under this Division, the operator of an aerodrome must bring to the applicant’s attention the purposes for which the information is collected and the manner in which the information will be used, retained, disclosed and destroyed.
> SOR/2016-39, s. 3

**Collection of information**

**452.1**

- **(1)** For the purpose of creating a restricted area identity card for an applicant, the operator of an aerodrome must collect the following information from the applicant:
	- **(a)** the applicant’s full name;
	- **(b)** the applicant’s height;
	- **(c)** a photograph depicting a frontal view of the applicant’s face;
	- **(d)** the applicant’s fingerprint images and iris images;
	- **(e)** the name of the applicant’s employer; and
	- **(f)** the applicant’s occupation.

**Destruction of images and templates**

- **(2)** The operator of the aerodrome must, immediately after issuing the restricted area identity card, destroy all fingerprint images and iris images that the operator collected from the applicant and any biometric template created from those images that is not stored on the card.
> SOR/2016-39, s. 3

**Quality control**

**452.11** For the purpose of allowing CATSA to monitor the quality of biometric templates and determining if a restricted area identity card is already active in respect of an applicant, the operator of an aerodrome must, before issuing the card, disclose to CATSA any biometric templates created from the fingerprint images and iris images collected from the applicant.
> SOR/2016-39, s. 3

**Protection of information**

**452.12** The operator of an aerodrome must take appropriate measures to protect information that is collected, used, retained or disclosed in accordance with this Division from loss or theft and from unauthorized access, use, disclosure, duplication or alteration.
> SOR/2016-39, s. 3

#### Deactivation of Restricted Area Identity Cards

**Deactivation request**

**452.13**

- **(1)** The operator of an aerodrome who has issued a restricted area identity card must immediately ask CATSA to deactivate the card if
	- **(a)** the card expires;
	- **(b)** the person to whom the card has been issued or their employer informs the operator that the card is lost, stolen or no longer functional; or
	- **(c)** the person to whom the card has been issued fails, on demand, to present or surrender the card to a screening officer.

**Reason for deactivation**

- **(2)** If the operator of an aerodrome asks CATSA to deactivate a restricted area identity card, the operator must inform CATSA of the reason for the request.

**Prohibition**

- **(3)** The operator of an aerodrome must not ask CATSA to deactivate a restricted area identity card for a reason other than a reason set out in subsection (1).

**Notification of Minister**

- **(4)** The operator of an aerodrome must notify the Minister if the operator asks CATSA to deactivate a restricted area identity card.
> SOR/2016-39, s. 3

**Change in employment**

**452.14** The operator of an aerodrome who has issued a restricted area identity card must notify the Minister immediately if
- **(a)** in the case of a person who has a single employer, the person to whom the card has been issued ceases to be employed or no longer requires ongoing access to restricted areas in the course of their employment; and
- **(b)** in the case of a person who has more than one employer, the person to whom the card has been issued ceases to be employed by all of their employers or no longer requires ongoing access to restricted areas in the course of their employment.
> SOR/2016-39, s. 3

**Duty of employer**

**452.15** The employer of a person to whom a restricted area identity card has been issued must immediately notify the operator of an aerodrome who issued the card if the person ceases to be an employee or no longer requires ongoing access to restricted areas in the course of their employment.
> SOR/2016-39, s. 3

**Retrieval of cards**

**452.16**

- **(1)** The operator of an aerodrome who has issued a restricted area identity card must take reasonable steps to retrieve the card if it has been deactivated and must notify CATSA if the card is not retrieved.

**Return of cards**

- **(2)** If a restricted area identity card has been deactivated, the person to whom the card has been issued must immediately return it to the operator of an aerodrome who issued it unless the card was surrendered in accordance with this Division or was lost or stolen.
> SOR/2016-39, s. 3

#### Keys, Combination Codes and Personal Identification Codes

**Issuance or assignment**

**452.17** The operator of an aerodrome must not issue a key or assign a combination code or personal identification code to a person for a restricted area unless
- **(a)** the person is a person to whom a restricted area identity card has been issued and the card is active; or
- **(b)** the person is in possession of a document that is issued or approved by the operator of the aerodrome in accordance with a security measure as authorization for the person to enter or remain in the restricted area.
> SOR/2016-39, s. 3

**Addition of key**

**452.18** The operator of an aerodrome may add a key to a restricted area identity card only if it is possible to cancel or remove the key without damaging or altering any other elements of the card.
> SOR/2016-39, s. 3

**Protection of information**

**452.19** The operator of an aerodrome must not add to or modify a restricted area identity card in any way that might allow the disclosure to CATSA of information about the person to whom the card has been issued.
> SOR/2016-39, s. 3

**Cancellation, withdrawal or retrieval**

**452.2** The operator of an aerodrome must cancel, withdraw or retrieve a key that has been issued to a person who has been issued a restricted area identity card, or a combination code or personal identification code that has been assigned to that person, if
- **(a)** the person’s restricted area identity card has been deactivated; or
- **(b)** the person no longer requires ongoing access to the restricted area in the course of their employment.
> SOR/2016-39, s. 3

#### Records

**General requirement**

**452.21**

- **(1)** The operator of an aerodrome and any person designated by the operator to issue restricted area identity cards or keys or to assign combination codes or personal identification codes must keep updated records at the aerodrome respecting
	- **(a)** restricted area identity cards and keys that have been issued;
	- **(b)** the names of the persons to whom restricted area identity cards or keys have been issued;
	- **(c)** the names of the persons to whom combination codes or personal identification codes have been assigned;
	- **(d)** blank restricted area identity cards in the operator’s possession;
	- **(e)** restricted area identity cards that have been deactivated;
	- **(f)** keys, combination codes or personal identification codes that have been cancelled, withdrawn or retrieved;
	- **(g)** deactivated restricted area identity cards that have not been retrieved by the operator;
	- **(h)** restricted area identity cards that have been reported as lost or stolen;
	- **(i)** steps taken to retrieve deactivated restricted area identity cards; and
	- **(j)** compliance with section 452.09.

**Deactivated cards**

- **(2)** Subject to subsection (3), a record respecting a restricted area identity card that has been deactivated must be retained for at least one year from the day on which the card was deactivated.

**Lost or stolen cards**

- **(3)** A record respecting a restricted area identity card that has been reported as lost or stolen must be retained for at least one year from the card’s expiry date.

**Provision to Minister**

- **(4)** The operator of the aerodrome must provide the Minister with the records on reasonable notice given by the Minister.
> SOR/2016-39, s. 3

#### Restricted Area Access Control Process

**Use of identity verification system**

**452.22** The operator of an aerodrome must implement and maintain a restricted area access control process that uses the identity verification system.
> SOR/2016-39, s. 3

#### Control of Access to Restricted Areas

**Unauthorized access prohibition**

**452.23** A person must not enter or remain in a restricted area unless the person
- **(a)** is a person to whom a restricted area identity card has been issued; or
- **(b)** is in possession of a document of entitlement, other than a restricted area identity card, for the restricted area.
> SOR/2016-39, s. 3

**Restricted area identity cards — conditions of use**

**452.24**

- **(1)** A person to whom a restricted area identity card has been issued must not enter or remain in a restricted area unless
	- **(a)** they are acting in the course of their employment;
	- **(b)** the card is in their possession;
	- **(c)** the card is active; and
	- **(d)** as applicable, they are in possession of a key that has been issued to them for the restricted area, or a combination code or personal identification code that has been assigned to them for the restricted area.

**Exception**

- **(2)** Paragraph (1)(d) does not apply to crew members.
> SOR/2016-39, s. 3

**Display of restricted area identity cards**

**452.25**

- **(1)** A person to whom a restricted area identity card has been issued must not enter or remain in a restricted area unless they visibly display the card on their outer clothing at all times.

**Display of temporary passes**

- **(2)** A person to whom a temporary pass has been issued must not enter or remain in a restricted area unless they visibly display the pass on their outer clothing at all times.
> SOR/2016-39, s. 3

**Oversight**

**452.26** The operator of an aerodrome must ensure that a person is not allowed to enter or remain in a restricted area at the aerodrome unless the person is in possession of
- **(a)** an active restricted area identity card that has been issued to the person; or
- **(b)** a document of entitlement, other than a restricted area identity card, for the restricted area.
> SOR/2016-39, s. 3

#### Business Continuity Plans

**Business continuity plans**

**452.27**

- **(1)** The operator of an aerodrome must develop and maintain a business continuity plan that, at a minimum, sets out how the operator will re-establish normal operations and comply with section 452.26 in the event that the operator is unable to use its restricted area access control process to comply with that section.

**Implementation**

- **(2)** The operator of the aerodrome must immediately implement its business continuity plan and notify the Minister and CATSA if the operator discovers that it is unable to use its restricted area access control process to comply with section 452.26.

**Notification of delay**

- **(3)** The operator of the aerodrome must immediately notify the Minister if the operator discovers that it will be unable, for more than 24 hours, to use its restricted area access control process to comply with section 452.26.

**Ministerial access**

- **(4)** The operator of the aerodrome must make its business continuity plan available to the Minister on reasonable notice given by the Minister.
> SOR/2016-39, s. 3

**Database backup**

**452.28** The operator of an aerodrome must regularly back up any database that the operator uses as part of the identity verification system.
> SOR/2016-39, s. 3

#### Use of Restricted Area Identity Cards, Keys, Combination Codes and Personal Identification Codes

**General prohibitions**

**452.29**

- **(1)** A person must not
	- **(a)** lend or give a restricted area identity card or a key that has been issued to them to another person;
	- **(b)** use a restricted area identity card or a key that has been issued to them to allow access to a restricted area at an aerodrome to another person without authorization from the operator of the aerodrome;
	- **(c)** intentionally alter or otherwise modify a restricted area identity card or a key unless they are the operator of an aerodrome or a person designated by the operator;
	- **(d)** use a restricted area identity card or a key that has been issued to another person;
	- **(e)** have in their possession, without reasonable excuse, a restricted area identity card or a key that has been issued to another person;
	- **(f)** use a counterfeit restricted area identity card or a counterfeit key; or
	- **(g)** make a copy of a restricted area identity card or a key.

**Disclosure or use of codes**

- **(2)** A person, other than the operator of an aerodrome or a person designated by the operator, must not
	- **(a)** disclose a combination code or personal identification code; or
	- **(b)** use another person’s combination code or personal identification code.
> SOR/2016-39, s. 3

**Report of loss or theft**

**452.3**

- **(1)** A person to whom a restricted area identity card or a key has been issued must immediately report its loss or theft to their employer or to the operator of an aerodrome who issued the card or key.

**Employer’s duty to report**

- **(2)** An employer who is informed by an employee of the loss or theft of a restricted area identity card or a key must immediately report the loss or theft to the operator of an aerodrome who issued the card or key.
> SOR/2016-39, s. 3

**Report of non-functioning card**

**452.31** An employer who is informed by an employee that a restricted area identity card is not functioning must immediately notify the operator of an aerodrome who issued the card.
> SOR/2016-39, s. 3

#### Presentation and Surrender of Restricted Area Identity Cards

**Presentation on demand**

**452.32**

- **(1)** A person in possession of a restricted area identity card who is in a restricted area at an aerodrome must, on demand, present the card to the Minister, the operator of the aerodrome, the person’s employer or a peace officer.

**Presentation during screening**

- **(2)** A person in possession of a restricted area identity card who is being screened by a screening officer at a restricted area access point or at a location in a restricted area must, on demand, present the card to the screening officer.
> SOR/2016-39, s. 3

**Surrender on demand**

**452.33**

- **(1)** A person in possession of a restricted area identity card must, on demand, surrender it to the Minister, the operator of an aerodrome, a screening officer or a peace officer.

**Demand by Minister or operator**

- **(2)** The Minister or the operator of an aerodrome may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen;
	- **(b)** the card has been deactivated; or
	- **(c)** the surrender of the card is required to ensure aviation security.

**Demand by screening officer**

- **(3)** A screening officer may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen;
	- **(b)** the card has been deactivated; or
	- **(c)** the screening officer is carrying out screening at a restricted area access point or at a location in a restricted area and the person who is in possession of the card refuses to be screened or refuses to submit goods in their possession or control for screening.

**Demand by peace officer**

- **(4)** A peace officer may demand the surrender of a restricted area identity card if
	- **(a)** the card has expired or has been reported as lost or stolen; or
	- **(b)** there is an immediate threat to aviation security, the security of any aircraft or aerodrome or other aviation facility or the safety of the public, passengers or crew members, and the surrender of the card is required to respond to the threat.
> SOR/2016-39, s. 3

**Return of cards**

**452.34** A screening officer or a peace officer to whom a person surrenders a restricted area identity card must return the card to the operator of the aerodrome where the card is surrendered or to the operator of an aerodrome who issued the card.
> SOR/2016-39, s. 3

**Notification of Minister**

**452.35** The operator of an aerodrome to whom a person surrenders a restricted area identity card must notify the Minister if the operator demanded the surrender in accordance with paragraph 452.33(2)(c).
> SOR/2016-39, s. 3

#### Escort and Surveillance

**General requirement**

**452.36**

- **(1)** The operator of an aerodrome must ensure that any person who is in a restricted area at the aerodrome and is not in possession of a restricted area identity card
	- **(a)** is escorted by a person in possession of an active restricted area identity card that has been issued to them; or
	- **(b)** is kept under surveillance by a person in possession of an active restricted area identity card that has been issued to them, in the case of an area the limits of which are defined for a specific purpose, such as construction or maintenance.

**Exceptions**

- **(2)** This section does not apply in respect of the following persons:
	- **(a)** passengers who have been screened; and
	- **(b)** inspectors.
> SOR/2016-39, s. 3

**Escort ratio**

**452.37**

- **(1)** The operator of an aerodrome must ensure that at least one escort is provided for every 10 persons who require escort.

**Surveillance ratio**

- **(2)** The operator of an aerodrome must ensure that no more than 20 persons at a time are kept under surveillance by one person.
> SOR/2016-39, s. 3

**Requirement to remain together**

**452.38**

- **(1)** A person under escort must remain with the escort while the person is in a restricted area.

**Idem**

- **(2)** An escort must remain with the person under escort while the person is in a restricted area.

**Requirement to inform**

- **(3)** The person who appoints an escort must inform the escort of the requirement to remain with the person under escort while that person is in a restricted area.
> SOR/2016-39, s. 3

**Screening requirement**

**452.39** The operator of an aerodrome must ensure that a person under escort or surveillance at the aerodrome and any goods in the person’s possession or control are screened at a screening checkpoint before the person enters a sterile area.
> SOR/2016-39, s. 3

**Exception — conveyances**

**452.4**

- **(1)** The operator of an aerodrome is not required to place an escort or surveillance personnel in a conveyance that is in a restricted area at the aerodrome and is carrying persons who require escort or surveillance if the conveyance travels in a convoy with an escort conveyance that contains at least one person in possession of an active restricted area identity card that has been issued to them.

**Exception to exception**

- **(2)** The operator of the aerodrome must ensure that, if a person who requires escort or surveillance disembarks from a conveyance in a restricted area at the aerodrome, the person is escorted or kept under surveillance in accordance with section 452.37.
> SOR/2016-39, s. 3

**Escort conveyances**

**452.41** The operator of an aerodrome must ensure that, at the aerodrome, at least one escort conveyance is provided for
- **(a)** every three conveyances requiring escort to or from an air terminal building apron area for a purpose other than snow removal operations;
- **(b)** every six conveyances requiring escort to or from an air terminal building apron area for snow removal operations; and
- **(c)** every six conveyances requiring escort to or from a restricted area other than an air terminal building apron area.
> SOR/2016-39, s. 3

#### Inspectors

**Exemption**

**452.42** Nothing in this Division requires an inspector acting in the course of their employment to be in possession of a restricted area identity card or any other document issued or approved by the operator of an aerodrome as authorization for the inspector to enter or remain in a restricted area.
> SOR/2016-39, s. 3

**Inspector’s credentials**

**452.43** The credentials issued by the Minister to an inspector do not constitute a restricted area identity card even if the credentials are compatible with the identity verification system or with an access control system established by the operator of an aerodrome.
> SOR/2016-39, s. 3

**Escort privileges**

**452.44** Nothing in this Division prohibits an inspector from escorting a person who is in a restricted area and is not in possession of a restricted area identity card if the inspector
- **(a)** is acting in the course of their employment;
- **(b)** does not escort more than 10 persons at one time;
- **(c)** remains with the person while the person is in the restricted area;
- **(d)** ensures that the person remains with the inspector while the person is in the restricted area; and
- **(e)** ensures that the person and any goods in their possession or control are screened at a screening checkpoint before the person enters a sterile area.
> SOR/2016-39, s. 3

**Conveyance escort privileges**

**452.45**

- **(1)** Nothing in this Division prohibits an inspector from escorting a person who is in a conveyance in a restricted area and is not in possession of a restricted area identity card if the inspector
	- **(a)** is acting in the course of their employment;
	- **(b)** does not escort more than 10 persons at one time; and
	- **(c)** is either in the conveyance or in an escort conveyance that is travelling in a convoy with the conveyance.

**Additional conditions**

- **(2)** If a person under escort disembarks from a conveyance in a restricted area, the inspector must
	- **(a)** remain with the person; and
	- **(b)** ensure that the person remains with the inspector.

**Idem**

- **(3)** If a person under escort is travelling to or from an air terminal building apron area, the Minister must ensure that at least one escort conveyance is provided for every three conveyances requiring escort in a convoy and that at least one inspector is in each escort conveyance.

**Idem**

- **(4)** If a person under escort is travelling to or from a restricted area other than an air terminal building apron area, the Minister must ensure that at least one escort conveyance is provided for every six conveyances requiring escort in a convoy and that at least one inspector is in each escort conveyance.
> SOR/2016-39, s. 3

**DIVISION 8**
### Airport Security Programs

#### Overview

**Division overview**

**453** This Division sets out the regulatory framework for promoting a comprehensive, coordinated and integrated approach to airport security. The processes required under this Division are intended to facilitate the establishment and implementation of effective airport security programs that reflect the circumstances of each aerodrome.
> SOR/2014-153, s. 35

#### Interpretation

**Processes and procedures**

**454** For greater certainty, any reference to a process in this Division includes the procedures, if any, that are necessary to implement that process.
> SOR/2014-153, s. 35

#### Airport Security Program Requirements

**Requirement to establish and implement**

**455**

- **(1)** The operator of an aerodrome must establish and implement an airport security program.

**Program requirements**

- **(2)** As part of its airport security program, the operator of an aerodrome must
	- **(a)** define and document the aerodrome-related security roles and responsibilities assigned to each of the operator’s employee groups and contractor groups;
	- **(b)** communicate the information referred to in paragraph (a) to the employees and contractors in those groups;
	- **(c)** have a security policy statement that establishes an overall commitment and direction for aerodrome security and sets out the operator’s security objectives;
	- **(d)** communicate the security policy statement in an accessible manner to all persons who are employed at the aerodrome or who require access to the aerodrome in the course of their employment;
	- **(e)** establish and implement a process for responding to aerodrome-related security incidents and breaches in a coordinated manner that is intended to minimize their impact;
	- **(f)** establish and implement a security awareness program that promotes a culture of security vigilance and awareness among the following persons:
		- **(i)** persons who are employed at the aerodrome,
		- **(ii)** crew members who are based at the aerodrome, and
		- **(iii)** persons, other than crew members, who require access to the aerodrome in the course of their employment;
	- **(g)** assess risk information and disseminate it within the operator’s organization for the purpose of informed decision-making about aviation security;
	- **(h)** establish and implement a process for receiving, retaining, disclosing and disposing of sensitive information respecting aviation security in order to protect the information from unauthorized access;
	- **(i)** identify sensitive information respecting aviation security and receive, retain, disclose and dispose of sensitive information respecting aviation security in a manner that protects the information from unauthorized access;
	- **(j)** disclose sensitive information respecting aviation security to the following persons if they have been assigned aerodrome-related security roles and responsibilities and require the information to carry out those roles and responsibilities:
		- **(i)** persons who are employed at the aerodrome, and
		- **(ii)** persons who require access to the aerodrome in the course of their employment;
	- **(k)** have a current scale map of the aerodrome that identifies all restricted areas, security barriers and restricted area access points; and
	- **(l)** document how the operator achieves compliance with the aviation security provisions of the Act and the regulatory requirements that apply to the operator.

**Other program requirements**

- **(3)** The following also form part of the airport security program:
	- **(a)** the security official referred to in section 425;
	- **(b)** the aerodrome security personnel training referred to in sections 426 and 427;
	- **(c)** the security committee or other working group or forum referred to in section 458;
	- **(d)** if applicable, the airport security risk assessment referred to in section 461;
	- **(e)** if applicable, the strategic airport security plan referred to in section 466;
	- **(f)** the menu of additional safeguards referred to in section 472;
	- **(g)** the emergency plan referred to in section 474; and
	- **(h)** the security exercises referred to in sections 475 and 476.
> SOR/2012-48, ss. 32, 65(F); SOR/2014-153, s. 35

**Documentation**

**456**

- **(1)** The operator of an aerodrome must
	- **(a)** keep documentation related to its menu of additional safeguards and any amendment to it for at least five years;
	- **(b)** if applicable, keep documentation related to its airport security risk assessment and any review of it for at least five years;
	- **(c)** if applicable, keep documentation related to its strategic airport security plan and any amendment to it for at least five years; and
	- **(d)** keep all other documentation related to its airport security program for at least two years.

**Ministerial access**

- **(2)** The operator of the aerodrome must make the documentation available to the Minister on reasonable notice given by the Minister.
> SOR/2014-153, s. 35

**Requirement to amend**

**457** The operator of an aerodrome must amend its airport security program if the operator identifies, at the aerodrome, an aviation security risk that is not addressed by the program.
> SOR/2014-153, s. 35

#### Security Committee

**Security committee**

**458**

- **(1)** The operator of an aerodrome must have a security committee or other working group or forum that
	- **(a)** advises the operator on the development of controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator;
	- **(b)** helps coordinate the implementation of the controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator; and
	- **(c)** promotes the sharing of information respecting the airport security program.

**Terms of reference**

- **(2)** The operator of the aerodrome must manage the security committee or other working group or forum in accordance with written terms of reference that
	- **(a)** identify its membership; and
	- **(b)** define the roles and responsibilities of each member.

**Records**

- **(3)** The operator of the aerodrome must keep records of the activities and decisions of the security committee or other working group or forum.
> SOR/2014-153, s. 35

#### Requirements that Apply only if an Amendment to Schedule 3 or a Ministerial Order is made: Airport Security Risk Assessments and Strategic Airport Security Plans

**Application**

**459**

- **(1)** Subject to section 460, sections 461 to 471 apply to the operator of an aerodrome if
	- **(a)** the Governor in Council makes an aviation security regulation adding an asterisk in Schedule 3 after the name of the aerodrome; or
	- **(b)** the Minister makes an order stating that sections 461 to 471 apply to the operator.

**Minister’s authority**

- **(2)** The Minister is authorized to make orders stating that sections 461 to 471 apply to operators of aerodromes listed in Schedule 3.
> SOR/2014-153, s. 35

**Transition**

**460**

- **(1)** Sections 461 and 462 do not apply to the operator of an aerodrome until the day that is 10 months after the earlier of
	- **(a)** the day on which an aviation security regulation adding an asterisk in Schedule 3 after the name of the aerodrome comes into force, and
	- **(b)** the day on which a ministerial order stating that sections 461 to 471 apply to the operator comes into force.

**Transition**

- **(2)** Sections 466 and 468 do not apply to the operator of an aerodrome until the day that is 22 months after the earlier of
	- **(a)** the day on which an aviation security regulation adding an asterisk in Schedule 3 after the name of the aerodrome comes into force, and
	- **(b)** the day on which a ministerial order stating that sections 461 to 471 apply to the operator comes into force.
> SOR/2014-153, s. 35

**Airport security risk assessments**

**461** The operator of an aerodrome must have an airport security risk assessment that identifies, assesses and prioritizes aviation security risks and that includes the following elements:
- **(a)** a threat assessment that evaluates the probability that aviation security incidents will occur at the aerodrome;
- **(b)** a criticality assessment that prioritizes the areas, assets, infrastructure and operations at or associated with the aerodrome that most require protection from acts and attempted acts of unlawful interference with civil aviation;
- **(c)** a vulnerability assessment that considers the extent to which the areas, assets, infrastructure and operations at or associated with the aerodrome are susceptible to loss or damage and that evaluates this susceptibility in the context of the threat assessment; and
- **(d)** an impact assessment that, at a minimum, measures the consequences of an aviation security incident or potential aviation security incident in terms of
	- **(i)** a decrease in public safety and security,
	- **(ii)** financial and economic loss, and
	- **(iii)** a loss of public confidence.
> SOR/2014-153, s. 35

**Submission for approval**

**462** The operator of an aerodrome must submit its airport security risk assessment to the Minister for approval, and must submit a new airport security risk assessment to the Minister within five years after the date of the most recent approval.
> SOR/2014-153, s. 35

**Requirement to consult**

**463** The operator of an aerodrome must consult its security committee or other working group or forum when the operator is
- **(a)** preparing its airport security risk assessment for submission to the Minister for approval; and
- **(b)** conducting a review of its airport security risk assessment.
> SOR/2014-153, s. 35

**Airport security risk assessment — annual review**

**464**

- **(1)** The operator of an aerodrome must conduct a review of its airport security risk assessment at least once a year.

**Airport security risk assessment — other reviews**

- **(2)** The operator of the aerodrome must also conduct a review of its airport security risk assessment if
	- **(a)** a special event that is scheduled to take place at the aerodrome could affect aerodrome security;
	- **(b)** the operator is planning a change to the physical layout or operation of the aerodrome that could affect aviation security at the aerodrome;
	- **(c)** an environmental or operational change at the aerodrome could affect aerodrome security;
	- **(d)** a change in regulatory requirements could affect aerodrome security;
	- **(e)** the operator identifies, at the aerodrome, a vulnerability that is not addressed in the assessment, or the Minister identifies such a vulnerability to the operator; or
	- **(f)** the Minister informs the operator that there is a change in the threat environment that could result in a new or unaddressed medium to high risk.

**Equivalency**

- **(3)** For greater certainty, a review conducted under subsection (2) counts as a review required under subsection (1).

**Documentation**

- **(4)** When the operator of the aerodrome conducts a review of its airport security risk assessment, the operator must document
	- **(a)** any decision to amend or to not amend the assessment or the operator’s risk-management strategy;
	- **(b)** the reasons for that decision; and
	- **(c)** the factors that were taken into consideration in making that decision.

**Notification**

- **(5)** The operator of the aerodrome must notify the Minister if, as a result of a review of its airport security risk assessment, the operator amends the assessment
	- **(a)** to include a new medium to high risk; or
	- **(b)** to raise or lower the level of a risk within the medium to high range.
> SOR/2014-153, s. 35

**Approval**

**465** The Minister must approve an airport security risk assessment submitted by the operator of an aerodrome if
- **(a)** the assessment meets the requirements of section 461;
- **(b)** the assessment has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the operator has considered the advice of its security committee or other working group or forum;
- **(d)** the operator has considered all available and relevant information; and
- **(e)** the operator has not overlooked an aviation security risk that could affect the operation of the aerodrome.
> SOR/2014-153, s. 35

**Strategic airport security plans**

**466** The operator of an aerodrome must establish a strategic airport security plan that
- **(a)** summarizes the operator’s strategy to prepare for, detect, prevent, respond to and recover from acts or attempted acts of unlawful interference with civil aviation; and
- **(b)** includes a risk-management strategy that addresses the medium to high aviation security risks identified and prioritized in the operator’s airport security risk assessment.
> SOR/2014-153, s. 35

**Requirement to consult**

**467** The operator of an aerodrome must consult its security committee or other working group or forum when establishing its strategic airport security plan.
> SOR/2014-153, s. 35

**Requirement to submit**

**468** The operator of an aerodrome must submit its strategic airport security plan to the Minister for approval.
> SOR/2014-153, s. 35

**Requirement to implement**

**469** The operator of an aerodrome must, as soon as its strategic airport security plan is approved, implement its risk-management strategy.
> SOR/2014-153, s. 35

**Approval of plan**

**470** The Minister must approve a strategic airport security plan submitted by the operator of an aerodrome if
- **(a)** the plan meets the requirements of section 466;
- **(b)** the plan has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the plan is likely to enable the operator to prepare for, detect, prevent, respond to and recover from acts or attempted acts of unlawful interference with civil aviation;
- **(d)** the risk-management strategy is in proportion to the risks it addresses;
- **(e)** the operator has considered the advice of its security committee or other working group or forum;
- **(f)** the operator has not overlooked an aviation security risk that could affect the operation of the aerodrome; and
- **(g)** the plan can be implemented without compromising aviation security.
> SOR/2014-153, s. 35

**Amendments**

**471**

- **(1)** The operator of an aerodrome may amend its strategic airport security plan at any time, but must do so if
	- **(a)** the plan does not reflect the operator’s airport security risk assessment;
	- **(b)** the Minister informs the operator that there is a change in the threat environment that could result in a new or unaddressed medium to high risk;
	- **(c)** the Minister informs the operator that its risk-management strategy is not in proportion to a medium to high risk set out in the operator’s airport security risk assessment; or
	- **(d)** the operator identifies a deficiency in the plan.

**Documentation — risk-management strategy**

- **(2)** If the operator of the aerodrome amends its risk-management strategy, the operator must document
	- **(a)** the reason for the amendment; and
	- **(b)** the factors that were taken into consideration in making that amendment.

**Documentation — strategic airport security plan**

- **(3)** If the operator of the aerodrome amends its strategic airport security plan, the operator must document
	- **(a)** the reason for the amendment; and
	- **(b)** the factors that were taken into consideration in making that amendment.

**Submission of amendment**

- **(4)** If the operator of the aerodrome amends its strategic airport security plan, the operator must, as soon as possible, submit the amendment to the Minister for approval.

**Approval**

- **(5)** The Minister must approve an amendment if
	- **(a)** in the case of an amendment to the summary required under paragraph 466(a), the conditions set out in paragraphs 470(a) to (c) have been met; and
	- **(b)** in the case of an amendment to the risk-management strategy required under paragraph 466(b), the conditions set out in section 470 have been met.

**Implementation**

- **(6)** If the operator of the aerodrome amends its risk-management strategy, the operator must implement the amended version of the strategy once it is approved by the Minister.
> SOR/2014-153, s. 35

#### Menu of Additional Safeguards

**Requirement to establish**

**472**

- **(1)** The operator of an aerodrome must establish a menu of additional safeguards that are
	- **(a)** intended to mitigate heightened risk conditions in a graduated manner; and
	- **(b)** consistent with the operator’s legal powers and obligations.

**Menu requirements**

- **(2)** The menu of additional safeguards must
	- **(a)** describe, by activity type and location, the safeguards in place at the aerodrome in respect of AVSEC level 1 operating conditions;
	- **(b)** allow the rapid selection of additional safeguards by activity type or location; and
	- **(c)** indicate the persons and organizations responsible for implementing each additional safeguard.

**Activity types**

- **(3)** For the purposes of paragraphs (2)(a) and (b), the activity types must include
	- **(a)** access controls;
	- **(b)** monitoring and patrolling;
	- **(c)** communications; and
	- **(d)** other operational controls.

**Locations**

- **(4)** For the purposes of paragraphs (2)(a) and (b), the locations must include
	- **(a)** public areas of the aerodrome;
	- **(b)** areas of the aerodrome that are not public areas but are not restricted areas; and
	- **(c)** restricted areas.
> SOR/2014-153, s. 35

**Requirement to submit**

**473** The operator of an aerodrome must submit its menu of additional safeguards to the Minister for approval.
> SOR/2014-153, s. 35

**Approval**

**473.1** The Minister must approve a menu of additional safeguards submitted by the operator of an aerodrome if
- **(a)** the menu meets the requirements of section 472;
- **(b)** the menu has been reviewed by an executive within the operator’s organization who is responsible for security;
- **(c)** the additional safeguards can be implemented rapidly and consistently;
- **(d)** the additional safeguards are consistent with existing rights and freedoms; and
- **(e)** the additional safeguards can be implemented without compromising aviation security.
> SOR/2014-153, s. 35

**Amendments**

**473.2**

- **(1)** The operator of an aerodrome may amend its menu of additional safeguards at any time, but must do so if
	- **(a)** the Minister informs the operator that there is a change in the threat environment that requires the addition or deletion of additional safeguards;
	- **(b)** the operator identifies a deficiency in the menu; or
	- **(c)** a change is made in the aviation security provisions of the Act or in regulatory requirements and the change affects the additional safeguards.

**Submission of amendment**

- **(2)** If the operator of the aerodrome amends its menu of additional safeguards, the operator must, as soon as possible, submit the amendment to the Minister for approval.

**Approval**

- **(3)** The Minister must approve the amendment if the conditions set out in section 473.1 continue to be met.
> SOR/2014-153, s. 35

#### Emergency Plans

**Plan requirements**

**474**

- **(1)** The operator of an aerodrome must establish an emergency plan that sets out the response procedures to be followed at the aerodrome for coordinated responses to the following emergencies:
	- **(a)** bomb threats;
	- **(b)** hijackings of aircraft; and
	- **(c)** other acts of unlawful interference with civil aviation.

**Response procedures**

- **(2)** The response procedures must
	- **(a)** set out in detail the actions to be taken by the employees and contractors of the operator of the aerodrome and identify the responsibilities of all other persons or organizations involved, including, as applicable, the police, emergency response providers, air carriers, emergency coordination centre personnel and control tower or flight service station personnel;
	- **(b)** include detailed procedures for the evacuation of air terminal buildings;
	- **(c)** include detailed procedures for the search of air terminal buildings;
	- **(d)** include detailed procedures for the handling and disposal of a suspected bomb; and
	- **(e)** include detailed procedures for the detention on the ground of any aircraft involved in a bomb threat or hijacking.
> SOR/2012-48, s. 33; SOR/2014-153, s. 35

#### Security Exercises

**Operations-based security exercise**

**475**

- **(1)** The operator of an aerodrome must, at least once every four years, carry out an operations-based security exercise that
	- **(a)** tests the effectiveness of the operator’s emergency plan in response to an act of unlawful interference with civil aviation and involves the persons and organizations referred to in the plan; and
	- **(b)** tests the effectiveness of additional safeguards that the operator chooses from its menu of additional safeguards.

**Equivalency**

- **(2)** If, in response to an aviation security incident, the Minister raises the AVSEC level for an aerodrome or any part of an aerodrome, the implementation of additional safeguards by the operator of the aerodrome counts as an operations-based security exercise for the purposes of subsection (1).
> SOR/2012-48, s. 33; SOR/2014-153, s. 35

**Discussion-based security exercise**

**476**

- **(1)** The operator of an aerodrome must, at least once a year, carry out a discussion-based security exercise that
	- **(a)** tests the effectiveness of the operator’s emergency plan in response

branch_name: refs/heads/master

extension: md

license_type: permissive