An SEPP is a consolidated document that combines a transit agency’s security program with its emergency response plan, ensuring that prevention, detection, response, and recovery activities are coordinated under one framework. It typically covers Risk and Threat and Vulnerability Assessments (TVAs), access control, Crime Prevention Through Environmental Design (CPTED), incident command structures, coordination with first responders, and training and exercise schedules. All of these plans are also integrated into the agency’s Emergency Operations Center (EOC) if one exists or shared with a partnering agency’s EOC. Because elements of a SEPP are designated Sensitive Security Information under 49 CFR Parts 15 and 1520, the document has specific handling and marking requirements. A well-maintained SEPP is reviewed annually, exercised regularly, and updated whenever threat intelligence, infrastructure, or leadership changes meaningfully alter the agency’s risk profile.

The Federal Transit Administration’s (FTA) Public Transit Risk Assessment Module (PTRAM), delivered through the U.S. Department of Transportation’s Transportation Safety Institute (TSI), is a training-focused resource that helps public transportation agencies understand and apply safety risk management principles within their safety programs. PTRAM supports the Safety Management System framework by guiding transit professionals through the process of identifying hazards, assessing the likelihood and severity of potential consequences, determining whether existing controls are sufficient, and prioritizing mitigation actions. It aligns with FTA’s Public Transportation Agency Safety Plan requirements, which require agencies to establish methods for hazard identification, safety risk assessment, and safety risk mitigation. In practice, PTRAM helps agencies move from reactive safety responses to a structured, proactive approach for documenting, evaluating, and reducing safety risks across bus, rail, and other public transit operations.

A tabletop exercise is a discussion-based session in which decision-makers walk through a realistic scenario, an active shooter, a flood, a ransomware attack, to test plans, roles, and communication without deploying people or equipment in the field. A Functional Exercise is a live exercise to test and evaluate the capabilities prior to performing a Full Scale exercise which will involve external partners. A Full-Scale drill, by contrast, puts operations staff, first responders, and sometimes volunteer victims into the physical environment to practice the plan in real time. Tabletops are lower-cost, surface policy and coordination gaps quickly, and work well as annual reviews. Functional exercises usually involve the agency staff itself to ensure all capabilities are in place prior to a Full Scale exercise..Full-scale drills validate that tabletops translate to real capability. Most mature agencies run a layered program: seminars, workshops, tabletops, functional exercises, and occasional full-scale events.

An effective transit EOC reflects the agency’s structure and needs, giving the agency a single place where leadership, operations, communications, and liaison staff can support an incident using the Incident Command System. Planning an EOC means defining the structure, staff roles, activation criteria, information flow, and connections to local, state, and federal partners, not just designating a room with technology. Agencies should align EOC procedures with existing Standard Operating Procedures, including how coordination with the Control Center, Customer Service and Video Surveillance support systems is achieved. EOC readiness can be ensured through exercises, and by maintaining redundant communications and backup locations. The best EOC programs are scalable: can be activated quickly for a small incident with just a few staff, and they expand smoothly into a unified command structure when a major event requires multi-agency coordination.