OAR 741-060-0040
Monitoring Requirement for Plans

(1) Monitoring the System Safety Program Plan
(a) The SSOA or its contractor may review, approve, oversee and enforce the implementation of and compliance with the system safety program plan.
(b) At least once every three years, either at one time or over a three year period, the SSOA or its contractor shall conduct an audit of the implementation of each RTA’s plan to verify compliance with, and evaluate the effectiveness of, the plan.
(c) Following each on-site audit, the SSOA or its contractor shall prepare a written report of its findings and recommendations, and the need, if any, for updating the system safety program plan, or revising implementation of the plan. If the report identifies deficiencies for which a corrective action plan is required, the RTA shall submit a corrective action plan to the SSOA within 30 days after receiving the report, or within a different time period if specified by the SSOA. The corrective action plan must comply with the requirements in 741-06-0072.
(2) Monitoring the System Security Plan
(a) The SSOA or its contractor may investigate and review the operation of each RTA to determine whether the RTA’s actual security practices comply with its system security plan.
(b) At least once every three years, the SSOA or its contractor shall conduct an on-site review of the implementation of each RTA’s system security plan to verify compliance with, and evaluate the effectiveness of, the plan.
(c) Following each on-site review, the SSOA or its contractor shall prepare a written report of its findings and recommendations, and the need, if any, for updating the plan or revising implementation of the plan. If the report identifies deficiencies for which a CAP is required, the RTA shall submit a CAP to the SSOA within 30 days after receiving the report, or within a different time period if specified by the SSOA. The CAP must comply with the requirements in OAR 741-060-0072 (Corrective Action Plan (CAP) Requirements).
(d) Sensitive security information, as defined in OAR 741-060-0040 (Monitoring Requirement for Plans), may not be disseminated or publicly disclosed unless required by ORS 192.410 to 192.505.
(3) Monitoring the Emergency Preparedness and Response Plan
(a)The SSOA or its contractor may investigate and review the operation of each RTA to determine whether the RTA’s actual emergency management practices comply with its Emergency Preparedness and Response Plan.
(b) At least once every three years, the SSOA or its contractor shall conduct an on-site review of the implementation of each RTA’s emergency preparedness and response plan to verify compliance with, and evaluate the effectiveness of, the plan.
(c) Following each on-site review, the SSOA or its contractor shall prepare a written report of its findings and recommendations, and the need, if any, for updating the plan or revising implementation of the plan. If the report identifies deficiencies for which a CAP is required, the RTA shall submit a corrective action plan to the SSOA within 30 days after receiving the report, or within a different time period if specified by the SSOA. The CAP must comply with the requirements in OAR 741-060-0072 (Corrective Action Plan (CAP) Requirements).

Source: Rule 741-060-0040 — Monitoring Requirement for Plans, https://secure.­sos.­state.­or.­us/oard/view.­action?ruleNumber=741-060-0040 (accessed May 26, 2025).

May 26, 2025

Rule 741-060-0040's source at or​.us