The short answer: the hazmat endorsement belongs to the driver, the security plan belongs to the company, and having one says nothing about the other. Under 49 CFR 172.800(b), each person who offers for transportation in commerce or transports in commerce one or more of sixteen listed material categories must develop and adhere to a transportation security plan. Not every hazmat load is on that list, and not every placarded load. But if one of your lanes is, the plan is mandatory, must be in writing under 172.802(c), must be reviewed at least annually, and drives a separate training duty under 172.704(a)(5).
What costs money is the absence. In Appendix B to 49 CFR Part 385, FMCSA classifies transporting hazmat without a security plan as an acute regulation. Everything below is sourced to Part 172 Subpart I, 172.704 and PHMSA guidance. This is a walk-through of the rules, not legal advice.
Run one test: take what you haul, expressed in hazard class, division and quantity per packaging, and check it against the sixteen categories below. One match is enough. Two points settle most arguments before they start.
The whole applicability test, from 49 CFR 172.800(b). Hand it to whoever books your loads.
| # | Material | Quantity that turns the plan on |
|---|---|---|
| 1 | Division 1.1, 1.2 or 1.3 material | Any quantity |
| 2 | Division 1.4, 1.5 or 1.6 material | Placarded per Subpart F |
| 3 | Division 2.1 material (flammable gas) | Large bulk quantity |
| 4 | Division 2.2 material with a subsidiary hazard of 5.1 | Large bulk quantity |
| 5 | Material poisonous by inhalation (171.8) | Any quantity |
| 6 | Class 3 meeting the criteria for Packing Group I or II | Large bulk quantity |
| 7 | Desensitized explosives meeting the Division 4.1 or Class 3 definition | Placarded per Subpart F |
| 8 | Division 4.2 meeting the criteria for Packing Group I or II | Large bulk quantity |
| 9 | Division 4.3 material | Placarded per Subpart F |
| 10 | Division 5.1 in Packing Groups I and II; perchlorates; ammonium nitrate, its fertilizers, emulsions, suspensions or gels | Large bulk quantity |
| 11 | Organic peroxide, Type B, liquid or solid, temperature controlled | Any quantity |
| 12 | Division 6.1 material (poison by inhalation is line 5) | Large bulk quantity |
| 13 | Select agent or toxin regulated by CDC (42 CFR part 73) or USDA (9 CFR part 121) | Any quantity |
| 14 | Uranium hexafluoride | Requiring placarding under 172.505(b) |
| 15 | IAEA Code of Conduct Category 1 and 2 materials, NRC Category 1 and 2 radioactive materials in Table 1, appendix A to 10 CFR part 37, HRCQ per 173.403 | As listed |
| 16 | Class 8 meeting the criteria for Packing Group I | Large bulk quantity |
Read the pattern, not sixteen lines. Four are "any quantity" categories: heavy explosives, poison-inhalation materials, temperature-controlled Type B organic peroxide, select agents. One cylinder is enough. Seven turn on large bulk quantity, in practice a cargo tank or portable tank. Four turn on placarding. Everything else, including much ordinary placarded freight, sits outside Subpart I.
Section 172.800(b) defines the term inside its own text, which is unusual and worth quoting exactly: a quantity greater than 3,000 kg (6,614 pounds) for solids or 3,000 liters (792 gallons) for liquids and gases in a single packaging such as a cargo tank motor vehicle, portable tank, tank car, or other bulk container.
Two words carry the weight: single packaging. Not the weight of the load, not the capacity of the trailer: the capacity of one container.
| What is on the trailer | Largest single packaging | Large bulk quantity? |
|---|---|---|
| Cargo tank with 6,000 gallons of a Class 3 PG II liquid | 6,000 gal | Yes. Over 792 gal in one packaging |
| Sixteen 55-gallon drums of the same liquid, 880 gal total | 55 gal | No, although the load is placarded |
| One IBC of 330 gal plus one of 275 gal | 330 gal | No. Separate packagings are not added |
| One cylinder of a poison-inhalation material | Irrelevant | Trigger anyway. Line 5 is any-quantity |
For contrast, 49 CFR 171.8 puts an ordinary bulk packaging at a capacity over 450 L (119 gallons) for a liquid, a net mass over 400 kg (882 pounds) with a capacity over 450 L for a solid, or a water capacity over 454 kg (1,000 pounds) for a gas. So a packaging can be "bulk" for placarding and still be nowhere near a large bulk quantity for Subpart I.
No, and believing it does is the most common error here. The two tests merely overlap. Placarding lives in 49 CFR 172.504: for Table 2 materials by highway, placards are generally not required on a vehicle or freight container carrying less than 454 kg (1,001 pounds) aggregate gross weight, with exceptions for bulk packagings and the Table 1 materials in 172.505. That figure decides whether placards go on the trailer. It decides nothing about Subpart I, where only four categories turn on placarding at all: lines 2, 7, 9 and 14 above. The tests split in both directions:
PHMSA said the same from the other direction in interpretation 06-0177 (September 13, 2006): consumer commodities do not require placarding and are not subject to security plan requirements. Placarding is one input, not the switch.
Yes, and recently enough that most published material is out of date. The only exception written into 172.800 is paragraph (c). As revised by PHMSA's final rule Reduce Training Burdens for America's Farmers, published at 91 FR 49329 on August 4, 2026 and effective September 3, 2026, the activities of a farmer generating less than $825,000 in 2025 dollars annually in gross receipts from the sale of agricultural commodities or products are outside Subpart I if they are conducted by highway or rail, in direct support of their farming operations, and within a 150-mile radius of those operations. The figure it replaces, which the rule itself describes as $500,000 in 2005 dollars, had never been adjusted for inflation. Indexing the new one to 2025 dollars, PHMSA wrote, "will ensure that the threshold automatically accounts for future inflationary changes." The same rule states that a farmer excepted from the plan is also excepted from the in-depth training in 172.704(a)(5). It runs under docket PHMSA-2025-0098 (HM-268J), RIN 2137-AG12, was signed July 31, 2026, and drew exactly one comment on the proposal, from the Dangerous Goods Advisory Council, in support; PHMSA puts the annualized cost saving at $5.7 million. All three conditions must hold at once: 200-mile runs, or hauling for a neighbor rather than in direct support of one's own operations, fall outside it whatever the receipts.
One more relief valve, a shortcut rather than an exception. Section 172.804 lets plans conforming to regulations, standards, protocols or guidelines issued by other Federal agencies, international organizations or industry organizations satisfy Subpart I, provided such security plans address the requirements specified in this subpart. That clause is the whole condition: a generic corporate security policy that never mentions personnel security, unauthorized access or en route security does not qualify.
Section 172.802(a) opens with the risk assessment: an assessment of transportation security risks for shipments of the listed materials, including site-specific or location-specific risks at facilities where they are prepared for transportation, stored, or unloaded incidental to movement, plus measures to address the assessed risks, which may vary commensurate with the level of threat at a particular time. Then, at a minimum:
How specific? PHMSA answered in interpretation 06-0177: the HMR set general requirements rather than a prescriptive list, a performance standard. The assessment should list the materials or classes you haul and an evaluation of the possible security risks associated with each, and need not address threats tied to one specific material. It may even conclude the risk for some materials is not significant. What it may not do is fail to exist.
The same letter answers the question a carrier eventually gets from a shipper or a broker: who owns en route security. PHMSA said it expects shippers to work with carriers, that a shipper and a carrier may have a joint plan or two separate plans, and that a shipper should satisfy itself that the carrier transporting its material has a security plan in place that addresses that material. That is why the request usually arrives as "send us your security plan" rather than "sign ours." A carrier with no document has nothing to send.
Three more items in 172.802(b), and thin plans fail here because they are checkable in seconds: identification by job title of the senior management official responsible for development and implementation, by title so the position survives turnover; security duties for each position or department plus the process of notifying employees when specific elements must be implemented, the half everyone skips; and a plan for training hazmat employees under 172.704(a)(4) and (a)(5), a component of the security plan, not a separate binder.
| Plan component | What it must contain | Who owns it | Review cadence |
|---|---|---|---|
| Risk assessment 172.802(a) | Materials or classes you haul, risks for each, site-specific risks where they are prepared, stored or unloaded incidental to movement, and the measures chosen | The named senior official | Annually by rule; in practice on any new lane, commodity or terminal |
| Personnel security 172.802(a)(1) | How you confirm information from applicants hired into positions with access to and handling of the covered materials | Whoever hires | Annually; also when hiring practice or screening vendor changes |
| Unauthorized access 172.802(a)(2) | Measures against unauthorized persons reaching the materials or the conveyances prepared to carry them: yard control, keys, seals | Yard supervisor, or the owner | Annually; also after a yard, gate or parking change |
| En route security 172.802(a)(3) | Measures origin to destination, explicitly including shipments stored incidental to movement: stop rules, check-in intervals, unplanned layovers | Dispatch and driver | Annually; also on route or customer changes |
| Senior official 172.802(b)(1) | The job title of the person responsible for development and implementation | The company | Annually; immediately if the position changes |
| Duties and notification 172.802(b)(2) | Duties per position or department, plus the process for notifying employees when specific elements must be implemented | The named official | Annually; also whenever the org chart moves |
| Training plan 172.802(b)(3) | How hazmat employees get training under 172.704(a)(4) and (a)(5) | The named official | Annually; and see the 90-day trap below |
| Form, retention, access 172.802(c), (d) | In writing, kept as long as it remains in effect, current version available to implementing employees, all copies maintained as of the latest revision date, a copy accessible at or through the principal place of business for a DOT or DHS official | The company | Continuous, and on demand |
Yes to the first; the second is not a number of years. Section 172.802(c) packs five duties into one block:
Section 172.802(d) handles production: a copy or electronic file must be accessible at, or through, the principal place of business and made available on request, at a reasonable time and location, to an authorized official of the Department of Transportation or the Department of Homeland Security. Note the two agencies: this is one of very few trucking records DHS can ask for directly.
Start with who counts. Under 49 CFR 171.8, a hazmat employee is anyone employed full time, part time or temporarily who directly affects hazmat transportation safety, expressly including anyone who loads, unloads or handles it, prepares it for transportation, is responsible for safety of transporting it, or operates a vehicle used to transport it. It also covers the self-employed, including an owner-operator, so a one-truck company cannot claim it has no one to train. Under 172.702 the employer must ensure each is trained and tested by appropriate means.
| Training | Who gets it | What it covers | New hires | Recurrent |
|---|---|---|---|---|
| Security awareness 172.704(a)(4) | Every hazmat employee, plan or no plan | Security risks in hazmat transportation, methods to enhance security, and a component on how to recognize and respond to possible security threats | Within 90 days after employment | At least every 3 years |
| In-depth security 172.704(a)(5) | Employees who handle the covered materials, perform a regulated function related to them, or are responsible for implementing the plan | Company security objectives, organizational security structure, specific security procedures, duties and responsibilities for each employee, and actions to take in the event of a security breach | Same 90-day window under 172.704(c)(1) | Every 3 years, or within 90 days of implementation of a revised plan |
PHMSA's security training FAQs add that those employees must be trained on the specific portions of the plan for which they are responsible. Three mechanics people get wrong:
Recordkeeping is 172.704(d): retain a record of current training inclusive of the preceding three years, keep it as long as the person is employed as a hazmat employee and 90 days thereafter, produce it on request. Five elements: the name; the most recent completion date; a description, copy or location of the training materials used; the name and address of the trainer; and certification that the employee has been trained and tested. A certificate with a name and a date satisfies two of five.
It shortens, and this is the trap that catches carriers who did everything else right. The general rule in 172.704(c)(2) is recurrent training at least once every three years. The same paragraph carves out the in-depth security training: every three years or, if the security plan for which training is required is revised during the three-year recurrent training cycle, within 90 days of implementation of the revised plan. Stack that against 172.802(c), which forces at least an annual review.
| What you did at the annual review | What the in-depth training clock does |
|---|---|
| Reviewed, changed nothing, documented the review | Unchanged. Next in-depth training due at the 3-year mark |
| Revised the plan and implemented the revision | 90 days from implementation to retrain everyone covered by (a)(5) |
| Added a commodity or lane and updated the risk assessment | 90 days. The risk assessment is part of the plan |
| Changed the named official's job title in the plan | A revision was implemented: treat it as 90 days and document notification under 172.802(c) |
Two consequences. A documented no-change annual review is cheaper than a revision, so batch revisions deliberately. And the training record must agree with the revision history: a plan revised in March against in-depth training dated the previous year is a discrepancy an investigator finds without any analysis.
Documents first: the written plan, the risk assessment inside it, the revision date, the matching training records, and whether the people named can describe their duties. What makes it expensive is the scoring. Appendix B to Part 385 splits regulations into acute, where noncompliance is so severe as to require immediate corrective action regardless of the carrier's overall safety posture, and critical, tied to management or operational controls. Then arithmetic: for each instance of noncompliance with an acute regulation, or each pattern of noncompliance with a critical one, one point is assessed. A pattern is more than one violation, and where documents are reviewed it needs violations equal to at least 10 percent of those examined.
| Regulation | How Appendix B describes it | Class | What it takes to score a point |
|---|---|---|---|
| 172.800(b) | Transporting HM without a security plan | Acute | One instance |
| 172.800(b) | Transporting HM without a security plan that conforms to Subpart I requirements | Acute | One instance. A plan missing a component lands here |
| 172.800(b) | Failure to adhere to a required security plan | Acute | One instance. The plan exists and is ignored |
| 172.704(a)(4) | Failing to provide security awareness training | Critical | A pattern: more than one, or 10% of records examined |
| 172.704(a)(5) | Failing to provide in-depth security awareness training | Critical | A pattern, same test |
Appendix B groups parts of the FMCSRs and HMRs into factors, and on this point the appendix contradicts itself: paragraph II(f)(1) lists Parts 172 and 173 as a regulatory factor, while the rating table in section III.C names only five factors and its hazmat line reads Factor 5, Haz. Mat. = Parts 397, 171, 177 and 180, with Part 172 absent. Since the table gives Part 172 no row of its own, in practice the point for a 172.800(b) violation lands on the hazmat factor rather than on a separate line of the rating table. Each factor is then rated: Satisfactory at 0 points, Conditional at 1, Unsatisfactory at 2 or more. The arithmetic is unforgiving: one missing security plan is one acute instance, one point, and that alone is enough to make the hazmat factor Conditional. Add a pattern of missing in-depth training and the factor reaches two. The rating table then offers two roads to an overall Unsatisfactory: two or more Unsatisfactory factors, or one Unsatisfactory factor together with more than two Conditional ones. One Unsatisfactory factor with two or fewer Conditional factors leaves the overall rating Conditional. Note also paragraph (h): a pattern under Part 395, hours of service, is scored two points rather than one, so a hazmat file and a logbook problem in the same review compound quickly.
For a placarded-quantity carrier, an Unsatisfactory rating also moves faster. Under 49 CFR 385.13(a)(1), carriers of hazardous materials in quantities requiring placarding, and carriers of passengers, are barred from operating a CMV in commerce beginning on the 46th day after the notice of proposed Unsatisfactory rating. All others reach that point on the 61st day and may get up to 60 additional days if FMCSA finds a good-faith effort to improve. Hazmat carriers get 15 fewer days and no discretionary extension there. See our DOT audit document checklist and DOT audit types explained.
Do not confuse the plan with the hazardous materials safety permit in 49 CFR 385.403, a separate requirement with its own short list: a highway route-controlled quantity of Class 7 material; more than 25 kg (55 pounds) net weight of a Division 1.1, 1.2 or 1.3 explosive, or a placarded amount of Division 1.5; more than one liter (1.08 quarts) per package of a hazard zone A poison-inhalation material; a hazard zone B poison-inhalation material in a bulk packaging; a hazard zone C or D one in a packaging of 13,248 L (3,500 gallons) or more; and methane or natural gas, or any liquefied gas at least 85 percent methane, in a bulk packaging of 3,500 gallons or more. Note the mismatch: any quantity of a poison-inhalation material pulls you into Subpart I, while the permit duty starts at one liter per package. Different part, different document, different numbers.
No, and it matters, because 172.820 is long and frequently pasted into templates sold to trucking companies. Section 172.820 opens with "Each rail carrier transporting in commerce one or more of the following materials". Its triggers are rail triggers: more than 2,268 kg (5,000 lbs) in a single carload of a Division 1.1, 1.2 or 1.3 explosive, a poison-inhalation material in a single bulk packaging, a highway route-controlled quantity of Class 7 material, or a high-hazard flammable train. Its duties are rail duties: commodity data by route within 90 days after each calendar year, a written route analysis and alternative route analysis, annual selection of the least-risk practicable route, a routing contact for Fusion Centers, consignee notice within 48 hours of a significant delay, records kept a minimum of two years.
None of that binds a motor carrier. If your template contains route analyses, Fusion Center contacts or a two-year retention rule, it was written for a railroad. Watch the retention line: 172.820(i)(1) sets two years for rail records, while 172.802(c) keeps your plan for as long as it remains in effect. Copying the rail number into a truck plan documents your own noncompliance.
TruckerNavi handles the safety side for Russian-speaking carriers in NY, NJ, FL and across the country: applicability screening against 172.800(b), a written security plan built to 172.802, the annual review with a dated record, 172.704 training tracking including the 90-day revision trap, DQ files, Drug & Alcohol program and DOT audit prep. Safety Compliance: BASIC (БАЗОВЫЙ) $99/mo, START (СТАРТ) $189/mo, PREMIUM (ПРЕМИУМ) $499/mo. Want to know what an investigator would find in your file before he does? Mock DOT Audit, $399. Opening a company from scratch? Authority Bundle, $499. Russian and English.
See Safety Compliance plans →Or just call: (315) 871-0833 · WhatsApp
No. The duty in 49 CFR 172.800(b) attaches to a specific list of sixteen material categories, each with its own quantity trigger. A carrier that never touches any of the sixteen has no security plan obligation at all, even if it carries hazmat every day and even if its drivers all hold the H endorsement. A carrier that touches even one of them must develop and adhere to a transportation security plan conforming to Subpart I of Part 172.
Section 172.800(b) defines it inside the section text: a quantity greater than 3,000 kg (6,614 pounds) for solids or 3,000 liters (792 gallons) for liquids and gases in a single packaging such as a cargo tank motor vehicle, portable tank, tank car, or other bulk container. The words in a single packaging do the real work. Sixteen drums adding up to 880 gallons are not a large bulk quantity, because no single packaging holds more than 792 gallons.
No, and this is the most common mistake. Placarding is the trigger for only four of the sixteen categories in 172.800(b): Division 1.4, 1.5 and 1.6 material requiring placarding, desensitized explosives meeting the definition of Division 4.1 or Class 3 requiring placarding, Division 4.3 material requiring placarding, and uranium hexafluoride requiring placarding under 172.505(b). Everything else is keyed to a class plus a quantity, not to whether a placard hangs on the trailer.
Under 49 CFR 172.802(a) the plan must contain a risk assessment plus, at a minimum, three elements: personnel security, meaning measures to confirm information provided by job applicants hired for positions that involve access to and handling of the covered materials; unauthorized access, meaning measures addressing the risk that unauthorized persons gain access to the materials or to conveyances being prepared for transportation; and en route security, meaning measures addressing the risks of shipments en route from origin to destination, including shipments stored incidental to movement.
Yes. Section 172.802(c) states that the security plan, including the transportation security risk assessment, must be in writing and must be retained for as long as it remains in effect. Section 172.802(d) adds that a copy or an electronic file must be accessible at, or through, the principal place of business and must be made available on request, at a reasonable time and location, to an authorized official of the Department of Transportation or the Department of Homeland Security.
At least annually, under 49 CFR 172.802(c), and revised or updated as necessary to reflect changing circumstances. The same paragraph adds three duties people miss: the most recent version must be available to the employees responsible for implementing it, all of those employees must be notified when the plan is updated or revised, and all copies of the plan must be maintained as of the date of the most recent revision.
Under 49 CFR 172.704(a)(5), every hazmat employee of a company required to have a security plan who handles the covered materials, performs a regulated function related to them, or is responsible for implementing the plan. PHMSA guidance states that in-depth security training is required only for those employees, while the separate security awareness training under 172.704(a)(4) applies to every hazmat employee. In-depth training must cover company security objectives, organizational security structure, specific security procedures, specific duties and responsibilities for each employee, and actions to take in the event of a security breach.
The clock resets to 90 days for the in-depth portion. Section 172.704(c)(2) requires recurrent training at least once every three years, but adds that for in-depth security training under 172.704(a)(5), if the security plan for which training is required is revised during the three-year recurrent training cycle, the employee must be trained within 90 days of implementation of the revised plan. Since 172.802(c) forces at least an annual review, a carrier that actually changes something in the plan owes retraining long before the three-year mark.