33 C.F.R. § 106.400 – General.

(a) The OCS facility owner or operator must ensure the FSO develops and implements a Facility Security Plan (FSP) for each OCS facility for which he or she is designated as FSO. The FSP:
1. (1) Must identify the FSO by name or position and provide 24-hour contact information;
2. (2) Must be written in English;
3. (3) Must address each vulnerability identified in the Facility Security Assessment (FSA);
4. (4) Must describe security measures for each MARSEC Level; and
5. (5) May cover more than one OCS facility to the extent that they share similarities in physical characteristics and operations, if authorized and approved by the cognizant District Commander.
(b) The FSP must be submitted for approval to the cognizant District Commander in a written or electronic format in a manner prescribed by the cognizant District Commander.
(c) The FSP is sensitive security information and must be protected in accordance with 49 CFR part 1520.
(d) If the FSP is kept in an electronic format, procedures must be in place to prevent its unauthorized deletion, destruction, or amendment.