Airport project drawings and SSI: what A/E firms can't share

What SSI covers in airport project work#

Sensitive security information, or SSI, is a category of unclassified information that federal transportation security rules restrict because its release could harm transportation security. For airports, the TSA rules in 49 CFR Part 1520 govern how it is identified, marked, shared and protected.

Airport design and construction work can generate SSI or depend on it. Security system layouts, access control and badging infrastructure, checkpoint and screening configurations, camera coverage, security-related specifications and vulnerability assessments are the usual places to look. Ordinary sheets can reveal the same information indirectly, through door hardware schedules or secured area boundaries.

An A/E firm that receives SSI to perform airport work generally takes on obligations to protect it and share it only with people who have a need to know. Those obligations generally do not lapse just because a project closes or a contract expires.

SSI is not the only restriction on airport work. Airport contracts often carry their own confidentiality and security terms, and federally funded projects can add conditions of their own. Treat SSI as the clearest reason for exclusion, not the only one.

Which airport project records may contain SSI#

SSI can sit in drawings, models and correspondence, so the review has to cover every record family on an airport project, not just sheets with a security discipline prefix. The table shows where it commonly appears and the default treatment for each.

Look beyond the project folder as well. Airport work often runs across several contracts, and its files collect in proposal folders, marketing image libraries and staff home drives long after the project closes.

Why SSI markings are not enough#

SSI markings are not enough because the rules protect the information, not the label. Documents designated as SSI generally carry a protective marking and a limited distribution statement, but drawing sets may mark only certain sheets, and copies made later often lose the label.

Exported PDFs, sheet extracts sent to a subconsultant, screenshots in an RFI response and linked models all carry content without carrying the original marking. A text search for the marking finds the labeled documents but misses the unlabeled derivatives that matter most in an archive.

Model files are the hardest case. A federated terminal model may hold security device families, camera locations and access control zones on layers that never appear on a printed sheet, so even a set with no marked sheets can produce a model that contains SSI.

That is why a design firm should not try to clear airport records on its own. Decisions about whether material is SSI belong to the airport's security office and TSA, not to the project team.

Who an A/E firm needs to involve#

Before any airport record is considered for reuse, an A/E firm needs answers from several parties, and each answer should be recorded in writing. In practice most firms find it simpler to keep the whole aviation practice excluded than to run this process project by project.

• 1The airport's security office or SSI coordinator, for the status of specific records.
• 2The firm's contract and any security addenda with the airport or prime, for confidentiality and handling terms.
• 3Counsel familiar with transportation security rules, for the firm's obligations as a holder of SSI.
• 4Subconsultants who authored security-related sheets, since their work and duties sit in the same set.
• 5The firm's IT lead, to confirm where airport files, models and email actually reside.

Illustrative: an aviation practice draws a hard line#

Illustrative: a fictional A/E firm has an aviation practice that designs terminal renovations, airfield lighting and parking structures alongside a larger commercial practice. Its project list lives in Deltek Vantagepoint, with Revit models on network storage, markups in Bluebeam sessions and correspondence in project mailboxes.

The aviation practice leader flags every airport project in Vantagepoint with an exclusion code that blocks its folders, models and mailboxes from any export. The firm does not attempt redaction. Even the parking structure work stays out, because its sheets show vehicle checkpoints and the airport has not reviewed them.

The firm's first licensing review proceeds with commercial office and laboratory projects only. Aviation remains excluded by default, and any future change would start with a written request to the airport, not an internal decision.

How to apply a default exclusion#

A default exclusion works only when it is enforced in the systems that feed exports, not just written in a policy memo. Build it into project setup so new airport work is flagged from the first day.

The same review applies to material that leaves the firm in other ways. Marketing case studies, conference presentations and award submissions about airport work often reuse plans and renderings, so route them through the airport as well.

• 1Tag every airport client and project in the ERP or project database with an exclusion flag.
• 2Map each flagged project to its file server folders, model locations, collaboration sessions and mailboxes.
• 3Block flagged locations from export scripts and review staging areas.
• 4Search firm-wide repositories for SSI marking text and airport names to catch stray copies.
• 5Check proposals, lessons-learned files and training materials for reused airport sheets.
• 6Record the exclusion and its basis so later reviewers do not reopen it by accident.

How SourceX treats security-sensitive projects#

SourceX treats security-sensitive projects, including airport security work, as excluded by default. In the SourceX five-step transaction, the Rights step identifies them from project metadata and contracts, and they are kept out of Supply rather than sent through Preparation, because de-identification cannot cure a security restriction.

Where a firm proceeds with other records, the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization, including which project categories were excluded and why.