APTA had a voluntary program; FRA staff joined with them to redraft it until Congress mandated Safety Management Plans after the Chatsworth collision. Since the passenger program was already underway at that time, FRA chose to finish it and then circle back and do the same for Class 1 railroads and other railroads with "deficient safety performance." That rule should be out late this year or early next year. The passenger rule includes limited Freedom of Information Act immunity for data gathered solely for the program. As you might imagine the plaintiff's bar vigorously opposed this. Presumably the freight rule will have a similar provision.

Safety Management Plans are relatively common now - mandated in Canada, for example.