TSA can, and probably does, have its own set of regulations, policies, and standard operating procedures that are not codified in any CFR. As it is CFRs are not laws in the sense we typically think of laws and really are more administrative laws that cut across the whole Federal government. For instance the US Army has hundreds of regulations, field manuals, training manuals, standard operating procedures, etc., from the very highest Army-wide level down to the lowest unit level and the majority of those are not based on a CFR. That said there are some instances where a CFR is based on law and the CFR lays out how the Federal government will comply with and enforce the law. Typically the CFR lays out general guidelines and charges Federal agencies with enforcing the law and requires they develop their own appropriate set of regulations, etc. It’s a bit of a gray area sometimes hard to understand even to those of us in the Federal government. Bottom line is there may be a CFR that requires Federal agencies to adhere to and enforce Federal controlled substance laws but most probably doesn’t get down to the detail that TSA personnel are required to report suspected substances. That more likely is a TSA level regulation, policy, or other appropriate guideline.