The DHS letter sent out to each facility will likely outline specific issues that must be covered in the SSP. This is to ensure that facilities develop and implement a security plan appropriate for the facility’s relative risk. The guide for developing the plan is covered in a set of 18 published Risk-Based Performance Standards (RBPS) and each tier has a specific set of standards to meet. Putting together an SSP will be a challenging task for most facilities. DHS estimates a minimum of 200 man hours are needed for the submission of each plan. The good news is facilities will have some flexibility in determining how to meet the RBPS.
RBPS cover a variety of areas including perimeter security, securing set assets, screening, as well as access control and monitoring. Every facility must submit an SSP online and describe how it will meet the requirement of each RBPS including a description of equipment, processes and procedures.
Some integrators experienced in petro-chemical facility security have been following CFATS from its inception. These integrators can help petro-chemical facilities both with their SSP submission and the implementation by providing solutions for specific tier rankings and each RBPS. Many petrochemical facilities have safety officers but some do not have personnel specifically covering security issues, so the safety officer has to fill in the gaps. To help them with the process, these facilities need to look for a security integrator with the following qualities:
- An extensive background in chemical plant security with an understanding of the industry’s needs and complexities.
- A knowledge and understanding of CFATS. The integrator needs to know the background and have a good understanding of tiering and RBPS requirements.
- Chemical-terrorism Vulnerability Information certification (CVI) – DHS has implemented restrictions to make sure that the information facilities have provided the department does not fall into public hands. An integrator with CVI certification has been pre-screened and instructed on what information needs to be kept private and how to keep it from getting into the public arena.
- Safety Act Certification – This means that the integrator’s electronic security services have been certified by the DHS to limit the legal liability of the end-user if a terrorist act should occur.
An integrator should also be aware of the latest technology available to meet the specific security needs of chemical plants. Perimeter security is the first RBPS and integrators need to be highly educated about the latest in intrusion detection including fiber-based fencing, video analytics and radar detection. Access control is another key element in plant security and the integrator should know the latest in access cards and biometric security. Integrators also need to have knowledge about the basics, including K-rated fences and vehicle barriers that can withstand a hit from a 15,000-pound vehicle at up to 50 miles per hour.
Another key element to selecting an integrator is to look for one that will examine a facility’s security goals and challenges and come back with cost-effective solutions based on the integrator’s knowledge and background in security and specifically chemical facility security. A design-build approach gives the integrator the freedom to put together the best and most efficient system available which usually saves the end-user money and time.
DHS will review security plans and give each facility a deadline for implementation. The department will monitor CFATS facilities and conduct regular on-site inspections to ensure plans are approved and implemented. The standards provide that facilities, found to be out of compliance, may be fined up to $25,000 a day or even face the possibility of immediate closure by DHS.
The original legislation gave DHS three years to develop and implement the program for high-risk chemical facilities. On June 15, 2009, several senior Congressional lawmakers introduced that would modify and make permanent the authority of the Secretary of Homeland Security to regulate security practices at chemical plants and facilities. The legislation, House Resolution 2868, was introduced by Bennie G. Thompson (D-Miss.), who serves as chairman of the Homeland Security Committee. HR 2868 has been sent to the House Energy and Commerce Committee for further review.
It has also been speculated that the large number of coastal petrochemical facilities now covered by the MTSA, which is overseen by the U.S. Coast Guard, will be placed under CFATS. Municipal water and water-treatment facilities could also be put under DHS jurisdiction in the future.