The final step in the process is the development of a site security plan (SSP) that will document how your company will meet the requirements of the 18 risk-based performance standards identified in the IFR to protect those items identified in your security vulnerability assessment. The site security plan is also part of the CSAT process and DHS will be issuing a 200-plus page risk-based performance standards guideline this August to assist you in the development of your site security plan. That will be the most difficult step in the process because it may go beyond the individual facility you are trying to protect. You may also have to include the physical location of required records and IT security requirements, if they are housed at a different location, such as your corporate headquarters.
Once you have submitted your site security plan it will be reviewed and compared against the security vulnerability assessment to determine if you have adequately addressed the protection of the facility in accordance with the risk-based performance standards. Upon approval, DHS will provide a letter that becomes your facility's security operating permit. To ensure your company's continued compliance and adherence to your approved plan, DHS field inspectors will conduct periodic in-depth site audits.
As you are most likely aware, CFATS has a sunset date at the end of October 2009, but the majority of chemical/petrochemical professionals believe it is here to stay in one form or the other. The only options that I see is that it becomes law as it is currently written, or with revisions. It also could be replaced by a different set of regulations like those proposed in the Thompson Bill (HR 5577), which would be stricter then the current IFR. The pressure is currently on the DHS to move quickly to show results under the current CFATS IFR. To do this, the DHS' CFATS staff is expanding, as is its budget. Plans call for DHS to have 10 field offices by the end of this year with a staff of 160, and then an increase to 300 in 2009. The 2008 budget is currently at $50 million, with a 2009 projection of $63 million.
As with other critical infrastructures, security requirements for the chemical and petrochemical industry are increasing and becoming more regulated. The final impact this will have on your company is yet to be determined. From my experience in the nuclear utility security industry, I would suggest that your company start to consider security as just another cost of doing business. Making the right choices now in the design of your site security plan will greatly assist you in keeping those costs within reason.
About the author: Richard A. Michau, CPP, is vice president of the chemical/petrochemical division of AlliedBarton Security Services, a premier provider of highly trained security personnel. He can be reached at firstname.lastname@example.org.
[Editor's note: Previous versions of this story indicated that facilities governed under the Maritime Transportation Security Act would be required to complete a Top Screen. That is not the case; facilities governed under the Maritime Transportation Security Act will not be required to complete a Top Screen.]