CFATS: Chemical facility anti-terrorism standards

Richard A. Michau, CPP, is vice president of the chemical/petrochemical division of AlliedBarton Security Services, and an expert on government compliance regarding CFATS.

Photo courtesy stock.xchng/Czarest
CFATS regulations affect security planning for chemical plants. Richard Michau, CPP, explains the process in this article for SecurityInfoWatch.com.

No one would deny the importance of protecting our chemical and petrochemical facilities against terrorists and other threats. But putting standards and best practices in place is understandably a lengthy and ever-evolving process. The industry's security leaders need to stay on top of the latest regulations, such as the Chemical Facility Anti Terrorism Standards (CFATS), to be compliant with the law and provide adequate security for their facilities and personnel.

Just over a year ago, on June 8, 2007, the Department of Homeland Security's CFATS Interim Final Rule (IFR) became a Federal Regulation under 6 CFR 27. The IFR along with its Appendix A, Chemicals of Interest (COI), released on Nov. 20, 2007 put in motion the uniform process of assessing our nation's chemical and petrochemical facilities against Risk-Based Performance Standards (RBPS). The purpose is to ensure that "high risk" chemical and petrochemical facilities have the proper security measures in place to prevent the release, theft, diversion, sabotage, or contamination of specific COI, as identified in Appendix A. The impact on the industry will depend on where a company's facility is ranked in the CFATS Tier process.

Under the IFR, if your company or facility manufactures, uses, stores or distributes any COI at the threshold levels identified in Appendix A, your company must have completed an online "Top Screen" using the DHS' Chemical Security Assessment Tool (CSAT) by January 22, 2008. As of March 31, 2008 over 30,000 Top Screens had been submitted and another 7,800 who had requested extensions were due. The DHS expects a total of 42,000 to 45,000 Tops Screens will be submitted before the process is completed.

If you have a facility that would fall under CFATS and you have not completed a Top Screen, it is not too late to do so. But please be aware that if you do not enter the screening process, DHS will be able to identify your facility through state and business record checks they are currently conducting, and will take action under Section 27.300 of the IFR. It also should be noted that if you currently have a facility that is governed under the Maritime Transportation Security Act you are not required to complete a Top Screen.

The DHS is processing all the Top Screens utilizing their computerized CSAT program. This process will place your facility into one of four risk tiers, or remove your facility from the CFATS program all together. It is estimated that of all the Top Screens received, 7,000 to 8,000 of them will be cataloged into one of the four tiers. Of these, it is estimated that approximately 100 will be ranked Tier I (the highest risk facility) and 200 to 300 will be ranked Tier II. The DHS was scheduled to send out all post-Top Screen preliminary letters for all tiers levels via registered mail in mid to late April 2008, however the anticipated delivery for these letters is now July. A facility's tier level is considered confidential and will be classified as Chemical-terrorism Vulnerability Information (CVI). Those facilities that submitted Top Screens but are not considered by DHS to be a security risk threat that would place them in one of the four tiers will be notified by e-mail and also by regular mail. These facilities will not be required to take any further action at this time.

Once you have received your Post Top Screen letter from the DHS, it will give you a specific timeline, based on their preliminary tier level, to complete your security vulnerability assessment (SVA) using the CSAT process. Once you have completed your SVA and submitted it back to DHS a final threat analysis will be performed to determine your facility's final tier level.

The final step in the process is the development of a site security plan (SSP) that will document how your company will meet the requirements of the 18 risk-based performance standards identified in the IFR to protect those items identified in your security vulnerability assessment. The site security plan is also part of the CSAT process and DHS will be issuing a 200-plus page risk-based performance standards guideline this August to assist you in the development of your site security plan. That will be the most difficult step in the process because it may go beyond the individual facility you are trying to protect. You may also have to include the physical location of required records and IT security requirements, if they are housed at a different location, such as your corporate headquarters.