Preparing for SSP Submission

Now that the CSAT SSP tool is open and available for SSP submissions high-risk chemical facilities will need to get serious about completing their site security plans and preparing for SSP submission. Facilities cannot begin the submission process until they receive their Final Notification Letter (FNL) from DHS officially designating them a High-Risk Facility, assigning them to a Tier level, defining the chemicals of interest (COI) that must be covered in the SSP, and outlining the security/vulnerability issues that must be addressed by the Risk-Based Performance Standards (RBPS) listed in 6 CFR §27.230. The letter also provides the submission deadline that marks the end of the 120-day submission requirement. Facility CSAT Personnel Roles All facilities that receive an FNL will have already submitted two documents using the Chemical Security Assessment Tool (CSAT). The Preparer, Submitter, Reviewer and Authorizer roles from those earlier submissions will be the same for the SSP Submission. The Preparers will typically be responsible for data entry. Reviewers will be able to look at the SSP submission on-line, but will not be able make any changes to the data. The Submitter will be responsible for the final facility review and actually submitting the completed SSP to DHS. The Authorizer will have no direct role in the SSP submission beyond verifying to DHS any changes made to the Preparers or Submitter. Facilities may authorize a single person to have multiple roles with the exception of Reviewers; no one designated a Reviewer will be allowed to be a Preparer or Submitter. Typically those individuals who were assigned to Preparer, Submitter, Reviewer roles in earlier CSAT submissions will be performing the same roles during the SSP submission. This is not, however, required by DHS. Facilities may make changes to any of these roles at the start of the SSP submission process. Additionally, multiple Preparers and Reviewers may be added for each facility. Facilities must remember that anyone accessing the facility records in CSAT must have completed the on-line CVI training and is an Authorized CVI User. Multiple Preparers DHS has added provisions for facilities to use multiple Preparers, something new for the SSP Tool. They recognize that there will be a number of facilities that will be using people variety of technical skills and backgrounds for preparation of the SSP. The decision was made to allow facilities to decide to allow those subject matter experts to help prepare the SSP submission in their respective specialty areas. The SSP Instructions manual implies that multiple Preparers may be working on the SSP at the same time when it says (page 9): “When multiple preparers are updating the same SSP, changes made by one will be visible to the others as soon as those changes are saved (by clicking Save, Next or Back).” This appears to be misleading because the same document later notes that SSP must be completed sequentially. On page 11 it explains that:

“That is, when you jump back to a previous section, all preceding sections will become un-highlighted [inaccessible] and you will be required to page through all the subsequent pages of the SSP tool. This is necessary because the SSP tool adapts the pages presented for completion based on answers on previous pages and a change within one section might require you to answer additional/different questions later.”

Given that subsequent pages may affected when data is entered into an SSP page, it will be a good idea for facilities to coordinate the data entry efforts made by multiple Preparers. When changes have to be made on previously completed sections it will certainly be a good idea for Preparers to review subsequent sections that have already been completed. This will make the review job of the Submitter much easier and reduce the number of SSPs rejected by DHS. Data Preparation The Instructions manual (page 5) provides a fairly comprehensive list of resources that facilities will need to complete the SSP submission process. The DHS list includes such things as copies of the CFATS regulations, the facility Top Screen and SVA submission, a copy of the FNL, among other things. All of the things on the list will undoubtedly be valuable for the Preparers and Submitter have readily at hand during the preparation for the SSP submission. In fact, it would make things much simpler if all of this material were maintained in a lockable office set up just for CFATS administration at the facility. This would make it much easier to comply with rules for safekeeping of CVI. A number of the items on the DHS list of resources are CVI and draft documents that the facility compiles for the purpose of SSP submission will be CVI as well. A dedicated room to which only CVI authorized personnel will have access to will make the required CVI security procedures much less intrusive to the SSP preparation and submission process. One invaluable resource that is not included on the DHS list is the SSP Questions manual. This manual provides a list of the questions found on the SSP tool. With room available to record answers and write notes this manual can serve as a workbook for the off-line preparation of the SSP submission. Again, as soon as any facility information is added to this manual it becomes CVI and only CVI Authorized Users may have access to the annotated document. The manual can also be used as a management tool for assigning responsibility for collecting and developing submission data. The manual can be printed and taken apart to provide teams or responsible individuals as an assignment template. This will allow them to work on portions that they are most familiar with. This will also provide for management review and approval of the data before it is added to the on-line tool. This will also make the Submitters review easier before the SSP is actually submitted to DHS. Once again, these partial documents will become CVI as soon as facility information is added. This means that marking and security provisions will apply to these portions of the manual and only CVI Authorized Users may work with them.