To know where its product is located at all times; To ensure that the material is being delivered to or received from a known, approved individual or entity; and To help prevent the theft or diversion of materials through force or deception.A key component of the Product Stewardship responsibility is an active and documented ‘know your customer’ program. DHS suggests that such a program would require that facilities would only sell/deliver hazardous materials to pre-cleared customers that meet certain security criteria. Those criteria would include:
“Verification and/or evaluation of the customer’s on-site security, “Verification that shipping addresses are valid business locations, “Confirmation of financial status, “Establishment of normal business-to-business payment terms and methods (e.g., not allowing cash sales), and “Verification of product end-use.”Most of these criteria are already well established parts of a variety of industry product stewardship programs. The relatively new provision is the requirement to review the customer’s on-site security program. This may cause some interesting problems for facilities because of chemical-terrorism vulnerability information (CVI) requirements for CFATS covered facilities. Sharing information on facility security measures requires verification of authorized user status and need-to-know. Presumably DHS will facilitate such information exchange. Other areas of Product Stewardship that DHS expects to see impact facility security measures include:
Vehicle and shipping control procedures that are periodically tested and evaluated; Unknown vehicle/driver control procedures; Chemical shipping and receiving procedures that identify shipments in advance; Customer pick-up procedures that provide for identification and verification of orders; and Process review procedures for all shipping and receiving processes.Inventory Control DHS expects that covered facilities will be using an inventory control process appropriate to their facility. System capabilities that DHS believes are appropriate to help protect covered COI include:
Listing of all hazardous material on site; Tracking of quantity and location of all hazmat; Monitoring use of hazmat by authorized personnel; Generating reports on location/use of hazmat; Tracking containers of hazmat; Tracking disposal of hazmat and empty hazmat containers; Recording purchasing/receiving records for materials management; and Providing linkage to Material Safety Data Sheet information.DHS notes that inventory control procedures can be enhanced by the use of appropriate physical security measures to control access to covered materials. The security measures listed in this RBPS have been addressed in earlier RBPS sections. Metrics The summary metric suggests that all covered facilities will have “documented processes for securing and monitoring the shipment, receipt, and storage of hazardous materials” (pg 62). The effectiveness of these processes in preventing unauthorized personnel from gaining access to covered materials will vary according to the Tier ranking of the facility. Processes for Tier 1 facilities will such unauthorized access “make it extremely unlikely’ while Tier 2 facilities would be expected to meet an ‘unlikely’ standard. Procedures at Tier 3 and 4 facilities would “reduce the likelihood” such access. The Metric 5.1 ‘standards’ for security of transportation containers are the same for all facilities. Adequate security measures will be provided for all shipping containers not actively involved in transportation. All such containers would be stored within the facilities security perimeter and will be addressed in the facility’s SSP. This would imply that the containers or their storage area would be ‘assets’ covered under RBPS #2. Metric 5.2 require that all facilities have a ‘know our customer program’ with Tier 1, 2, and 3 facilities refusing to sell hazmat to customers not meeting prescribed criteria. Similarly Metric 5.3 requires all facilities to have procedures in place to identify and authorize vehicle access to the facility with accompanying shipping and receiving control procedures. Again all but Tier 4 facilities would include procedures for staging/vetting unexpected vehicles/drivers. Metric 5.4 addresses the requirement for procedures that address confirmation of inbound and outbound hazmat shipments. Procedures for Tier 1 and 2 facilities would address all such shipments while Tier 3 and 4 facilities would cover most shipments. Tier 1, 2 and 3 facilities are expected (Metric 5.5) to have a written procedure for verifying the receipt of orders for hazmat and controlling the sales and storage of hazardous materials. A review process to ensure the effectiveness of these procedures will be included in the procedure.