CSAT SSP Edit Process

Yesterday I noted that DHS had published a new manual as part of the Chemical Security Assessment Tool (CSAT). That manual, the CSAT SSP Edit Process User Guide, outlines the procedures to be used to edit either Administrative or Technical information in a submitted Site Security Plan.

PET PEAVE WARNING: Before I start looking at the details of the process outlined in the manual let me voice a vociferous complaint about a purely administrative matter. I really get upset when anyone, but especially a government entity, publishes a .PDF document with a security setting which prohibits the copying of information from the document. It serves no real security purpose and makes the job of reviewers like myself more difficult. It also makes it more difficult for covered facilities to incorporate information from the manual into local procedure documents. DHS has been pretty good about avoiding this setting, but this document is so protected. BAH HUMBUG.

Editing SSP

Once a facility’s site security plan (SSP) has been submitted there have been no provisions for going back and modifying information in that document without going through the Help Desk. This new manual explains how facilities can now go through the on-line CSAT to do this post-submission editing.

DHS and the writers of this manual take great pains to explain that starting the editing process does not change any of the time limits in the CFATS process for the editing facility. Modifications of deadlines for SSP or subsequent Top Screen Submission must be done through the extension process outlined for those submissions. This is explained in this manual and in on-line disclaimers which must be acknowledged before you can finish requesting to start an edit.

One other item that needs to be understood is how these edits affect an approved SSP. A currently approved SSP remains in effect until this edit is submitted and approved by DHS.

Administrative or Technical Edit

There are two distinct types of data that can be edited using this process and one item (Geospatial Information – Latitude and Longitude of facility) that must still be edited through the Help Desk. Administrative data is described as “information pertaining to your facility’s description, contact information, local police, fire, and Emergency Management Team (EMT) jurisdiction information, and employee and workshift information” (para 1.2, pg 1). Technical data is described as “information pertaining to your facility’s operations, security measures, and other areas which are not considered an administrative edit”.

NOTE: There is actually a third option. If the facility just needs to update the facility name, address, owner, or operator information the Submitter can use the ‘Update Facility Info’ button on the CSAT Survey List Screen when you first sign into the CSAT web site. This avoids the whole edit procedure.

To provide more clarity, DHS provides an exhaustive list of the Administrative Edit covered data in Appendix B. It provides a list of questions that are covered under the Administrative Edit. All other SSP questions (except the Geospatial data) are covered under the Technical Edit.

The reason for the different types of edits is related to the frequency which DHS-ISCD will allow the edits to be conducted. Technical edits can only be done once every 90-days while there are no restrictions on the number of times that a facility can execute an Administrative edit. The reason is that the questions eligible for Administrative edits are not substantive from a security perspective; they reflect descriptive data and point of contact information. The technical data has direct bearing on security issues and requires substantial review and approval on the part of DHS.

Edit Procedures

The procedures for conducting an edit are relatively simple (from a CSAT perspective) but somewhat time consuming. A facility Submitter will sign on to the CSAT web site. There they will have the option of selecting either an Administrative of Technical edit from the latest SSP submission on the CSAT Survey List Screen. Clicking on either button will take you to the appropriate Disclaimer page. This reminds people that the Edit function does not change due dates or become effective until approved by DHS.

When the Administrative Edit is selected the Submitter will be shown a screen listing the SSP questions that fall under that edit procedure (the same list as found in Appendix B). This provides one-last check to ensure that no Technical Edit questions need to be addressed. If an Administrative Edit is the appropriate edit, check the ‘Continue’ button and you will be returned to the CSAT Survey List Screen.

When the Technical Edit is selected there will be a brief additional disclaimer screen. If you have not waited at least 90 days since the last technical edit, when you click the ‘Continue’ button you will be taken to an error message letting you know when the current 90-day limit is up. If you don’t receive this error warning you will be returned to the CSAT Survey List Screen.

In both cases, returning to the CSAT Survey List Screen will show a “Pending Data Retrieval” message to the right of the latest SSP. No further action can be taken until DHS sends the Submitter an email letting him know that the SSP is now available for editing. Then the Preparer can sign back in to CSAT and will see a ‘New’ SSP listing with an appropriate ‘Input Changes’ Button to the far right of that new SSP. Clicking on that button will take the Preparer into the SSP Tool with all of the information pre-populated from the last SSP submitted.

At this point, all of the procedures for filling out the original SSP apply. This includes data entry procedures, moving between pages, saving copies, validating entries, printing copies and transmitting to the Submitter for the actual submission of the edited version. The only difference will be that when the Submitter actually pushes the ‘Submit’ button there will be an addition Disclaimer screen reminding the Submitter that due dates have not changed and that the existing (pre-editing) version of the SSP remains in effect until the edited version is reviewed and approved by DHS.

Decisions

The hardest part of this new process seems to be deciding when to do a Technical Edit. I’m not talking about the decision between an Administrative Edit and the Technical Edit (Appendix B makes that decision simple), but the actual decision about when to make a Technical Edit. Because of the 90-day limit between making Technical Edits, facilities need to make sure that they consider consolidate pending changes into a single change.

If there is a time-critical change that will require a Technical Edit, facility management will have to decide if making that change will justify postponing any other planned changes until after the 90-day limit has passed. Generally speaking, consolidating Edits makes a lot of sense. I suspect that the folks reviewing/approving the edited versions of SSP’s will greatly appreciate such consolidation.