CSAT 2.0 Update – 10-07-16

I just finished a conversation with David Wulf, the Director of the DHS Infrastructure Security Compliance Division, and some of his staff about the roll out of the new Chemical Facility Anti-Terrorism Standards (CFATS) risk assessment methodology and the associated changes in the Chemical Security Assessment Tool (CSAT) known as CSAT 2.0.

New Top Screen

DHS has already sent out the first set of notification letters directing facilities to submit new Top Screens. Wulf expects to send out 700 to 800 letters every two weeks for at least the next year or so. Simple math would indicate (and Wulf confirmed) that ISCD would be sending Top Screen notification letters to facilities that had previously submitted Top Screens but had been notified that they were not considered to be at high-risk of terrorist attack and thus not covered under the CFATS program.

ISCD is also taking a slightly different tack than they have used in earlier rollouts in the selection of current facilities that will receive their notification letters. Previous CSAT roll outs have focused on the highest risk facilities first. For CSAT 2.0 ISCD is sending letters out in each batch to a mixture of Tier 1, Tier 2, Tier 3, Tier 4, and uncovered facilities.

Notifications

ISCD expects to send out the first notification letters based upon Top Screen 2.0 results sometime after the first of the year. Some existing facilities will Tier out of the CFATS program because the new risk assessment methodology will no longer rate them at high-risk facilities. Those facilities will no longer be covered by the CFATS program.

Other existing facilities will be notified that their Tier assignments have changed. Those notification letters will indicate which areas of their existing (authorized or approved) site security plans (SSP) will need to be changed to reflect those changes. Deadlines will be provided for the required SSP edits.

Facilities that are notified that they are now covered by the CFATS program will be given 120 days to submit the new SVA/SSP. Those two previously separate tools have been combined into a single submission document.

Expanded CFATS Coverage

Wulf does expect the number of covered CFATS facilities to increase as a result of this new risk methodology and re-contacting facilities that had previously submitted Top Screens. Just how many new facilities might be involved is hard to say. A certain proportion of those facilities will no longer have inventories of DHS chemicals of interest (COI) [NOTE: Facilities that receive notification letters will still need to submit Top Screens even if they do not have current inventories of COI.] Those facilities will almost certainly not be brought into the CFATS process.

Some facilities will have increased their COI inventory levels or added new COI. They should have already submitted Top Screens when those inventory changes were made. Fortunately for those facilities, the way the Top Screen is written there is no attempt made to chase back when those inventories were increased. That means that notified facilities do not need to worry about ISCD taking regulatory action against them for not making timely notifications as long as the file their new Top Screens within the 60-day time limit from the date of the notification letter.

There will still be some facilities with no changes in COI inventory that will now be covered by the CFATS program because of the different risk assessment methodology. Wulf expects that the number of new CFATS facilities will not be overly large.

ASP and EAP Not Affected

The new CSAT 2.0 will not affect the use of the Alternate Security Program (ASP) or the Expedited Approval Program (EAP). Those alternatives to the SSP will still be available for selected facilities. Even if the EAP is not used, facilities will find the EAP guidance document valuable for helping them select appropriate security measures to include in their SSP.