With the large number of facilities (40,000+ by DHS estimates) that will now be required to complete the Top Screen, it seems like a good time to review the hardest part of the Chemical Security Assessment Tool (CSAT) to understand, the registration process. CSAT is the online tool that DHS will use to accept, review and evaluate all information pertaining to the security situation at a chemical facility. The registration process is the way that DHS gets the facility entered into CSAT, determines who at the facility is authorized access to CSAT, and allows DHS to provide secure access to those personnel.
Actually the registration process is easy to understand once one gets past the roles of the four different players involved in the registration process; the Preparer, the Submitter, the Authorizer, and the Reviewer. Good, legal definitions of these four roles, along with instructions for completing the registration process, can be downloaded from the DHS web site. That lengthy .PDF document is the CSAT User Registration User Guide. What follows is the stadium program version of the data on these important players in the CSAT game.
Authorizer:
The Authorizer is the person in the organization that has responsibility for facility security; either a corporate officer or a person appointed by a corporate officer. While the Authorizer does not directly enter or edit information in the online CSAT, he is responsible for signing the final documents certifying the identity of the Preparer and Submitter. The Authorizer must be domiciled in the United States. The Authorizer may full fill that role for multiple facilities in the organization, or there may be a separate Authorizer for each facility.
Submitter:
Again the Submitter must be a corporate officer or appointed by a corporate officer to fulfill these duties and must be domiciled in the United States. The Submitter may also be the Authorizer. The Submitter is the person that actually submits the information in the CSAT system. As such the Submitter will be provided with a Username and a Password by DHS after the registration process is complete. A single Submitter may be designated for multiple facilities within a corporation.
Preparer:
The Preparer is not required to be an officer of the corporation or formally appointed by an officer, though the Preparer must still be domiciled in the United States. The Preparer may also be the Submitter or Authorizer. The Preparer is the person that actually enters data into the CSAT, but is not authorized to officially transmit data to DHS. The Preparer will be issued a Username and Password by DHS. While the Preparer may serve that role for multiple facilities, the requirements for data preparation require intimate knowledge of the facility so the Preparer will most often represent a single facility.
Reviewer:
A Reviewer is a person that is authorized to look at a facilities’ data in CSAT but is not authorized to enter or change that data. There may be multiple Reviewers designated for a single facility and a Reviewer may be designated for multiple facilities. The Reviewer provides an additional set of eyes to make sure that submitted data is correct and allows for personnel at a facility to go back and look at CSAT data after it has been submitted.
Designating the Players:
What must be kept in mind when selecting the people to fulfill these roles in the CSAT process is that these are the people that will be dealing with the Top Screen Submission. For those facilities that end up being designated High-Risk Facilities, these people will also be submitting Security Vulnerability Assessments (SVA) and Site Security Plans (SSP) within CSAT. Careful thought should go into selecting and designating these roles.
Smaller organizations with only a single facility that will be required to submit a Top Screen will have an easier time making these selections. An Environmental Health and Safety Manager will probably fulfill the role of Authorizer; adding Security to the regulatory requirements covered by that individual. The facility manager will probably have the role of Submitter. Depending on the size of the facility that manager may also be the Preparer or that role may be delegated to another manager within the facility. There may be no Reviewers designated or that role may be given to a security consultant hired to help the facility complete the CSAT process.
For larger organizations with multiple facilities the situation may get much more complex. There may be a single Authorizer for the organization or there may be multiple Authorizers, each responsible for one or more facilities within the organization. The same holds true for Submitters and Preparers. There can only be a single Submitter and Authorizer on each registration, but there can be multiple facilities with a different Preparer for each facility or the same Preparer for two or more of the facilities all on one registration.
Each time a registration is completed the Submitter and Preparer(s) will receive a User Name and Password. To ease the problem of remembering multiple Usernames and Passwords there should be a single registration covering all of the facilities that a Submitter will be responsible for. These facilities will also have to have a single Authorizer. Since an Authorizer does not receive a User Name and Password, there is no reason that a single Authorizer cannot be on multiple registrations.
DHS has made provisions to change personnel within the CSAT system. The procedures are relatively simple and they have provided another large .PDF document, CSAT User Change Request Guide, to explain how to make these personnel changes, but that is the topic for another blog.
While the selection of Authorizers, Submitters, Preparers and Reviewers is an important part of the CSAT process, facilities should not take too much time in making these selections. Since the registration process requires physically mailing off a signed copy of printouts from the on-line registration process, and DHS will not provide the Usernames and Passwords until that mailed document is received, facilities need to complete the online portion of the registration process in an expedited manner. Facilities that have to submit a Top Screen due to possession of more than the Screening Threshold Quantity of a chemical(s) listed in Appendix A, 6 CFR part 27, have until January 18th, 2008 to complete that Top Screen. Not completing the Top Screen by that date due failure to get the Username and Password back in time due to late mailing of the signed registration documents (and remember that Christmas slows the mail) may result in a fine of up to $25,000 per facility.
Completing the registration process for CSAT is an important first step in complying with the Chemical Facility Anti-terrorism Standards (CFATS) outlined in 6 CFR part 27. While the registration has little to do with actual security situation at a chemical facility, it is the first step in the formal security assessment required by these new regulations.
Posts
No comments:
Post a Comment