Once the perimeter of the high-risk chemical facility is secured people have to be let in and out of the facility so that work can actually get done, products produced and shipped to the customer. Allowing the appropriate people to enter and leave the facility while keeping potential terrorists and other associated evil doers outside of the facility is called access control. This blog deals with personnel access control only, not vehicle or package control; those are extensive topics in their own right.
For the purposes of access control to the facility there are three classes of personnel, those with unaccompanied access, those with accompanied access and those that are not authorized access. In all secured facilities the first class is limited in size and the last class is very large. The relative size of the middle class will vary with the level of risk associated with the facility (Tiers 1 thru 4 for purposes of CFATS) and the day to day security situation.
People that have unaccompanied access (UAA) to the facility are those employees and contractors that have been adequately screened and checked to ensure that they have no known association with known terrorist groups and that their jobs require general access to the facility. There may be areas of the facility where they are not authorized unaccompanied access, but those areas are limited and well defined (more discussion in a future blog). The level of security screening will vary according to the level of risk associated with the facility, but at a minimum {Section 27.230(12)} all personnel authorized unaccompanied access to a high-risk chemical facility will have their names submitted to DHS for check against terrorist watch lists. Management will have to decide (and document) what level of criminal background check is necessary for such employees and having that background check conducted.
The next largest group of people that will be allowed entry to the chemical facility are those that are authorized only accompanied access (AA) to the facility. These will be the delivery personnel, vendors, limited duty contractors, officialvisitors, and the unofficial visitors to employees that periodically enter and exit the facility. In the highest risk facilities these people will be physically accompanied by someone with UAA from the time they enter the facility to the time they leave the facility. At lower risk facilities there may be designated areas within the perimeter fence (offices, break rooms, parking lots, etc) where the accompaniment rule may be relaxed somewhat. At those facilities where the volume of AA personnel would be so high as to be disruptive, management may want to set up the security perimeter to exclude areas like the parking lot, break areas and offices.
Even those people given AA to the facility have to undergo some sort of screening to ensure that they are not a specific threat to the facility. This does not normally rise to the level of conducting a background check or having DHS conduct a terrorist watch list check, but the basic identity of everyone entering the facility must be checked. At higher risk facilities, or when the general threat level is elevated, verifying that identity with their parent organization should be required. In all cases someone at the chemical facility must be able to verify that the person is expected and should be allowed even AA.
Anyone that does not fit within the first two groups falls within the last group, those not authorized access to the facility. Since this class includes most people in the world, it does not mean that the person denied access to the facility is, or even is suspected of being, a specific threat to the facility. Special care must be taken when dealing with this class of people that one does not convey the impression that because they are denied access that there is something wrong with them. Remember, they may be customers.
Provisions have to be made to identify each person entering the facility and identify which of the three classes to which they belong. In most cases this means that a guard will be responsible for checking identification and assigning people to the appropriate class. Clear instructions andadequate training must be given to the guard force to allow them to make these decisions on a daily basis with a very low error rate.
Given the limited employee base of most chemical facilities and if there is enough continuity in the guard force, most guards will soon be able to personally identify each person at the facility that is authorized UAA. Until such time as that happens, and to allow for the addition of new UAA personnel or guards, the guard force needs to have a way to positively identify UAA personnel. Clearly marked photo identification badges are the most common method for doing this, but giving the guard a facility UAA roster (preferably with photos) can also be used. The use of biometric identification of personnel for routine entry into the facility by UAA personnel is seldom necessary.
The most efficient way of dealing with the daily routine AA personnel is to provide the guard with a daily list of personnel that are expected to request entry to the facility that day. That list would include name, parent organization and the person to contact for providing an escort. For those personnel requesting entry to the facility that are not on that list the guard would be responsible for getting the identification information and then contacting someone on the UAA list to authorize AA for that visitor. At the higher risk facilities only a limited number of personnel (normally the facility security officer or someone in the security office) would be allowed to give that authorization.
Everyone that requests and is denied access needs to be documented. This should be done for a number of reasons. First it is done to protect the guard force from complaints. If they document everyone that requests entry and on what authority they were denied entry, there can be little question about the guards exceeding their authority. Furthermore, the possibility exists that those personnel being denied access are probing the facility security and Section 27.230(16) requires facilities to maintain records of potential security incidents or suspicious activities.
Personnel access control is an integral part of any Site Security Plan. Defining who is authorized access to the high-risk chemical facility and under what conditions is an important part of denying access to those people who might be interested in attacking the facility.
Posts
No comments:
Post a Comment