Chemical-Terrorism Vulnerability Information – who will be involved?

The Chemical Facility Anti-Terrorism Standards (6 CFR part 27) require many facilities to provide information to the Department of Homeland Security (DHS). Most of that information will deal with security concerns and vulnerabilities at the facility and some of the information will potentially contain commercial information that would be of use to the facility’s competitors. In order to protect this information from inadvertent disclosure, to terrorists or competitors, DHS has developed a set of standards to protect this sensitive, but not classified, material called Chemical-Terrorism Vulnerability Information (CVI).

 

While the rules affecting CVI are directed mainly at government agencies (Federal, State, and Local) and contractors working for those agencies, they also affect the facilities that generate much of the data. Any facility that is required to generate a Top Screen submission under Section 27.200 of 6 CFR part 27 is going to be required to generate, receive and maintain files that should be protected under the rules for protecting CVI. These files include:

 

1. Security Vulnerability Assessments (SVA);
2. Site Security Plans (SSP);
3. Documents relating to the Department's review and approval of SVA’s and SSP’s, including Letters of Authorization, Letters of Approval, and responses to them;
4. Written notices and other documents developed to comply with the interim final rule;
5. Alternative Security Programs;
6. Documents related to inspections and audits;
7. Notices of deficiency;
8. Records of training, exercises, and drills;
9. Incidents and security breaches;
10. Maintenance, calibration and testing of security equipment;
11. Objections and appeals;
12. Records required to be created and maintained by regulated facilities;
13. Sensitive portions of orders, notices, or letters;
14. Information developed pursuant to the Top-Screen process; and
15. Other information designated as Chemical-terrorism Vulnerability Information by the Secretary.

 

Most of the 40,000+ facilities that will be completing the Top Screen will have only a minimal number of documents that fall under the CVI rules. If the facility received an official letter requiring them to complete a Top Screen; that letter would be maintained in CVI files. Copies of the facilities CSAT Registration documents probably should also be filed in these files.

 

A copy of the completed Top Screen Questions workbook used to prepare for filing the on-line Top Screen submission would also be included in the CVI files. The inventory documents that a facility uses to prepare the Top Screen are not considered to be CVI as they are not provided to the government. A high-risk facility would probably want to give these documents similar internal protection to those required by CVI since they would help to define the potential targets for a terrorist, but they would not receive the legal protection of CVI.

 

Most facilities will receive an notification (either immediately after completing the Top Screen on-line or via a letter from DHS) that they are not considered a High-Risk Facility (and are thus exempt from further requirements of 6 CFR Part 27) and a copy of that notification should be maintained in the CVI files for that facility. The only other documents that these less than high-risk facilities will have to maintain would be the records for personnel completing the on-line training for CVI rules.

 

At least one person at each facility will need to have completed the CVI training so that they understand the safekeeping and disclosure rules involved with CVI documents. For facilities that are not designated High-Risk facilities that person would probably be the person for maintaining the other environmental, health and safety files for the facility. Anyone else who’s duties would include routine handling of CVI files should also receive the training as would anyone who is required to coordinate security issues with anyone outside of the facility.

 

For those facilities designated by DHS as High-Risk facilities will have significantly more people dealing with CVI documents on a routine basis. Future blogs will address the additional people required to be CVI literate at those facilities.

Tags: Chemical Facility Security, Chemical-Terrorism Vulnerability Information