Every facility that completes a Top Screen should have program set up to administer the security of Chemical-Terrorism Vulnerability Information. Most of the 40,000+ facilities that are expected to complete a Top Screen are only going to require a minimal facility CVI program. For these facilities there will only be two documents that will be maintained on file that will require CVI markings; a copy of the submitted Top Screen and a copy of the letter from DHS informing them that the facility is not regulated under 6 CFR part 27.
While DHS will probably never inspect these documents, and no one else should ever need to see them, it will be a good idea for most facilities to keep them on hand. They would be beneficial to have when a facility has to re-submit a Top Screen when there are significant changes at the facility to processes, plant surroundings or chemical inventories. There will also be inevitable changes to the regulations that might require re-submission.
In setting up a minimal CVI program the first thing a facility needs to do is to appoint a
“CVI point of contact” (para 5.3 of the CVI Procedure Manual). This will be the person responsible for administering the CVI program at the facility. According to para 5.4c the responsibilities of the Point of Contact (POC) are:
1. “Demonstrate full familiarity with the minimum requirements for protecting CVI according to Section 550(c), the implementing regulations, and the procedures established in this Manual.
2. “Ensure the secure dissemination of CVI to authorized users and private third parties with a vested interest in the chemical facility,including:
o Response to, or assistance with, need-to-know inquiries;
o Verification that initial and ongoing training has been completed; and
o Certification that NDAs are executed and implemented, as necessary.
3. “Initiate, facilitate, and promote activities to foster and maintain awareness of CVI policies and procedures.
4. “To the extent practicable, remind individuals of their post-employment CVI responsibilities.
The first responsibility can be taken care of by completing the online training program for protecting CVI documents. Once this training is completed and the appropriate background check is completed by DHS, DHS will email the individual a copy of the certificate stating that the individual is an Authorized User. The CVI POC will have to periodically check the DHS web site to insure that there have been no changes to the procedure manual. Whenever a new version is published, it would be a good idea to re-do the training program.
For a minimal CVI program there will be little need to have more than the Point of Contact at the facility designated as an Authorized User. Facility management can decide whose job might reasonably require access to those limited CVI documents and have them complete the same online training program. The POC should maintain copies of each certificate as part of the facility’s CVI procedural files. They should probably be maintained in the same locked container as the CVI marked documents for ease of program administration.
CVI marked documents are required to be stored in a locked container. This may be a desk drawer or file cabinet as long as only those people who are both Authorized Users and have a Need to Know have access to that container. As a practical matter it would probably be best if only CVI marked documents and program administration documents were stored in that container. In a multi-drawer file cabinet or desk it would be more practical if the drawer were separably lockable so that routine access to non-CVI documents would not compromise the security of the CVI documents.
A log must be maintained for tracking production, receipt, transmission and dissemination of CVI marked documents (para 5.3). Each document will be marked with a unique tracking number (See Appendix A, CVI Procedure Manual). The log will include who transmitted and received the document and how their Authorized User status was verified.
For a minimal CVI program this probably can be documented on a single sheet of paper. For the Top Screen document the date the Submitter printed the final copy of the Top Screen and submitted it to DHS will be the initial entry. The “who received” entry will be “Secure DHS Website”.
For facilities that receive a “may be regulated” letter from DHS the CVI program will be more complicated since more documents and people will be involved. We’ll look at those programs in a future blog.
Posts
No comments:
Post a Comment