Yesterday (see: “Chemical Security Page Update 09-22-08”) I noted that DHS had revised their Chemical-Terrorism Vulnerability Information (CVI) procedure manual. As part of that revision there has been a substantial revision of the CVI cover sheet that is used to ‘protect’ CVI documents. Facilities should replace all current cover sheets with the new version as the document security rules listed on the new version have changed substantially.
The old cover sheet was marked as version 1.0 with an effective date of 06/2007; the new form on the DHS web site does not have a version number or effective date. This lack of version/date is probably an over site. I’ll watch the DHS web site to see if a ‘new’ version makes it to the site.
There are five sections of information on the Cover Sheet. There have been changes made in each of the five sections; some were significant others were simply editorial. Those sections are:
- Warning
- Access
- Handling
- Sanitized Products
- Derivative Products
Cover Sheet Warning
At the top of the Cover Sheet is a warning about the legal requirements for protecting CVI. The wording on both pages is identical. The only difference between the two is the final statement; on the old form the warning was printed in red, it is in black on the new form. That statement reads:
- “By reviewing this cover sheet and accepting the attached CVI you are agreeing to abide by the guidance contained herein. Your acceptance provides immediate access only to the attached CVI.”
Access Information
This section details the requirements for providing document access to others. The old Cover Sheet had some fairly detailed requirements, including the following list:
- “Government officials and contractors must be covered by a Memorandum of Agreement signed with the Chemical Security Compliance Division
- “All individuals must complete CVI Authorized User Training
- “All individuals must demonstrate a valid need-to-know for specific CVI. For state and local officials this determination will be made by the state CVI Security Officer”
The new Cover Sheet has reduced the complexity of the requirements. The list now reads:
- “All individuals must be CVI Authorized Users.
- “All individuals must demonstrate a valid need-to-know for specific CVI”
Handling Information
Most of the changes made to the Handling section of the Cover Sheet are editorial in nature; word and phrasing changes rather that requirement changes. The one exception to that is found under the Transmission heading. The old Transmission information read:
- “You may transmit CVI by the following means to an eligible individual who meets the access requirements listed above. In all cases, the recipient must accept the terms for Non-Disclosure Agreement before being given access to CVI”
The new information is simplified and all references to an NDA are removed. The new Transmission information reads:
- “You may transmit CVI by the following means to a CVI Authorized User with a need to know.”
Sanitized Product Information
From time to time it may be necessary to take information from a CVI document and convert it into a form that may be shared with personnel that are not Authorized Users or have a need-to-know. The procedure of cleaning up that information is known as ‘sanitizing’. The old Cover Sheet laid out the following requirements for the sanitizing process; nothing can be disclosed that:
- “Is proprietary, business sensitive, or trade secret;
- “Relates specifically to, or identifies the submitting person or entity (explicitly or implicitly); and
- “Is otherwise not appropriately found in the public domain.”
The new Cover Sheet has some substantial differences. The new Cover Sheet says that nothing can be disclosed that:
- “Exposes vulnerabilities of identifiable critical infrastructure or protected systems of a facility;
- “Is proprietary, business sensitive, or trade secret;
- “Relates specifically to the submitting person or entity (explicitly or implicitly).”
Derivative Products Information
Anytime that CVI information is taken from one document and included in a second, the second document becomes CVI as well. The second document derives its CVI status from the first; it becomes a derivative product. There are only two differences between the old and new Cover Sheets in the Derivative section of the cover sheet.
First the following statement was not included in the new Cover Sheet:
- “The CVI Tracking Number(s) of the source document(s) must be included on the derivatively created document in the form of an endnote.”
Additionally the blank for recording the CVI Tracking Number was removed from the bottom of the new Cover Sheet.
What These Changes Mean
Reviewing the actual changes to the CVI program that are embodied in the new procedure manual will take some additional time. The changes that we can quickly see in the CVI Cover Sheet seem to indicate that DHS is loosening up some of the structure surrounding the handling of CVI, at least at the facility level. I’ll look at the changes to the CVI manual in future blogs and we will see how accurate that perception is.
Posts
No comments:
Post a Comment