SSP-RBPS Rolled Out Today

At noon today the Department of Homeland Security rolled out the next phase of the implementation of the Chemical Facility Anti-Terrorism Standards (CFATS). They published the Risk-Based Performance Standards Guidance (RBPS Guidance) document and opened the Site Security Plan (SSP) tool on their Chemical Security Analysis Tools (CSAT) web site. Two SSP supporting documents were also published on the CSAT site. Additionally they started the process of mailing out the notification letters that will let high-risk chemical facilities the official results of their Security Vulnerability Assessment (SVA) that were submitted last year. Finally, DHS has sent emails to the registered users of the CSAT that the RBPS Guidance has been posted on the DHS web site. RBPS Guidance The RBPS Guidance document is a more polished document than the draft that DHS published for public comment last year. It still does not spell out what a high-risk chemical facility must do to adequately secure itself from potential terrorist attack, but DHS has been prohibited by Congress from doing that. Instead it “reflects DHS’s current views on certain aspects of the Risk-Based Performance Standards (RBPSs) and does not establish legally enforceable requirements for facilities subject to CFATS or impose any burdens on the covered facilities” (RBPS Guidance, pg 7). The general layout of the document and the basic content remains the same as the draft, but the new document will require a careful reading. There are some subtle differences in the information presented. Additionally, DHS has made it clear that this is a living document. In one of many footnotes in the document the RBPS Guidance notes that “DHS is likely to periodically update this Guidance document to take into account lessons learned throughout CFATS implementation, describe new security approaches and measures that covered facilities may wish to consider implementing, and provide information on any new or revised RBPSs” (pg 8). SSP Tool As with all of the previous tools published in CSAT, access to the actual SSP tool where high-risk chemical facilities will actually submit their SSP is limited to registered CSAT users. As with each of the previously published tools the CSAT web site includes downloadable copies of two documents that will aid Preparers and Submitters with the preparation and submission of the SSP. The SSP Instructions provides detailed instructions on how to answer the very large number of questions that constitute the method of submission of the SSP. The SSP Questions provides a way for facility Preparers to collect and organize the required information to make it easier to actually enter the information into the on-line SSP tool. Each of these lengthy documents should be read carefully before trying to collect and submit the data required for the SSP. Future Blogs As I have done with all of the other CSAT tools, I will be doing a number of blog postings looking at the details of the SSP Tool, it’s supporting documents and the RBPS Guidance document. This is probably the most complex portion of the CFATS process and will take a lot of time to analyze and explain. Of course, I have the luxury of not actually having to implement this at a real chemical facility. I certainly welcome and encourage anyone with questions and comments about these new documents to send them on to me (pjcoyle@aol.com) or to post them as comments to this blog. I’ll do my best to explain things. DHS has also established a procedure for dealing with questions. You can contact the CFATS Help Desk either via e-mail at csat@dhs.gov or by phone at 866-323-2957. They also provide the name and address of a real person to whom you can “submit questions via regular mail” (pg 9):

Dennis Deziel Deputy Director Infrastructure Security Compliance Division U.S. Department of Homeland Security, Mail Stop 8100 Washington, DC, 20528