RBPS Guidance – RBPS #3 Screen and Control Access

This is another in a series of blog postings that will provide a close-up look at the RBPS Guidance document. DHS recently released this document to assist high-risk chemical facilities in meeting the risk-based performance standards required for site security plans under 6 CFR §27.230. The other blogs in the series were the: Risk-Based Performance Standards Guidance Document RBPS Guidance – Getting Started RBPS Guidance – RBPS #1 Restrict Area Perimeter RBPS Guidance – RBPS #2 Secure Site Assets This post looks at the third risk-based performance standard which deals with screening and controlling the access of personnel and vehicles into the facility or into restricted areas or critical assets within the facility. The discussion in this RBPS is predicated on the existence of a perimeter barrier system that allows entrance to the facility at only a limited number of controlled points. Security Measures The discussion in this section of the Guidance document focuses on five classes of security measures. They are: Personnel identification, Hand carried items inspection, Vehicle identification and inspection, Control point measures, and Parking security measures. Personnel Identification The Guidance document provides examples of a number of potential personnel identification schemes for verifying the identity of personnel entering the facility or restricted areas within the facility ranging from checking government photo identification (drivers license for example) to sophisticated facility provided ID cards that can interact with automated access control systems. The less sophisticated systems require that someone actually looks at the ID and compares it to a list of personnel authorized access. Not covered in the RBPS is the need to provide the security personnel at the gate with an daily list of personnel expected to arrive at the facility to make deliveries, pick-up shipments, or conduct other transitory business. The higher risk facilities may require their suppliers and customers to provide advance copies of photo IDs or other unique identifying information for their drivers delivering or picking up loads. Lower risk facilities may decide that just providing the driver’s name will be sufficient. Other, unexpected personnel not cleared in advance will need to require escorts to pick-them up at the gate. Privacy concerns will have to be addressed when keeping records of personnel entering the facility; the more identifying information provided the more problems that will arise. Facilities will need to establish firm rules for purging personal information and ensure that they are followed to the letter. Controls will have to be put into place to ensure that access to the personal information is strictly limited. Hand Carried Item Inspections This section of the RBPS #3 discussion points out that while all personnel should be subject to inspection, it is reasonable to subject visitors to a higher level of inspection than trusted (and cleared) facility employees. Many facilities will find that random more detailed inspections of employees’ hand carried packages will provide an additional level of security. The description of inspection techniques provided on page 43 naturally leads one to assume that the focus of these inspections is directed at finding explosive devices. While these would certainly be high priority search targets, facilities should also consider prohibiting/controlling people bringing cameras onto the facility. A visitor with a camera could be on a facility reconnaissance mission. Vehicle Identification and Inspections High-risk chemical facilities will need to inspect vehicles entering the facility. Depth and extent of the inspection may be adjusted depending on the vehicles. Just as in package inspections, employee vehicles probably will not receive the same level of inspection as unannounced delivery vehicles. While not addressed in the Guidance document, facilities with theft/diversion COI packaged in smaller containers may want to seriously consider searching outbound vehicles for such containers. Tight controls on those filled containers may reduce the necessity for checking vehicles, random checks will provide an additional layer of security. Control Point Measures The Guidance document describes a number of measures that can be used to control the flow of traffic approaching the facility and near critical assets within the facility. The control point measures outside the facility received some attention in RBPS #1, but they may also help position approaching vehicles in the optimum position for vehicle searches. Within the facility perimeter the vehicle control measures can help to keep unauthorized vehicles away from critical assets. They can also be used to control the movement of vehicles within the facility; making it unnecessary to require vehicles to be escorted when moving from the gate to loading and unloading facilities. Parking Security Measures The location of many facility parking lots was selected long before facility security became an issue; they are located within the facility perimeter. This creates a potential problem with controlling the movement of personal vehicles within the security perimeter. Limiting these parking areas to just employee parking may not be practical depending on the number of ‘visitors’ that the facility typically sees. Other traffic control measures to isolate the parking lots from critical facilities may be more appropriate. A parking area that is not directly addressed in the Guidance document is the area where trailers, both dry boxes and tank wagons, are parked when they are waiting for loading or unloading. Fully loaded trailers are very difficult to search adequately. This means that the parking areas for these vehicles must be kept away from critical assets in the facility. Allowing drivers and their tractors to remain with trailers for extended periods of time is going to create security problems. Unless the area is closely monitored, these drivers will have effective access to many areas of the facility where they do not belong. Providing separate parking area for the tractors of long-haul drivers physically separated from the facility and remotely monitored will be a good solution for many facilities. Other facilities may need to require these drivers to drop their trailers and leave the facility perimeter while they wait for loading or unloading to be completed. Security Considerations DHS continues to make the points in this standard that they did in the previous two; no single security measure will be adequate by itself. Layering security with complimentary measures and techniques will provide a much higher level of security. Differing environmental conditions must also be taken into account when planning for this standard; security needs to be effective in all expected situations. Metrics The metrics for this standard are all pretty straight forward with no concepts that weren’t introduced in either this section of Appendix C. Only one of the metrics, 3.2 – Identity Verification Systems, combines the suggested measures for two different tiers (Tiers 3 and 4). There is only one other metric, 3.3 – On Site Parking, that is not applicable to all four tiers; Tier 4 is listed as ‘N/A’.