RBPS Guidance – RBPS #4 Deter, Detect and Delay

This is another in a series of blog postings that will provide a close-up look at the RBPS Guidance document. DHS recently released this document to assist high-risk chemical facilities in meeting the risk-based performance standards required for site security plans under 6 CFR §27.230. The other blogs in the series were the: Risk-Based Performance Standards Guidance Document RBPS Guidance – Getting Started RBPS Guidance – RBPS #1 Restrict Area Perimeter RBPS Guidance – RBPS #2 Secure Site Assets RBPS Guidance – RBPS #3 Screen and Control Access This posting looks at RBPS #3 which covers the facility’s ability to deter terrorists from attempting attacks on the facility, detecting an attack or potential attack early enough in the process to allow for early interdiction of the attack, and delaying an attacker from reaching critical assets long enough for security forces to get into place to interdict the attackers before they reach and successfully attack critical assets. Security Measures There are no security measures discussed in this RBPS that were not previously discussed in RBPSs 1, 2 or 3. Security Considerations The discussion of security considerations in this RBPS covers the same ground that was discussed in the three earlier RBPS. Metrics While the security measures and considerations for this RBPS have been previously discussed, there are some significant differences in the focus of the metrics for this RBPS. The Tier 1 Summary Metric focuses on “a series of protective security layers” that allow the process of deter, detect and delay to “allow response to thwart the adversary action before it achieves mission success” (pg 55) and only security measure that it specifically mentions is vehicle barriers. Metric 4.1, Deterrence and Delay (General), introduces a new concept not emphasized in previous RBPS; “well-coordinated security response planning”. This reflects the realization that any security system can be penetrated by a sufficiently determined opponent. This means that there must be a well planned and coordinated response to interdict that determined opponent. The focus of Metric 4.2 is on preventing vehicle borne attacks on critical assets at the facility through the use of anti-vehicle barrier systems. The Detection Monitoring and Surveillance Metric (4.3) delves into the detection and surveillance system in much more depth than was done in earlier RBPS. While the discussion in Tiers 1 thru 3 focuses on electronic systems, the Tier 4 discussion specifically mentions using security patrols to affect the detection, monitoring and surveillance tasks. The other tiers focus more on all weather system capability, back-up power, and independent systems not subject to common cause failures. Metric 4.4 focuses on detection and mentions ‘countersurveillance’ and “frustration of opportunity to observe critical assets” (pg 58) for the first time. The discussions for the two highest tiers also mention the use of a “Security Operations Center” to continuously monitor a “facility-wide intrusion detection system”. The final metric, 4.5 – Interdiction by Security Forces or Other Means, was one of the most controversial in the draft version of the Risk-Based Performance Standard Guidance document because it firmly suggested the use of armed security forces. The discussion of the interdiction of ‘armed intruders’ still includes the potential use of a facility security force (described as “contract or proprietary, mobile or posted, armed or unarmed, or a combination thereof “ pg 58) it does place equal emphasis on the use of “sufficient delay tactics to allow local law enforcement to respond before the adversary achieves mission success” as an acceptable alternative. The other alternative that is addressed is the use of “process controls or systems that rapidly render the critical asset nonhazardous even if a breach of containment were to occur” though this is unlikely to be a widely useable option.