SSP Submission – RBPS #5 Shipping Receiving and Storage

This is another in a series of blog posting on the recently released Site Security Plan Instructions Manual and Questions Manual. The other blogs in this series are: Preparing for SSP Submission SSP Submission – Facility Data SSP Submission – Facility Security Measures SSP Submission – RBPS #1 Restrict Area Perimeter SSP Submission – RBPS #2 Secure Site Assets SSP Submission – RBPS #3 Screen and Monitor SSP Submission – RBPS #4 Deter Detect and Delay This section of the SSP looks at security measures, processes and procedures that specifically control shipping, receiving and storage to help facilities to “minimize the risk of theft or diversion of any of its hazardous materials” and “helps to prevent tampering or sabotage” (pg 59 RBPS Guidance document). This section applies to both facility wide security measures and measures that apply only to specific assets. After the questions about whether the facility has facility wide and asset specific security measures for RBPS #5 there are two additional generic questions that apply to facility wide measures. Each question has a potential ‘Yes’, ‘No’ and ‘Other’ responses. The ‘Other’ response makes no sense as a response to these questions. The two questions are:

“Does the facility have a ‘Know Your Customer’ program? “Does the facility have a Product Stewardship program?”

Documentation Questions The next series of questions deals with the documentation of sales and purchases of hazardous materials. These questions specifically ask about all hazardous materials (per 49 U.S.C. §§ 5101, et seq.) with the parenthetical inclusion of the phrase ‘including COI’. This ties in with the discussion in RBPS Guidance Manual that explains that DHS considers that RBPS #5 applies to all hazardous materials not just the COI listed in the notification letter. DHS does not make answering these questions very easy. When asking for a ‘quantity’ they provide three possible responses in check-off boxes. Those responses are: “All”, “Most” and “None”. The explanations for these terms are not provided, so we should be able to take them at face value. Unfortunately this leaves a potential response gap between ‘most’ (‘All’> ‘most’ > ‘half’) and ‘none’; there really should be a ‘some’ response available if DHS is not going to provide for a numerical response. I would guess that DHS wants anything less than ‘most’ to be answered ‘none’. One of the documentation questions does not refer to ‘hazardous chemicals’ or ‘COI’. It asks about shipments of ‘feed materials’ or ‘products’. The distinction is fairly clear in the wording so this must refer to all incoming raw materials (not just chemicals) and all outgoing products. In a chemical manufacturing environment this would be important because the contamination of any of the raw materials with the ‘proper’ contaminant could result in a catastrophic incident. There is an ‘odd’ pair of questions at the end of this first section. This question addresses the use of ‘numbered photo identification badges’. This is another one of those questions that has been asked earlier in the SSP; in this case in RPBS #3. Transportation Security Questions There are a number of areas within this RBPS that address transportation security. The first such area has a number of questions about the carriers that are used by the facility for outbound shipments. An interesting thing about these questions is that they don’t mention ‘hazardous materials’ or ‘COI’ or ‘covered materials’; this implies that the questions apply to all shipments made from the facility. The final series of Yes/No questions regarding transportation security deal with a variety of policies and procedures to provide transportation security for hazardous materials. They include such things as performance checklists, team drivers for long trips, procedures for vetting drivers, and redundant communications protocols. Security Measure Questions There are a couple of separate areas within this RBPS section that deal with security measures employed. The first of these areas deals with man-portable containers of ‘hazardous materials’. Nothing in the Questions manual or the RBPS Guidance document provides a definition of ‘man-portable containers’. Certainly 5-gal containers would fit that description; 30-gal containers can be man-handled relatively easily; and with a hand-truck even 55-gal drums can be moved by a single person easily. The questions about man-portable containers start with a qualifying question asking about ‘what number of hazardous materials in man-portable containers’ are provided with additional security measures. The wording of the question is odd (are we noticing a trend?); it doesn’t ask about the number of containers, but about the number of hazardous materials (again ‘including COI’). Again the answer is not a number, but the same ‘All’, ‘Most’, and ‘None’ that we have encountered in this section before. If the answer ‘None’ is selected, the Prepare will see none of the other questions in this area. There is a series of questions relating to the security techniques used to monitor hazardous materials on site. These questions briefly address such techniques as video monitoring, intrusion detections, physical security techniques. The potential answers to these questions are ‘Yes’, ‘Partial’, and ‘No’. No provisions are made for explaining ‘Partial’ responses. The final series of questions dealing with security measures ask about tamper resistance devices. These Yes/No response questions deal with the use of numbered seals on container closures, tamper resistant locks, and other techniques that would provide evidence of unauthorized access to hazardous materials. Inventory Control Questions There are a number of inventory control questions. One series of questions addresses procedures that the facility has put into place to implement a ‘know your customer’ program. Another series deals with the storage area used for hazardous chemicals and the processes used to monitor those storage areas. All of the questions in these areas are answered by selecting ‘Yes’ or ‘No’. There are a couple of ‘odd’ questions in these inventory control questions. First the facility Preparer is asked if the facility “has a written policy limiting the on-site inventory of specifically identified hazardous materials (including COI) below threshold quantities”. This question might make some sense if there was a follow-up question to ask which hazardous materials are ‘specifically identified’. Another question asks if the inventory control system provides links to the Material Safety Data Sheet (MSDS). While this is briefly mentioned in the RBPS Guidance document (pg 61), there is no explanation how such a linkage would contribute to the security of the hazardous material. An MSDS provides information about chemical safety, not chemical security.