Friday, September 18, 2009

CFATS Training

I received a series of emails last night from a reader in the security industry. He wanted to know if I new of any training programs that could be used for security personnel working at CFATS covered facilities. I had to tell him that I had not heard of any training programs other than one Chemical-Terrorism Vulnerability Information training program that I had written about last spring. Unfortunately I forgot about a DHS general awareness training program [NOTE: Updated Link 9-18-09, 14:39] that is available through the Sector Specific Agency Executive Management Office that I wrote about last year. He was, of course, familiar with the CFATS CVI training program used to become an authorized user of CVI.

Training Requirements

He does bring up an interesting problem that high-risk chemical facilities are going to have to start looking seriously as they think about moving into the SSP implementation phase of the CFATS process. That is how to go about training facility employees and security personnel. The Risk-Based Performance Standard Guidance document does address the training issue in RBPS #11. The introduction to that RPBS (pg 90) provides this explanation about the importance of training:
“Training details the performance standards related to security and response training, exercises, and drills. By performing proper security training, exercises, and drills, a facility enables its personnel to be better able to identify and respond to suspicious behavior, attempts to enter or attack a facility, or other malevolent acts by insiders or intruders. Well-trained personnel who practice how to react will be more effective at detecting and delaying intruders and provide increased measures of deterrence against unauthorized acts.”
The emphasis here seems to be on facility/security group response training. In fact, a large portion of the discussion in RBPS #11 is focused on this type of group training. But anyone with training development experience is aware of the fact that before training can be conducted on group response, individuals must be trained in the skills that they will need to participate in those group actions.

The RBPS does provide a detailed list of the training topics (Table 13, pgs 93-4) to which various personnel probably need to be exposed. The list is broken down into requirements for three categories of employees; Facility Security Officer (FSO) and Assistant FSO, Personnel with Security Responsibilities, and All Remaining Employees. Obviously the most extensive training will be required for the FSO.

The ‘All Remaining Employees’ category will receive the least training, what is usually termed ‘general awareness’ training. This is the type training that companies usually use professionally developed training videos to present the general concepts followed by a brief discussion of company specific policies. I have not yet heard of anyone developing this type video for CFATS general awareness training.

There is one interesting pair of items in the Table 13 list of training subjects; CVI and SSP training requirements. As you would expect, both the FSO and Personnel with Security Responsibilities groups will be required to be CVI Certified.

There is no such requirement for the All Remaining Employees group. But there is a requirement to train that group on “Relevant provisions of the SSP”. Since the SSP is clearly CVI it will take some careful preparation to extract relevant information for presentation to a non-CVI certified audience. One last point about the RBPS training ‘requirements’; the RPBS recommends the inclusion of off-site personnel in the training program. The RBPS #11 introduction (pg 90) notes that:
“A strong training program typically includes not only personnel-specific exercises and drills but also joint activities involving both facility personnel and law enforcement and first responders. Including law enforcement and first responders in training, exercises, and drills improves responder understanding of the layout and hazards associated with the facility while strengthening relationships with the emergency response community.”
One thing that facilities need to remember when they bring outsiders on site for this type training is that they need to include at least some minimal Hazcom training for those personnel. If these personnel are going to be moving about the facility, even escorted, they need to be made aware of the chemical safety considerations that must be taken into account at the facility.

Training Development Ideas 

I have more than a little experience in training development and presentation. I spent fifteen years as an Infantry NCO, developing and executing informal and formal training programs for individuals, small units and up to company size units. While working in the chemical industry for 16 years I developed and presented Hazcom and process safety training. And for the last year or so I have been doing contract training development and presentation for Georgia QuickStart, an industrial training program run by the State of Georgia.

Professional training development takes time. If you are just developing a simple stand-up classroom presentation using tools like PowerPoint® it can easily take 20 to 40 hours for each hour of instruction. Most of that work goes into the task identification process, determining what information actually needs to be communicated to the target audience. Making a training video or developing a computer based training program takes a great deal more time. Needless to say, all of that time takes money.

This is one of the reasons that most companies turn to the use of generic training videos for a wide variety of periodic government-required training programs. Usually a one hour period of instruction will include a 20 minute video, a 20 minute discussion of company or facility specific requirements and then a written test with a post-test review of the answers. This type training would probably be okay for the training requirements for the ‘All Remaining Employees’.

A training video along the lines of the computer based awareness training developed by DHS Infrastructure Protection would be valuable. An experienced instructor could even use that DHS computer based training program for group instruction, using discussion techniques to identify the security problem and appropriate response in that program.

Another training requirement from the RBPS #11 that is clearly amenable to this type of video training program would be the “Recognition and detection of dangerous substances and devices” requirement for all personnel in Table 13 (pg 93). I know that TSA has developed a similar DVD based training program for IED’s on railcars, but I have not been allowed to review the program. A generic training video for would be a valuable addition to the CFATS training process.

Most of the training for FSO’s will be given to such a small target audience (two or three people per facility) that it would probably not make financial sense to develop a training video for the limited market. On-line computer based training would make much more sense. Most of the FSO unique training is generic CFATS, security or intelligence information. Since the work of the FSO is such a key component of a successful security program it would probably be better for DHS Infrastructure Security and Compliance Division (ISCD) to develop this training as part of the CSAT tool. It would be done along the same lines as the CVI certification.

There is a large number of training requirements in Table 13 that the FSO and ‘Personnel with Security Responsibilities’ have in common. A generic video could be developed to deal with many of these requirements, but many will have to be dealt with on a facility specific basis. While small facilities may be able to get away with in-house developed training for these objectives, most large facilities are going to have to turn to professional training developers.

One final note; the Table 13 group “Personnel with Security Responsibilities’ is actually going to be at least two and possibly more groups at most high-risk facilities. The most obvious members of this group will be security personnel including guards, roving patrols and monitoring personnel (including off-site monitors). Next there will be production personnel that have a variety of security plan responsibilities including controlling access to secure/critical areas. Finally, there will be the maintenance personnel (including contractors) that will be maintaining security related equipment. The training programs for these three groups will be substantially different.

Complex Training Requirements 

So you can see that the training requirements for supporting the CFATS program at a high risk facility are going to be complex. It is no wonder that my inquisitive reader was looking for someone who was working on the issue. Oh, there is some bad news associated with this. While the RBPS #11 training guidance is relatively general, there are more specific training requirements being considered in the CFATA legislation currently being considered in Congress. Most importantly the legislation requires 8 hours of training per year for all employees.

Final note: If anyone knows of someone developing security related training programs for high-risk chemical companies please let me know. I would certainly like to share that information with my readers.


Anonymous said...

Thanks, very informative.
Looking foward to more on this subject.

Anonymous said...

All very good info (re: CFATS Trng), however the link to the DHS general awareness training program took me to

and gave this message:
Dear AOL Journals user,

We're sorry to inform you that on Oct. 31, 2008, AOL® Hometown has been shut down permanently. We sincerely apologize for any inconvenience this may cause.


Anonymous said...

Link works now. Offered training, while very basic in content, was good just the same.

/* Use this with templates/template-twocol.html */