DHS CSAT FAQ Page Update 05-28-10

This last week saw DHS make more modifications to the responses on their Chemical Security Assessment Tool (CSAT) Frequently Asked Questions (FAQ) page than they have in quite some time. They modified responses to three previously asked questions and added seven new questions. The modified responses were for the following questions: 1473 What information do I need to know about my facility in order to register? 1563 How do I know if my facility is a Treatment Works as defined in Section 212 of the Federal Water Pollution Control Act? 1604 Do I need to keep a record and/or printout of my survey before transmitting it to DHS? There were no material changes to any of the modified responses. The DHS people were just cleaning up typographical errors and misspellings; all typical work that needs to be done to a data base this large. Special Note to DHS: you missed one error in the answer to question 1563: “recy6cling”. New FAQ I routinely recommend that all facility security managers (and other interested people) read the responses to all new questions, even if they do not appear to apply to the facility. This is because they always provide some level of insight into the thinking of ISCD and that is always valuable. The new questions added this week were: 1403 In the on-line SSP, how do I identify my facility's Cyber Control System on the map if it is managed off-site? 1661 What is the definition of A Commercial Grade (ACG) for the purposes of CFATS? Specifically, under Appendix A of the Chemical facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27, if a chemical facility manufactures or otherwise possesses a Theft/Diversion or Sabotage chemical of interest (COI) but does not directly offer the chemical for commercial sale, does the facility need to count the chemical toward the applicable screening threshold quantity to determine if the facility must submit a Top-Screen to DHS? 1662 I have received an email notification that a CSAT Letter is available for viewing. How do I access this letter? 1663 I have a final tiering determination and SSP deadline, but have not yet submitted my SSP. I have also made material modifications to my site. What should I do? 1664 Between the time a facility submits an SSP for review and ISCD inspects the facility, could DHS direct a facility to cease operations? In other words, could DHS shut down a facility based on the content of a submitted SSP without an actual facility inspection? 1665 What are examples of redundant radio systems? 1666 Does a facility have an obligation to notify DHS if the facility itself is shutting down/closing? A Commercial Grade The response to question 1661 should be closely looked at by any facility that has an STQ amount of either a Theft/Diversion COI or a Sabotage COI on site. DHS clarifies in this response the status of a facility that possesses but does not sell those COI. DHS explains that the phrase “offered for commercial sale” does not mean that facilities that use but not sell these COI are exempt from reporting these materials on their Top Screen. The phrase is used to describe the chemical not the facility. There still remains one potential loop hole in this definition. If a facility produces the material for internal consumption and does not sell or transfer that material off-site, then it would appear that the facility would not be required to report it on the Top Screen. If I were in that situation, though, I would specifically ask DHS for their opinion on the matter before submitting my Top Screen. Change in COI The response to question 1663 is of particular importance to a wide range of facilities. When a facility has received their final notification letter of their tiering and SSP due date, but have not yet submitted their SSP, the facility does not get a reprieve from the SSP requirement by submitting a ‘material change’ Top Screen showing a reduction or removal of a COI from the facility. In addition to filing a new Top Screen, DHS wants facilities to report the change on their SSP. If the change has already been done, DHS wants it to be reported on the SSP as a “Planned Measure”. If the change is in process or planned to take place, DHS wants it to be reported as a “Proposed Measure”. This will allow DHS to evaluate the effect of the change on the security profile of the facility. For “Planned Measures”, DHS will consider those measures when deciding on the approval of the SSP. For “Proposed Measures”, DHS will not consider them in the approval decision process, but ISCD will inform the facility of the potential affect of the change on their CFATS Status. The most important part of this response, however, is found in the last paragraph:

“By stating a COI has been or will be permanently removed from a facility in the SSP, or that conditions have otherwise been permanently and materially changed, the facility is then legally bound to ensure that COI is in fact never held at that facility again or that the condition or material change remains in effect unless and until DHS approves a revision to the facility’s SSP. See §§ 27.210(d) and 27.245(a)(iii).”

It would seem to me that facilities would want to be very careful in reporting this type of change as a “Planned Measure”. If there is any reasonable chance that the facility will be returning the material to the facility, then it may be more prudent to report the change as a “Proposed Change”. This will not carry the same legal burden as a “Planned Measure” since DHS is not using that report in their actual consideration of the SSP.