Reader Comment 08-25-10 ERP Requirements

I got a quick response from an anonymous reader to my blog posting this morning about the EPA ICR. Anonymous took exception to my comment about the lack of an emergency planning requirement in the CFATS program. Anonymous provided this quote from 6 CFR 27.230(a)(9):

“Response. Develop and exercise an emergency plan to respond to security incidents internally [emphasis added by PJC] and with assistance of local law enforcement and first responders;”

Anonymous is certainly correct that there is an emergency response component of CFATS, but it is limited to the on-site response. After all, facility management has no authority to do or require anything to be done off-site. And actually the same could be said for the emergency response requirement for water treatment facilities. Though, many of those facilities are owned by local municipalities so they may have more impact on off-site consequence planning.

I did not clarify that in my earlier blog post. That’s what comes from adding a toss off ‘by the way’ type comment to a blog post. I apologize for the lack of clarity.

Off-Site Consequence Response

While on-site emergency response is important (and it certainly is to on-site personnel), the entire focus of the CFATS regulations is the prevention of off-site consequences. In setting up the regulatory authority to establish a program to prevent terrorist attacks at high-risk chemical facilities, Congress completely overlooked the requirement to be able to respond to such a successful attack.

The security and response communities know full well that it is impossible to completely and absolutely prevent a terrorist attack. A determined and well trained terrorist team will be able to find a workable hole in any security scheme, especially if they are willing to die in the execution of their attack.

This is why an effective off-site emergency response plan must be an integral part of any security operation. Unfortunately, while facilities might be liable for off-site consequences they have no authority to effect off-site planning, preparation, rehearsal or execution of an emergency response plan. At most they may be required to contribute money, information and expertise to such efforts.

This is why, when Congress actually gets around to authoritatively addressing the CFATS reauthorization issue they need to include a mandate for off-site emergency response planning through an organization like FEMA.