Unannounced Changes to CFATS Web Sites

I noted earlier this week that DHS had apparently made changes to their Chemical Security web page. After looking at a number of other CFATS related web sites this morning, it is fairly clear that DHS has made changes to a number of their web pages. Most of these are cosmetic and all remove the “Welcome to the new DHS Web Site – Give us your feedback” banner that was put on the pages during the last wholesale revision of the DHS web site.

There are two changes associated with the Security Vulnerability Assessment Tool web site that deserve some attention; the wording revision on the page and a change in one of the links.

SVA Wording Change

The SVA page from last year included the following ‘schedule’ for the submission of SVA’a following the DHS notification of initial high-risk assessment and tier assignment:

• Preliminary Tier 1 facilities have 90 days to complete and submit a CSAT SVA from the date of written notification

• Preliminary Tier 2 facilities have 120 days to complete and submit a CSAT SVA from the date of written notification

• Preliminary Tier 3 facilities have 150 days to complete and submit a CSAT SVA from the date of written notification

• Preliminary Tier 4 facilities have 180 days to complete and submit a CSAT SVA from the date of written notification or a Department-approved Alternative Security Program (ASP)

The new page simply states: “Unless specifically notified by the Department to the contrary, the SVA must be submitted within 90 calendar days from the date of written notification.”

The new page requirement is certainly in line with the requirements set forth in the CFATS regulations {§27.210(b)(2)}. The old page explained the laxer requirements by stating: “These deadlines were established by the Assistant Secretary of Infrastructure Protection consistent with his discretion under the Interim Final Rule, published on June 8, 2007.”

The staged submission requirements reflected the fact that DHS was having severe difficulties in getting the reviews completed on the existing Site Security Plans and thus the Department wanted to concentrate its efforts on the highest risk facilities throughout the review process. Now that the Department is starting to clear its backlog of SSP reviews they will have more assets available to concentrate on SVA reviews as well so the staged submission deadline is no longer warranted.

While the change is policy is almost certainly justified, there has been no formal notification that the policy has changed. I understand that a schedule printed on an official web site does not carry the same weight as a published regulation, but there was still a change in policy made and the community deserves formal notification of that change.

Manual Change

Both the old and new versions of the web site contain links to the SVA Questions Manual:

• Older version - Review CSAT SVA Questions (PDF, 107 pages - 1.26 MB)

• Newer version - Review CSAT SVA Questions (PDF, 105 pages - 368 KB)

It is clear that the descriptions are different and quick looks at each manual (both links are currently working) show that they are indeed different. I have not had a chance to determine specifically how different, but they are not identical, even though they both have the same date and version numbers printed in the document.

Once again, change is a necessary thing, but the community deserves and requires explanation when changes are made and why they happen. This is not currently happening and that is disturbing to say the least.