EAP Intention Notification

As I have mentioned a couple of times this week, the CFATS Expedited Approval Program (EAP) started functioning on June 16^th. Tier 3 and Tier 4 facilities wishing to complete their site security plans (SSP) are required to notify the DHS Infrastructure Security Compliance Division (ISCD) 30 of their intention to participate in the EAP process at least 30-days prior to submitting the EAP SSP. The ability to initiate that notification became available on the 16^th.

Yesterday I sought clarification on how a facility was supposed to submit that notification by completing a request to the CFATS Help Desk via their web form. I received my reply back this morning:

“A facility can provide 30 day notice via CSAT or letter to DHS. The notification button became available in CSAT this week for Tier 3 and 4 facilities. Letters can be faxed to 866-731-2728 or emailed to csat@hq.dhs.gov.”

Since I am not a registered CSAT user (you have to be designated access by a covered CFATS facility) I have not been able to see this ‘notification button’, but it is apparently available on the site. I have heard that ISCD has been directly notifying ‘affected facilities’ of the notification procedure.

The other new piece of information in the CFATS Help Desk email is that you can fax or email the notification letter to ISCD. This was not mentioned in the EAP Fact Sheet or on the EAP web site.

There is no specific guidance as to the content of the letter. I would suspect that at the very least the letter would need to contain the facility name and CFATS ID number and a statement to the effect that the facility intends to submit an EAP site security plan. I would suspect that the designated facility Submitter could sign the letter, but the Authorizer signature would probably be the safest bet.