ISCD Publishes September CFATS Fact Sheet

This morning the DHS Infrastructure Security Compliance Division (the folks that run the CFATS program) published their September CFATS Fact Sheet, providing updated information on the progress being made on the completion of the Site Security Plan (SSP) approval process.

The table below summarizes the important numbers included in the new Fact Sheet and compares it to the August and July Fact Sheet numbers (NOTE the August link is to my blog post because the August Fact Sheet is no longer available on the ISCD web site. Both the July and June Fact Sheets are):

	July	August	September
Covered Facilities	3,229	3,223	3,197
Authorized SSP	3,121	3,139	3,178
Approved SSP	1,935	2,021	2,104

The relatively small increase in approved SSPs would seem to indicate that we are not yet seeing the effect of facilities submitting SSPs under the Expedited Approval Process. Since the first EAP SSP could only have been submitted on July 16^th we are still well within the potential 100 day limit for DHS to disapprove an EAP submitted on that date. I expect that we will start to see an increase in numbers when the October Fact Sheet is published next month, but we won’t see the gross effects until November or December. The EAP approval process for facilities already in the CFATS program as of June 16^th will not be completed until near the end of February.

The other impressive statistic in the new Fact Sheet is that we are now at about 99% on the facilities that have an authorized Site Security Plan. This is the first stage of the SSP review process and reaching that 99% point means that we are essentially at full compliance on submitting SSPs. The program will probably never reach the 100% authorization rate as new chemical facilities are being built and added to the program fairly frequently. There is a time lag between the time that a facility is notified that it is a covered facility and the time that it is required to submit an SSP.

Which, of course, leads us to one of my pet peeves; we see another unexplained drop in the number of facilities covered by the CFATS program. There are a number of legitimate reasons that a facility could be removed from the program; they could have eliminated or reduced the use/storage/manufacture of the DHS chemicals of interest (COI) that form the basis for entry into the process; or the facility could have been closed. I actually know of a covered facility that burnt to the ground (certainly no remaining security issues at that site). What bothers me is that DHS has refused to publish numbers reflecting the reasons that facilities have left the program.

The reason that I harp on this so much is that we need the numbers to intelligently discuss how ISCD is handling the verification of the changes. Without understanding why the facilities are leaving the program we can’t even ask legitimate questions about the process.

Finally, there is one other area where DHS is not sharing information about the CFATS process. We know that they started doing compliance inspections well over a year ago. We know from the latest GAO report on the CFATS program that ISCD had completed 83 such compliance inspections early this year. What we don’t know is what they have done since then. Given the problems that the GAO identified in the compliance inspection process we can be sure that Congress is going to start asking questions about this area. I don’t understand why ISCD hasn’t gotten in front of this problem by starting to publish the numbers.