Another New PSP FAQ Posted to CFATS Knowledge Center

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) published another new frequently asked question (FAQ) on their CFATS Knowledge Center web page. As with a number of recent additions to the FAQ list, this one deals with the CFATS personnel surety program (PSP) that the Department is in the process of rolling out.

FAQ #1769 asks:

“My facility must perform background checks in accordance with the Risk-Based Performance Standard (RBPS) 12 “Personnel Surety” on affected individuals. Who is an affected individual?”

Typically, these FAQ responses quote from the appropriate portion of the CFATS regulation as the major part of the response. The appropriate part of the CFATS regulation in this case would be 6 CFR 27.230(a)(12):

“Perform appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets….”

In this case the response is in two parts:

• Facility personnel who have or are seeking access, either unescorted or otherwise, to restricted areas or critical assets; and

• Unescorted visitors who have or are seeking access to restricted areas or critical assets.

They go on to explain the difference in the first part from the actual wording of the regulation by noting:

“The regulatory text makes no distinction between facility personnel who are escorted and facility personnel who are unescorted, and uses the term ‘unescorted’ to modify only the noun ‘visitors.’ As such, if facility personnel have access, either unescorted or escorted, to restricted areas or critical assets, they are deemed to be affected individuals who must be screened for the purposes of the Personnel Surety protocol.”

Commentary

The ISCD folks are being very careful with this distinction because there were a number of comments that they had received during the various information collection request comments periods that made it clear that very many people were under the misapprehension that only facility personnel that had unescorted access to critical areas would require personnel surety checks.

I am more than a little surprised that ISCD did not also take this opportunity to reinforce the other question that is closely related to this one; are contractor personnel ‘facility personnel’ or ‘visitors’? They made it clear in their Federal Register notice that they intend to give facilities the widest possible latitude in determining how contractors, even various groups of contractors will be handled for the PSP. The facility will be required to provide an explanation of how contractors are being handled in the revision to the Site Security Plan that will be made to implement the new terrorist screening portion of the RBPS #12 requirements.