PSP User Manual – Potential Problem Solutions

This is part of an on-going series of blog posts about the new Chemical Facility Anti-Terrorism Standards (CFATS) personnel surety plan (PSP) User Manual. This manual sets forth the instructions for using the new PSP tool in the on-line Chemical Security Assessment Tool (CSAT). Other blogs in this series include:

DHS Publishes PSP User’s Manual;

Announces PSP Manual on CFATS Knowledge Center;

PSP User Manual – Rules of Behavior

PSP User Manual – Groups and Submitters

PSP User Manual – Miscellaneous

Potential Problems Identified

Back in in early January, after DHS published their PSP program notice in the Federal Register, I wrote a blog post about potential problems with the system as it was explained in that notice. The potential problem areas identified in that post include:

• Multiple facilities

• Facility turnaround contractors

• Local delivery drivers

• Electronic access

• False positives

As expected, the User Manual did not specifically address any of these problems. It did, however, provide information to help resolve three of these problems; multiple facilities, facility turnaround contractors and electronic access.

Multiple Facilities

As long as all corporate facilities all have a single authorizer (the most likely situation), the PSP can be set up so that the Corporation Group would be a single account listing all company personnel with access to any of the covered facilities within the company. The Corporate Group could have a single submitter to support all facilities or individual submitters from each of the covered facilities. The latter would allow for a person at each covered facility who was able to review all of the personnel for whom PSP data submissions had been made.

If the company set up separate Groups for each facility that would still allow the Corporate Group to be set up for personnel from headquarters that could be visiting any of the covered sites within the company and might require unaccompanied access as ‘visitors’. Unfortunately, there would be no one at the facility who could verify data submission on those personnel in the Corporate Group, because the local Submitter would not have access to the Corporate Group data and one person cannot be a Submitter in multiple Groups within the same company.

A way around this would be to make someone else at the local facility a Submitter on the Corporate Group. Another way around the problem would be for HR to forward a completed template spread sheet with the required information for those company personnel that might be visiting the covered facility for that facility Submitter to upload to the local facility Group.

Facility Turnaround Contractors

The new PSP CSAT tool provides an easy solution for the problem of facility turnaround contractors without having to require possession of a TWIC or HME. The Authorizer can set up a Group for the main contractor responsible for turnarounds with a Submitter from that contractor.

The contractor would then be responsible for uploading the individual data for all personnel who would be working on that site. The contractor could then provide a status report for that facility that showed that all personnel data had been submitted. That document would, of course, be a Chemical-terrorism Vulnerability Information (CVI) protected document. The facility could then prepare a sign-in/sign-out sheet to help keep track of the contractors on site. As long as the sheet did not reference the PSP program or PSP status, this would not be a CVI protected document.

Electronic Access

Facilities that are going to allow vendors routine electronic access to physical components of control systems, building access systems, or security monitoring systems for maintenance purposes are going to have to include the vendor personnel who will have that access in their PSP program. This would require that they be set up as a separate Group on the PSP tool. Again the Authorizer would set up a vendor employee as a Submitter for that Group and establish an oversight Submitter from the company so that there would be someone in the company that could verify that data had been submitted.

Oversight Submitter

In a couple of places above I have suggested that the Authorizer establish a company employee as an ‘oversight Submitter’ on Groups that are being used to submit data on personnel who are not company employees. The idea here is that there would be someone from the covered facility that could access the Group data on the PSP tool to verify that an individual’s data had been submitted to the PSP tool prior to allowing that person access to a covered facility.

This is somewhat complicated by the fact that a person can only be a Submitter on one group under a given Authorizer. Small facilities could quickly run out of people who could verify the PSP status on multiple contractor or vendor Groups.

What is really needed is for the tool to be modified by adding a PSP Reviewer position. A reviewer would typically be the Security Manager or person fulfilling that type role on a local basis. The Authorizer could then specify multiple Groups within the company that each reviewer would be authorized to access to verify the submission status of contractor, vendor or corporate personnel desiring unaccompanied access to the critical areas of the facility.

The way things are currently structured in the PSP tool there is only one person who has access to the PSP status of all personnel in multiple groups; the Authorizer. It does not make any kind of sense in having a corporate officer put in the position of potentially having to be available at all hours to verify that someone has been properly vetted through the PSP program.