Updated DHS Chemical Sector Information

This week DHS, acting as the Chemical Sector-Specific Agency (SSA) supporting the National Infrastructure Protection Plan (NIPP), published a new website that provides information to support the security and safety of small and medium sized chemical facilities. This new page serves as a landing page for chemical facilities to find the resources and information available from the US government and its chemical sector partner agencies.

Information Links

The new page provides links to:

• Chemical Sector Regulatory Authorities (5-26-17);

• Chemical Sector (5-27-17);

• Chemical Sector Resources (04-07-17);

• Chemical Security Analysis Center (no date);

• Chemical Risk Management Self-Assessment Model (08-15);

• Chemical Sector Publications (02-06-17); and

• Chemical Sector: Partnering to Enhance Security and Resilience (04-05-17)

Cybersecurity Support

Chemical manufacturing, warehousing, and transportation companies have specific cybersecurity concerns that extend beyond the standard IT cybersecurity issues with which all public and private sector organizations have to contend. With that in mind, the above listed page have many references to cybersecurity resources. They include:

• DHS Critical Infrastructure Cyber Community (C³) Voluntary Program Small and Midsize Businesses (SMB) Toolkit;

• Stop.Think.Connect.™ Toolkit;

• Cybersecurity for Small Businesses (training exercise);

• Federal Communications Commission Small Biz Cyber Planner 2.0;

• Federal Trade Commission: Protecting Small Businesses;

• Internet Essentials for Business 2.0;

• White Paper: Every Small Business Should Use the NIST Cybersecurity Framework;

• Chemical Sector Cybersecurity Framework Implementation Guidance;

• Protecting Critical Infrastructure

None of the above titles specifically addresses industrial control system security issues. There are references to the topic on two of the pages listed above (Chemical Sector Publications and Protecting Critical Infrastructure). The last only provides a link to arguably the most important DHS ICS cybersecurity site, ICS-CERT. The former provides a section on ICS security which describes a worthwhile DVD resource available upon request from DHS. There is only a passing reference to the ICS-CERT Cybersecurity Evaluation Tool (CSET).

Emergency Response Planning

What is sadly lacking from the resources listed is any significant reference to emergency response planning. The only information provided is a link to a FEMA site that provides generic small business emergency planning guidelines. That information is very limited and provides no mention of chemical emergency response planning.

While emergency response planning is important for all businesses, it is arguably much more important for chemical facilities, especially those with hazardous chemicals on site. The failure of emergency response planning for most businesses will not have significant off-site consequences, but that is not true for many (most?) chemical facilities. While the EPA is vaguely responsible for emergency response planning requirements at the most dangerous facilities, one would think that the Federal Emergency Management Agency (FEMA) would be much more proactive in this area.