ISCD Publishes CFATS Update – November 2017

On Friday the DHS Infrastructure Security Compliance Division (ISCD) published their Chemical Facility Anti-Terrorism Standards (CFATS) Monthly Update for November. The casual CFATS web site observer would be surprised to hear this since this has not been shown on either the Critical Infrastructure: Security Compliance web page or the CFATS Knowledge Center web page.

Published Data

Table 1 below shows the data published indicating the compliance data published for the facilities currently covered under the CFATS program. The numbers show a continued increase in the number of covered facilities and the number of compliance inspections being conducted.

Current Facilities	Oct 2017	Nov 2017	∆
Covered Facilities	3,492	3,517	+25
Authorization Inspections	2,374	2,400	+26
Approved Security Plans	2,270	2,273	+3
Compliance Inspections	2,106	2,122	+16

Table 1: Current CFATS Facilities

Table 2 shows the data showing the data on all facilities since the program was initiated back in 2007. Again, we see increases across the board.

Total Facilities	Oct 2017	Nov 2017	∆
Authorization Inspections	2,975	3,015	+20
Approved Security Plans	2,766	2,779	+13
Compliance Inspections	2,807	2,954	+61

Data Analysis

Figure 1 below is a graph showing the number of authorization inspections conducted since ISCD resumed reporting in May of this year. Both lines show a slight uptick in the number of inspections conducted. This is to be expected as facilities have had a chance to begin submitting SVA/SSPs for the new tiering letters that have begun to be issued under the new risk assessment process was implemented. We can expect to see a sharper increase in coming months.

Figure 1: Authorization Inspections

The compliance inspection information continues to require us to make some assumptions about how ISCD is counting the difference between current and total compliance inspections. Figure 2 shows the data reported since May.

Figure 2: Compliance Inspection Data

The total number of compliance inspections data continues to show a fairly consistent rate of increase (linear regression analysis shows R² of .996) since May. This would be consistent with ISCD’s current emphasis on ensuring that facilities with approved site security plans are in compliance with those plans. As ISCD begins to conduct more authorization inspections on newly submitted SSPs this rate will probably flatten out as the limited manpower available to the Division is re-purposed.

When we compare the current to total compliance inspection data we begin to see some discrepancies; a much steeper increase in the total number of compliance inspections as compared to the relatively flat increase in current inspections. When we look at the number of current compliance inspections compared to the number of currently approved SSPs we have to draw the conclusion that ISCD is reporting only one ‘current’ compliance inspection per facility with an approved SSP.

There are only two ways that ISCD can be reporting a large number of new inspections each month with only a small increase in the number of current SSP’s; either there are a significant number of facilities exiting the CFATS program or there are multiple compliance inspections being conducted on current facilities. The number of currently approved SSPs does show a slight decrease (8) since reporting resumed in May even though the total number of SSPs that have been approved has increased by 60. That would seem to indicate that some facilities have left the program (68?) during the reporting period and that is within the magnitude of what ISCD reported back in April.

The change in the number of compliance inspections tells a completely different story. Since May there has been an increase of 901 total compliance inspections completed and only an increase of 191 current compliance inspections. Since a facility must have an approved SSP prior to having a compliance inspection the 68 disappearing SSPs does not explain the difference of 710 compliance inspections. Combining the two data sets we can see that there have been 642 (710 – 68) compliance inspections that are not accounted for in the total number of current compliance inspections.

The only thing that I can conclude is that ISCD chemical security inspectors have conducted at least 642 compliance inspections since reporting resumed in May where the facility was not in compliance with the currently approved SSP. How many of these are unique facilities vs facilities with multiple non-compliant inspections results cannot be determined from the data presented in these reports.