S 3405 CFATS Reauthorization – Inspection Frequency

This is another in a series of blog posts about S 3405, the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2018, which would reauthorize the Chemical Facility Anti-Terrorism Standards (CFATS) program for five years. The other blog posts in the series include:

Sen Johnson Proposes Gutting Cybersecurity Provisions of CFATS Program

S 3405 Introduced – CFATS Authorization

S 3405 CFATS Reauthorization – EAP

S 3405 CFATS Reauthorization – CFATS Recognition Program

Inspection Frequency

Section 6 of the bill addresses inspection and audit frequency. It would amend 6 USC 622(d)(1), Audits and Inspections. It would add a new subparagraph that would prohibit DHS from conducting CFATS program audits or inspections more frequently than once every two years; three years for facilities in the CFATS Recognition Program.

Commentary

This portion of the bill is another attempt by Sen. Johnson to provide regulatory relief to covered facilities under the CFATS program. Unfortunately, the wording of text indicates a profound misunderstanding of the CFATS process.

Currently, when a CFATS facility submits their site security plan for approval there is a somewhat less than formal visit to the facility by a team of Chemical Security Inspectors to audit the provisions of that plan. Essentially, they are trying to acquire sufficient information about the facility and its security plan to allow the review process to determine whether or not that plan should be authorized. Once the details of the site security plan (SSP) are agreed upon between DHS and the facility there will then be a formal Authorization Inspection. Then a year or two later DHS will conduct a compliance inspection (see ISCD CI fact sheet).

Additionally, a facility could face a requirement to revise their SSP because of changes in their situation (including perhaps a Tier reduction) which could require a new Authorization Inspection depending on the extent of the required changes.

Under the letter of the requirements in §6 there would have two be a two-year period between any of those inspection. I think that what Johnson was trying to accomplish was to establish the minimum period between compliance inspections. Even that requirement could raise problems for the program if a facility failed a compliance inspection and had to be re-inspected after taking subsequent corrective actions.

This is one of those instances where it would behoove crafters of legislation to take language of a proposed bill and walk it back through the regulatory agency to ensure that there are no unintended consequences of the wording of the bill. I am not suggesting that Johnson needed to have the wording ‘approved’ by DHS, just checked to see what the consequences of the language would actually be in practice.