CFATS FY 2019 Outreach Plan

Today the DHS Cybersecurity and Infrastructure Security Agency (CISA) published their FY 2019 Chemical Facility Anti-Terrorism Standards (CFATS) Outreach Implementation Plan. This annual report was required by the 2014. This document provides a summary of activities undertaken in 2018 and planned for 2019 to implement the CFATS outreach requirements set forth in 6 USC 622(e)(1) and 6 USC 629. This is a follow-up to the FY 2018 report published earlier this year.

Outreach Program

Very little information in this 48-page pamphlet will be of direct interest to covered CFATS facilities; they are not really the target of this outreach effort. This effort is targeted at potential chemical facilities of interest (P-CFOI, facilities that may hold DHS chemicals of interest) to ensure that those facilities are knowledgeable of the CFATS reporting requirements for facilities that hold COI at or above the screening threshold quantity outlined in Appendix A to 6 CFR 27.

A quick read of the document does provide some interesting factoids.

As part of the roll-out of CSAT 2.0 in the fall of 2016, 3,013 facilities submitted first-time Top Screens, and of those, 335 have been added to the CFATS program as being high-risk facilities; a conversion rate of 11.1%.

In FY 2018, presumably as a result of the on-going outreach program, and additional 1,269 facilities submitted first-time Top Screens with 184 of those being added to the CFATS program; a 14.5% conversion rate.

As part of the FY 2019 outreach program, CISA will be targeting a slightly different set of industries that it believes may be under-represented in Top Screen submissions. This year the shorter list includes (pg 13):

• Glass and glass products manufacturing;

• Propane distribution;

• Plastics manufacturing;

• Grain and oilseed milling;

• Frozen food manufacturing;

• Dairy product manufacturing;

• Animal slaughtering and processing;

• Agriculture co-ops; and

• Soap, cleaning compound, and cosmetics manufacturing

LEPC Outreach

One interesting new addition to this outreach program document this year is found in Appendix B, Local Emergency Planning Committee (LEPC) Focused Outreach. This part of the outreach program is not directed at identifying new P-CFOI. Rather it is an attempt to answer a recommendation of the latest Government Accountability Office (GAO) report on the CFATS program about increased sharing of information with Local Emergency Planning Committees (LEPCs) and emergency response personnel.

Appendix B lists the 95 LEPCs receiving specific outreach efforts from the Infrastructure Security Compliance Division (ISCD) of CISA. It notes that these 95 LEPCs in 45 counties represent 870 existing CFATS facilities. Three counties account for the bulk of these LEPCs;

Middlesex County, MA (13), Middlesex County, NJ (25), and Harris County, TX (13).

With the concentration of chemical manufacturing and shipping in Harris County, TX it is heartening to see the substantial number of LEPCs in that country. In contrast, Los Angeles County, CA, with a much higher population and more diverse chemical manufacturing environment has only a single LEPC. This will make ISCD’s outreach effort simpler, but it makes me wonder how effective that LEPC can be.