CFATS and Facility Fires

Ever since the West Fertilizer explosion in 2013, I periodically get asked if the Chemical Facility Anti-Terrorism Standards (CFATS) program helps prevent facility fires. The answer is complicated, but generally speaking no, that is not the direct intent of the program; the CFATS is a security program not a safety program. Having said that, it is complicated and worth an additional look.

Safety and Security

Anyone that has worked in an industrial workplace knows that safety and security are intertwined. Security obviously prevents incidents that are the result of malicious intent and those events, if successfully carried out have safety consequences. A terrorist attack could certainly cause a fire at a facility; preventing the attack would certainly prevent the associated fire.

But effective safety programs are also a good way to mitigate the effects of a malicious act. Effective fire prevention and mitigation activities would reduce the negative effects of a successful terrorist attack that was intended to start a fire. So, part of an effective security plan is good integration with the facility safety activities.

Emergency Response

Planned and coordinated on-site and off-site emergency response is an important part of both facility security and safety plans. Both plans must address the potential failure to prevent the unwanted outcomes associated with either a security or safety incident. In fact, the undesirable consequences of either type event are frequently identical. Thus, there needs to be coordination of the emergency response portions of both the security and safety plans for the facility.

CFATS and Safety Incidents

One thing that facility security officers need to remember is that the response to a safety incident is going to have a potentially significant effect on the facility security plan. A fire at a facility is going to disrupt all activities at the facility, especially the security activities. An emergency response from outside agencies is going to bring a large number of people into the facility that may or may not be familiar with the security controls in place. And if those security controls interfere with the operations of emergency response personnel the facility and its staff will suffer.

A site security plan should include actions to be taken to increase security during both security and safety incidents. The increase in traffic into the facility by emergency response personnel, the appearance of crowds of bystanders watching the event and the presence of TV and print news crews along the facility perimeter all need to be taken into account when planning on how to respond to such events. Facilities that have to rely on volunteer fire departments are going to have a special problem with quickly identifying incoming emergency response personnel.

Security plans are also going to have to be able to deal with post incident cleanup activities. While CFATS rules provide for unescorted access to facilities by emergency response personnel during an incident, they do not provide an exemption for post-incident response personnel. After a significant safety event a wide variety of new and unusual personnel are going to be required to have access to the facility. This obviously includes environmental remediation teams at chemical facilities but will also include a variety of government and insurance company investigators. There could also be engineering and construction personnel that will be involved in planning for and executing facility repairs. All of these personnel are going to have to be accommodated by either vetting through the personnel surety program or more likely being escorted by facility personnel.

Finally, facility security officers need to remember their incident reporting requirements under the CFATS program. While an accidental fire at a CFATS covered facility may not sound like a security incident, if it had any effect on the facility security, compromised (even temporarily) any of the facility security measures included in the Site Security Plan, or just help identify problems with the security plan or its emergency response processes; notifications to the Infrastructure Security Compliance Division will be required.