ISCD Updates Ownership Change FAQ

Today the CISA Infrastructure Security Compliance Division (ISCD) updated a frequently asked question (FAQ) response in the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. FAQ #1275 was changed; it was originally published in 2015 and most recently revised in 2017. FAQ #1275 asks:

What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

Two different changes were made. There was an inconsequential name change substituting either ‘Cybersecurity and Infrastructure Security Agency’, ‘CISA’, or ‘Agency’ where the previous version used ‘DHS’. The second change is slightly more substantive.

In the Option 2 explanation the last two sentences were removed:

The buyer should also provide the new facility name, owner, operator, and parent company, as applicable. Facilities may edit this information themselves; however, the Department still requests a letter from the buyer and from the seller if possible.

 Then, the following language substituted:

To expedite the transfer, the buyer should provide in its letter, the new facility name, owner, operator, and parent company, as applicable. The buyer should also include the New Authorizer's name, email address, and phone number.

This is not a real policy change; it just provides some additional clarity.