More Details on Modified CFATS Compliance Inspections

I received a response to my email to CISA Infrastructure Security Compliance Division (ISCD) about the temporary changes that are being made to the Chemical Facility Anti-Terrorism Standards (CFATS) compliance inspection process that I briefly mentioned earlier this week.

First, ISCD makes is clear that they are continuing to work out the details of the modified inspection plan in coordination with each facility being inspected. Not only is ISCD trying to work out an effective compliance inspection regime during the COVID-19 pandemic, but they also realize that each facility is going to have a unique set of circumstances that needs to be taken into account so that the inspections do not unduly endanger facility personnel or chemical security inspectors.

The ‘three options’ reported on CFATS Knowledge Center have been more completely explained in this email. They are:

1. Compliance Audits: Chemical Security Inspectors (CSIs) request, remotely review, and  then lead a discussion with facility personnel on records and documentation related to  the facility’s chemical(s) of interest (COI) and the security measures described in the  facility’s security plan.

2. Compliance Audits with Facility Perimeter Walkaround: In addition to the Compliance Audit, this includes CSIs conducting a walkaround of the covered facility’s perimeter to review in person the facility’s perimeter security measures.

3. Modified COVID-19 Compliance Inspections: CSIs conduct an onsite inspection while minimizing face-to-face time and maintaining social distancing as much as possible.

These briefly describe inspection modality changes do not reflect any material change in the CFATS inspection process. These are evolving interim measures that allow DHS inspectors to verify that covered facilities continue to maintain their security programs during this emergency. ISCD can be expected to work closely with facilities to ensure that these modified inspections are effective and safe.

The use of the term ‘audits’ in options 1 and 2 imply (in my opinion) that a successful compliance inspection has already been conducted at the facility. This would allow chemical security inspectors, where a periodic compliance inspection is called for, to assure themselves that the facility is remaining generally in compliance during reduced operations or facility closures during the pandemic.

If ISCD is using any of these three modified inspection modalities at facilities where a compliance inspection has not yet taken place, I would expect that there would be a more complete inspection that would take place after the COVID-19 emergency has passed.

One final point was made in the email I received. ISCD is still not conducting any authorization inspections during the COVID-19 emergency. The detailed inspection and facility review that is required to provide ISCD with the information necessary to authorize a site security plan cannot be safely conducted in a safe social-isolation environment.

I would love to hear from facilities or CSI that have participated in one of these modified inspections, on or off the record.