CFATS and NTAS – 5-18-21

The CISA Office for Chemical Security published a ‘Latest News’ notice on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center about the relationship between last week’s publication of a new National Terrorism Alert System (NTAS) bulletin.

The bottom line of the short message is found in the last two sentences:

“As of May 17, 2021, tiered CFATS facilities are not being required to implement the heightened security measures under Risk-Based Performance Standards (RBPS) 13 and 14 of their security plans. CISA is monitoring the intelligence information and will inform high-risk chemical facilities if there are changes that warrant activation of RBPS 13 or 14.”

Heightened Security Measures

RBPS 13 addresses ‘Security Measures and Considerations for Elevated Threats’. The Risk Based Performance Standards guidance document section on RBPS 13 specifically addresses the various levels in the old, color-coded alert system that DHS adopted shortly after it was created. That system was replaced in 2011, but the guidance document has not been updated since it was first published in May of 2009. It lists the types of security measures that should be considered for the various threat levels in the old system and facilities are expected to have planned measures that can easily be put into place for the higher threat levels.

But the new NTAS Bulletins, first initiated in 2015, do not fit into that Elevated Threats scenario because there is no actionable information provide in Bulletins that can guide facilities to respond with increased security measures.

RBPS 14 addresses ‘Specific Threats, Vulnerabilities, or Risks’. This standard comes into play when a facility is specifically notified of a threat targeted at that facility. Again, there is no actionable information about any specific threats that could require a facility to implement new security measures.

In other words, the information provided in this ‘Latest News’ item should come as no surprise to anyone responsible for security at CFATS covered facility. But it is reasonable to assume that if news of a specific threat does become available, communication with specific potentially affected facilities may first be initiated by direct communication from OCS to specific facilities, probably through chemical security inspectors, before public communications are made.