Review - ChemLock Exercises – An Overview

Developing a chemical facility security plan is just a time-consuming, compliance exercise until it has been tested. Instead of waiting for a real-world security incident to be the first test of a facility security plan, a smart security team will conduct a variety of exercises to evaluate the efficacy of the plan and the assumptions which drove its development. CISA’s new ChemLock program, a voluntary off-shoot of the successful Chemical Facility Anti-Terrorism Standards (CFATS) program, provides a number of exercise tools that facility security managers can use to plan, execute and evaluate a series of exercises to see how well their facility security plan stands up to a variety of security scenarios.

ChemLock Exercise Web Page

This page is the starting point for exercise planning and development. Most of (okay maybe all, but I am not sure about that) the information here was not specifically developed by the CISA Office of Chemical Security (the folks that manage the CFATS program), but rather by the wider range of offices within CISA and DHS.

There are two general options provided on this page. The first (and easiest) is a series of canned CISA Tabletop Exercises Package (CTEP). The CTEPs are no-cost to download and include the scenario-specific situation manual, planner handbook, facilitator/evaluator handbook, and assorted forms and templates. The second option is to contact the ChemLock folks to ask for assistance in planning and executing an exercise. That option is initiated by the use of the same  ChemLock Services Request Form that I have mentioned in a number of earlier posts.

Which Exercise?

In a perfect world, every facility would run every exercise as routine part of operations. Obviously, that is not going to happen in the real world. If a facility has never run an exercise of this sort, it is probably best to concentrate on one exercise and run it through a couple of iterations before trying to determine what sort of ‘exercise schedule’ will be appropriate for the facility.

I will be looking at individual exercise packages in future posts, but each facility is going to have to determine which exercise would be the most appropriate to start with. Facilities are going to want to start with something simple, but something that is a real potential threat at that facility. For example, a vehicle borne explosive device is probably not a serious threat at a facility that does not have significant inventories of toxic inhalation hazard chemicals on site unless an attacker has a particular issue with the facility.

Remember, though, the whole purpose of the ChemLock program is to help chemical facilities solve their security issues. The folks at OCS have offered to provide that assistance. So, facilities should contact the ChemLock folks with their questions about these exercise programs. Questions should be addressed via email to ChemLock@cisa.dhs.gov.

For more details about these exercise offerings, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/chemlock-exercises-an-overview - subscription required.