ACC ASP – Submitting the ASP

This is the last in a series of blog posts about the recently published American Chemistry Council Alternative Security Plan for the CFATS program. The earlier posts are listed below. This post will look at how the ASP is submitted to ISCD and address some way that this ASP might improve the CFATS SSP process.

ACC Publishes CFATS Alternative Security Program

ACC ASP – Guidance Document

ACC ASP – Instructions

Reader Comment – 1-2-13 – ACC Comments on ASP

ACC ASP – Template

ASP Submission

Before an organization tries to submit the ASP they must realize that they will still be completing the SSP submission via the SSP tool in CSAT. There are a number of questions that must still be completed in the SSP tool when submitting the SSP. The SSP Questions Manual describes the questions that the facility will be required to answer when submitting an SSP.

All of the questions described through page 49 must be answered by all facilities, regardless of whether or not they are submitting an ASP in lieu of the remainder of the SSP. The answers to many of those questions will already be pre-populated in the SSP tool based upon earlier submissions to ISCD via CSAT. Even if the answers are prepopulated the facility is required to review the information to ensure that it is correct. Contact the CSAT Help Desk {(866) 323-2957} for assistance in correcting invalid data.

On page 50 the manual shows that facilities wishing to submit an ASP will check the ‘Yes’ button for Q 5.6-17939. Four additional questions will then be asked about the adequacy of the ASP in meeting DHS requirements for an ASP. DHS has generally agreed that a properly executed ACC ASP will fulfill these requirements so most facilities will answer ‘Yes’ to all four questions. A ‘No’ answer to any of the four questions will require the answering of a fifth question asking if the facility really wants to submit the ASP anyway.

At that point the facility will be required to identify and describe the documents to be upload to the SSP; the process is described on page 51 of the manual. This will include the completed WORD® file downloaded as part of the ACC ASP Guidance document. Supporting diagrams, maps, photographs and supporting documents will also be uploaded at the same time.

According to the SSP Instructions Manual once the data is uploaded, the CSAT SSP tool will take the submitter to the validation portion of the submission at the end of the tool. From that point on the process will be the same as for those facilities completing the standard SSP.

Other ASPs

While the ACC really designed their ASP for the use of their member companies, they are not stopping others from using the ASP. While I don’t see why any type of high-risk chemical facility couldn’t use the ACC ASP, I understand that there are other industry organizations that are working with DHS to get ASPs of their own design approved; designs one would expect to be tailored to facilities within that type of industry.

The one group that might have concerns with this ASP would be colleges and universities. Educational organizations have been pressing DHS to develop an ASP particularly for their ‘unique’ situation since the CFATS program was first introduced. I suspect that they will continue to have a hard time accepting that DHS actually intends for them to put significant security measures in place at their facilities that DHS has judged to be at high-risk of a terrorist attack. They will continue to hope that an ASP will be able to be used as a dispensation from the CFATS risk-based performance standards requirements. The ACC ASP will severely disappoint the scholarly community.

ISCD and the ACC ASP

I have not yet seen an official notice from the folks at ISCD that they will ‘accept’ an ACC ASP submission and part of me does not expect to. The way that the SSP tool handles the ASP submission process, there is nothing involved that would identify a submission as being made via an ACC ASP. Theoretically, a facility could submit any sort of document using the procedures that I have described above as an ASP. The SSP tool would accept it.

That, doesn’t mean, of course, that ISCD would actually use the information submitted. Scott Jenson and Bill Erny from ACC both assure me that DHS has told them that information submitted via the ACC ASP format meets the needs for their analysis. That means that ISCD knows where to look for the specific information that they need to evaluate the SSP/ASP submission. Some other format that hasn’t been pre-cleared with ISCD may not provide the needed information or may provide it in a format that is not easily decipherable by ISCD. ISCD is having a hard enough time getting the information they need from a straight SSP submission; they are not going to waste any time trying to decipher something that they don’t understand.

ISCD Improving SSP

I understand that ISCD has folks working on a plan to improve the current SSP submission process. I fully believe that they would do well to take a hard look at the format used by the ACC ASP and adapt it to an on-line submission process. They should definitely strive to have the printed document from the end of that submission process be in a format that the average corporate reader or chemical facility security inspector could readily read the document and find the information needed to implement or audit the implementation of the Site Security Plan.

Lacking that sort of fundamental change I would like to suggest that ISCD should consider including a specific template for the submission of the ACC ASP (and any other subsequently approved ASP format). If I were setting it up I would have a separate upload of each of the sub-paragraphs listed on the ASP Table of Contents page. Each sub-paragraph would be a separate file and it would be easy to parse those files to the appropriate analyst at Headquarters for the evaluation of the SSP/ASP. It would also make it easier to make subsequent changes to the SSP/ASP, requiring only a submission of the portions that will be changing.

Recommendation – Two Thumbs Up

Just in case I haven’t made it clear in my analysis to date, I really do believe that the ACC ASP is a significant improvement over the current SSP submission. The folks at ACC are to be commended for the work they have done on the document. I highly recommend that any high-risk facility that has yet to submit their SSP consider using this ASP template for their submission. Facilities that have yet to have ISCD authorize previously submitted SSP’s (and there is a large number of those) needs to contact ISCD and see if changing to the ACC template would make the approval process any easier.

ACC ASP – Template

This is the fourth in a series of blog posts about the recently published American Chemistry Council Alternative Security Plan for the CFATS program. The earlier posts are listed below. This post will look at the “ACC ASP Template Final20121107” (Template) Word file that is imbedded in the “Alternate Security Program (ASP) Guidance for CFATS Covered Chemical Facilities” (Guidance document) that forms the core of the downloadable program.

ACC Publishes CFATS Alternative Security Program

ACC ASP – Guidance Document

ACC ASP – Instructions

Protective Markings

The template is essentially the same as the last twenty pages of the on the instructions that I discussed in the earlier post. There are, however, some important differences between the two. First the template includes all appropriate Chemical-Terrorism Vulnerability Instruction (CVI) markings that will have to be on the document when it is submitted to DHS, including front and rear ‘cover’ pages and a footer “warning” statement. As soon as any facility information is placed in the template it becomes a document requiring CVI protection.

Any attached documents will require the same cover pages and page markings. Cover pages can be found on the CVI web page.

Formatting

The basic format of the document is an outline based upon the outline found in the Table of Contents. The outline markings are based upon bullet points instead of letters or numbers. If you want to change it to a more classical outline that allows easy reference to the paragraphs within the sections that can easily be done in Word®. Personally I would use a numbered outline system for reasons that will be clearer shortly.

Unlike the template found in the Instruction document, the page numbering on the Table of Contents page is not actually linked to the section headers. One of the last things that you are going to want to do before submitting the completed ASP document in the DHS CSAT SSP Tool will be to put the appropriate page numbers in the Table of Contents. This will actually make it easier to copy sections from the template into separate documents to farm out the completion of the information to different people or teams. Again, remember that the CVI marking and protection rules will have to followed for those abstracted sections as soon as any facility information is entered.

Duplicate Information

There will be places in the document where the same information will be entered in different places. While DHS won’t be concerned about seeing duplicate (the key here is that it really is duplicate) information in multiple places, there is a good reason for not writing the same information in more than one place. If you have to go back and make a change to it for some reason you may miss one or more iterations.

It will be more effective to write it one time and then refer back to it in later places in the ASP documentation using conventional notations like “{See Section 5.2(a)(1)}”. This is the reason that I suggest using number (or lettered) paragraphs within each section instead of bullet points.

Detailed Information

This bears repeating, one of the main problems that DHS has encountered with their SSP authorization process has been that an inadequate amount of information describing parts of the security process for the facility has been included in the SSP submission. While the ASP process makes submitting the information easier (and subsequently more useable) there still needs to be a sufficiency of information provided.

Remember, analysts will be sitting in an office building somewhere reading the information provided by the facility trying to determine if the security measures provide an adequate measure of protection for the facility at its present tier level. Telling them in section 5.1 that there is a chain-link fence around the facility perimeter is not adequate information, they need to be told something like this:

“The facility is protected by 1,257 feet of commercial grade chain link fence. All segments of the fence are 8 foot tall with an outward-facing 18” top-guard with four strands of razor-wire. Corner posts have two top guard supports at a 90 degree angle from each other. Fence posts are set in three foot of concrete and placed at no more than 15 foot intervals. A single course of cinderblocks set in an 18 inch deep concrete footing runs under the fence fabric between each post with anchors placed no further than three feet apart to attach the fence fabric to the cinder block.”

Okay, my fence is a bit of overkill, but it is completely described.

Not Too Much Information

Remember that every detail that you put into the ASP submitted to ISCD is an inspectable part of your site security plan. To change any of those details you have to re-submit the revised ASP and hope that it passes muster with DHS. If you make changes without that pre-approval, it could cost you up to $25,000 per day, or, in the worst case, cause DHS to issue a facility closure order.

The area that will probably cause the most problem for this is not the physical plant. The more likely area will be in processes and procedures. Where possible the process or procedure documents will be maintained in documents separate from the ASP and the title of the appropriate document will be mentioned in the ASP where necessary.

For example if you use padlocks on unloading valves as part of your process to protect access to a COI you are going to have to have some method to maintain control of the keys to those locks to prevent that unauthorized access. Rather than outlining your entire key control process you could explain that: “The keys for those valve locks are maintained in the locked key box in the Shift Supervisor’s Office and are only issued in accordance with the provisions of the Facility COI Key Control Procedure.” Once part of the authorized SSP, that wording would allow a Chemical Facility Security Inspector (CFSI) to verify that the process in that procedure was being followed, but not to evaluate the details of that process.

It would probably be a good idea to maintain a list of all of the referenced processes and procedures in Section 1 of the ASP.

Key Words and Phrases

One of the things that does not receive enough emphasis in the supporting documentation for the ASP is the importance of using certain key words and phrases when describing facility security measures. These key words and phrases can be found in the RBPS Metrics for each Risk-Based Performance Standard in the RBPS Guidance document.

For example section 5.1 of the ASP calls for a description of ‘Vehicle Barriers’ and the Security Metric 1.2 for Restrict Area Perimeter (pg 29) Tiers 1 and 2 calls for “Entrances equipped with traffic control systems to slow incoming traffic…”. Given that combination I would suggest that the description start with:

“The single vehicle gate is equipped with traffic control devices to slow incoming traffic. The traffic control devices consist of ….”

Memorandum of Understanding

There are a number of references to “MOU in place” in the “Emergency Responders, Off-sit” paragraphs of Section 2 of the ASP. An MOU is a memorandum of understanding between facility management and an organization outside of the facility (local police, fire departments, or emergency medical services for instance) that is providing some sort of support to the facility Site Security Plan.

As long as the facility is relying on an outside agency as part of its SSP, it needs to be able to show that the agency is prepared to provide the necessary services. The MOU needs to specify what type of support will be provided, under what circumstances, and what type of response time could be expected. Probably the most important aspect of the MOU is that it needs to be signed by an appropriate official of the supporting agency.

One More Posting

The next and final posting in this blog series will address how the completed ASP is submitted to DHS.

ACC ASP – Instructions

This is the third in a series of blog posts about the recently published American Chemistry Council Alternative Security Plan for the CFATS program. The earlier posts are listed below. This post will look at the “Alternate Security Program (ASP) Template Guidance and Instructions” (Instructions) that is imbedded in the “Alternate Security Program (ASP) Guidance for CFATS Covered Chemical Facilities” (Guidance document) that forms the core of the downloadable program.

ACC Publishes CFATS Alternative Security Program

ACC ASP – Guidance Document

The Instructions can be found on page 18 of the Guidance document. Click on the first ‘paperclip’ symbol on the page and you will open the file:

ACC ASP Template Guide and Instructions Final20121130.docx

The numbers at the end of the file name may change as the ACC updates and revises this program.

Chemical-Terrorism Vulnerability Information (CVI)

It was mentioned briefly in the ASP Guidance document that everyone that will be accessing the partially completed SSP/ASP document will have to be CVI trained and certified. Once any information about the security of the facility is entered into the template it becomes a document requiring CVI protection. Make sure that everyone who will be working with this information has completed the online training course and copies of their training certificates are on file.

Before You Start

Pages 2 thru 9 of the Instructions provide a general set of guidelines that should be followed when filling out the template. I strongly recommend that the entire team that will be working on the SSP/ASP preparation carefully read those 7 pages of the Instructions and be familiar with the any of the Risk Based Performance Standards (RBPS) in the RBPS Guidance document published by DHS that they may be responsible for. This familiarity will make it much easier to fill in the template with verbiage that includes the key words and phrases in the RBPS that the folks at DHS ISCD will be looking for in their evaluation of the SSP/ASP.

RBPS

There is a brief discussion of the RBPS in the ASP Guidance document and there are two brief explanations of the RBPS in the Instructions, but both documents gloss over a very important point. While DHS may not (prohibited by Congress) specify a particular security measure they do spell out in the RBPS Guidance document the way they will measure compliance (RBPS Metrics) with each RBPS at the specific Tier level to which a facility has been assigned. The difference between the required performance metrics for two different tiers may be one word, eg: ‘routinely’ vs ‘usually’. Including these key words in the description of a security measure may make it easier for DHS analysts to understand the intent of the security plan.

Attack Scenarios

One of the more confusing ideas that DHS included in their CFATS program was the idea of “Attack Scenarios”. Security professionals initially thought that the seven scenarios proposed by DHS were the proposed design basis for the security plans, attacks that had to be prevented for the plan to be successful. That was not the intent of DHS. As the Instruction document explains (pg 3):

“Rather, the attack scenarios are analytical devices, supporting the evaluation of a facility’s security and enabling DHS to conduct comparative risk analysis across the sector.”

The Security Metrics in the RBPS explain how well the facility (at its specific tier level) must be able to deal with those scenarios. As the Instructions document explains, not all attack scenarios apply to each RBPS. But, when they do apply they should be specifically addressed in the words that are put into the template so that it is clear to the ISCD analysts that the facility has addressed the issue.

Security Approach

There is a nice discussion in the Instructions document about the differences between perimeter based and asset based security measures. Essentially, the ‘perimeter based’ approach includes the entire facility whereas the ‘asset based’ approach only provides security measures for a specific area of the facility where a COI is found. For a facility with a single high-risk COI, it may make more economic sense to confine the bulk of the security measures to the area where that COI is used/stored. For facilities with multiple COIs at varying security levels, it may make more sense to protect the facility at the level for the COI with the lowest tier ranking (provided by DHS) and reserve the more complex security arrangements for the area around the highest tier-ranked COI.

As noted on page 5 of the Instructions document:

“In the description of a specific security measure, ASP preparers should describe whether it is applied facility wide or to specific assets.”

Too Much Information

As the Instruction document alludes to, the problems that ISCD has had with not being able to authorize SSPs have been in large part due to not receiving enough information from the facility about their security plans. So generally speaking, the more the better, but there is a limit. As the Instructions document states on page 7:

“On the other hand, the preparer may wish to limit detail that does not relate to the listed COI or the performance of the specific security measure or system, to allow for minor changes without the need for ASP resubmission.”

This is an important point that needs to be clearly understood by facility management. Once the SSP/ASP is authorized by DHS it is essentially a legally binding document outlining the inspectable requirements for facility security under the CFATS program. The congressional prohibition against specifying particular security programs no longer applies. If a subsequent ISCD inspection does not find an authorized component of the SSP/ASP in place, the facility may be fined up to $25,000 per day or even shut down (an extreme case to be sure) for non-compliance. Any changes to the authorized ASP must be approved by ISCD before they are made.

One way to get around some of this problem will be to include the little details of the plan in separate documents describing specific procedures and processes. The Instructions document notes that:

“It is not necessary to include the text of every procedure that is described in the ASP.  Use an unambiguous reference that is clear to facility personnel and that inspectors can request by name for review, for example, ‘Suspicious Activity Reporting Procedure S.4.01’.”

There must be, however, enough detail in the submitted ASP to allow the ISCD analysts to determine if the RBPS Security Metrics have been met.

Take Credit for Everything

The last topic that is specifically discussed in the first nine pages of the Instruction document is a reminder to take a careful look at everything that the facility does to determine if it contributes to security. Many process safety and almost all emergency response measures already in place at the facility may contribute to the security plan, particularly the ‘Response’ RBPS. Simple things like referring to a COI by a company product name rather than an easily recognizable chemical name will make it harder for an attacker to find their target. Pages 8 and 9 of the Instruction document provides a short list of things to look at.

Just remember, though, if you take credit for it and list it in the ASP you must continue doing it until DHS gives you permission to change.

The Template

The remainder of the 30 page Instruction document is an annotated copy of the template. Explanatory material and completion suggestions are provided in blue type. Almost everything in black type should remain in the submitted document with appropriate additional supporting information. I’ll look at the actual template in some detail in later blog posts.

ACC ASP – Guidance Document

This is the second in a series of blog posts about the recently published American Chemistry Council Alternative Security Plan for the CFATS program. The initial blog post is listed below and dealt with an overview of the place of the ASP in the CFATS program. This post will look at the “Alternate Security Program (ASP) Guidance for CFATS Covered Chemical Facilities” (Guidance document) that forms the core of the downloadable program.

ACC Publishes CFATS Alternative Security Program

There are two embedded documents in the Guidance document; the template and the instructions for the ASP and they form the basis of the actual ASP that will be submitted to DHS as part of the facility site security plan. There is a significant amount of additional information available in the document.

CFATS Overview

The first five pages of the Guidance document provide a fairly detailed guide to the CFATS program. Now anyone who is in the process of considering options for submitting an ASP in lieu of an SSP should be fairly familiar with the CFATS program, so this would seem to be somewhat superfluous.

We have to remember, however, that once a facility reaches the SSP stage of the SSP process, the funding issues become rather large. The upper level management that needs to become involved in the budgeting process at this point could use a high level lesson in the requirements of the CFATS program and these five pages could form a good starting point for that discussion.

Pre-Authorization Inspection

In its discussion of the CFATS inspection process the Guidance document provides a reasonably good description of the purpose and process of the Pre-Authorization Inspection. Since DHS ISCD has yet to formally address this addition to the CFATS program in any of their written documents the following description taken from the Guidance document serves an important purpose;

“Pre-Authorization Inspections (PAI) are conducted AFTER the submission of an SSP/ASP but BEFORE a letter of authorization, in which the SSP/ASP is preliminarily approved as the regulatory standard for that facility. Pre-authorization inspections were instituted after it became clear that the CSAT SSP template was not producing enough detail to result in the issuance of letters of authorization. Their purpose is for the inspection team to establish the facts on the ground and for DHS to provide feedback for both the improvement of the detailed content of the SSP/ASP and potentially for improvements in existing security measures to meet the RBPSs.”

Of course, part of the purpose of the publication of this ASP template and instructions is to provide an initial data submission to DHS and ISCD that precludes the necessity for DHS to conduct such PAIs.

Authorization Inspection Process

The ACC Guidance document provides information on the Authorization Inspection process as well. Again this is another area where detailed information has been lacking from the folks at ISCD, unless they are providing it directly to facilities when they schedule the inspections. In any case, the information provided here will be very beneficial to any facility beginning to prepare for their authorization inspections.

The Appendixes

The Guidance document includes four appendixes that provide a variety of additional information on the CFATS program. The four appendixes are:

• Definitions and Acronyms

• Alternate Security Program Template

• CFATS Risk‐Based Performance Standards

• CFATS Reference Links

Of the four the second is, of course, the most important for facilities considering the submission of their SSP. It includes two imbedded Word® documents that form the basis for the ASP submission.

• ACC ASP Template Guide and Instructions Final20121130.docx

• ACC ASP Template Final20121107.docx

I’ll discuss these two documents in later blog posts in the series, but I suspect that the ACC will be a tad bit more proactive in updating these files as additional facilities use them to prepare and submit their SSP/ASP

Assessment

I think that the ACC has produced a very good CFATS summary document here. In many cases it is more informative than the formal DHS documents upon which it draws. The major drawback is that it spends almost no time discussing the preparation of the ASP. While that is covered in the imbedded instruction document, it would be helpful if there were some discussion here about some of the ASP/SSP issues.

For instance, there is nothing said about the relationship between an adequate level of information necessary for DHS assessment and the need to leave room for minor modifications in the program that won’t require a resubmission of the ASP. Too much detail and the smallest change will have to go through a long-delayed reassessment process at ISCD. Too little detail and the facility will have to go through the added problem of an AIP inspection.

Additionally, I think that there should be a little more emphasis on the fact that any security procedures, processes and equipment mentioned in the authorized SSP/ASP become a regulatory requirement for the facility in all future DHS-ISCD inspections. While DHS cannot specify which security processes need to be employed to get an SSP/ASP authorized, they can and will require strict adherence to the authorized SSP/ASP.

I’ll look at how these issues are addressed in the instructions and template in future blog posts.

All and all this is a much better document than anything that the folks at DHS have done for the SSP process.