ISCD Updates Ownership Change FAQ

Today the CISA Infrastructure Security Compliance Division (ISCD) updated a frequently asked question (FAQ) response in the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. FAQ #1275 was changed; it was originally published in 2015 and most recently revised in 2017. FAQ #1275 asks:

What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

Two different changes were made. There was an inconsequential name change substituting either ‘Cybersecurity and Infrastructure Security Agency’, ‘CISA’, or ‘Agency’ where the previous version used ‘DHS’. The second change is slightly more substantive.

In the Option 2 explanation the last two sentences were removed:

The buyer should also provide the new facility name, owner, operator, and parent company, as applicable. Facilities may edit this information themselves; however, the Department still requests a letter from the buyer and from the seller if possible.

 Then, the following language substituted:

To expedite the transfer, the buyer should provide in its letter, the new facility name, owner, operator, and parent company, as applicable. The buyer should also include the New Authorizer's name, email address, and phone number.

This is not a real policy change; it just provides some additional clarity.

ISCD Updates Another CFATS FAQ Response

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the response to a frequently asked question (FAQ) on the CFATS Knowledge Center. The updated response was for FAQ # 1275; What needs to be done when a facility is bought or sold?

There was no substantive change to the requirements associated with the change in ownership. The change simply removed the Chemical-Terrorism Vulnerability Information (CVI) disclosure statement at the end of the response. That statement used to read:

“CVI Disclosure If any letters submitted to DHS for review contain any CVI information, the letter must be properly marked, packaged, and sent in accordance with the CFATS regulations for protection of CVI (see 6 CFR § 27.400). A copy of the CFATS regulation, including the CVI requirements in 6 CFR § 27.400, is available at https://www.dhs.gov/critical-infrastructure-chemical-security.”

It is not clear why the statement was removed. While one would like to assume that anyone associated with the CFATS program would understand the CVI requirements for identifying and sending CVI protected information, the whole purpose of FAQ responses is to communicate information in a new format to ensure that the affected parties understand all of the requirements.

DHS Publishes 3 New CFATS FAQ and Updates 13

Today the folks at the DHS Infrastructure Security Compliance Division (ISCD) published a brief note on their CFATS Knowledge Center that they had added three new frequently asked questions (FAQ). An additional search of the Knowledge Center also showed that ISCD had updated the responses to thirteen previously released FAQ.

The three new FAQ’s are:

FAQ #1777 How do I determine “Need to Know” under Chemical-terrorism Vulnerability Information (CVI)?

FAQ #1778 The Department of Transportation (DOT), pursuant to 49 Code of Federal Regulations (C.F.R.) Part 107, has granted my facility a special permit that exempts sabotage/contamination Chemicals of Interest (COI) shipments from placarding requirements of Subpart F of 49 CFR Part 172. Pursuant to the Chemical Facility Anti-Terrorism Standards (CFATS) 6 C.F.R. Part 27, is my facility still required to report its sabotage/contamination COI holdings?

FAQ #1779 A local governmental entity operates a Public Water System (PWS) consisting of two separate facilities. Facility “A” receives a Chemical of Interest (COI) above the applicable Screening Threshold Quantity (STQ), off-loads and uses some of the COI, and then repackages the unused COI and ships it for use at PWS Facility “B.” At both facilities, the COI is used exclusively to treat drinking water to enable consumption by residents of the community serviced by the PWS. Is PWS Facility “A” required to submit a Top-Screen to report the COI to DHS, or is PWS Facility “A” an excluded facility under “The Protecting and Securing Chemical Facilities from Terrorist Attacks of 2014” Public Law 113-254 (6 U.S.C. § 621 et seq.)?

The updated FAQ’s are:

FAQ #81 How can I obtain access to the Chemical Security Assessment Tool (CSAT) User Registration web site? Last updated - August 13, 2008;

FAQ #102 I have reached a page on the Chemical Security Assessment Tool (CSAT) User Registration web site that states, "To continue, please enter the letters that are in the image below:" I cannot read the letters in the image and am unable to continue. Last updated - October 07, 2008;

FAQ #702 I was in the Chemical Security Assessment Tool (CSAT) User Registration System and got distracted. When I returned, it had timed out; can I get back in? Last updated - August 13, 2008;

FAQ #706 I have multiple usernames. Can I get rid of the duplicates? Last updated - August 14, 2009;

FAQ #707 How do I change the name of the Authorizer/Submitter/Preparer? Last updated - August 14, 2009;

FAQ #708 I have multiple usernames. Can I get rid of the duplicates? Last updated - August 08, 2008;

FAQ #711 What are the responsibilities of a Submitter? Last updated - August 14, 2009;

FAQ #715 What guidance is there regarding the selection of an Authorizer? Last updated - August 08, 2008;

FAQ #716 What is the Notification Code and where can I find it? Last updated - August 08, 2008;

FAQ #718 How do I enter additional facilities? Last updated - August 08, 2008;

FAQ #1238 How do I comply with the Chemical Facility Anti-Terrorism Standard (CFSATS) regulation if my facility does not have Internet access? Last updated - August 14, 2008;

FAQ #1392 How do I transfer my account or reassign my user role? Last updated - October 21, 2009;

FAQ #1610 Can a consultant request a user change? Last updated - November 13, 2009

ISCD Updates Three CVI FAQ Responses

This afternoon the folks at the DHS Infrastructure Security Compliance Division (ISCD) updated the responses to three frequently asked questions (FAQ) on the CFATS Knowledge Center. There is no notice for these changes in the ‘Latest News’ section of the page, probably because there is no really new information involved in the updates. Links to two Chemical-terrorism Vulnerability Information (CVI) web sites have been updated though the old links still work (right now anyway).

There is also a dead link to the EPA RMP*Comp tool site on the CFATS Knowledge Center. And it appears that there may have been changes to that tool.

Revised FAQs

The three revised FAQs are:

FAQ #321 Where can I locate a copy of the CVI manual?

New Answer - The CVI manual (http://www.dhs.gov/publication/safeguarding-information-cvi-manual) regarding protection of information is available on the DHS website.

Previous Answer - The CVI manual (http://www.dhs.gov/xlibrary/assets/chemsec_cvi_proceduresmanual.pdf) (PDF, 59 pages -228 KB) regarding protection of information is available on the Chemical-terrorism Vulnerability Information website.

FAQ #516 Where can I take CVI training? 

New Answer - Go to the Chemical-terrorism Vulnerability Information (CVI) Authorized User Training website at csat.dhs.gov/cvi_training. [Actually goes to: https://csat.dhs.gov/dana/home/index.cgi]

Previous Answer - Go to the DHS Critical Infrastructure: Chemical Security website (http://www.dhs.gov/chemicalsecurity) and click on the link "Complete Chemical-terrorism Vulnerability Information (CVI) Training."

FAQ #1551 Can individuals who are not US Citizens be CVI Authorized Users?

New Answer - Yes, non-U.S. citizens can be CVI Authorized Users as long as they can complete CVI Authorized User Training. To access CVI Authorized User Training, go to csat.dhs.gov/cvi_training. [Actually goes to: https://csat.dhs.gov/dana/home/index.cgi]

Previous Answer – Yes.

RMP*Comp Problems

The link to the EPA’s RMP*Comp has been changed by the EPA yet again and the link provided on the Knowledge Center does not lead to that changed site. This is the second time (see post here) that there has been a change to the EPA’s web site that was not ‘coordinated’ with the folks at ISCD. The EPA does not date their web page changes so there is no telling when it was changed. The last time that I accessed the site via the link on the CFATS Knowledge Center was for a post back in August.

Actually, I think that the EPA may have changed the RMP*Comp calculations themselves. In my August post I compared the RMP*Comp results to the new Pamphlet 74 from the Chlorine Institute. I don’t remember having to enter the information on the dike protecting the leaking tank. In any case a 150 lb spill of chlorine now produces a toxic end-point of 0.4 miles or 2112 feet. The same spill checked in August showed that the toxic end-point was 4224 feet or twice as far. This may only affect chlorine (see my August post).

Facilities with Release – Toxic COI may want re-run their toxic end-point calculations and compare them to their latest Top Screen submission. If there is a significant difference, I would contact the CFATS Help Desk to see if it is worthwhile submitting a new Top Screen.