ISCD Publishes CFATS Update – 9-8-16

Today the DHS Infrastructure Security Compliance Division (ISCD) published their latest update of their progress in implementing the Chemical Facility Anti-Terrorism Standards (CFATS) program. While there is continued progress in authorizing and approving Site Security Plans (SSPs) it was at a much reduced rate this last month. The rate of compliance inspections was also reduced this month.

As is usual, ISCD take no effort to explain their numbers or the changes in rates from previous months. We can probable guess that the reduced rate of authorizations and approvals is more related to the reduced number of facilities that are at that point in their CFATS implementation process. This is also almost certainly being impacted by the current freeze in submitting Top Screens and Security Vulnerability Assessments.

Neither of those explanations would explain the less pronounced decrease in the number of compliance inspections completed in the last month. The change in the inspection rate may be small enough to be just part of the standard variation in the way inspections are being conducted. Or it could be explained by a possible increase in the vacation rate among Chemical Security Inspectors as the time for starting school approached.

Still no word from ISCD about the reasons for the continued decrease in the number of covered chemical facilities. While we would certainly hope that the decrease is due to facilities decreasing the amount of, or eliminating the presence of, DHS chemicals of interest (COI). This is the only explanation that ISCD ever mentions, but there are some number of chemical facilities that are removed from the list of covered facilities because the company has gone out of business (I personally know of at least one). The important question is how many (if any) were driven out of business because (in all or part) of the cost of compliance with the CFATS program?

ISCD also continues to fail to report data on the compliance rate from their compliance inspections. We know that less that the compliance rate was less than 50% for the initial 80 or so inspections. That coupled with the failure of ISCD to discuss the compliance rate in more recent inspections makes one wonder just how successful the CFATS program has been in increasing the security of chemical facilities.

The Real Cause of SSP Approval Delays

Over the last two years we have seen innumerable delays in the implementation of the CFATS programs. As I have mentioned on many occasions, this is a complex program being stood up on the fly and it goes without saying that there have been a number of under-estimations of the problems with that are associated with getting this complex program up and running.

The latest delay that we have heard about was caused by not enough information provided in the SSP submissions. It seems that just answering the questions is not enough. Now DHS wants submitters to check the ‘Other’ box where available and provide additional information via the explanatory text box or submitting separate documents. The questions did always seem to be just a little too simple; a whole bunch of them to be sure; but not very complex.

SSP Evaluation

The original idea was to have the computer answers scored by an evaluation program and then to have the data reviewed by subject matter experts to fine tune the results. According to information that I have just received that doesn’t seem to have worked out too well. There just isn’t enough differentiation available in the responses to the questions. And the added information is not in a machine reviewable format. Thus, DHS is having to rely much more on the subject matter expert review process.

Unfortunately, there is a sad lack of subject matter expertise in ISCD; it is after all a small organization that has been stood up with little thought about backing up the computer scoring system with chemical facility expertise. The way I understand it, there are three chemical engineers and one mechanical engineer with one cyber security guy to take care of the information and control systems evaluations.

Now, I want you to think about the very extensive questionnaire that is an SSP submission. Add to that the supplementary information and additional documents that ISCD is now requesting from the Tier 1 facilities (and will be requesting from all the remainder of the facilities). Think about how long it will take those five individuals to review almost 5,000 SSP submissions. A recent meeting of chemical inspectors from the Southeast Region was told that those five people would take 30 years to review the SSPs. I’ve heard a more reasonable 15 years from another source, though not too many people would think that 15 years would be a reasonable time to get the initial SSP submissions reviewed.

Contractor Solution

Now the folks in charge if NPPD and ISCD are not idiots; they know the current situation is untenable. This is why last summer some time they put out a request for bids for contractors to take over the SME review process. This is why early last fall there were number of the standard belt-way bandit organizations advertising for people with chemical facility security expertise. Review the job descriptions in those ads and it is clear what they would be working on. The contract was just about to be issued last December when it was withdrawn at the last minute.

None of my sources has been able to tell me why, but I can guess. Anyone that has been paying attention has heard Congress jumping all over DHS about the large number of contractors that the Department has been using for any number of jobs that they don’t have the head count or expertise to perform. Whether or not all of these contractors are necessary is a discussion for a venue other than this. What is certain, however, is that ISCD cannot do these SSP reviews without outside assistance.

Congressional Oversight

Once again this is a problem of underestimating the scope of the CFATS process and politics interfering with the career folks inside DHS. This may be why Under Secretary Rand Beers did not have a career professional sitting at the table next to him at the recent House Subcommittee hearing. He’s far enough removed from the problems at ISCD to not be questioned too closely about the reasons for the delays. His answers were correct as far as they went; the questions were just not deep enough.

Perhaps when the Senate Homeland Security Committee invites a DHS representative to update them on the status of CFATS they’ll invite someone with a little bit more knowledge of the details of the program. The new director (or is it acting director, it is so hard keeping track) of ISCD, Rick Driggers, was there in Orlando, FL last week when the Chemical Facility Security Inspectors were briefed on the current state of the problem; he should be able to explain to Sen. Lieberman and Sen. Collins what is really delaying the CFATS implementation process.

Or perhaps Chairman King wants to hold a full committee hearing to ask some real oversight questions instead of having people feed straight lines to opponents of IST.