Review - OCS Improves Personnel Surety Program – 9-16-21

Today the CISA Office of Chemical Security (OCS) published a news item on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center announcing that they had made enhancements to the Personnel Surety Program application within the Chemical Security Assessment Tool (CSAT). They provided a link to a brief description of those enhancements and an updated PSP Instruction Manual.

As with any time that a regulatory organization changes reference documents, covered facilities need to download the new manual, even if they are ‘done’ with their initial data submission under the PSP. Old versions should be maintained to allow facilities to explain or justify what they had done before the newer manual was published.

There does not seem to be anything in this new manual that is going to require a facility to make any changes to their facility site security plan. But, if it looks like changes could be required by the new document, facilities should contact their chemical security inspector for clarification. Questions could also be submitted to the CFATS Help Desk (1-866-323-2957), but the CSI would probably be able to provide a quicker answer.

For more details on the new information, including a look at some of the changes made in the PSP manual, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ocs-improves-personnel-surety-program - subscription required.

CFATS 60-day or 30-day ICR Notice – 6-23-21

Today CISA’s Office for Chemical Security published notices on both the Chemical Facility Anti-Terrorism Standards (CFATS) landing page and the CFATS Knowledge Center about the two information collection request (ICR) revision notices that were published in today’s Federal Register. I wrote about (subscription required) these two ICR notices earlier today. Looking at the web site notices, I realized that in my reporting, I had compounded the mistake made by the folks that publish the Federal Register (or maybe the CISA folks who submitted the ICR notice, do not know for sure); the notice for ICR 1670-0014, was not a 60-day ICR notice, it was actually a 30-day ICR notice.

Actually, the notice has it listed both ways. Under the ‘Action’ heading near the top of the notice, it clearly calls it a ’30-Day notice’. And down in the ‘Summary’ it provides the date of, and a link to, the actual 60-day notice published back in March. But it does provide a comment due date of August 23, 2021; 60-days from today. To further confuse matters it calls for sending comments to the docket on the Federal eRulemaking Portal; 30-day ICR notice comments are normally sent directly to OMB’s dhsdeskofficer@omb.eop.gov.

Now I should have known better, because I did a blog post on the actual 60-day ICR revision notice back in March.

In the end, this probably is not a big deal. There were no comments submitted on the 60-day ICR revision notice, and I do not expect there to be any on this notice. There will probably be a correction published in the Federal register changing the comment due date to a date 30-days from that notice.

New CFATS Cyber Alert – 5-13-21

Today the CISA Office for Chemical Security published a notice on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center page regarding a CISA alert for the DarkSide ransomware that recently shut down the Colonial Pipeline operation in Georgia. Today’s notice reports that CISA urges “critical infrastructure asset owners and operators to adopt a heightened state of awareness and implement the recommendations listed in this advisory to help protect them against malicious activity.”

The CISA alert provides a brief overview about what is known about the Colonial Pipeline attack, but it does not include any specific indicators of compromise. It provides some generic actions that an organization can take to reduce the chances of a successful ransomware attack. It has a separate section dealing with control system mitigation and response measures that can reduce the impact of a ransomware attack on industrial control systems. Finally, the document provides a large number of links to documents and resources for obtaining more detailed information.

There are no mentions of any specific CFATS program measures that covered facilities would have to implement.

ISCD Updates 2 FAQ Responses – 9-18-20

 Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two Frequently Asked Questions (FAQs) on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The changes were non-substantive, editorial changes.

The following FAQ responses were revised today:

FAQ #1554 Does the Cybersecurity and Infrastructure Security Agency (CISA) have enforcement authority to fine non-compliant facilities, to include shutting down a facility?

FAQ #1557 What should a facility do if it believes the risk-based tier determination that the Cybersecurity and Infrastructure Security Agency (CISA) has assigned it no longer reflects the actual security risk posed to the facility? What should a facility do if it believes the risk-based tier determination that the Cybersecurity and Infrastructure Security Agency (CISA) has assigned it no longer reflects the actual security risk posed to the facility?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1554 Changes ‘DHS’ to ‘CISA’, and substitutes document links for URLs

#1557 Changes ‘DHS’ to ‘CISA, revises ISCD mailing address, and substitutes document links for URLs

Since this address change is being made in a number of FAQ responses, I am providing the new ISCD snail mail address:

Department of Homeland Security
Cybersecurity and Infrastructure Security Agency
Infrastructure Security Division
Chemical Security
245 Murray Lane, SW Mail Stop 0610
Arlington, VA 20528

ISCD Publishes 2 New Fact Sheets – 9-15-20

Today the CISA Infrastructure Security Compliance Division (ISCD) published two the Fact Sheets on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. They also revised a Frequently Asked Question (FAQ) and four responses to FAQs.

New Fact Sheets

ISCD published to new Fact Sheets as part of their outreach program. The two

• Protect Chemicals at Warehouse, Storage, and Distribution Facilities From Use in a Terrorist Attack

• CFATS: Top-Screens for Dynamic Business Operations

The warehouse fact sheet is part of the ISCD’s industry outreach program; providing information about the CFATS program and how warehousing facilities are affected by the program. This is very similar in concept and information to previously published industry outreach fact sheets. One small nit to pick with the information provided; the list of ‘common chemicals of interest (COI) includes ‘anhydrous ammonia’; probably more commonly found in warehouse operations would be ‘ammonia (concentration 20% or greater)’.

The dynamic business operations fact sheet is another look at a topic that was discussed here last week. The information provided in this new fact sheet is very similar to the information provided in the relatively new  CSAT Top Screen Submissions Tips page.

Revised FAQ – Ammonium Nitrate

While ISCD has been revising a number of FAQs over the last couple of months to make them more useful, every once-in-a-while they actually change one of the questions being asked, which generally requires a significant rewrite of the response. Such was the case today when FAQ #1228 was changed.

• Old question - How is the Screening Threshold Quantity (STQ) calculated for Ammonium Nitrate (AN)?

• New question - How is the screening threshold quantity (STQ) calculated for ammonium nitrate (AN) [with more than 0.2 percent combustible substance, including any organic substance calculated as carbon, to the exclusion of any other added substance]?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The difference is important because there are two different listings for ‘ammonium nitrate’ in the list of DHS Chemicals of Interest (COI); ammonium nitrate, the explosive (where the ‘more than 0.2%... applies) and ammonium nitrate, the potential explosive precursor. The original FAQ did not really distinguish between the two and this made the Response a tad bit confusing. Instead of just taking the easy way out and just revising the response to address the precursor form of the AN, ISCD revised the question, expanded the answer and, in my opinion, just made the matters more confusing, but then again AN is confusing.

AN, the fertilizer is the ‘non-explosive’ form of the chemical. I know, Beirut and West, TX were big (big is a massive understatement in the case of Beirut) explosions of AN. Perhaps ISCD should skip the two listings (would take a rule change) for AN and treat both forms of the material as an explosive for security purposes. It would still have the release-explosive and theft/diversion security classifications and STQ’s, but it would clear up a lot of the confusion. And let’s face it; a smart terrorist could craft an attack on an ammonium nitrate fertilizer storage that would result in a massive explosion.

Revised FAQ Responses

ISCD revised the responses for the following FAQ’s:

FAQ #1272 Who is responsible for submitting a Top-Screen in situations where chemicals of interest are located on property that is leased by a tenant from a landlord?

FAQ #1405 How will I know if the agricultural extension has been lifted and what to do next?

FAQ #1456 Should release chemicals of interest (COI) presently in process or chemicals that are by-products be considered when calculating COI quantities toward the screening threshold quantity (STQ)?

FAQ #1541 How does a facility count the amount of a release-flammable mixture that is a fuel with a National Fire Protection Association (NFPA) rating of 1, 2, 3, or 4 if it is stored in an aboveground tank farm (including farms that are part of pipeline systems)?

For the most part these changes were non-substantive changes made for clarification purposes; no changes in policy or procedure were included. The changes were:

#1272 Added a reference link and additional explanatory language (2^nd paragraph),

#1405 Changed URL to document link,

#1456 Removed reference to ‘total onsite quantity (TOQ)’, and

#1541 Added comments about the gasoline Top Screen extension (2^nd paragraph).

ISCD Updates 2 FAQS – 9-4-20

On Friday CISA’s Infrastructure Security Compliance Division (ISCD) corrected the responses to two frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The changes were non-substantive editorial changes.

The following FAQ responses were revised Friday:

FAQ #1666 Does a covered chemical facility have an obligation to notify the Cybersecurity and Infrastructure Security Agency (CISA) if the facility is closing?

FAQ #1724 How do National Terrorism Advisory System (NTAS) Alerts and Bulletins affect a CFATS facility’s RBPS 13 compliance responsibilities?

NOTE: The links provided for all FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced FAQs:

#1666 Correct minor typo (caps), and

#1724 Correct minor typo (caps)

ISCD Publishes 1 New FAQ and Updates 6 FAQ Responses – 9-2-20

Today CISA’s Infrastructure Security Compliance Division (ISCD) published one new frequently asked question (FAQ) and updated responses to six existing FAQ’s on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The updates are generally not substantive changes in policy or guidance, but rather issued to increase their ease of use.

New FAQ

The newly published FAQ is:

FAQ #1666 Does a covered chemical facility have an obligation to notify the Cybersecurity and Infrastructure Security Agency (CISA) if the facility is closing?

NOTE: The links provided for all FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The short answer is found in the first paragraph of the response:

“A covered chemical facility that has closed must report the closure to CISA so that the facility record may be archived. Notification is accomplished by submitting a revised Top-Screen and sending a signed letter to CISA notifying CISA of the facility’s closure.”

This ‘must report’ answer is based upon the requirement in 6 CFR 27.210(d) to report ‘material modifications’ to a facility’s operations or site within 60 days.

Not mentioned in the FAQ response is the necessity of informing ISCD (if you do not do it in your letter submission, they will certainly ask) about the disposition of the remaining DHS chemicals of interest at the site. It is unlikely that ISCD will relieve a facility owner of the responsibility of maintaining the site security plan operations while COI remains on site.

Updated FAQ

The following FAQ responses were revised today:

FAQ #1724 How do National Terrorism Advisory System (NTAS) Alerts and Bulletins affect a CFATS Facility’s RBPS 13 compliance responsibilities?

FAQ #1738 What is the difference between the Expedited Approval Program (EAP) and the Chemical Facility Anti-Terrorism Standards (CFATS) program?

FAQ #1739 What is the difference between the Risk Based Performance Standards (RBPS) Guidance document and the DHS Guidance for the Expedited Approval Program (EAP)?

FAQ #1758 I am the owner/operator of a farm that possesses anhydrous ammonia (AA) at or above the Chemical Facility Anti-Terrorism Standards (CFATS) screening threshold quantity (STQ) for commercial sale and distribution to facilities that then use my business’s product for treatment of crops. Is my facility eligible to claim the CFATS agricultural production facility Top-Screen extension?

FAQ #1759 I am the owner/operator of a farm that possesses anhydrous ammonia (AA) at or above the Chemical Facility Anti-Terrorism Standards (CFATS) screening threshold quantity (STQ) of 10,000 lb for use as a refrigerant in a cold storage facility for fresh produce (fruits, vegetables, etc.). Is my facility eligible to claim the CFATS agricultural production facility Top-Screen extension?

FAQ #1769 My facility must perform background checks in accordance with the Risk-Based Performance Standard (RBPS) 12 “Personnel Surety” on affected individuals. Who is an affected individual?

The following changes were made in the referenced FAQs:

• #1724 – Corrected grammatical error is question,

• #1738 – Added reference to “Chemical Facility Anti-Terrorism Standards Act of 2014 (CFATS Act)”,

• #1739 – Added links to referenced documents,

• #1758 – Added linked reference to Federal Register Notice,

• #1759 – Added linked reference to Federal Register Notice, and

• #1769 – Changed URL to link to CFR reference.

ISCD Updates 3 FAQ Responses – 9-1-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to three frequently asked questions (FAQ’s) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center.

With the exception of the response to FAQ #1620, the changes were minor, non-substantive editorial changes dealing with the provision of links to official documents.

The three updated FAQs were:

FAQ #1253 How can I request a Chemical Facility Anti-Terrorism Standards (CFATS) presentation?

FAQ #1490 Must all employees involved in filling out the Top-Screen, Security Vulnerability Assessment (SVA), or Site Security Plan (SSP) at my facility be Chemical-terrorism Vulnerability Information (CVI) Authorized Users?

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

NOTE: The links provided above were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced FAQs:

• #1253 – Revised list of questions to be answered in request email,

• #1490 – Changed listing URL’s to link to document name,

• #1620 – Changed snail mail address for reporting CFATS violations.

ISCD Updates 3 FAQ Responses – 8-26-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to three frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The changes were minor, non-substantive editorial changes dealing with the provision of links to official documents.

The three updated FAQs were:

FAQ # 1398 Are chemicals of interest (COI) in hazardous waste to be counted towards a screening threshold quantity (STQ)?

FAQ #1481 What factors does a facility need to account for when calculating whether a facility possesses the screening threshold quantity (STQ) for a theft/diversion chemical of interest (COI)

FAQ #1673 Where can I read about the current indefinite extension to the Top-Screen deadline for agricultural production facilities?

NOTE: The links provided above were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced FAQs:

• #1398 Added link for ‘40 CFR 261.33’

• #1481 Added link for ‘49 CFR § 171.8’

• #1673 Added link for ‘(73 FR 1640)’

ISCD Updates 4 FAQ Responses – 8-24-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to four frequently asked questions (FAQ) on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The changes were all relatively minor editorial changes with no change in policy or procedures.

The four revised FAQs are:

FAQ #1759 I am the owner/operator of a facility that possesses anhydrous ammonia (AA), ammonium nitrate, potassium nitrate, sodium nitrate or any other chemical of interest (COI) at or above the Chemical Facility Anti-Terrorism Standards (CFATS) screening threshold quantity (STQ) for commercial chemical application services. Is my facility eligible to claim the CFATS agricultural production facility Top-Screen extension?

FAQ #1760 I am the owner/operator of a business that possesses anhydrous ammonia (AA) at or above the Chemical Facility Anti-Terrorism Standards (CFATS) screening threshold quantity (STQ) for BOTH the treatment of crops and for use as a refrigerant in a cold storage facility. Is my facility eligible to claim the CFATS agricultural production facility Top-Screen extension?

FAQ #1771 What documentation will I be asked to provide or make available for the Chemical Security Inspector during an Expedited Approval Program (EAP) Compliance Inspection (CI)?

FAQ #1777 How do I determine “need to know” under Chemical-terrorism Vulnerability Information (CVI)?

NOTE: The links provided above were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced FAQs:

• #1759 adds reference and link to Federal Register notice on agricultural production facility Top-Screen extension and removes ‘APF’ abbreviation.

• #1760 removes ‘APF’ abbreviation

• #1771 replaces ‘inspector’ in FAQ with ‘Chemical Security Inspector’

• #1777 Adds link to ‘Safeguarding Information Designated as Chemical-terrorism Vulnerability Information (CVI) Revised Procedure Manual’ and removes standalone URL.

ISCD Updates 1 FAQ Response – 8-17-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated their response to FAQ # 81, How do I register for the Chemical Security Assessment Tool (CSAT)?, on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. Unlike the earlier series of FAQ response updates earlier this summer (see here for example), this update is a substantial rewrite of the response.

The most important change is that ISCD is now requiring TLS 1.2 (instead of the earlier TLS 1.0) be enabled in the browser to access the CSAT User Registration website. I would suspect that TLS 1.2 will be required for access to the whole CSAT site. I have an email in to ISCD requesting clarification.

The other changes to the FAQ #81 response include revisions to the instructions for setting TLS 1.2 for Microsoft® Internet Explorer® and Mozilla® FireFox®. They also added instructions for setting TLS 1.2 in Microsoft Edge® and Google® Chrome®.

ISCD Updates 2 FAQ Responses – 7-28-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked question (FAQ) responses on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. Both of these responses have recently been updated as part of the on-going editorial fine tuning of FAQ responses that has been taking part over the last couple of weeks.

The two FAQ responses that were updated yesterday were for the following FAQ:

FAQ #1778 The Department of Transportation (DOT), pursuant to 49 CFR Part 107 has granted my facility a special permit that exempts sabotage/contamination chemicals of interest (COI) shipments from placarding requirements of Subpart F of 49 CFR Part 172. Pursuant to the Chemical Facility Anti-Terrorism Standards (CFATS) 6 CFR Part 27, is my facility still required to report its sabotage/contamination COI holdings?

FAQ #1779 A local governmental entity operates a Public Water System (PWS) consisting of two separate facilities. Facility "A" receives a chemical of interest (COI) above the applicable screening threshold quantity (STQ), off-loads and uses some of the COI, and then repackages the unused COI and ships it for use at PWS Facility "B". At both facilities, the COI is used exclusively to treat drinking water to enable consumption by residents of the community serviced by the PWS. Is PWS Facility "A" required to submit a Top-Screen to report the COI to the Cybersecurity and Infrastructure Security Agency (CISA), or is PWS Facility "A" an excluded facility under 6 U.S.C. § 621(4)(B)?

FAQ #1778 was last revised on July 21^st, 2020. The most recent change was to remove links to regulations in the question.

FAQ # 1779 was last revised on July 27^th, 2020. The most recent change was to remove links to regulations in the question.

ISCD Updates 7 FAQ Updates – 7-27-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1633 What is a proposed measure and why would a facility include one in their Site Security Plan (SSP)?

FAQ #1660 Can a facility’s tiering level ever change? How and why?

FAQ #1772 Who will conduct the Chemical Facility Anti-Terrorism Standards (CFATS) Compliance Inspections for facilities in the Expedited Approval Program (EAP)?

FAQ #1779 A local governmental entity operates a Public Water System (PWS) consisting of two separate facilities. Facility "A" receives a chemical of interest (COI) above the applicable screening threshold quantity (STQ), off-loads and uses some of the COI, and then repackages the unused COI and ships it for use at PWS Facility "B". At both facilities, the COI is used exclusively to treat drinking water to enable consumption by residents of the community serviced by the PWS. Is PWS Facility "A" required to submit a Top-Screen to report the COI to the Cybersecurity and Infrastructure Security Agency (CISA), or is PWS Facility "A" an excluded facility under 6 U.S.C. § 621(4)(B)?

FAQ #1788 How may a facility request an extension for a survey that is coming due?

FAQ #1742 was last updated on July 20^th, 2020. Today’s update changed the labeling and indentation of the three subparagraphs.

FAQ #1749 was last updated on July 21^st, 2020. Today’s update changed the indentation of the 8 subparagraphs.

FAQ #1633 was last updated on July 20^th, 2020. Today’s update changed the labeling of the three subparagraphs.

FAQ #1660 was last updated on July 16^th, 2020. Today’s update changed the labeling of the three subparagraphs.

FAQ #1772 has not apparently been changed since it was last updated on July 20^th, 2020.

FAQ #1779 was last updated on July 22^nd, 2020. Today’s update changed the format of the quotation marks used in the question (but not in the response).

FAQ #1788 was last updated on July 16^th, 2020. Today’s update removed an extraneous ‘)’ in the Question.

ISCD Updates 2 FAQ Responses – 7-22-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1779 A local governmental entity operates a Public Water System (PWS) consisting of two separate facilities. Facility “A” receives a chemical of interest (COI) above the applicable screening threshold quantity (STQ), off-loads and uses some of the COI, and then repackages the unused COI and ships it for use at PWS Facility “B.” At both facilities, the COI is used exclusively to treat drinking water to enable consumption by residents of the community serviced by the PWS. Is PWS Facility “A” required to submit a Top-Screen to report the COI to the Cybersecurity and Infrastructure Security Agency (CISA), or is PWS Facility “A” an excluded facility under 6 U.S.C. § 621(4)(B)?

FAQ #1782 Are there any facilities statutorily excluded from CFATS?

ISCD Updates 8 FAQ Responses – 7-21-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to eight frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

FAQ #1762 Can our company’s human resources department request a change in contact information to receive the Chemical-terrorism Vulnerability Information (CVI) certificates?

FAQ #1763 Why are my Chemical-terrorism Vulnerability Information (CVI) documents and information located in my Chemical Security Assessment Tool (CSAT) account inaccessible?

FAQ #1764 How long will a facility have to implement the approved security measures to check for terrorist ties under Risk-Based Performance Standard (RBPS) 12(iv) in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1773 Solid ammonium nitrate in the chemicals of interest (COI) column of Appendix A is listed as “Ammonium nitrate, solid [nitrogen concentration of 23% nitrogen or greater]” and has a minimum concentration of 33% under the Theft/Diversion security issue. In calculating whether a facility has a screening threshold quantity (STQ) of solid ammonium nitrate in a mixture, does the facility look at the percentage of the nitrogen in the mixture or the percentage of the ammonium nitrate in the mixture?

FAQ #1778 The Department of Transportation (DOT), pursuant to 49 CFR Part 107 has granted my facility a special permit that exempts sabotage/contamination chemicals of interest (COI) shipments from placarding requirements of Subpart F of 49 CFR Part 172. Pursuant to the Chemical Facility Anti-Terrorism Standards (CFATS) 6 CFR Part27, is my facility still required to report its sabotage/contamination COI holdings?

FAQ #1789 How does the Cybersecurity and Infrastructure Security Agency (CISA) define truck terminals as referred to in the Chemical Facility Anti-Terrorism Standards (CFATS) Final Rule?

FAQ #1749 was also updated yesterday. Today’s version changed the subparagraph numbering system.

The printing of FAQ #1778 question in the “Search Results” section of the CFATS Knowledge Center when searching for this FAQ has some formatting problems (printing the URL instead of the web page name). The version printed here is the correct version.

ISCD Updates 9 FAQ Responses – 7-20-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to six frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. There were also two news items on today’s CFATS Knowledge page; first, a note about the 30-day ICR renewal notice published in today’s Federal Register for the Chemical-Terrorism Vulnerability Information (CVI) program. The second note is an update of information about the COVID-19 modified compliance inspection program.

FAQ Updates

The FAQ updates are part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1750 What happens after I submit my Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1751 If my facility has been issued a “letter of acceptance” through the Expedited Approval Program (EAP), but then the Cyber Infrastructure Security Agency (CISA) discovers that the measures in the Site Security Plan (SSP) insufficiently meet the risk-based performance standards (RBPS) during a Compliance Inspection, what happens?

FAQ #1752 Who can certify a facility’s Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1766 Does the Cybersecurity and Infrastructure Security Agency (CISA) allow facilities to contract out the submission of information under Option 1 or Option 2 for the Personnel Surety Program in Risk-Based Performance Standards (RBPS) 12(iv) to third parties?

FAQ #1767 Will the facility be notified if the Agency learns that an affected individual has terrorist ties?

FAQ #1768 When will the Cybersecurity and Infrastructure Security Agency (CISA) grant access to the Chemical Security Assessment Tool (CSAT) Personnel Surety Program application if a facility chooses to meet Risk-Based Performance Standard (RBPS) 12(iv) by selecting Option 1 or Option 2 in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1772 Who will conduct the Chemical Facility Anti-Terrorism Standards (CFATS) Compliance Inspections for facilities in the Expedited Approval Program (EAP)?

Interestingly, FAQ #1742 was previously updated last week. Today’s update simply indents the three subparagraphs in the response.

CVI ICR

The first news item on today’s CFATS Knowledge Center points to today’s CISA information collection request (ICR) renewal notice in the Federal Register for the CVI program. This is the follow-up to the 60-day ICR notice published in March. There is no burden change reported in the renewal notice. CISA is soliciting comments on the ICR notice. Comments may be submitted via email to dhsdeskofficer@omb.eop.gov. All submissions must include the words “Department of Homeland Security” and the OMB Control Number 1670-0015.

Covid-19 Modified Inspections

The second news item for today notes that CISA has completed the pilot of COVID-19 modified compliance inspections that had first been announced on June 11^th, and I more completely detailed two days later. Today’s notice says: “Based on the pilot, CISA is now conducting modified compliance operations and high-priority compliance assistance.” Facilities will be notified of any compliance inspection scheduled by their Chemical Security Inspector or the Infrastructure Security Compliance Division (ISCD) headquarters.

There has been no change made to the CFATS Compliance Inspection Fact Sheet since November 2019.

ISCD Updates 6 FAQ Responses – 7-16-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to six frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

• FAQ #1660 Can a facility’s tiering level ever change? How and why?

• FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

• FAQ #1743 What happens if the Expedited Approval Program (EAP) Site Security Plan (SSP) for my facility is deemed facially deficient? How will the Cybersecurity and Infrastructure Security Agency (CISA) notify the facility?

• FAQ #1745 If a facility has submitted a Site Security Plan (SSP) or an Alternative Security Program (ASP) in lieu of an SSP, but does not yet have approval, can it still be part of the Expedited Approval Program (EAP)?

• FAQ #1746 What is the deadline for Tier 3 and 4 facilities to submit their Expedited Approval Program (EAP) Site Security Plans (SSP)?

• FAQ #1788 How may a facility request an extension for a survey that is coming due?

ISCD Updates 6 FAQ Responses – 7-13-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to five frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The five FAQ responses updated today were:

FAQ #1657 Does the Cybersecurity and Infrastructure Security Agency (CISA) have a list of specific security measures that are required at Chemical Facility Anti-Terrorism Standards (CFATS)-covered high-risk facilities?

FAQ #1658 What is an Alternative Security Program (ASP)?

FAQ #1659 What are “planned” measures and why would a facility include them in the Site Security Plan (SSP)?

FAQ #1660 Can a facility’s tiering level ever change? How and why?

FAQ #1741 I have some security measures in my Expedited Approval Program (EAP) Site Security Plan (SSP) that do not meet the specific requirements in the measures outlined in the DHS Guidance for the Expedited Approval Program. Do I have material deviations? What do I do?

FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

ISCD Updates 5 FAQs – 7-6-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to five frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The five FAQ responses updated today were:

FAQ #1540 How does a facility count the amount of release-flammable chemical of interest (COI) within a mixture that is not a fuel with a National Fire Protection Association (NFPA) rating of 1, 2, or 3?

FAQ #1642 I am already a Chemical-terrorism Vulnerability Information (CVI) Authorized User. Do I need to take the CVI training again to maintain my CVI Authorized User status?

FAQ #1644 What should be done with my Chemical-terrorism Vulnerability Information (CVI) Authorization User number?

FAQ #1650 What happens after a facility submits its Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

FAQ #1653 If a facility is in a location where another entity provides certain security measures (e.g., industrial park, co-located facility; office park, etc.), can the facility include these security measures as part of its Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

Actually, FAQ #1540 does not appear to have had any changes made since the last time it was updated, last week.

ISCD Publishes 3 FAQ Response Updates – 7-2-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to three frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

 

The three FAQ responses updated today were:

 

FAQ #1633 What is a proposed measure and why would a facility include one in their Site Security Plan (SSP)?

FAQ #1634 Should my facility include information in the Security Vulnerability Assessment (SVA)/Site Security Plan (SSP) about chemicals of interest (COI) and/or security/vulnerability issues that are not listed in its Tiering Letter, but that the facility believes to be of concern? What are the Agency’s expectations about these other security/vulnerability issues and COI?

FAQ #1635 The Risk-based Performance Standards (RBPS) for "Shipping, Receipt and Storage" (RBPS 5) and for "Theft and Diversion" (RBPS 6) in the Chemical Facility Anti-Terrorism Standards (CFATS) regulation (6 CFR §§ 27.230(a)(5) and (a)(6)) refer to "hazardous materials" and to "dangerous chemicals," respectively. Do those terms include any chemicals other than chemicals of interest (COI) listed in Appendix A of the CFATS regulation?