ISCD Published Updated CFATS Statistics – 8-20-20

Yesterday the CISA Infrastructure Compliance Division (ISCD) updated their Monthly Statistics page for the Chemical Facility Anti-Terrorism Standards (CFATS) program. The update was published unusually late in the month. It did add a new COVID-19 inspection term – Compliance Audit.

ISCD Activities

The table below shows the activities conducted by the CFATS chemical security inspectors during the month of July.

Inspection Data	Apr-20	May-20	Jun-20	Jul-20
Authorization Inspections	0	0	1	10
Compliance Inspections	2	4	35	76
Compliance Assistance	0	0	198	162
Compliance Audit			27*	8

The 27 Compliance Audits listed for June

were not included in the June report.

The bottom line in the table reflects the newly reported Compliance Audits. This new term is being used to describe an abbreviated, virtual inspection that was instituted in June in response to COVID-19 visitation limitations. The ISCD page defines ‘Compliance Audits’ as:

“Compliance Audits: This metric shows the number of Compliance Audits conducted. During a Compliance Audit, CISA inspectors remotely review and then lead a discussion with facility personnel on records and documentation related to the facility’s COI and the security measures described in the facility’s security plan.”

The page also notes that:

“Based on the pilot [conducted in June], CISA is now conducting modified compliance operations, which include Compliance Audits, modified Authorization and Compliance Inspections, and high-priority compliance assistance.”

For details on what the ‘modified’ inspections entail, contact your CSI.

CFATS Status

The table below shows the status of the facilities currently (presumably as of August 1^st) of the facilities in the CFATS program.

Facility Status	Apr-20	May-20	Jun-20	Jul-20
Tiered	142	158	150	139
Authorized	160	138	130	141
Approved	3033	3039	3061	3057
Total	3335	3335	3341	3337

ISCD Updates Monthly Update Page – 05-02-18

Yesterday as part of the update of their Chemical Facility Anti-Terrorism Standards (CFATS) web site, the DHS Infrastructure Security Compliance Division (ISCD) updated the CFATS Monthly Update page. This page provides the most recent statistics on the activities that ISCD and covered chemical facilities have undertaken to implement the CFATS program. Unlike most of the other pages on the CFATS web site, the only changes made to this page were the current statistics.

ISCD Activities

The table below shows the recent statistics for significant activities undertaken by ISCD in support of the implementation of the CFATS program. Long-time readers will note that I have added a new row reflecting the number of Top Screens that have been processed by ISCD since the inception of the program. I have been watching this number for a couple of months now and ISCD has been updating it regularly since January.

CFATS Activities	Feb-18	Mar-18	Apr-18
Top Screens Processed to Date	87,840	88,258	88,600
Authorization Inspections to Date	3,352	3,496	3,600
Authorization Inspections Month	133	149	110
Compliances Inspections to Date	3,249	3,349	3,413
Compliances Inspections Month	79	90	76
Compliance Assistance Visits to Date	4,007	4,096	4,238
Compliance Assistance Visits Month	172	86	143

ISCD has been consistently reporting about 400 new Top Screens each month. These new submissions would be from both currently covered facilities updating their information as changes were made in the chemicals of interest (COI) inventories, and ‘new’ facilities providing ISCD with the information required to determine if they will be come a new covered facility. The word new was included in single quotes because it could include previously covered facilities that had been dropped from the program because of changes to their risk status.

Facility Status

The table below shows the current status of the facilities covered under the CFATS program.

CFATS Facility Status	Feb-18	Mar-18	Apr-18
Tiered	474	387	363
Authorized	665	681	639
Approved	2,345	2,373	2,397
Total	3,485	3,441	3,399

As expected we see a decline in the number of Tiered and Authorized facilities as facilities newly included in the program make their way through the site security plan approval process. I do not expect these two fields will drop to zero anytime soon as new facilities are added to the program on an ongoing basis. This is due to both the continued ISCD outreach efforts and normal regulatory compliance activities by facilities in the chemical space.

I think that we now have enough data points in the new reporting format to start to graph the changes in facility status over time. The graph below shows change in status.

ISCD Updates CFATS Monthly Update Page – 04-03-18

Yesterday the DHS Infrastructure Security Compliance Division (ISCD) updated the Chemical Facility Anti-Terrorism Standards (CFATS) Monthly Update web page. This page provides a summary of ISCD activities and CFATS facility status over the previous month. The data presented continues to show progress on the implementation of the CFATS program.

The table below shows the reported ISCD activities over the last two months. The ‘to Date’ lines show the numbers for the activity since the program was started in 2007. The ‘Month’ lines show numbers for the same activity in the indicated month.

CFATS Activities	Feb-18	Mar-18
Authorization Inspections to Date	3352	3496
Authorization Inspections Month	133	149
Compliances Inspections to Date	3249	3349
Compliances Inspections Month	79	90
Compliance Assistance Visits to Date	4007	4096
Compliance Assistance Visits Month	172	86

The numbers continue to reflect the maturation of the CFATS program. As more of the new facilities from the CSAT 2.0 implementation submit their site security plan (SSP) and have it authorized, we will continue to see increases in the monthly rate of authorization inspections and a decline in the compliance assistance inspections. And as more facilities have their SSP approved we will see an increase in the number of compliance inspections.

The table below shows the status of the facilities in the CFATS program over the last two months. Tiered facilities are those that have had their submitted Top Screen reviewed by ISCD and have been notified that they are covered facilities under the CFATS program and have been assigned their risk-based Tier ranking. The Authorized and Approved facilities refer to the status of the facility’s SSP. Approved facilities are in the compliance phase of the program where they will receive periodic compliance inspections by ISCD to ensure that the facility is in compliance with its negotiated SSP standards.

CFATS Facility Status	Feb-18	Mar-18
Tiered	474	387
Authorized	665	681
Approved	2345	2373
Total	3485	3441

The decline in the number of Tiered facilities is to be expected as the facility begin to move through the SSP submission and approval process. We may see minor periodic upticks in that number as ISCD continues its facility outreach program to identify chemical facilities that may be required to submit Top Screens.

I continue to be concerned about the resumption in the decline in the number of covered facilities. On one hand, the facility risk reduction efforts necessary for leaving the CFATS program means that the risks of a successful terrorist attack on that facility are diminished; which is certainly a good thing. The potential downsides are that the facility risk reduction comes at the cost of increasing the risks to another facility (for example having a larger inventory of chemicals of interest at a supplier location instead of at the using facility) and/or by increasing the transportation risk by increasing the number of shipments of COI.

For a variety of reasons ISCD has not provided the regulated community with any kind of information about the ‘successful’ risk reduction efforts at the facilities that have departed the program. I am hoping that this will be one of the issues that Congress will address during its process of re-authorizing the CFATS program; either during hearings where David Wulf is testifying or in the various reports that Congress is sure to request (almost certainly already have requested) from both the DHS Inspector General and the Government Accounting Office.

ISCD Updates Monthly Update Page – 02-02-18

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the data on the Chemical Facility Anti-Terrorism Standards (CFATS) Monthly Update page. The new data for January 2018 shows the continued progress being made implementing the CFATS program.

Facility Status

The table below shows the facility status at the end of the month of January. As I predicted last month, we have now seen our first decline in the number of covered facilities since the implementation of CSAT 2.0 in October of 2016. Remember, facilities have every incentive to take actions to reduce/eliminate their use or inventories of DHS chemicals of interest (COI) so as to avoid being covered by the costly CFATS program.

CFATS Facility Status	Dec-17	Jan-18
Tiered	723	576
Authorized	493	600
Approved	2340	2339
Total	3556	3515

We should continue to see a decline in the number of tiered facilities now that the CSAT 2.0 implementation has essentially been completed. It is unlikely to ever drop to zero as the ISCD outreach plan continues to identify new potential facilities and changes in the chemical industries brings new facilities into the possession of COI. I suspect that in the coming months we will see the increase in the number of Authorized facilities begin to level off and eventually start to drop as more facilities complete the site security plan approval process.

ISCD Activities

The table below shows the activities that the chemical security inspectors have undertaken in support of the CFATS program.

CFATS Activities	Dec-17	Jan-18
Authorization Inspections to Date	3132	3225
Authorization Inspections Month	49	97
Compliances Inspections to Date	3112	3176
Compliances Inspections Month	77	63
Compliance Assistance Visits to Date	3799	3873
Compliance Assistance Visits Month	100	122

Once a facility receives administrative approval of their submitted site security plan (SSP) and receive their ‘Authorization Letter’ they have to pass an Authorization Inspection to receive final approval of their SSP. The Authorization Inspection checks to ensure that the facilities have all of the security measures in place that they have described in their authorized SSP. Compliance Inspections, on the other hand, is a periodic check of the facility’s compliance with the terms of their SSP, including the scheduled implementation of their ‘pending security measures’.

The comparison of the ‘to Date’ data and the January data shows a much closer match that we have been seeing. The four-inspection difference on reported numbers for authorization inspections and one-inspection difference for compliance inspections could certainly fall within the ‘glitch in the system’ that ISCD reports on the page. The not so subtle difference between the delta on ‘to Date’ Compliance Assistance Visits of 74 and the reported 122 conducted during the month of January is less easy to accept. Since this is more of a manpower utilization issue than a actual compliance issue, I’ll leave this to the DHS IG to question if they feel it is appropriate.

I will mention this, however. ISCD provides the following explanation for the Compliance Assistance Inspection:

“This metric shows the number of Compliance Assistance Visits completed. ISCD offers CAVs to CFATS-covered facilities and facilities of interest so that the facilities have an in-depth knowledge of how to meet the requirements of the CFATS regulation. These visits can perform various functions, such as assisting with determining COI reporting requirements, submitting or resubmitting a Top-Screen, developing an SSP or ASP, editing a SSP based on a change in security posture or tiering, or assistance with complying with any other part of the regulation.”

I would like to think that the “complying with any other part of the regulation” would include inspections when a facility reports that they have either reduced their COI inventory below the Screening Quantity Threshold or removed the COI entirely from the facility. All other things being equal, the reduction/removal of the COI would be a prerequisite from removal of a facility from the CFATS program.

ISCD Publishes CFATS Update – November 2017

On Friday the DHS Infrastructure Security Compliance Division (ISCD) published their Chemical Facility Anti-Terrorism Standards (CFATS) Monthly Update for November. The casual CFATS web site observer would be surprised to hear this since this has not been shown on either the Critical Infrastructure: Security Compliance web page or the CFATS Knowledge Center web page.

Published Data

Table 1 below shows the data published indicating the compliance data published for the facilities currently covered under the CFATS program. The numbers show a continued increase in the number of covered facilities and the number of compliance inspections being conducted.

Current Facilities	Oct 2017	Nov 2017	∆
Covered Facilities	3,492	3,517	+25
Authorization Inspections	2,374	2,400	+26
Approved Security Plans	2,270	2,273	+3
Compliance Inspections	2,106	2,122	+16

Table 1: Current CFATS Facilities

Table 2 shows the data showing the data on all facilities since the program was initiated back in 2007. Again, we see increases across the board.

Total Facilities	Oct 2017	Nov 2017	∆
Authorization Inspections	2,975	3,015	+20
Approved Security Plans	2,766	2,779	+13
Compliance Inspections	2,807	2,954	+61

Data Analysis

Figure 1 below is a graph showing the number of authorization inspections conducted since ISCD resumed reporting in May of this year. Both lines show a slight uptick in the number of inspections conducted. This is to be expected as facilities have had a chance to begin submitting SVA/SSPs for the new tiering letters that have begun to be issued under the new risk assessment process was implemented. We can expect to see a sharper increase in coming months.

Figure 1: Authorization Inspections

The compliance inspection information continues to require us to make some assumptions about how ISCD is counting the difference between current and total compliance inspections. Figure 2 shows the data reported since May.

Figure 2: Compliance Inspection Data

The total number of compliance inspections data continues to show a fairly consistent rate of increase (linear regression analysis shows R² of .996) since May. This would be consistent with ISCD’s current emphasis on ensuring that facilities with approved site security plans are in compliance with those plans. As ISCD begins to conduct more authorization inspections on newly submitted SSPs this rate will probably flatten out as the limited manpower available to the Division is re-purposed.

When we compare the current to total compliance inspection data we begin to see some discrepancies; a much steeper increase in the total number of compliance inspections as compared to the relatively flat increase in current inspections. When we look at the number of current compliance inspections compared to the number of currently approved SSPs we have to draw the conclusion that ISCD is reporting only one ‘current’ compliance inspection per facility with an approved SSP.

There are only two ways that ISCD can be reporting a large number of new inspections each month with only a small increase in the number of current SSP’s; either there are a significant number of facilities exiting the CFATS program or there are multiple compliance inspections being conducted on current facilities. The number of currently approved SSPs does show a slight decrease (8) since reporting resumed in May even though the total number of SSPs that have been approved has increased by 60. That would seem to indicate that some facilities have left the program (68?) during the reporting period and that is within the magnitude of what ISCD reported back in April.

The change in the number of compliance inspections tells a completely different story. Since May there has been an increase of 901 total compliance inspections completed and only an increase of 191 current compliance inspections. Since a facility must have an approved SSP prior to having a compliance inspection the 68 disappearing SSPs does not explain the difference of 710 compliance inspections. Combining the two data sets we can see that there have been 642 (710 – 68) compliance inspections that are not accounted for in the total number of current compliance inspections.

The only thing that I can conclude is that ISCD chemical security inspectors have conducted at least 642 compliance inspections since reporting resumed in May where the facility was not in compliance with the currently approved SSP. How many of these are unique facilities vs facilities with multiple non-compliant inspections results cannot be determined from the data presented in these reports.