DHS Completely Revamps Chemical Security Website – 5-2-18

Today the DHS Infrastructure Security Compliance Division (ICSD, actually they get the blame, but were probably not responsible for the change) completely revamped their Chemical Facility Anti-Terrorism Standards (CFATS) web site. The link to the previous CFATS landing page now takes you to a generic DHS chemical security web page. To get to the CFATS program information previously provided at that site you have to start with the new CFATS web page.

CFATS Landing Page

The landing page is quite a bit simpler than the previous page with not nearly as many informative links. It contains two minor sections near the top of the page. The first in the upper left corner is a linked listing of other major pages on the site. This section reappears on each of the linked pages. Those pages include:

• CFATS Monthly Update (new info to be discussed in a separate blog);

• CFATS Process (overview of CFATS processes with numerous links);

• CFATS Resources (links to all of the manuals, guidance docs and many flyers)’

• CFATS Risk-Based Performance Standards (RBPS) (overview of RBPS with links to guidance document and RBPS flyers);

• Appendix A: Chemicals of Interest (COI overview with links to COI list, rule and some flyers);

• Reporting a CFATS Violation (essentially the same as the previous version); and

• Chemical Security Laws and Regulations (more on this in a separate blog post)

The second minor section is the announcement section which the ISCD will apparently be using to make general announcements about the operation of the CFATS program.

Below these minor sections are three expandable sections that contain a few tidbits of information, but not near as many links as the old landing page sections:

CFATS Overview;

CFATS Act of 2014; and

CFATS Monthly Statistics.

Chemical Security Landing Page

This new page provides links to three entirely new web sites (besides the obligatory link to the CFATS landing page):

Ammonium Nitrate Security Program (revamp of earlier pages);

Chemical Sector Security Events (more later in the post); and

Chemical Sector Resources (expansion of an earlier set of pages).

I will be addressing the first and last sites in separate blog posts.

CFATS Knowledge Center

The CFATS Knowledge Center page maintains the same URL and appearance that it had under the older web site. There is not a link to it, however, on the CFATS landing page, and only two of the main pages contain the link. The Frequently Asked Question (FAQ) search tools remain the same.

Commentary

I am getting to be an old fogey and do not really appreciate change for change sake. The old CFATS landing page was an old friend and reliable tool that I with which I was well familiar and had a fairly involved plan for periodic monitoring of it parts for changes.

Having said that, the new site does appear to be cleaner and crisper in it appearance. The landing page is not going to be as helpful as the earlier version, but the new CFATS Process page will take up most of the slack in that regard. Unfortunately, we will have to keep checking the less helpful landing page for the announcement section.

My only real complaint about the new landing page is that it does not include a link to the FAQ’s at the CFATS Knowledge Center nor does it have contact information for the CFATS Help Desk. Two very important resources, they should be on every page.

DHS Updates CFATS Web Site

Today the folks at DHS Infrastructure Security Compliance Division (ISCD) updated the Critical Infrastructure: Chemical Security web site. This web site is essentially the web site for the Chemical Facility Anti-Terrorism Standards (CFATS) program. The most obvious change was to provide a link to the October 2015 CFATS Fact Sheet that I discussed yesterday. Additionally ISCD updated almost every page with links on this site.

For most of the pages the updates were mostly cosmetic; bringing a unified format to the pages and adding links to provide more depth to the discussion. There were some significant changes (typically providing more information) made to the following pages:

• Chemical Facility Anti-Terrorism Standards (CFATS) Facility Inspections;

• Chemical-terrorism Vulnerability Information (CVI);

• Evaluating Need to Know for Chemical-terrorism Vulnerability Information (CVI); and

• Ammonium Nitrate Security Program

There was one page that was putatively included in today’s update but still remains woefully out of date. That is the Chemical Security Laws and Regulations page. While the ‘date published’ was changed at the bottom of the page, the page still does not include any reference or link to the current statute authorizing the CFATS program; the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (PL 113-254). This is the second time that this page has been “updated” this year without including mention of the new authorization statute.

More on New DHS Web Site

Last week I noted that DHS had done an across the board upgrade of their web site. Most of the pages just had their content copied into a new format, so there was no real change in information. The concept of landing pages appears to have been done away with; two that I tracked in particular on chemical security and cybersecurity have disappeared.

Change Notification

As I noted earlier, DHS has done away with the update dates on the bottom of pages that allowed viewers to quickly determine if changes had been made to a page since it was last visited. DHS has continued to make email notification of page changes available on a limited number of pages. In the chemical security arena those pages include:

Critical Infrastructure – Chemical Security - http://www.dhs.gov/critical-infrastructure-chemical-security 

2012 Chemical Sector Security Summit - http://www.dhs.gov/2012-chemical-sector-security-summit

If you have an interest in either of these pages you should certainly sign up for this free service. The only problem that I have seen in the past is that it only provides notification for changes on the specific pages listed. It does not provide notice of changes made on linked pages.

Chemical Security Assessment Tool

The one page that I am extremely disappointed about the lack of email notification for changes is the page dealing with the Chemical Security Assessment Tool (CSAT). This is the single most important part of the CFATS web site for the regulated community and there appears to be no method of communicating changes to this portion of the site.

I am providing the listing of the CSAT web pages below. It includes the links to the latest versions of the various supporting documents (and those links are now active).

Chemical Security Assessment Tool - http://www.dhs.gov/chemical-security-assessment-tool  -

Register to Access CSAT - http://www.dhs.gov/register-access-csat

CSAT User Registration .PDF [10-11 V 5.1] - http://www.dhs.gov/xlibrary/assets/chemsec_csatuserregismanual.pdf

Update My Information - http://www.dhs.gov/update-my-information

CSAT Account Management .PDF [04-11 V 2.1] - http://www.dhs.gov/xlibrary/assets/chemsec_csatuseraccountmanage.pdf

CSAT Top Screen - http://www.dhs.gov/csat-top-screen

Appendix A [FR] - http://www.dhs.gov/xlibrary/assets/chemsec_appendixa-chemicalofinterestlist.pdf

Top Screen for Fuels - http://www.dhs.gov/top-screen-submittal-requirements-fuels-except-propane-0

Top Screen for Propane [FR] - http://www.gpo.gov/fdsys/pkg/FR-2008-03-21/html/08-1059.htm

Top Screen Questions .PDF [01-09 V 2.8] - http://www.dhs.gov/xlibrary/assets/chemsec_csattopscreenquestions.pdf

Top Screen Users Manual .PDF [09-10 V 1.99] - http://www.dhs.gov/xlibrary/assets/chemsec_csattopscreenusersmanual.pdf

CSAT Security Vulnerability Assessment - http://www.dhs.gov/csat-security-vulnerability-assessment

SVA Questions .PDF [06-08 V 1.0] - http://www.dhs.gov/xlibrary/assets/chemsec_csat_sva_questions.pdf

SVA Instructions .PDF [01-11 V 2.1] - http://www.dhs.gov/xlibrary/assets/chemsec-csatsva-instructions.pdf

CSAT Site Security Plan - http://www.dhs.gov/csat-site-security-plan

RBPS Guidance .PDF [05-09] - http://www.dhs.gov/xlibrary/assets/chemsec-csatsva-instructions.pdf

RBPS Response to Comments .PDF - http://www.dhs.gov/xlibrary/assets/chemsec_cfats_riskbased_performance_standards_comments_received.pdf

SSP Questions .PDF [06-11 V 2.0] - http://www.dhs.gov/xlibrary/assets/chemsec_csat_ssp_questions.pdf

SSP Instructions .PDF [05-09 V 1.0] - http://www.dhs.gov/xlibrary/assets/chemsec_csat_ssp_instructions.pdf

SSP Screen Shots .PDF - http://www.dhs.gov/xlibrary/assets/chemsec_csat_ssp_screenshots.pdf

SSP Edit Process User Guide .PDF [10-10 V 0.7] - http://www.dhs.gov/xlibrary/assets/chemsec_csatsspedit_userguide.pdf

Public Comments

DHS is using their successful public feedback program on IdeaScale.com. Comments can be submitted by joining the DHS Redesign community. The same site allows you to look at all of the comments on the design, report issues, and to suggest improvements (I just submitted asuggestion [NOTE: Link added 12:50 EDT 8-13-12] to add the review dates to each page).

These IdeaScale discussions have been very interesting in the past and I expect to see a lot of interesting ideas brought up. I just hope that DHS does a better job in responding to the ideas and suggestions about their web site than they have done in their previous projects on this site.

DHS CVI Website Updated

Some early today or late yesterday the folks at ISCD updated their Chemical-Terrorism Vulnerability Information (CVI) web page. The landing page now has a reference to the Executive Order that President Obama signed last year concerning Controlled Unclassified Information (CUI). It also includes links to a page addressing the CUI issue as it currently stands at ISCD.

Readers might remember that back in November when the EO was signed I opined that:

“It is clear that chemical-terrorism vulnerability information (CVI) will fall under the provisions of EO 13556. As the CVI category is established by regulation (6 CFR 27.400) it is certain that it will survive the initial review of the Secretary and the EA [Executive Agent]. The disclosure provisions should also remain unchanged. There may need to be some revisions made to the CVI Procedures Manual, depending on the review of the marking and protections provisions by the EA.”

Well this new web page indicates that the National Archives and Records Administration (NARA) (the Executive Agent for this EO) has decided that the CVI program will remain as a CUI program. As such we can expect that some revisions will have to be made to the CVI manual to bring it up to the new standards. DHS will publish the new manual when it is ready and will certainly revise their on-line training program. All of that will happen at some point in the not too distant future (hopefully).

Web Page Dating

ISCD is continuing to have problems with the dating of their web pages. This has been a hallmark of the ISCD web site; page dates show at a glance when the page has been updated saving the casual reviewer (or even the more serious one such as myself) from having to constantly read an unchanging web page, waiting to see if new information becomes available. Until just recently, (not too long after the recent reorganization, coincidentally I’m sure) these dates reflected the dates that the new pages have been posted on the web site.

These two pages have very suspicious dates. The landing page date is certainly wrong; it shows that this page was changed/reviewed on February 24th of this year. I know that is not true, I check this page every morning at about 8:00 am EST/EDT. Yesterday the date read August 6th, 2009. Today it reads February 24th, 2011. I suspect that it was approved on February 24th but not actually posted for some reason until today.

The EO 13556 page shows a date of March 21, 2011. That date may be correct; without the link to page provided on the new landing page I would have no way of knowing that this page even existed to check on it. Still, I doubt that March 21st was when the page actually went live; it is very likely in my mind that it actually went live this morning with the updated CVI landing page that pointed to it.

These page dates are really a very minor thing; in fact only anal-retentive people like me are even probably aware that they exist. It does however reflect a general decrease in the appearance of professionalism in ISCD. The CFATS web site was something that ISCD had always taken pride in and deserved accolades for their innovative use of the web as a communications tool. I really hate to see it slipping down to the standards of the rest of the Department.