DHS CSAT FAQ Page Updates 06-11-10

This last week the folks at the DHS Chemical Security Assessment Tool (CSAT) Help Desk have been very busy updating the responses to 48 of the site’s extensive list of Frequently Asked Questions (FAQ). Thirty-eight of those new responses were simple corrections of typographical errors. There were 8 responses to new questions and 2 questions where there were substantive changes to the response. New FAQ The newly addressed FAQ were: 365: What is a Security Vulnerability Assessment (SVA)? 411: I need to calculate the Distance of Concern for more than one toxic chemical. What do I do? 1173: What is the definition of a transportation container as it related to CFATS? 1206: How does a facility count the amount of a release-explosive chemical? 1209: Are transportation containers that are detached from the motive power considered in calculating the STQ? 1228: How is the STQ calculated for Ammonium nitrate as an explosive? 1269: Please explain how to report individual chemicals as neat chemicals or as part of a mixture. 1347: How do I determine the total quantity of a Release-Toxic Chemical of Interest? We can tell from the FAQ numbers that these are not new changes to the system, but questions that the DHS Help Desk folks expected to have submitted when changes were made to the CSAT system in the past, but were not asked until just recently. Even so, I recommend (as I always do) that anyone connected with preparing or submitting CFATS documents should read each of these ‘new’ questions. While the specific question/response might not be directly applicable to a particular facility, it will provide insight into the operations of the CFATS process. Substantive Changes The two questions with substantive changes to the response were nearly identical and the changes to the responses were the same. The two questions were: 1363: I have completed the Top-Screen and submitted it to DHS, but I discovered that I need to make some changes to the information I submitted. How can I do this? 1406: If I have already submitted a Top Screen and later determine that I need to re-submit, what do I do? In both cases they substituted the work “Submitter” for the word ‘you’ in two places in the answer. This may seem to be a minor change, but it subtly reminds CSAT Users that it is only the Submitter for the facility that may notify the system that a revised or updated Top Screen. Missed Errors There were a couple of typographical errors in these 48 responses that were missed during this revision process. Each of these errors could only be caught by a careful reading of the responses; they were subtle enough that spell checks or grammar checks would not be expected to catch them. The five responses are identified below with the ‘correction’ in brackets. 1274: “You may FAX [FedEx] forms or other information to this mailing address”; 1347: “mixture is one percent (1%) of [or] greater by weight”; 1436: “What is the FR [APA] for Sabotage/contamination COIs”; 1440: “above the applicable STQ for a COL [COI]”; and 1472: “date the form. the [The] completed form”. The response to question 1228 seems to be contradictory to me. It should be reworded to make it clearer. It says (in part):

“Where AN as an explosive presents a theft-EXP/IEDP security issue, the STQ is 400 pounds, and a facility is expected to include all amounts of ACG of AN when determining whether it meets or exceeds the STQ. And, per § 27.203(c), in calculating this theft STQ, facilities need only count amounts in transportation packaging.”

The response to question 1261 has a much more basic problem; it doesn’t address the question. The question asks: “How do I figure out the Capacity Utilization Rate? The same equipment produces multiple listed chemicals.” The answer obviously is directed at the wrong question; stating that:

“Distances of concern for purposes of Top-Screen must be calculated using EPA's RMP*Comp. Instructions for using RMP*Comp for Top-Screen are available in the downloadable Top-Screen Users Manual on the DHS website.”

Keeping a large data base like this up to date and correcting little, nit-picking problems like these takes a great deal of work and dedication. As always I like to remind the CFATS community of the hard, usually unnoticed work being done by the folks at the CSAT Help Desk. Next time you talk to one of these people, please take the time to thank them for a job well done.

DHS CSAT FAQ Page Update 05-28-10

This last week saw DHS make more modifications to the responses on their Chemical Security Assessment Tool (CSAT) Frequently Asked Questions (FAQ) page than they have in quite some time. They modified responses to three previously asked questions and added seven new questions. The modified responses were for the following questions: 1473 What information do I need to know about my facility in order to register? 1563 How do I know if my facility is a Treatment Works as defined in Section 212 of the Federal Water Pollution Control Act? 1604 Do I need to keep a record and/or printout of my survey before transmitting it to DHS? There were no material changes to any of the modified responses. The DHS people were just cleaning up typographical errors and misspellings; all typical work that needs to be done to a data base this large. Special Note to DHS: you missed one error in the answer to question 1563: “recy6cling”. New FAQ I routinely recommend that all facility security managers (and other interested people) read the responses to all new questions, even if they do not appear to apply to the facility. This is because they always provide some level of insight into the thinking of ISCD and that is always valuable. The new questions added this week were: 1403 In the on-line SSP, how do I identify my facility's Cyber Control System on the map if it is managed off-site? 1661 What is the definition of A Commercial Grade (ACG) for the purposes of CFATS? Specifically, under Appendix A of the Chemical facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27, if a chemical facility manufactures or otherwise possesses a Theft/Diversion or Sabotage chemical of interest (COI) but does not directly offer the chemical for commercial sale, does the facility need to count the chemical toward the applicable screening threshold quantity to determine if the facility must submit a Top-Screen to DHS? 1662 I have received an email notification that a CSAT Letter is available for viewing. How do I access this letter? 1663 I have a final tiering determination and SSP deadline, but have not yet submitted my SSP. I have also made material modifications to my site. What should I do? 1664 Between the time a facility submits an SSP for review and ISCD inspects the facility, could DHS direct a facility to cease operations? In other words, could DHS shut down a facility based on the content of a submitted SSP without an actual facility inspection? 1665 What are examples of redundant radio systems? 1666 Does a facility have an obligation to notify DHS if the facility itself is shutting down/closing? A Commercial Grade The response to question 1661 should be closely looked at by any facility that has an STQ amount of either a Theft/Diversion COI or a Sabotage COI on site. DHS clarifies in this response the status of a facility that possesses but does not sell those COI. DHS explains that the phrase “offered for commercial sale” does not mean that facilities that use but not sell these COI are exempt from reporting these materials on their Top Screen. The phrase is used to describe the chemical not the facility. There still remains one potential loop hole in this definition. If a facility produces the material for internal consumption and does not sell or transfer that material off-site, then it would appear that the facility would not be required to report it on the Top Screen. If I were in that situation, though, I would specifically ask DHS for their opinion on the matter before submitting my Top Screen. Change in COI The response to question 1663 is of particular importance to a wide range of facilities. When a facility has received their final notification letter of their tiering and SSP due date, but have not yet submitted their SSP, the facility does not get a reprieve from the SSP requirement by submitting a ‘material change’ Top Screen showing a reduction or removal of a COI from the facility. In addition to filing a new Top Screen, DHS wants facilities to report the change on their SSP. If the change has already been done, DHS wants it to be reported on the SSP as a “Planned Measure”. If the change is in process or planned to take place, DHS wants it to be reported as a “Proposed Measure”. This will allow DHS to evaluate the effect of the change on the security profile of the facility. For “Planned Measures”, DHS will consider those measures when deciding on the approval of the SSP. For “Proposed Measures”, DHS will not consider them in the approval decision process, but ISCD will inform the facility of the potential affect of the change on their CFATS Status. The most important part of this response, however, is found in the last paragraph:

“By stating a COI has been or will be permanently removed from a facility in the SSP, or that conditions have otherwise been permanently and materially changed, the facility is then legally bound to ensure that COI is in fact never held at that facility again or that the condition or material change remains in effect unless and until DHS approves a revision to the facility’s SSP. See §§ 27.210(d) and 27.245(a)(iii).”

It would seem to me that facilities would want to be very careful in reporting this type of change as a “Planned Measure”. If there is any reasonable chance that the facility will be returning the material to the facility, then it may be more prudent to report the change as a “Proposed Change”. This will not carry the same legal burden as a “Planned Measure” since DHS is not using that report in their actual consideration of the SSP.

DHS CSAT FAQ Page Update 05-07-10

Earlier this week DHS updated one of the responses to their extensive listing of frequently asked questions (FAQ) for the Chemical Security Assessment Tool for the CFATS program. The response was for the following question: 1363: I have completed the Top-Screen and submitted it to DHS, but I discovered that I need to make some changes to the information I submitted. How can I do this? In this case there was absolutely no change in the actual wording of the answer. The change was made to the heading under which the question was filed. The earlier version (posted 5-22-09) of this response the question was filed under the “Usernames/Passwords” heading, a completely inappropriate heading given the question and the response. The latest incarnation of this question is filed under the “Top Screen Navigation and Troubleshooting” heading.

This will make it easier to find the question while browsing the long FAQ list. With a list of questions as long as this, properly listing the question under the appropriate heading is really an important correction.

DHS CSAT FAQ Page Update 01-29-10

This last week DHS only added/update one question on the Chemical Security Assessment Tool (CSAT) Frequently Asked Question (FAQ) web page. This extensive FAQ page provides a very large list of questions that have been addressed by the CSAT Help Desk and provide some insight into the DHS CFATS program administration. This week a new question and response were added to the FAQ page. That question was: 1660 Once I get my “final” tier, can it or will it ever change? How and why? DHS notes that the ‘final’ tier is the term given to the tier designation after the Security Vulnerability Assessment (SVA) is reviewed by DHS and does not mean that this is a permanent tier ranking. The response provides three examples (presumably not exclusive) of how a facility might receive a different tier ranking. Significant Change in Operations The first example is the one explicitly covered in the CFATS regulations {§27.210(d)}. Anytime a facility has a ‘significant’ change or “material modification” in their operations they are required to submit a new Top Screen. DHS will evaluate the new Top Screen and determine if the change is significant enough to require either a new SVA or Site Security Plan (SSP). A new SVA might result in a change in Final Tier ranking. DHS has not specifically listed all of the things that might constitute a “material modification” but it would certainly include the addition or removal of a chemical of interest (COI) from a facility. A significant increase or decrease in the inventory of an already existing COI would be a material modification. The addition of a new security measure would not be captured in a new Top Screen, but could conceivably result in a change in Tiering. Facilities should probably contact the Help Desk for a determination on how to proceed in that case. Remember, removing a security measure that has already been placed on a submitted or approved SSP can only be done with the approval of DHS. Two New Tier Change Methods The second response expands on an implicit requirement of §27.210(b). That section requires facilities to periodically resubmit their SVA and or SSP. DHS has yet to publish a schedule for the resubmission of SVA’s and SSP’s (we really do need to get the current SSP process complete before anyone really wants to worry about that), but DHS could also send letters to individual facilities, or post a notice in the Federal Register requiring a class of facilities, to submit new SVA’s or SSP’s. This FAQ response notes that DHS could change their Tier ranking based on the newly submitted SVA or SSP without any underlying change in the Top Screen information. This could reflect the DHS determination that “the plan has been successful enough to lower the facility’s final tier”. Not stated in this response, but possible, would be the determination that the SSP had proven inadequate in some manner and the Tier ranking could be raised. A similar methodology has actually been used for addressing the Tier ranking of a large number of gasoline fuel terminals after DHS changed some of the SVA questions relating to the storage of gasoline products. DHS required re-submissions of the SVA for the potentially affected terminals and re-evaluated their Tier rankings based upon the new information. The third response is implicit in the Secretary’s authority determine Tier rankings and requires no new input from covered facilities. This response indicates that DHS can change the existing Tier ranking when:

“DHS considers new information about a site, chemical, threat, or process that warrants revising (up or down) an existing final tier. DHS will provide appropriate notification to the facility of the reasons justifying a change in the facility’s existing tier.”

This means that if DHS were to come into some new information that would change their basis for determining Tier rankings, DHS could go back and use that new information to re-evaluate previously issued rankings.

DHS CFATS FAQ Page Update 01-08-10

Last week DHS updated/posted answers to eight questions on the CFATS Frequently Asked Questions (FAQ) web page. The first four answers are updates to previously answered questions and the remaining four are answers to new questions. The eight questions are: 1143: My company is a spin-off of two separate corporations. As a result several of the new company's facilities are co-located. That is, the facilities either share a fenceline or are completely imbedded within a common facility. What will be required of us in regards to CFATS? Do both companies need to develop a Top Screen, SVA, and Site Security Plan? Is it possible for our imbedded plants to share the Top Screen, SVA, and Site Security Plan with the host company? If this is possible, what would be required by both companies to accomplish this and be compliant under 6 CFR Part 27? 1567: How does a facility count the amount of release flammable COI in a mixture with a National Fire Protection Association (NFPA) rating of 1, 2 or 3 that is not a fuel? 1568: How does a facility count the amount of release-flammable mixture with a National Fire Protection Association (NFPA) rating of 4 if it is stored in either below or above ground tank(s)? 1633: What is a proposed measure and why would a facility include one in the SSP? 1619: I recently received a new CSAT tiering letter for my facility and the facility has an elapsed Security Vulnerability Assessment (SVA) due date. What do I do? 1657: Does DHS have a list of specific security measures that are required at CFATS-covered high-risk facilities? 1658: What is required of an Alternate Security Program to be acceptable in lieu of an SSP? 1659: What are “planned” measures and why would a facility include them in the SSP? Flammable Mixtures Two of the questions that have updated answers deal with the subject of how to count chemicals of interest in flammable mixtures. There are significant differences between these new answers and the previous time they were answered back on September 3rd, 2008 and the new answers will almost certainly add to the confusion surrounding this topic; changes can be confusing even if they are correct. Question 1567 substantially changes the instructions from the old answer for counting flammable COI in a mixture where the mixture has a NFPA (National Fire Protection Association) rating of 1, 2, or 3. The old answer included the requirement that: “Mixtures with an NFPA flammability hazard rating of 1, 2 or 3 are calculated by multiplying the perentage of the COI times the total weight of the mixture to see if the amount of the COI is at or above the STQ.” There is no such requirement in 6 CFR 27.204(a)(2). The new answer removes that language and affirms that such mixtures are not counted in the Top Screen as long as the mixture is not a fuel. Question 1568 simplifies the previous answer to this question by just stating that: “A facility must count the entire weight of any release-flammable mixtures with an NFPA rating of 4 toward the STQ, regardless of whether the mixture is stored in below ground or above ground tanks.” To make it more ‘technically’ correct the wording should probably be: “…the entire weight of a mixture containing a release-flammable chemical of interest at a concentration equal to or greater than 1% with an NFPA….” Other Changed Answers In the answer to question 1143 DHS emphasizes that while it would typically be the party responsible for the security of the COI that would have to make the appropriate submissions, DHS acknowledges that special cases will certainly exist. They suggest that if there is any question about this specific issue that the parties should consult with the Help Desk (866-323-2957) for individual determinations. The other previously answered question provides DHS to address, in a small way, the issue of inherently safer technologies. The answer provides a new response that was not previously included in the list of items that a facility might want to include in the ‘proposed security measures’ sections of the SSP submission. The new response is: “Changes in processes, operations, or chemical uses a facility is considering or proposing.” This would allow DHS to advise facilities if their proposed IST measure would change their security situation. New Questions As is usual with these reviews, I suggest that everyone in the chemical security community that might be dealing with CFATS issues should read the answers that DHS provides for new questions. These four questions are no different. I don’t see any really new information in any of these answers. The answer to the ASP question does provide an interesting reference to an explanation of Alternative Security Plan in the preamble to the Interim Final Rule for 6 CFR Part 27. Since most people will not have seen the interim final rule this is a valuable reference.

DHS CSAT FAQ Page Update – 11-20-09

Last week DHS added four new questions to their CSAT Frequently Asked Questions (FAQ) web page. One question was already addressed here last week; the other questions were: 1648: How does a SSP user navigate through the SSP Tool? How are answers to questions saved in the SSP Tool? 1650: What happens after a facility submits its Site Security Plan (SSP)? 1651: How do I start an SSP? After Initial SSP Submission As more and more facilities complete the submission of their SSP the inevitable question is what happens next; that is answered in the response to question 1650. Once DHS receives the submission they will review the submission. The first review is largely automated; a check to see if all of the appropriate questions have been answered for all of the COI listed in the notification letter. Then a number of subject matter experts will review the details of the submission to see if the plan meets all of the requirements of 6 CFR 27.225. If all of the issues are adequately addressed, DHS will issue a ‘Letter of Authorization’ that ‘authorizes’ the facility to proceed with the implementation of the Site Security Plan outlined in their submission. DHS will then schedule a site inspection to determine if the facility is in compliance with their SSP. The inspectors will look at the existing and planned security procedures that are detailed in the submission to ensure their adequacy in meeting the risk-based performance standards outlined in the regulations. DHS has told Congress that they expect to start the inspections in December with priority being given to the Tier 1 facilities that were required to submit their SSP’s earlier this fall. If the facility’s SSP submission is inadequate, DHS has two different approaches that it can take. If the facility appears to be on the right track, but has some issues with its submission DHS will send the facility a guidance letter that outlines specific things that are missing or need clarification with the facility submission. Provisions are made for additional consultation with DHS to correct these deficiencies. As part of that consultation the facility might consider asking for courtesy inspection where an inspector will visit the facility to look at the facility’s situation and security measures. This visit will not be considered to be the SSP inspection. If the facility’s SSP submission is completely inadequate DHS may formally disapprove the SSP. The letter making that notification will outline the deficiencies in the SSP. Instructions on how to proceed and a new deadline for correcting those deficiencies will be included. Facilities should keep in mind that the Secretary has the authority to seek civil sanctions on non-compliant facilities including issuing a cease operations order until the facility is in compliance. One would assume that those options would be outlined in the notification of disapproval. SSP CSAT Tool Both of the other questions deal with the actual operations of the SSP tool. Facilities that have yet to start their SSP submission should read these two responses to reinforce the instructions provided in the SSP on-line instructions manual and the initial notification letter. The brief responses will not be an adequate substitute for reading the actual instructions, but do serve to re-enforce some key points.

CSAT FAQ #1649

For the last year or so I have typically been reporting on new and updated DHS CSAT Frequently Asked Question (FAQ) on a weekly basis. These are not usually urgent and it takes up too much time and effort to report on each and every FAQ change as it is posted. I do, however, review them every morning because from time to time one comes up that may appear to require quicker reporting. Yesterday, DHS posted such a new FAQ: 1649 How do I request an extension of my facility’s Top-Screen, SVA or SSP filing deadline? Actually, the question does not appear to time critical, but the response indicates a potential problem with DHS receiving these requests. The response states: “A request for an extension must be submitted to DHS in writing by USPS or delivery service. DO NOT FAX your extension request to the CSAT Help Desk.” The emphasis was added by DHS, not here at the blog. I can think of a number of legal reasons that DHS might require an original document with signature, but I also know, from long experience, that things sent by fax to not always get to the recipient in a timely manner or they get garbled in transmission. BTW: CVI rules do allow for transmission of CVI by fax, but they do require prior coordination with the receiver to ensure that a CVI authorized user with need to know is on the receiving end of the fax transmission to ensure that appropriate security measures are put into place to protect the document upon its receipt. In any case; when DHS shouts at us with CAPS in their fax, I assume that they are especially concerned that the message is important. So please, do not fax your extension requests to the CSAT Help Desk.

DHS CSAT FAQ Page Update – 11-13-09

Last week DHS posted three new questions and responses to the already extensive CSAT Frequently Asked Question (FAQ) list. Those questions were: 1610: Can a consultant request a user change? 1646: The CSAT Security Vulnerability Assessment (SVA) Tool does not allow printing of large summary reports. Will facilities be able to print large summary reports from the CSAT Site Security Plan (SSP) Tool? 16:47: What data and information from a facility’s Top-Screen(s) and Security Vulnerability Assessment(s) (SVA) will be pre-populated by CSAT in the facility’s Site Security Plan (SSP)? User Changes It isn’t often that I can catch the FAQ preparers in a mistake, but their response to Question 1610 does contain a significant oversight. The answer starts out by stating that: “A consultant may not request or initiate a CSAT user change.” Then they go on to say:

“In general, the original user must make any change to his/her user role – e.g., authorizer changes authorizer, submitter changes submitter, preparer changes preparer.”

Since a consultant or contractor may be a Preparer, the consultant can request changes to their status as a Preparer. I would be willing to bet that what the answer was intended to say was that a consultant may not request changes to Authorizers, Submitters or for Preparers other than himself/herself. Pre-Populated Data The answer to Question 1647 contains the standard information about where the data comes from that should be pre-populated on the facility’s Site Security Plan when that tool is initially opened. It also reminds users to review and correct that data. The cautionary note about having to change errors in latitude and longitude only with the assistance of the Help Desk is, as usual, not explained. DHS uses the latitude and longitude of the facility as a major component of its internal tool to determine if the facility is a high risk facility and to assign its tier ranking. If there is an error in that location, there might have been an error made in making those determinations. That is why changes to the latitude and longitude must be made via the Help Desk.

DHS CSAT FAQ Page Update – 11-06-09

Last week DHS added responses to five new questions on their extensive CSAT Frequently Asked Questions page. Those questions were: 1268 Am I exempt from registering since I fall under Part 105 of the Maritime Transportation Security Act? 1558 May I continue to work on my SVA while I replace, or after I replace, an existing Top-Screen? 1613 What is the anticipated timeframe for receiving a response to an extension request? 1614 My circumstances have changed from my original Top-Screen submission. What do I base my SVA on – my original submission or the material modifications I have made? 1615 I have resubmitted my Top Screen because of material modifications at my facility. This resulted in a change to my tiering. In this case, what happens to my current SVA? As always, I recommend that site security managers read all new responses as they are posted. There is no telling which might affect the CFATS implementation at a facility without reading the individual answers. New Top Screens With the economic situation being so bad for the chemical industry in general, many facilities are closing, reducing operations, or eliminating product lines; all things that can result in the reduction or elimination COI. This means that DHS has been receiving large numbers of Top Screen resubmitals that might result in lowering of risk level ratings or removal from the list of high-risk chemical facilities. What affect this has on facility SVAs is the basis for four of this week’s new questions. First, DHS makes clear that once an SVA notification letter is sent to a facility the facility is required to complete the SVA for the underlying Top Screen unless or until DHS removes the requirement. If a facility feels that their subsequent Top Screen will result in removal from the high-risk list (if they no longer have COI on-site for example) they should request an extension of the time to file their SVA under the old Top Screen siting the lack of COI and the new Top Screen submission as justification. In the event that the resubmitted Top Screen does not result in a change of tier level the new top screen will almost certainly not result in a change in date for the submission of the SVA previously required. This is the reason that DHS wants facilities to continue working on their current SVAs or SSPs while their new Top Screen is being evaluated. If a new Top Screen does result in a change of preliminary tier rankings, DHS still might not change the due date of a previously ordered SVA. If there were no changes in the list of covered chemicals held at the facility, there will likely be no need to change the SVA submission, so DHS would keep the same date. Similarly, if there was an elimination of a minor (by inventory standards) COI while large scale storage of other COI remain, DHS might not change the SVA date. The later situation might not even change the completion date of an ordered Site Security Plan.

CSAT FAQ Update 10-23-09

Last week DHS updated a fairly large number of their responses to Frequently Asked Questions on the CSAT FAQ page. The questions addressed include: 103: I am a member of a media organization seeking information about CSAT. Who should I contact? 453: Relating to Mission Critical Chemicals, what is the National Emergency Production Rate? 459: How can I print the completed Top-Screen, SVA, or SSP? How can I print the completed Top-Screen, SVA, or SSP? 1392: How do I transfer my account or reassign my user role? 1405: How will I know the agricultural extension has been lifted and what to do next? 1508: Where can I find more thorough descriptions of the attack scenarios? 1517: I completed my CVI training. Why does it take me back to CVI training when I log into my Top Screen or SVA? 1608: What is the format for entering my CVI authorization number when I am prompted for it, for example,during CVI training? 1609: I need assistance navigating through the CSAT application. However, I am not a registered CSAT user. 1617: Why does CSAT log me off prior to the 20 minute timeout period? 1618: How do I access and acknowledge CSAT letters (for example, my facility's tiering letter)? 1644: What should be done with my CVI Authorization User Number? 1645: Do I need to report chlorine bleach (sodium hypochlorite) as Chlorine on the CSAT Top-Screen? A number of these, according to my records, are new entries on the CSAT FAQ page. As such they should probably be read by all CSAT users just to make sure that they understand current CFATS policy. These new questions are: 405, 459, 1517, 1608, 1617, 1618, 1609, 1644, and 1645. Of these nine new questions four of them are particularly interesting. Agriculture Extension The answer to question 1405 about the change in status of the Agriculture extension is important, in and of itself, but it also provides some valuable advice for tracking any changes in the CFATS regulations. First it provides the link to the source page for CFATS on the DHS web site, http://www.dhs.gov/chemicalsecurity, where one can sign up for email notification of changes to that web site. Second it provides a link to the www.regulations.gov web site where you can sign up to be notified of changes to specific dockets; in this case docket number DHS-2006-0073. This will provide email notification of official changes to the CFATS program. CVI Authorization Number Question 1608 provides a good description of the format for the CVI Authorization Number that everyone receives upon completion of the online CVI training. The number comes in two distinct parts; first the date the training was completed and the second part is the sequential number assigned to each authorized user. Both portions are required to be entered in separate boxes when a user is required to provide authentication of authorization to use CSAT applications. Question 1644 addresses a non-procedural question about the protection of CVI numbers. DHS ISCD recommends that authorized users need to protect their CVI number the same way that they would protect their driver’s license number or credit card numbers; sharing the number only with trusted organizations and people. IP Addresses Question 1617 deals with something that is normally transparent to most internet users; your computer’s IP Address. It seems that many corporate IT programs use multiple ‘proxy servers’ to provide protection of individual computers from malicious attacks. Switching IP addresses during extended stays on the internet is one way of using these proxy servers to protect corporate computers. Unfortunately, changing the IP address during a session on one of the CSAT applications causes the DHS computer to shut down access, to protect the DHS computer from attack. The answer to question 1617 provides a detailed discussion of how to deal with this problem. You would suspect this is the reason you are being kicked off CSAT when you receive a "504 Proxy Server Error" notification. Interesting Response Revisions Most of the revised questions have relatively minor changes to the previously provided response to the FAQ. There are two questions that the changes made to the responses are worth discussing. Question 453 provides a much more detailed description of what to consider when a facility determines its National Emergency Production Rate for their Top Screen submission. This answer is well worth reading before a facility re-submits or submits their first Top Screen. One change I’m not really sure was productive was removing the link provided to the Census page referenced in the explanation. In the old response that link, http://www.census.gov/cir/www/mqc1pag2.html, was provided. Question 1508 addresses the issue of access to the details of the SVA attack scenarios. The new change keeps the explanation that this information is only available to authorized users working on an active SVA. It removes the instruction to contact the Help Desk for assistance in finding the document. The only assistance provided for locating the document is noting that it is “available in the CVI Document Vault”.

CSAT FAQ Update 09-25-09

Last week the Department of Homeland Security updated the responses to three questions on their CSAT Frequently Asked Question Page. The questions addressed were: 1373: If a mixture has multiple COIs as flammable release, does the facility need to list the entire weight of the mixture for each COI or does it only need to be listed once. Listing it multiple times would give the appearance that the facility has a lot more COIs than they actually do have. 1532: How may I request an extension of my facility's SVA deadline? 1557: What should I do if I think my facility was incorrectly determined to be high-risk or received an incorrect preliminary risk-based tier determination? Acting Assistant Secretary Two of the questions (1532 and 1557) that were reviewed/updated had the same change made in their answers. It seems that Mr. James L. Snyder is no longer the Deputy Assistant Secretary for Infrastructure Protection. The two answers require that requests that would have been addressed to him are now to be addressed to Mr. William F. Flynn, Assistant Secretary (Acting) for Infrastructure Protection. The personnel change was apparently made since June 5th of this year when the two questions were last updated. Multiple COI in a Mixture I can’t find a previous entry for question 1373 in my records, so it looks that this is one of those questions that had a pre-formulated response for a question that was not asked until recently. It addresses the situation where a flammable mixture contains two or more flammable release COI. The answer notes that the COI with the highest percentage concentration in the mixture will be the COI that is reported on the Top Screen for the entire contents of the mixture. This will prevent double or triple counting the same flammable mixture on the Top Screen.

DHS CSAT FAQ Page Update 8-28-09

Last week DHS updated the responses to two of the questions on the DHS CSAT FAQ web page. Those questions were: 707 How do I change the name of the Authorizer/Submitter/Preparer? 1633 As used in the CSAT SSP tool, what is the difference between a planned security measure and a proposed security measure? The update to the response to question 707 involved the correction of a minor typo. The update to the response to question 1633 involves a clarification of a definition of a ‘planned security measure’ in the Site Security Plan. The old definition included the explanation that such a measure was one that the facility had “definitely decided to install/implement”. The new wording changes that to read “committed to install/implement”. This should make it more clear that a facility will have to be able to show some sort of documentation to a DHS inspector to demonstrate that commitment if the measure had not yet been installed at the time of the inspection. Additionally a missing phrase, “for facility to remain in compliance with the SSP” was added to the statement explaining that planned security measures that are approved by DHS must be implemented. There were also some minor formatting changes made in the response to this question.

CSAT FAQ Update 08-07-09

Last week DHS only had one new entry posted on the CSAT FAQ web page. The question was:

1643 How will DHS protect the data it collects?

The answer is the same as the one that was posted on July 7th.

DHS CSAT FAQ Page Update – 07-17-09

Last week DHS only provided two new FAQ questions/answers on their extensive Frequently Asked Questions web page. Those questions were: 1392: When would I have the ability to transfer my account or reassign my user role? 1640: When will I be notified if I have to complete a SVA? Transfer User Account The answer to this question briefly explains that user accounts can only be changed after the user name and password have been issued. This is done to protect the facility from attempts to hijack the facility accounts to gain access to the facility security information stored on-line. The registration system is an open access system, so no changes are allowed in that system. There is a separate, secured access system, designed to handle change requests. That is the User Change Request System. SVA Notification I am not sure that the answer provided for this question actually addresses the desired information. It does do a good job of describing what information the SVA notification provides, but it does not address the timing of that notification. Part of the problem DHS has in answering questions like this is that there are a number of factors that go into the timing of the review of the submitted Top Screen, and then making the initial determination that a facility is a high-risk facility and determining the preliminary tier ranking. The complexity of the Top Screen will certainly bear on the length of time it will take to make the appropriate determinations. A simple Top Screen with a single COI in a well defined area will take much less time to reach a determination than a Top Screen with multiple COI in multiple risk categories stored in a variety of conditions and areas within the facility. While the initial evaluation is done by computer, each Top Screen submission is also reviewed by a real live person. This leads to the another variable in determining how much time it takes to evaluate a Top Screen. Currently the limited numbers of personnel available for enforcement activities in the CFATS program are tied up with a large number of initial Site Security Plans. Since these are Tier 1 and Tier 2 facilities currently undergoing SSP submission, they would generally be expected to have a higher priority than new Top Screens. The good news is that while the facility is waiting for their SVA notification letters, they can go ahead and start collecting data for the SVA submission. If they are subsequently notified that they are a high-risk facility they will have a head start on preparing their submission. If they are told that they are not a high-risk facility (and thus not covered by the CFATS regulations) the information they have gathered will help them to make their own assessment of their site security status, valuable information for any facility. Finally, the time spent waiting for DHS notification does not count towards the deadlines that the facility must meet in complying with their responsibilities under CFATS.

DHS CSAT FAQ Page Update – 07-10-09

This last week DHS updated five questions on their extensive CSAT FAQ web page. Actually they added three questions/answers and reviewed/updated another two. The five questions were (the last three are new): 1392: When would I have the ability to transfer my account or reassign my user role? 1472: How do I fix a typo in the user registration information I submitted? 1641: In RMP*Comp, what value do I use for the Quantity Released? 1642: I am already a CVI Authorized User. Do I need to take the CVI training again to maintain my CVI Authorized User status? 1643: How will DHS protect the data it collects? Changing Registration Information Two of the questions deal with changing user registration information; transferring accounts or changing information. The procedure is fairly straight forward when one is transferring user roles to someone else in the organization that is already registered. It becomes slightly more complicated when someone new is added because it requires the authorizer to sign and mail in a new registration document. Changing information is more difficult because of the need to make sure that only appropriate people are making changes. Chemical-Terrorism Vulnerability Information The two questions dealing CVI do not provide new information, but should probably be read by everyone involved in the CFATS process at high-risk chemical facilities. The first one deals with why old-authorized users (people who completed CVI training before October of last year) should go back and re-do their training. The second provides a decent overview of how DHS is required to treat CVI. RMP*Comp The question on the use of the EPA tool, RMP*Comp, explains that the Preparer should use the Total Onsite Quantity of toxic release COI as the ‘release quantity’ in this tool. Non-CFATS users of this tool typically use the amount in the largest storage tank for the EPA ‘worst case scenario’ calculation of the potential exposure area. DHS uses the total quantity because it must be expected that a ‘successful’ terrorist attack would target all storage containers for a nearly simultaneous release whereas an accidental release would be unlikely to affect all storage containers.

DHS CSAT FAQ Page Update 06-05-09

Last week DHS posted reviews/changes to four frequently asked questions listed on its CSAT FAQ web page. Those questions were: 170: What is a Public Water System? 1532: How may I request an extension of my facility's SVA deadline? 1557: What should I do if I think my facility was incorrectly determined to be high-risk or received an incorrect preliminary risk-based tier determination? 1634: My facility offered information in the SVA about security/vulnerability issues involving COI that are not listed in my DHS Final Notification letter; what are DHS' expectations about these other security/vulnerability issues and COI? Two of the answers (170 and 1634) had no changes. The other two questions had changes to the person to whom requests for extensions of an SVA/SSP filing deadline should be sent. The old answers directed that the requests would be addressed to “Mr. Robert Stephan, Assistant Secretary for Infrastructure Protection, Department of Homeland Security”. Then new answer requires they be sent to “Mr. James L. Snyder, Deputy Assistant Secretary for Infrastructure Protection, Department of Homeland Security”. Changes like this are to be expected during changes in administration. Interestingly both the old and new answers require that the request be sent “c/o Dennis Deziel, Infrastructure Security Compliance Division”. This indicates that the same person is going to be the ‘action officer’ for processing these requests regardless of whose signature will appear on the official response.