ISCD Updates 9 FAQ Responses – 7-20-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to six frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. There were also two news items on today’s CFATS Knowledge page; first, a note about the 30-day ICR renewal notice published in today’s Federal Register for the Chemical-Terrorism Vulnerability Information (CVI) program. The second note is an update of information about the COVID-19 modified compliance inspection program.

FAQ Updates

The FAQ updates are part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1750 What happens after I submit my Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1751 If my facility has been issued a “letter of acceptance” through the Expedited Approval Program (EAP), but then the Cyber Infrastructure Security Agency (CISA) discovers that the measures in the Site Security Plan (SSP) insufficiently meet the risk-based performance standards (RBPS) during a Compliance Inspection, what happens?

FAQ #1752 Who can certify a facility’s Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1766 Does the Cybersecurity and Infrastructure Security Agency (CISA) allow facilities to contract out the submission of information under Option 1 or Option 2 for the Personnel Surety Program in Risk-Based Performance Standards (RBPS) 12(iv) to third parties?

FAQ #1767 Will the facility be notified if the Agency learns that an affected individual has terrorist ties?

FAQ #1768 When will the Cybersecurity and Infrastructure Security Agency (CISA) grant access to the Chemical Security Assessment Tool (CSAT) Personnel Surety Program application if a facility chooses to meet Risk-Based Performance Standard (RBPS) 12(iv) by selecting Option 1 or Option 2 in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1772 Who will conduct the Chemical Facility Anti-Terrorism Standards (CFATS) Compliance Inspections for facilities in the Expedited Approval Program (EAP)?

Interestingly, FAQ #1742 was previously updated last week. Today’s update simply indents the three subparagraphs in the response.

CVI ICR

The first news item on today’s CFATS Knowledge Center points to today’s CISA information collection request (ICR) renewal notice in the Federal Register for the CVI program. This is the follow-up to the 60-day ICR notice published in March. There is no burden change reported in the renewal notice. CISA is soliciting comments on the ICR notice. Comments may be submitted via email to dhsdeskofficer@omb.eop.gov. All submissions must include the words “Department of Homeland Security” and the OMB Control Number 1670-0015.

Covid-19 Modified Inspections

The second news item for today notes that CISA has completed the pilot of COVID-19 modified compliance inspections that had first been announced on June 11^th, and I more completely detailed two days later. Today’s notice says: “Based on the pilot, CISA is now conducting modified compliance operations and high-priority compliance assistance.” Facilities will be notified of any compliance inspection scheduled by their Chemical Security Inspector or the Infrastructure Security Compliance Division (ISCD) headquarters.

There has been no change made to the CFATS Compliance Inspection Fact Sheet since November 2019.

Three CFATS ICRs

In today’s Federal Register DHS submitted their 30-day notice of intent to file information collection requests (ICR) for a variety of CFATS related programs. The 60-day notice for each of these ICR was submitted back in July and there were no comments filed on any of those submissions. Anyone wishing to comment on any of these three ICR has until October 26th to electronically submit their comments to Regulations.gov using the appropriate docket number listed below. Chemical Security Assessment Tool Renewal - OMB Number: 1670-0007 – Docket Number: DHS-2009-0033 I discussed the details of this in a previous blog but here is a quick summary of the data collections covered by this ICR (Title #collections @ time/collection):

CFATS Helpdesk 25,000 @ 0.25 hrs/request CVI Authorization 8,073 @ 1.00 hr/request CSAT User Registration 4,167 @ 1.00 hr/request CSAT Top Screen 4,167 @ 30.3 hrs/request SVA and Alternative SVA 825 @ 250 hrs/request SSP 825 @ 200 hrs/request

Chemical-Terrorism Vulnerability Information New – OMB Number: 1670-New – Docket Number: DHS-2009-0034 I discussed the details of this in a previous blog but here is a quick summary of the data collections covered by this ICR (Title #collections @ time/collection):

CVI Authorization 8,073 @ 1.00 hr/request Determination of CVI 250 @ 0.25 hrs/request Determination of a “Need to Know” 12,500 @ 0.25 hrs/request Disclosure of CVI Information 250 @ 0.25 hrs/request Notification of Emergency or Exigent Circumstances 250 @ 0.25 hrs/request Tracking Log for CVI Received 25,000 @ 0.08 hrs/request

Chemical Facility Anti-Terrorism Standards New – OMB Number: 1670-New – Docket Number: I discussed the details of this in a previous blog but here is a quick summary of the data collections covered by this ICR (Title #collections @ time/collection):

Request for Redetermination 1,041 @ 0.25 hrs/request Request for an Extension 1,454 @ 0.25 hrs/request Notification of a New Top Screen 6,250 @ 0.25 hrs/request Request for a Technical Consultation 1,454 @ 0.25 hrs/request

DHS Intends to Submit New CVI ICR

Earlier this week the DHS National Protection and Programs Directorate (NPPD) announced their intention to submit an information collection request (ICR) to the Office of Management and Budget to allow DHS to collect information from the public in support of the CFATS Chemical-Terrorism Vulnerability Information (CVI) program. This will be a new ICR covering data collection requirements not covered under current OMB authorizations. Comments on this proposed ICR must be filed by August 31st, 2009 via the www.Reguluations.gov web site (DHS-2009-0034). The following actions in support of the CVI program will be covered by this ICR:

CVI Authorization 8,073 @ 1.00 hr/request Determination of CVI 250 @ 0.25 hrs/request Determination of a “Need to Know” 12,500 @ 0.25 hrs/request Disclosure of CVI Information 250 @ 0.25 hrs/request Notification of Emergency or Exigent Circumstances 250 @ 0.25 hrs/request Tracking Log for CVI Received 25,000 @ 0.08 hrs/request

None of these data collection requirements are new to the CFATS program. They have been in place for quite some time. It appears that the new administration is being much more aggressive than its predecessor in identifying specific data collection requirement that must be approved by OMB. It will be interesting to see how this affects operations at OMB.