More Details on Modified CFATS Compliance Inspections

I received a response to my email to CISA Infrastructure Security Compliance Division (ISCD) about the temporary changes that are being made to the Chemical Facility Anti-Terrorism Standards (CFATS) compliance inspection process that I briefly mentioned earlier this week.

First, ISCD makes is clear that they are continuing to work out the details of the modified inspection plan in coordination with each facility being inspected. Not only is ISCD trying to work out an effective compliance inspection regime during the COVID-19 pandemic, but they also realize that each facility is going to have a unique set of circumstances that needs to be taken into account so that the inspections do not unduly endanger facility personnel or chemical security inspectors.

The ‘three options’ reported on CFATS Knowledge Center have been more completely explained in this email. They are:

1. Compliance Audits: Chemical Security Inspectors (CSIs) request, remotely review, and  then lead a discussion with facility personnel on records and documentation related to  the facility’s chemical(s) of interest (COI) and the security measures described in the  facility’s security plan.

2. Compliance Audits with Facility Perimeter Walkaround: In addition to the Compliance Audit, this includes CSIs conducting a walkaround of the covered facility’s perimeter to review in person the facility’s perimeter security measures.

3. Modified COVID-19 Compliance Inspections: CSIs conduct an onsite inspection while minimizing face-to-face time and maintaining social distancing as much as possible.

These briefly describe inspection modality changes do not reflect any material change in the CFATS inspection process. These are evolving interim measures that allow DHS inspectors to verify that covered facilities continue to maintain their security programs during this emergency. ISCD can be expected to work closely with facilities to ensure that these modified inspections are effective and safe.

The use of the term ‘audits’ in options 1 and 2 imply (in my opinion) that a successful compliance inspection has already been conducted at the facility. This would allow chemical security inspectors, where a periodic compliance inspection is called for, to assure themselves that the facility is remaining generally in compliance during reduced operations or facility closures during the pandemic.

If ISCD is using any of these three modified inspection modalities at facilities where a compliance inspection has not yet taken place, I would expect that there would be a more complete inspection that would take place after the COVID-19 emergency has passed.

One final point was made in the email I received. ISCD is still not conducting any authorization inspections during the COVID-19 emergency. The detailed inspection and facility review that is required to provide ISCD with the information necessary to authorize a site security plan cannot be safely conducted in a safe social-isolation environment.

I would love to hear from facilities or CSI that have participated in one of these modified inspections, on or off the record.

ISCD Publishes Updated and New Fact Sheets

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The ‘Documentation’ section of the page now includes links to four new CFATS fact sheets for industries that are not normally considered chemical industries. They have also updated their two inspection fact sheets.

Industry Fact Sheets

The four new industry fact sheets are for:

• Pools and Water Parks;

• Wineries;

• Breweries; and

• Fisheries and Hatcheries.

Sharp eyed readers will note that three of these are included in the list of fact sheets that I mentioned in my earlier blog post about the CFATS Outreach Implementation Plan FY 2018. The last three fact sheets were reportedly released in 2017, but that I had not seen them published on the CFATS web site. The pools and water parks sheet was not mentioned in the earlier document. The lab factsheet that I had also mentioned earlier as not having been seen was not included in today’s link publication.

Much of the information provided in the four fact sheets is identical. Not surprisingly, the lists of ‘typical’ DHS chemicals of interest (COI) used by the facilities is slightly different in each case. Three of the factsheets (not the one for breweries) listed included brief comments about the agricultural exemption; mainly for fertilizers applied to land associated with the facility. The fisheries factsheet however, notes that fisheries and hatcheries are not included in that exception.

Inspection Fact Sheet Updates

The two new inspection updates deal with preparing for:

• Authorization Inspection; and

• Compliance Inspection

These are both complete re-writes of fact sheets written in 2014 and 2016 respectively. As with the previous versions, neither of these documents real information valuable for passing of the respective inspections, but they both provide valuable information that will be helpful in preparing for the conduct of the inspections.

One interesting piece of information is included in the compliance inspection fact sheet and it relates to the scheduling of those inspections. It notes that:

“ISCD compares eight factors (seven static and one dynamic) in an automated calculation to schedule CIs. Facilities with a higher score are prioritized. Static factors included in this calculation are a facility’s tier, number of planned measures [emphasis added], the time since the last inspection, and compliance history. The eighth factor changes based on new and emerging requirements.”

The issue of planned measures has been an issue since compliance inspections were started in the CFATS program. ISCD gave facilities credit for security measures that could not be implemented immediately for some reason; usually dealing with capital expenditure, long lead time equipment and the such. As long as the facility had budgeting in place and a firm schedule for completion documented, credit was given for those measures in the approval of the facility’s site security plan. During a large number of the initial compliance inspections chemical security inspectors found that facilities were not complying with their planned implementation schedules. While mitigation measures had to be in place for these planned measures to be approved by ISCD, facilities would not be fully secured until those planned measures were completed. ISCD is obviously taking these planned security measures very seriously.

To my disappointment the Expedited Approval Program appears to have been short changed in its mention in these two documents. It is briefly mentioned in a footnote in the authorization inspection document (mentioning that an authorization inspection is not required), but it is completely missed in the compliance inspection fact sheet. The consequences for a failed compliance inspection for EAP facilities is completely different from those for a facility that has gone through the standard site security plan approval process and should have been mentioned in the compliance inspection fact sheet.