ISCD Updates 9 FAQ Responses – 7-20-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to six frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. There were also two news items on today’s CFATS Knowledge page; first, a note about the 30-day ICR renewal notice published in today’s Federal Register for the Chemical-Terrorism Vulnerability Information (CVI) program. The second note is an update of information about the COVID-19 modified compliance inspection program.

FAQ Updates

The FAQ updates are part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1742 What criteria does the Cybersecurity and Infrastructure Security Agency (CISA) use to determine if a Site Security Plan (SSP) submitted through the Expedited Approval Program (EAP) is facially deficient?

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1750 What happens after I submit my Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1751 If my facility has been issued a “letter of acceptance” through the Expedited Approval Program (EAP), but then the Cyber Infrastructure Security Agency (CISA) discovers that the measures in the Site Security Plan (SSP) insufficiently meet the risk-based performance standards (RBPS) during a Compliance Inspection, what happens?

FAQ #1752 Who can certify a facility’s Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1766 Does the Cybersecurity and Infrastructure Security Agency (CISA) allow facilities to contract out the submission of information under Option 1 or Option 2 for the Personnel Surety Program in Risk-Based Performance Standards (RBPS) 12(iv) to third parties?

FAQ #1767 Will the facility be notified if the Agency learns that an affected individual has terrorist ties?

FAQ #1768 When will the Cybersecurity and Infrastructure Security Agency (CISA) grant access to the Chemical Security Assessment Tool (CSAT) Personnel Surety Program application if a facility chooses to meet Risk-Based Performance Standard (RBPS) 12(iv) by selecting Option 1 or Option 2 in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1772 Who will conduct the Chemical Facility Anti-Terrorism Standards (CFATS) Compliance Inspections for facilities in the Expedited Approval Program (EAP)?

Interestingly, FAQ #1742 was previously updated last week. Today’s update simply indents the three subparagraphs in the response.

CVI ICR

The first news item on today’s CFATS Knowledge Center points to today’s CISA information collection request (ICR) renewal notice in the Federal Register for the CVI program. This is the follow-up to the 60-day ICR notice published in March. There is no burden change reported in the renewal notice. CISA is soliciting comments on the ICR notice. Comments may be submitted via email to dhsdeskofficer@omb.eop.gov. All submissions must include the words “Department of Homeland Security” and the OMB Control Number 1670-0015.

Covid-19 Modified Inspections

The second news item for today notes that CISA has completed the pilot of COVID-19 modified compliance inspections that had first been announced on June 11^th, and I more completely detailed two days later. Today’s notice says: “Based on the pilot, CISA is now conducting modified compliance operations and high-priority compliance assistance.” Facilities will be notified of any compliance inspection scheduled by their Chemical Security Inspector or the Infrastructure Security Compliance Division (ISCD) headquarters.

There has been no change made to the CFATS Compliance Inspection Fact Sheet since November 2019.

ISCD Announces COVID-19 Modified Inspections

Today the CISA Infrastructure Security Compliance Division (ISCD) published a notice on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center announcing that they were planning on resuming modified CFATS compliance inspections this month. The notice states:

“Effective June 2020, CISA will begin piloting three options for modified compliance operations to verify that high-risk facilities are maintaining the security measures in their security plans during this pandemic operational environment while also limiting in-person interactions between Chemical Security Inspectors (CSIs) and facility personnel. CSIs will be in contact if your facility had an inspection postponed or have an upcoming inspection. If you have any questions, please contact your local CSI or email CFATS@hq.dhs.gov.”

While ISCD announced back in March that they were stopping most site visits (including inspections) in support of COVID-19 restrictions, they never did complete stop their inspections. According to the CFATS Monthly Statistics page there were 4 compliance inspections completed last month and the earlier version of that page reported 2 compliance inspections in April. There were no details provided as to why ISCD decided to conduct these six inspections despite the COVID-19 restrictions. My guess is that the inspected facilities had failed previous inspections and CISA decided that it was important to ensure that the facilities were currently in compliance.

No details are available for the three options mentioned in today’s notice. I would expect that facilities that are expecting routinely scheduled re-inspections may be offered an option for an electronic meeting with the CSI assigned to the facility to review the current status of the facility operations and security measures. This might also include a requirement for live videos of security measures.

I would suspect that for facilities that are currently closed, I would expect that ISCD might want to send a CSI to physically visit the facility and tour the facility with a designated representative to ensure that appropriate measures have been taken to keep the facility secure while under limited operations due to the COVID-19 pandemic.

I have not idea what the third (middle?) option would be.

I will see what I can find out. Facility security managers should certainly reach out to their assigned CSI.

ISCD Updates CFATS Web Site

Yesterday the DHS Infrastructure Security Compliance Division (ISCD) updated their Chemical Facility Anti-Terrorism Security (CFATS) program web site. Links were added for two fact sheets; one dealing with the compliance inspection program and one dealing with the personnel surety program (PSP).

The compliance inspection fact sheet is the same one that I wrote about last Friday. I would not have even mentioned this except for the fact that whenever the landing page is changed, I go back and check all of the links on the page to see if there were any additional changes made since the last landing page change. In this case there was; a week ago the PSP page was changed to add a link to a new fact sheet about the relatively new identifying people with terrorist ties portion of the PSP.

The first page of the two-page fact sheet is a basic description of this new portion of the PSP program. It contains no new information and everything there has been thoroughly (in my not so humble opinion) discussed here in this blog on a number of different occasions. The second page is a short list (3) of frequently asked questions (FAQ) about the program that provide a little more emphasis and one nugget of new information about the program.

In response to an implementation timing question, the fact sheet reiterates the previous information provided that ISCD, through the facility’s Chemical Security Inspector, will notify the facility when it needs to start modifying their Site Security Plan (SSP) to include implementation of the terrorist screening portion of the PSP. They emphasize this point by stating (in bold print): “Facilities should wait to be contacted by the Department before altering their SSP/ASP or attempting to submit any information for vetting.”

The fact sheet then goes on to explain that ISCD will “provide an optional supplement [emphasis added], which discusses information the Department will consider and review in order to make a determination on the facility’s ability to satisfy RPBS 12(iv)”. Hopefully, this guidance will provide the information that I had complained about being absent from the Compliance Inspection Fact Sheet. It is more than a little disappointing that a link to this ‘optional supplement’ has not been provided on the PSP web site.

The interesting nugget of information that I referred to earlier is found in the response to the second FAQ about how ISCD will be providing the notification to begin implementing the terrorist screening portion of the PSP. It states that: “Initially, DHS will be working with certain

facilities to complete this requirement during compliance inspections.”

This helps explain the confusion raised in the latest CFATS Quarterly where ISCD explained that the first compliance inspection that included Terrorist Screening Data Base (TSDB) personnel vetting was conducted on January 28th, 2016 and the first SSP change with an updated PSP was approved a little over one-month later. This was probably the same facility in both instances.

In any case, ISCD is continuing to parcel out new information about changes in their CFATS program. I hoping, however, that they are directly notifying covered facilities about these changes in their web site. The average facility security officer (for most facilities a second job for someone) does not have time to do a daily detailed perusal of the CFATS web site to ferret out these changes. Though to be fair, ISCD does a good job of annotating when web site changes are made. That is much more than I can say for other DHS agencies, like TSA for instance.

ISCD Publishes March 2016 CFATS Update

This morning the folks at the DHS Infrastructure Security Compliance Division (ISCD) published their latest update information about compliance activities surrounding the implementation of the Chemical Facility Anti-Terrorism Standards (CFATS) site security plan program. The numbers show continued improvement in the number of facilities that have approved site security plans (SSPs) and a continued increase in the number of compliance inspections the Chemical Security Inspectors (CSI) have done.

	January 2016	February 2016	March 2016
Covered Facilities	3,088	3,083	3,074
Authorized SSPs	3,285	3,305	3,324
Approved SSPs	2,354	2,391	2,449
Compliance Inspections	450	532	624

ISCD is continuing to report more facilities with authorized SSPs than there are currently facilities in the program. ISCD has yet to explain whether they are continuing to report authorized SSPs for facilities that are no longer in the program or if they are just reporting multiple versions of the SSPs for the facilities that remain in the program. In either case, it makes it impossible to tell how many more SSPs that ISCD has to authorize or approve.

The March numbers (actually for activities in February) show an increased rate in approvals and compliance inspections. If the rate for this last month continues, ISCD should complete the SSP approval process early next year; unless, of course, they are having the same number with counting approved SSPs that they are with authorized SSPs.

The pickup in the rate of compliance inspections is important, especially since the same folks that are doing the authorization visits and approval inspections are doing the compliance inspections. As we see fewer of the non-compliance inspections being done in the future, we should see a further increase in the rate of compliance inspections.

As the number of compliance inspections increases it is going to become more important for ISCD to correct the lack of reporting on actual compliance results. More important than just the numbers of facilities here is some indication at how well the industry is doing in complying with their negotiated SSP performance standards. Last year the GAO reported a poor pass rate on the early compliance inspections and a lack of enforcement action. It would certainly be interesting to see if that has changed.

BTW: The link on the Chemical Security landing page for this CFATS update takes you to a link for last month’s update, not the March update. I have reported the direct link to the March 2016 update.

CFATS – What to Expect from an Inspection

Today the DHS Infrastructure Security Compliance Division (ISCD) published a new document for their Chemical Facility Anti-Terrorism Standards (CFATS) program entitled “What to Expect from a Chemical Facility Anti-Terrorism Standards (CFATS) Inspection”. The document provides some basic information CFATS covered facilities need to know about authorization inspections and compliance inspections.

The sixteen page manual (in relatively large type) does not go into a great deal of detail, but the information provided is certainly valuable for organizations going through one of the two inspections for the first time. Some of the larger bullet point discussions include:

• What Is an Authorization Inspection;

• What Is a Compliance Inspection;

• Before an Inspection;

• Expediting the Onsite Visit;

• Preparation for the Inspection Team;

• What Documents for a Compliance Inspection;

• Who Should Be Present Onsite or Available During the Inspection;

• During the Inspection;

• Inspection Outbrief;

• Post-Authorization Inspection;

• Post-Compliance Inspection;

I used the term ‘bullet point’ above for a very specific reason. This booklet is essentially the “What to Expect from a CFATS Inspection” presentation by Dave Schmidt at the 2015 Chemical Sector Security Summit. Still it is valuable to have this more generally available and it is listed on the DHS Critical Infrastructure: Chemical Security web page.

BTW: There have been a number of new informational offerings from ISCD over the last two months and that is a good thing. BUT, there is still no word on when the CFATS Personnel Surety Program is going to get kicked off by the Federal Register Notice describing how the PSP will work. It took almost a year and a half to get the OMB approval of the ICR, let’s hope it does not take that long to get departmental approval for the PSP notice.

ISCD Publishes August CFATS Fact Sheet for August 2015

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) published the August 2015 Chemical Facility Anti-Terrorism Standards (CFATS) Fact Sheet. There was little change in the number of authorized Site Security Plans (SSPs) and an even smaller change in the number of covered facilities. We do see a significant continued improvement in the number of facilities with approved SSPs.

The table below provides a comparison of the numbers in the July 2015 and August 2015 Fact Sheets.

	August 2015	July 2015
Covered Facilities	3,223	3,229
Authorized SSPs	3,139	3,121
Approved SSPs	2,021	1,935

CFATS Fact Sheet Data

It is too early to see any significant change in the Approved SSP numbers due to the Expedited Approval Program. Facilities were able to start submitting EAP SSPs about half-way through the month, but the folks at ISCD still have to review and approve those submissions. The Department has up to 100 days to complete that review. I suspect that we could start to see some of those approval affecting the September 2015 Fact Sheet numbers.

ISCD is still not reporting the number of compliance inspections conducted or the results of those inspections. According to a recent GAO report (pg 28), as of February of this year there had been 69 compliance inspections completed with only 35 of those facilities having passed the inspection. The GAO reported that ISCD was working with the non-compliant facilities instead of taking any of the authorized enforcement activities available to the Department.

NOTE: There had been a minor coordination issue earlier in the day with the publication of the Fact Sheet. The Critical Infrastructure: Chemical Security web page change which provided the link to the new fact sheet was published before the link became active so the page was for a short time pointing at the July 2015 Fact Sheet.

New GAO Report on CFATS Program

Last Friday the Government Accountability Office (GAO) published their latest report on the Chemical Facility Anti-Terrorism Standards (CFATS) program. While the report did identify some areas where the DHS Infrastructure Security Compliance Division (ISCD) needed to improve the CFATS program it generally noted that significant improvements had been made and previously identified problems had generally been corrected.

The GAO Report identifies four areas of concern:

∙ DHS has not taken steps to mitigate errors in some facility-reported data;

∙ DHS does not have reasonable assurance that it has identified all of the nation’s highest-risk chemical facilities;

∙ DHS cannot ensure consistency in how it addresses noncompliance in the CFATS program because it does not have documented processes and procedures; and

∙ DHS’s CFATS performance measure does not reflect security measures that facilities have implemented and that ISCD has verified.

Top Screen Data Reporting

The GAO identifies a problem with the reporting of Distance of Concern DOC for the release of toxic chemicals in the Top Screen. The CFATS Top Screen requires the facility to calculate the down wind distance that a worse case discharge of a toxic release chemical of interest (COI) will cause a significant problem. The tool that facilities are required to use is the EPA’s RMP*Comp.

The user inputs the maximum amount of a Toxic COI that they have on site, enters some other basic information (see pages 42 and 43 of the Top Screen User’s Manual) and the tool calculates DOC which is then reported in the Top Screen. DHS then uses this information as part of its determination of whether or not a facility may be covered under the CFATS program as a facility at high-risk of terrorist attack.

The GAO used available Top Screen data to verify the DOC reported for a ‘a generalizable sample of facilities’. Using that data the GAO report indicates that 44% of the facilities (2,700 facilities) had errors in the reported DOC and about 43% under-reported the DOC. It goes on to note that a common potential reason for the under-reporting may be due to one difference in the way the tool is used to calculate EPA and CFATS DOC information, the CFATS program does not allow facilities to take credit for passive mitigation measures such as dikes around tank farms.

The Report provides an example of a facility with more than 200,000 lbs of anhydrous ammonia  (AA) reported in its Top Screen that reported a DOC of 0.9 miles and GAO found a minimum possible distance of 2.4 miles when they calculated the DOC using R*Comp. I have replicated that work and found that there was no way to come up with a DOC of 0.9 miles regardless of whether or not mitigation measures were used. I suspect that the facility used their largest storage tank data (as they would for EPA reporting) instead of the total amount of AA on site as required by DHS. It is remotely possible that GAO’s figure of 0.9 miles came from the DOC value reported for the Area of Highest Quantity (AHQ) instead of the total COI.

The GAO report notes that ISCD has all of the information in its Top Screen Database necessary to verify the DOC data, but does not choose to do so. The first part is not necessarily true. The RMP*Comp tool, when calculating the DOC for materials that are gasses at 25°C, asks if the material is liquefied, and if liquefied whether it is liquefied by refrigeration or by pressure. That information is not included in the Top Screen and makes a big difference in the DOC. This is not important for most toxic release COI, but it is for AA. Using the Report’s example with AA you could get DOC’s of 2.4 miles (unliquified) 6.5 miles (liquefied under refrigeration) vs 8.0 miles for liquefied by pressure (all in an urban setting).

The thing that the GAO failed to take into account in pointing out this deficiency is that ISCD does not verify any of the information provided in the Top Screen. It is true that they could generally check the DOC value (using the ‘unliquified’ data from RMP*Comp), but that might not give a true picture for all COI. But given the fact that ISCD is accepting all other reported information, it would be unusual for them to pick out this one item that could be partially verified in a portion of the instances where it is reported.

Given the fact that the Report notes that only 43% of the discrepancies that it noted were under-reports, it seems to me that their data would tend to indicate that there were systemic problems with the use of the RMP*Comp tool. As ISCD moves forward with implementing the results of the outside evaluation of their risk ranking methodology, they should consider taking this calculation out of the hands of the facility and do the calculations in-house.

The GAO has two recommendations for this area:

∙ Provide milestone dates and a timeline for implementation of the new Top-Screen and ensure that changes to this Top-Screen mitigate errors in the Distance of Concern submitted by facilities, and

∙ In the interim, identify potentially miscategorized facilities with the potential to cause the greatest harm and verify the Distance of Concern these facilities report is accurate.

Facility Identification

The report outlines the measures that DHS has taken to identify facilities that have not submitted Top Screens, but should have done so. While they had conducted earlier out-reach activities, the effort was expanded after the West Fertilizer incident and the issuance of the President’s Executive Order on Increasing Chemical Facility Safety and Security. As a result of these latest efforts just over 3,000 potentially non-compliant facilities were identified and contacted by DHS.

More than 1500 had already submitted Top Screens; the ‘new’ identification was apparently based on differing naming or location information. Over three hundred were exempted from CFATS regulations. Of the remaining just over 1,000 have now submitted Top Screens and just 24 of those have been designated as high-risk facilities covered under the CFATS program with 44 still pending. ISCD is continuing to investigate other means of identifying potentially non-compliant facilities.

The report indicates an interesting problem. ISCD has asked States for information on the chemical facilities that they regulate as part of this program. California recently complied, identifying over 46,000 facilities (ISCD has only processed 50,000 Top Screens since the program started) which ISCD is now going through. Only 13 other States have supplied similar lists.

The GPO did not provide any recommendations for DHS on this issue.

Compliance Inspection Issues

The Report starts of the discussion of this issue with a review of actions that ISCD has taken to increase their rate of site security plan approvals and notes that ISCD has made substantial improvements in that approval rate. Interestingly, even though the GAO calculated that ISCD would have the approval backlog eliminated next year, they did not mention that the EAP process will almost certainly further accelerate the SSP approval process.

The Report then notes that ISCD has completed 83 compliance inspections of facilities with approved site security plans. There is no discussion of how well that reflects the requirement for ISCD to inspect facilities within one year of their site security plan being approved. The number seems low, but it will almost certainly increase as ISCD has fewer authorization inspections to complete.

The GAO reports that nearly half of the facilities inspected have not completely implemented all of the security measures outlined in their site security plans, which of course means that the facilities are out of compliance. The Report notes that ISCD is working with the facilities to get them into compliance.

The GAO notes that none of the non-compliance sanctions available to the Department (including Compliance Orders, Civil fines and even Cease Operations Orders) have been used by the Department to-date. While ISCD is ‘working with’ the facilities, the GAO reports that they do not have any written processes or procedures in place to document the progress that is being made at those facilities. Nor, apparently, does ISCD have any written processes or procedures in place on how they determine whether or not a facility is in compliance.

The GAO had one recommendation for this area:

∙ Develop documented processes and procedures to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans.

CFATS Performance

The last area of concern identified in the Report concerns the program reporting done by ISCD to DHS. This annual reporting requirement is used by DHS and the GAO to assess program performance and efficacy. One of the pieces of information included in that report is the number of security measures implemented by facilities. The GAO notes that ISCD does not distinguish between those measures implemented before the facility site security plans were approved, which measures have been reported as planned, or which of the planned measures have been implemented. Thus, the GAO reports that the numbers do not reflect changes brought about by the CFATS program and ISCD actions in support of that program.

The GAO had one recommendation for this area:

∙ Improve the measurement and reporting of the CFATS program performance by developing a performance measure that includes only planned measures that have been implemented and verified.

Moving Forward

DHS has acknowledged the four recommendations in the GAO report and has reported their intended actions to be taken in response to those recommendations. GAO confirms that if those actions are taken as reported, the recommendations would be considered as completed.