EAF SSP Submissions

The post below has incorrect information - for the correct process for submitting EAP submissions see my post at - http://chemical-facility-security-news.blogspot.com/2015/07/eap-submission-process-simplified.html  Posted 07-22-15 4:30 CDT.
 

Readers of this blog have seen me comment on the upcoming submission of expedited approval facility (EAF) site security plans (SSP) for the DHS Chemical Facility Anti-Terrorism Standards program for a couple of months now. All along I have been predicting that the Infrastructure Security Compliance Division (ISCD) would probably be establishing a new Chemical Security Assessment Tool (CSAT) tool for the on-line submission of the EAF SSP. Well, it appears that I was wrong.

I learned today that EAF facilities (starting July 16^th) will be able to start submitting their EAF SSP vis the current SSP Tool. The procedure that will be used will be very similar to that used for the submission of Alternative Security Plans (ASP).

Preparation

The first thing that the facility Submitter is going to need to do is to print a hard-copy of the CSAT SSP Questions Manual. Put pages 3 thru 49 in a binder and place a CVI Cover Sheet on the front and rear of the binder. Mark each of the pages from the manual with the following:

“WARNING: This record constitutes Chemical-terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classified information in accordance with 6 C.F.R. §§ 27.400(h) and (i).”

Now fill in all of the blanks that apply to your facility. Many of these will already be filled in (pre-populated) when you get to the on-line tool, but having all of the information in one place will make things much easier when you start completing the SSP.

Next you will want to get the DHS Guidance for the Expedited Approval Program. You can either print out the blank pages 60-61 and 64 thru 91, or fill them out on your computer and then print them out. The hard copy of page 61 will have to be signed by the facility owner. They would then be scanned as a single document so that an electronic copy can be uploaded to CSAT. I would then recommend that the hard copies be put into the same binder as the SSP Questions Manual pages. Fortunately you don’t have to worry about the CVI marking of these pages, ISCD has already done that.

Finally you are going to need an electronic copy of a facility site map or diagram, the more detailed the better and electronic copies of photographs of the facility, preferably at least one overhead shot and one of each COI storage area. Since they are going to be submitted as part of your SSP they should be electronically marked as described above.

Submission

The rest is time consuming, more than a little tedious, but rather simple. Sign on to CSAT go to the SSP tool and start filling out the responses to the questions using the binder prepared above. If there is a sever discrepancy between the binder data and any data that is prepopulated in the SSP (and it appears that the on-line data is incorrect), contact the CFAT Help Desk {(866) 323-2957} before proceeding.

Once you complete answering the questions on page 49 from the SSP Questions Manual the next screen should be the ASP Questions. Or it may possibly be a new page for similar EAF program questions (I haven’t actually seen these pages now). In any case, there will be a small number of questions about the data that you are going to submit. Answer those questions and upload the EAF document and photographs. There will be a couple of ‘are you sure you want to submit this now’ questions and then you are done.

When to Submit

If your facility had received its final tiering notice before June 16^th and your facility had notified ISCD on June 16^th that you intended to submit an EAF SSP, then you can start submitting your EAF SSP on July 16^th (next Thursday). If you notified ISCD after the 16^th you have 30 days from the date of that notification.

If you had received your final tiering notification before June 16^th you have until November 13^th to complete your EAF SSP submission. Your EAF notification letter from ISCD will confirm the date you can begin submission and the date by which that submission must be completed.

ISCD Publishes Latest CFATS Update – 05-01-15

This afternoon the folks at ISCD published their latest CFATS Update showing the current status of site security plans and the number of facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program. As we have seen over the last year or so, there has been a continued steady increase in the number of facilities that have had their site security plans authorized and approved.

Current SSP Statistics

ISCS is still not including in this update either an accounting of the number or status of facilities that have undergone a CFATS compliance inspection; the next step in the CFATS process. With less than 300 facilities yet to receive SSP authorization (and many of these may not have yet reached the point in the CFATS process where they have even submitted SSPs for review) I would expect more attention to have been applied to the compliance inspection portion of the program.

Covered Facilities

We are continuing to see a steady decline in the number of facilities that are still covered under the CFATS program. This month I have changed the graph to only show the data since January 2014 since there was a significant change (acceleration) in the rate of decline starting at that point (I described this in an earlier post).

I did a simple statistical analysis of the data provided in the chart above looking at the rate of change. Using the simple linear analysis tools in MS Excel® I determined the equation for that rate of decline and the R² value for that regression.

y = -63.025x + 4353

where: y = the number of covered facilities and

                      x = the number of months since January 2014

The R² value for this data set is R² = 0.9867. My statistics professor from a couple of decades ago considered an R² of > 0.99 to indicate a significant correlation between the two sets of data; this is pretty close. If this correlation continues (a BIG IF; no cause and effect relationship has been established) we could expect there to be no facilities in the CFATS program after sometime in the middle of October 2019.

This is, of course, a pretty silly application of statistical analysis, but since we have no statistical data from ISCD on the reasons for removal from the CFATS program we are reduced to playing these types of analytical games.

Expedited Approval Facility Process

With more than 91% of the currently covered facilities having an authorized site security plan under the current CFATS program, it would seem that there is much less need for the Expedited Approval Facility (EAF) process required by HR 4007. Depending on the actual content of the EAF requirements to be published next month by ISCD it might be easier for facilities with authorized SSPs to continue in the current approval process than change their existing plans to conform to the EAF plan.

A quick reminder hear, HR 4007 specifically provides ISCD with the authority {§2102(c)(4)(B)(ii)} to publish the EAF plan requirements without going through the publish and comment process required for a normal change in regulations. The deadline for the publication of the EAF guidance document is June 16^th and Tier 3 and 4 facilities without an approved SSP have 30 days (July 16^th) to decide if they want to use the EAF process instead of the standard SSP approval process.

While I suspect that there has been some discussion with industry about the EAF process there have been no public statement from DHS about how this program will work. I’m pretty sure that some of the procedural details are still being worked out.

HR 4007 – The EAF Process

This is part of a continuing discussion of the recently passed HR 4007, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014. As promised in one of the earlier posts this post will look at the process to be used by expedited approval facilities (EAF).  The previous postings in this series were:

HR 4007 Sent to the President

HR 4007 – An Overview

HR 4007 – Implementation Deadlines

HR 4007 – Current Site Security Plans

HR 4007 – Expedited Approval Facility

HR 4007 – The Clock Starts Ticking

HR 4007 – DHS Security Suggestions

Establishing the Program

As I mentioned in an earlier posting DHS has 180 days to get the EAF program established. Thus, by June 16^th, 2015 we should have the guidance for the program from DHS. Remember, DHS is specifically not required to go through the publish and comment cycle nor do they need to receive OMB clearance of this program, either the guidance document or the information collection request (ICR) under 44 USC 3507. This means that we are unlikely to receive much advance notice of the provisions in the guidance document.

DHS has three basic options on how they are going to proceed with this EAF program development:

● Publish a guidance document that is little more than a list of required minimum security measures that a Tier 3 and/or Tier 4 facility would have to have to obtain approval of their site security plan (SSP). Facilities would then certify compliance and submit their SSP using the current CSAT tool.

● Develop a new CSAT tool specifically for the EAF program. The tool would be a template {authorized, but not required, under §2102(c)(4)(H)} where facilities would fill in the appropriate blanks that would be a substitute for the current CSAT SSP tool and then certify compliance.

● A combination of the two above.

I would like to see the second option. It would seem to me to be the simplest way to proceed for the EAF owners, which was clearly the congressional intent. The cheapest and easiest way out for ISCD though would be the first option since it would only require publishing a new guidance document (that would have to be published in any case) and would not require any substantive changes to CSAT. I suspect that the blended approach will be what we actually see; ICSD will publish the guidance to meet their 180 day deadline and then at some future date put the CSAT template into use.

Facility Participation

Starting on June 16^th CFATS covered facilities then assigned to Tier 3 or Tier 4 that do not already have approved site security plans will have 30 days to look over and assess whether or not they want to continue to attempt to have their current site security plans approved or whether they want to seek approval under the EAF program. This 30 day period could be important to facilities since they are required to give ISCD 30-days’ notice {§2102(c)(4)(D)(iii)} before submitting the certification and SSP.

Existing facilities would have until November 13^th, 2015 (120 days) to submit their certification and SSP. Because of the 30-day notice requirement any current facility that has not notified ISCD by October 14^th, 2015 that they intend to submit and EAF certification and SSP will have to go through the current SSP process.

While DHS will be specifying minimum security requirements in their guidance for facilities participating in the EAF program, those minimums are not set in stone. Congress has given facilities the option to use lesser security measures as long as they explain in their site security plan how those measures actually meet the requirements of the risk-based performance standards {§2102(c)(4)(B)(ii)}. But, DHS still has the final responsibility and authority to decide if those standards are met.

EAF Site Security Plan Approval

The whole purpose of the EAF program is to expedite the SSP approval process. With this in mind Congress provided a 100-day time limit for DHS to make a decision that the SSP is ‘facially deficient’ or obviously does not “address the security vulnerability assessment and the risk-based performance standards for security for the facility” {§2101(7)}. Lacking such an assessment the SSP will be approved.

Congress did not intend for chemical security inspectors to be involved in the EAF approval process, but they did not prohibit their involvement either. The decision is supposed to be made based on four factors {§2101(7)}:

● The facility’s site security plan;

● The facility’s Top-Screen;

● The facility’s security vulnerability assessment; or

● Any other information.

That ‘any other information’ is specifically and broadly defined to include any information “the facility submits to the Department; or the Department obtains from a public source or other source”. That covers just about any means the Department decides to utilize, as long as it is done within 100 days of the submission.

Disapproved EAF SSPs

If during the 100 day DHS review of the SSP, or after a compliance inspection (I’ll look at compliance inspections in more detail in a later post) of the facility after the SSP is approved, the Secretary (read ISCD) determines that the security measurements are “insufficient to meet the risk-based performance standards based on misrepresentation, omission, or an inadequate description of the site”, the Secretary has two options {§2102(c)(4)(G)(ii)(I)}:

● Require additional security measures, or

● Suspend the certification of the facility.

In either case DHS is required to provide written notice that includes “a clear

explanation of each deficiency in the site security plan”; this would include specific suggestions for additional security measures. If the deficient facility would like to remain in the EAF program they would then have 90 days to submit a new certificate and SSP and DHS would have 45 days to review the new submission. If the facility declined to resubmit an EAF certification, they would have 120 days to submit a full site security plan or an alternative site security plan.