Latest GAO Report on CFATS Looks at Regulatory Collaboration

Last week the Government Accountability Office (GAO) published their latest report on the Chemical Facility Anti-Terrorism Standards (CFATS) program. This report looks at how the CFATS program interacts with eight other Federal chemical safety and security programs at both the Agency and installation levels. Includes recommendation to legislate additional chemical security requirements for water treatment facilities.

Other Programs

The report looks at how much of an overlap there is in security requirements between the CFATS program and eight other Federal regulatory programs. Those programs are:

• Explosives materials Program (ATF),

• Maritime Transportation Security Act program (Coast Guard),

• Hazardous materials transportation program (DOT),

• Resource Conservation and Recovery Act program (EPA),

• Risk Management Program (EPA),

• America’s Water Infrastructure Act program (EPA),

• Pipeline Security Program (TSA), and

• Rail Security program (TSA)

Using a very broad (and loosely defined as “engage in similar activities") term ‘align’ the GAO reports that all eight programs align with “six of 18 CFATS standards regarding restricting area perimeter; securing site assets; screening and controlling access; deterring, detecting, and delaying an attack; deterring theft and diversion, and deterring insider sabotage” {pg 21, using .PDF page numbers}. A table spanning three pages outlines which CFATS risk-based performance standards (RBPS) each of the Federal programs align with.

What is clear from a detailed reading of the report is that GAO, in looking for alignment, was looking for areas where regulatory compliance with another program could be used, at least in part, to comply with CFATS security plan requirements under the RBPS. While the GAO admits that some program coordination has taken place under the EO 13650 Working Group (see their lite web page) it takes DHS to task for not continuing to work on clarifying where compliance with other programs fits into CFATS compliance. The first GAO recommendation addresses this:

“The Secretary of DHS should direct its chemical safety and security programs to collaborate with partners and establish an iterative and ongoing process to identify the extent to which CFATS-regulated facilities are also covered by other programs with requirements or guidance that generally align with some CFATS standards.” {pg 53}

More specifically, recommendation five goes on to say:

“The Director of DHS’s Cybersecurity and Infrastructure Security Agency should update CFATS program guidance or fact sheets to include a list of commonly accepted actions facilities may have taken and information they may have prepared pursuant to other federal programs, and disseminate this information.” {pg 54}

Further recommendations are made to EPA, ATF and DOT to look at how their programs interface with the CFATS program.

DHS concurred with both of the above recommendations and had this specific response to recommendation five:

“DHS concurred with recommendation 5, stating in its letter that, among other actions, CISA will update or create a new guidance document or fact sheet by December 31, 2021, that includes a list of commonly accepted actions CFATS-regulated facilities may have taken and information they may have prepared pursuant to other federal programs and disseminate this information.” {pg 56}

Water Treatment Facility Security

This report states that water treatment and wastewater treatment facilities that are exempt from the coverage of the CFATS program “may present attractive terrorist targets due to their large stores of potentially high-risk chemicals and their proximities to population centers” {pg 47}. They go on to note that an earlier report “found that the Risk Management Program regulates at least 1,100 public water system and 500 wastewater treatment works facilities for many of the same chemicals at the same threshold quantities as the CFATS program’s chemical release attack scenario” {pgs 47-8}.

There are significant differences in the security aligned requirements of both the Risk Management Program and Water Infrastructure Act programs, and the CFATS program. “For example, the Risk Management Program and Water Infrastructure Act programs do not contain requirements or guidance regarding security training or background checks. In addition, while the Water Infrastructure Act program contains guidance on cybersecurity, the Risk Management Program does not.” {pg 48}

Water treatment facilities are also subject to the voluntary security guidelines of the American Water Works Association’s security practices management standard. They go on to note that EPA program officials reported that “the voluntary water and wastewater standards are not as comprehensive as the CFATS program’s 18 standards, and it is unclear the extent to which public water systems and wastewater treatment works implement the standard because its use is entirely voluntary” {pg 50}. Further, the report notes that DHS officials stated that “the general alignment of Water Infrastructure Act requirements or guidance with some CFATS standards may not reflect the level of security achieved because, unlike the CFATS program, the Water Infrastructure Act program does not include verification measures” {pg 51}.

The GAO makes two similar recommendations (#6 and #7) to DHS and the EPA about working with the other agency to “to assess the extent to which potential security gaps exist at water and wastewater facilities and, if gaps exist, develop a legislative proposal for how best to address them and submit it to the Secretary of Homeland Security and Administrator of EPA, and Congress, as appropriate” {pg 54}.

Commentary

The Working Group formed under Obama’s chemical safety and security executive order kind of faded away during the Trump administration. There was certainly some ongoing coordination there was no incentive (and many political disincentives) to forge any new regulatory efforts. This is very likely to change under the Biden Administration, though it will not likely be a top priority. Congressional efforts, if the two committees in the House can better their coordination, may be more persuasive.

The one CFATS legislative initiative that I think may be possible this session may be the introduction of bills to address the water facility security issue. The chance of their passage is still rather small given the CFATS three-year extension passed last year, but significant committee work and hearings this session may bear fruit in the 118^th Congress.

ISCD Updates Whistleblower Information

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the landing page for the Chemical Facility Anti-Terrorism Standards (CFATS) program, providing more information on how someone can report various concerns about the implementation of the CFATS program at facilities around the country. The new information includes:

• Links to a new ‘Reporting CFATS Violations’ web page;

• Links to a new ‘Report a Violation’ flyer;

• A new email address that can be used to report violations; and

• A brief blurb on the landing page describing all of the above.

Other than the email address there is no new information here. There is an understandable minor expansion of what can/should be reported; the new documentation specifically identifies failure to submit a Top Screen (which is, for some reason, not actually named in the flyer) as one of the things that should be reported to ISCD. That was never specifically mentioned in earlier discussions about CFATS’ violations reporting.

The new version of the landing page also provides a link to another ‘new’ page and an older document. The ‘new’ page is ‘Actions to Improve Chemical Facility Safety and Security - A Shared Commitment. It is dated December 16^th, 2016, but this is the first time that I have seen it. The document linked to from that page is the final report on the response by EPA, OSHA and DHS to the President’s (Obama) Executive Order on Chemical Safety and Security (EO 13650). That reporting document was published in May 2014 and I commented on it soon after.

OMB Approves EPA Chemical Safety Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that they had approved a final rule from the EPA implementing changes to the Clean Air Act regulations; the “Modernization of the Accidental Release Prevention Regulations under Clean Air Act”. This rule addresses changes to the Risk Management Program identified as a result of the President’s EO 13650 review of chemical safety and security programs. The notice of proposed rulemaking was published in March of this year. I did a series of blog posts about that NPRM.

This rule will certainly be included in any list of accomplishments of the Obama Administration; whether or not it withstands congressional review in the 115^th Congress. For better or worse this will be a signature piece of chemical safety regulation.

It will be interesting to see if the EPA tried to craft a rule that would withstand that review or whether they went with a straight implementation of the NPRM. I suspect the later, given the surprising (in most quarters) election of Donald Trump instead of Hillary Clinton to head the next administration. Clinton would have been expected to veto any congressional review negating this rule.

New EO 13650 Chemical Safety Documents

Last week the Occupational Safety and Health Administration (OSHA) updated their “Actions to Improve Chemical Facility Safety and Security” web site with a notice that EO 13650 Working Group had completed a number of new initiatives. Those initiatives included:

• The Working Group published Executive Order 13650 Regulatory Programs Overview

• The Working Group developed the Regulatory Frequent or Critical Violations resource

• OSHA and EPA published Fact Sheet: The Importance of Root Cause Analysis During Incident Investigation

• OSHA published Fact Sheet: The Use of Metrics in Process Safety Management (PSM) Facilities

• OSHA and EPA published the Process Safety Management and Risk Management Plan Comparison Tool

The links in that notice all go to the same place, the EO 13650 “Completed Actions: Modernizing Policies and Regulations” web page. That page further provides links to the following useful fact sheets and program information:

• The Importance of Root Cause Analysis During Incident Investigation;

• The Use of Metrics in PSM Facilities; and

• PSM and RMP Requirements;

There is also a link to the EPA’s Substance Registry Services web page. This page allows for a single source search capability for a wide variety of Federal resources about chemical health, safety and security information for by chemical name or CAS number.

EPA Publishes RMP Revision NPRM

The EPA published a notice of proposed rulemaking (NPRM) in Monday’s Federal Register (available on-line today; 81 FR 13637-13712) for revisions to their Risk Management Program (RMP) regulations. The revisions are mostly in response to the President’s executive order on Chemical Safety and Security (EO 13650) and the EPA’s request for information (RFI) supporting that EO.

NPRM Overview

The major points of the NPRM address the following three areas:

• Accident Prevention Program Revisions

• Emergency Response Enhancements

• Enhanced Availability of Information

The NPRM proposed three changes to the accident prevention program. These include:

• Requiring all facilities with Program 2 or 3 processes to conduct a root cause analysis as part of an incident investigation of a catastrophic release or an incident that could have reasonably resulted in a catastrophic release (i.e., a near-miss);

• Requiring regulated facilities with Program 2 or 3 processes to contract with an independent third-party to perform a compliance audit after the facility has a reportable release; and

• Requiring selected facilities to conduct a safer technology and alternatives analysis (STAA) as part of their PHA, and to evaluate the feasibility of any inherently safer technology (IST) identified.

The NPRM proposed four changes to the emergency response enhancements. These include:

• Requiring all facilities with Program 2 or 3 processes to coordinate with the local emergency response agencies at least once a year to ensure that resources and capabilities are in place to respond to an accidental release of a regulated substance;

• Requiring all facilities with Program 2 or 3 processes to conduct notification exercises annually to ensure that their emergency contact information is accurate and complete; and

• Requiring all facilities subject to the emergency response program requirements of subpart E of the rule (or “responding facilities”) conduct a full field exercise at least once every five years and one tabletop exercise annually in the other years; and

• Requiring responding facilities that have an RMP reportable accident to conduct a full field exercise within a year of the accident.

The NPRM proposed five changes to the enhanced availability of information. These include:

• Requiring all facilities to provide certain basic information to the public through easily accessible means such as a facility Web site or at public libraries or government offices;

• Requiring a subset of facilities, upon request, to provide the Local Emergency Planning Committee (LEPC) with summaries related to: compliance, emergency response exercises, accident history and investigation reports, and any ISTs implemented at the facility;

• Requiring all facilities to hold a public meeting for the local community within a specified timeframe after an RMP reportable accident;

• Proposing revisions to clarify or simplify the RMP submission; and

• Proposing technical corrections to various provisions of the rule.

EPA Seeking Guidance

In addition to the proposed changes in the NPRM, the EPA is also looking for public input on additional changes to the RMP that might be included in future rulemaking. For the accident prevention program, the EPA is looking for information on additional requirements for:

• Location of stationary sources (related to their proximity to public receptors); or

• Emergency shutdown systems

Public Comments

The EPA is soliciting public feedback on the NPRM. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # EPA-HQ-OEM-2015-072). Comments should be received by May 13^th, 2016.

The EPA is currently planning one public hearing to allow personnel to provide oral comments about the NPRM. The hearing will be held on March 29^th, 2016 in Washington, DC. Advanced registration for a chance to speak at the hearing is strongly suggested. You are supposed to be able to register on-line here, but the site is not set up as of the time I’m writing this post (3-12-16 9:00 pm CST). I suspect that it will be set up sometime on Monday.

Commentary

While I have not had a chance to complete a detailed review of the extensive NPRM, it seems clear even at the broad overview provided here that no one is going to be fully satisfied with what the NPRM proposes or ignores. In general I think that that should be the mark of any good regulation, but we will have to wait and see if that is the specific case here.

The topic of inherently safer technology provides a good case in point. Environmental and many safety advocates have long pushed for the EPA to require RMP facilities to implement IST improvements to their chemical processes. While there is not a consensus definition of what an IST improvement would be, the more vocal advocates press for a replacement of toxic chemicals with safer alternatives where ever possible, while more moderate advocates would replace the ‘where ever possible’ with ‘where practical’.

Industry, on the other hand, maintains that it already has conducted IST analysis as part of their standard engineering practices and that the decision to implement a specific IST improvement is a risk-management decision that is only able to be made by facility owners and engineers based upon their unique knowledge of the process.

At first glance it looks like the EPA in this NPRM has taken a middle road or requiring companies to formally document their IST analysis process.  Business will most likely complain that this is bureaucratic make-work that will cost money without providing any safety improvement. The safety and environmental activists will certainly agree that the study provision will not provide any safety improvement; that such improvements can only come with mandatory IST implementation. It will take a detailed look at the IST process outlined in this NPRM (I’ll be doing this in some later blog post) to determine which is more nearly correct about their assessment.

As usual, readers of this blog can expect that I will be taking more detailed looks at the actual language of the proposed changes in a series of future blog posts. Two things that I can tell you at this point: first, I expect that multiple parties will petition for a longer comment period (90 days instead of 60); second, I expect that there will also be multiple requests for regional public hearings. I really expect that both requests will be honored.

OMB Approves EPA RMP NPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the EPA’s notice of proposed rulemaking (NPRM) on Modernization of the Accidental Release Prevention Regulations Under Clean Air Act. The NPRM was submitted to OMB in December of last year and is related to the chemical safety and security executive order (EO 13650) issued in 2013.

The Unified Agenda (UA) listing for this rulemaking abstract explains that the rulemaking:

“In response to Executive Order 13650, the EPA is considering potential revisions to its Risk Management Program regulations and related programs. The Agency may consider the addition of new accident prevention or emergency response program elements, and/or changes to existing elements, and/or other changes to the existing regulatory provisions.”

The UA entry claims the Clean Air Act Section 112(r)(7) {42 USC 7412(r)(7)} as the legal basis for this rulemaking which forms the basis for the EPA’s risk management program (RMP). Limiting the legal basis for the rulemaking to sub-paragraph (7) suggests that the following areas for changes suggested in EO 13650 will not be included in this rulemaking:

• General duty clause {§7412(r)(1)};

• List of substances upon which RMP is based {§7412(r)(3)};

• RMP fuel exemption {§7412(r)(4)(b)}; or

• Chemical Safety Board {§7412(r)(6)};

As would be expected, industry has taken a great deal on interest in this rulemaking; going all the way back to their participation in EO 13650 listening sessions and responding to the EPA’s EO 13650 request for information. In just the last couple of weeks there have been a number of meetings at OIRA between a wide variety of groups and the EPA. The OIRA web site provides a listing of those meetings (NOTE: the names listed below are the meeting requestor names, the links provide more details about whom participated in the meetings):

• American Water Works Association;

• George Washington University;

• SOCMA;

• AF&PA;

• American Petroleum Institute;

• AFPM;

• Center for Effective Government;

• American Chemistry Council (ACC); and

• CSAG

I expect that we will see this NPRM published in the Federal Register later this week.

EPA Sends Accidental Release NPRM to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs announced that it had received from the EPA a notice of proposed rulemaking (NPRM) to modernize the accidental release prevention regulations under Clean Air Act. The listing for this rulemaking (RIN: 2050-AG82) in the Fall 2015 Unified Agenda makes it clear that this is being initiated in response to the President’s Executive Order on Improving Chemical Facility Safety and Security (EO 13650).

While the EO is specifically mentioned in the Unified Agenda listing, the EPA’s 2014 request for information (RFI) on their Risk Management Program (almost certainly to be addressed in this NPRM) supporting that EO is not mentioned. We could still see that RFI mentioned in the Preamble to the NPRM (and I really suspect that we will), but I suspect that it was not mentioned in the Unified Agenda is that the RFI was much more wide-ranging in its program coverage than the coverage of this rulemaking.

In identifying the legal basis {42 USC 7412(r)(7)} for this rulemaking, the EPA has made it clear that they are only going to address the RMP regulations pertaining to “release prevention, detection, and correction requirements”. Since the list of covered chemicals triggering the RMP status for facilities is provided under §7412(r)(3), it does not appear that this rulemaking will include any changes to that list.

It also appears that two other potential RMP modifications strongly suggested by public comments to the RFI will not appear in this rulemaking. Those are the inclusion of inherently safer technology (IST) standards based upon the General Duty Clause of §7412(r)(1) or expanding the off-site consequence information sharing requirements of §7412(r)(7)(H).

It will be interesting to see how long this NPRM takes to wend its way through the OIRA process. I expect that it will be months (at least) before this NPRM is published. If RMP program revisions are too controversial it is unlikely that this NPRM will make it through to a final rule before the end of the Obama Administration in January of 2017. This may argue for a more moderate update of the regulations that could possibly get through the regulatory process next year. Otherwise, the ultimate fate of this rulemaking would rest with the on-coming President.

EO 13650 Updates

As part of their ongoing efforts to comply with the President’s executive order on chemical safety and security (EO 13650) OSHA has updated their EO 13650 web site. The new information includes links to three new documents:

∙ Actions to Improve Chemical Facility Safety and Security Fact Sheet;

∙ Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills; and

∙ Chemical Safety Alert: Safer Technology and Alternatives

Additionally, there is an announcement of a webinar to be conducted by the Chemical Safety and Security Working Group. The webinar will be conducted on June 19^th. The site provides an email address (eo.chemical@hq.dhs.gov) to sign up to participate in the webinar.

DHS Publishes CFATS ANPRM

The DHS National Protection and Programs Directorate (NPPD) is publishing in Monday’s Federal Register (79 FR 48693-48696; available on-line today) an advance notice of proposed rulemaking (ANPRM) concerning possible changes to the Chemical Facility Anti-Terrorism Standards (CFATS) program. This is the third rulemaking that was directed by the President’s Executive Order on Increasing Chemical Safety and Security (EO 13650) and the only one to start as an ANPRM rather than a request for information (RFI).

Actually the EO gave only a very limited requirement for the CFATS program to look at the list of DHS chemicals of interest (COI) that triggers the initial facility reporting requirement that may lead a facility to be covered by the CFATS program. This ANPRM address that issues and takes a broader look at the potential for changes to the CFATS program. No specific changes are proposed in this ANPRM; rather this is functionally similar to the RFIs for the EPA Risk Management Program (RMP) and the OHSA Process Safety Management (PSM) program.

NPPD’s Infrastructure Security Compliance Division (ISCD) proposes a number of questions that it would like answers to from the regulated and affected communities that would allow ISCD to formulate a proposed rule. Those questions are grouped into seven functional areas:

• General regulatory approach;

• Treatment of non-traditional chemical facilities;

• Clarification of terminology;

• Risk based performance standards (RBPS);

• Appendix A (COI list);

• Small business considerations; and

• Alignment with other regulatory programs.

In soliciting responses to these questions, ISCD requests that the responses be as detailed as possible and include analysis of the potential cost and benefits of the proposals. Comments may be filed using the Federal eRulemaking Portal (www.Regulations.gov; Docket # DHS-2014-0016) Comments should be filed by October 17^th, 2014.

EPA RMP RFI Published

Earlier this week the Environmental Protection Agency’s request for information (RFI) for potential improvements to their Risk Management Program (RMP) was published in the Federal Register (79 FR 44603-44633). The lengthy document marks the official beginning of the process to revise the RMP regulations. It was initiated as part of the response of the EPA to President Obama’s Executive order on Improving the Safety and Security of Chemical Facilities (EO 13650).

The RMP-RFI identifies various areas of the RMP program that might be changed in the rulemaking process. At this point in the rulemaking process EPA has not identified any specific rule changes. Rather it has identified a number of areas of potential change along with a brief look at some of the alternatives that might be considered as part of the rulemaking process. It is seeking to establish a more form dialog with the public and the regulated community about how these potential changes could be most effectively implanted.

OSHA RFI Overlap

OSHA was required to publish their RFI for their chemical safety program, the Process Safety Management (PSM) program, much earlier in the EO 13650 process. Since both of these regulatory programs look at chemical safety issues (EPA from a protection of the community perspective and OSHA from a protection of the worker point of view) there is a certain amount of overlap in the two programs. This means that there will likely be overlaps in the program improvement process as well.

The EPA document identifies seven areas where responses to the OSHA RFI may be applicable to future changes in the RMP program. They include:

• Update the List of Regulated Substances;

• Additional Risk Management Program Elements;

• Define and Require Evaluation of Updates to Applicable Recognized and Generally Accepted Good Engineering Practices;

• Extend Mechanical Integrity Requirements To Cover Any Safety-Critical Equipment

• Require Owners and Operators To Manage Organizational Changes;

• Require Third-Party Compliance Audits; and

• Effects of OSHA PSM Coverage on RMP Applicability

RMP Specific Areas of Interest

In addition to these seven areas that are at least partially addressed in the earlier OSHA PSM-RFI, there are eleven areas where EPA is seeking public and industry input on potential changes to the RMP regulations. They are:

• Safer Technology and Alternatives Analysis;

• Emergency Drills To Test a Source's Emergency Response Program or Plan;

• Automated Detection and Monitoring for Releases of Regulated Substances;

• Additional Stationary Source Location Requirements;

• Compliance With Emergency Response Program Requirements in Coordination With Local Responders;

• Incident Investigation and Accident History Requirements;

• Worst Case Release Scenario Quantity Requirements for Processes Involving Numerous Small Vessels Stored Together;

• Public Disclosure of Information To Promote Regulatory Compliance and Improve Community Understanding of Chemical Risks;

• Threshold Quantities and Off-Site Consequence Analysis Endpoints for Regulated Substances Based on Acute Exposure Guideline Level Toxicity Values;

• Program 3 NAICS Codes Based on RMP Accident History Data; and

• The “Safety Case” Regulatory Model

Public Comments

The EPA is soliciting public comments on this RFI. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # EPA-HQ-OEM-2014-0328). Comments should be submitted by October 29^th, 2014.

OMB Approves EPA RMP RFI

As I suggested last night, the OMB announced that it had approved the EPA’s request for information concerning potential changes to their Risk Management Program. This is being reported as being a ‘Notice’ not a ‘Pre-rule’ meaning that an advance notice of proposed rulemaking could still be expected to be part of any rulemaking process arising out of this action.

It won’t be until later today that we know whether or not this notice will be published in Monday’s Federal Register, though I fully expect that it will be.

EPA to Publish Chemical Safety RFI

I got an interesting email from the EO 13650 Working Group yesterday giving me advance notice of the EPA’s press release (issued today) about their pending publication of a Request for Information (RFI) for possible revisions to the EPA’s Risk Management Program (RMP). This is part of the Agency’s response to the requirements of the President’s Executive Order on Increasing Chemical Safety and Security (EO 13650).

Now, anyone that has been following the activities of the EO 13650 Working Group has been expecting this RFI. The EPA submitted the document to the OMB for approval back in May. That approval has not yet been announced, though we may see the announcement of that approval tomorrow on the OMB’s Office of Information and Regulatory Affairs web site.

According to today’s press release the RFI has been signed and forwarded to the folks at the Federal Register for official publication. It is not going to be in tomorrow’s Federal Register, so the earliest that it could show up is in the Monday edition (which will be released on-line on Saturday). From the date of publication there will be a 90-day comment period. There will almost certainly be requests to extend that comment period due to the breadth of the information requested.

An unofficial draft of the RFI is available on the EPA web site. The documents takes pains to acknowledge that this is not the official document and that there may be minor differences between the draft and the version that will be published in the Federal Register. Still it’s nice to have the draft available so that we can opine on the contents quickly and informatively when it is published.

So I guess it is time to start reading the lengthy (115 pages) document. I’ll probably start reporting on it in detail on Saturday.

EO 13650 Report Published - CFATS

This week the Chemical Facility Safety and Security Working Group published their report as required by the President’s Executive Order on Improving Chemical Safety and Security (EO 13650). I have been a sceptic about the potential accomplishments of this group, but I do have to admit that this 122 page report, “Actions to Improve Chemical Facility Safety and Security – A Shared Commitment” is a pretty good effort at identifying the actions that the government (at all levels) and industry need to take to improve chemical safety and security.

Many people will be less than satisfied that the report does not spell out in more detail the specific language that should be included in new and/or revised regulations or legislation. That is not, however, the purpose of a report like this. The hard work of crafting legal language can only come after the general policy has been developed. This is a policy document, the necessary precursor to the time consuming process of changing the course of the regulatory machinery.

Overview

The Executive Summary of the document (occupying 7 pages of the document all by itself) identifies ‘five thematic areas’ in the document {pg v}:

• Strengthening community planning and preparedness;

• Enhancing Federal operational coordination;

• Improving data management;

• Modernizing policies and regulations; and

• Incorporating stakeholder feedback and developing best practices.

In each of these areas the Working Group has sought to identify actions that can be taken immediately within the current regulatory framework that addresses chemical safety and security. These include actions that have already been taken by the Working Group and the federal agencies that they represent. They also identified future actions that they are recommending to the President that include both regulatory and legislative initiatives that would support the Working Groups findings.

As with any policy development like this, the devil is now in the details of implementing that policy. With only 30 months left in the Obama Administration, most of these changes will not be completed by the time that a new President is sworn in in January of 2017. The political measure of the effectiveness of these policy proposals will be how well the survive the transition to the next Administration.

CFATS Improvements

The report makes it clear (pgs 45 – 47) that a significant portion of the actions to be taken to improve the Chemical Facility Anti-Terrorism Standards (CFATS) will come through changes to the CFATS regulations (6 CFR 27). Other than an update of the list of DHS chemicals of interest (COI) the report does not make any specific recommendations about changes to the CFATS regulations. It just notes that DHS has initiated a rulemaking process and will publish a notice of proposed rulemaking (ANPRM) in the near future.

The report does note that the Infrastructure Security Compliance Division (ISCD) of DHS NPPD is already taking some actions to upgrade their internal procedures in the following areas (pg 46):

• Improving the tiering methodology used to identify and provide risk tiers to high-risk chemical facilities, including planning how to incorporate economic consequences into the model;

• Coordinating chemical facility security activities in various DHS agencies and explore ways to increase harmonization among chemical facility security regulatory programs;

• Evaluating the various efforts taken to help identify facilities that should have submitted a CFATS Top-Screen but failed to do so, in order to determine the efficiency of those programs; and

• Identifying the most cost-effective way to continue to pursue potentially noncompliant facilities.

The report goes on to identify three congressional actions that will be necessary to improve the CFATS portions of improving the safety and security of chemical facilities:

• Authorizing CFATS for the long term;

• Streamlining the CFATS enforcement process; and

• Removing the water and wastewater treatment facility exemption to CFATS.

There are other CFATS proposed actions scattered through-out the remainder of the document. They include:

Strengthening Community Planning and Preparedness - Add layers of data to the Department of Homeland Security (DHS) Infrastructure Protection Gateway for LEPCs/TEPCs and SERCs/TERCs to identify regulated and unregulated facilities on a map. {pg xii}

Enhancing Ammonium Nitrate Safety and Security - Solicit feedback through a Chemical Facility Anti-Terrorism Standards (CFATS) Advance Notice of Proposed Rulemaking (ANPRM) on potential modification of the CFATS regulations to address ammonium nitrate. For example, consider lowering the current screening threshold quantities for ammonium nitrate under CFATS. {pg xvii}

Best Practice Guidance for CFATS Risk-Based Performance Standards – DHS will publish a Best Practice Guide regarding the CFATS Risk-based Performance Standards to share with industry. This effort seeks to increase stakeholder understanding and compliance with the CFATS regulation. {pg 48}

Best Practice Guidance for Implementing the Framework for Improving Critical Infrastructure Cybersecurityat Chemical Facilities –DHS will coordinate with industry to develop a voluntary guidance document for chemical facilities that increases awareness and use of the cybersecurity framework developed by the National Institute of Standards and Technology (NIST) to help critical infrastructure sectors and organizations reduce and manage their cyber risk. The document will provide standards, guidelines, and practices to help reduce cyber risks to chemical facilities and encourage them to manage cybersecurity as part of a complete hazards approach to enterprise risk management.  {pg 48}

Moving Forward

It will be interesting to see how long it takes OMB to clear the CFATS ANPRM. This might be a good measure of the Administration’s political will to carry through with the recommendations in this potentially important Working Group report.

EPA Submits RMP RFI Notice to OMB

On Thursday the Environmental Protection Agency submitted a notice to the OMB’s Office of Information and Regulatory Affairs (OIRA) for approval concerning a Risk Management Program request for information. I would assume that this is related to the requirements of §6(a)(iii) of the President’s Executive order on Increasing Chemical Safety and Security (EO 13650). That sub-paragraph requires that the Chemical Safety and Security Working Group to “develop a plan for implementing practical and effective improvements to chemical risk management identified pursuant to subsections (a)(i) and (ii) of this section.”

It will be interesting to see how long this takes to get out of the OMB. Depending on how politically sensitive the recommendations made in the notice actually are this may happen after Election Day in November.

CFATS and Cybersecurity – Spaulding’s Testimony

Earlier this week Undersecretary Suzanne Spaulding testified at a closed hearing before the Homeland Security Subcommittee of the House Appropriations Committee about the cybersecurity budget for DHS. A portion of the unclassified written testimony dealt specifically with the Departments Chemical Facility Anti-Terrorism Standards (CFATS) program.

Spaulding’s testimony did not specifically address cybersecurity at high-risk chemical facilities or how the Department intended to address the assessment of that portion of the security risk. It did, however, address some information sharing activities that are being undertaken by the National Protection and Programs Directorate (NPPD) of the Department as a result of the President’s Executive Order on Increasing the Safety and Security of Chemical Facilities (EO 13650).

Internal Information Sharing

As part of the mandated review of the intra-Executive Branch information sharing initiative started by that EO Spaulding noted that:

“Specifically, ISCD [Infrastructure Security Compliance Division] will run comparisons on the EPA Risk Management Program and the Superfund Amendments and Reauthorization Act Title III data from all 50 individual state data sets on an annual basis to identify facilities that are potentially non-compliant with the CFATS regulation.”

The intention of this information sharing exercise is to identify facilities that have filed RMP and CERCLA information with the EPA that could help identify facilities (like last year’s West Fertilizer) that had not submitted Top Screens required under the CFATS Program.

Interestingly there is no mention of similar information sharing exercises with the Department of Labor’s Occupational Safety and Health Administration (OSHA) that maintains a similar listing of chemical facility information as part of its Process Safety Management (PSM) program. I understand that the database used by OSHA is so much different from those used by EPA and DHS that the Department is having a great deal of difficulty establishing the ability to compare information in the CFATS and PSM databases.

Another part of the intra-Federal information sharing process is the coordination of inspection programs. Spaulding promised that: “ISCD will coordinate inspections with EPA and Occupational Safety and Health Administration and participate in cross-training activities to integrate and improve the outreach of Federal regulatory programs”.

The Federal Government’s inspection cadres for all three programs (CFATS, RMP, and PSM) are not large enough individually to ensure that all chemical facilities housing hazardous chemicals are visited on a routine basis by Federal inspectors. For the sake of efficiency sharing of inspection information between these three programs could help identify facilities that require more frequent and/or detailed inspections by the other programs.

External Information Sharing

While sharing within the Federal government is important to increase the efficiency of these three regulatory programs, it is not usually the Federal government that is responsible for responding to catastrophic failures of these programs. That responsibility lies with the State and local emergency response agencies. Spaulding told the Subcommittee that:

“In addition, ISCD will coordinate and work with each of the 50 State Emergency Response Commissions and the 3,000 (+) Local Emergency Planning Committees to ensure communities can meet their responsibilities in regard to potential chemical emergencies.”

SSP Review

In addition to the improved information sharing process the Under Secretary updated the Subcommittee on the progress seen in the implementation of the CFATS program; specifically the progress in authorizing and approving site security plans. The data provided was based on information as of April 1^st, which coincides with the last CFATS Update (I’m expecting to see the update for the month of April published next week). She was able to supply the Subcommittee with some additional details that were not included in that monthly report.

She reported that all of the Tier 1, 2, and 3 facilities have had their initial review of the facility SSPs. The table below shows the authorization and approval numbers for Tiers 1 and 2. I would certainly suspect that these numbers are now higher. She also provided information on the number of compliance inspections that had been completed for facilities that have had the Site Security Plan approved.

	# in Tier	Authorized	Approved	Compliance
Tier 1	110	107	100	19
Tier 2	336	263	211	3

SSP Numbers as of April 1^st

She also reported that 450 facilities have submitted Alternative Security Plans (ASP). These plans are held to the same performance standards (and approval processes) as the Site Security Plans but are prepared in a more user friendly format. To my knowledge, the only ASP format that is currently ‘approved’ (ASP format approval is not technically necessary) is the ASP designed by the American Chemistry Council (ACC).

Reason for this Testimony

Now none of the above information was really about cybersecurity. Spaulding can be forgiven, however, for drifting from the purpose of the hearing in presenting this data to the Homeland Security Subcommittee in this venue. The Subcommittee has been a vocal critic of the CFATS program implementation and has on multiple occasions threatened to withhold funds from the program. As the program is under her purview, Spaulding can be forgiven for taking any opportunity provided to praise the progress that is being made.

I will not be surprised, however, to see her and ISCD Director Wulf back before this Subcommittee to address specific questions about the CFATS program before the DHS budget is marked up.

Public Comments on OSHA PSM ANPRM – 04-06-14

This is part of a continuing look at the public comments that have been posted to the docket for the OSHA Process Safety Management program advance notice of proposed rulemaking. Earlier posts in the series include:

• Public Comments on OSHA PSM ANPRM – 03-09-14

• Public Comments on OSHA PSM ANPRM – 03-09-14

• ICS and OSHA PSM

• Public Comments on OSHA PSM ANPRM – 03-22-14

• OSHA PSM Enforcement

• Public Comments on OSHA PSM ANPRM – 03-29-14

OSHA PSM and Emergency Response Planning

The comment period on this request for information or advanced notice of proposed rulemaking closed on Monday. There were 48 new submissions posted this last week, almost as many as had been posted in all of the previous weeks. Four of the submissions were from private citizens; the remaining comments came from the following organizations:

• Institute of Makers of Explosives (IME)

• National Association of Chemical Distributors (NACD)

• The Fertilizer Institute (TFI)

• New York City Department of Environmental Protection (DEP)

• American Chemistry Council (ACC)

• American Exploration and Production Council (AXPC)

• Texas Pipeline Association (TPA)

• United Auto Workers International Union (UAW)

• National Oilseed Processors Association (NOPA)

• American Fuel and Petrochemical Manufacturers (AFPM)

• Texas Oil and Gas Association (TXOGA)

• International Liquid Terminals Association (ILTA)

• Justrite Manufacturing Company, LLC

• Semiconductor Industry Association (SIA)

• Change to Win

• ORCHSE Strategies, LLC

• United Steelworkers (USW)

• Society of Chemical Manufacturers and Affiliates (SOCMA)

• American Coatings Association (ACA)

• U.S. Chemical Safety Board (CSB)

• Domestic Energy Producers Alliance (DEPA)

• The Vinyl Institute (VI)

• Southern Company, Inc.

• The Chlorine Institute (CI)

• Marcellus Shale Coalition (MSC)

• The Ethylene Oxide Sterilization Association, Inc. (EOSA)

• Agricultural Retailers Association (ARA)

• Louisiana Mid-Continent Oil and Gas Association (LMOGA)

• American Petroleum Institute (API)

• Sustainable Technology and Policy Program (STPP)

• Allen, Meredith; Metcalfe, PLLC

• Covidien

• Chemistry Council of New Jersey (CCNJ)

• De La Mare Engineering, Inc. (DLM)

• Mary Kay O'Connor Process Safety Center (MKOPSC)

• American Pyrotechnics Association (APA)

• Risk Integrity Safety Knowledge, Inc. (RISK, Inc.)

• Continental Resources, Inc. (CLR)

• Comment from Craig, Richard; Compressed Gas Association (CGA)

• Americold Logistics

• Interstate Natural Gas Association of America (INGAA)

As I have been doing with the recent posts in this series I will address only the new ideas mentioned in these comments.

Ammonium Nitrate

A number of commenters note that including fertilizer grade ammonium nitrate under §1910.109 may be more appropriate than having it regulated under the PSM standard (§1910.119), but even that would require significant revisions to the existing standards.

 Emergency Response Coordination

A recommendation was made that any added OSHA emergency response coordination requirement be closely aligned with the EPA’s requirements in this area under the RMP program. While mainly duplicative they should not be contradictory.

Another commenter noted that OSHA already addresses the requirements for an emergency action plan in §1910.38.

Demonstrated Improvement in Safety

A number of commenters have noted that OSHA has not suggested any information that would indicate that the suggestions for changes in the PSM standards would provide any significant improvement in safety. Many have mentioned that all of the incidents mentioned in the RFI as justifications for making changes to the PSM standard were all clearly the result of failures to comply with current PSM requirements.

Comments not Reviewed in Detail

I’m sorry but I have to admit that there were two comments that I did not review closely for purposes of this post; the comments from the U.S. Chemical Safety Board (CSB) and the comments from the Mary Kay O'Connor Process Safety Center (MKOPSC). Both of these comments were extensive and comprehensive. Any abstraction of the information presented in those comments for inclusion in this post would be a disservice.

I would recommend that anyone interested in chemical process safety should take the time to read both of these documents.

Moving Forward

It will be interesting to see if anything actually comes from this effort. It is clear from many of the industry comments submitted that there is some perceived need for updating the PSM requirements. That is still countered by a general industry reluctance to accepting an increase in the regulatory burden. Almost all industry commenters noted that any rulemaking needs to be preceded by a detailed cost-benefit analysis with a clear identification of the extent of the potential reduction in hazard that is expected to be gained by any new regulation.

Public Comments on OSHA PSM ANPRM – 03-29-14

This is part of a continuing look at the public comments that have been posted to the docket for the OSHA Process Safety Management program advance notice of proposed rulemaking. Earlier posts in the series include:

• Public Comments on OSHA PSM ANPRM – 03-09-14

• Public Comments on OSHA PSM ANPRM – 03-09-14

• ICS and OSHA PSM

• Public Comments on OSHA PSM ANPRM – 03-22-14

• OSHA PSM Enforcement

There is only one day left in the comment period (Monday) and there were only eleven comments posted to the docket in the last week, including another one from yours truly (from last week’s blog) and one from a private citizen. The comments were submitted by:

• International Association of Drilling Contractors (IADC)

• Sunoco Logistics

• International Association of Fire Fighters (IAFF)

• Gas Processors Association (GPA)

• Global Risk Consultants (GRC)

• Auditing Roundtable/Board of Environmental Health & Safety Auditor Certifications

• American Gas Association (AGA)

• UIC School of Public Health, Environmental and Occupational Health Policy

• Chemical Facility Security News (Blog)

• American Industrial Hygiene Association (AIHA)

Many of the same comments seen in earlier comments have been repeated here. I will just address the new information or new points of views detailed in the current set of responses.

Need for New OSHA PSM Regulations

A comment was made that the problems used in the RFI to justify a possible expansion of the OSHA PSM coverage was a better justification for better enforcement of the current PSM requirements.

Oil and Gas Drilling Exemption

One commentor noted that removing the current oil and gas drilling rig exemption would add an additional 4,000 work sites to the list of facilities that an already overburdened inspection force would not be able to get around to. Another commentor noted that there is no clear definition of what might be included; they suggest that production facilities as defined in API Recommended Practice 80 might form a workable definition. A comment was made that the original exemption was put into place with the understanding that a separate OSHA standard would be developed for these activities; that has not occurred. Another commentor noted that natural gas facilities are regulated under PHMSA pipeline regulations.

LEPC Coordination

A suggestion was made that in addition to LEPC coordination, facilities storing large quantities of hazardous materials be required to submit a Hazardous Materials Management Plan as outlined in NFPA 400. Another suggestion was made that large chemical facilities be required to provide financial support to the local LEPC. A commenter noted that natural gas transmission and distribution facilities are already required to maintain close coordination with local emergency response authorities under 49 CFR 192.615.

Atmospheric Storage Tank Exemption

The use of the NFPA 30 definition of atmospheric storage tanks has been suggested as a way of removing the current confusion related to the OSHA definition. An update of §1910.106, the flammable liquids standard has been suggested. A suggestion was made that there should be a distinction between raw material tanks that feed a process and finished goods tanks that are filled from the process.

Highly Hazardous Chemicals

Expanding the list of Highly Hazardous Chemicals by adding specific chemicals would be a reactive exercise. The suggestion was made to use generic descriptions based upon amount and hazard category in place of trying to list all new HHC.

Certification of Auditors

A commentor noted that lead auditors, whether in-house or third party, should be Certified Process Safety Auditors. Other members of the team that are subject matter experts would not need to be certified.

Management Systems

The suggestion was made that portions of the new ANSI/AIHA Z10 consensus standard on industrial hygiene be included in the management systems language of the PSM standard.

Temporary Workers

While this was not specifically addressed in the RFI one commentor submitted a lengthy paper about the perceived hazards of allowing temporary workers to work in PSM cover areas. This included a suggestion that the PSM standard specifically address increased training requirements for temporary workers.