OCS Updates FAQ Response – 3-1-23

Today, CISA’s Office of Chemical Security (OCS) published an updated responses to a FAQ on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The revised FAQ responses were for FAQ #1275. This is the same FAQ that was ‘updated’ yesterday. Yesterday’s non-update is no longer listed.

FAQ #1275 What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ, you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

For the most part the changes in the response are wording changes that clarify the status of the ‘buyer’ and ‘seller’ {for example changing the word ‘buyer’ to ‘new owner/operator (buyer)’ in the initial discussion for Option 1}.

A slightly more complex change is made in the discussion of the requirements for Option 1. It changes the sentence:

“The buyer should explain that his organization is willing to assume the ID and take responsibility for the submitted and the future surveys and should explicitly document that the COI holdings and facility operations will remain the same.”

To read:

“The buyer should explain that the new organization is willing to assume the existing ID and take responsibility for surveys submitted by the seller. The buyer should explicitly document that the COI holdings and facility operations remain the same or submit a new survey if the buyer intends to make material modifications to its operations or site.”

Finally, a new sentence is added to the end of that discussion:

“If the buyer is unable to obtain a letter and/or contact information from the seller, then the buyer should include a statement in their letter accounting for this.”

OCS Updates CFATS FAQ Response – 2-14-23

Today, CISA’s Office of Chemical Security updated a frequently asked question (FAQ) response on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. I also look at policy updates that should have been made. The FAQ Response revision updated the information provided to FAQ #1756 to add delivery options for delivering the described letter to OCS:

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

NOTE: The link provided for the FAQ in this post was copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ, you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The revised information includes specifically authorizing the us of surface mail or email as alternative delivery options for the letter to OCS described in the response.

Review - OCS Updates CFATS FAQ Response – 1-18-23

Today, CISA’s Office of Chemical Security updated a frequently asked question (FAQ) response on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The revision updated the information provided to FAQ #1554 to reflect recent regulatory changes:

FAQ #1554 Does the Cybersecurity and Infrastructure Security Agency (CISA) have enforcement authority to fine noncompliant facilities, to include shutting down a facility?

NOTE: The link provided for the FAQ in this post was copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ, you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The revised information is an increase in the maximum civil penalty under 6 CFR 27.300(b)(3) from $38,139 to $41,093. This change was recently made when DHS updated their civil penalties to reflect inflation.

 

For a look at the policy changes that CISA has not made to reflect the annual inflation adjustment, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ocs-updates-cfats-faq-response-1 - subscription required.

ISCD Updates 1 FAQ Response – 8-17-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated their response to FAQ # 81, How do I register for the Chemical Security Assessment Tool (CSAT)?, on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. Unlike the earlier series of FAQ response updates earlier this summer (see here for example), this update is a substantial rewrite of the response.

The most important change is that ISCD is now requiring TLS 1.2 (instead of the earlier TLS 1.0) be enabled in the browser to access the CSAT User Registration website. I would suspect that TLS 1.2 will be required for access to the whole CSAT site. I have an email in to ISCD requesting clarification.

The other changes to the FAQ #81 response include revisions to the instructions for setting TLS 1.2 for Microsoft® Internet Explorer® and Mozilla® FireFox®. They also added instructions for setting TLS 1.2 in Microsoft Edge® and Google® Chrome®.

ISCD Updates 8 FAQ Responses – 7-21-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to eight frequently asked questions on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. This is part of an on-going effort at ISCD to make FAQ editorial changes designed to: reflect changes in program management (CISA branding), to change URL’s to page links (see the similar 6-22-20 blog post) and to make the responses more helpful; rather than reflecting changes in ISCD policy.

The FAQ responses updated today include:

FAQ #1749 What is a “certification” in the Expedited Approval Program (EAP)?

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

FAQ #1762 Can our company’s human resources department request a change in contact information to receive the Chemical-terrorism Vulnerability Information (CVI) certificates?

FAQ #1763 Why are my Chemical-terrorism Vulnerability Information (CVI) documents and information located in my Chemical Security Assessment Tool (CSAT) account inaccessible?

FAQ #1764 How long will a facility have to implement the approved security measures to check for terrorist ties under Risk-Based Performance Standard (RBPS) 12(iv) in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1773 Solid ammonium nitrate in the chemicals of interest (COI) column of Appendix A is listed as “Ammonium nitrate, solid [nitrogen concentration of 23% nitrogen or greater]” and has a minimum concentration of 33% under the Theft/Diversion security issue. In calculating whether a facility has a screening threshold quantity (STQ) of solid ammonium nitrate in a mixture, does the facility look at the percentage of the nitrogen in the mixture or the percentage of the ammonium nitrate in the mixture?

FAQ #1778 The Department of Transportation (DOT), pursuant to 49 CFR Part 107 has granted my facility a special permit that exempts sabotage/contamination chemicals of interest (COI) shipments from placarding requirements of Subpart F of 49 CFR Part 172. Pursuant to the Chemical Facility Anti-Terrorism Standards (CFATS) 6 CFR Part27, is my facility still required to report its sabotage/contamination COI holdings?

FAQ #1789 How does the Cybersecurity and Infrastructure Security Agency (CISA) define truck terminals as referred to in the Chemical Facility Anti-Terrorism Standards (CFATS) Final Rule?

FAQ #1749 was also updated yesterday. Today’s version changed the subparagraph numbering system.

The printing of FAQ #1778 question in the “Search Results” section of the CFATS Knowledge Center when searching for this FAQ has some formatting problems (printing the URL instead of the web page name). The version printed here is the correct version.

ISCD Updates Two FAQs

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions (FAQ) on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center page. The changes were not substantial and did not reflect any changes in policy or procedure.

The two FAQ responses that were changed are:

FAQ #1374 Does Phosphorus, which is part of a polymer, need to be counted toward the STQ? They are buying the polymer which contains the phosphorus.

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

Actually, I cannot see any changes in the response to FAQ #1374. The only change that I see in the response to FAQ #1756 is the addressee on the letter to be sent to ISCD. The previous version of this response had the letter addressed to “David Wulf, Director” and the new addressee is “Amy Graydon, Acting Director”.

This is not the result of some shake-up at ISCD. Back in January when the new Administration took office, the political appointees were required to submit their resignations. Pending new appointments by President Trump, various senior professional staff of the Department were bumped up in acting positions so that the management structure of the Department would be able to continue in force. David Wulf was jumped up to Acting Deputy Assistant Secretary for Infrastructure Protection, DHS and Amy was bumped up to temporarily fill his Director Position. Presumably at some point in the near future after the nomination and approval process is finally complete, all of these folks will revert back to the normal positions. This routinely happens when, for whatever reason, political appointees leave and are not immediately replaced.

I personally do not really understand why DHS includes personnel names in these official addresses. In the military they used the title of the person (ie: Commander) and the local clerks were smart enough to get the letter to the correct person. Personal mail got sent to a person’s name and official mail got sent to the office.

ISCD Publishes Three FAQ Updates

Today the DHS Infrastructure Security Compliance Division (ISCD) published three revised frequently asked question (FAQ) responses on its Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. While many recent changes have been made to add regulatory links, the three FAQ responses published today had some significant word changes.

The three FAQ responses that were updated today were:

FAQ #1291 How do I determine whether or not I need to report my aluminum powder? 

FAQ #1383 Is Ammonium Nitrate Fuel Oil, also known as ANFO, included on Appendix A?

FAQ #1437 How is the screening threshold quantity (STQ) for sabotage/contamination chemicals of interest (COI) calculated in a mixture?

FAQ #1291

The basic change to this FAQ response was the addition of links to the CFATS regulation and to the CFATS Advisory Opinion web site where there is a link to Opinion 2016-02 that addresses the ‘A Commercial Grade’ (ACG) issue in some detail. The greater detail found that opinion apparently provides a reasonable justification to remove some of the explanatory wordage in the original FAQ response.

FAQ #1383

The new FAQ #1383 response if very much shorter than the original response. It removes the explanation of why ANFO is not treated as an explosive by the CFATS program. While the new answer does specifically answer the question posed, I think that the information provided in the earlier version should have been retained for clarities sake. For the record, here is the old response with the deleted language highlighted:

No. As stated in the preamble to the final Appendix A to the Chemical Facility Anti-terrorism Standards (CFATS), the only explosive Chemicals of Interest (COI) listed in Appendix A (i.e., release explosives and theft/diversion explosives) are those listed by the Department of Transportation (DOT) as Class 1, Division 1 explosives. See 72 Fed. Reg. 65402-65403, [Link Added] 65405 & n. 37 (Nov. 20, 2007). Although ANFO is an explosive, it is not listed by DOT as a Division 1.1 explosive, and thus it is not covered by Appendix A. However, a facility that manufactures ANFO and possesses any chemical of interest (e.g. ammonium nitrate) in a quantity at or above the applicable STQ would be required to submit a Top-Screen.

FAQ #1437

The response to FAQ 1437 is a complete re-write of the original FAQ response; removing any mention of ACG which was never really pertinent to the question. Unfortunately, the new language is a little bit confusing until one actually looks at the Appendix A table.

The new response states:

“As provided in 6 CFR §27.203(d), https://www.gpo.gov/fdsys/pkg/CFR-2016-title6-vol1/pdf/CFR-2016-title6-vol1-sec27-203.pdf, a facility shall count toward the STQ the total quantity of any placarded amount of a sabotage/contamination chemical that the facility ships.”

The actual wording of §27.203(d) reads:

“A facility meets the STQ for a sabotage/contamination chemical of interest if it ships the chemical and is required to placard the shipment of that chemical pursuant to the provisions of subpart F of 49 CFR part 172 [Link Added].”

The way the regulation reads, if a facility ships one shipment of a sabotage/contamination chemical of interest that DOT required to be placarded (either on the container or the vehicle carrying the material) then the facility would have met the STQ requirements for that COI, regardless of the size of the shipment. The FAQ response would seem to indicate that you could have some number of placarded shipments of a sabotage/contamination COI, but not yet reach the COI level.

Looking at the COI table in Appendix A, however, quickly clears up the matter. The STQ for all sabotage/contamination COI is listed as ‘APC’ or ‘a placarded amount’; confirming that a single placarded shipment of the COI would meet the STQ for that sabotage/contamination COI.

ISCD Updates 15 CFATS FAQ Responses and Adds a New One

Today the DHS Infrastructure Security Compliance Division (ISCD) updated fifteen for frequently asked question (FAQ) responses on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. It also added a new FAQ concerning recent DHS emails requesting new Top Screen submissions.

New FAQ

FAQ #1441 was added to the CFATS Knowledge Center. It asks: “If a facility has not made any changes to its holdings of chemicals of interest (COI) as indicated on its most recent Top-Screen, and DHS previously determined the facility to not be high risk, why did the facility receive an email from DHS requesting that a new Top-Screen be completed?”

The response refers back to the Federal Register notice about the introduction of CSAT 2.0 and the new CFATS risk assessment methodology.

FAQ Revisions

The FAQ responses that were changed were:

FAQ #641 When does a facility need to submit a Chemical Security Assessment Tool (CSAT) Top-Screen? 

FAQ #1143 What is required of co-located facilities in regards to the Chemical Facility Anti-Terrorism Standard (CFATS)? Do both companies need to develop a Top-Screen and Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)? Is it possible for the imbedded facility to share the Top-Screen and SVA/SSP with the host company? If this is possible, what would be required by both companies to accomplish this and be compliant under 6 CFR Part 27?possible, what would be required by both companies to accomplish this and be compliant under 6 CFR Part 27?

FAQ #1238 How do I comply with the Chemical Facility Anti-Terrorism Standard (CFSATS) regulation if my facility does not have Internet access?

FAQ #1562 What is a Public Water System?

FAQ #1612 What type of nitrocellulose is reportable as a chemical of interest (COI)? 

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

FAQ #1628 How does a facility submit an Alternative Security Program (ASP) in lieu of a Site Security Plan (SSP)?

FAQ #1634 Should my facility include information in the Security Vulnerability Assessment (SVA)/Site Security Plan (SSP) about Chemicals of Interest (COI) and/or security/vulnerability issues that are not listed in its Tiering Letter, but that the facility believes to be of concern?. What are the Department’s expectations about these other security/vulnerability issues and COI? 

FAQ #1650 What happens after a facility submits its Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

FAQ #1653 If a facility is in a location where another entity provides certain security measures (for example: industrial park, co-located facility; office park, etc., can the facility include these security measures as part of its Site Vulnerability Assessment (SVA)/Site Security Plan (SPP)?

FAQ #1658 What is required of an Alternative Security Program (ASP)?

FAQ #1660 Can a facility’s tiering level ever change? How and why?

FAQ #1666 Does a facility have an obligation to notify DHS if the facility is closing? 

FAQ #1745 If a facility has submitted a Site Security Plan (SSP) or an Alternative Security Plan (ASP) in lieu of an SSP, but does not have an approval, can it still be part of the Expedited Approval 

FAQ #1751 If my facility has been issued a “letter of acceptance” through the Expedited Approval Program (EAP), but then the Department of Homeland Security (DHS) discovers that the measures in the Site Security Plan (SSP) insufficiently meet the risk-based performance standards (RBPS) during a compliance inspection, what happens?

There was one major response re-write, FAQ # 641. The dated original entry referred to dates and requirements that were only applicable at the start of the CFATS program. The new version reflects the on-going requirements to submit Top Screens for facilities not currently covered under the CFATS program as well as Top Screen renewal requirements for covered facilities.

One common change was the addition of links to 6 CFR 27, 6 USC 22 or some other federal regulation when the FAQ response includes reference to those publications. We see these changes in FAQ #1143, #1194, #1442, #1612, #1620, #1653, #1658, #1666, #1745 and #1751. I counted 22 other FAQ responses that included similar references where regulatory links could be added. It will be interesting to see if ISCD updates those FAQ responses as well.

Another common change was to change wording to FAQ responses reflecting the CSAT 2.0 change to submit a combined Security Vulnerability Assessment (SVA) and Site Security Plan (SSP), or as it is now called SVA/SSP. This change was made in FAQ responses #1628, #1634, #1650, #1653, and #1660.

One truly inconsequential change was made to the response to FAQ #1562. It added “(STQ)” following the words “Screening Threshold Quantity” in the second paragraph of the response.

Finally, one FAQ response (#1238) was corrected to properly reflect the original publication date.