ISCD Publishes 2 New Fact Sheets – 9-15-20

Today the CISA Infrastructure Security Compliance Division (ISCD) published two the Fact Sheets on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. They also revised a Frequently Asked Question (FAQ) and four responses to FAQs.

New Fact Sheets

ISCD published to new Fact Sheets as part of their outreach program. The two

• Protect Chemicals at Warehouse, Storage, and Distribution Facilities From Use in a Terrorist Attack

• CFATS: Top-Screens for Dynamic Business Operations

The warehouse fact sheet is part of the ISCD’s industry outreach program; providing information about the CFATS program and how warehousing facilities are affected by the program. This is very similar in concept and information to previously published industry outreach fact sheets. One small nit to pick with the information provided; the list of ‘common chemicals of interest (COI) includes ‘anhydrous ammonia’; probably more commonly found in warehouse operations would be ‘ammonia (concentration 20% or greater)’.

The dynamic business operations fact sheet is another look at a topic that was discussed here last week. The information provided in this new fact sheet is very similar to the information provided in the relatively new  CSAT Top Screen Submissions Tips page.

Revised FAQ – Ammonium Nitrate

While ISCD has been revising a number of FAQs over the last couple of months to make them more useful, every once-in-a-while they actually change one of the questions being asked, which generally requires a significant rewrite of the response. Such was the case today when FAQ #1228 was changed.

• Old question - How is the Screening Threshold Quantity (STQ) calculated for Ammonium Nitrate (AN)?

• New question - How is the screening threshold quantity (STQ) calculated for ammonium nitrate (AN) [with more than 0.2 percent combustible substance, including any organic substance calculated as carbon, to the exclusion of any other added substance]?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The difference is important because there are two different listings for ‘ammonium nitrate’ in the list of DHS Chemicals of Interest (COI); ammonium nitrate, the explosive (where the ‘more than 0.2%... applies) and ammonium nitrate, the potential explosive precursor. The original FAQ did not really distinguish between the two and this made the Response a tad bit confusing. Instead of just taking the easy way out and just revising the response to address the precursor form of the AN, ISCD revised the question, expanded the answer and, in my opinion, just made the matters more confusing, but then again AN is confusing.

AN, the fertilizer is the ‘non-explosive’ form of the chemical. I know, Beirut and West, TX were big (big is a massive understatement in the case of Beirut) explosions of AN. Perhaps ISCD should skip the two listings (would take a rule change) for AN and treat both forms of the material as an explosive for security purposes. It would still have the release-explosive and theft/diversion security classifications and STQ’s, but it would clear up a lot of the confusion. And let’s face it; a smart terrorist could craft an attack on an ammonium nitrate fertilizer storage that would result in a massive explosion.

Revised FAQ Responses

ISCD revised the responses for the following FAQ’s:

FAQ #1272 Who is responsible for submitting a Top-Screen in situations where chemicals of interest are located on property that is leased by a tenant from a landlord?

FAQ #1405 How will I know if the agricultural extension has been lifted and what to do next?

FAQ #1456 Should release chemicals of interest (COI) presently in process or chemicals that are by-products be considered when calculating COI quantities toward the screening threshold quantity (STQ)?

FAQ #1541 How does a facility count the amount of a release-flammable mixture that is a fuel with a National Fire Protection Association (NFPA) rating of 1, 2, 3, or 4 if it is stored in an aboveground tank farm (including farms that are part of pipeline systems)?

For the most part these changes were non-substantive changes made for clarification purposes; no changes in policy or procedure were included. The changes were:

#1272 Added a reference link and additional explanatory language (2^nd paragraph),

#1405 Changed URL to document link,

#1456 Removed reference to ‘total onsite quantity (TOQ)’, and

#1541 Added comments about the gasoline Top Screen extension (2^nd paragraph).

ISCD Updates Two FAQ Responses and Adds a New Article

Today the DHS Infrastructure Security Compliance Division (ISCD) updated two frequently asked question (FAQ) responses and added a new article on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. There is no specific notice on that site concerning the presence of the new article.

FAQ Updates

The two changed FAQ responses were significant rewrites of the verbiage but no real new information was provided. The updated FAQ responses were for the following existing FAQ:

FAQ #1489 Can a covered facility have contractors or lawyers fill out their Security Vulnerability Assessment (SVA)/Site Security Plan?

FAQ #1579 How does a facility define itself if it has multiple buildings, yet only a few select buildings possess Chemicals of Interest (COI) that are subject to being regulated by the Chemical Facility Anti-Terrorism Standards (CFATS)?

The new response to FAQ #1489 is significantly shorter than the previous response. ISCD has removed verbiage about the need for facility knowledge on the part of the Preparer and the unrelated information that the Submitter should be an officer or employee of the company who is domiciled in the US. That was perfectly good information, but it was not really pertinent to the FAQ.

For FAQ #1579 there was actually a significant change to the wording of the FAQ as well as nearly complete rewrite of the response. The original FAQ started off with “How does a college define itself….” The new FAQ substitutes ‘facility’ for ‘college’; expanding the coverage of the response to include a more diverse set of facilities. That expansion did not have any real effect on the new response.

The new response would seem to imply that ISCD is taking a different sort of look at facilities that choose to only include isolated parts of their overall facility in their definition of the facility for the purpose of Top Screen submissions. The original FAQ response included this:

“As such, an institution of higher learning can, if appropriate, submit a Top-Screen on a facility-by-facility basis or on a campus-wide basis. However, the Department will evaluate whether or not the facility or facilities, if determined to be high-risk, have complied with CFATS and, specifically, the Risk-Based Performance Standards (RBPS).”

The new response substitutes the following language:

Individual buildings within a facility site can be registered as separate facilities if they possess COI at or above the screening threshold quantity (STQ). For example, a college or university can, if appropriate, submit a Top-Screen on a building-by-building basis or on a campus-wide basis and need not necessarily count the total of all COI in separate buildings to ascertain whether it meets or exceeds the applicable STQ for each COI. However, the Department will evaluate whether or not the definition of the parameters of the facility or facilities to determine whether such definition appears intended to thwart or evade regulation under CFATS.

It is clear to see that the original response had more of a focus on how the identification of multiple facilities impacted the site security plan for the sites. The new response would seem to indicate that ISCD has new concerns about people attempting to evade coverage under the CFATS program by filing multiple sites that might not be considered at high risk of terrorist attack when the combination of the facilities might be considered to be at high risk.

Both the original response and the new response provide a link to the final rule on Appendix A to the CFATS regulations (6 CFR Part 27) and a description of the area within that final rule where the discussion takes place that affect the response to this FAQ. If ISCD had used a link to the Federal Register web site instead of their own listing of the publication, they would have been able to provide a more direct link to the discussion (here).

New Article

The new article (Article #1780) provides a fairly detailed discussion of the categories of facilities that are exempt from the requirement to submit a Top Screen and are thus exempt from coverage under the CFATS program. The information provided in this article has, for the most part, been provided in individual FAQ responses to questions about the specific programs that form the basis for the exemption from CFATS program coverage. This is the first time, however, that it has been included in a single place on the CFATS Knowledge Center.

ISCD Published 6 Update FAQ Responses

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the responses to six frequently asked question (FAQ) responses on the CFATS Knowledge Center. The changes to these responses were non-consequential; ISCD simply removed language referring to two manuals that were made obsolete by the change to CSAT 2.0 that was made last October.

No notice of the changes was provided on the CFATS Knowledge Center page.

Changes

The FAQ responses that were updated were:

FAQ #702 I was in the Chemical Security Assessment Tool (CSAT) User Registration System and got distracted. When I returned, it had timed out; can I get back in?

FAQ #706 I have multiple usernames. Can I get rid of the duplicates?

FAQ #707 How do I change the name of the Authorizer/Submitter/Preparer?

FAQ #708 I am confused about the Authorizer/Submitter/Preparer structure. Can you explain it?

FAQ #1392 How do I transfer my account or reassign my user role?

FAQ #1610 Can a consultant request a user change?

The two manuals that are no longer part of the Chemical Security Assessment Tool (CSAT) that are not mentioned in the updated FAQ responses are:

• CSAT User Registration User Manual

• Chemical Security Assessment Tool (CSAT) Account Management User Guide

NOTE: The links to the two old manuals were still good as of the writing of this post.

Commentary

Since the two old manuals have been included in the CSAT 2.0 program upgrade, it is certainly logical that references to the two manuals have been removed. What I do not understand is why the response updates did not refer to the new CSAT 2.0 manual that did address these issues; the Chemical Security Assessment Tool (CSAT) 2.0 Portal User Manual.

While the old method of just providing a link to the relevant manual was not really helpful, ISCD could be helpful if they provided a link to the manual and a section reference where the information could be found.