CFATS Resources Page – 6-1-20 – Fact Sheets

In Monday’s post about the ‘Hydrogen Peroxide’ flyer, I noted that ISCD had included a link to that fact sheet on their CFATS Resources web page (okay, CISA is probably maintaining that page not ISCD in particular, but I won’t get too picky here). While that was the only new entry on the page, there were a number of changes to documents on that page that I had not previously noted because CISA had not been including change dates on web pages. For the most part there is nothing really earthshaking here, but CFATS facilities need to know that there are ‘updated’ documents available here.

Fact Sheets

This header includes a long list of ‘fact sheets’ about the Chemical Facility Anti-Terrorism Standards (CFATS) program. Most of these fact sheets now have updating dates in November 2019. The last update that I noted for many of them was in May of 2019; that was mainly a CISA branding function. Looking at a few of the documents the new versions have some relatively minor editorial word changes.

The one exception is the fact sheet on CFATS penalty assessments. When the original fact sheet was issued in 2017, the table for “Applicable fines for failing to file Top-Screen and/or SVA/SSP” in the fact sheet provided the same data as was found in the Table 1 of the 2017 policy letter. The updated ‘CFATS Penalty Policy’ page (link from ‘Fact Sheets’ section) links to the same policy letter, but there are some significantly different data in the new fact sheet.

For example: the policy letter reports that the first warning letter would be sent to a facility 14 days after the Top Screen submission deadline had passed. The fact sheet states that this letter would be sent 14 days before the submission deadline. Similarly, the first penalty assessment ($2,000) would be levied 30 days after the submission deadline according to the policy letter and just one day after the submission deadline according to the fact sheet. Again, the policy letter would levy a $2,000/day penalty for failure to file starting 90 days after the submission deadline and the fact sheet notes that that would start at 60-days.

I suspect that the two documents are talking about two different types of Top Screens. I think that the policy letter is describing an initial Top Screen for a facility that is not yet covered by the CFATS program and the fact sheet is referring to the recurring resubmissions that covered facilities are required to submit. I am basing this on the differing references to the date in the warning letter; ISCD is unlikely to know when the submission is required for the initial Top Screen and thus unable to provide a 14-day warning before the required submission date.

Industry-related Chemicals Fact Sheets

This subheading under ‘Fact Sheets’ provides a list of industries that frequently use DHS chemicals of interest (COI) that could require facilities to submit Top Screens. These fact sheets were originally published in 2017 and 2018 (see here for example) and most recently updated in 2019. While the republication was essentially a CISA rebranding effort, some editorial changes were made to the various fact sheets.

With the exception of the “Agricultural Production Facilities Fact Sheet”, clicking on any of the listed industries takes you the same web page; “INDUSTRY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS (CFATS) RESOURCES”. There you have to again click on the industry of concern to get to the actual fact sheet of interest. The reason that the ag fact sheet is treated differently is because it is about the continued exemption from Top Screen submissions that DHS has provided to specifically defined agricultural production facilities.

Well, that is enough about the documents listed on this page for today. I will look at more of them in later posts.

ISCD Updates a Number of CFATS Information Documents

Recently the DHS Infrastructure Security Compliance Division (ISCD) provided links to a number of new and updated information documents related to the Chemical Facility Anti-Terrorism Standards (CFATS) program. Links were provided on either the CFATS Knowledge Center page or the CFATS Resources page.

The new or revised documents I found are:

• CFATS Risk-Based Performance Standards (RBPS) 10 – Monitoring (new);

• Chemical Facility Anti-Terrorism Standards: Top Regulated Chemicals of Interest (COI) (revised);

• Chemical Facility Anti-Terrorism Standards: The Role of First Responders (new);

• DHS Guidance for the Expedited Approval Program (?);

• Chemical Facility Anti-Terrorism Standards: Expedited Approval Program (new);

• Chemical Facility Anti-Terrorism Standards: Resubmitting a Top-Screen (revised);

• CFATS Risk-Based Performance Standards (RBPS) 1-7: Detection and Delay (revised); and

• CFATS Risk-Based Performance Standards (RBPS) 12iv – Screening for Terrorist Ties (revised)

I have not done (and probably will not do) a detailed review of the revised documents. These are ‘fact sheets’ and those are seldom (if ever) used to announce new policy. If new policy were involved, we would have seen a more formal announcement of the revised documents. I suspect that this was mainly a branding exercise for the new Cybersecurity and Infrastructure Security Administration (CISA).

The odd one on the list above was the EAP guidance document. It was not rebranded with the CISA format or logo. There is no date on the document, so I am not even sure that it was revised. It was listed on the top of the ‘User Manuals’ column of the CFATS Knowledge Center, so ISCD is apparently attempting to at least call attention to the manual. The EAP program was mandated by Congress in the first re-write of the CFATS legislation and may not survive the second re-write. It has not been used by more than a handful of facilities, but that is more because it was introduced after the vast majority of facilities had already submitted proposed Site Security Plans under the existing program than it was because of any problems with the EAP.

Most of the documents listed above have dates back in May. I am not sure when they were actually published or the links made available. A couple of years ago DHS generally stopped putting date of change notices on their web pages. With web sites that are as voluminous as the CFATS program this makes it very difficult to keep up with the changes. I had hoped with the rise of CISA (and the fall of NPPD, its predecessor) that we would see a change in this policy. Every once-in-a-while a ‘last published date’ slips in (see here), but I have not seen any indication that this is more than the action of isolated web-scriptors trying to do right.