CFATS Tiering Fact Sheet – 5-30-21

Today I saw an interesting post on LinkedIn by Bryan McDonald, a chemical security inspector with the Office for Chemical Security in CISA. His post pointed at a Chemical Facility Anti-Terrorism Standards program fact sheet on “Tiering Methodology” that I had not seen. This is a nice overview of the enhanced tiering process that DHS started as part of their CSAT 2.0 upgrade back in 2016.

I was able to trace the fact sheet back to the “CFATS Tiering Methodology” web page. It has been quite some time (2018) since I last took a detailed look at that page. There have been some minor revisions and this fact sheet has certainly been updated for the CISA branding. It is well worth the read.

I have no idea when either the page or the fact sheet was updated. DHS stopped the practice of dating their web products when changes were made. Without those dates it is impractical for me to go back and check every CFATS related page (and there are a very large number of them) to watch for changes. And OCS does not report the changes to their web site on their CFATS Knowledge Center web site like they used to.

OCS Publishes 2 New FAQs – 4-1-21

Today the CISA Office of Chemical Security (new name for the team running the CFATS program) added two new frequently asked questions (FAQ) to the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. Both FAQ’s provide links to new YouTube videos about the CFATS program.

The two new FAQs are:

• FAQ #1790 What is the Chemical Facility Anti-Terrorism Standards (CFATS)? (video resource)

• FAQ #1796 Does the Chemical Facility Anti-Terrorism Standards (CFATS) apply to my facility?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

These two videos can also be accessed via the new CFATS Video Resources page. That page also contains two additional video links. The four currently listed videos (with the appropriate YouTube links) are:

• What is CFATS?

• Does CFATS Apply to My Facility?

• The CFATS Process

• Risk-Based Performance Standards

I am not a big fan of video presentations, but that reflects my age and upbringing more than the efficacy of the media.

ISCD Updates 5 FAQ Responses – 2-16-21

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to five frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The same substantive change was made in each case.

The following FAQ responses were revised:

FAQ #1275 What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

FAQ #1557 What should a facility do if it believes the risk-based tier determination that the Cybersecurity and Infrastructure Security Agency (CISA) has assigned it no longer reflects the actual security risk posed to the facility?

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

FAQ #1666 Does a covered chemical facility have an obligation to notify the Cybersecurity and Infrastructure Security Agency (CISA) if the facility is closing?

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The same change was made in each of the five responses, a complete change in the snail mail address for CFATS notifications. The new address is:

Chemical Security, Associate Director

CISA – CHR STOP 0609

Cybersecurity and Infrastructure Security Agency

1310 N. Courthouse Rd.

Arlington, VA 20598-0609

Interestingly, these five FAQ responses were all changed in a similar way last December.

ISCD Updates 5 FAQ Responses – 12-21-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to five frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The same substantive change was made in each case.

The following FAQ responses were revised:

FAQ #1275 What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

FAQ #1557 What should a facility do if it believes the risk-based tier determination that the Cybersecurity and Infrastructure Security Agency (CISA) has assigned it no longer reflects the actual security risk posed to the facility?

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

FAQ #1666 Does a covered chemical facility have an obligation to notify the Cybersecurity and Infrastructure Security Agency (CISA) if the facility is closing?

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The same change was made in each of the five responses, a complete change in the snail mail address for CFATS notifications. The new address is:

Chemical Security, Associate Director

CISA – SCS STOP 0390

Cybersecurity and Infrastructure Security Agency

1401 South Clark St.

Arlington, VA 20598-0390

ISCD Publishes New Ammonium Nitrate Fact Sheet

Today the CISA Infrastructures Security Compliance Division (ISCD) published a link to a new ammonium nitrate fact sheet on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The fact sheet explains how the CFATS program addresses the two different forms of ammonium nitrate (AN) found in commerce in the United States. There is no new information or program interpretation provided in this fact sheet.

The CFATS program has two different entries for AN in Appendix A to 6 CFR 27, the list of DHS chemicals of interest (COI). The new fact sheet explains that the first listing in Appendix A is for forms of AN that are listed as DOT Division 1.1 explosives. Those forms of AN are addressed in the CFATS program as either a release-explosives (5,000-lb STQ) or theft-explosives security risk (400-lb STQ). Any commercial grade of AN that is a Division 1.1 explosive is covered under this listing in Appendix A.

The second listing for AN is for all other grades of ammonium nitrate where AN is at least 33% of material. This form of AN is addressed in the CFATS program as a theft-improvised explosive device precursor (IEDP) (2,000-lb STQ) security risk.

Facilities that have an amount of AN on hand in excess of the STQ for the form described above have a duty to complete a Top Screen submission to CISA so that ISCD can determine if the facility is at high-risk of terrorist attack and thus covered under the provisions of the CFATS program.

ISCD Updates 1 FAQ Response – 12-4-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to seven frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. There was a minor change in administrative procedures made.

The following FAQ response was revised:

FAQ #1275 What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

NOTE: The link provided for the FAQ in this post was copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1275 Minor administrative procedural change – In last paragraph added option to email or surface mail letters to ISCD where only the Fax option was included in the earlier version.

ISCD Updates 7 FAQ Responses – 11-24-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to seven frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The changes were non-substantive editorial revisions.

The following FAQ responses were revised:

FAQ #1653 If a facility is in a location where another entity provides certain security measures (e.g., industrial park, co-located facility, office park, etc.), can the facility include these security measures as part of its Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

FAQ #1724 How do National Terrorism Advisory System (NTAS) Alerts and Bulletins affect a CFATS facility’s RBPS 13 compliance responsibilities?

FAQ #1769 My facility must perform background checks in accordance with the Risk-Based Performance Standard (RBPS) 12 Personnel Surety on affected individuals. Who is an affected individual?

FAQ #1770 How will the Cybersecurity and Infrastructure Security Agency (CISA) protect the data it collects? Can Chemical-terrorism Vulnerability Information (CVI) be released under the Freedom of Information Act (FOIA)?

FAQ #1782 Are there any facilities statutorily excluded from the Chemical Facility Anti-Terrorism Standards (CFATS) regulation?

FAQ #1785 How does the Cybersecurity and Infrastructure Security Agency (CISA) notify a facility of its tiering?

FAQ #1793 When does a covered facility under the Chemical Facility Anti-Terrorism Standards (CFATS) program need to submit a revised or updated Top-Screen?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1653 Editorial change in answer – Replaced “;” with “,” between “located facility” and “office park”,

#1724 Editorial change in answer – Replaced “;” with “,” between “public safety” and “and recommended” in first paragraph,

#1769 Editorial change in question and answer – Removed “-“ between “(RBPS)” and “12”,

#1770 Editorial changes in answer – Removed unnecessary “ after “CFR § 27.400(d)"” and added space in “6 CFR §§ 27.300and 27.400(j)”,

#1782 Editorial change in question – Moved “(CFATS)” from behind “regulations” to behind “Standards”,

#1785 Editorial change in answer – Removed extra “.” After “(CFATS) regulation” in first paragraph,

#1793 Editorial change in answer – Added “,” after “every two years” in paragraph 2.

ISCD Updates 5 FAQ Responses – 11-20-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to 5 frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The changes were non-substantive editorial revisions.

The following FAQ responses were revised:

FAQ #1771 What documentation will I be asked to provide or make available for the Chemical Security Inspector during an Expedited Approval Program (EAP) Compliance Inspection (CI)?

FAQ #1772 Who will conduct the Chemical Facility Anti-Terrorism Standards (CFATS) Compliance Inspections for facilities in the Expedited Approval Program (EAP)?

FAQ #1773 Solid ammonium nitrate in the chemicals of interest (COI) column of Appendix A is listed as “Ammonium nitrate, solid [nitrogen concentration of 23% nitrogen or greater]” and has a minimum concentration of 33% under the Theft/Diversion security issue. In calculating whether a facility has a screening threshold quantity (STQ) of solid ammonium nitrate in a mixture, does the facility look at the percentage of the nitrogen in the mixture or the percentage of the ammonium nitrate in the mixture?

FAQ #1777 How do I determine “need to know” under Chemical-terrorism Vulnerability Information (CVI)?

FAQ #1782 Are there any facilities statutorily excluded from the Chemical Facility Anti-Terrorism Standards regulation (CFATS)?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1771 Editorial change in answer – Replaced “compliance inspection” with “CI”,

#1772 Editorial change in answer – Added “(CISA)” after “Cybersecurity and Infrastructure Security Agency”,

#1773 Editorial change in answer – Changed “6 C.F.R. §” to read “6 CFR §”,

#1777 No apparent change,

#1782 Editorial change in question – Changed “CFATS?” to read “the Chemical Facility Anti-Terrorism Standards regulation (CFATS)?”

ISCD Updates 5 FAQ Responses – 11-17-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to 15 frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. The changes were non-substantive editorial revisions.

The following FAQ responses were revised:

FAQ #1405 How will I know if the agricultural extension has been lifted and what to do next?

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

FAQ #1756 What action is required if a facility needs to change owner and/or operator names when it is not related to a transfer of ownership?

FAQ #1768 When will the Cybersecurity and Infrastructure Security Agency (CISA) grant access to the Chemical Security Assessment Tool (CSAT) Personnel Surety Program application if a facility chooses to meet Risk-Based Performance Standard (RBPS) 12(iv) by selecting Option 1 or Option 2 in its Site Security Plan (SSP)/Alternative Security Program (ASP)?

FAQ #1769 My facility must perform background checks in accordance with the Risk-Based Performance Standard (RBPS) 12 - “Personnel Surety” on affected individuals. Who is an affected individual?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1405 Change to URL for DHS updates page, old URL goes to new site,

#1620 No apparent changes,

#1756 Editorial change in answer – Changed “Office of Chemical Security” to “Chemical Security” in snail-mail address,

#1768 Editorial change in answer – Changed “Department” to “Agency”,

#1769 Editorial change in question and answer – Removed hyphen from “(RBPS) 12 – ‘Personnel Surety’” in both.

ISCD Updates 15 FAQ Responses – 11-11-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to 15 frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page.

The following FAQ responses were revised:

FAQ #1275 What needs to be done with the facility ID in the Chemical Security Assessment Tool (CSAT) when a covered chemical facility is bought or sold?

FAQ #1481 What factors does a facility need to account for when calculating whether a facility possesses the screening threshold quantity (STQ) for a theft/diversion chemical of interest (COI)?

FAQ #1489 Can a covered facility have contractors or lawyers fill out their Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

FAQ #1490 Must all employees involved in filling out the Top-Screen, Security Vulnerability Assessment (SVA), or Site Security Plan (SSP) at my facility be Chemical-terrorism Vulnerability Information (CVI) Authorized Users?

FAQ #1554 Does the Cybersecurity and Infrastructure Security Agency (CISA) have enforcement authority to fine noncompliant facilities, to include shutting down a facility?

FAQ #1620 How does an individual report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at one’s facility or another facility?

FAQ #1633 What is a proposed measure and why would a facility include one in their Site Security Plan (SSP)?

FAQ #1635 The Risk-Based Performance Standards (RBPS) for "Shipping, Receipt and Storage" (RBPS 5) and for "Theft and Diversion" (RBPS 6) in the Chemical Facility Anti-Terrorism Standards (CFATS) regulation (6 CFR §§ 27.230(a)(5) and (a)(6)) refer to "hazardous materials" and to "dangerous chemicals," respectively. Do those terms include any chemicals other than chemicals of interest (COI) listed in Appendix A of the CFATS regulation?

FAQ #1653 If a facility is in a location where another entity provides certain security measures (e.g., industrial park, co-located facility: office park, etc.), can the facility include these security measures as part of its Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)?

FAQ #1724 How do National Terrorism Advisory System (NTAS) Alerts and Bulletins affect a CFATS facility’s RBPS 13 compliance responsibilities?

FAQ #1735 How can a corporation with multiple facilities regulated under the Chemical Facility Anti-Terrorism Standards (CFATS) request the corporate approach and what benefits does this provide the corporation?

FAQ #1738 What is the difference between the Expedited Approval Program (EAP) and the Chemical Facility Anti-Terrorism Standards (CFATS) program?

FAQ #1745 If a facility has submitted a Site Security Plan (SSP) or an Alternative Security Program (ASP) in lieu of an SSP, but does not yet have approval, can it still be part of the Expedited Approval Program (EAP)?

FAQ #1750 What happens after I submit my Expedited Approval Program Site Security Plan (EAP SSP)?

FAQ #1751 If my facility has been issued a “letter of acceptance” through the Expedited Approval Program (EAP), but then the Cybersecurity and Infrastructure Security Agency (CISA) discovers that the measures in the Site Security Plan (SSP) insufficiently meet the risk-based performance standards (RBPS) during a Compliance Inspection, what happens?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1275 Editorial change to address – Changed ‘Chemical Security’ to ‘Office of Chemical Security’,

#1481 Editorial change to Question – Added ‘?’ at the end of the question,

#1489 Editorial change to Answer – Changed ‘(high risk)’ to ‘(high-risk)’,

#1490 Editorial change to Answer – In first paragraph changed ‘with regards to the SVA development’ to read ‘with regards to the development of the facility's Top-Screen, SVA, or SSP’,

#1554 Editorial change to Answer – In first paragraph changed ‘specified time frame’ to read ‘specified timeframe’,

#1620 Editorial change to Answer – In second paragraph changed type on email address to BOLD,

#1633 Editorial change to Answer – Added period at the end of each sentence in the subparagraphs,

#1635 Editorial change to Question – Changed ‘Risk-based’ to ‘Risk-Based’,

#1653 No apparent change,

#1724 Editorial change to Answer – In first paragraph changed ‘businesses and governments’ to read ‘businesses, and governments’,

#1735 Editorial change to Answer – In second paragraph changed ‘Chief of Regulatory Compliance’ to ‘Chief of Chemical Security’,

#1738 Editorial change to Answer – Changed ‘meets the applicable’ to read ‘meet the applicable’,

#1745 No apparent change,

#1750 Editorial change to Answer – In second paragraph changed ‘if DHS fails’ to read ‘if CISA fails’,

#1751 Editorial change to Question – Changed ‘Cyber Infrastructure Security Agency (CISA)’ to “Cybersecurity Infrastructure Security Agency (CISA).

ISCD Updates 4 FAQ Responses – 11-9-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page.

The following FAQ responses were revised:

FAQ #81 How do I register for the Chemical Security Assessment Tool (CSAT)?

FAQ #1194 Are facilities, particularly colleges and universities, able to avoid reporting certain chemical(s) of interest (COI) in their Top-Screen?

FAQ #1228 How is the screening threshold quantity (STQ) calculated for ammonium nitrate (AN) [with more than 0.2 percent combustible substance, including any organic substance calculated as carbon, to the exclusion of any other added substance]?

FAQ #1274 How can a person contact the Chemical Security Assessment Tool (CSAT) Help Desk?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

FAQ #81 Editorial substitution of ‘follow’ for ‘following’ in first sentence,

FAQ #1194 Editorial addition of ‘)’ after first CFR site,

FAQ #1228 Editorial removal of second ‘.’ after “5,000 pounds” in second paragraph, and

FAQ #1274 No apparent change except for date.

ISCD Updates 2 FAQ Responses – 10-13-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page.

The following FAQ responses were revised:

FAQ #1770 How will the Cybersecurity and Infrastructure Security Agency (CISA) protect the data it collects? Can Chemical-terrorism Vulnerability Information (CVI) be released under the Freedom of Information Act (FOIA)?

FAQ #1784 Does a facility have to count theft/diversion chemicals of interest (COI) in transportation packaging towards the screening threshold quantity (STQ) if the COI is on or attached to motive power, to include an overnight stay?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1770 Complete rewrite of FAQ and response, but no change in policy or procedure.

#1784 Provides links to regulation and Federal Register cites.

For reference purposes, here is what the language of FAQ 1770 and its response read before yesterday’s changes:

Question: Can Chemical-terrorism Vulnerability Information (CVI) be released under the Freedom of Information Act (FOIA)? 

Answer: No. Notwithstanding the Freedom of Information Act or FOIA (5 U.S.C. 552), the Privacy Act (5 U.S.C.552a), and other laws, in accordance with the Homeland Security Act as amended by the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, Public Law 113-254, and 6 C.F.R. § 27.400(g), records containing CVI are not available for public inspection or copying, and the Department does not release such records to persons without a need to know.

Further, as provided in 6 C.F.R. § 27.405, no law, regulation, or administrative action of a State or political subdivision thereof shall have any effect if such law or regulation conflicts with the Chemical Facility Anti-Terrorism Standards (CFATS). Requests for CVI under State or local FOIA or open records laws should be referred to the DHS National Protection and Programs Directorate (NPPD) Information Management and Disclosure Office, NPPD.FOIA@hq.dhs.gov.

If a record contains both information that may not be disclosed under Public Law 113-254 and information that may be disclosed, the latter information may be provided in response to a FOIA request, provided that the record is not otherwise exempt from disclosure under FOIA and that it is practical to redact the protected CVI from the requested record.

Note: Please refer to the “Safeguarding Information Designated as Chemical-terrorism Vulnerability Information (CVI) Handbook” for more information. The Handbook is available at https://www.dhs.gov/publication/safeguardinginformation-cvi-manual.

ISCD Updates 1 FAQ Response – 10-9-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to one frequently asked question (FAQ) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. None of the changes were substantive nor did they reflect policy changes.

The following FAQ response was revised:

FAQ #1785 How does the Cybersecurity and Infrastructure Security Agency (CISA) notify a facility of its tiering?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced response:

#1785 Replace ‘DHS’ with ‘CISA’, added regulatory links and replaced URLs with links.

ISCD Update 8 FAQ Responses – 9-29-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to eight frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center web page. None of the changes were substantive nor did they reflect policy changes.

The following FAQ responses were revised:

FAQ #1557 What should a facility do if it believes the risk-based tier determination that the Cybersecurity and Infrastructure Security Agency (CISA) has assigned it no longer reflects the actual security risk posed to the facility?

FAQ #1579 How does a facility define itself if it has multiple buildings, yet only a few select buildings possess chemicals of interest (COI) that are subject to being regulated by the Chemical Facility Anti-Terrorism Standards (CFATS) regulation?

FAQ #1612 What type of nitrocellulose is reportable as a chemical of interest (COI)?

FAQ #1735 How can a corporation with multiple facilities regulated under the Chemical Facility Anti-Terrorism Standards (CFATS) request the corporate approach and what benefits does this provide the corporation?

FAQ #1754 Does a facility have to report temporary holdings of chemicals of interest (COI) at or above the screening threshold quantity (STQ)?

FAQ #1765 What does a facility need to do to comply with the Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety Program (PSP) requirements that are in effect now that the program has been implemented?

FAQ #1787 How have covered chemical facilities generally complied with 6 CFR § 27.230(a)(12)(iii), which requires facilities to verify an affected individual is legally authorized to work?

FAQ #1793 When does a covered facility under the Chemical Facility Anti-Terrorism Standards (CFATS) program need to submit a revised or updated Top-Screen?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced responses:

#1557 Corrected typography error is question.

#1579 Editorial corrections and removes reference to CFATS final rule.

#1612 Replaces URLs with reference links.

#1735 Makes two paragraphs out of first paragraph.

#1754 Provides links to references and adds paragraph discussing fluctuating inventories.

#1765 Updated response to reflect the addition of Tier III and Tier IV facilities to Personnel Surety Program.

#1787 Replaces URLs with reference links.

#1793 Replaced ‘DHS’ with ‘CISA’ and removed red highlighting from last paragraph.

ISCD Updates 2 FAQ Responses – 9-9-20

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the responses to two frequently asked questions (FAQs) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. Most of the changes are non-substantive editorial changes, but there is a new link to a relatively new CSAT web page.

Updated FAQ

The following FAQ responses were revised today:

FAQ # 387 What if my facility will be adding a chemical of interest (COI) in the future?

FAQ #1143 What is required of co-located facilities regarding the Chemical Facility Anti-Terrorism Standards (CFATS)? Do both companies need to submit a Top-Screen and Security Vulnerability Assessment (SVA)/Site Security Plan (SSP)? Is it possible for the embedded facility to share the Top-Screen and SVA/SSP with the host company? If this is possible, what would be required by both companies to accomplish this and be compliant under 6 CFR Part 27?

NOTE: The links provided for the FAQs in this post were copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The following changes were made in the referenced FAQs:

#387 Adds link to new CSAT Top Screen Submissions Tips page,

#1143 Changed URLS to document links

Top Screen Submission Tips Page

According to the date on the web page it was originally published this last May, but this is the first time I have seen the page. The CFATS web site is huge and ISCD does not do a good job of communicating changes to the site.

This page begins with a brief overview of the purpose of the Top Screen. It then goes on to look at five major topics:

• Resubmissions for material modifications,

• Business operations: predictive top-screen filing,

• Business planning: hypothetical top-screen filing,

• Regular resubmissions, and

• Facility closures

I followed all of the links on the page and found that the following two pages had been updated since this new page was published:

Chemical Security Assessment Tool (CSAT) Top-Screen,

CFATS Covered Facilities and Inspections

I do not see any major changes to those pages.

ISCD Publishes ‘Bulk Packaging’ FAQ

Today the CISA Infrastructure Security Compliance Division (ISCD) published a new frequently asked question (FAQ) on the CFATS Knowledge Center. FAQ 1794 addresses the definition of the term “bulk transportation packaging” as used in the Top Screen Instructions.

FAQ 1794 asks: What constitutes “bulk transportation packaging”?

The answer provided is:

“Bulk transportation packaging is referred to in the Chemical Security Assessment Tool (CSAT) Top-Screen Instructions document found under the “User Manuals” section of the Knowledge Center homepage. Bulk transportation packaging includes transportation containers such as tank cars, barges, railcars, and other large storage containers that hold 4,000 pounds or more of chemicals of interest (COI) and that can be placed on or hitched to a vehicle and removed from a site.”

This definition is taken almost word-for-word from the Top Screen instructions for ‘Theft/Diversion’ chemicals of interest on page 8.