Review - OCS Publishes CFATS Updates – 10-6-21

 Today CISA’s Office of Chemical Security updated the CFATS Monthly Statistics page, providing a look at the activities for the chemical security inspectors for the Chemical Facility Anti-Terrorism Standards (CFATS) program and the end-of-month snapshot of the status of the facilities in the Program. There was a slight decrease in the level of CSI activities and there was a net loss of nine facilities currently in the CFATS program.

For more details about how those numbers have changed over the last four months, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ocs-publishes-cfats-updates-10-6 - subscription required.

ISCD Updates Monthly Statistics – 9-1-20

Yesterday the CISA Infrastructure Security Compliance Division (ISCD) updated their Monthly Statistics page showing the ongoing operations and facility status in the Chemical Facility Anti-Terrorism Standards (CFATS) program. ISCD’s chemical inspectors continue to show a relatively aggressive operating tempo in a COVID-19 environment. Facility status information shows an apparent increase in the rate of facilities leaving the program.

ISCD Activities

The table below shows the activities conducted by the CFATS chemical security inspectors during the month of August.

Inspection Data	May-20	Jun-20	Jul-20	Aug-20
Authorization Inspections	0	1	10	24
Compliance Inspections	4	35	76	107
Compliance Assistance	0	198	162	115
Compliance Audit		27*	8	9
Total	4	261	256	255

The 27 Compliance Audits listed for June

were not included in the June report.

See here for last month’s report and an explanation for the new ‘Compliance Audit’ terminology.

The COVID-19 activity rate is higher than the average activity rate (214.5 activities reported per month) for CSI in the first seven months of 2019 (the last months where I kept detailed analytical records).

Facility Status

The table below shows the status of the facilities currently in the CFATS program.

Facility Status	May-20	Jun-20	Jul-20	Aug-20
Tiered	158	150	139	124
Authorized	138	130	141	147
Approved	3039	3061	3057	3056
Total	3335	3341	3337	3327

It is always a challenge trying to determine from this data exactly how many facilities have actually left the CFATS program. New facilities may have been added to the program as Top Screen submissions continue and there is status movement from Tiered to Authorized and Authorized to Approved to further complicate matters. I would confidently say ten facilities left the program, but it could have been more depending if new facilities were added to the program in the last month.

Facilities can leave the program if their status as being at ‘high risk of terrorist attack’ changes due to modifications in their inventory of DHS chemicals of interest causes a drop below appropriate thresholds.

ISCD Publishes June 2017 CFATS Update

Today the DHS Infrastructure Security Compliance Division (ISCD) published their June 2017 CFATS Monthly Update a couple of days early. Interestingly the update was announced (or at least noted) on their Chemical Facility Anti-Terrorism Standards (CFATS) landing page, but not the CFATS Knowledge Center. I expect that we will see it announced there in the coming days.

Changes in Information

ISCD continues their old technique of keeping 90+% of the verbiage on the Monthly Update the same; just updating (most) of the data that changes. Table 1 below summarizes the current facility data from last month and this month.

Current Facilities	May 2017	June 2017	∆
Covered Facilities	2,570	2,750	+180
Authorization Inspections	2,386	2,349	-37
Approved Security Plans	2,281	2,282	+1
Compliance Inspections	1,921	1,996	+75

Table 1: Current Facilities

The decrease in the number of ‘Current Facilities’ with Authorization inspections almost certainly indicates that there continues to be facilities that are leaving the CFATS program. ISCD does not specifically include a reporting of that number, but we can get a pretty good guess from the figures that they provide in their ‘Since Inception of Program’ reporting. Table 2 shows a comparison of those numbers in the two latest reports.

Total Facilities	May 2017	June 2017	∆
Authorization Inspections	2,914	2,918	+4
Approved Security Plans	2,719	2,726	+7
Compliance Inspections	2,053	2,201	+148

Table 2: Total Facilities

Comparing the ∆ column (or the change between the two reports) we can see that there were at least 4 (+3) new authorization inspections conducted and 7 (+6) site security plans approved. Additionally, there were 148 (+73) compliance inspections completed. This should mean that we have had at least 82 (3 + 6 + 73) facilities leave the program in the Month of May. That should also mean that a total of 262 (180 + 73) new facilities were added to the CFATS program. The change in facility numbers pretty well tracks with what ISCD reported for the initial results for CSAT 2.0.

Missing Information

As long time readers might expect, there are additional pieces of information that I wish ISCD would include in their reporting. First I would like to see some additional reporting on the continued progress of the CSAT 2.0 implementation; numbers like the total number of Top Screen notification letters sent to date and the total number of Top Screen 2.0 submissions received.

Additionally, ISCD could have update the numbers that they have reported in the ‘**’ footnote in the Update. They continue to report that:

“DHS continues to issue new high-risk tiering determinations as Top-Screens are submitted. 2,268 [emphasis added] of the currently covered facilities were tiered using CSAT 2.0, and 302 [emphasis added] were tiered using the prior methodology.”

Finally, I have to harp on something or no one would believe it was me writing the blog. I really wish that ISCD would add go/no-go stats to their reporting on compliance inspections. It would be very informative to see whether or not there is an improvement over the nearly 50% no-go rate seen earlier in the program.

Manual Update

If you peruse (very closely) the updated CFATS landing page today you might have noticed that ISCD has also published another updated version of their CSAT 2.0 Security Vulnerability Assessment/ Site Security Plan Instructions manual. This is version 2.0.15. There are no details in the manual about what has been changed, but it looks like ISCD is continuing to tweak their manuals to improve clarity.

This was not announced on the CFATS Knowledge Center either. Again, we will probably see a note there in the next couple of days.