CFATS PSP – Facility Analysis

This is part of a continuing series of blog posts about the CFATS Personnel Surety Program that was described in a 60-day information collection request (ICR) notice in Friday’s Federal Register. This post will look at the facility analysis used to calculate the regulatory burden caused by this ICR. The earlier posts in the series are listed below.

DHS Publishes CFATS PSP 60-day ICR Notice

CFATS PSP – Data Submission Options

CFATS PSP – Who Gets Screened

CFATS PSP – Who Submits Information?

CFATS PSP – Other Information to be Collected

CFATS PSP – Only Tier 1 and 2 Facilities Impacted

CFATS PSP Comments – 03-30-31

This ICR notice provides a relatively detailed look at the facilities that are included in the CFATS program; providing information that has been difficult to obtain because of the Department’s security concerns.

Categorizing Facilities

The Department has established four general descriptive categories of high-risk chemical facilities based upon the types of DHS chemicals of interest (COI) they have on site and the size of the facility. Three of the categories describe facilities where the primary security concern is based upon the possession of release hazard COI and the fourth describes facilities where theft/diversion of COI is the major security challenge.

ISCD divides the release COI facilities, ‘loss of containment’ is the term used in the notice, into three groups based upon the size of the facility:

• Group A includes open facilities with 100 or more employees;

• Group B includes open facilities with 99 or fewer employee; and

• Group C facilities are enclosed facilities.

Table 4 in the notice provides a breakdown of the number of facilities in each category. I have provided a summary of that data in a slightly more readable format below.

	Tier 1	Tier 2	Tier 3	Tier 4	Total
Group A	4	8	22	72	106
Group B	6	16	33	190	245
Group C	10	15	66	13	104
T/D	93	400	935	1683	3111
Total	113	439	1056	1958	3566

Table 1: Number of Facilities

What is very interesting is that theft/diversion facilities clearly predominate in every tier, with only a total of 455 facilities where a catastrophic on-site chemical release is the primary security challenge. The notice addresses points out that:

“In the original 2007 CFATS Regulatory Assessment, conducted prior to implementation of the CFATS Program, the Department assumed that 38 percent of all high-risk chemical facilities would be regulated due to the risk that one or more chemicals could be subject to theft or diversion for purposes of creating an explosion or producing an improvised explosive device. However, the 2012 CFATS Personnel Surety Program Analysis found that 87 percent of all currently regulated CFATS high-risk chemical facilities are regulated due to the risk that a chemical could be subject to theft or diversion for purposes of creating an explosion or producing an improvised explosive device.”

Unfortunately, that description fails to take into account that some of the COI where theft/diversion is the primary security hazard are not used to make explosive devices, but rather chemical weapons. It probably doesn’t affect any of the numbers, but it provides some misleading information.

Number of Employees

DHS makes an attempt to estimate the number of employees and resident contractors working at these facilities. This initial estimate is based upon 2007 CFATS program estimates plus some recommendations for changes included in the comments from the earlier ICR submission. The table below summarizes the data from Table 9 in the notice which provides the estimate for the average number of full time employees/contractors at a facility in the category, plus 20% for turnover (they are using this number to estimate the number of people that will undergo a personnel surety check).

	Tier 1	Tier 2	Tier 3	Tier 4
Group A	3050	2176	3799	2207
Group B	50	49	68	200
Group C	201	418	409	265
T/D	46	46	46	46

Table 2: Update of 2007 CFATS personnel estimate

Looking at the numbers in the table above there seems to be some obvious problems with the models used to come up with these estimates. The variation in employee numbers from Tier to Tier within the same category is hard to explain when there is no variation in the numbers for threat/diversion facilities. With such a wide variance for data that is supposed to represent an average suggests that the standard variation within the data set is quite large. And, oh yes, the Group B definition was facilities with less than 99 employees; how did Tier 4 Group B get an average 200 employees and contractors?

One of the alternatives that ISCD mentions in the ICR notice is using data submitted by the facilities in their Top Screen submission. Table 3 below is a summary of that data reported in Table 10 in the notice. It includes the average Top Screen personnel numbers and an ACC estimate of the number of visitors to facilities (not by Tier) that will be given unescorted access requiring vetting.

	Tier 1	Tier 2	Tier 3	Tier 4	ACC Visitors
Group A	719	267	713	884	1746
Group B	43	36	39	20	437
Group C	360	587	225	211	437
T/D	783	499	279	234	73

Table 3: CFATS Top Screen Personnel Data plus ACC visitor estimates

Using the data from Table 3, and plant numbers from Table 1 ISCD estimates that they would have to process 1,806,966 personnel surety screenings in the first year of the program and a three year average processing of 864,678 per year if ISCD were going to require all four tiers to participate in the personnel screening program. Since initially only Tier 1 and Tier 2 facilities will participate the numbers are reduced to 412,647 in the first year and average 191,845 per year.

CFATS PSP – Only Tier 1 and 2 Facilities Impacted

This is part of a continuing series of blog posts about the CFATS Personnel Surety Program that was described in a 60-day information collection request (ICR) notice in Friday’s Federal Register. This post will look at the decision to only apply this ICR to Tier 1 and Tier 2 facilities. The earlier posts in the series are listed below.

DHS Publishes CFATS PSP 60-day ICR Notice

CFATS PSP – Data Submission Options

CFATS PSP – Who Gets Screened

CFATS PSP – Who Submits Information?

CFATS PSP – Other Information to be Collected

While the discussion through much of the ICR notice mentions all CFATS facilities, buried in the discussion of calculating the burden of the ICR is a statement that the ICR will only apply to Tier 1 and Tier 2 facilities.

Testing PSP

One of the suggestions that ISCD received after the last 30-day ICR notice was forwarded to OMB (and subsequently withdrawn) was that ISCD should do the same thing that it had done with most major CSAT tool deployments (excepting the SSP) and test the tool before it was officially deployed. This would allow the bugs to be worked out of the program.

While this probably would have been a good idea two years ago when the PSP was initially proposed (and before the Department started evaluating SSPs), this is no longer a reasonable prospect before the PSP ICR is submitted and approved. Too many facilities are receiving provisional authorizations for their SSP without a method being available to complete the personnel surety terrorist vetting required under RBSP #12.

Besides, even in conducting a test version of the PSP tool with live data (the only type of test that would be really worth while) would still require an approved ICR to collect the data and have it entered into the CSAT application. Thus the ICR must go forward without a live system test.

Limited PSP Implementation

ISCD has worked out a way to test the PSP application and the data collection and submission process from a variety of facilities, as well as evaluate the assumptions underlying the burden estimates in the ICR. They will limit the initial application of the PSP tool to just Tier 1 and Tier 2 facilities. They estimate that this will entail only 552 facilities and about 192,000 individual. This is compared to about 4,000 facilities and over 2 million individuals for a full deployment of the PSP.

Tier 3 and Tier 4 facilities are not being exempted from the PSP. ISCD intends that “ a subsequent ICR would be published and submitted to OMB for approval to incorporate any lessons learned and potential improvements to the CFATS Personnel Surety Program prior to collecting information from Tier 3 and Tier 4 high-risk chemical facilities” (78 FR 17696).

CFATS PSP – Other Information to be Collected

This is part of a continuing series of blog posts about the CFATS Personnel Surety Program that was described in a 60-day information collection request (ICR) notice in Friday’s Federal Register. This post will look at what additional information (in addition to the personally identifiable information (PII) previously discussed) ISCD might require a high-risk chemical facility to submit to DHS under the CFATS PSP. The earlier posts in the series are listed below.

DHS Publishes CFATS PSP 60-day ICR Notice

CFATS PSP – Data Submission Options

CFATS PSP – Who Gets Screened

CFATS PSP – Who Submits Information?

While the bulk of the information collection covered under this ICR will be the PII used to vet personnel against the Terrorist Screening Database (TSDB), there is additional information that ISCD will be collecting in its administration of the PSP at the Department level.

Information about the High-Risk Facility

Since the Department envisions that many high-risk facilities will use third-party organizations to submit the PII required for the PSP on it facility personnel, the PSP tool in the on-line Chemical Security Assessment Tool (CSAT) will require information “ that identifies the high-risk chemical facility, or facilities, at which each affected individual has or is seeking access to restricted areas or critical assets” (78 FR 17686). From that wording it would seem that vendors and contractors supporting multiple high-risk facilities will be required to identify which facilities they routinely support as part of their data submissions in the PSP tool.

Additional information may be collected from the facility about its PSP in support of adjudications under Subchapter C of 6 CFR Part 27; in processing requests for extensions,

High-risk chemical facilities will also be required to provide ISCD with a point of contact for the collection of additional information about the facility, its PSP, and individuals who have had their PII submitted for screening.

Additional PII

The previously identified PII will be routinely collected on any individual based upon which submission option the facility chooses to use in their PSP filings. ISCD realizes that from time to time they will have to request additional information about an individual to better confirm or deny potential matches in the TSDB. ISCD and law enforcement agencies might also be expected to contact the facility for further information about individuals that have been identified as matches against the TSDB. The notice makes the point that a “request for additional information from the Department does not imply, and should not be construed to indicate, that an individual is known or suspected to be associated with terrorism” (78 FR 17686).

Additional information may be collected about individuals in the PSP as part of the adjudications under Subchapter C described above. Additionally redress requests by individuals may require facilities to provide additional information about an individual. Unfortunately, this is the only mention of ‘redress’ for individuals who feel that they are wrongly identified as having terrorist ties. This may be because the Department will not necessarily notify the facility if an individual is identified as having terrorist ties and thus individuals are unlikely to know if they are wrongly identified.

The reference in this ICR to redress does mention (in a footnote) a series of Privacy Act documents that the Department issued in June of 2011 as part of the original ICR submission to OMB that was subsequently withdrawn. Those documents will certainly be revised as this new ICR moves forward.

Odd Information

There is one odd paragraph in this section of the ICR; it deals with the collection of what would generally be described as file numbers. The notice states that there will be ‘blank data fields’ in the PSP tool in CSAT that will allow the facility to enter a designation or number unique to an individual so that a facility may better track the data submission. I can’t see any reason why a facility submitting information on their own employees would really need this, but it would sure come in handy for third-party submitters, vendors and contractors who might need to keep track of what facilities are associated with a particular individual.

CFATS PSP – Who Submits Information?

This is part of a continuing series of blog posts about the CFATS Personnel Surety Program that was described in a 60-day information collection request (ICR) notice in Friday’s Federal Register. This post will look at how ISCD expects facilities to organize the submission of the required personally identifiable information (PII). The earlier posts in the series is listed below.

DHS Publishes CFATS PSP 60-day ICR Notice

CFATS PSP – Data Submission Options

CFATS PSP – Who Gets Screened

Facility Responsibility

The individual high-risk chemical facility covered under the CFATS program is responsible for implementing the Personnel Surety Program (PSP) as part of their facility site security plan (SSP). That does not mean, however, that they will be submitting the personal information on all of the people that work at the facility or will have unescorted access to critical areas of the facility as visitors, contractors or vendors. DHS has provided for a number of different options for the facility to use as part of its PSP. The four basic options are:

• The facility submits information on all affected individuals for the facility;

• The parent company submits information on all affected individuals for the facility;

• Either the facility or the parent company designates a third-party to submit the information; or

• The PSP includes some combination of the three for different classes of affected personnel.

The notice explains that vendors and contractors would have essentially the same options available for vetting their personnel that would have unescorted access to critical areas of high-risk chemical facilities. What is not made clear is how the vetting done by vendors and contractors would be communicated to the facility security manager and how those records would be made available to ISCD Chemical Facility Inspectors conducting compliance inspections. Would facilities have to submit the same type of abbreviated information that it does for personnel that had already undergone a TSA security threat assessment?

CSAT Application

Anyone that is familiar with the various roles defined in the current CSAT applications will quickly realize that only one of the options outline above could be directly rolled into the current CSAT roles of Authorizer, Submitter, Preparer and Reviewer. With this in mind the notice mentions a new role for the CSAT process; the Personnel Surety Submitter (PSS). As we saw when ISCD allowed for multiple submitters with the advent of the SSP tool, the notice makes clear that they expect that many facilities will use multiple PSS.

There is not a great deal of information in the notice about the PSS, but we can expect that the PSS will have to go through a similar process of identifying and notifying ISCD of the appointment of PSS. One would also expect that when an individual is logged into CSAT in a PSS role, they will only have access to facility PSP information. What is not so readily apparent is whether or not personnel with current access to the CSAT application in existing roles will be able to access the PSP information as well. Privacy issues may require limiting access to that information.

Another thing that is not immediately clear from this discussion in the PSP notice is the CVI status of the submitted information. Currently the Registration application and the Top Screen application do require that someone with access to those CSAT applications have completed the Chemical-Terrorism Vulnerability Information (CVI) training program. The two remaining CSAT applications (Security Vulnerability Assessment – SVA – and the Site Security Plan – SSP) do require the possession of a CVI training certificate to be able to access the applications. If it is determined that PSP information is not CVI, then it is likely that ISCD will not require CVI training for personnel performing PSS duties.

The CSAT User Roles and Responsibilities section of the notice does not address how vendors and contractors that will be submitting the information on their employees fit into this CSAT application process. Will their PSS have to be appointed by the Authorizer of the supported high-risk chemical facility or will a management member from the vendor or contractor be able to appoint their own PSS?

Realistically, these details will be more suited to explication in the inevitable revision of the CSAT Registration Manual that will be necessitated by the addition of the PSS to the list of positions that require CSAT Registration.