SSP Submission – RBPS #3 Screen and Monitor

This is another in a series of blog posting on the recently released Site Security Plan Instructions Manual and Questions Manual. The other blogs in this series are: Preparing for SSP Submission SSP Submission – Facility Data SSP Submission – Facility Security Measures SSP Submission – RBPS #1 Restrict Area Perimeter SSP Submission – RBPS #2 Secure Site Assets This posting looks at the SSP sections that deal with Screening and Monitoring access to the facility. Questions for this RBPS may be found in both the Facility and Asset level sections of the SSP. If the facility has indicated that there are asset specific security provisions at the site, they will be asked if there are RBPS #3 measures for each of the identified assets. An affirmative answer will require the answering of a series of questions about those measures. Screening Questions The first real question asks about the general level of screening conducted at the facility. With answers ranging from all vehicles and personnel entering the facility to no screening, it seems to be fairly easy to select an appropriate response. One slight draw back; the answers assume that similar levels of screening are being done for both personnel and vehicles. If one is being required to undergo a significantly higher level of screening than the other, use the “Other” response and explain the situation in the provided block. Then there will be individual questions about the use of screening on inbound and outbound vehicles and personnel. An affirmative answer to any of these questions will bring up additional detailed questions about how that screening is performed. The first question in the series asks about the methods used to perform the screening with four possible answers:

Not allowed on site Cursory inspection Random inspection Not applicable

These answers do not appear to include 100% screening, but that is misleading. If the facility were to select ‘Random inspection’ the subsequent question asking about the frequency of inspection includes an answer of ‘100%’. Thus a facility that does 100% screening should select ‘Random inspection’ for their response to the initial question. There is a special area for ‘Inbound Trucks and Railcars’. It is not clear from the information available in the Questions Manual whether these questions are limited to tank trucks and tank cars or if they also include dry-box trucks and rail cars. Looking at the earlier questions about inbound inspections, there are questions about inbound ‘delivery vehicles’ which could include dry-box trucks picking up shipments. I would probably tend to answer questions about dry-box trucks under the ‘delivery vehicle’ question and any boxcar rail shipments under the ‘Inbound Trucks and Railcars’ question. I base this assumption on the fact that both types of railcars are required to be inspected before loading under TSA rail security regulations (49 CFR §1580.107(a)) if they are being loaded with Rail Security-Sensitive Material. For facilities with Theft/Diversion COI there will be a series of question about inspections of outbound vehicles. It may seem strange to see the question about POV (personally/privately owned vehicles) outbound from ‘Theft COI Areas’, but this would be an appropriate question if POVs were allowed to be parked near warehouse areas where Theft/Diversion COI are stored or loaded onto trucks. If one of the vehicle types addressed in this section is not allowed to be parked near an area where Theft/Diversion COI are stored or handled, the appropriate answer would be ‘Not Applicable’. Similar questions are asked for a variety of personnel and their hand carried items. Again, there are separate questions for inbound and outbound inspections. The answers to these questions are essentially the same as those answered for vehicle inspections. Identification Verification The other area included in this section deals with the procedures that the facility uses to verify the identity of personnel entering the facility. The first set of questions in this section concern ‘General Identification Methods’. Two of the questions in this section seem to be out of place since they ask about checks of vehicles and hand carried items to prevent “the introduction of weapons, explosives, drugs, etc. into the facility” (pgs 116-7, Questions Manual). These questions were dealt with in great detail in the earlier ‘Screening’ section of the SSP. Most of the questions are fairly straight forward items asking about procedures for checking identification and the uses of badges and passes. One question seems a little bit odd in the way it is presented. On page 120 of the Questions Manual there is a matrix that looks at the types of badges and passes that might be used on one axis and the people that might be required to use those badges and passes on the other axis. Where the columns cross you find the typical ‘Yes’ and ‘No’ buttons. This is a an economical way of presenting these questions. The odd thing is the last entry on the ‘personnel’ axis; ‘N/A’. The only thing that I can think of is that a check in the ‘Yes’ box in the ‘N/A’ column automatically marks ‘No’ for all of the personnel responses for that ID type. Access Control System While Access Control Systems (ACS) are technically part of the ‘identification verification process’ they do deserve their own unique discussion. I was disappointed that Access Control Systems were not addressed in the RBPS Guidance document, but they are addressed here in the SSP. Unfortunately, from the information presented in the Questions Manual, it is not possible to tell if there will questions on the use of ACS in the asset security portion of this RBPS section. There are a similar series of questions to those seen in the CCTV and Alarm Systems section of the RBPS #1 questions. They ask where the ACS will be ‘controlled’, ‘administered’ and ‘monitored’. The way the ‘monitored’ question is presented (a ‘Yes’/’No’ choice for each location) that multiple answers to that question are expected. I have the same complaints about the lack of explanation for the distinction between ‘controlled’ and ‘administered’ that I expressed in the SSP RBPS #1 posting. Vehicle Restrictions The vehicle restrictions section of the RBPS #3 portion of the SSP looks at how the facility controls the movement of vehicles into and within the facility. This section uses a term that is derived from the design of European Castles; the ‘sally port’. In castle construction this was an area between the inner and outer walls of the castle where a force could assemble to ‘sally forth’ and conduct their counter attack It was distinguished by two sets of gates; one in each wall. In modern security usage it describes a protected area where an inspection can be conducted between two closed gates. Under high-threat conditions only one gate will be opened at a time. This section also includes questions about parking areas on and off site. There are questions about the parking situation allowed for a variety of classes of vehicles, including employee, contractor and visitor POVs. The other class of vehicles listed is ‘Delivery’ vehicles, so I guess this covers both pick-up and deliveries (answering a question earlier in this posting). One class of vehicles that is missing from this section is ‘Service Vehicles’; those vehicles driven by a wide variety of vendors that make deliveries and provide technical services at high-risk chemical facilities. They may include uniform, food and office supply vendors that do not typically make their deliveries to normal loading docks. They may also include a wide variety of technicians providing service to a wide range of specialty equipment. This may be especially critical since these vehicles are frequently parked in or adjacent to operational areas of chemical facilities.

Reader Comment – 06-10-09 – Identification of Assets

I got an interesting telephone call from a long time reader last night. He wanted to point out an apparent error in my posting yesterday about the SSP requirements for RBPS #2. I stated that the Facility Notification Letter included identification of assets. This reader, who has seen a number of these letters, noted that there is no listing of assets in any of the letters that he has seen. I have gone back and read the appropriate discussion in the Instructions Manual and can confirm that there is nothing there that indicates that DHS will identify covered assets. Actually, I find this kind of surprising because facilities did identify potential assets in their SVA filings and I would have thought that DHS would have used that information to provide a listing of assets that would have to be addressed in the SSP. This is especially true because of the amount of information that was collected in the SVA about individual assets. To clarify the actual requirement then, paragraph 5.0 (pg 37) of the Instructions Manual states that:

“A facility should complete this section [RBPS #2] if it has identified an asset or assets for special security treatment relevant to satisfying an RBPS and did not provide information about all relevant security measures for that RBPS in the facility-wide section. The security measures unique to an asset in this section should be clearly distinguishable from facility-wide security measures.”

The reader did provide some additional information about the Final Notification Letters. These letters provide a listing of the COI that must be addressed in the SSP (no news there). Along with the listing of the COI, DHS has provided the Tier Level ranking for each COI. A Tier 1 facility may have COI on site that only ‘requires’ protection appropriate to a Tier 2, 3, or 4 facility. This means that when doing asset specific security measures that Tier 1 facility should look at the metrics for the tier appropriate to that COI.

SSP Submission – RBPS #2 Secure Site Assets

This is another in a series of blog posting on the recently released Site Security Plan Instructions Manual and Questions Manual. The other blogs in this series are: Preparing for SSP Submission SSP Submission – Facility Data SSP Submission – Facility Security Measures SSP Submission – RBPS #1 Restrict Area Perimeter The Final Facility Notification Letter will include a list of facility assets with the associated COI that the facility must address in their site security plan (SSP). Section 5 of the Instructions Manual provides some over-all directions for the completion of this RBPS in the SSP. Unfortunately, there seems to be a serious disconnect between how the Instruction Manual and the Questions Manual address RBPS #2. The confusion caused by this disconnect is at least partially cleared up by referring to pages 52 thru 56 of the SSP Screenshots available on the CSAT SSP web page. Given the importance of the Screenshots document in understanding this RBPS, DHS should have listed the document in the Key Documents section of the CSAT web page. Incomplete Instructions The Instruction Manual notes that “DHS expects that RBPS 2 (Secure Site Assets) typically will be applicable to all facilities at either the facility-wide level or the asset level (or both). However, a facility must address RBPS 2 for each asset whether or not facility-wide security measures were previously entered” (pg 34, IM). This implies, and later discussion confirms, that the facility will be required to identify and describe each asset. The Questions Manual only mentions identification of assets obliquely, stating after the first “Are there any security measures…” question that the Preparer should if “answering at the Asset level, write the name of the asset for which you are providing answers.” There is no indication that each asset identified in the Notification Letter must be named and described as identified in page 52 of the Screenshots. Nor is there any mention of the long list of questions about each asset that are shown on page 53 of the Screenshots. Additionally, there is no indication in RBPS #2 the Questions Manual that the facility will have to identify those RBPS that have “asset-specific security measures that are different from the facility-wide security measures” (pg 39, IM). There are brief mentions in later RBPS sections that questions may apply to either facility or specific assets. If the facility is planning on using the Questions Manual as a workbook for data collection for their SSP submission I have some suggestions for modifying that manual. Copies should be made of pages 53 thru 55 of the Screenshots; one copy for each asset identified in the Notification letter and any other assets that the facility might wish to report upon. Then the same number of copies should be made of each of the pages in the Questions Manual for the following RBPS numbers 3, 5, 6 and 7. A copy set should be labeled and grouped together for each asset and tabbed for easy access. Barriers Most of the questions dealing with barriers are very similar to the questions in RBPS #1. The reason for that is relatively simple; barriers are very much the same whether they are located on the facility perimeter or on the perimeter of a restricted area within the facility. There are some new questions such as the one dealing with skylights in roofs because the assumption was made that buildings roofs would be inside the facility perimeter. Surprisingly there are a number of new questions that probably should have been included in RBPS #1. For example there are detailed questions about anti-vehicular barriers, which certainly are applicable to internal barriers, but would also apply to facility perimeter barriers. Other questions in this category include the questions on barrier upgrades. There are two questions about internal barriers that are surprising in their sophistication. There are two internal barrier questions that deal with movable barriers utilizing ‘dispensed liquids, foams’. I have only seen these obliquely mentioned in the literature and they are not addressed at all in the RBPS Guidance document. I would certainly be interested in hearing from anyone that sells or uses such barriers. Intrusion Detection Systems The questions about intrusion detection systems for this RBPS are nearly duplicates of the ones used in RBPS #1. There are some minor changes in wording, but the intent on the questions remains the same. Given the similarity in questions it is imperative that Preparers keep in mind that they should not duplicate the answers from RBPS #1 unless there are similar sensor systems in use around internal restricted areas. Security Lighting I hadn’t noticed that there were no questions about security lighting in RBPS #1 until I read the questions on security lighting in this RBPS. I have no idea why these questions were not included the RPBS #1 Questions; the subject is certainly addressed in nearly identical language in the two RBPS sections in the Guidance document. The questions here focus on where the security lighting is, the level of lighting provided at specific areas (site perimeter, gates, and other critical locations), and the percentage of gates and critical locations that are lighted.