ISCD Publishes Latest CFATS Update – 05-01-15

This afternoon the folks at ISCD published their latest CFATS Update showing the current status of site security plans and the number of facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program. As we have seen over the last year or so, there has been a continued steady increase in the number of facilities that have had their site security plans authorized and approved.

Current SSP Statistics

ISCS is still not including in this update either an accounting of the number or status of facilities that have undergone a CFATS compliance inspection; the next step in the CFATS process. With less than 300 facilities yet to receive SSP authorization (and many of these may not have yet reached the point in the CFATS process where they have even submitted SSPs for review) I would expect more attention to have been applied to the compliance inspection portion of the program.

Covered Facilities

We are continuing to see a steady decline in the number of facilities that are still covered under the CFATS program. This month I have changed the graph to only show the data since January 2014 since there was a significant change (acceleration) in the rate of decline starting at that point (I described this in an earlier post).

I did a simple statistical analysis of the data provided in the chart above looking at the rate of change. Using the simple linear analysis tools in MS Excel® I determined the equation for that rate of decline and the R² value for that regression.

y = -63.025x + 4353

where: y = the number of covered facilities and

                      x = the number of months since January 2014

The R² value for this data set is R² = 0.9867. My statistics professor from a couple of decades ago considered an R² of > 0.99 to indicate a significant correlation between the two sets of data; this is pretty close. If this correlation continues (a BIG IF; no cause and effect relationship has been established) we could expect there to be no facilities in the CFATS program after sometime in the middle of October 2019.

This is, of course, a pretty silly application of statistical analysis, but since we have no statistical data from ISCD on the reasons for removal from the CFATS program we are reduced to playing these types of analytical games.

Expedited Approval Facility Process

With more than 91% of the currently covered facilities having an authorized site security plan under the current CFATS program, it would seem that there is much less need for the Expedited Approval Facility (EAF) process required by HR 4007. Depending on the actual content of the EAF requirements to be published next month by ISCD it might be easier for facilities with authorized SSPs to continue in the current approval process than change their existing plans to conform to the EAF plan.

A quick reminder hear, HR 4007 specifically provides ISCD with the authority {§2102(c)(4)(B)(ii)} to publish the EAF plan requirements without going through the publish and comment process required for a normal change in regulations. The deadline for the publication of the EAF guidance document is June 16^th and Tier 3 and 4 facilities without an approved SSP have 30 days (July 16^th) to decide if they want to use the EAF process instead of the standard SSP approval process.

While I suspect that there has been some discussion with industry about the EAF process there have been no public statement from DHS about how this program will work. I’m pretty sure that some of the procedural details are still being worked out.

DHS Updates CFATS Fact Sheet

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) published the latest CFATS Update with basic program numbers through February 1^st.

Table 1 shows the basic numbers for January and February. The February 20^th data comes from DHS written testimony at the HR 4007 hearing last month.

	Feb 1st	Feb 20th	Mar 1st
Covered Facilities	4,266	4,202	4,199
Assistance Visits	1,379		1,402
Total SSPs Authorized	986	1,049	1,169
Authorization Inspections	642	781	834
Total SSPs Approved	417	540	554

CFATS Program Statistics

Covered Facilities

The stats for the number of covered facilities are a little surprising. Assistant Secretary Durkovich, in response to questions at last month’s hearing on HR 4007, reported that as a result of cross checking the EPA RMP list with the CFATS list ISCD had sent letters to over 3,000 facilities that had not filed Top Screens. Director Wulf reported at that same hearing that over 800 Top Screen submissions had already been received from those facilities.

I would have expected that the ‘Covered Facilities’ number would have started to increase as a result of these new submissions. Two things could be at play here. First, the Top Screen submissions were new enough that ISCD had not yet had a chance to make a preliminary finding of being at high-risk at many or any of these new facilities. Second, the rate of facilities leaving CFATS because of plant closures, inventory reductions or COI removals had accelerated so that they outweighed the increase in new facilities. I really suspect that it is probably a combination of the two.

We also need to remember that historically ISCD has only preliminarily declared about 10% of the facilities that have filed Top Screens to be at high-risk of terrorist attack. Give that figure; we would only expect about 300 of the newly identified facilities to be added to the CFATS rolls.

Site Security Plans

ISCD continues to show improvements in the total number of authorized and approved site security plans (SSPs). Table 1 shows the total number of facilities with approved and authorized SSPs.

Table 1: Totals to Date

Table 2 shows a real improvement in the rate that site security plans were authorized; an average of more than six per work day; easily the highest to date. The approved plan rate does not appear to be keeping pace. The daily average is only about 2.5, falling behind last month’s rate and far behind the best rate of almost 5 facilities per day seen in September.

Table 2: Daily Rate

I don’t understand why ISCD continues to ignore the PR potential of being able to utilize the written portion of these updates to explain the good and the bad numbers seen in these reports. I would be willing to bet that there is a reasonable explanation for the poor approval rate seen last month, but ISCD does not seem to want to publicly acknowledge the issue.

The HR 4007 hearing last week gave ISCD a pass on the whole issue of authorizations and approvals; failing to ask even the most basic questions. Continued poor approval performance is sure to finally attract the attention of the politicians in the next six months or so; probably about the time that the DHS spending bill comes to the floor. CFATS may not be able to withstand that kind of attention again.

Compliance Inspections

I still have some concerns about whether or not they are going to be able to maintain this kind of approval rate as the requirements to conduct compliance inspections continues to rise.

To date ISCD Chemical Facility Inspectors have only had to conduct 12 such inspections (as of February 20^th). This will begin to be an issue early this summer as last spring’s start of significant SSP approvals means that facilities become eligible for inspection. These numbers should begin to appear on the CFATS Update in the near future.

DHS Updates CFATS SSP Status

Last weekend I complained about the CFATS Update being late. It turns out that I may have been a little unfair in that assessment. Yesterday the folks at the DHS Infrastructure Security Compliance Division (ISCD) posted their November CFATS Update Fact Sheet to the Critical Infrastructure: Chemical Security web site. The reason for the ‘delay’ is that they changed the ‘as of date’ from the first of the month to November 19^th to provide a full month of regulatory activity instead of reporting the calendar month that was half ate up due to the federal funding fiasco. That change in reporting period may have ended up being a political miscalculation. It turns out that there was a dramatic drop in the SSP approval rate and with the changed effective date it can’t be blamed on Congress.

The Data

To see what I mean just look at the Total Number of SSPs Authorized/Approved graph below. The number of Authorized plans continues to grow nicely, but there is only a small growth in the number of Approved plans.

The true extent of the problem can be better seen in the SSPs Authorized/Approved per Day graph below. This shows that the SSP daily approval rate is the lowest since ISCD started providing these updates in April.

In fact, if you look at the total number of facilities yet to be approved and allow ISCD a 50 week work year at 5 days per week, it will take ISCD 27.1 years to complete the remainder of the SSP approvals at the daily rate exercised in the latest period.

The Problem

Two weeks ago I reported a potential reason for this drop in approval rates. I had heard from the field that there has been an increasing number of instances where the subject matter experts at ISCD Headquarters were over ruling the recommendations from the chemical security inspectors (CSI, again PLEASE lets change their title to get rid of that acronym) on the approval of the site security plans at the smaller chemical facilities. These are the facilities that are now typically being visited in the SSP approval/authorization process.

The whole point of the tiering process in CFATS was to ensure that the lower risk facilities only had to have security measures commensurate with the risk they faced. A realistic security program has to take into account that smaller facilities (usually from smaller companies) also will not have the expertise and resources (manpower and money) to have as elaborate a security system as larger facilities. But, they also have the advantage of having fewer people on site who all know each other and know more about the facility details than would the employees and contractors at a larger facility. Security anomalies will be caught faster at these smaller facilities than would similar situations at the bigger, more anonymous chemical plants.

We should be seeing an increase in the rate of authorizations and approvals for site security plans now that the bulk of the large, complex facilities have been taken care of. It should be taking a smaller team of CSI to visit each facility. The inspections should be taking less time as there is less stuff to look at. The CSI proficiency at conducting the inspections should be increasing and the contractors supporting the facility security plans should have a better understanding of the SSP authorization and approval process. All of this means that we should be seeing an acceleration in the rate of authorizations and approvals, not a slowdown.

The Alternative View

Now there may certainly be another explanation for the delay. The FFF may have caused a number of CSI to quit, for instance (I have not heard of any such reports, but it is possible). As always, I freely offer to provide ISCD Director Wulf, or any of his staff, open access to this forum to provide another explanation for the change in the SSI approval rate.

In any case, we will be hearing an explanation when he goes back before Congress. Any one of three House committees and the Senate Homeland Security Committee are all about due to hold CFATS oversight hearings again in the near future. And they are notoriously less likely to actually listen to the response.

NOTE: Graphs were added at 11:15 CST on 11-26-13

SSP Authorization Backlog

One of the problems that is currently facing the CFATS program is the problem of the backlog of authorizations and approvals of site security plans for covered facilities. The latest data that I have seen shows a total of 4298 CFATS covered facilities with 598 authorized site security plans and 182 approved plans. At the current rate of approvals, it is going to take from 7 to 10 years to clear that backlog and that is assuming that there is no significant increase in the number of covered facilities.

There are probably some increases in efficiency to be expected as ISCD gets more and more of these processes under their belt. But there is still a limit to the number of facilities that the current inspection force can reasonably and effectively visit in any given amount of time. Additionally, these same inspectors are going to be expected to start compliance inspections later this year and at some point in time ISCD is going to start implementing the Ammonium Nitrate Security Program (ANSP). That is going to decrease the staff support available for completing the site security plan reviews.

It is clear that some sort of radical game changing plan is going to have to be put into place. Doubling or tripling the number of Chemical Security Inspectors (NOTE: I really wish that ISCD would change that job title to ‘Chemical Facility Security Inspectors’ so that we don’t have to use the ‘CSI’ acronym) is clearly not an option. So we are going to have to reduce the number of site security plans reviewed or at least the level of review applied.

We already have a risk tiering system that divides the covered high-risk chemical facilities into for risk tiers. The folks at ISCD have concentrated their work on the highest risk tiers first, essentially having completed the authorization of all Tier 1 facility site security plans and most of the SSP approvals for that Tier. A great deal of work has already been done on the Tier 2 facilities. What if we reduce the level of review necessary for the Tier 3 and Tier 4 facilities?

Actually, I would prefer to suggest that we adopt the EPA and OSHA regulatory model (the first time that those response/safety plans are reviewed is when an inspector shows up at the facility) for those facilities, but the §550 authorization for the CFATS program specifically requires the Secretary to “review and approve each vulnerability assessment and site security plan”.

I think that for the Tier 3 and 4 facilities, the process would be better served if the review and approval process were conducted along the same lines as those used for the review and approval of the security vulnerability assessments. These are currently done as a mostly automated review of the submissions with some expert review but no visits conducted by the CSI staff. This would certainly speed up the authorization and approval process.

This would also have the added benefit of freeing up the CSI for the even more arduous task of conducting facility inspections to ensure that facilities are adequately complying with their site security plans. Properly done, this will be a much more time consuming task than checking to see if site security plans cover the necessary requirements.

CFATS Update – June 2013

As I noted in a lunch-time addendum to this morning’s post about the bad link to the CFATS Update, ISCD has corrected that bad link. The new link takes one to the most up-to-date information that ISCD has provided to date about the CFATS program.

Updated CFATS Status

The table below shows the data from the new update as well as the similar numbers from the initial two updates.

	April 2013	May 2013	June 2013
Facilities currently covered by CFATS	4382	4351	4331
Removed, reduced or modified COI holdings	2900	3000	3000
Facility Assistance Visits	1202	1242	1253
SSP Authorized	280	380	469 (10.8%)
SSP Approved	53	85	125 (2.9%)

This new data shows continued improvement in the SSP approval process. At the current rate of authorization, it will take a little more than 43 months (3.6 years) to get all facilities authorized (3862 Remaining/89 authorized last month). Looking at approved SSPs the same way, it will take about twice as long (8 years) for all facilities to get their SSP approved (3862 Remaining/40 approved last month.

Data Problems

There is a minor problem with that analysis. The June update says that the data was correct as of June 6^th. There was no such note on the April or May updates. I had assumed that they were up-to-date as of the first of the month. If that is true, then the approval rate has slowed just a little bit over the last month and the extrapolated completion dates would move about by some unknown, but small, amount.

Information

 The written portion of the update sheet was modified a little bit this month; removing the ‘CFATS Guiding Principles’ section found in the previous report. The freed-up space was filled with a brief description of the facility types for the first 100 SSP approvals. It notes that 26% of those were semiconductor manufacturing facilities and the balance included: chemical and non-chemical manufacturing facilities, distribution warehouses, industrial gas plants, research and development facilities, waste management facilities, food processing plants, pest control facilities, and one university. Given the resistance DHS got from educational facilities from the very beginning, the last facility on the list impresses me somewhat.

One final Issue

There is one small untruth in the data reported above. There are actually no facility SSPs approved. The Personnel Surety standard has not been met by any of these facilities because no one has been able to vet their employees or unescorted visitors against the Terrorist Screening Database. All of the ‘approved’ SSPs are conditional approvals pending the approval of the CFATS Personnel Surety Program.