DHS Updates CFATS Fact Sheet

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) published the latest CFATS Update with basic program numbers through February 1^st.

Table 1 shows the basic numbers for January and February. The February 20^th data comes from DHS written testimony at the HR 4007 hearing last month.

	Feb 1st	Feb 20th	Mar 1st
Covered Facilities	4,266	4,202	4,199
Assistance Visits	1,379		1,402
Total SSPs Authorized	986	1,049	1,169
Authorization Inspections	642	781	834
Total SSPs Approved	417	540	554

CFATS Program Statistics

Covered Facilities

The stats for the number of covered facilities are a little surprising. Assistant Secretary Durkovich, in response to questions at last month’s hearing on HR 4007, reported that as a result of cross checking the EPA RMP list with the CFATS list ISCD had sent letters to over 3,000 facilities that had not filed Top Screens. Director Wulf reported at that same hearing that over 800 Top Screen submissions had already been received from those facilities.

I would have expected that the ‘Covered Facilities’ number would have started to increase as a result of these new submissions. Two things could be at play here. First, the Top Screen submissions were new enough that ISCD had not yet had a chance to make a preliminary finding of being at high-risk at many or any of these new facilities. Second, the rate of facilities leaving CFATS because of plant closures, inventory reductions or COI removals had accelerated so that they outweighed the increase in new facilities. I really suspect that it is probably a combination of the two.

We also need to remember that historically ISCD has only preliminarily declared about 10% of the facilities that have filed Top Screens to be at high-risk of terrorist attack. Give that figure; we would only expect about 300 of the newly identified facilities to be added to the CFATS rolls.

Site Security Plans

ISCD continues to show improvements in the total number of authorized and approved site security plans (SSPs). Table 1 shows the total number of facilities with approved and authorized SSPs.

Table 1: Totals to Date

Table 2 shows a real improvement in the rate that site security plans were authorized; an average of more than six per work day; easily the highest to date. The approved plan rate does not appear to be keeping pace. The daily average is only about 2.5, falling behind last month’s rate and far behind the best rate of almost 5 facilities per day seen in September.

Table 2: Daily Rate

I don’t understand why ISCD continues to ignore the PR potential of being able to utilize the written portion of these updates to explain the good and the bad numbers seen in these reports. I would be willing to bet that there is a reasonable explanation for the poor approval rate seen last month, but ISCD does not seem to want to publicly acknowledge the issue.

The HR 4007 hearing last week gave ISCD a pass on the whole issue of authorizations and approvals; failing to ask even the most basic questions. Continued poor approval performance is sure to finally attract the attention of the politicians in the next six months or so; probably about the time that the DHS spending bill comes to the floor. CFATS may not be able to withstand that kind of attention again.

Compliance Inspections

I still have some concerns about whether or not they are going to be able to maintain this kind of approval rate as the requirements to conduct compliance inspections continues to rise.

To date ISCD Chemical Facility Inspectors have only had to conduct 12 such inspections (as of February 20^th). This will begin to be an issue early this summer as last spring’s start of significant SSP approvals means that facilities become eligible for inspection. These numbers should begin to appear on the CFATS Update in the near future.

SSP Authorization Backlog

One of the problems that is currently facing the CFATS program is the problem of the backlog of authorizations and approvals of site security plans for covered facilities. The latest data that I have seen shows a total of 4298 CFATS covered facilities with 598 authorized site security plans and 182 approved plans. At the current rate of approvals, it is going to take from 7 to 10 years to clear that backlog and that is assuming that there is no significant increase in the number of covered facilities.

There are probably some increases in efficiency to be expected as ISCD gets more and more of these processes under their belt. But there is still a limit to the number of facilities that the current inspection force can reasonably and effectively visit in any given amount of time. Additionally, these same inspectors are going to be expected to start compliance inspections later this year and at some point in time ISCD is going to start implementing the Ammonium Nitrate Security Program (ANSP). That is going to decrease the staff support available for completing the site security plan reviews.

It is clear that some sort of radical game changing plan is going to have to be put into place. Doubling or tripling the number of Chemical Security Inspectors (NOTE: I really wish that ISCD would change that job title to ‘Chemical Facility Security Inspectors’ so that we don’t have to use the ‘CSI’ acronym) is clearly not an option. So we are going to have to reduce the number of site security plans reviewed or at least the level of review applied.

We already have a risk tiering system that divides the covered high-risk chemical facilities into for risk tiers. The folks at ISCD have concentrated their work on the highest risk tiers first, essentially having completed the authorization of all Tier 1 facility site security plans and most of the SSP approvals for that Tier. A great deal of work has already been done on the Tier 2 facilities. What if we reduce the level of review necessary for the Tier 3 and Tier 4 facilities?

Actually, I would prefer to suggest that we adopt the EPA and OSHA regulatory model (the first time that those response/safety plans are reviewed is when an inspector shows up at the facility) for those facilities, but the §550 authorization for the CFATS program specifically requires the Secretary to “review and approve each vulnerability assessment and site security plan”.

I think that for the Tier 3 and 4 facilities, the process would be better served if the review and approval process were conducted along the same lines as those used for the review and approval of the security vulnerability assessments. These are currently done as a mostly automated review of the submissions with some expert review but no visits conducted by the CSI staff. This would certainly speed up the authorization and approval process.

This would also have the added benefit of freeing up the CSI for the even more arduous task of conducting facility inspections to ensure that facilities are adequately complying with their site security plans. Properly done, this will be a much more time consuming task than checking to see if site security plans cover the necessary requirements.

CFATS Update – June 2013

As I noted in a lunch-time addendum to this morning’s post about the bad link to the CFATS Update, ISCD has corrected that bad link. The new link takes one to the most up-to-date information that ISCD has provided to date about the CFATS program.

Updated CFATS Status

The table below shows the data from the new update as well as the similar numbers from the initial two updates.

	April 2013	May 2013	June 2013
Facilities currently covered by CFATS	4382	4351	4331
Removed, reduced or modified COI holdings	2900	3000	3000
Facility Assistance Visits	1202	1242	1253
SSP Authorized	280	380	469 (10.8%)
SSP Approved	53	85	125 (2.9%)

This new data shows continued improvement in the SSP approval process. At the current rate of authorization, it will take a little more than 43 months (3.6 years) to get all facilities authorized (3862 Remaining/89 authorized last month). Looking at approved SSPs the same way, it will take about twice as long (8 years) for all facilities to get their SSP approved (3862 Remaining/40 approved last month.

Data Problems

There is a minor problem with that analysis. The June update says that the data was correct as of June 6^th. There was no such note on the April or May updates. I had assumed that they were up-to-date as of the first of the month. If that is true, then the approval rate has slowed just a little bit over the last month and the extrapolated completion dates would move about by some unknown, but small, amount.

Information

 The written portion of the update sheet was modified a little bit this month; removing the ‘CFATS Guiding Principles’ section found in the previous report. The freed-up space was filled with a brief description of the facility types for the first 100 SSP approvals. It notes that 26% of those were semiconductor manufacturing facilities and the balance included: chemical and non-chemical manufacturing facilities, distribution warehouses, industrial gas plants, research and development facilities, waste management facilities, food processing plants, pest control facilities, and one university. Given the resistance DHS got from educational facilities from the very beginning, the last facility on the list impresses me somewhat.

One final Issue

There is one small untruth in the data reported above. There are actually no facility SSPs approved. The Personnel Surety standard has not been met by any of these facilities because no one has been able to vet their employees or unescorted visitors against the Terrorist Screening Database. All of the ‘approved’ SSPs are conditional approvals pending the approval of the CFATS Personnel Surety Program.