DHS CSAT FAQ Page Update – 11-20-09

Last week DHS added four new questions to their CSAT Frequently Asked Questions (FAQ) web page. One question was already addressed here last week; the other questions were: 1648: How does a SSP user navigate through the SSP Tool? How are answers to questions saved in the SSP Tool? 1650: What happens after a facility submits its Site Security Plan (SSP)? 1651: How do I start an SSP? After Initial SSP Submission As more and more facilities complete the submission of their SSP the inevitable question is what happens next; that is answered in the response to question 1650. Once DHS receives the submission they will review the submission. The first review is largely automated; a check to see if all of the appropriate questions have been answered for all of the COI listed in the notification letter. Then a number of subject matter experts will review the details of the submission to see if the plan meets all of the requirements of 6 CFR 27.225. If all of the issues are adequately addressed, DHS will issue a ‘Letter of Authorization’ that ‘authorizes’ the facility to proceed with the implementation of the Site Security Plan outlined in their submission. DHS will then schedule a site inspection to determine if the facility is in compliance with their SSP. The inspectors will look at the existing and planned security procedures that are detailed in the submission to ensure their adequacy in meeting the risk-based performance standards outlined in the regulations. DHS has told Congress that they expect to start the inspections in December with priority being given to the Tier 1 facilities that were required to submit their SSP’s earlier this fall. If the facility’s SSP submission is inadequate, DHS has two different approaches that it can take. If the facility appears to be on the right track, but has some issues with its submission DHS will send the facility a guidance letter that outlines specific things that are missing or need clarification with the facility submission. Provisions are made for additional consultation with DHS to correct these deficiencies. As part of that consultation the facility might consider asking for courtesy inspection where an inspector will visit the facility to look at the facility’s situation and security measures. This visit will not be considered to be the SSP inspection. If the facility’s SSP submission is completely inadequate DHS may formally disapprove the SSP. The letter making that notification will outline the deficiencies in the SSP. Instructions on how to proceed and a new deadline for correcting those deficiencies will be included. Facilities should keep in mind that the Secretary has the authority to seek civil sanctions on non-compliant facilities including issuing a cease operations order until the facility is in compliance. One would assume that those options would be outlined in the notification of disapproval. SSP CSAT Tool Both of the other questions deal with the actual operations of the SSP tool. Facilities that have yet to start their SSP submission should read these two responses to reinforce the instructions provided in the SSP on-line instructions manual and the initial notification letter. The brief responses will not be an adequate substitute for reading the actual instructions, but do serve to re-enforce some key points.

Preparing for SSP Submission

Now that the CSAT SSP tool is open and available for SSP submissions high-risk chemical facilities will need to get serious about completing their site security plans and preparing for SSP submission. Facilities cannot begin the submission process until they receive their Final Notification Letter (FNL) from DHS officially designating them a High-Risk Facility, assigning them to a Tier level, defining the chemicals of interest (COI) that must be covered in the SSP, and outlining the security/vulnerability issues that must be addressed by the Risk-Based Performance Standards (RBPS) listed in 6 CFR §27.230. The letter also provides the submission deadline that marks the end of the 120-day submission requirement. Facility CSAT Personnel Roles All facilities that receive an FNL will have already submitted two documents using the Chemical Security Assessment Tool (CSAT). The Preparer, Submitter, Reviewer and Authorizer roles from those earlier submissions will be the same for the SSP Submission. The Preparers will typically be responsible for data entry. Reviewers will be able to look at the SSP submission on-line, but will not be able make any changes to the data. The Submitter will be responsible for the final facility review and actually submitting the completed SSP to DHS. The Authorizer will have no direct role in the SSP submission beyond verifying to DHS any changes made to the Preparers or Submitter. Facilities may authorize a single person to have multiple roles with the exception of Reviewers; no one designated a Reviewer will be allowed to be a Preparer or Submitter. Typically those individuals who were assigned to Preparer, Submitter, Reviewer roles in earlier CSAT submissions will be performing the same roles during the SSP submission. This is not, however, required by DHS. Facilities may make changes to any of these roles at the start of the SSP submission process. Additionally, multiple Preparers and Reviewers may be added for each facility. Facilities must remember that anyone accessing the facility records in CSAT must have completed the on-line CVI training and is an Authorized CVI User. Multiple Preparers DHS has added provisions for facilities to use multiple Preparers, something new for the SSP Tool. They recognize that there will be a number of facilities that will be using people variety of technical skills and backgrounds for preparation of the SSP. The decision was made to allow facilities to decide to allow those subject matter experts to help prepare the SSP submission in their respective specialty areas. The SSP Instructions manual implies that multiple Preparers may be working on the SSP at the same time when it says (page 9): “When multiple preparers are updating the same SSP, changes made by one will be visible to the others as soon as those changes are saved (by clicking Save, Next or Back).” This appears to be misleading because the same document later notes that SSP must be completed sequentially. On page 11 it explains that:

“That is, when you jump back to a previous section, all preceding sections will become un-highlighted [inaccessible] and you will be required to page through all the subsequent pages of the SSP tool. This is necessary because the SSP tool adapts the pages presented for completion based on answers on previous pages and a change within one section might require you to answer additional/different questions later.”

Given that subsequent pages may affected when data is entered into an SSP page, it will be a good idea for facilities to coordinate the data entry efforts made by multiple Preparers. When changes have to be made on previously completed sections it will certainly be a good idea for Preparers to review subsequent sections that have already been completed. This will make the review job of the Submitter much easier and reduce the number of SSPs rejected by DHS. Data Preparation The Instructions manual (page 5) provides a fairly comprehensive list of resources that facilities will need to complete the SSP submission process. The DHS list includes such things as copies of the CFATS regulations, the facility Top Screen and SVA submission, a copy of the FNL, among other things. All of the things on the list will undoubtedly be valuable for the Preparers and Submitter have readily at hand during the preparation for the SSP submission. In fact, it would make things much simpler if all of this material were maintained in a lockable office set up just for CFATS administration at the facility. This would make it much easier to comply with rules for safekeeping of CVI. A number of the items on the DHS list of resources are CVI and draft documents that the facility compiles for the purpose of SSP submission will be CVI as well. A dedicated room to which only CVI authorized personnel will have access to will make the required CVI security procedures much less intrusive to the SSP preparation and submission process. One invaluable resource that is not included on the DHS list is the SSP Questions manual. This manual provides a list of the questions found on the SSP tool. With room available to record answers and write notes this manual can serve as a workbook for the off-line preparation of the SSP submission. Again, as soon as any facility information is added to this manual it becomes CVI and only CVI Authorized Users may have access to the annotated document. The manual can also be used as a management tool for assigning responsibility for collecting and developing submission data. The manual can be printed and taken apart to provide teams or responsible individuals as an assignment template. This will allow them to work on portions that they are most familiar with. This will also provide for management review and approval of the data before it is added to the on-line tool. This will also make the Submitters review easier before the SSP is actually submitted to DHS. Once again, these partial documents will become CVI as soon as facility information is added. This means that marking and security provisions will apply to these portions of the manual and only CVI Authorized Users may work with them.