CISA Announces ChemLock Security Awareness Training – 2-25-25

I got an email from CISA today (nothing special about me here, anyone can sign up for these emails here) about a new chemical security awareness training program being offered by the ChemLock folks. The email reported that:

“The Cybersecurity and Infrastructure Security Agency (CISA) is proud to announce the new ChemLock: Security Awareness Training, which helps employees at all levels of an organization understand the risk of dangerous chemicals, their responsibility in protecting those chemicals from malicious actors, and what to do when they recognize potential threats.”

The new program (ChemLock: Security Awareness Course) comes with its own web page that provides a program overview, and the current schedule of on-line presentations. That page notes that:

“This interactive, practical, no-cost course runs approximately 1 hour in length and is appropriate for personnel at all levels of an organization regardless of their security expertise or involvement with dangerous chemicals.”

If you have a large digital TV in your training room, you might want to schedule key personnel to participate in a group training program.

NOTE: This is the ChemLock program as it currently exists, not the enhanced program that I have been advocating since the start of the year.

DHS Publishes Chemical Security Awareness Training ICR

Today the DHS National Protection and Programs Directorate (NPPD) published a 60-day information collection request (ICR) renewal notice in the Federal Register (80 FR 57200-57201) for their Infrastructure Assessment and Training Program. This ICR used to be for the Chemical Security Awareness Training Program that I first wrote about in 2008, but was apparently canceled earlier this year.

The notice now describes the ICR as supporting the IP Gateway that consists of three separate collection activities:

• General User Registration;

• Chemical Security Awareness Training Registration, and

• User Satisfaction Survey

The last time that this ICR was approved (2011) DHS expected [.DOC download] 400,000 responses/participants per year at one hour per response (the total for registration, training and post training survey). That number was an estimate based upon the number of workers in the chemical industry not actual participation in the program that had been running for about three years at that point.

The current ICR notice expects just 9,000 participants in the program but they expect 5 hours of response burden for each participant. This would mean that the training portion of the program would be significantly longer than the earlier CSATP.

NPPD is soliciting comments on this ICR. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # DHS-2014-0010). Comments should be submitted by November 23, 2015.

Commentary

Readers will recall that last week I complained that there was no chemical sector specific training available from DHS. I hope that this ICR submission indicates that that is only a temporary condition. I look for to seeing this new 5 hour long chemical security awareness training program.

TSA Motor Carrier Hazmat Training ICR – 30-day Notice

The Transportation Security Administration published a 30-day information collection request (ICR) notice in today’s Federal Register (76 FR 31971) concerning a planned voluntary security-related training course for the Hazardous Materials (Hazmat) motor carrier and shipper industry. Approval of the new ICR by the Office of Management and Budget (OMB) would allow TSA to collect information on a training evaluation form.

The notice explains that TSA will be producing the voluntary security awareness training program and making it available as live instruction and as an on-line training program. Additionally, TSA intends to send a DVD copy of the training program to all DOT registered HAZMAT shippers and motor carriers.

Public comments on this ICR may be submitted directly to the OMB via email to oira_submission@omb.eop.gov, addressing it to the Desk Officer, Department of Homeland Security/TSA.

Workplace Security Awareness Training

Last night I completed the on-line FEMA Workplace Security Awareness (IS-906) training program. This course presents information on how employees can contribute to their organization's security. It covers much of the same information as the chemical sector security awareness training program provided by DHS but includes additional information on areas such as cyber security and the handling of bomb threats.

The format for the training program is much more traditional than the chem. sector training program. Once you get passed the introductory material most of the material is presented as written matter. I’m not sure why this is the case, but even with most of the video presentations this training program contains a dearth of audio material.

The lack of audio for most of the videos makes them practically worthless. I recommend skipping any video that includes the notation that it does not include audio; you get a better understanding of the scenario from the written description provided than from the audio-less video.

As with almost all on-line training programs this is designed to be completed by individuals. There is a 15 question test that can be taken at the end of the training; successfully completing the test (75% to pass) provides the individual with certificate of completion that can be used to document training completion for various regulatory training requirements. Note: the email provided the link to the actual certificate is not a clickable link, you need to copy/paste it into your browser for it to work.

Group Training

For facilities that prefer to conduct their regulatory required training in a classroom environment, this program could be used, but the reliance on reading the information really does make it impractical. FEMA has provided a summary of the course material that could be readily turned into a slide presentation that could be used for a traditional classroom presentation. They also provide a copy of the test that could be used to document the training for meeting regulatory requirements.

Since government publications are not covered by copyright laws, I will not be surprised to see enterprising consultants adapting this summary into pretty PowerPoint® presentations. It could be worth the cost if it were pretty enough.

Valuable Information

There is some good supplementary information provided in the training program that any security manager ought to keep handy. The Additional Resources page of the presentation is a good example, providing links to all sorts of good information. This page is certainly worth copying.

Finally, there is a link to the DHS Bomb Threat Checklist. When I was in the Army we had a similar form at every phone. I have not seen them since I got out of the Army in 1987. Every corporate telephone should have one underneath it for ready access in the event a bomb threat is received. It provides an excellent reminder of how to handle such telephone calls and a ready form for recording critical information.

Training Resource

Personally I prefer the more innovative training program produced by the Chemical Sector Office, but this training program is certainly a worthwhile addition to any organization's security training program.

OMB Approves Chemical Security Awareness Training ICR

Last Friday the Office of Management and Budget provided their approval of the information collection request (ICR) for the DHS Chemical Security Awareness Training Program. I have previously described this on-line training program that helps CFATS and non-CFATS covered chemical facilities train their employees on the types of security threats that they should be aware of while working at a variety of chemical facilities.

Since this ICR supports a voluntary training program, it really is a non-issue. Even though the previous ICR expired last October, it had no practical effect on the operation of the training program. This is just one of those bureaucratic ‘dot-the-i and cross-the-t’ exercises that Federal government agencies must periodically go through. The ICR approval process helps to ensure that the Federal government doesn’t impose undue burdens on the public, but that isn’t really an issue in this instance.

One of the reasons that I am ‘wasting’ time on reporting this approval today is that I always enjoy pointing out the silly mistakes that government agencies are prone to. I reported in an earlier blog that the OMB had the wrong date in their system for the publication date for the 30-day ICR notice in the Federal Register. Well, apparently no one at the OMB reads this blog because they continue to report the wrong date for the submission of that notice. Furthermore, the Federal Register Citation they provide for that 30-day notice is actually the citation for the earlier 60-day notice.

On a more controversial ICR this mistake might actually cause some sort of minor problem. In this case I really doubt that anyone is going to be going back to research the approval process of this ICR as part of any legal defense against a DHS enforcement action.

Reader Comment – Awareness Videos

Jon Greenwood provided an update to my previous blog about the security awareness training video that his team has available. Where previously they had a video trailer available on-line for their video, they now have the complete video available for on-line review. They also now have a MARSEC/TWIC customization available for review.

I haven’t had a chance to review these complete videos, but that is the whole point of having them available on-line. You don’t have to rely on my opinion of how well they will fit your particular training needs; you can check them out yourself. As someone who has been responsible for planning training, this is a very valuable service and I commend Greenwood Security for making these available for preview.

Security Awareness Training

I got a short email from Jon Greenwood of Greenwood Security. He wanted to let me know that they had finished their security awareness training video and have posted a video trailer on the internet. They are advertising this video as a training tool that can be used to meet the security awareness training requirements for the CFATS, MTSA and TSA Pipeline security programs.

I’m glad to see that they are using an old-style film advertising technique to give the chemical security community a chance to take a look at the video before they consider buying this. The production values of the clips included in the trailer look good and the information is well presented. I particularly like the ‘low probability but you got to be safe’ attitude of the presentation.

How does this compare with the DHS provided on-line training for security awareness that I’ve discussed before? Well this is targeted at a slightly different audience. The DHS program is targeted at the on-line individual training where videos like this one are better suited to classroom instruction. They both have their place in a security awareness training program.

Jon’s email does mention that Greenwood Security can customize their video for either company or site specific applications. This is certainly an interesting idea and is certain to catch the attention of corporate audiences. Training videos are frequently tuned out by many employees, but the inclusion of scenes that include the facility and, maybe more importantly, employees can help to attract and retain employee attention.

I still would like to see someone do a security awareness training video that uses the scenario based technique used in the DHS on-line program. I have used videos like this in a number of different safety training programs. Stopping the video after each scenario provides a good chance for an interactive discussion. These discussions always make for a more effective training session as they more actively involve the students and make them think about the material being presented.

One last thing about security awareness training (or any kind of mandated training for that matter); don’t forget the end-of-class test. A simple ten question written test helps focus the student’s attention and is the perfect compliance record. While most inspectors will accept a signed class roster, nothing makes them happier than being able to look in an employee’s training folder and be able to see a copy of the test the employee took at the end of mandatory training. Where tests are provided as part of a training package, I always like to modify them by adding at least some site-specific questions and terminology.

BTW: The Greenwood Security web site does have a nice Training page, but it doesn’t list individual products (and no link to this trailer, unfortunately) or provide pricing. I guess you would have to contact them to get the details if you are interested.