CFATS Tiering Fact Sheet – 5-30-21

Today I saw an interesting post on LinkedIn by Bryan McDonald, a chemical security inspector with the Office for Chemical Security in CISA. His post pointed at a Chemical Facility Anti-Terrorism Standards program fact sheet on “Tiering Methodology” that I had not seen. This is a nice overview of the enhanced tiering process that DHS started as part of their CSAT 2.0 upgrade back in 2016.

I was able to trace the fact sheet back to the “CFATS Tiering Methodology” web page. It has been quite some time (2018) since I last took a detailed look at that page. There have been some minor revisions and this fact sheet has certainly been updated for the CISA branding. It is well worth the read.

I have no idea when either the page or the fact sheet was updated. DHS stopped the practice of dating their web products when changes were made. Without those dates it is impractical for me to go back and check every CFATS related page (and there are a very large number of them) to watch for changes. And OCS does not report the changes to their web site on their CFATS Knowledge Center web site like they used to.

DHS CSAT FAQ Updates 07-02-10

As part of the introduction for the new CFATS Knowledge Center (which I covered yesterday) DHS updated three previously published responses to Frequently Asked Questions (FAQ), printed five new FAQ with responses, and added four new articles about CFATS related topics.

Updated FAQ 1368: Are background checks required for fire department personnel (firefighters and fire protection engineers)? If so, would the background check used for initial employment be acceptable? 1387: When logged in to TS, how do you know which role you are logged in as? 1546: Does a facility have to go through the CSAT process if it has already implemented security measures? The responses to the first two questions listed above were identical to the previously printed versions as far as I can tell. Why they were given new ‘published’ dates I don’t know. I don’t have a copy of the previously published version (8-15-08) of the response to 1546 in my files, but there doesn’t appear to be anything new in the current response. The short answer to that FAQ is, of course, yes. New FAQ 1652: What is a “critical asset”? 1653: If my facility is located in an office park complex and the office park complex has certain security measures, can the facility include these security measures as part of its Site Security Plan? 1654: Would disapproval of an SSP and/or receipt of a guidance letter from DHS be a good time to ask for inspector assistance? 1655: My tiered facility possesses only Theft/Diversion COI. Do I need to address all of the RBPS or just #6 pertaining to theft/diversion? 1656: In preparing its SSP, how can a facility provide information about changes in security measures to reflect changes in threat level? Any time that DHS publishes a new FAQ on this page I will continue my previous practice (from the CSAT FAQ Page reviews) of recommending that all CFATS related personnel should read the response. At the very least it will provide an understanding of the thought processes currently in vogue at ISCD; certainly a valuable bit of knowledge. It is not often that I find fault with the guidance included in the response to these FAQ. I have never found anything obviously wrong, but from time to time I find that the response does not cover an obvious complication or problem that should clearly be addressed. I found one in the response to question 1653 about including office park security measures on the SSP for a high-risk facility within the office park. The DHS response essentially says that the facility can use a variety of ‘Other’ text boxes to report these security measures and then reminds the facility that: “Sites must be prepared to provide documentation about these procedures even though they are provided by another party.”

This kind of overlooks the fact that DHS considers the security measures on the approved SSP to be part of the security requirements for the high-risk facility; requirements that can only be changed with the advanced approval of DHS. Since the office park management is not a party to this agreement, they can discontinue any of the park security measures at anytime that they wish; leaving the facility high-and-dry when it comes to SSP compliance. This ought to at least be mentioned in this response. I was especially happy with the DHS response to FAQ 1656 about security measures for periods of increased risk. DHS notes that RBPS 13 and 14 contain questions “related to variable security measures under different threat conditions, including predictable times of changed threat like a hurricane evacuation [emphasis added], holiday shutdown, or turnaround”. High-risk chemical facilities need to include security planning in all of their emergency response plans; regardless of whether or not those plans are specifically terrorist related. During any emergency response situation the facility will be more vulnerable and may be a higher visibility target due to news coverage.

New Articles 1667: Consolidating CSAT User Accounts 1668: CSAT User Account Passwords 1669: How DHS “Tiers” Chemical Facilities 1670: How DHS Notifies a Facility of Its Preliminary or Final Tiering As I noted in yesterday’s blog, the folks at ISCD have started to provide more detailed articles on various aspects of the CFATS process. It is apparent that these articles are not developed in response to a specific question received by the Help Desk personnel. I would assume that it is probably based upon a pattern of questions received at the Help Desk or asked directly of on-site inspectors. In any case, because of the depth of the discussions involved, I would certainly recommend that all CFATS related personnel should read each of these articles as they are issued and/or revised. All four of the articles listed in this week’s updates of Knowledge Center are well worth reading. Of particular interest to all high-risk facilities will be the article on facility tiering (1669). This is a particularly good discussion of the reason for, and process of placing facilities in these risk-based tiers. There is one sentence in this article that bears particular attention. It is found towards the end of the article and states:

“The Department’s tiering algorithm is classified, but the presence or quantity of a particular chemical of interest (COI) listed in Appendix A is not the sole factor in determining a facility’s tier, nor is it an indicator of a facility's eventual or continued coverage under the rule [emphasis added].”

I have been hearing rumors that this last phrase has been cropping up more frequently in discussions around DHS about the implementation of inherently safer technology (IST), particularly reducing or removing COI from high-risk facilities. It seems that there may have been some instances that the CFATS processes may have identified facilities that could be of enough of terrorist target that they would need to remain on the high-risk facility list even if their COI were reduced below the screening threshold quantities (STQ) listed in Appendix A. I’m not sure how a facility would respond to being told that their hard work at reducing their COI below STQ levels did not remove them from CFATS coverage. I would suspect that there would be some facility management that might get extremely upset. Politically, this could call into question the justification for potentially mandating IST implementation. It would be interesting to see how this would play out, if and when.

Reader Comment – 11-22-09 – Chlorine Cylinders

I had an interesting comment from Edward posted to an earlier blog, but he was addressing our anonymous engineer from New Zealand. Edward wrote (in part):

“The issue with the Chlorine is theft, and not a volumetric release so the factors used would be the inherent security of the facility, its proximity areas of consequence (towns, built up areas other infrastructure etc) and climactic conditions like the prevailing winds. While I cannot speak for DHS at all, I have not seen a facility with chlorine 1 ton cylinders as a COI in rural areas listed as Tier 1 or 2. My questions include: Where is your facility being built? Are there plans to continue to build around it? What populations concentrations exist and how far away are they? There are many other questions, but they border on CVI, so they are best left out.”

Theft vs Release Edward makes an interesting point about chlorine (and a number of other COI as well), it actually falls under multiple categories; it is a Release Toxic COI and a Theft Weapons of Mass Effect (WME) COI with separate a STQ for each (2,500 lbs and 500 lbs respectively). Edward does make a common mistake however. While a single ‘1 ton’ cylinder certainly does not hold a toxic release STQ, two such cylinders certainly do. DHS in their Top Screen requires facilities to report total inventory on site, so a facility with 16 ‘1 ton’ cylinders would be require response under both theft and release for the SSP. Actually, the bulk of Edward’s comment reflects considerations for the chlorine in the release toxic mode, rather than the theft mode. He makes a very good point, however in noting that the number of cylinders or pounds of chlorine for that matter would never be the sole factor in determining the risk tier of a facility. That is why DHS does not make a final tiering decision until the SVA is submitted. Covered Water Treatment Facilities Edward opened his comments by writing that “I have several clients that use chlorine for water treatment and their Tier rating varies dependent upon many other factors than just number of cylinders.” Now CFATS does not currently cover water treatment or waste water treatment facilities that are covered by specific EPA regulations, so Edward is obviously not talking about those types of water treatment facilities. But, having worked for a company that manufactured water treating chemicals, I am well aware that there is an awful lot of water treating going on in this country that does not meet the requirements of those particular exemptions. DHS vs EPA One last point I want to make; when we talk about security requirements for drinking water treatment facilities and waste water treatment works, it does not currently look like DHS will be making those tiering decisions when HR 2868 (or a similar Senate bill yet to be introduced) becomes law. The EPA will get to write those rules. While the Administrator is probably going to be required to ‘consult with’ DHS, it will still be EPA rules that will determine water facility rankings. Since COI are not the only concern at these facilities, a drinking water treatment facility could conceivably be ranked at Tier 1 without the presence of any COI; though I would only possibly expect that with the largest drinking water facilities. In any case, thanks for the participation Edward. NOTE to Readers You’ll notice that I try to address substantive reader comments in ‘Reader Comment’ blogs. The reason is that few readers will be going back to an August blog posting just to look for reader comments (as was done in this case). But I do have a number of people who find this site through search engines linking them to posts on specific issues. Since I am now moderating comments (approving them before they make it to the site), I can make sure that the comments made to even the oldest posts get the attention they deserve. Readers can continue the conversation by responding to the comment in the original posting (as Edward did) or to my newer ‘Reader Comment’ posting. If you are actually replying to the comment it might be better to reply at the original posting in case the initial commentor is watching that posting for comments. If you are responding to my comments, responding to the ‘Reader Comment’ blog may be more appropriate. I’ll try to ensure that these comments get tied back to the earlier posting.