Looking Back – 3-14-10 – SSP Experience

Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list. 

Today a blog post from March 14th, 2010, “Reader Comment 03-13-10 SSP Experience”. This was part of an ongoing conversation that took place in this blog about the early days of the Chemical Facility Anti-Terrorism Standards (CFATS) program. While that program is dead, and the specific program discussion of mostly historical interest, there is an ongoing hope that the CFATS program in some form may be resurrected int he 120th Congress. Hopefully, a rejuvenated CISA would take a hard look at the lessons learned in standing up a new chemical security program. 

Review – 6 Advisories and 1 Update Published – 10-1-26

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Meari, Johnson Controls (2), ABB, Monta, and Armatura. They also updated an advisory for products from CISA. 

Advisories  

Meari Advisory - This advisory describes two vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The vulnerabilities were reported to CISA by Gabriel Adams. CISA notes that: “Meari did not respond to CISA's coordination attempts.” 

Johnson Controls Advisory #1 - This advisory describes a cleartext transmission of sensitive information vulnerability in the Johnson Controls EasyIO Neo Series EC and CW Controllers. The vulnerability was reported by Gabriele Gardois. 

Johnson Controls Advisory #2 - This advisory describes an exposure of sensitive information to an unauthorized actor vulnerability in the Johnson Controls EasyIO Neo Series EC and CW Controllers. The vulnerability was reported by Gabriele Gardois. 

ABB Advisory - This advisory describes two vulnerabilities in the ABB Protection and Control IED Manager PCM600. The vulnerabilities were reported by Abhinav Agarwal.  

Monta Advisory - This advisory describes four vulnerabilities in the Monta monta.app EV charging application. The vulnerabilities were reported to CISA by an anonymous researcher. 

Armatura Advisory - This advisory describes five vulnerabilities in the Armatura LLC Armatura One web-based security platform. The vulnerabilities were reported to CISA by Andrew Capobianco of RewCon.co. One of the vulnerabilities is included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog. 

Updates  

CISA Update  

This update provides additional information on the Malcolm advisory that was originally published on September 11th, 2026. The new information includes adding self-reference to Web version. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-1-update-published-fd7 - subscription required. 

Review – Bills Introduced – 9-29-26

On Tuesday, with just the Senate in session, there were 44 bills introduced. Two of those bills would receive additional coverage of the blog: 

S 5576 A bill to establish the Artificial Intelligence Safety Board, and for other purposes. Warner, Mark R. [Sen.-D-VA]    

S 5590 A bill to require the Secretary of Defense to submit a plan to identify, prioritize, and remediate the presence of certain equipment and computational facilities owned or controlled by a foreign adversary in the electric grid of the United States, and for other purposes. Banks, Jim [Sen.-R-IN]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-9-29-26 - subscription required. 

CSB Announces Release of Husky Fire Safety Video

Yesterday, the Chemical Safety Board announced that they had released their latest safety video, “Alarming Mistakes, Deadly Decisions: Fatal Fire at BP-Husky”. The video looks at the September 2022 incident at the BP-Husky refinery in Oregon, Ohio.  It looks at the events that led up to the naphtha release and fire at the refinery that killed two employees, as well as the safety issues identified and recommendations made by the CSB as a result of their investigation. 

 

EPA Sends TCE Compliance Extension NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) on “Trichloroethylene (TCE); Regulation under the Toxic Substances Control Act (TSCA); Additional Compliance Date Extensions”. 

This rulemaking was not included in the 2026 Unified Agenda. 

The EPA has been postponing the effective date of “certain regulatory provisions of the final rule entitled “Trichloroethylene (TCE); Regulation Under the Toxic Substances Control Act (TSCA)”” pending ‘judicial review’ since January 28th, 2025. The latest such extension was published on May 5th, 2026. 

Short Takes – 9-30-26 - Federal Register Edition

Avian Influenza  

Amendments To Import Requirements for Highly Pathogenic Avian Influenza. APHIS notice of proposed rulemaking. Summary: “Current APHIS regulations specify that live birds and other avian commodities may not be exposed to highly pathogenic avian influenza (HPAI) or sourced from premises quarantined for HPAI within the 90 days immediately preceding export to the United States. We are proposing to reduce this timeframe to 28 days preceding export to the United States. This action is necessary to align APHIS regulations with international standards regarding HPAI transmission. This action would allow foreign regions to resume the export of live birds and other avian commodities to the United States sooner following an outbreak of HPAI, while still providing adequate safeguards that the importation of the birds or other avian commodities does not present a risk of disseminating HPAI within the United States.” 

Medical Device Security  

Robotically-Assisted Surgical Devices-Premarket Submissions; Draft Guidance for Industry and Food and Drug Administration Staff. FDA notice of availability. Summary: “The Food and Drug Administration (FDA or Agency) is announcing the availability of the draft guidance titled “Robotically-Assisted Surgical Devices—Premarket Submissions.” This draft guidance provides draft recommendations for premarket submissions for robotically-assisted surgical devices (RASDs). This draft guidance is not final nor is it for implementation at this time.” NOTE: includes cybersecurity guidance. 

Space Geek  

Name of Information Collection: NASA Small Business Supplier Development Program (Formerly Known as the NASA Mentor-Protégé Program). NASA 30-day ICR revision notice. Summary: “The purpose of the Program is to provide incentives to NASA prime contractors (mentors) to assist small businesses and other protégés to enhance their capabilities and increase their participation in NASA, other Government, and in commercial contracts and subcontracts. Under the Program, mentor-protégé agreements specify the assistance to be provided by the mentor and agreement milestones, as well as reporting requirements for the mentor and protégé firm. This information collection (i.e., application and reports submitted pursuant to mentor-protégé agreements) is required by NASA to monitor the performance and progress of both the mentor and the protégé in this developmental assistance program.” 

Request for Comment on the Draft Environmental Assessment for Blue Origin New Glenn Cadence Increase at Space Launch Complex 36A, Cape Canaveral Space Force Station, Florida. FAA notice of availability. Summary: “In accordance with the National Environmental Policy Act of 1969, as amended (NEPA), DOT Order 5610.1D, DOT's Procedures for Considering Environmental Impacts, and FAA Order 1050.1G, FAA National Environmental Policy Act Implementing Procedures, the FAA is announcing the availability of and requesting comment on the Draft Environmental Assessment Blue Origin New Glenn Cadence Increase at Space Launch Complex 36A, Cape Canaveral Space Force Station, Florida (Draft EA).” 

Notice of Intent To Prepare a Supplemental Environmental Impact Statement (SEIS) and Open a Public Scoping Period for the SpaceX Starship-Super Heavy Operations at Space Launch Complex 37 at Cape Canaveral Space Force Station, Cape Canaveral, Florida. FAA notice of intent. Summary: “In accordance with the National Environmental Policy Act of 1969, as amended (NEPA), FAA Order 1050.1G, FAA National Environmental Policy Act Implementing Procedures, and Department of War (DoW) and Department of the Air Force (DAF) NEPA Implementing Procedures, FAA is announcing its intent to prepare a Supplemental Environmental Impact Statement (SEIS) concerning Space Exploration Technologies Corp.'s (SpaceX) proposal obtain a modification to their existing vehicle operator license from the FAA to authorize commercial Starship-Super Heavy operations at Space Launch Complex 37 (SLC-37) at Cape Canaveral Space Force Station (CCSFS). This SEIS supports FAA's adoption of the Final Environmental Impact Statement for the SpaceX Starship-Super Heavy Cape Canaveral Space Force Station (2025 DAF EIS), EIS Identification Number: EISX-007-057-USF-1730277197. The proposed operations would include up to 76 Starship-Super Heavy launches and up to 152 landings per year (up to 76 Super Heavy Booster and up to 76 Starship vehicle landings), including return-to-launch-site (RTLS) and ocean landings. FAA is requesting comments concerning the scope and content of the SEIS. A Draft SEIS will be released for public review and comment later.”