cfats aka: chemical facility anti-terrorism standards clyde d. miller director, corporate security...
TRANSCRIPT
CFATS CFATS Aka: Chemical Facility Anti-terrorism StandardsAka: Chemical Facility Anti-terrorism Standards
Clyde D. MillerClyde D. MillerDirector, Corporate SecurityDirector, Corporate SecurityJune 9, 2010June 9, 2010
History of CFATSHistory of CFATS Section 550 of the DHS Appropriations Act of Section 550 of the DHS Appropriations Act of
2007 – October 20062007 – October 2006 Interim Final Rule November 2007Interim Final Rule November 2007 Three-Year Sunset Provision (From October 2006)Three-Year Sunset Provision (From October 2006)
Final Appendix A – November 2007Final Appendix A – November 2007 Currently 322 Chemicals of Interest (COI)Currently 322 Chemicals of Interest (COI) Three Security Issues – Release, Theft & SabotageThree Security Issues – Release, Theft & Sabotage Minimum Concentration Rules were developedMinimum Concentration Rules were developed
Agriculture Exemption – December 2007Agriculture Exemption – December 2007 ““COI solely for preparation for treatment of or during COI solely for preparation for treatment of or during
application to crops, feed, land or other areas on an application to crops, feed, land or other areas on an agricultural production facility”agricultural production facility”
Currently Extended Through October 2010Currently Extended Through October 2010
CFATS ProcessCFATS Process
Determine COI over ThresholdDetermine COI over Threshold Access CSATAccess CSAT
Registration of FacilityRegistration of FacilityTop ScreenTop ScreenSecurity Vulnerability AssessmentSecurity Vulnerability AssessmentSite Security PlanSite Security Plan
Performance Standards vs. Performance Standards vs. MeasuresMeasures
Risk-based performance standards, Risk-based performance standards, rather than mandate specific security rather than mandate specific security measuresmeasuresPlan can’t be rejected re: Specific Plan can’t be rejected re: Specific
MeasuresMeasures Avoid Prescriptive RequirementsAvoid Prescriptive Requirements Requires Security ProfessionalsRequires Security Professionals
Risk Based Performance Risk Based Performance StandardsStandards
1.1. Restricted Area PerimeterRestricted Area Perimeter
2.2. Securing Site AssetsSecuring Site Assets
3.3. Screening and Access Screening and Access ControlsControls
4.4. Deter, Detect and DelayDeter, Detect and Delay
5.5. Shipping, Receipt and Shipping, Receipt and StorageStorage
6.6. Theft and DiversionTheft and Diversion
7.7. SabotageSabotage
8.8. CyberCyber
9.9. ResponseResponse
10.10. MonitoringMonitoring
11.11. TrainingTraining
12.12. Personnel SuretyPersonnel Surety
13.13. Elevated ThreatsElevated Threats
14.14. Specific Threats, Specific Threats, Vulnerabilities or RisksVulnerabilities or Risks
15.15. Reporting of Significant Reporting of Significant Security IncidentsSecurity Incidents
16.16. Significant Security Incidents Significant Security Incidents and Suspicious Activitiesand Suspicious Activities
17.17. Officials and OrganizationsOfficials and Organizations
18.18. RecordsRecords
19.19. Others as determined by DHSOthers as determined by DHS
Chemical Vulnerability Chemical Vulnerability Information (CVI)Information (CVI)
Top-Screen Security Vulnerability
Assessments Site Security Plans Tiering Level Training
Drills and Exercises Incidents and breaches of
security Maintenance, calibration, and
testing of security equipment Security threats Audits Letters of Authorization and
Approval from DHS
Documentation identifying the results of audits and inspections by DHSAlternative Security Programs Any records required to be created or retained by a covered facility Sensitive portions of orders, notices or letters under CFATS Other information developed for chemical facility security purposes that the Secretary determines is similar to that covered
Inherently Safer TechnologyInherently Safer Technology and CFATS and CFATS
No specific IST elements in CFATSNo specific IST elements in CFATS Incentive to conduct IST evaluationIncentive to conduct IST evaluation
Elimination of COI’sElimination of COI’s Not transfer riskNot transfer risk Reduction of mixtureReduction of mixture
Facilities have dropped from programFacilities have dropped from program Others have notOthers have not
New Twist - In or Out?New Twist - In or Out?
Reducing COI below STQ does not Reducing COI below STQ does not necessarily remove facility from necessarily remove facility from CFATS regimeCFATS regime
DHS Says: The STQs trigger DHS Says: The STQs trigger preliminary screening requirements preliminary screening requirements rather than the threshold quantity for rather than the threshold quantity for establishing whether a facility is a establishing whether a facility is a high-risk facilityhigh-risk facility
RBPS Twelve – Personnel RBPS Twelve – Personnel SuretySurety
Measures designed to verify and Measures designed to verify and validate identityvalidate identity
Measures designed to check criminal Measures designed to check criminal historyhistory
Measures designed to verify and Measures designed to verify and validate legal authorization to workvalidate legal authorization to work
Measures designed to identify people Measures designed to identify people with terrorist tieswith terrorist ties
Guidance Suggests Recurring VettingGuidance Suggests Recurring Vetting
Executing RBPS TwelveExecuting RBPS Twelve Recurring Vetting of Employees and Recurring Vetting of Employees and
ContractorsContractors Terrorist Screening DatabaseTerrorist Screening Database (TSDB, Not to (TSDB, Not to
be confused with “No Fly List”)be confused with “No Fly List”) ClassifiedClassified Company will not get resultsCompany will not get results Lengthy data setsLengthy data sets
Employees and ContractorsEmployees and Contractors Either unescorted or escorted access to Either unescorted or escorted access to
restricted areas or critical assetsrestricted areas or critical assets Unescorted visitors who have access to Unescorted visitors who have access to
restricted areas or critical assetsrestricted areas or critical assets
Data SetsData Sets DHS may collect the following information DHS may collect the following information
from individuals:from individuals:Full nameFull nameDate of birthDate of birthPlace of birthPlace of birthGenderGenderCitizenshipCitizenshipPassport informationPassport informationVisa informationVisa informationAlien registration numberAlien registration numberDHS Redress Number (if available)DHS Redress Number (if available)Work phone number(s)Work phone number(s)Work e-mail address(es)Work e-mail address(es)
Status of CFATS 2010Status of CFATS 2010
Top Screens CompletedTop Screens Completed Preliminary Tiers IssuedPreliminary Tiers Issued SVAs CompletedSVAs Completed Tiers 1 & 2 Final TieringTiers 1 & 2 Final Tiering
SSPs underwaySSPs underwayInspections for Tier 1 FacilitiesInspections for Tier 1 Facilities
Tiers 3 & 4 to come in wavesTiers 3 & 4 to come in waves
Latest CFATS NumbersLatest CFATS Numbers * *An Evolving Process An Evolving Process
* November 2009 vs. June 2010
Preliminary Tier
NovemberPreliminary Tier June
Final TierNovember
Final TierJune
Totals Nov
Totals June
Tier 1 8 5 172 224 180 229
Tier 2 54 54 578 516 632 570
Tier 3 318 157 1,099 1,100 1,417 1,257
Tier 4 3,340 1,964 473 1,313 3,813 3,277
Totals 3,720 2,180 2,322 3,153 6,042 5,333
What Does It Take to Comply?What Does It Take to Comply?
A Team Effort is Required:A Team Effort is Required:Security – Both Site & CorporateSecurity – Both Site & CorporateSite Management – Site Manager & Site Management – Site Manager &
PreparerPreparerSite Shipping & ReceivingSite Shipping & ReceivingIT – Both Site & CorporateIT – Both Site & CorporateEngineering – Both Site & CorporateEngineering – Both Site & CorporateEcologyEcologyCustomer ServiceCustomer ServiceLawyers?Lawyers?
Son of CFATSSon of CFATSSenate and HouseSenate and House
Maritime Transportation Security Act (MTSA) SitesMaritime Transportation Security Act (MTSA) Sites Labor involvementLabor involvement
Training RequirementsTraining Requirements Background WaiversBackground Waivers
No State PreemptionNo State Preemption IST issues IST issues
Mandatory Consideration – All TiersMandatory Consideration – All Tiers Mandatory Implementation Tiers 1 & 2Mandatory Implementation Tiers 1 & 2 Explain Why NotExplain Why Not Possible out for impracticality or economicsPossible out for impracticality or economics
33rdrd Party Right of Action Party Right of Action Lawyer Full Employment ActLawyer Full Employment Act
Gulf Disaster EffectGulf Disaster Effect
DiscussionDiscussion
Clyde MillerClyde Miller
Director, Corporate SecurityDirector, Corporate Security
BASF CorporationBASF Corporation