Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Community College Risk Management Consortium
July 23 – 24, 2015
Colleges and the Chemical Facility Anti-Terrorism Standards (CFATS)
ALEXANDER JOVES | JULY 2015
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
National Protection and Programs DirectorateDepartment of Homeland Security
The Office of Infrastructure Protection
Thursday July 23, 2015
Colleges and the Chemical Facility Anti-Terrorism Standards (CFATS)
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Why Chemical Facility Security?
The Homeland faces a persistent and evolving threat from terrorist groups and cells.
Chemical facilities potentially are attractive targets as: – A successful attack on some chemical facilities could potentially cause a
significant number of deaths and injuries.– Certain chemical facilities possess materials that could be stolen or diverted
and used as or converted into weapons for use offsite. In 2007, Congress authorized the Department to regulate security at “high-
risk” chemical facilities.– The Department developed the Chemical Facility Anti-Terrorism Standards
(CFATS), 6 CFR Part 27, to implement this authority. In December 2014, Congress passed H.R. 4007: Protecting and Securing
Chemical Facilities from Terrorist Attacks Act of 2014 (The CFATS Act of 2014).– The President signed the CFATS Act of 2014 into law on December 18, 2014.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
The CFATS Act of 2014
H.R. 4007: Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014– Reauthorizes the CFATS program for an additional four years– The act eliminates uncertainty and provides stability for industry to plan and
invest in CFATS-related security measures The CFATS Act of 2014 preserves most of the existing regulations and
provides additional provisions and changes to existing authorities to include:– Expedited Approval Program for facilities in Tier 3 and Tier 4– Changes to the Personnel Surety Program– Emergency Enforcement
To read the Act in its entirety, please visit https://www.congress.gov/bill/113th-congress/house-bill/4007
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Who Is Regulated?
To determine if a facility is subject to CFATS, DHS looks at the unique circumstances faced by the facility, starting with the quantities of Chemicals of Interest (COI) the facility possesses.
Potential regulation is not based on the facility type, meaning that many different types of facilities may be subject to CFATS, including:
– Chemical manufacturers– Warehouse and distributors– Chemical repackaging operations– Oil and gas operations
Congress did exempt several types of facilities from regulation:– Facilities regulated under the Maritime Transportation Security Act (MTSA) or
regulated by the Nuclear Regulatory Commission (NRC)– Facilities owned or operated by the Departments of Defense or Energy– Public water systems and water treatment works regulated under certain federal
water quality laws
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Colleges & Universities & CFATS
Colleges and universities are among the many types of facilities that possess chemicals of interest (COI) for legitimate uses.
COI may be used, stored, or even made in areas, including: – chemistry labs; – research facilities;– field houses;– pool complexes; and– agricultural, medical, and other
campus facilities Image available from iStockPhoto
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Security Issues and COI at Colleges and Universities
The primary CFATS security issue for colleges and universities is theft/diversion.
Colleges and universities are regulated for more than 50 different COI that are regularly used, stored, and made on campus. The top 10 regulated COI from tiered colleges and universities are:
1. Nitric Acid 6. Boron tribromide2. Titanium Tetrachloride 7. Sodium cyanide3. Nitric oxide 8. Propane 4. Trichlorosilane 9. Potassium cyanide5. Phosphorus pentasulfide 10. Chloroacetyl chloride
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Colleges and Universities Under CFATS
DHS gives facilities flexibility in how they define themselves– This can be very useful for colleges and universities in complying with CFATS
as they often are made up of many individual buildings, operations and areas, only a small number of which may possess COI
– A college or university with a single or small number of buildings on campus -such as a research complex – that possess threshold levels of COI may decide to define the research complex as the facility, rather than the entire campus
Even if the college or university decides to make the entire campus the “facility” for CFATS purposes, the college or university may design their SSP so that the security measures are focused solely on the areas where the COI are located.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Risk-Based Performance Standards (RBPS)
Under the CFATS Act of 2014, a CFATS-covered facility must submit for DHS approval an SSP or, if the facility chooses, an ASP that contains security measures that meet all applicable RBPS developed by DHS.– RBPS are non-prescriptive, and thus provide facilities with substantial flexibility,
including the ability to leverage existing measures where appropriate. Compliance with the RBPS will be tailored to fit each facility’s
circumstances, including tier level, security issues, and physical and operating environments.– Consequently, measures appropriate to meet an RBPS for one type of facility
will not necessarily be appropriate for anther type of facility (e.g., DHS would not expect a covered university to necessarily employ the same type of measures as a large chemical manufacturer).
CFATS currently has 18 RBPS, addressing areas such as perimeter security; shipping, receipt, and storage; cybersecurity; personnel surety; training; and recordkeeping.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Site Security Plan (SSP) Review and Inspections
DHS uses a two-step process to determine if an SSP (or ASP) meets all applicable RBPS for a covered facility’s tier and security-vulnerability issues.– An SSP (or ASP) is reviewed by DHS and if it appears to meet the applicable
RBPS, the facility will receive a Letter of Authorization and an inspection is scheduled. If it does not meet the applicable RBPS, the facility will be provided a letter identifying deficiencies that must be resolved prior to authorization or final approval.
– After a facility receives a Letter of Authorization, DHS will inspect the facility for compliance with CFATS and will either issue a Letter of Approval approving the SSP (or ASP) or issue a notice of deficiencies that must be resolved prior to final approval.
Inspections typically take approximately one week and involve two or more inspectors. Facilities should be prepared to show all security elements in the authorized SSP (or ASP) during an inspection.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Key CFATS Tools
Chemical Security Assessment Tool (CSAT): CSAT is the backbone of the CFATS program, and currently includes four primary applications:– User Registration– Top-Screen– SVA– SSP
Chemical-terrorism Vulnerability Information (CVI): CVI is the information protection category used to ensure secure handling of certain sensitive CFATS-related information.– Except in emergency or exigent circumstances, only CVI authorized users with
a “need-to-know” are permitted to access the CSAT Top-Screen, SVA, and SSP, certain correspondence, and other types CVI as specified in CFATS.
– Persons potentially eligible to access CVI include facility employees; federal employees, contractors, and grantees; and state/local government employees.
– DHS provides online CVI training and authorization.
ALH1
Slide 11
ALH1 OGC wrote: I would suggest deleting this entire slide. DHS should not be talking about the reasons for facilities potential non compliance.Annie Hunziker, 7/18/2012
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Program Status: Covered Facilities
DHS has received over 49,000 Top-Screens. Of the Top-Screens received and analyzed, DHS issued preliminary tiers
to more than 8,700 facilities. As of June 22, 2015, CFATS covers 3,236 facilities (2,865 final tiered
facilities, 371 preliminarily tiered facilities) across all 50 states.
Tier Final Tiered Facilities
Facilities Awaiting Final Tier
1 113 1
2 344 223 824 103
4 1,584 245Total 2,865 371
All statistics are current as of June 22, 2015.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Program Status: SSPs and Inspections
Site Security Plans (SSPs): DHS has received and is in the process of reviewing an estimated 4,600 SSPs and Alternative Security Programs (ASPs); of these, 3,106 SSPs have been authorized and 1,897 have been approved.
Authorization Inspections (AIs): The first AI was conducted during the summer of 2010. As of June 22, 2015, 2,462 AIs have been conducted.
Compliance Assistance Visits (CAVs): DHS continues to conduct CAVs to assist facilities with RBPS compliance, and has completed an estimated 1,935 CAVs.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Program Status: Other Results
Since the inception of CFATS, more than 3,000 chemical facilities have eliminated, reduced, or otherwise made modifications to their holdings of potentially dangerous chemicals and are now no longer considered high-risk.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Program Status: Enforcement
Administrative Orders: DHS has issued 66 Administrative Orders under CFATS to facilities that failed to submit an SSP within the prescribed deadline. All 66 facilities came into compliance as a result of the Administrative Orders, and without the need for the issuance of penalty orders by DHS.
Compliance Inspections: In September 2013, DHS began conducting compliance inspections to verify facilities are implementing the measures contained in their approved SSP. As of June 1, 2015, DHS has conducted 87 compliance inspections.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
ISCD Progress
ISCD is working to continuously strengthen the program and improve implementation of CFATS.
Progress includes:– Improving the SSP review process and increasing the pace of SSP reviews – Refining inspector tools and training– Reinvigorating industry engagement on the development of ASP templates – Improving internal communications and organizational culture – Preparing for an external peer review of the CFATS risk assessment
methodology
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Available Resources
Outreach: DHS outreach for CFATS is a continuous effort to educate stakeholders on the program. – To request a CFATS presentation or a CAV, individuals may submit a request
through the program Web site, located at www.dhs.gov/chemicalsecurity, or by e-mailing DHS at [email protected].
CFATS Help Desk: DHS has developed a CFATS Help Desk that individuals can call or email with questions on the CFATS program.– Hours of Operation are 8:30 AM – 5:00 PM, Monday through Friday– The CFATS Help Desk toll-free number is 1-866-323-2957– The CFATS Help Desk email address is [email protected]
CFATS Web site: For CFATS Frequently Asked Questions (FAQs), CVI training, and other useful CFATS-related information, please go to www.dhs.gov/chemicalsecurity.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
For more information visit:www.dhs.gov/criticalinfrastructureAlex Joves
Infrastructure Security Compliance DivisionOffice of Infrastructure Protection
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Ammonium Nitrate: Statutory Authority
December 26, 2007: President signed the 2008 Consolidated Appropriations Act that includes Section 563, Secure Handling of Ammonium Nitrate.
This statute directs DHS to “regulate the sale and transfer of ammonium nitrate by an ammonium nitrate facility...to prevent the misappropriation or use of ammonium nitrate in an act of terrorism.”
The statute requires DHS to:– Establish threshold quantities of ammonium nitrate in mixtures– Register certain ammonium nitrate sellers and purchasers, and vet against the
TSDB– Require ammonium nitrate facilities to maintain records on ammonium nitrate
sales or transfers for two (2) years– Require ammonium nitrate facilities to report theft or loss of ammonium nitrate– Inspect/audit facilities’ records
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Ammonium Nitrate Security Program Status
On August 3, 2011, DHS published the Ammonium Nitrate Security Program Notice of Proposed Rulemaking (NPRM), which invited comments that will be used to inform DHS’s development of the final rule.– Comments on the proposed rule were due to DHS on or before December 1, 2011.– Comments regarding information to be collected were due to OMB on or before
October 3, 2011. During the comment period, DHS held several listening sessions across the
country in locations with a high usage of ammonium nitrate. This provided potentially affected stakeholders an opportunity to comment on the NPRM. In addition, two Webinars were held for government stakeholders.
Additional information on the Ammonium Nitrate Security Program can be found on the DHS web site at http://www.dhs.gov/files/programs/ammonium-nitrate-security-program.shtm.
Q:\2014\BSD\17\NicheName\20\DCN#.pptx
Thank You
