The Department of Homeland Security has issued new federal requirements for chemical facilities. Will your facility be affected?
FACILITIES THAT USE, STORE, manufacture, or transport specified chemicals are potential targets for terrorists, activists, and other threats. New Department of Homeland Security (DHS) regulations present additional challenges for these facilities.
Since September 11, 2001, a number of federal and state security regulations have been approved or are pending approval. (New York, New Jersey, Maryland, and other states currently have chemical security legislation in place; the majority of states are evaluating their responsibilities under the new DHS regulations.) These are in addition to long-standing security requirements under the Clean Air Act, Clean Water Act, and the Resource Conservation and Recovery Act. The newest — and most comprehensive — of these regulations is called the Chemical Facility Anti-Terrorism Standards.
Chemical Facility Anti-Terrorism Standards (CFATS)
Whereas most security-related regulations to date have been issued by the Environmental Protection Agency, Department of Transportation, U.S. Coast Guard, and various state agencies, the DHS issued this regulation shortly after receiving the authority in November 2006 from President Bush. The Advanced Notice of Proposed Rulemaking was issued on December 28, 2006, and a subsequent Interim Final Regulation on April 9, 2007, in 6 CFR Part 27, Section 550. These regulations require the DHS to identify “high-risk” chemical facilities through analysis of facility-supplied “Top Screen” information and require affected facilities to conduct security vulnerability assessments (SVAs), write site security plans (SSPs) and implement gap-closure measures.
The regulations represent a significant potential effect on thousands of facilities across the U.S. that manufacture, use, store, or transport hazardous chemicals. A proposed “DHS Chemicals of Interest” list was published in April 2007. Once finalized — possibly as soon as October 2007 — this list will guide the DHS in identifying high-risk facilities and help determine the risk tier for the facility. The department will begin notifying facilities of their status upon final promulgation of the rule, presumably within the last quarter of 2007. Top-Screen information will be due within 60 days of notification, and SVAs and SSPs are due within 90 and 120 days, respectively.
Who Is Affected?
The DHS defines a “chemical facility” as “any facility that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Secretary to be potentially dangerous or that meets other risk-related criterion identified by (DHS).”
If your facility has any of the chemicals on the DHS Appendix A, “Chemicals of Interest” list at or above the screening threshold quantity, you must notify the DHS and complete a secure, online Top-Screen survey.
The DHS will evaluate the Top Screens from approximately 40,000 respondents to determine which are high-risk facilities and which of four risk tiers is appropriate for each facility so designated. All high-risk facilities will be notified by the department and will be required to complete a security vulnerability assessment and site security plan. Tiers 1 through 3 will have 90 days after notification to complete an SVA and 120 days to complete their SSP. Tier 4 facilities are not required to submit this information and may use alternative methodologies and formats, as approved by the DHS.
Tiers 1 and 2 must update the Top Screen, SVA, and SSP every two years, whereas Tiers 3 and 4 are on a three-year update cycle.
Who Is Not Affected?
CFATS provides specific exemptions for the following:
-
Facilities and vessels regulated under the Maritime Transportation Security Act.
-
Department of Defense or Department of Energy sites, or facilities regulated by the Nuclear Regulatory Commission.
-
Water treatment facilities.
-
Wastewater treatment facilities.
-
Railroads.
-
Long-haul pipelines, including natural gas and oil. (Pipelines that are part of a chemical facility’s infrastructure are included in CFATS.)
Security Vulnerability Assessments
The DHS requires all Tier 1 through 3 facilities to use the online Chemical Security Assessment Tool (CSAT) for the appropriate sector and submit it within 90 days of notification from the DHS. Tier 4 facilities are allowed to use other DHS-approved SVA methodologies.
Site Security Plans
Tier 1 through 3 facilities must develop and submit an SSP using the CSAT within 120 days of DHS notification that their SVA is approved. The department will issue a Letter of Authorization upon preliminary plan approval and schedule a facility visit to confirm that the plan has been implemented. If satisfied, the DHS will then issue a Letter of Approval.
Tier 4 facilities are allowed to use an Alternative Security Program, as long as it provides an equivalent level of security.
Inspections and Enforcement
The DHS may choose to notify local emergency response or other agencies about site inspections; those agencies may choose to attend the visit or request inspection results information from the DHS. Although the DHS plans to use its own auditors for now, it may issue a future rulemaking concerning third-party auditors. It has established “due process” measures for imposing noncompliance penalties.
Taking Action
One of the largest challenges for good security managers is finding time to meet these regulatory requirements and still conduct regular security duties in addition to other collateral job assignments at their chemical facility. One of the keys to overcoming these challenges is finding others who can help you leverage your time. Look for opportunities to obtain corporate assistance for some of these tasks. Additionally, look at options to obtain outside contractor or consulting assistance from experts who may be able to advise you or actually perform the work of any of these items:
-
Security vulnerability assessments
-
Third-party security audits
-
Railway security and safety route analyses
-
Maritime security assessments
-
MARSEC security exercises and other training
-
Hazardous material offeror and transporter regulation compliance
-
Chemical facility risk management assessments, including inherently safer technology evaluations
Many companies can assist in identifying the impacts of existing and new security requirements on your operations and requirements.