The Department of Homeland Security (DHS) has issued final regulations requiring all facilities that possess any one of 300+ chemicals of interest (COI) in amounts at or above the screening threshold quantity (STQ) to submit initial “Top-Screen” data to DHS by January 22, 2008.1 DHS will evaluate the Top-Screen data to identify high-risk facilities that would be subject to the more stringent Security Vulnerability Assessment and Site Security Plan requirements in the rule. Although the title of the rule “Chemical Facility Anti-Terrorism Standards” (CFATS) suggests it applies only to chemical facilities, in fact, it will apply to many other companies in diverse businesses that possess the chemicals of interest above the rather low screening threshold quantities.
Marybeth Kelliher, DHS contact for the November 20 “Appendix A” rule and its principle author, has been invited to participate. We also are very pleased that AcuTech is collaborating with us. AcuTech provided subject matter expertise to DHS supporting the development of the CFATS rules. In addition to providing an overview of the rule and discussing its many applicability issues and exceptions, we will focus during the Webinar on last-minute questions from attendees before they submit their CSAT Top-Screens.
What is CFATS?
As part of the 2007 DHS Appropriations Act2, Congress directed the DHS to identify and regulate “high risk chemical facilities.” DHS promulgated a framework rule known as the Chemical Facility Anti-Terrorism Standard (CFATS), which went into effect on June 8, 20073. On November 20, 2007, DHS adopted its Appendix A rule, which specifies which chemicals at what levels will be subject to the rule. Together, the two rules require facilities with Chemicals of Interest (COI) at or above Screening Threshold Quantities (STQ) to submit information to DHS through the on-line CSAT Top-Screen. Based on an evaluation of Top-Screen data, DHS will identify high risk chemical facilities. Such identified facilities would then be required to conduct a Security Vulnerability Assessment (SVA) and prepare a Site Security Plan (SSP) to address identified vulnerabilities and applicable risk-based performance standards (RBPS).
What facilities are affected?
A facility that possesses or plans to possess (e.g., manufactures, processes, uses, stores or distributes) Chemicals of Interest (COI) identified in “Appendix A” must submit an on-line CSAT Top-Screen if their COI are at or above screening threshold quantities (STQ). COI include:
- EPA Risk Management Plan (RMP)4 Toxic and Flammable Chemicals
- Explosives (DOT Class 1.1)
- Gases Poisonous by Inhalation (DOT Class 2.3)
- Chemical Weapons & Precursors
- Improvised Explosive Device (IED) Precursor Chemicals
- Water Reactives
Affected facilities would include a broad range of facilities storing, processing, or using chemicals including, but not be limited to, chemical manufacturers, refineries, fuel terminals and tank farms, LNG peak shaving facilities, fertilizer distributors and wholesalers, explosives users or manufacturers, ammonia refrigeration systems, laboratories, colleges and universities, and many ordinary businesses deemed to be ‘chemical facilities’ due to use of one or more of the chemicals of interest onsite. Companies should refer to Appendix A to determine if they possess chemicals in quantities that are subject to the CFATS rules.
What facilities are excluded from CFATS?
- Facilities, or parts of facilities, regulated by Maritime Transportation Security Act5
- Public Drinking Water Systems6
- Wastewater Treatment Works7
- Facilities subject to significant regulation by the Nuclear Regulatory Commission
- Facilities owned or operated by the Department of Defense or the Department of Energy
- Facilities that possess chemicals on the DHS list of Chemical of Interest, but below the STQ
- Facilities that possess listed chemicals, but whose activities are not included in the scope of CFATS by policy (e.g., railroad facilities were mentioned in the preamble to the interim final rule as not being subject to CFATS at this time)
Facilities with small, NRC regulated radioactive sources are not exempted nor are private facilities that treat and provide drinking water to employees or guests. Similarly, facilities that treat industrial wastewater would not be excluded, though the wastewater treatment system itself would be.
How does a facility complete the Top-Screen and the CSAT Registration?
In order to access the on-line Top-Screen, facilities must register and personnel involved in preparing the Top-Screen and subsequent steps must be trained and certified on management of Chemical-terrorism Vulnerability Information (CVI). Companies may choose to register facilities individually or in bulk. All personnel expected to prepare, review or submit a Top-Screen must be CVI trained. We encourage facilities to review the CSAT Top-Screen Questions and Users Manual to become familiar with the information that will be required to complete the Top-Screen.
What kind of information will DHS collect through the CSAT Top-Screen?
Through the CSAT Top-Screen DHS is collecting information and assessing facilities based on several security issues or groups of issues:
1. Risk to public health and safety from a release of:
- toxics chemicals
- flammable chemicals
- explosives (DOT Class 1.1)
2. Risk to public health and safety from theft or diversion of:
- Chemical weapons and precursors that could be converted to weapons using simple chemistry, equipment and technique
- toxic inhalation hazard gases (DOT Class 2.3)
- Improvised Explosive Device (IED) Precursors
3. Risk to public health and safety from sabotage or contamination of materials that could release toxic inhalation gases if exposed to water (water reactives).
DHS is also collecting information on two issues related to critical use of chemicals or facilities:
4. Risks to the national or regional economy from the loss of a facility or chemical availability
5. Risks to the ability of the government to provide critical services in the event of an emergency due to the unavailability of chemicals critical to:
- Public health
- Potable drinking water and electric power
- National defense
What is CVI and CVI Training and Certification?
Information marked as Chemical-terrorism Vulnerability Information (CVI) is protected from public disclosure. The CVI management program seeks to balance the need to protect sensitive security information with the need to share relevant information with state and local government officials who have a "need to know" to carry out chemical facility security activities.
Only persons who have been trained in the protection and management of CVI and who have a “need to know” are allowed to access such information. This includes company personnel that will prepare, review and submit a CSAT Top-Screen as well as company personnel that will receive responses from DHS regarding submitted information. Upon successful completion of the training, DHS will issue a unique CVI Authorized User Number.
What happens after a facility submits a CSAT Top-Screen?
CFATS creates a system composed of discrete elements that, taken together, constitute a progressive program to identify high risk chemical facilities and to impose security standards commensurate with the security risk profile of such covered facilities.
- Facilities manufacturing, storing, or using “Chemicals of Interest” at or above STQ will first complete the CSAT Top-Screen.
- Facilities that meet security risk thresholds determined by DHS’s analysis of the Top- Screen information will be assigned a preliminary tier level and will be requested in writing to submit an online CSAT Security Vulnerability Assessment (SVA).
- Results of the SVA will determine the final tier level and facilities in Tiers 1-3 will be requested in writing to complete an online Site Security Plan (SSP) where the site will describe its current and planned security measures to achieve the applicable Risk Based Performance Standards (RBPS).
- A covered facility’s SSP will be approved by DHS and will be used during inspections and enforcement of the regulation.
What are Risk-Based Performance Standards (RBPS)?
CFATS includes 19 categories of risk-based performance standards (see Attachment A for a list of the RBPS). The standards are scalable, meaning that facilities at higher tiers will be required to meet tougher risk-based standards than facilities assigned to lower tiers. Congress explicitly prohibited DHS from imposing specific measures or disapproving an SSP because it lacks a specific measure. The risk-based approach is intended to be flexible and to state a security outcome or goal, thereby allowing facilities the choice of how to achieve that outcome or goal. DHS will provide guidance on how the 19 RBPS may be applied across the 4 tiers. This will be particularly challenging as the RBPS requirements are not specific and will require interpretation and possibly negotiation with the Department.
What if I have already completed an SVA and have a security plan?
Facilities that are assigned to Tiers 1-3 must use the CSAT SVA tool. The use of the CSAT SVA is not strictly required for a Tier 4 facility. Tier 4 facilities may submit for review and approvals the Sandia Risk Analysis Methodology (RAM) for chemical facilities, the CCPS SVA Methodology for fixed chemical facilities, or any methodology certified by CCPS as equivalent to CCPS as described by DHS in the IFR. Facilities in Tiers 1-3 may submit an Alternative Security Plan in lieu of an SSP.
Who can answer my questions on the CSAT Top-Screen?
DHS is posting responses to CSAT FAQs (frequently asked questions). The CSAT Helpline is also available at 866-323-2957 from 7:00 a.m. – 7:00 p.m., Eastern Time, Monday-Friday.
- CFATS Information: http://www.dhs.gov/chemicalsecurity
- Appendix A: http://www.dhs.gov/xlibrary/assets/chemsec_appendixachemicalofinterestlistpdf
- CSAT Top-Screen Registration: http://www.dhs.gov/xprevprot/programs/gc_1169501486197.shtm#1
- CVI Training: http://www.dhs.gov/xprevprot/programs/gc_1181835547413.shtm
- CSAT FAQs: http://csat-help.dhs.gov/pls/apex/f?p=100:1:3995924700902089