Taking the final steps in its implementation of the Chemical Facility Anti-Terrorism Standards (CFATS), the Department of Homeland Security (DHS) released important guidance documents on May 15, 2009, and began notifying covered facilities of their final risk-tier designation. The tiering notification constitutes the last action by DHS before high-risk facilities are required to submit a Site Security Plan (SSP). Once apprised of their final risk status, facilities have 120 days to submit their SSP for DHS review and approval.  

Among the guidance documents released by DHS are instructions for completing an SSP and questions that a facility will have to answer to do so. These guidance documents are intended to assist facilities in developing their SSPs in accordance with the requirements of CFATS. Under the regulatory program, DHS approval of an SSP is contingent upon its finding that the SSP satisfies the 18 Risk-Based Performance Standards (RBPS), which are listed in the CFATS rule.  

A separate guidance document details the types of security measures a facility may have to implement in order to satisfy the RBPS. Pursuant to statutory edict, the RBPS guidance is not intended to be prescriptive — a facility may not need to implement all of the suggested measures in order to prepare an approvable SSP — but it provides examples of the types of measures DHS believes would satisfy the RBPS for a facility. It is incumbent upon the facility to identify and develop appropriate security measures that will satisfy the RBPS given the facility’s specific circumstances and risk profile.  

Since releasing a draft version of the RBPS guidance in October 2008, DHS received extensive comments, some of which are reflected in changes to the final RBPS guidance. Most significantly, DHS removed all of the numerical benchmarks not otherwise described in the CFATS rule, and clarified that facilities are not mandated to adopt specific security measures contained in the guidance.  

Simultaneously with the release of the SSP and RBPS guidance, DHS began the process of notifying covered facilities of their final tiering status and timetable for SSP submission. Approximately 140 Tier 1 facilities are currently being notified that their SSPs must be filed within 120 days. DHS has indicated that it will notify the remaining high-risk facilities in the coming months and expects to start the clock on Tier 2 facilities in June.  

Once it receives the SSPs, DHS will make a preliminary determination as to whether a given SSP adequately addresses the facility’s vulnerabilities and meets the RBPS. If a facility’s SSP is granted preliminary approval, DHS will conduct site inspections before making a final determination. DHS has indicated that while site inspectors will not use the RBPS guidance as a compliance checklist, they will use the guidance to inform the SSP inspection process. If DHS concludes that a facility’s SSP does not adequately address the facility’s vulnerabilities or satisfy the RBPS, the facility will have to determine what additional security measures are needed to secure DHS approval. Because the RBPS guidance is not prescriptive, facilities will need to effectively analyze whether the security measures they have adopted will satisfy the RBPS, given the facility’s risk profile.  

Failure to comply with CFATS, including failure to develop an SSP to DHS’s satisfaction, may lead to a civil penalty of up to $25,000 per day of the violation, or an order to cease operations, or both.  

For more information, please visit: Chemical Facility Security Regulation