Chemical Facilities Anti-Terrorism Standards
The Department of Homeland Security (DHS) was given legal authority in late 2006 to regulate high risk chemical facilities. Regulations subsequently developed by the Department, known as Chemical Facilities Anti-Terrorism Standards (CFATS), went into effect in June 2007.
CFATS require selected chemical facilities to develop and implement enhanced security plans. A chemical facility, as defined by CFATS, is an entity that possesses or plans to possess a "threshold quantity" of a chemical substance determined by DHS to be potentially dangerous or meets other risk-related criteria.
In November 2007, the DHS published in the Federal Register a list (Appendix A, Chemicals of Interest) of more than 300 chemicals of interest (COI) and required all companies with a threshold quantity to complete a Top Screen questionnaire.
The purpose of the Top Screen questionnaire is to gather data on chemical facilities to determine if they present a "high level of security risk." Facilities are required to complete the questionnaire using the Internet-based Chemical Security Assessment Tool (CSAT) developed by DHS. The deadline for submitting the document to DHS was January 22, 2008. About 32,000 facilities have completed the questionnaire.
After evaluating the data, facilities that met high risk criteria were notified by letter. The high risk facilities were provisionally placed in one of four tiers, Tier 1 being the highest risk and Tier 4 the lowest risk. The tier ranking is based on the facility's location, and the type and amount of chemicals at the facility. Each tier has different security thresholds. The levels of performance that a facility must achieve is unique based on its risk profile.
About 7,000 chemical facilities were designated as high risk and provisionally placed in the following tiers:
- Tier 1 - 182 facilities
- Tier 2 - 681 facilities
- Tier 3 - 1,613 facilities
- Tier 4 - 3,943 facilities
The remaining 25,000 facilities that completed the questionnaire are not considered high risk and have no further CFATS compliance requirements unless they substantially modify their use of chemicals or make major changes in personnel, operations, and sites. In this case, a facility has 60 days to submit to DHS a updated Top Screen questionnaire.
Facilities can request an extension in the deadline to submit the questionnaire.
Security Vulnerability Assessment
Chemical facilities provisionally placed in Tier 1-4 are required to complete a Security Vulnerability Assessment (SVA) within 90-180 days of receiving notification by DHS. To develop a SVA, facilities again must utilize the Chemical Security Assessment Tool. The SVA contains more than 100 pages of questions and 90 pages of instructions to gather data on:
- Assets characterization
- Threats
- Security vulnerabilities and countermeasures
- Risks
Based on the SVA data, DHS will make a final determination on a chemical facility's tier ranking.
Facilities placed in Tier 4 have the option to submit an Alternative Security Program (ASP) for consideration in lieu of a SVA. Approval of an ASP is based on guidelines provided by the Center for Chemical Process Safety (CCPS) for a SVA (Section 2.5, Guidelines for Analyzing and Managing the Security Vulnerabilities of Fixed Sites, CCPS, 2003).
High risk chemical facilities can request an extension in the time to complete a SVA.
Chemical facilities in Tier 1 and 2 are required to develop a Site Security Plan (SSP) using a template provided by DHS. The template contains more than 1,500 questions. Tier 3 and 4 facilities may choose to submit an Alternative Security Plan in lieu of a SSP for consideration by DHS.
A SSP describes and analyzes a facility's current security measures (physical and procedural) and plans for enhancements if needed to mitigate vulnerabilities and comply with CFATS. The SSP must incorporate 18 risk-based performance standards (RBPS) listed by DHS. Facilities have 120-180 days to complete the plan after receiving notice from DHS.
After submission of the SSPs, they are evaluated by DHS. Upon preliminary approval of an SSP, DHS will issue a Letter of Authorization. DHS inspectors will then visit a facility to determine if it complies with its SSP. If found to be in compliance, DHS will issue a Letter of Approval.
CFATS requires Tier 1-2 facilities to file an updated Top Screen questionnaire, SVA, and SSP every two years. Tier 3-4 facilities must do the same every three years. Facilities must also provide ongoing testing, training, drills and exercises, based on its SSP.
DHS has authority to fine a facility up to $25,000 per day and close down a facility if it fails to comply with CFATS.
An appeal process has been established at DHS for companies to challenge their tier ranking and disapproval of a SVA, SSP, or ASP, as well as orders, fines, and facility closures.