1. Chemical Facility Anti-Terrorism Standards Update
Ohio Chemical Technology Council
November 12, 2013

2. Chemical Facility Anti-Terrorism Standards
The Chemical Facility Anti-Terrorism Standards (CFATS) regulatory program focuses specifically on security at high-risk chemical facilities
The CFATS program identifies and regulates high-risk chemical facilities to ensure they have security measures in place
The Department works closely with the private sector and industry to assess risks, implement protective programs, and measure effectiveness
Facilities must meet and maintain performance-based security standards appropriate to the facilities and the risks they pose
Source: DHS

3. Origins in a Post-9/11 World
For decades, chemical facilities were safe, but not necessarily secure
Post 9/11 paradigm shift to security
However, many chemical facilities did not voluntarily invest sufficiently in security
Senator Corzine proposed Federal legislation six weeks after 9/11
Vehemently opposed by industry; failed to pass
Pittsburgh Tribune-Review expos
Throughout 2002 & 2003, Reporter Carl Prine walked into chemical facilities around the country with a smile and wave
60 Minutes story (6/13/04)
Steve Kroft & Carl Prine walked into many of the same plants, this time with cameras
Public groundswell arose for action
Pittsburgh Tribune-Review available at Newseum.org
Images of Kroft and Pine available on PBS.org

4. Legislative Development
DHS agreed that chemical facility security legislation should be a top priority
A successful attack on one of many chemical facilities could cause significant loss of human life
Immediately post-9/11, many chemical facilities had woefully insufficient security
Simply relying on voluntary industry security efforts was not having a sufficient effect
Many Congressmen heeded the call, and various bills were introduced
Legislation was supported by the public, Congress, and even industry
Multiple detailed bills were proposed but no agreement was reached
On October 4, 2006, President Bush signed House Homeland Security Appropriations Bill, which included a provision to give DHS regulatory authority over “high-risk chemical facilities”
To implement this new authority, the Department developed the Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27

5. Guiding Principles of the CFATS Program
Not all chemical facilities present the same level of risk
The most scrutiny should be focused on those that, if attacked, could endanger the greatest number of lives, have the greatest economic impact, or present other significant risks
Facility security should be based on reasonable and clear performance standards
Facilities should be given flexibility to select site-specific security measures that will effectively address those risks
Recognize the progress many responsible companies have made to date and build on that progress
Security measures should never compromise safety measures
Chemical facility security risks should not be transferred to surrounding communities

6. Who Is Regulated?
Whether CFATS applies to a facility depends on the facility’s unique characteristics, starting with the quantity of Chemicals of Interest (COI) the facility possesses.
Potential regulation is not based on the facility type, meaning that many different types of facilities may be subject to CFATS, including:
Chemical manufacturers
Warehouses and distributors
Oil and gas operations
Congress did exempt several types of facilities from regulation:
Facilities regulated under the Maritime Transportation Security Act (MTSA) or regulated by the Nuclear Regulatory Commission (NRC)
Facilities owned or operated by the Departments of Defense or Energy
Public water systems and water treatment works
Hospitals
Semi-conductor manufacturers
Colleges and universities

7. Initiate CFATS Process
Complete Top-Screen
Complete SVA or ASP
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Facility with Chemicals of Interest (COI) at or above the Screening Threshold Quantity (STQ) recognizes the need to submit a Top-Screen and completes CVI training and CSAT user registration.
CFATS Help Desk registers the facility and provides a user ID and password.
Facility completes Top-Screen, identifying chemicals and quantities and providing other relevant information.
DHS reviews Top-Screen information and determines the facility's Preliminary Tier status or determines that facility is not high risk.
DHS sends facility a Preliminary Tier letter and deadline for completing a Security Vulnerability Assessment (SVA) or an Alternative Security Program (ASP for Tier 4 facilities, if they choose). If DHS has determined that the facility is not high risk, the facility is sent a letter releasing it from further regulation.
Covered (high-risk) facility completes an SVA or ASP to provide more detailed information about COI and vulnerability to attack.
SVA/ASP Review
Complete SSP or ASP
Authorization
Inspection & Approval
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
DHS reviews SVA or ASP information provided and determines either the facility’s Final Tier or that facility is not high risk.
DHS notifies the facility of its final status, and tiered facilities are provided deadlines for completing an Site Security Plan (SSP) or ASP.
Facility completes an SSP or ASP detailing site-specific security measures to satisfy applicable Risk-Based Performance Standards.
DHS reviews SSP or ASP and (a) issues an authorization letter for SSP or ASP and schedules an inspection or (b) issues notice to resolve deficiencies. Failure to resolve deficiencies may result in disapproval.
DHS conducts authorization inspection, reviews all available information, and either issues a Letter of Approval for the SSP or ASP or issues notice to the facility to resolve deficiencies. Failure to resolve deficiencies may result in disapproval.
If SSP or ASP is approved, DHS conducts compliance inspections on a regular and recurring basis to verify continued compliance with the approved SSP or ASP.

8. Risk-Based Performance Standards
RBPS guidance, though non-prescriptive, exemplifies security measures that covered facilities may wish to consider when developing SSPs or ASPs. Facilities are free to include other measures in their SSPs or ASPs, provided such measures satisfy applicable RBPS.
Restrict area perimeter
Secure site assets
Screen and control access
Deter, detect, delay
Shipping, receipt, and storage
Theft and diversion
Sabotage
Cyber
Response
Monitoring
Training
Personnel surety
Elevated threats
Specific threats, vulnerabilities, or risks
Reporting of significant security incidents
Significant security incidents and suspicious activities
Officials and organization
Records

9. Program Status: Covered Facilities
DHS has received over 46,000 Top-Screens.
Of the Top-Screens received and analyzed, DHS issued preliminary tier notification and SVA due dates to over 8,500 facilities.
DHS has received over 8,500 SVAs and has reviewed nearly all of them.
As of November 4, 2013, CFATS covers 4,321 facilities (3,398 final tiered facilities, 923 preliminarily tiered facilities) across all 50 states.
Tier
Final Tiered
Facilities
Facilities Awaiting Final Tier 1
110 12 2
359 50 3
1032
174 4
1897
687
Total
3398
923
All statistics are current as of November 4, 2013

10. Program Status: Other Results
Since the program’s inception, more than 3,000 facilities have voluntarily removed or reduced the onsite quantity of chemical of interest (COI), or modified their processes, to the point that they are no longer considered high-risk

11. Progress on CFATS Implementation
The Department is working to continuously strengthen the CFATS program and improve its implementation
Progress in the last year includes:
Improving the SSP/ASP review process and increasing the pace of SSP/ASP reviews and approvals
Engaging industry in the development of ASP templates
Instituting corporate security reviews
Completing an external peer review of the CFATS risk assessment methodology
Publishing a Federal Register 60- Day Notice on the Personnel Surety Program. The Notice closed on June 4, 2013
Conducting the first Compliance Inspection in September
Upcoming:
30-Day Personnel Surety Notice in the Federal Register

12. Executive Order on Chemical Safety and Security
On August 1, 2013, the President issued an Executive Order to improve the safety and security of chemical facilities and reduce the risks of hazardous chemicals to first responders, workers, and communities.
The Executive Order directs the Federal Government to:
Improve operational coordination with state and local partners;
Enhance federal agency coordination and information sharing;
Modernize policies, regulations and standards; and
Work with stakeholders to identify best practices.
DHS, along with the Environmental Protection Agency (EPA) and the Department of Labor (DOL), are serving as co-chairs for the Chemical Safety and Security Working Group. Federal agencies have formed sub-working groups and begun implementing actions of the Executive Order.
More information can be found at

13. Executive Order Improving Chemical Facility Safety and Security
Comments and questions are also being collected through submission to
EO Listening Sessions
November 5, 2013
Texas City, Texas
November 15, 2013
Washington, DC
November 19, 2013
Springfield, IL
November 25, 2013
Webinar
December 4, 2013
Hamilton, NJ
December 11, 2013
Orlando, FL
December 16, 2013
Week of January 8, 2014
California (Tentative)
January 14, 2014
Week of January 20, 2014
Houston, TX (Tentative)

14. Learn More About CFATS
CFATS Web site: For CFATS Frequently Asked Questions (FAQs), and other useful CFATS-related information, please go to
Presentations and Conferences: DHS is interested in participating in events to provide information and updates on the CFATS program– request a presentation or a chemical security conference booth by ing DHS at
CFATS Help Desk: DHS has developed a CFATS Help Desk that individuals can call or with questions on the CFATS program.
Toll-Free number: ; address:

15. Frank Blair
Chemical Security Inspector, ISCD