Chemical Facility Anti-Terrorism Standards (6 CFR Part 27)
On April 9, 2007 the Department of Homeland Security (DHS)
published the Final Interim Rule on Chemical Facility
Anti-Terrorism Standards (6 CFR part 27) in the Federal
Register. The rule goes into effect in on June 8, 2007 and
the Secretary of DHS will, on that date, be able to direct
individual, or classes of, chemical facilities to initiate
actions under that rule. An appendix to that Rule, Appendix
A, DHS Chemicals of Interest, was also published on that day
for public comment (Docket 2006-0073). The comment period
ends on May 9, 2007 and it appears that DHS intends to
publish the final version on June 8th of this year.
Within 60 days of the publishing of the final version of
Appendix A, the final rule goes completely into effect.
Starting on that date all chemical facilities that have, or
expect to have on site at least the Screening Threshold
Quantity (STQ) found in Appendix A of any of the more than
300 chemicals listed will be required to provide to DHS
information on their chemical facilities, the chemicals used
there, and the potential consequences of an attack on the
facility. This information will be provided through an
Internet utility called the Top Screen. Each facility will
have 60 days in which to complete this requirement.
DHS will utilize this information to:
1. Determine if the facility is a ?high-risk chemical
facility? that would
have further responsibilities under 6 CFR part 27, and
2. If determined to be a high-risk chemical facility,
preliminarily
assign the facility to one of four tiers that will determine
the levels
of protection required to meet federal security guidelines
under 6
CFR part 27, and
3. Notify the high-risk facility of deadlines to complete
the next step
in the process, the Security Vulnerability Assessment.
DHS estimates that more than 6,000 facilities will be
covered by the requirement to complete a Top Screen
submission. Of those, they expect between 1,500 and 6,000
will be required to take further actions under this new
regulation. The highest risk facilities, Tier 1, will be
required to complete the designated actions sooner than the
lower, high risk facilities. Between 36 and 42% of these
facilities are expected to be ?small entities? under the
Small Business Administration?s rules.
Once DHS evaluates the information provided in the Top
Screen, they will notify facilities which of four tiers they
have been assigned for the purposes of preparation of a
Security Vulnerability Assessment. Those not assigned to one
of the four tiers are not considered to be a ?high risk
facility? and will not be governed by the other requirements
of this regulation. DHS encourages facilities not designated
high risk facilities to consider using the methodologies
outlined in this regulation to implement their own security
programs.
The three highest risk tiers (tiers 1, 2, and 3) will be
required to perform a Security Vulnerability Assessment
(SVA) within 90 days of their notification. The results of
this SVA will be required to be entered into the DHS on-line
Chemical Security Assessment Tool (CSAT) so that DHS can
make a final determination of their Tier ranking. Those
facilities notified that they were preliminarily assigned a
Tier 4 (lowest high-risk rating) will have the option of
filing an already prepared vulnerability assessment (VA) in
lieu of performing a new SVA and requesting DHS approval of
that VA as an Alternate Security Plan (ASP). DHS may approve
the ASP as long as it meets the criteria of the Center for
Chemical Process Safety (CCPS) for an SVA (Section 2.5,
Guidelines for Analyzing and Managing the Security
Vulnerabilities of Fixed Chemical Sites, CCPS, 2003).
Once DHS approves the SVA, facilities in all four tiers will
have 120 days to complete a Site Security Plant (SSP). The
key point for the SSP is that it must specifically address
all of the security problems noted in the SVA and address
each of the Department?s nineteen Risk Based Performance
Standards. Once the submitted SSP is approved via a Letter
of Authorization, DHS will inspect the facility to insure
that its SSP is being effectively implemented before DHS
issues it Letter of Approval of the SSP.
One of the more controversial elements of the Risk Based
Performance Standards is the requirement for employee
background checks as part of the Personal Surety Standard.
As part of the SSP the facility will have to identify
critical assets and restricted areas as appropriate.
Employees, contractors, and visitors with unaccompanied
access to these areas will be required to be identified in
the SSP. These personnel will be required to have under gone
a background check that, at a minimum:
1. Verifies and validates identity, and
2. Completes a criminal history check of publicly or
commercially
available databases, and
3. Verifies and validates legal authorization to work via
the I9
process, and
4. Includes measures to identify personnel with terrorist
ties.
DHS has made clear that current or even long time employees
cannot be grandfathered around this requirement. It has also
reiterated that conviction for a misdemeanor offense does
not necessarily preclude someone from authorized
unaccompanied access in a high risk chemical facility.
Personnel with current screening documentation under another
DHS program will be deemed appropriately screened; they will
still have to be identified in the SSP. DHS will establish
procedures for submitting names for the performance of the
checks for personnel with terrorist ties as these checks
will be done by DHS.
There are provisions for the protection of any information
submitted to DHS in support of this regulation. Any
information submitted will be protected as CVI
(Chemical-terrorism Vulnerability Information) and
disseminated only to personnel on a need to know basis. The
protections required for this information parallel the
requirements for classified defense information.
The new regulation establishes authority to issue orders to
insure compliance. These orders may be enforced by fines of
up to $25,000 per day and potentially government closure of
the facility. An appeals process has been established for
the designation as a high risk facility, assignment to
tiers, disapproval of SVA, SSP or ASP, orders, fines or
facility closure.
This new regulation will put extensive security requirements
on a large number of chemical facilities that have never
been covered under government security guidelines before. A
great deal of work by both the private sector and the
government will have to be done before all of the high risk
chemical facilities in the United States can be brought up
to the standards of these requirement.
Patrick J. Coyle has 15 years experience with the US Army,
including a stint as a Physical Security NCO in Europe. He
has also spent 12 years working as a Process Chemist is a
specialty chemical manufacturing company.
Further information concerning the new regulations
concerning protecting chemical plants from terrorist attack
can be found at
http://www.members.aol.com/ChemPlantSec/ChemPlantSecurity.htm
Article Directory: Article Dashboard http://www.articledashboard.com