CFATS CFATS Aka: Chemical Facility Anti-terrorism StandardsAka: Chemical Facility Anti-terrorism Standards

Clyde D. MillerClyde D. MillerDirector, Corporate SecurityDirector, Corporate SecurityJune 9, 2010June 9, 2010

History of CFATSHistory of CFATS Section 550 of the DHS Appropriations Act of Section 550 of the DHS Appropriations Act of

2007 – October 20062007 – October 2006 Interim Final Rule November 2007Interim Final Rule November 2007 Three-Year Sunset Provision (From October 2006)Three-Year Sunset Provision (From October 2006)

Final Appendix A – November 2007Final Appendix A – November 2007 Currently 322 Chemicals of Interest (COI)Currently 322 Chemicals of Interest (COI) Three Security Issues – Release, Theft & SabotageThree Security Issues – Release, Theft & Sabotage Minimum Concentration Rules were developedMinimum Concentration Rules were developed

Agriculture Exemption – December 2007Agriculture Exemption – December 2007 ““COI solely for preparation for treatment of or during COI solely for preparation for treatment of or during

application to crops, feed, land or other areas on an application to crops, feed, land or other areas on an agricultural production facility”agricultural production facility”

Currently Extended Through October 2010Currently Extended Through October 2010

CFATS ProcessCFATS Process

Determine COI over ThresholdDetermine COI over Threshold Access CSATAccess CSAT

Registration of FacilityRegistration of FacilityTop ScreenTop ScreenSecurity Vulnerability AssessmentSecurity Vulnerability AssessmentSite Security PlanSite Security Plan

Performance Standards vs. Performance Standards vs. MeasuresMeasures

Risk-based performance standards, Risk-based performance standards, rather than mandate specific security rather than mandate specific security measuresmeasuresPlan can’t be rejected re: Specific Plan can’t be rejected re: Specific

MeasuresMeasures Avoid Prescriptive RequirementsAvoid Prescriptive Requirements Requires Security ProfessionalsRequires Security Professionals

Risk Based Performance Risk Based Performance StandardsStandards

1.1. Restricted Area PerimeterRestricted Area Perimeter

2.2. Securing Site AssetsSecuring Site Assets

3.3. Screening and Access Screening and Access ControlsControls

4.4. Deter, Detect and DelayDeter, Detect and Delay

5.5. Shipping, Receipt and Shipping, Receipt and StorageStorage

6.6. Theft and DiversionTheft and Diversion

7.7. SabotageSabotage

8.8. CyberCyber

9.9. ResponseResponse

10.10. MonitoringMonitoring

11.11. TrainingTraining

12.12. Personnel SuretyPersonnel Surety

13.13. Elevated ThreatsElevated Threats

14.14. Specific Threats, Specific Threats, Vulnerabilities or RisksVulnerabilities or Risks

15.15. Reporting of Significant Reporting of Significant Security IncidentsSecurity Incidents

16.16. Significant Security Incidents Significant Security Incidents and Suspicious Activitiesand Suspicious Activities

17.17. Officials and OrganizationsOfficials and Organizations

18.18. RecordsRecords

19.19. Others as determined by DHSOthers as determined by DHS

Chemical Vulnerability Chemical Vulnerability Information (CVI)Information (CVI)

Top-Screen Security Vulnerability

Assessments Site Security Plans Tiering Level Training

Drills and Exercises Incidents and breaches of

security Maintenance, calibration, and

testing of security equipment Security threats Audits Letters of Authorization and

Approval from DHS

Documentation identifying the results of audits and inspections by DHSAlternative Security Programs Any records required to be created or retained by a covered facility Sensitive portions of orders, notices or letters under CFATS Other information developed for chemical facility security purposes that the Secretary determines is similar to that covered

Inherently Safer TechnologyInherently Safer Technology and CFATS and CFATS

No specific IST elements in CFATSNo specific IST elements in CFATS Incentive to conduct IST evaluationIncentive to conduct IST evaluation

Elimination of COI’sElimination of COI’s Not transfer riskNot transfer risk Reduction of mixtureReduction of mixture

Facilities have dropped from programFacilities have dropped from program Others have notOthers have not

New Twist - In or Out?New Twist - In or Out?

Reducing COI below STQ does not Reducing COI below STQ does not necessarily remove facility from necessarily remove facility from CFATS regimeCFATS regime

DHS Says: The STQs trigger DHS Says: The STQs trigger preliminary screening requirements preliminary screening requirements rather than the threshold quantity for rather than the threshold quantity for establishing whether a facility is a establishing whether a facility is a high-risk facilityhigh-risk facility

RBPS Twelve – Personnel RBPS Twelve – Personnel SuretySurety

Measures designed to verify and Measures designed to verify and validate identityvalidate identity

Measures designed to check criminal Measures designed to check criminal historyhistory

Measures designed to verify and Measures designed to verify and validate legal authorization to workvalidate legal authorization to work

Measures designed to identify people Measures designed to identify people with terrorist tieswith terrorist ties

Guidance Suggests Recurring VettingGuidance Suggests Recurring Vetting

Executing RBPS TwelveExecuting RBPS Twelve Recurring Vetting of Employees and Recurring Vetting of Employees and

ContractorsContractors Terrorist Screening DatabaseTerrorist Screening Database (TSDB, Not to (TSDB, Not to

be confused with “No Fly List”)be confused with “No Fly List”) ClassifiedClassified Company will not get resultsCompany will not get results Lengthy data setsLengthy data sets

Employees and ContractorsEmployees and Contractors Either unescorted or escorted access to Either unescorted or escorted access to

restricted areas or critical assetsrestricted areas or critical assets Unescorted visitors who have access to Unescorted visitors who have access to

restricted areas or critical assetsrestricted areas or critical assets

Data SetsData Sets DHS may collect the following information DHS may collect the following information

from individuals:from individuals:Full nameFull nameDate of birthDate of birthPlace of birthPlace of birthGenderGenderCitizenshipCitizenshipPassport informationPassport informationVisa informationVisa informationAlien registration numberAlien registration numberDHS Redress Number (if available)DHS Redress Number (if available)Work phone number(s)Work phone number(s)Work e-mail address(es)Work e-mail address(es)

Status of CFATS 2010Status of CFATS 2010

Top Screens CompletedTop Screens Completed Preliminary Tiers IssuedPreliminary Tiers Issued SVAs CompletedSVAs Completed Tiers 1 & 2 Final TieringTiers 1 & 2 Final Tiering

SSPs underwaySSPs underwayInspections for Tier 1 FacilitiesInspections for Tier 1 Facilities

Tiers 3 & 4 to come in wavesTiers 3 & 4 to come in waves

Latest CFATS NumbersLatest CFATS Numbers * *An Evolving Process An Evolving Process

* November 2009 vs. June 2010

Preliminary Tier

NovemberPreliminary Tier June

Final TierNovember

Final TierJune

Totals Nov

Totals June

Tier 1 8 5 172 224 180 229

Tier 2 54 54 578 516 632 570

Tier 3 318 157 1,099 1,100 1,417 1,257

Tier 4 3,340 1,964 473 1,313 3,813 3,277

Totals 3,720 2,180 2,322 3,153 6,042 5,333

What Does It Take to Comply?What Does It Take to Comply?

A Team Effort is Required:A Team Effort is Required:Security – Both Site & CorporateSecurity – Both Site & CorporateSite Management – Site Manager & Site Management – Site Manager &

PreparerPreparerSite Shipping & ReceivingSite Shipping & ReceivingIT – Both Site & CorporateIT – Both Site & CorporateEngineering – Both Site & CorporateEngineering – Both Site & CorporateEcologyEcologyCustomer ServiceCustomer ServiceLawyers?Lawyers?

Son of CFATSSon of CFATSSenate and HouseSenate and House

Maritime Transportation Security Act (MTSA) SitesMaritime Transportation Security Act (MTSA) Sites Labor involvementLabor involvement

Training RequirementsTraining Requirements Background WaiversBackground Waivers

No State PreemptionNo State Preemption IST issues IST issues

Mandatory Consideration – All TiersMandatory Consideration – All Tiers Mandatory Implementation Tiers 1 & 2Mandatory Implementation Tiers 1 & 2 Explain Why NotExplain Why Not Possible out for impracticality or economicsPossible out for impracticality or economics

33rdrd Party Right of Action Party Right of Action Lawyer Full Employment ActLawyer Full Employment Act

Gulf Disaster EffectGulf Disaster Effect

DiscussionDiscussion

Clyde MillerClyde Miller

Director, Corporate SecurityDirector, Corporate Security

BASF CorporationBASF Corporation