Chemical Facility Anti-Terrorism Standards (CFATS)

CFATS

Are you affected by CFATS?

On April 9, 2007, the U.S. Department of Homeland Security (DHS) issued the Chemical Facility Anti-Terrorism Standards (CFATS), which became effective on June 8, 2007. Since that time, industry has been working to understand the full scope of the regulation's requirements and what steps will likely need to be taken for CFATS compliance.

Under the CFATS umbrella, DHS established eighteen "Risk-Based Performance Standards" (RBPSs) that regulated facilities must address, as applicable. With performance standards (as opposed to prescriptive measures), each regulated facility has the flexibility to implement security measures that are the most appropriate for that particular site, subject to DHS review and approval. To help the regulated community better understand the intent (and expectations) for each RBPS at varying tiers (i.e. Tier 1 – Tier 4), DHS issued a RPBS Guidance Document in May 2009.

That same month, DHS notified approximately 140 facilities that they were receiving a final Tier 1 designation. These facilities were required to submit a Site Security Plan (SSP) to DHS on or before September 15, 2009.

On June 29, 2009, DHS notified a second batch of facilities that they were receiving a final Tier 2 designation, and that they must submit a SSP to DHS on or before October 29, 2009. DHS then notified a third group of facilities that they were receiving a final Tier 3 designation in late July 2009; their SSPs were due in November of that year. Some Tier 4 facilities began receiving final tier designations in October 2009, with their SSPs due to DHS by February 2010. To date, DHS has classified approximately 218 facilities as final Tier 1′s, 535 facilities as final Tier 2′s, 1,126 facilities as final Tier3′s, and 2,215 facilities as final Tier 4′s.

Three preliminary Tier 1 facilities are awaiting final tier determinations, as are 39 preliminary Tier 2′s, 146 preliminary Tier 3′s, and 474 preliminary Tier 4′s.

Ameristar Can Help With CFATS Compliance.

From the inception of CFATS more than 3 years ago, Ameristar has closely followed the development of the regulation. We have assembled a team of security experts to serve as a resource not only to security integrators, but also to the manufacturers of the sensors and systems that the security integration community will use to implement appropriate risk-based security solutions. Perhaps more significantly, Ameristar has served, and continues to serve, as a resource to chemical and petrochemical company security directors. Click here for Ameristar products that help achieve CFATS compliance.

Ameristar has been working with security directors to conceptualize security enhancements for RBPS 1 (Restrict Area Perimeter), RBPS 2 (Secure Site Assets), RBPS 3 (Screen and Control Access), and RBPS 4 (Deter, Detect, and Delay). Ameristar understands that each regulated facility faces unique security challenges, and the successful execution of CFATS requires a multi-disciplinary team that appreciates the nuanced application of the regulation.

CFATS requires all covered facilities to address the eighteen established RBPSs, as applicable. RBPSs 1-6 focus predominately on physical security. Whether the need is for enhanced fence-line security or enhanced security for Theft/Diversion Chemicals of Interest (COIs) contained in "transportation packaging," Ameristar has a solution for any risk-tier:

  1. RBPS 1 – Restrict Area Perimeter: Addresses the need to provide for a controlled perimeter surrounding the facility. This involves both securing and monitoring the area perimeter.
  2. RBPS 2 – Secure Site Assets: Addresses security at and around restricted areas or potentially critical targets within the facility. Like RBPS 1, this requires screening and monitoring – but at the asset level rather than facility-wide.
  3. RBPS 3 – Screen and Control Access: Addresses the identification, screening, and inspection of individuals and vehicles entering and/or exiting the facility.
  4. RBPS 4 – Deter, Detect, and Delay: Addresses deterrence, detection, and delay of would-be adversaries, so that the facility creates sufficient time between the detection of an attack and the point at which the attack succeeds.
  5. RBPS 5 – Shipping, Receipt, and Storage: Addresses the shipping, receipt, and storage of COI, including restricting access to COIs to only authorized individuals.
  6. RBPS 6 – Theft or Diversion: Addresses the theft or diversion of COI. Like RBPS 5, this requires restricting access to COIs to only authorized individuals.

Approaches to Compliance

There are several different approaches a CFATS-regulated facility may take to secure and protect its Chemicals of Interest (COIs) and associated CFATS assets. When making this determination, facilities should consider, among other factors, the location, type, tier, amount, and Appendix A Security Issue(s) (i.e., Release, Theft, and/or Sabotage/Contamination) of the COI.

Update On the CFATS Implementation Process

  1. More than 38,000 initial Top-Screens received by DHS
  2. More than 7,000 preliminary tier notifications issued by DHS
  3. 4,755 facilities covered by CFATS across all 50 states
  4. Nearly 4,000 Site Security Plans (SSP) and Alternative Security Programs (ASP) have been received by DHS
  5. More than 150 Pre-authorization Inspections (PAI) have been completed by DHS
  6. 4 Authorization Inspections (AI) have been completed
  7. 63 Administrative Orders have been issued to facilities that failed to submit a Site Security Plan within the deadline (all 63 facilities are now in compliance with CFATS)

In March 2011, Congress introduced four separate pieces of legislation that would extend authority for the CFATS program. Those four bills are listed below (with links):

H.R. 908, the Full Implementation of the Chemical Facility Anti-Terrorism Standards Act extends CFATS authorization until October 2017.

H.R. 916, the Continuing Chemical Facilities Antiterrorism Security Act of 2011 extends CFATS authorization until October 2015 and establishes a voluntary chemical security training program and voluntary chemical security exercise program

H.R. 901, the Chemical Facility Anti-Terrorism Security Authorization Act of 2011 extends CFATS authorization until September 2018

S.473, the Continuing Chemical Facilities Antiterrorism Security Act of 2011 extends CFATS authorization until October 2014 and establishes a voluntary chemical security training program and voluntary chemical security exercise program and creates a Chemical Facility Security Advisory Board to "…advise the Secretary [of DHS] on the implementation of [CFATS]…."

DHS continues to conduct a review of CFATS Appendix A and the current list of Chemicals of Interest (COI). The focus is on things like screening threshold quantities and mixture rules.

DHS is still working with the U.S. Coast Guard on improving the harmonization and coordination of CFATS and the Maritime Transportation Security Act (MTSA).

DHS is finalizing the analysis of the agricultural facility surveys. At this writing, many agricultural facilities are exempt from the CFATS mandates. DHS is looking at the survey to determine if that exemption should become permanent.

On June 2, 2011 (by a vote of 233-188), the House of Representatives voted to extend the current Chemical Facility Antiterrorism Standards (CFATS) program through the end of FY 2012 (September 30, 2012). The provision is contained in HR 2017, the Homeland Security appropriations bill for FY 12.

According to the Agricultural Retailers Association, on May 4, 2011 the House Energy and Commerce Subcommittee on the Environment and the Economy approved a bill (H.R. 908) that would extend the U.S. Department of Homeland Security's (DHS) authorization for the Chemical Facilities Anti-Terrorism Standards (CFATS) program through 2017. This is not to contradict the above mentioned "extension", as this five year extension is a bill in motion.

DHS believes that the exclusion of water and wastewater facilities leaves a huge gap in the CFATS mandate. Although DHS feels water facilities should stay under the EPA, DHS believes that CFATS tools should be used to make sure these facilities and the chemicals they use and store "are secure".

Click here for CFATS compliance products and solutions by Ameristar

© 2013 Ameristar Security Products, Inc. All Rights Reserved.