| l 9, 2007 the Department of Homeland Security (DHS) | | | | of performing a new SVA and requesting DHS |
| published the Final Interim Rule on Chemical Facility | | | | approval of that VA as an Alternate Security Plan |
| Anti-Terrorism Standards (6 CFR part 27) in the | | | | (ASP). DHS may approve the ASP as long as it |
| Federal Register. The rule goes into effect in on June | | | | meets the criteria of the Center for Chemical Process |
| 8, 2007 and the Secretary of DHS will, on that date, be | | | | Safety (CCPS) for an SVA (Section 2.5, Guidelines for |
| able to direct individual, or classes of, chemical facilities | | | | Analyzing and Managing the Security Vulnerabilities of |
| to initiate actions under that rule. An appendix to that | | | | Fixed Chemical Sites, CCPS, 2003). |
| Rule, Appendix A, DHS Chemicals of Interest, was also | | | | Once DHS approves the SVA, facilities in all four tiers |
| published on that day for public comment (Docket | | | | will have 120 days to complete a Site Security Plant |
| 2006-0073). The comment period ends on May 9, | | | | (SSP). The key point for the SSP is that it must |
| 2007 and it appears that DHS intends to publish the | | | | specifically address all of the security problems noted |
| final version on June 8th of this year. | | | | in the SVA and address each of the |
| Within 60 days of the publishing of the final version of | | | | Department’s nineteen Risk Based |
| Appendix A, the final rule goes completely into effect. | | | | Performance Standards. Once the submitted SSP is |
| Starting on that date all chemical facilities that have, or | | | | approved via a Letter of Authorization, DHS will |
| expect to have on site at least the Screening | | | | inspect the facility to insure that its SSP is being |
| Threshold Quantity (STQ) found in Appendix A of any | | | | effectively implemented before DHS issues it Letter of |
| of the more than 300 chemicals listed will be required | | | | Approval of the SSP. |
| to provide to DHS information on their chemical | | | | One of the more controversial elements of the Risk |
| facilities, the chemicals used there, and the potential | | | | Based Performance Standards is the requirement for |
| consequences of an attack on the facility. This | | | | employee background checks as part of the Personal |
| information will be provided through an Internet utility | | | | Surety Standard. As part of the SSP the facility will |
| called the Top Screen. Each facility will have 60 days | | | | have to identify critical assets and restricted areas as |
| in which to complete this requirement. | | | | appropriate. Employees, contractors, and visitors with |
| DHS will utilize this information to: | | | | unaccompanied access to these areas will be required |
| 1. Determine if the facility is a high-risk chemical | | | | to be identified in the SSP. These personnel will be |
| facility that wouldhave further responsibilities under | | | | required to have under gone a background check that, |
| 6 CFR part 27, and | | | | at a minimum: |
| 2. If determined to be a high-risk chemical facility, | | | | 1. Verifies and validates identity, and |
| preliminarilyassign the facility to one of four tiers that | | | | 2. Completes a criminal history check of publicly or |
| will determine the levelsof protection required to meet | | | | commerciallyavailable databases, and |
| federal security guidelines under 6 | | | | 3. Verifies and validates legal authorization to work via |
| CFR part 27, and | | | | the I9process, and |
| 3. Notify the high-risk facility of deadlines to complete | | | | 4. Includes measures to identify personnel with terrorist |
| the next stepin the process, the Security Vulnerability | | | | ties. |
| Assessment. | | | | DHS has made clear that current or even long time |
| DHS estimates that more than 6,000 facilities will be | | | | employees cannot be grandfathered around this |
| covered by the requirement to complete a Top | | | | requirement. It has also reiterated that conviction for a |
| Screen submission. Of those, they expect between | | | | misdemeanor offense does not necessarily preclude |
| 1,500 and 6,000 will be required to take further actions | | | | someone from authorized unaccompanied access in a |
| under this new regulation. The highest risk facilities, Tier | | | | high risk chemical facility. Personnel with current |
| 1, will be required to complete the designated actions | | | | screening documentation under another DHS program |
| sooner than the lower, high risk facilities. Between 36 | | | | will be deemed appropriately screened; they will still |
| and 42% of these facilities are expected to be | | | | have to be identified in the SSP. DHS will establish |
| small entities under the Small Business | | | | procedures for submitting names for the performance |
| Administration’s rules. | | | | of the checks for personnel with terrorist ties as these |
| Once DHS evaluates the information provided in the | | | | checks will be done by DHS. |
| Top Screen, they will notify facilities which of four tiers | | | | There are provisions for the protection of any |
| they have been assigned for the purposes of | | | | information submitted to DHS in support of this |
| preparation of a Security Vulnerability Assessment. | | | | regulation. Any information submitted will be protected |
| Those not assigned to one of the four tiers are not | | | | as CVI (Chemical-terrorism Vulnerability Information) |
| considered to be a high risk facility’ and will | | | | and disseminated only to personnel on a need to know |
| not be governed by the other requirements of this | | | | basis. The protections required for this information |
| regulation. DHS encourages facilities not designated | | | | parallel the requirements for classified defense |
| high risk facilities to consider using the methodologies | | | | information. |
| outlined in this regulation to implement their own | | | | The new regulation establishes authority to issue |
| security programs. | | | | orders to insure compliance. These orders may be |
| The three highest risk tiers (tiers 1, 2, and 3) will be | | | | enforced by fines of up to $25,000 per day and |
| required to perform a Security Vulnerability | | | | potentially government closure of the facility. An |
| Assessment (SVA) within 90 days of their notification. | | | | appeals process has been established for the |
| The results of this SVA will be required to be entered | | | | designation as a high risk facility, assignment to tiers, |
| into the DHS on-line Chemical Security Assessment | | | | disapproval of SVA, SSP or ASP, orders, fines or |
| Tool (CSAT) so that DHS can make a final | | | | facility closure. |
| determination of their Tier ranking. Those facilities | | | | This new regulation will put extensive security |
| notified that they were preliminarily assigned a Tier 4 | | | | requirements on a large number of chemical facilities |
| (lowest high-risk rating) will have the option of filing an | | | | that have never been covered under government |
| already prepared vulnerability assessment (VA) in lieu | | | | security guidelines before. |