Chemical Facility Anti-terrorism Standards

1. Chemical Facility Anti-terrorism Standards • Since 2003, the Department of Homeland Security (DHS) has been working with its private sector partners in the chemical industry, state and local governmental entities and other interested parties on chemical facility security issues. • CFATS gives the Department of Homeland Security (DHS) the authority to regulate the security of “high-risk” DHS defined chemical facilities. • A “chemical facility” is defined as “any establishment that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined to be potentially dangerous or that meets other risk-related criteria identified by the Department”. • CFATS applies to chemical facilities currently “possessing or planning to possess” these chemicals

2. Top-Screen Assessments • If a facility possesses a Chemical of Interest (COI) that is on the DHS Chemicals of Interest list (6 CFR Part 27, Appendix A) at or above the Screening Threshold Quantity (STQ) for any applicable security issue, the facility must complete and submit a Top-Screen to DHS. • The Top-Screen Assessment helps identify high-risk chemical facilities which are subject to the Chemical Facility Anti-Terrorism Standards • The ``Top-screen'' risk assessment methodology accessible through a secure Department web site using the Chemical Security Assessment Tool (CSAT). • The Top-Screen is an initial screening process that determines the facility’s initial risk level through a preliminary consequence analysis.

3. Top-Screen Factors • Factors affecting the results of the Top-Screen include: • Volumes and hazards of chemicals; • Whether any chemicals used are chemical weapon precursors; • Proximity to receptors; • Whether the facility’s products are of national economic importance; • Whether the facility is a major supplier directly to the Department of Defense (DoD) or to other DoD suppliers; and • Whether the facility is a major supplier to public health, water treatment or power generation facilities.

4. Outcomes of the Assessment • Two outcomes from the Top-Screen from DHS: • If DHS makes a preliminary determination that a facility is not high-risk, DHS will send a letter to the facility indicating this. • If DHS makes a preliminary determination that a facility is high-risk, DHS will send a letter to the facility (see Attachment C for an example of such a letter). The letter will notify the facility of: • Its preliminary status as a high-risk facility, • Its preliminary placement in a risk-based tier and • The specific Chemical(s) of Interest and related security issues that need further analysis.

5. Security Vulnerability Assessments • The results of the Top-Screen determine whether any further analysis is required as well as the scope and level of detail of that analysis. • Facilities that are determined to be high risk are required to complete Security Vulnerability Assessments and Site Security Plans CSAT sections within 120 days.

6. High Risk Facilities • The Department uses this methodology to determine if a chemical facility ``present[s] a high level of security risk'' and should be covered by this program. • If the Department determines that a chemical facility qualifies as ``high risk,'' the Department would require the facility to prepare and submit a Vulnerability Assessment and Site Security Plan, and would provide technical assistance to the facility as appropriate. • Following a facility's submission of these materials, the Department would review the submissions for compliance with risk-based performance standards.

7. Site Inspections • The Department (or when appropriate, a DHS- certified third-party auditor) will follow up with a site inspection and audit. • If the facility's Vulnerability Assessment or Site Security Plan is found deficient or if other problems arise, the facility could seek further technical assistance from the Department, and could consult, object, or appeal depending on the stage of the process.

8. Approval of Site Security Plan • If the Vulnerability Assessment and/or Site Security Plan are ultimately disapproved, the covered facility would be required to revise its plan and resubmit the materials to meet the Department's performance standards, or face the penalties and other remedies set forth in the statute. • If the covered facility's submissions are approved, the security plan is fully implemented and the facility is otherwise in compliance, the Department would issue a Letter of Approval to document the determination.

9. Vulnerability Assessment Updates • The Department notifies the facility of its continuing obligations--based on its level of risk--to maintain and periodically update its Vulnerability Assessment and Site Security Plan.

10. Chemical Buffer Zone Protection Program • The Chemical Buffer Zone Protection Program (Chem-BZPP) is designed to identify and implement voluntary protective measures for the area outside of a chemical facility's fence, or the ``buffer zone,'' to make it more difficult for a potential attacker to plan or launch an attack. • These plans are intended to develop effective preventive and protective measures within the immediate vicinity of high-priority chemical sector critical infrastructure targets.

11. Chemical Buffer Zone Protection Program • The plans also increase the security- related capabilities of the jurisdictions responsible for the security and safety of the surrounding communities. • DHS provides funds to localities to support the implementation of regional buffer zone plans and mitigate the identified vulnerabilities.

12. Site Assistance Visits • Upon request, DHS conducts ``inside-the-fence'' site assistance visits to critical chemical facilities for a variety of reasons--a facility presents a high level of risk, the owner requests it, or the facility or sector is under threat. • The site visits are conducted by DHS protective security professionals, subject-matter experts, and local law enforcement, along with the facility's owners and operators.

13. Site Assistance Visits • These visits facilitate security vulnerability identification and mitigation discussions between government and industry. • The visits also provide facilities and localities with valuable information on how to better protect the facility from a terrorist attack. • After a visit, DHS suggests protective measures and issues a report to the facility to bolster its protective measures.

14. Registration Penalties • Failure to register under CFATS will result in facilities being presumed to possess a high security risk. • The consequences of non-compliance can include fines of $25,000 per day and/or an order to close and cease operations until the facility is brought into compliance. • Each facility needs to check their inventory (the most that could be on site at any one time) against the threshold screening quantities published in the regulations.

15. SARA Title III (Community Right to Know) • Federal P.L. 99-499, Title III of the Superfund Amendments and Reauthorization Act (SARA Title III) - The Emergency Planning and Community Right-to-Know Act (EPCRA) of 1986, • SARA, Title III provides funding for training in emergency planning, preparedness, mitigation, response, and recovery capabilities associated with hazardous chemicals.  Individuals who would be eligible for this training include public officials, fire and police personnel, medical personnel, first responders, and other tribal response and planning personnel. 

16. Goals of SARA Title III • Established a process whereby state and local planning entities could determine the hazardous substances existing within their designated areas and establish emergency procedures and guidelines to be followed in responding to the release of a hazardous substance to the environment. • Defines the public’s right to obtain information about the chemicals and hazardous substances utilized and stored in the community.

17. Coverage • Any business which stores, uses, or releases hazardous materials may be required to comply with one or more provision of SARA Title III. 

18. SERC and LEPC • State Emergency Response Commission (SERC) • Local Emergency Planning Committees (LEPC) • Most LEPCs serve a single county but some counties have joined with others to form a multicounty district with a single LEPC serving the entire district.

19. LEPC Plans • EPCRA (SARA Title III) includes nine specific items which the plans must address. • Identify the facilities which use or store hazardous substances; • Identify the routes used to transport the hazardous substances; • Outline standard operating procedures for use by facilities and first responders when responding to a release of a hazardous substance; • Identify sensitive facilities and their relationship to reporting facilities; • Detail release notification procedures; • Indicate how facilities will determine a release and what areas of the community are likely to be affected; • Outline evacuation plans for facilities and the community; • Establish a schedule for exercising the plan; and • Indicate where training is available for hazardous material incident response.

20. Section 304 Reporting • Section 304 – This section addresses requirements for immediate reporting of spills/releases of hazardous substances. • Any spilling, leaking, pumping, pouring, emitting, emptying, discharging, injecting, escaping, leaching, dumping, or disposing into the environment (including the abandonment of or discarding of barrels, containers, and other closed receptacles) of any listed substance that exceeds the reportable quantity is considered an emergency release • Section 304 requires immediate verbal reporting (via telephone) upon the event of a release and submittal of a written follow-up report after the initial response has been completed • Notification is made to both the SERCand LEPC • Additional state regulations on reporting requirements

21. Section 311 and 312 Coverage • Facilities falling under Section 311 and 312 requirements are: • Any facility required under Occupational Safety and Health Administration (OSHA) regulations to maintain MSDSs for hazardous chemicals stored or used in the work place. • Facilities with chemicals in quantities that equal or exceed the following thresholds must report: • For Extremely Hazardous Substances (EHSs)(40 CFR part 355 Appendix A and Appendix B (PDF)), either 500 pounds or the Threshold Planning Quantity (TPQ), whichever is lower. • For gasoline (all grades combined) at a retail gas station, the threshold level is 75,000 gallons, if the tank(s) was stored entirely underground and was in compliance at all times during the preceding calendar year with all applicable Underground Storage Tank (UST) requirements • For diesel fuel (all grades combined) at a retail gas station, the threshold level is 100,000 gallons, if the tank(s) was stored entirely underground and the tank(s) was in compliance at all times during the preceding calendar year with all applicable UST requirements • For all other hazardous chemicals: 10,000 pounds

22. Section 311 Reporting • Facilities must submit the MSDSs they maintain for OSHA to their SERC, LEPC, and local fire department for the regulated chemicals. • Or, facilities may choose to submit a detailed list of the same chemicals instead. • This is a one-time submittal; facilities have three months after becoming subject to the OSHA regulations to submit their material. • New facilities and any facility that begins to store any new reportable chemical must file a 311 report within 90 days of the date the stored quantity of the material first exceeded the threshold. • If a change occurs, a new report must be submitted within 90 days. • Facilities that need to submit MSDSs or chemical lists under Section 311, also need to submit an annual inventory report for the same chemicals (EPCRA Section 312).

23. Section 312 Reporting • Section 312 – This section requires submittal of a Tier II form (in most states) • The reporting thresholds for section 312 are the same as those for Section 311 • 312 reporting requirements: • Information on a Tier II form covers storage from the preceding calendar year • Tier II forms are sent to the LEPC, the SERC and the local fire department • The Tier II forms must be submitted on an annual basis (by March 1 of each year).

24. Toxic Release Inventory Reporting • Section 313 –Section 313 covers manufacturing facilities • Regulated facilities are defined as those which: • Have 10 or more full-time employees; • Have a specific NSICS Code (formerly SIC code); and • Manufacture, process, or import more than 25,000 lbs., or otherwise use more than 10,000 lbs. of chemicals on the Section 313 list. • If a facility meets all three requirements, a Toxic Chemical Release Inventory (TRI) form must be submitted • Amounts reported are for the preceding calendar year • The 313 report submittal goes directly to the federal Environmental Protection Agency and is required annually, by July 1. • TRI data is sent electronically using the TRI-MEweb application