Enhancing Chemical Facility Security with CFATS Program

1. 2017 – WV SERC Conference & Chemical Safety, Security and Transportation Workshop August 2017 Chemical Facility Anti-Terrorism Standards (CFATS)

2. Why Chemical Facility Security? DHS recognizes this Persistent and Evolving Threat “Compelling Confirmation” that Chlorine Gas Used as Weapon in Syria OPCW, September 10, 2014 • A successful attack on some chemical facilities could potentially cause a significant number of deaths and injuries • Certain chemical facilities possess materials that could be stolen or diverted and used as or converted into weapons for use offsite Death Toll in West, Texas,Fertilizer Explosion Rises to 15 NPR, April 23, 2013 French Authorities Hold Suspect in Beheading and Explosion at Chemical Plant NYTimes, June 26, 2015 West, Texas, in 2013. Image courtesy of the Chemical Safety Board.

3. Why Chemical Facility Security? • In December 2006, Congress authorized the Department to regulate security at “high-risk” chemical facilities through the Appropriations Act of 2007 • The Department developed the Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27, to implement this authority • In December 2014, Congress passed the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 • Extended the Department’s authority over security at high-risk chemical facilities Statutory Authority

4. The CFATS Regulation • CFATS follows a risk-based approach, allowing DHS to focus on high-risk chemical facilities in accordance with their specific level of risk • To determine if a facility is subject to CFATS, DHS looks at the unique circumstances faced by the facility • If the facility is in possession of threshold quantities of Appendix “A” Chemicals-of-Interest (COI), the facility must provide information to the Department to support risk assessment • This applies even if the facility does not consider itself a “chemical facility”— CFATS applies to hospitals, mines, universities, etc.

5. Am I Exempt?

6. Essentials of the CFATS Program Tier 2 12% Tier 3 30% Tier 4 54% DHS uses information submitted through assessments to determine if a facility is high risk • High risk (i.e., covered) facilities are placed in1 of 4 high-risk tiers • Facilities determined by DHS to be high-risk are required to develop and implement security plans that meet applicable risk-based performance standards (RBPS) • More than 3,000 facilities have eliminated, reduced, or modified their holdings and/or processes and are no longer considered high-risk

7. The CFATS Process All facilities with COI High-risk facilities • DHS provides compliance assistance upon request at any stage of this process to Facilities. From the facility perspective

8. CFATS Universe Hospitals and Clinics Food Processing Colleges and Universities Wineries/Breweries Wineries Oil Refineries Chemical Manufacturing Correctional Facilities Chemical Facilities Come in All Shapes and Sizes Farm Cooperatives “Appendix A” – a list of 300+ chemicals-of- interest (COI) at specific threshold quantities and concentrations that require reporting to the Department Identifying high-risk chemical facilities

9. Industries with Facilities Regulated by CFATS • Academia (College & Universities) • Aerial Sprayers (Non-Fertilizer) • Breweries • Cold Chain/Refrigeration • Crime Labs (State, City, County, Private, etc.) • Energy Utilities • Fisheries and Hatcheries • Food Processors and Co-Ops • Healthcare (Hospitals & Providers) • Industrial Equipment Manufacturing • Laboratories • Metal Service and Metal Merchants • Mining • Motor Vehicle Parts Manufacturing • Paints/Coatings • Parks and Pools • Petrochemical Manufacturing • Petroleum Refining/Oil Drilling • Plastics • Pulp and Paper • Race Tracks • Retail Storage and Distribution • Semiconductors • Water Filtration • Wineries NH3 AN CI H202 CFATS regulates facilities in various industries, including:

10. Risk-Based Performance Standards 1) Restrict Area Perimeter 2) Secure Site Assets 3) Screen and Control Access 4) Deter, Detect, Delay 5) Shipping, Receipt, and Storage 6) Theft and Diversion 7) Sabotage 8) Cyber 9) Response RBPS-8 Cyber RBPS-10 Monitoring 10) Monitoring 11) Training 12) Personnel Surety 13) Elevated Threats 14) Specific Threats, Vulnerabilities, or Risks15) Reporting of Significant Security Incidents 16) Significant Security Incidents and Suspicious Activities 17) Officials and Organization 18) Records • Rather than define specific security measures, DHS developed 18 Risk-Based Performance Standards (RBPS) • Compliance with the RBPS will be tailored to fit each facility’s circumstances, including tier level, security issues, and physical and operating environments RBPS-1 Restrict Area Perimeter RBPS-18 Records

11. Chemical Security Inspectors • Chemical Security Inspectors are located in all 50 States • More than 130 Chemical Security Inspectors • Organized into teams in each of the 10 Federal regions • Conduct: • Authorization Inspections • Compliance Assistant Visits • Compliance Inspections • Stakeholder Outreach • Enforcement Operations • Chemical Security Inspectors also attend meetings with Federal, State, local, and private industry members

12. - Puerto Rico (Region 2) CFATS National Footprint Number of Approvals, by State 0 1-10 11-20 21-30 30+ Number of Facilities, by Region 0 1-115 116-230 231-345 346-460 461-575 576-690 Region 5 Region 10 Region 10 Region 1 Region 8 Region 2 Region 5 Region 8 Region 9 Region 7 Region 9 Region 3 Region 7 Region 4 Region 4 Region 6 Region 6 - Hawaii (Region 9) - Guam (Region 9)

13. Snapshot Region 3 Delaware 13 Inspectors All statistics are current as of August, 2017 294 Currently Tiered Facilities 220 Currently Authorized Facilities 211 Currently Approved Facilities 217 Total Authorization Inspections 201 Total Compliance Inspections

14. West Virginia Snapshot • 21 Currently Tiered Facilities • 17 Currently Authorized Facilities • 16 Currently Approved Facilities • 16 Total Authorization Inspections • 14 Total Compliance Inspections • In April, DHS began retiering all facilities as part of the implementation of an enhanced tiering methodology. The number of currently tiered facilities, authorizedfacilities, and approved facilities may shift as facilities receive new high-risk tiering determinations. All statistics are current as of August, 2017

15. Submitting and Protecting Information

16. Improved Tiering Methodology and CSAT 2.0 • The enhanced tiering methodology accounts for the relevant elements of risk: threat, vulnerability, and consequence • CSAT 2.0 will consist of a revised Top-Screen, Security Vulnerability Assessment, and SSP • Collects data needed for the improved CFATS risk-tiering methodology • All facilities with chemicals of interest (COI) at or above screening threshold quantity (STQ) will be required to resubmit a new Top-Screen • New tools were released in fall 2016; facilities began receiving new tiers in April 2017 • DHS expects retiering to be completed in fall 2018 Current As Of July 8th, 2014

17. 2017 Priorities: Personnel Surety Program • Personnel Surety includes vetting individuals with access to COI and other sensitive parts of high-risk chemical facilities • Risk-Based Performance Standard (RBPS)12 requires certain types of background checks, including recurrent vetting against the Terrorist Screening Data-Base (TSDB) • DHS began implementation of the CFATS Personnel Surety Program in December 2015. Tier 1 and Tier 2 facilities have four ways to implement terrorist screening provisions: • Direct vetting through DHS’s online tool • Verifying credentials through DHS’s online tool • Using an electronic credential reader, like a TWIC reader • Visual verification of a credential • More than 7,000 names are currently being vetted through the TSDB

18. Available Resources • CFATS Tip-Line: 1-877-394-4347 (1-877-FYI 4 DHS) or via email: CFATSTips@hq.dhs.gov

20. Garret J. Hansen – Supervisory Chemical Security Inspector Infrastructure Security Compliance Division – Field Operations, Region 3 Office of Infrastructure Protection garret.hansen@hq.dhs.gov or 202-302-6365 (cell)