As part of the Homeland Security Appropriations Act of 2007, Congress directed the Department of Homeland Security (DHS) to identify and regulate “high-risk chemical facilities.” Specifically, DHS was to require each such facility to conduct a security vulnerability assessment (SVA) and prepare a security plan reflecting risk-based performance standards (RBPS) established by the Department. DHS promulgated the Chemical Facility Anti-Terrorism Standards (CFATS) as 6 CFR Part 27 on April 9. CFATS became effective on June 8.
The rule will have widespread consequences because it goes beyond simply regulating chemical plants.
It will impact any facility that handles chemicals on the Chemicals of Interest List (Appendix A of the rule) at levels above the Screening Threshold Quantities (STQ), with a few exemptions stipulated by Congress and practical policy decisions made by DHS. Many of those facilities, should the DHS analyses conclude they pose a high security risk, will be assigned to one of the four tiers. They could represent a wide cross-section of industries and applications that use chemicals. This is consistent with DHS’ role as the agency responsible for the chemicals sector under the National Infrastructure Protection Plan.
This is a very significant development for the chemical sector because up to this point no Federal regulation had defined security expectations for chemical facilities except U.S. Coast Guard Maritime Security Regulations. The Maritime Transportation Security Act of 2002 (MTSA) didn’t explicitly define RBPS or tiers. While the MTSA regulations are performance-based for the most part, the Coast Guard does have the authority to specify security measures, whereas DHS isn’t given this authority by the Act.
Under the Act, DHS must establish RBPS for security of high-risk chemical facilities, while industry must perform SVA and develop and implement Site Security Plans (SSP) that address these requirements.
The SSP will need to explain how the site met the RBPS set by DHS. This is a new realm in the world of chemical industry security — so a key aspect of meeting the regulatory requirements will be interpreting these standards and determining the best path to achieving them. No other security regime in the post 9/11 era is attempting to regulate so many diverse types of facilities in such a progressive way.
For some facilities, getting into and maintaining compliance to the rule could require significant investment and operational changes.
Intention of the standards
CFATS was designed to reduce security risk to critical chemical facilities as well as to the communities surrounding them, recognizing that chemicals may be both crucial to other essential parts of society — including public health, the food and water supply, energy and national defense — and hazardous to those working with and around them. For that reason, the regulations will identify chemical facilities as “high-risk” because they have a potential for significant harm to human health and because they are essential to critical missions of the government as well as the national or regional economies. Also recognizing the great variation among facilities that manufacture, store and use chemicals, the regulations are written to be implemented on a site-specific basis, reflecting the security profile of individual facilities.
The new program is:
- Risk-based. CFATS will assign high-risk facilities to one of four tiers and will impose requirements and standards based on the potential risk represented by the particular tier.
- Performance-based. Rather than prescribing specific security measures for all facilities or even for all facilities in a given tier, it establishes RBPS that will allow a facility to implement security measures that, taken together, meet the applicable RBPS for its tier.
- Complementary to existing industry voluntary efforts and investments. Following 9/11, facilities throughout the chemical sector developed security programs and initiatives to reduce vulnerabilities to terrorist attacks. Some companies and facilities implemented their own programs while others participated in broader industry initiatives such as the American Chemistry Council’s Responsible Care Security Code or the American Petroleum Institute’s Security Guidelines. Many facilities conducted vulnerability assessments using methodologies developed by Sandia National Labs, the American Institute of Chemical Engineers’ Center for Chemical Process Safety, or other methodologies derived from those two methods.
While CFATS does build on existing industry efforts, it’s an enforceable regulatory program. Recalcitrant facilities may be fined or even shut down for failure to comply.
The facilities affected
Prescribed screening and evaluation efforts will determine whether a facility is regulated under CFATS.
Chemical facilities that have a minimum STQ of listed chemicals on site will be screened. Subsequent information-gathering and assessment efforts, centered around the SVA, will place regulated facilities into one of four tiers. Each tier will be required to meet RBPS with layered security measures, with rigor increasing with tier. It is believed that the majority of sites screened won’t be included in the regulated community.
Facilities not subject to the regulation include:
- Those exempted by statute, such as facilities regulated pursuant to MTSA, owned or operated by the Department of Defense or the Department of Energy, those subject to regulation by the Nuclear Regulatory Commission; Public Water Systems as defined by Section 1401 of the Safe Drinking Water Act; and Treatment Works as defined in Section 212 of the Federal Water Pollution Control Act;
- Facilities that possess or plan to possess listed chemicals but below the STQ;
- Facilities that aren’t considered “high-risk” after DHS screens or further analyzes their activities and potential risks either following submittal of a Top-Screen or SVA;
- Facilities that possess or plan to possess chemicals but whose activities aren’t included in the scope of CFATS by policy (e.g., rail yards were mentioned by DHS in the interim final rule preamble).