As I mentioned, there were two CFATS sessions at the big industrial security conference in Dallas. The second session was called "CFATS - Beyond the SSP" and took a look at SSP and post SSP issues for chemical facilities. The speakers mainly focused on implementing the SSP and getting through the authorization inspection.
Attorney Evan Wolff of the firm Hunton & Williams spoke about some of the legal considerations involved in CFATS. He reminded everyone in the room that his advice and thoughts should not be construed as legal counsel. One of his first pieces of advice for each chemical facility is to have a corporate policy in place for physical and cyber security. That policy needs to clearly define leadership and management roles so that everyone knows who is responsible for each part of the policy and so that there are no gaps.
Since there are many other regulations affecting plants and facilities Wolff reminded the presentation attendees to review the impact of all of the other regulations and standards including OSHA, NFPA and any state or local regulations. It is important to make sure that your facility remains compliant in all areas even when making changes and adjustments for CFATS mandates. He encourages the development of compliance mechanism, so that procedures are in place for each standard or regulation.
Another thing Wolff recommends is for each chemical facility to develop a consistent way to manage chemicals and inventories. This is very important because it provides documentation and is essential for keeping in compliance over the long run. Standardized and documented procedures will make any subsequent DHS inspections that much easier to pass.
For your DHS inspection Wolff recommends the following:
• Remember that DHS has broad inspection authority under the law and can come into your facility with limited notice. That means you can't let your guard down. You have to have your procedures in place and ready to past muster at all times.
• Prior to the inspection, review all CFATS documents and conduct a dress rehearsal. Be ready not to just talk about your procedures, but to show how those processes work on a day-to-day basis.
• During the inspection keep notes as you go along with the inspector. These will be very useful and allow you to quickly go back and make any necessary changes or adjustments.
• Don't speculate during the inspection. If you don't know the answer just say "I don't know." Speculating can get you in trouble. Being up front about what you know and don't know is the only way to go.
• Request copies of all materials generated during the inspection process. Ask for copies of any photos or videos that have been taken.
• Consider sending a follow up letter to DHS after the inspection. Reiterate your understanding of the inspection result and request any clarification in writing.
It is some good, sound advice from someone who has been through the process with a number of clients. It's important to tap into the CFATS knowledge base that is out there and get quality advice from experienced professionals who know CFATS and have an understanding of it.
Copyright © ADT Security Services, Inc. 2011 - All Rights Reserved. Legal Disclaimer - Some of the individuals posting to this site, including the moderators, work for ADT Security Services, Inc. Opinions expressed here and in any corresponding comments are the personal opinions of the original authors, not of ADT Security Services, Inc. The content is provided for informational purposes only and is not meant to be an endorsement or representation by ADT Security Services, Inc. or any other party. This site is available to the public. No information you consider confidential should be posted to this site. By posting you agree to be solely responsible for the content of all information you contribute, link to, or otherwise upload to the Website and release ADT Security Services, Inc. from any liability related to your use of the Website. You also grant to ADT Security Services, Inc. a worldwide, perpetual, irrevocable, royalty-free and fully-paid, transferable (including rights to sublicense) right to exercise all copyright, publicity, and moral rights with respect to any original content you provide. The comments are moderated. Comments will appear as soon as they are approved by the moderator.