By Drew McClay In the past few months, our staff has been made aware of several clients who have received notifications from the Department of Homeland Security (DHS) that their site vulnerability assessments and site security plans must be updated. The notifications are primarily citing a July 2019 notice in the Federal Register which states that enhanced staff background checks would apply to every DHS designated facility at all risk levels.  Previously, the rule applied only to the highest risk facilities.

DHS Risk Tiers

The notices have detailed updates for some facilities under the Chemical Facility Anti-Terrorism Standards (CFATS).  Facilities that have been identified by the agency as being a “high-risk facility” for having dangerous chemicals are categorized in one of four tiers.  Tier 1 and Tier 2 are those determined to be the highest risk and are subject to stringent requirements.  Tier 3 and Tier 4 facilities, while still regulated by DHS, are considered lower risk.  Previously, these lower-risk facilities have been subject to fewer requirements under the CFATS program, including adjusted requirements for the level of detail necessary in staff background checks.

Personnel Surety Program

The agency has a full set of requirements for staff at facilities that handle dangerous chemicals, known as a personnel surety program which is part of Risk-Based Performance Standard (RBPS) 12. Personnel surety has been part of the site assessment and security plans in some form for all facility tiers in the past; however, for lower-risk, Tier 3 and Tier 4 facilities, the requirement primarily consisted of only a general background check.  The July 2019 change stated that an additional screening for terrorist ties, already a requirement for Tier 1 and 2, would now apply to Tier 3 and 4 facilities as well.  With the publication of this notice, all tiered facilities submitting their site vulnerability assessment and site security plans going forward are required to include this information in their submission. This change was embedded into DHS’ online site assessment and security plan form submission after July 2019; however, facilities that submitted their forms prior to that date were not required to update their plan solely to include the enhanced security background checks until notified by DHS that they are required to make the update.  Our clients have only recently started receiving such notices.

Compliance Process

After receiving a notification, facilities have 30 days to update their site assessment and security plan and resubmit it. Fortunately, there is little additional information that must be entered; however, the facilities must also indicate how they will comply with RBPS 12(iv).  DHS provides four options for compliance and a summary of each is available in a guidance document supplied by DHS. Cornerstone has found that these personnel surety requirements can cause Tier 3 and Tier 4 facilities to reevaluate their chemical usage on site.  Some facilities have decided that complying with the new requirements is excessively burdensome and so they find ways to reduce or eliminate the chemical that pulled them into the CFATS program. For most facilities, that is not an option, and they must determine which of the DHS compliance methods best suit their operations. Facilities have the option of proposing their own compliance method to DHS; however, for most this would entail more work than just selecting one of the four prescribed options.

Compliance Timeline

Tier 1 and 2 facilities are already subject to this requirement.  But, if your facility has been designated as Tier 3 or Tier 4, and you have not yet received a notification to update your online profile, now is the time to find out more about RBPS 12(iv).  After receiving notification that an update is required, the timeframe for response is limited. So, it is important to become familiar with the available compliance options and how to update your plans.  If your facility is submitting for the first time, be sure to understand the RBPS because it will be required as part of the initial submission.