|
By design, the Chemical Facilities Anti-Terrorism Standards (CFATS) stretch beyond traditional chemical manufacturing facilities and impact every facility in the United States that stores, maintains or manages a chemical of interest (COI) at the designated quantity and concentration from among over 300 listed in Appendix A to the CFATS rule. The list includes commonly used chemicals such as propane, ammonia, and chlorine.
DHS has already identified thousands of facilities as subject to CFATS from a wide variety of industrial sectors, including
- petroleum refineries and manufacturers
- energy and utility companies
- agriculture and food concerns
- paint and coatings manufacturers
- explosives manufacturers
- mining companies, and
- health care and pharmaceutical companies
THE THREE STAGES OF CFATS COMPLIANCE:
The first stage of CFATS regulation began on January 22, 2008, when all facilities had 60 days to review the list of 322 COIs, determine if they “possess” any of those chemicals above the screening threshold quantity (STQ) and submit a chemical inventory or “Top-Screen.” DHS gave notice to those facilities that it considered presumptively high risk and were thus required to complete a security vulnerability assessment (SVA), which takes place on a rolling schedule established by DHS. The process begins anew when a facility determines that it possesses a COI above the threshold quantity. The final stage is the development of site security plans (SSPs), again based on a DHS schedule.
DHS approval of an SSP is contingent upon its finding that the SSP satisfies the 18 Risk-Based Performance Standards (RBPS) listed in the CFATS rule and described in DHS guidance. The RBPS guidance is not intended to be prescriptive — a facility may not need to implement all of the DHS-suggested measures in order to prepare an approvable SSP — but to provide examples of the types of measures DHS believes would satisfy the RBPS and to allow a facility flexibility in designing the most appropriate and cost-effective solutions from a comprehensive suite of security options. From experience with other regulatory programs, industry has recognized that courts will often enforce agency “guidance” as binding legal requirements when regulatory standards are not clear.
BEST PRACTICES FOR PREPARING SSPS:
Failure to adequately comply with CFATS may have significant repercussions. DHS may order a facility to cease operations, or it may assess civil penalties up to $25,000 per day. Clear operating policies and procedures are important to demonstrate compliance and to help a covered facility prepare responses to the 1500 highly complex and subjective SSP questions.
As part of those procedures, it will likely make sense for a facility to:
- establish a compliance team to take responsibility for completion of the SSP, including legal counsel who may help interpret DHS rules and guidance and afford the protections of attorney-client privilege as appropriate to the confidential information generated during the regulatory process in the event of an enforcement proceeding;
- develop a CFATS training program, including proper methods for handling Chemical Terrorism Vulnerability Information (CVI), a new category of highly sensitive security information;
- coordinate responses to SSP questions with security plans developed under OSHA and EPA regulatory programs; and
- adequately prepare for CFATS-mandated site inspections so that the information provided to federal inspectors is controlled and properly documented.
CONTINUING OBLIGATIONS:
Once its SSP is approved, a facility will have to develop operating policies and procedures and implement security measures and activities based on the approved SSP. Affected facilities also have an obligation to resubmit new Top-Screens, SVAs and SSPs every two to three years (depending upon the risk tier), or within 60 days if there is a “material modification” in operations at the facility.
If a facility does not currently possess one or more chemicals at or above the STQ, but later comes into possession of such a chemical or chemicals, the facility will have to complete and submit a Top-Screen within 60 calendar days of possession. Alternatively, if the COI on-site falls below the STQ, the facility must resubmit a Top-Screen and will be able to “tier out” of the program.
Industry should continue to monitor Congress, which is now considering CFATS reauthorization legislation that is expected to remove the existing exemptions for drinking water and wastewater systems and mandate that facilities include measures in their SSPs to “reduce the consequences of a terrorist attack” by switching to safer alternative chemicals or processes, such as substituting less hazardous chemicals at the site.
Content contributed by Evan D. Wolff, Esq. and Maida Oringher Lerner, Esq. Evan Wolff, Director of Hunton & Williams’ Homeland Security Practice, can be reached at ewolff@hunton.com. Maida Lerner, counsel at Hunton & Williams, can be reached at mlerner@hunton.com.
|
