When it comes to cargo security, air and ocean transportation probably are where you've focused your efforts. But if you have any involvement with the storage, transportation, and distribution of chemicals, warns the U.S. Department of Homeland Security (DHS), then you need to add those activities to your list of security concerns—right now.
CFATS, the Chemical Facility Anti-Terrorism Standards (6 CFR Part 27), establishes risk-based performance standards for chemical facility security. The final rule was published in late 2007, and DHS plans to ramp up enforcement in 2010.
CFATS applies to any facility that manufactures, uses, stores, or distributes certain chemicals at or above specified quantities. The rule requires all facilities that handle chemicals to complete an online "Top Screen" questionnaire about the facility itself and the chemicals that are manufactured, processed, used, stored, or distributed there. After the completed form has been submitted, an automated response will advise the user whether or not the chemicals are regulated. Chemicals that fall under the regulations are those that DHS has determined present significant risk from theft, diversion, sabotage, or other security issues, says DHS manager Laurie Boulden. (The list of "chemicals of interest" can be found in the regulation's Appendix A.)
Facilities that are regulated must conduct a Security Vulnerability Assessment, which investigates further how and where the chemicals are stored as well as the facility's vulnerability to certain risk scenarios, Boulden explains. Once DHS has reviewed the assessment, a facility may be required to prepare a Site Security Plan demonstrating that a facility is able to meet certain risk-based performance standards. "DHS is expressly forbidden from requiring any particular measure, so it is up to each individual facility to decide, based on its own processes, operations, business models, and plans, how it wants to meet the standards," Boulden says. "Each site is basically writing its own regulation by which it wants to be held accountable." DHS may also conduct a site visit.
Penalties for noncompliance are stiff indeed: up to $25,000 per day and/or orders to cease operations. The regulation is rather complicated, and DHS has made extremely detailed information available online. But the agency is not leaving companies entirely to their own devices: Those that are subject to the regulation may arrange for an informational presentation, an on-site "compliance assistance" visit, and compliance training, among other support services.
Loxo/Planzer