# Presentation: 478655

## Hazardous Materials Transportation Security Requirements 

**Hazardous Materials Transportation Security Requirements**** **

**Notes:**
Hello.  I’m ______________, I am with the U.S. Department of Transportation, Pipeline and Hazardous Materials Safety Administration, Office of Hazardous Materials Initiatives and Training.

## Objectives

**Provide an overview of the security requirements found in the Hazardous Materials Regulations (HMR)**
**Offer suggestions and guidance on how to comply with these requirements**
**	**

**Notes:**
We’re here today to talk about hazardous materials transportation security.
This session will focus on meeting two objectives. 
First, we’ll discuss specific security plan and security training requirements prescribed in the hazardous materials regulations.  These requirements were published in a rulemaking which we refer to as HM-232. The effective date of this rule was March 25, 2003.
Next, I’ll provide some guidance and suggestions for conducting threat assessments and creating a security plan.

## Reference Material

**Notes:**
Included in your standard pack is a copy of our security brochure.  It is a good reference tool for you to use to meet the security requirements found in the HMR.

## Overview of the Security Requirements

**Security plan requirements**
**Security awareness training**
**In-depth security training**
**Initial and recurrent training and record keeping**
**Security plan administration**

**Notes:**
First, let’s summarize the requirements of HM-232. 
Each hazmat employee must receive general awareness security training.
Each person who offers for transportation in commerce or transports in commerce, one or more of the hazardous materials listed in 49 CFR 172.800 (b) of the Hazardous Materials Regulations (or HMR) must develop and adhere to a security plan.
By December 22, 2003, hazmat employees of entities required to have security plans who handle hazardous materials, perform functions related to hazmat, or are responsible for implementing the security plan, must receive in-depth security training.  
Now, I’ll go into more detail.

## Security Plan Requirements

**	****Each person who offers for transportation in commerce or transports in commerce one or more of the hazmat listed in 172.800(b)(1-7) must develop and implement a security plan**

- §172.800

**Notes:**
New security plan requirements are found in Parts 172.800 and 172.802.
172.800(b) states that each person who offers for transportation in commerce or transports in commerce one or more of the hazardous materials listed in 172.800(b)(1-7) must develop and implement a security plan by September 25, 2003.

## Required Components of a Security Plan

**Assessment of possible transportation security threats and appropriate measures to address assessed threats**
**Security plans must include the following elements:**
**Personnel security**
**Unauthorized access**
**En route security**

- §172.802

**Notes:**
Here are the required components of a security plan:
First, an assessment of possible transportation security threats, and appropriate measures to address assessed threats, must be completed.
Then, a security plan must be developed based on your assessment. At a minimum, security plans must include:
Personnel security – measures to confirm information provided by job applicants hired for positions that have access to the hazardous materials covered by the plan.
Unauthorized access – measures to address the assessed risk that unauthorized persons may gain access to hazardous materials covered by the security plan.
En route security – Measures to address the assessed security risks of shipments covered by the security plan en route from origin to destination, including shipments stored incidental to movement.

## Required Components of a Security Plan (cont.)

**Security plans must be in writing **
**Copies must be available to employees**
**Plans must be revised and updated **
**All current copies must be maintained**

- §172.802

**Notes:**
Security plans must be in writing and must be retained for as long as they remain in effect.
Copies of security plans, or portions thereof, must be available to the employees who are responsible for its implementation.
Security plans must be revised and updated as necessary to reflect current circumstances.
And, when the security plan is updated or revised, all copies of the revised or updated plan must be maintained as of the date of the most recent revision.

## Security Plans Approved by Other Organizations

**HM-232 permits security plans ****that conform to regulations or standards issued by other Federal agencies, international organizations, or industry groups**
**Examples may include security requirements imposed by USCG, DOD, NRC, UN, IMO, or TSA**

- §172.804

**Notes:**
HM-232 permits security plans that conform to regulations or standards issued by other Federal agencies, international organizations, or industry groups.
Examples may include security requirements imposed by the Department of Defense, Nuclear Regulatory Commission, United Nations, International Maritime Organization, or the Transportation Security Administration.

## Security Awareness Training

**Hazmat employees must receive security awareness training at the next recurrent training, but no later than  March 24, 2006**
**New hazmat employees must receive security awareness training within 90 days after employment**

- §172.704(a)(4)

**Notes:**
Hazmat employees must receive security awareness training no later than the first recurrent training after March 25, 2003, but in no case later than March 24, 2006.
New hazmat employees must receive security awareness training within 90 days of employment.

## Security Awareness Training Must Include: 

**Security risks associated with hazmat transportation**
**Methods designed to enhance hazmat transportation security**
**How to recognize and respond to possible security threats**

**Notes:**
Security awareness training must include:
Security risks associated with hazmat transportation,
Methods designed to enhance hazmat transportation security, and
How to recognize and respond to possible security threats.

## Hazmat Transportation Security Awareness Training Module on CD-ROM

**	****Meets security awareness training requirement as long as record keeping requirements described ****in 172.704(d) are followed**** **

**Notes:**
The Hazmat Transportation Security Awareness Training Module, produced by PHMSA’s Office of Hazardous Materials Initiatives and Training, meets the requirement for security general awareness training as long as record keeping requirements are followed.
The Training Module includes interactive test. This will allow industry to more easily utilize our complementary CD to meet the security awareness training requirement.

## In-depth Security Training

**	****Each hazmat employee of a person required to have a security plan must be trained concerning the security plan and its implementation**

- §172.704(a)(5)

**Notes:**
New in-depth security training requirements are as follows:
Each employee of a person required to have a security plan who handles hazardous materials covered by the plan, performs a regulated function related to the hazmat covered by the plan, or is responsible for implementing the plan, must be trained concerning the security plan and its implementation.  

The effective date for this requirement was December 22, 2003. 

## In-depth Security Training Must Include:

**Company security objectives**
**Specific security procedures**
**Employee responsibilities**
**Actions to take in the event ****of a security breach**
**Organizational security structure**

- §172.704(a)(5)

**Notes:**
In-depth security training must include:
Company security objectives,
Specific security procedures,
Employee responsibilities,
Actions to take in the event of a security breach, and
The organizational security structure.

## Other Training

**Training conducted to comply with requirements of other Federal or international agencies may be used to satisfy the requirements in the HMR**

- §172.704(b)

**Notes:**
Training conducted by employers to comply with hazard communication programs required by OSHA or EPA, or to comply with security training programs required by other Federal or international agencies, may be used to satisfy the training requirements in paragraph (a) of section 172.704 to the extent that such training addresses the training components specified in paragraph (a) of the regulation.

## Initial and Recurrent Training

**Initial training - Training must be complete within 90 days after employment or change in job function**
**Recurrent training at least every three years**

- §172.704(c)

**Notes:**
Hazmat employees must receive security awareness training and in-depth security training at least once every three years.
A record of current training, inclusive of the past three years, shall be created and retained by the hazmat employer for each employee for as long as they are employed, and for 90 days thereafter. 
These training and record keeping requirements did not change with HM-232.

## Recordkeeping

**A training record must be kept for each hazmat employee**
**Record must include:**
**Employees name**
**Most recent completion date of training**
**Description, copy, or location of training materials used**
**Name and address of person providing the training**
**Certification of employee training**

- §172.704(d)

**Notes:**
Training records must include:
Employees name,
Most recent completion date of training,
A description, copy, or location of training materials used,
The name and address of the person providing the training, and
Certification of employee training.

## Security Plan Administration Requirements

**Plans must be in writing and retained as long as it remains in effect**
**Copies, or portions of plans, must be available to personnel consistent with their need to know**
**Revised/updated as necessary reflecting changing circumstances**
**When update, all copies must be current as of the date of the latest revision**

- §172.802(b)

**Notes:**
There are specific security plan administration requirements.
The plan must be in writing and retained for as long as it remains in effect,
Security plans must be in place by September 25, 2003,
Copies, or portions of the plan must be available to personnel (consistent with their need to know),
Security plans must be revised and updated as necessary, and
Revised or updated copies must be maintained as of the date of the most recent revision. 

## Overview of Suggestions and Guidance

**Hazmat security planning**
- Four step process
- Performance standards vs. security measures
**Security threat assessment steps**
**Suggested security measures**
**Graduated security planning**
**Example of graduated security planning**
**Security plan check list**

**Notes:**
In this section we’ll take a look at: 
The four steps of  hazardous materials security planning;
We’ll discuss performance standards vs. security measures;
The seven recommended security threat assessment steps;
We will list some suggested security measures specific to the required elements of a security plan:
Personnel security,
Unauthorized access, and
En route security.
We’ll discuss graduated security planning using the Homeland Security Alert System (HSAS) and look at an example of graduated security planning,
And we’ll examine a security plan check list.

## Hazmat Security Planning 

**Four step process:**
**Assess possible security risks **
**Develop *****performance standards***** and identify *****security measures***
**Develop and implement a security plan**
**Administration and training**

**Notes:**
Hazmat security planning can be broken down into four steps:
First, as stated in 172.802 (a), a security plan must include an assessment of possible transportation security threats.
Next, based on the assessment, performance standards should be developed, and appropriate security measures identified. I’ll discuss this further in a moment.
Then, a security plan must be developed and adhered to, addressing the vulnerabilities identified in the security threat assessment. 
Finally, training, and administration of training records, must be carried out in accordance with 172.704. 

## Hazmat Security Planning 

**Performance Standards**
- Courses of action
- Related to threats
- Define desired outcome
**Security Measures**
- Specific actions to achieve performance standards

**Notes:**
Now let’s discuss performance standards verses security measures.
A performance standard is a course of action related to an assessed threat that defines a desired outcome. A security measure is a specific action taken to achieve a performance standard. 
For example, keeping unauthorized individuals from entering a facility is a performance standard. 
Posted guards, surveillance cameras, and upgraded fencing are security measures that address the performance standard.
Bear in mind that in many cases a safety precaution designed to prevent or reduce an accidental spill can also be a security measure. For example, many companies segregate hazmat and keep hazmat locked up. Locking hazmat up is, in fact, a security measure.

## Security Threat Assessment Steps 

**Scoping**
**Knowledge of operations**
**Assessment**
**Strategy**
**Action**
**Verification**
**Evaluation**
- Risk assessment guidance is available on-line at: http://hazmat.dot.gov/riskmgmt/rmsef/rmsef.htm

**Notes:**
The Office of Hazardous Materials Safety developed these seven steps to conduct a security threat assessment; these include:
Scoping,
Knowledge of operations,
Assessment,
Strategy,
Action,
Verification, and
Evaluation

This risk assessment guidance is available on our hazmat safety homepage. The specific link is shown on this slide.

## Step 1. Scoping 

**Determine scope of operations ****that need security risk management**
**Characterize your hazmat transportation operations**
**Identify industry partners**
**Determine vulnerabilities**

**Notes:**
Step one is scoping. Shippers and carriers should determine the scope of their operations that need security threat management.
They should characterize their hazmat transportation operations in terms of types of hazmat handled and modes of transport.
Companies should identify other partners that they interact with during hazmat transportation, such as other shippers or local law enforcement.
And, they should determine where vulnerabilities may be greatest and where security attention is needed most.

## Step 2. Knowledge of Operations 

**Collect detailed information about**
**transportation operations**
**Quantities of materials transported**
**Baseline security programs**
**Current security procedures**
**Related safety programs**

**Notes:**
Step two is knowledge of operations.
A company should collect detailed information about their transportation operations. Some of these details may include:
Quantities of hazardous materials transported,
Baseline security programs – what are they already doing?
Current security procedures – what security procedures are already in place?
And other related safety programs or procedures that enhance security.

## Step 3. Assessment 

**Analyze security threats**
**Assess baseline programs**
**Identify security threat control points**
**Assessment may be based on:**
**Impressions of experienced staff, brainstorming, or surveys**
**Formal, rigorous hazard assessment techniques**

**Notes:**
Step three is the Assessment. 
To conduct an assessment, a company should:
Analyze security threats, using appropriate security threat assessment techniques; 
Assess current baseline security programs – Are they adequate? What else can be done?
Identify security threat control points, such as facility entrances, or en route stops.
Assessments may be based on impressions of experienced staff, brainstorming sessions, or employee surveys. Get your employees involved. They have the knowledge of, and experience with, your hazmat products. Encourage your employees to be part of your security solutions.
And, you should use formal, rigorous threat assessment techniques, like risk matrices, or scoring and ranking systems like the interactive assessment available on the Hazmat Transportation Security Awareness Training CD.

##  Step 3. Assessment (Cont’d)

**“****Assessment of transportation security threats” is *****not***** “risk assessment”**
**Security is different from safety**
** **

**Notes:**
It is important for hazmat transporters to understand that an assessment of transportation security threats is not the same as risk assessment. One of our concerns should be that companies may use risk assessment tools in place of security threat assessments. 
Risk assessments address the potential for accidental release. 
Security threat assessments address the potential for intentional theft or diversion of hazardous materials in transportation. 

## Hazmat Safety vs. Security 

**Similarities**
**Anticipate causes**
**Avoid consequences**
** **
**Differences**
**Accidents can be statistically modeled – Intent is non-linear (not statistical)**
**Frequent small vs. infrequent massive**
**Safety protocols seek to prevent**
**Security measures seek to reduce**

**Notes:**
Hazmat safety or risk assessments are similar to security threat assessments in that they both strive to anticipate causes, and avoid consequences.
The differences are:
Accidents can be statistically modeled, but intent is non-linear or not statistical;
Accidental releases are more frequent and typically small vs. terrorist acts which are typically infrequent, yet massive;
Safety protocols seek to prevent accidental releases; and
Security measures seek to reduce the potential threat of an incident, and to mitigate consequences if an incident occurs.

## Step 4. Strategy

**Rank or group security threats ****(low, medium, or high)**
**Prioritize opportunities for security ****threat reduction**
**Decide on preventative or control actions**
**Create a written document (security plan) summarizing decisions**

**Notes:**
Step four of a Security Threat Assessment is Strategy.
Companies should rank or group the security vulnerabilities they identified in the assessment step, based on low, medium, or high threat;
They should prioritize opportunities for security threat reduction to meet their determined goals;
Next, they should make decisions about what preventative or control actions should be taken; and
Finally, they should create a written document, or security plan, that summarizes their strategic decisions.

## Step 5. Action

**Implement the written plan you develop**
*Step 6. Verification*
**Monitor implementation of your strategy**

**Notes:**
Step five is the action or implementation step. Companies need to put their plans in place.

Step six is verification. This is when companies should monitor and verify that the actions determined by the assessment are carried out.

## Step 7. Evaluation

**Determine if goals are being met**
**Identify relevant performance indicators**
**Compare your strategies and results with others in your field**

**Notes:**
And finally, in step seven, an evaluation should be done to: 
Determine if the goals of the security plan are being met;
Identify relevant performance indicators; and
Compare your strategies and results with others in your field.
An evaluation should be done from time to time to make sure the security plan is keeping pace with external and internal changes like:
Growth of the company,
Expansion of hazmat products, or 
Changes in other businesses in the same geographical area.

## Required Elements of a Security Plan

**Personnel security**
**Unauthorized access**
**En route security**

- §172.802

**Notes:**
Here are some suggested measures companies may want to consider implementing specific to the three required elements of a security plan:
Personnel security,
Unauthorized access, and
En route security.

## Personnel Security

**Verify information provided on employment applications**
**Ensure employees are familiar with security plans**
**Encourage employees to report suspicious incidents or events**
**Implement routine security inspections**
**Meet regularly to discuss security measures and improve awareness**
**Provide information on security issues**
**Provide awareness and in-depth security training**

**Notes:**
For personnel security:
Verify information provided on applications for employment,
Ensure employees are familiar with company security plans,
Encourage employees to report suspicious incidents or events,
Implement routine security inspections,
Meet regularly with staff to discuss security measures and improve awareness,
Provide information to staff on facts, trends, and other security issues, and
Provide awareness and in-depth security training, as required.

## Unauthorized Access

**Partner with local law enforcement and emergency responders**
**Request review of facility **
**Restrict access to facility activities and procedures**
**Add security guards/off-hour patrols as needed**
**Improve fencing and lighting **
**Limit visitor access**
**Require identification badges for staff**

**Notes:**
Suggested measures addressing unauthorized access include:
Partner with local law enforcement and emergency responders,
Request review of facilities by local law enforcement officials,
Restrict access to facility activities and procedures,
Add security guards or off-hour private patrols as needed,
Improve fencing and lighting, 
Limit visitor access,
Require identification badges for staff,
(continued on next slide)

## Unauthorized Access (cont)

**Improve security procedures for pick-up and deliveries**
**Secure hazmat in locked ****	****      buildings or fenced areas **
**Lock vehicles and secure ****	****    containers when stored at ****	****       facilities**
**Use tamper resistant seals and locks**
**Inventory on-site hazmat periodically**
**Keep records of security incidents**
**Report suspicious activities to local FBI ****or local law enforcement**

**Notes:**
Improve security procedures for pick-up and deliveries,
Secure hazmat in locked buildings or fenced areas, 
Lock vehicles and secure containers when stored at facilities,
Use tamper resistant seals and locks,
Inventory on-site hazmat periodically,
Keep records of security incidents, and
Report suspicious activities to your local FBI office or local law enforcement.

## En Route Security

*En Route Security*

**Shippers know your carrier**
**Identify preferred routes ****	****	****     and alternatives**
**Minimize stops**
**If hazmat must be stored         during transportation, ensure storage facility is secure**
**Consider escorts or guards**

**Notes:**
Suggested measures for en route security include:
Shippers know your carrier (verify safety ratings, verify carrier and operator identities, confirm consignee and destination),
Identify preferred routes and alternatives,
Minimize stops, 
If hazmat must be stored during transportation, ensure storage facility is secure,
(continued on next slide)

## En Route Security (cont)

**Consider using ****	****	****    advanced technologies**
**Install tamper-proof ****	****	****  seals on valves and package or container openings**
**Establish communication system**
**Consignees: alert shipper if shipment is late; check carrier’s identity**
**Report suspicious activities to local FBI or local law enforcement**

**Notes:**
Consider escorts or guards, if appropriate,
Consider using advanced technologies like anti-theft devices, or vessel tracking systems,
Install tamper-proof seals on valves and package or container openings,
Establish a communication system with transport vessels and operators,
Consignees: alert shipper if your shipment is not received when expected and check carrier’s identity with shipping documents, and
Report suspicious activities to local FBI office or local law enforcement.

## Graduated Security Planning Using HSAS 

**Specific measures put**
**into place by the plan**
**may vary commensurate**
**with the level of the**
**threat at the time **

- §172.802(a)

**Notes:**
The Department of Homeland Security recommends that security plans be reviewed and modified as the Homeland Security Alert System level changes.
As stated in the HMR, specific measures put into place by the plan may vary with the level of the threat at the time.

## Practical Example of Graduated Security Planning

***HSAS Level******	******Character of Planning***
**Green**** – Low****	****Normal operations**
**	****	****	****Planning and preparation**
**Blue**** – Guarded****	****Normal operations**
**	****	****	****Heightened training**
**	****	****	****Heightened security**
**Yellow**** ****– Elevated****	****Normal operations**
**	****	****	****Heightened communication/awareness**
**	****	****	****Increased security presence**
**Orange**** ****– High****	****Normal service delivery**
**	****	****	****Essential business backup**
**	****	****	****Modified capital and maintenance activity**
**	****	****	****Maximum sustainable security effort**
**Red**** – Severe****	****Redundant management/control**
**	****	****	****Modified services delivery, essential business only**
**	****	****	****Suspended capital and maintenance**
**	****	****	****Maximum surge security effort**

**Notes:**
Here’s a practical example of graduated security planning based on the Homeland Security Alert System:

Green – Low		Maintain normal operations
		Planning and preparation stage– purchase and install			security measures
Blue – Guarded		Maintain normal operations
		Heighten training efforts
		Heighten security efforts
Yellow – Elevated	Maintain normal operations if possible
		Heighten communication and awareness
		Increase security presence
Orange – High		Attempt normal service delivery
		Implement essential business backup plan, if necessary
		Modify capital and maintenance activity
		Maintain maximum sustainable security effort
Red – Severe		Implement redundant management/control
		Modify service delivery
		Maintain essential business only
		Suspend capital and maintenance efforts
		Maintain maximum surge security effort

## Security Plan “Check List”

- Are the “threats” adequately defined?
- Does the security plan address the “threats”?
- Does the security plan define “performance standards”?
- Are the security measures site specific?
- Are the security measures appropriate to the operation, the threats, and the performance standards they are intended to support?
- Are the defined threats, performance standards and their supporting security measures adequate to the operation?

**Notes:**
Here is a check list that can be used to evaluate a hazardous materials transportation security plan:
Are the “threats” adequately defined?
The definition of “threats” should not be a reverse list of previously          installed “risk” protection.
Does the security plan address the “threats”?
Each threat should result in a considered response, even if that response is to do nothing.
Does the security plan define “performance standards”?
Are the expected results adequately described?
Are the security measures site specific?
Are the security measures appropriate to the operation, the threats, and the performance standards they are intended to support?
Are the defined threats, performance standards, and their supporting security measures adequate to the operation?

## Remember... 

**Think prevention**
**A security plan is not an emergency plan – it is supposed to *****reduce the potential, *****as well as mitigate consequences, of a security related incident***** ***
**Most effective measures don’t always involve high-tech or ****high-cost solutions**
**A security plan is not a “silver bullet”**

**Notes:**
Remember:
Think prevention,
A security plan is not an emergency plan – it is supposed to reduce the potential, as well as mitigate consequences of a security related incident, and 
The most effective security measures do not necessarily involve high-tech or high-cost implementations. Sometimes very simple changes in procedures can achieve the same results as a much more costly hardware-based solution.
A security plan is not a “silver bullet”. It won’t be perfect. All we can expect is a good faith effort.

## Informational Resources

*Informational Resources*

- http://hazmat.dot.gov

## How Can You Reach Us?

- Hazardous Materials **INFO-LINE**
**1-800-HMR49-22**
- (1-800-467-4922)
- Hours of Operation:  9 am – 5 pm  EST

- E-mail:  infocntr@dot.gov

- Obtain answers to HMR questions
- Request copies of Federal Register, exemptions (special permits), or training materials
- Report HMR violations
- Fax on Demand

## Slide 42

## Contact Information

**Jack Whitley**
**Transportation Specialist**
**233 Peachtree Street NE**
**Suite 602**
**Atlanta, Georgia 30303**
**(404) 832-1145**
**earl.whitley@dot.gov**

## Slide 44