# DHS Guidance for the Expedited Approval Program

# Table of Contents

Overview

How to Use this Document

Definitions

Section A : General Facility Information

Section B : Detection Measures (RBPS 1, 2, 3, 4, 5, 6, and 7)

Section C : Delay Measures (RBPS 1, 2, 3, 4, 5, 6, and 7)

Section D : Response Measures (RBPS 9, 11, 13, and 14)

Section E : Cyber Security Measures (RBPS 8)

Section F : Security Management Measures (RBPS 7, 10, 11, 12, 15, 16, 17, and 18)

Re sources

Attachment 1 : Certification Under Penalty of Perjury

Attachment 2: Expedited Approval Site Security Plan Example

# Overview

The Department of Homeland Security (DHS or the Department) regulates high

- risk chemical facilities under the Chemical Facility Anti

- Terrorism Standards Program (CFATS), 6 C.F.R.
Part 27. CFATS was created pursuant to Section 550 of the Homeland Security Appropriations Act of 200 7

, P.L 109

- 295

, which gave DHS regulatory authority over security at high

- risk chemical facilities. Under CFATS, facilities that have been finally determined by DHS to be high

- risk are required to develop and implement security plans that meet applicable R isk

- B ased
P erfo rmance S tandards (RBPS).

Congress re

- authorized CFATS in 2014 through t he Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (the Act)

, P.L. 113

- 254 ( 6 U.S.C. § 621, et seq. ) . While the
Act preserves most of the existing CFATS regulations, some aspects of the program are changing as a result of the new law.

One new creation of the Act is a process for high

- risk chemical facilities assigned a final Tier 3 or 4 to receive expedited approval of their S ite S ecurity P lans (SS P)

. The Act directs DHS to issue prescriptive guidance for facilities that choose to submit SSP s as part of the Expedited Approval Program that “identifies specific security measures that are sufficient to meet the risk

based performance standards

. ” See 6 U.S.C § 622(c)(4)(B)(i). This document provides the statutorily required guidance to facilities choosing to file under the E xpedited A pproval P rogram , which includes specific security measures that are sufficient to meet the RBPS the facilities must sati sfy under 6 CFR § 27.230

.

Page 3 of 62

# How to Use this Guidance Document

This guidance document was specifically developed to meet the requirements of 6 U.S.C. 622 (c)(4)(B) and must be used by each chemical facilit y that submit s a n Expedited Approval Program SSP

. Although this guidance discusses security measures specific to the Expedited Approval Program, Tier 3 and 4 chemical facilities can use this do cument to help gain a better understanding of security measures which could be used to meet the RBPS and to help identify and select processes, measures, and activities that they may choose to implement to secure and monitor their facility.

Timelines

In general, facilities assigned a final Tier 3 or 4 may elect to su bmit a security plan pursuant to the Expedited Approval Program using this guidance document. See 6 U.S.C. § 622(c)(4)(A). Facilities assigned a final Tier 3 or 4 prior to December 18, 2014 (the date of enactment of the Act) that choose to submit a SSP and certification under the Expedited Approval Program must submit the security plan not later than November 13, 2015. Facilities that are assigned final Tier 3 or 4 after December 18, 2014 have until Nove mber 13, 2015 , or 120 days after their assignment to Tier 3 or 4, whichever date is later. See 6 U.S.C. § 622(c)(4)(D).

Further, any facility that elects to submit under the new Expedited Approval Program must notify DHS of its intention to do so at leas t 30 days prior to submitting the security plan and certification. See 6 U.S.C. § 622(c)(4)(D)(iii). This notification can be made via the Department’s Chemical Security Assessment Tool ( CSAT ) system or letter sent to:

Director, Infrastructur e Security Compliance Division Offic e of Infrastructure Protection Department of Homeland Security M ail S top 0610 245 Murray Lane Washington, D

. C

. 20528

Risk

- Based Performance Standards (RBPS)

Facilities must identify measures to satisfy each requirement within this guidance document in order to satisfy the entirety of the RBPS (See 6 CFR § 27. 230) . For reference, the RBPS are included below.

RBPS 1: Restrict Area Perimeter. Secure and monitor the perimeter of the facility

.

Page 4 of 62RBPS 2: Secure Site Assets. Secure and monitor restricted areas or potentially critical targets within the facility

.

RBPS 3: Screen and Control Access. Control access to the facility and to restricted areas within the facility by screening and/or inspecting individuals and vehicles as they ent er, including:

(i) Measures to deter the unauthorized introduction of dangerous substances and devices that may facilitate an attack or actions having serious negative consequences for the population surrounding the facility; and

(ii) Measures implementin g a regularly updated identification system that checks the identification of facility personnel and other persons seeking access to the facility and that discourage abuse through established disciplinary measures

.

RBPS 4: Deter, Detect, and Delay. Deter, detect, and delay an attack, creating sufficient time between detection of an attack and the point at which the attack becomes successful, including

measures to:

(i) Deter vehicles from penetrating the facility perimeter, gaining unauthorized access to

res tricted areas or otherwise presenting a hazard to potentially critical targets;

(ii) Deter attacks through visible, professional, well

- maintained security measures and systems, including security personnel, detection systems, barriers and barricades, and h ardened or reduced

- value targets;

(iii) Detect attacks at early stages, through counter

- surveillance, frustration of opportunity to observe potential targets, surveillance and sensing systems, and barriers and barricades; and

(iv) Delay an attack for a su fficient period of time to allow appropriate response through on

site security response, barriers and barricades, hardened targets, and well

- coordinated response planning

.

RBPS 5: Shipping, Receipt, and Storage. Secure and monitor the shipping, receipt, an d storage of hazardous materials for the facility

.

RBPS 6: Theft and Diversion. Deter theft or diversion of potentially dangerous chemicals

.

RBPS 7: Sabotage. Deter insider sabotage

.

RBPS 8: Cyber. Deter cyber sabotage, including by preventing unauthorized on

- site or remote access to critical process controls, such as Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCSs), Process Control Systems (PCSs), Industrial Control Systems (ICSs); critical business s ystems; and other sensitive computerized systems

.

Page 5 of 62RBPS 9: Response. Develop and exercise an emergency plan to respond to security incidents internally and with the assistance of local law enforcement and first responders

.

RBPS 10: Monitoring. Maintain ef fective monitoring, communications, and warning systems, including:

(i) Measures designed to ensure that security systems and equipment are in good working order and inspected, tested, calibrated, and otherwise maintained;

(ii) Measures designed to regular ly test security systems, note deficiencies, correct for detected deficiencies, and record results so that they are available for inspection by the Department; and

(iii) Measures to allow the facility to promptly identify and respond to security system and equipment failures or malfunctions

.

RBPS 11: Training. Ensure proper security training, exercises, and drills of facility personnel

.

RBPS 12: Personnel Surety. Perform appropriate background checks on and ensure appropriate credentials for facility pers onnel, and, as appropriate, for unescorted visitors with access to restricted areas or critical assets, including:

(i) Measures designed to verify and validate identity;

(ii) Measures designed to check criminal history;

(iii) Measures designed to verify a nd validate legal authorization to work; and

(iv) Measures designed to ident ify people with terrorist ties. 1

RBPS 13: Elevated Threats. Escalate the level of protective measures for periods of elevated threat

.

RBPS 14: Specific Threats, Vulnerabilities, or Risks. Address specific threats, vulnerabilities, or risks identified by the Assistant Secretary for the particular facility at issue

.

1 All facilities, in all tiers, must comply with subparts (i), (ii), and (iii) of RBPS 12 (See 6 CFR § 27.230(a)(12)) as part of their SSPs. Facilities will only be required to comply with RBPS 12(iv) after certain other events have occurred, however. Compliance with RBPS 12(iv) will be required for Tiers 1 and 2 upon approval of an Information Collection Request under the Paperwork Reduction Act, and upon notification to facilities by DHS that the CFATS Personnel Surety Program (i.e., the program enabling compliance with RBPS 12(iv)) has been implemented. DHS will seek to implement RBPS 12(iv) for Tiers 3 and 4 after the CFATS Personnel Surety Program has been implemented for Tiers 1 and 2, and will update its Information Collection Request and publish new Paperwork Reduction Act materials prior to implementation for Tiers 3 and 4.

Page 6 of 62RBPS 15: Reporting of Significant Security Incidents. Report significant security incidents to the Department and t o local law enforcement officials

.

RBPS 16: Significant Security Incidents and Suspicious Activities. Identify, investigate, report, and maintain records of significant security incidents and suspicious activities in or near the site

.

RBPS 17: Officials and Organization. Establish official(s) and an organization responsible for security and for compliance with these standards

.

RBPS 18: Records. Maintain appropriate records.

Many RBPS have overlapping requirements and are grouped to most efficiently describe the

requ irements of the CFATS program. This document is organized into overarching security objectives, which collectively account for all of the requirements of the RBPS as described in the below table :

Overarching Security Objectives

Detection Delay Response Cyber Security Security ManagementRisk-Based Performance Standards Restrict Area Perimeter X X

Secure Site Assets X X

Screen and Control Access X X

Deter, Detect, and Delay X X

Shipping, Receipt and Storage X X

Theft and Diversion X X

Sabotage X X X

Cyber X

Response X

Monitoring X

Page 7 of 62Facilities choosing to submit an SSP as part of the Expedited Approval Program must include security measures which cover all RBPS and must review all security objectives to ensure that their p l an meets the requirements of all RBPS.

The programs and processes a facility ultimately chooses to implement to meet the RBPS under the Expedited Approval Program must be described within the SSP devel oped by the facility pursuant to the Act . Facilities utilizing this program must develop their SSP utilizing the guidance herein. 2

Material Deviations

A security plan submitted through the Expedited Approval Program must comply with th e guidance set forth in this document . If a facility chooses a security measure that materially deviates from a measure specified in the guidance, then the facility’s SSP must identify the deviation for the specific security measure and explain how the new measure meets the relevant RBPS. See 6 U.S.C. 622(c)(4)(B)(ii).

2 The Act also permits DHS to develop a template, which a facility could adopt to participate in the EAP by utilizing a template developed by DHS (see 6 U.S.C. §§ 622(c)(4)(A)(ii) & (H)); however, at this time, DHS has not completed the development of any such templates for use as part of thi s program. Therefore, at this time, a facility choosing to participate in the EAP must use this guidance document. Training X X

Personnel Surety X

Elevated Threats X

Specific Threats X

Reporting of Significant Security Incidents X

Significant Security Incidents and Suspicious Activities X

Officials and Organization X

Records X

Page 8 of 62Material deviations are set forth for each specific required security measure throughout this guidance. Specific examples of material deviations are also provided. Pursuant to 6 U.S.C. § 622(c)(4) (B)(ii), a facility must explain how a materially deviating measure accomplishes the security outcome(s) required by the relevant RBPS

. In light of the overlap of the RBPS as explained in the above chart, DHS has identified the relevant portions of the ap plicable RBPS for each measure. For each material deviating measure, a facility must explain how the measure

meet s each of these elements of the RBPS. See Attachment 2 for an example of how to correctly identify a material deviation.

The guidance document also provides examples of deviations that would not be considered material . These are provided in the form of options and in the form of broader language to permit non

- material deviations within the required measures. The security m easures herein are prescriptive, in that a facility must either choose a measure listed or choose to materially deviate; however, DHS believes that there is considerable latitude for non

- material deviations within the required measures. For instance, when a facility chooses a measure to meet the detection requirement in B.1 , it can choose an Intrusion Detection System (IDS), Closed Circuit Television (CCTV) system

, or employees or onsite security personnel to provide detection . Furthermore, as opposed to requiring that a facility use a very specific IDS , DHS simply requires that the IDS have one or more of the following types of sensors: infrared (IR) sensors, microwave sensors, fiber

- optic sensors, buried cable, magnetic switches, balanced magnetic switc hes, volumetric motion sensors, glass

- breakage sensors, and passive IR motion sensors. See B.1.1. This permits a facility to include a multitude of different non

- material deviations in its SSP to address detection, while continuing to comply with the required security measures. A facility is not required to provide a justification for non

- material deviations, because these types of deviations are accounted for within the parameters of the required security measures in the guidance.

Based on the ab ove analysis, D HS considers a deviation outside of the parameters set forth in the required risk

- based performance measures under CFATS to be a material deviation , and therefore, must be identified and include d in the explanation for how the security measu re meets the RBPS (as required by section 622(c)(4)(B)(ii))

. In determining whether a material deviation is sufficient to meet the relevant portions of all applicable RBPS, the material deviation will be evaluated against the security measures required by this guidance.

Planned Measures

The security measures within the Expedited Approval SSP must either be existing security measures or planned measures with a clear timeline for implementation not to exceed twelve (12) months from date of the approval. Se e 6 U.S.C. § 622(c)(4)(C)(v). DHS has identified twelve

Page 9 of 62(12) months as a reasonable time period 3 for planned measures in order to allow for the basic tasks for security system and procedural implementation to include planning and assessment of requirement s ; design and development of proposed solutions ; soliciting bids and identifying/acquiring funding (when required); and installing, testing, and implementing the systems or procedures. This timeframe allows for the appropriate planning and budgeting, whil e also ensuring expedited completion of planned measures. If a facility cannot implement a planned measure within twelve (12) months, that is a material deviation from this guidance and must be identified within the SSP with details justifying why the 12

- month timeframe cannot be met and what timeframe the facility proposes and how the deviation still accomplishes the RBPS. Any item identified as a planned measure must include all relevant details outlining how the planned measure meets the specific guidance.

Other Guidance Requirements

Along with the SSP , the facility must submit a certification, signed under penalty of perjury that meets the requirements of 6 U.S.C. § 622(c)(4)(C). See Attachment 1.

An example of how th is guida nce can be applied to develop an Expedited Approval SSP is included in Attachment 2

. Th at example identifies how f acilities submitting under the Expedited Approval Program may choose to develop their SSP

. Note that in accordance with 6 U.S.C. § 622(c)(4)(G)(ii), if during or after a compliance inspection, the Department of Homeland Security determines that planned or implemented measures in an SSP submitted through the Expedited Approval Program “ar e insufficient to meet the risk

- based performance standards based on a misrepresenta tion, omission, or inadequate description of the site,” DHS may require additional measures or suspend the certification of the facility.

The SSP developed pursuant to this program, as well as certain information exchanged between the facility and DHS staff and/or inspectors during the review process, is considered to constitute Chemical

- terrorism Vulnerability Information (CVI) under the CFATS rule and may be shared only with those who have a need to know and have been certified by DHS as authorized users of CVI ( s ee 6 CFR § 27.400 and 6 U.S.C. § 623 )

.

3 The Act requires facilities submitting under the expedited approval program to implement planned measures within a reasonable time period, which must be stated in the SSP. DHS has identified twelve (12) months as a reasonable time period, which is consistent with the application of the CFATS regulation thus far and is based on best practices and lessons learned in working with the regulated community on the development and implementation of planned measures.

Page 10 of 62

# Definitions

Asset : A ny on

- site or off

- site activities; process(es); systems; subsystems; buildings or infrastructure; rooms; capacities; capabilities; personnel; or response, containment, mitigation, resiliency, or redundancy capabilities that support the storage, handling, processing, monitoring, inventory/shipping, security, and/or safety of the facility’s chemicals, including chemicals o f interest (COI). 4

Asset

- based Security Program : A layered security approach that employs heightened security measures around higher tiered assets.

Certification : A document that is signed under penalty of perjury by the owner or operator of an expedited approval facility and submitted with an Expedited Approval Program SSP that certifies compliance with all of the requirements contained in 6 U.S.C. § 622(c)(4)(C).

C ritical A sset : A n asset whose theft, loss, damage, disruption, or degradation would result in significant adverse impacts to human life or health. 5

Critical Cyber Asset : Cyber systems such as Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCSs), Process Control Systems (PCSs), Industrial Control Sy stems (ICSs); critical business systems; and other sensitive computerized systems that monitor and/or control physical processes that contain a COI; are connected to other systems that manage physical processes that contain a COI; or contain business or personal information that, if exploited, could result in the theft, diversion, or sabotage of a COI. 6

Existing Measure : Security measures that are in place at the time of SSP submission and are assessed by the Department for the purpose of determining whe ther a facility’s SSP satisfies an applicable RBPS.

Operator : A person who has responsibility for the daily operations of a facility or facilities subject to part 27 of title 6 of the Code of Federal Regulations. 7

Owner : A person or entity that owns any facility subject to part 27 of title 6 of the Code of Federal Regulations. 8

4 See Department of Homeland Security, Chemical Facility Anti

- Terrorism Standards Risk

- Based Performance Standards Guidance (May 2009), at 16 , available at http://www.dhs.gov/xlibrary/ass ets/chemsec_cfats_riskbased_performance_standards.pdf
5 See RBPS Guidance Document at 16.

6 See RBPS Guidance Document at 71.

7 See 6 C.F.R § 27.105

Page 11 of 62Planned Measure : Security m easures that are in the process of being implemented by a facility and that can be assessed by the Department for the purpose of determining whether a f acility’s SSP satisfies an applicable RBPS. These may include security measures that are in the design phase, but have an approved and documented capital budget; are in the bid process and have been placed for bid or for which bids have been received and a re under review; are in a pilot phase or in execution as a demonstration project, and for which there is a documented implementation budget and schedule. 9

Restricted Area : A n area where there are special access controls, activity limitations, equipment requirements, or other special, defining measures (usually but not always security measures) employed to prevent unauthorized entry; limit access to specific personnel; or elevate security, safety, or some other characteristic to a higher degree of protect ion. 10

8 See 6 C.F.R § 27.105.
9 See Department of Homeland Security, CFATS Knowledge Center, FAQ 1659 (Jan. 7, 2010), available

at http://csat

- help.dhs.gov.
10 See RBPS Guidance Document at 16.

Page 12 of 62

# Section A : General Facility Information

A facility’s security plan submitted under the Expedited Approval Program must include a section on general facility information in order to provide DHS with an accurate picture of the facility’s general layout and posture. The information required below should also be validated to be consistent with the information currently in CSAT. This section must include basic facility detail to include at a minimum: the facility name, CSAT Facility ID number, ow ner/operator, facility address, and facility latitude and longitude , as further described below

.

A.1 Facility Owner

The facility must list the names of both the owner and operator as define d in this guidance and 6 CFR § 27.105. The facility must also list the Facility Name as listed within CSAT.

A.2 Facility Location

The facility’s address must be its physical location including the street number, street, city, state, and ZIP code. This must include local street and road designations and the address may not include post office box numbers or rural box numbers. The facility must also list its latitude and longitude.

Enter the latitude and longitude of the geographical center of a facility in decimal units with four to six significant digits after the decimal point (e.g., 12.345678). In the Unite d States, latitude is expressed as a positive number, longitude as a negative number. Enter latitude with no sign before it and longitude with a negative sign with no space before the coordinate (e.g.,

- 98.765432). Enter only numeric data.

There are seve ral publicly available tools to help find the latitude and longitude of a facility, such as mapping and aerial photography tools (e.g., Google Earth, TerraServer). To find the geographic center of a facility, use an online map or aerial photography tool a nd select the approximate geographic center as the point of reference for the latitude and longitude. For additional assistance in identifying the latitude and longitude, see Frequently Asked Question 1560 on the CFATS Knowledge Center (http:// csat

- help.d hs.gov )

.

A.3 Facility Type

A brief facility type description must be included. Th e type must describe the primary purpose of the facility, which may be one of the following:

Page 13 of 62Agricultural Chemicals Distribution Agricultural Chemicals Manufacturing Agricultural Products Processing Chemical Distribution Chemical Manufacturing College/University Food Distribution Food Processing Health Care Mineral Extraction/Processing Natural Gas Storage/Transfer Petroleum Products Distribution Petroleum Refining Pharmaceutical Manufacturing Power Generation Propane Distribution Research Waste Management Other

If a facility chooses other, the facility must describe the facility type.

A.4 Facility Co

- Location

If the facility is a co

- located host or tenant, this i nformation and the facility(s) with which the facility share s property must be clearly identified. A facility that is co

- located shares a site with another company’s facility through either a host or tenant agreement. A facility that does not share a sit e with another facility must list that it is a sole tenant or that it is not co

- located.

A.5 Facility Personnel

The general facility information must also include a list of names and/or titles and contact information of facility personnel with security responsibilities, to include, where applicable the Site Security Officer (SSO), Alternate SSO, Corporate Security Officer, Cyber Security Officer, and Corporate Cyber Security Officer.

The number of facility personnel ( broken out for each category of full time, part time, full time contractor, part time contractor, and on

- site security) as well as the work shifts and operational coverage must be detailed within the security plan. A facility that is operational 24/7 or has on

site security 24/7 must clearly identify this coverage. Shift hours must indicate the start time and end time for each group’s shift.

Page 14 of 62A.6 Local First Responders

The facility’s local Fire Department and Local Law Enforcement office, along with any other applicable local first responder s, must be included along with their contact information.

A.7 Chemicals of Interest

Finally, the facility must clearly identify all regulated chemicals of interest (COI) defined in the final tiering letter from DHS and critical assets. For each such COI, the security plan must identify the chemical name, final tier level, security concern/issue (i.e.

, Theft/Diversion, Release

Toxic, Release

- Flammable, Release

- Explosive, and Sabotage/Contamination), portability (i.e.

,
man

- portable, mechanically portab le, bulk storage, or bulk transportation), container type (e.g.

, railcar, cylinder, tote, bag), and whether the facility receives, manufactures, ships and/or sells the COI. Each critical asset must be listed with an asset name and description. The asset description

must include the location of the asset, primary function, COI associated with the asset, and any other information the facility deems necessary to assist DHS in understanding the security posture of the assets.

A.8 Attachments

T he facility must upload a plot plan, facility schematic, or similar attachment demonstrating the location of the COI within the facility along with its security plan. To the best extent possible, this attachment should be to scale and detail all avenues of approach, access points, and barriers at the facility.

Page 15 of 62

# Section B: Detection Measures
(RBPS 1, 2, 3, 4, 5, 6, and 7)

Background on Detection

Detection measures are critical to the satisfaction of many of the RBPS and must be applied with overlapping principles of deterrence, delay, and response. Detection refers to the ability to identify potential attacks or precursors to an attack and to communicate that infor mation, as appropriate. For a protective system to prevail, detection needs to occur prior to an attack (i.e., in the attack

- planning stages) or early enough in the attack where there is sufficient delay between the point of detection and the successful c onclusion of the attack for the arrival of adequate response forces to thwart the attempt. Therefore, detection and delay are inherently linked. The levels of detection that a facility chooses to implement must be based on the levels of delay implemented and vice versa. A facility that has multiple layers of robust delay measures may implement a lower level of detection and still have a successful protection system in place. This must be balanced and described in the SSP and in accordance with the below requirements.

B.1 Detection (RBPS 1, 2, 4 , 6 and 7 ) :

Detection must be accomplished through systems, personnel, or a combination thereof and mu st be located at the critical asset(s), perimeter, or both as further described below. In order to meet the requirement for RBPS for detection

, an Expedited Approval Facility must include in its plan one or more of the following in accordance with the requirements below :

• I ntrusion Detection System (IDS)

• Closed Circuit Television (CCTV) system

• E mployees or onsite security personnel

B.1.1 If a facility utilizes an Intrusion Detection System (IDS), it must:

B.1.1.1 Include one or more of the following types of sensors and deploy in accordance with the manufacturer’s specifications: infrared (IR) sensors, microwave sensors, fiber

- optic sensors, buried cable, magnetic switches, balanced magnetic switches, volumetric motion

s ensors, glass

- breakage sensors, and passive IR motion sensors.

Page 16 of 62o When utilizing exterior sensors such as IR , microwave, fiber

- optic, or buried cable, facilities must take into account weather and terrain to ensure effective deployment of sensors.

o When using IR or passive IR, the IR energy must be focused onto the targeted area for detection.

o When utilizing a magnetic switch or balanced magnetic switch, facilities must mount the mechanism on the door frame or window frame and the actuating magnet on the door or window

.

B.1.1.2 Be activated at all times when another detection method identified within this document (see B.1.2 and B.1.3) is not available

.

B.1.1. 3 C over either all perimeter entry point(s) (doors and windows, as applicable) or all access point(s) l eading to the critical asset(s)

.

B.1.1. 4 Alarm to a responsible and trained individual(s) to initiate a response either through local alarm, central station, auxiliary connection (police or fire), or proprietary station

.

o When a sensor or other IDS component identifies an event of interest, an alarm must notify facility management, security personnel, local law enforcement, or a third party who then must assess the event either directly by sending one or more persons to the locat ion of the event or remotely by alerting personnel to evaluate sensor inputs and surveillance imagery.

o If the facility uses a third party company or facility personnel who dispatch personnel, the IDS must alarm to individuals who are trained to ensure th at appropriate law enforcement or other security responders are dispatched and that a facility point of contact is reached.

B.1.1. 5 Include back

- up power or deploy personnel as described below to provide detection during system outages or failures

.
o If back

- up power is utilized it must:

• Start automatically upon failure of the primary power;

• Be adequate to power the required systems for at least an amount of time (which must be stated in the SSP ) which facility officials believe is sufficient for power to be restored after an outage ;

• Be equipped w ith adequate fuel supply to last for at least the amount of time described in the previous bullet ;

• Be tested to ensure efficiency and effectiveness; and

• Be located in a restricted area for added security.

Page 17 of 62o If the f acility deploys personnel as a compensatory measure for system failures or outages, they must:

• B e deployed immediately upon notification of the outage and in place within one hour of failure/outage notification ;

• Remain in place until the failure or outage is resolved; and

• Be trained and capable to provide detection at all perimeter entry point(s) (doors and windows, as applicable) or all access point(s) leading to the critical asset(s) where system failures have occurred during this time ( s ee B.1.3)

.

If a facility elects to use IDS to satisfy B.1, material deviations from this guidance include any

measure that does not meet the specific requirements contained in B.1.1

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviation ac complishes monitoring of perimeter and critical asset(s) comparable to the requirements in B.1.1 and how the measure accomplishes sufficient security required within the relevant portions of the applicable RBPS , specifically: RBPS 1 (monitor the perimeter)

, RBPS 2 (monitor restricted areas and potentially critical targets )

, RBPS 4 (detect breach of the perimeter /critical assets )

, RBPS 6 (deter theft and diversion through perimeter/ critical asset monitoring ) , and RBPS 7 (deter insider sabotage through perimeter/ critical asset monitoring)

. For example, a measure that compensates for system outages or failures in a manner not described above is a material deviation from
B.1.1.

B.1.2 If a facility utilizes a Closed Circu it Television (CCTV) system, it must:

B.1.2.1 Include the integration of cameras, recorders, switches, keyboards, and monitors.

B.1.2.2 Ensure the capability to detect an object, recognize the type of object, and identify the details of the object and be deployed in accordance with manufacturer’s specifications.

B.1.2.3 Be activated at all times when another detection method (see B.1.1 and B.1.3) is not available

.

B.1.2. 4 C over all perimeter entry point(s) (doors and windows, as applicable)

, all critical asset(s) access point(s), or all critical asset(s) area(s)

.

B.1.2. 5 Have appropriate security lighting ( s ee B.2 .1 )

.

Page 18 of 62B.1.2. 6 Be monitored by a dedicated and trained individual (s) or be equipped with motion detection to alarm to a responsible and traine d individual(s) to initiate a response

.

o When the CCTV system relies on motion detection which alarms to an individual, the video

- processing system must be linked to communicate to the alarm

processing system.

B.1.2. 7 Include back

- up power or deploy perso nnel as described above (see B.1.1) to provide detection during system outages or failures

.

B.1.2. 8 Include information transmission via one of the following methods: metallic video cables, RF transmission, and/or fiber

- optic cable.

If a facility elects to use CCTV to satisfy B.1, material deviations from this guidance include any

measure that does not meet the specific requirements contained in B.1.2. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviation accomplishes the monitoring (perimeter and critical asset(s)) comparable to the requirements in B.1.2 and how the measure accomplishes sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets ), RBPS 4 (detect breach of the perimeter/critical assets), RBPS 6 (deter theft and diversion through perimeter/critical asset monitoring, and RBPS 7 (deter inside r sabotage through perimeter/critical asset monitoring). For example, s uch deviations include i mplementing a compensatory measure for system outages or failures which is not described above.

B.1.3 If the facility utilizes employees or on

- site security personnel, they must:

B.1.3.1 Be capable of providing and trained to provide detection of an intrusion or attempted theft as further described below ; and

B.1.3.2 Be either dedicated to perimeter access point(s), critical asset(s) access point(s), or crit ical asset(s) area(s) or conduct roving patrols of the perimeter or critical asset(s) area(s).

Being capable of providing detection includes having the time, resources, proper security lighting (see B.2.1)

, and viewpoint to provide the detection. Being tr ained to provide detection requires training which must include:

• I dentifying attempts to breach the access point(s) or area(s);

Page 19 of 62• Recognizing suspicious persons or vehicles;

• Identifying degradation to security measures (barriers, locks, etc.),

• Detecting inventory control issues; and

• Reporting (how and to whom) these potential security incidents.

If a facility elects to use employees or security personnel to satisfy B.1, materi al deviations from this guidance include any measure that does not meet the specific requirements in B.1.3.
P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviation accomplishes monitoring (perimeter and critical asset(s)) comparable to the requirements of B.1.3 and how the measure accomplishes sufficient security required within the relevant portions of the applicable RBPS , specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets ), RBPS 4 (detect breach of t he perimeter/critical assets), RBPS 6 (deter theft and diversion through perimeter/critical asset monitoring, and RBPS 7 (deter insider sabotage through perimeter/critical asset monitoring).

B.1.4 Tier 3 and 4 facilities which choose to participate in the Expedited Approval Program must ensure a detection capability which creates sufficient time to allow for a response between the detection of an attack and the point at which the attack becomes succ essful. The point at which an attack becomes successful is closely linked to the type of attack being attempted and the event that is meant to be caused. This is most clearly identified by the facility’s regulated COI and security concern (s) (Theft/Diver sion, Release

, and Sabotage)

.

A Theft/Diversion attack becomes successful when the COI is successfully taken off

- site or diverted either through theft or deception and utilized in a terrorist attack. Therefore, a detection capability for the se facilities must be able to detect the action prior to this success either upon attempt to gain access to the facility, depart with the COI, or utilize the COI in the attack

. Facilities tiered for Theft/Diversion must accomplish detection through any of or a combination of the methods identified above

.

A Release attack becomes successful instantly at the point of the attack and therefore the facility must provide continuous monitoring in order to detect the attempted attack when it becomes imminent. Facilitie s tiered for Release must accomplish detection through any of or a combination of the methods identified above.

A Sabotage attack becomes successful offsite after allowing an on

- site tampering ; therefore, the facility must provide continuous monitoring thr ough any of or a combination of the methods identified above or monitoring via one of the methods identified in B.1.4.3

.

Page 20 of 62B.1.4.1 Facilities tiered for Theft/Diversion must ensure there are gaps in detection no greater than four (4) hours commensurate wit h the level of delay. If a facility is able to

create a robust delay capability ( s ee C.1.1.3 ) , t he facility must ensure that there are gaps in detection no more than eight (8) hours. This ensures that detection is likely to occur prior to the attempt, at the moment of the attempt, or at a minimum of prior to successful utilization of the COI for the attack.

With regard to B.1.4.1, material deviations from this guidance include any m easure that does not meet the specific requirements contained in B.1.4.1. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the monitoring comparable to the requirements in B.1.4.1 and how t he measure accomplishes sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets), RBPS 4 (detect breach of the perimet er/critical assets), and RBPS 6 (deter theft and diversion through perimeter/critical asset monitoring )

. For example, material deviation s from this guid ance include a monitoring capability with gaps greater than eight (8) hours with mitigating factors suc h as added delay.

B.1.4.2 Facilities tiered for Release must ensure continuous monitoring through dedicated sources. This cannot allow for any breaks in detection.

With regard to B.1.4.2, material deviations from this guidance include any measure that does not meet the specific requirements contained in B.1.4. 2 . Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the monitoring comparable to the requirements in B.1. 4.2 and how the measure accomplishes sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets), and RBPS 4 (detect breach of the perimeter/critical assets). For example, materia l deviations from B.1.4.2 include l ess than continuous monitoring capability with mitigating factors such as containment vessels, fire suppression systems, or other process safeguards, and d etection vi a other means than those described above such as via leak detection systems, gas alarm, process alarm, etc.

B.1.4.3 Facilities tiered for Sabotage must perform detection through one or more of the following:

• Continuous monitoring through dedicated source s via one of the methods described above;

Page 21 of 62• 100% screening and inspections for contraband upon entering the facility or critical asset(s) area(s) ( s ee C.3 .3 and C.3.4 ) ; or

• S hipping procedures requiring 100% inspection of shipments and tamper evident devices upon egress (see C.5.8)

.

With regard to B.1. 4.3, material deviation s from this guidance include any measure that does not meet the specific requirements in B.1.4.3. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the monitoring comparable to the requirements in B.1.4.3 and how the measure accomplishes sufficient security required within the relevant po rtions of the applicable RBPS, specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets ), RBPS 4 (detect breach of the perimeter/critical assets), RBPS 6 (deter theft and diversion through perimeter/cr itical asset monitoring, and RBPS 7 (deter insider sabotage through perimeter/critical asset monitoring).

B.2 Security Lighting (RBPS 1, 2, and 4) :
Security lighting can help to both deter attempts at penetrating a facility’s perimeter and assist in the monitoring and detection of any such attempts. Due to the increased likelihood of detection based on appropriate security lighting, maintaining a well

- lit facility perimeter also can help deter adversaries from attempting to breach that perimeter.

B.2.1 F acilit ies must provide and maintain sufficient illumination levels (at a minimum of 5 foot

candles for indoor storage areas and 10 foot

- candles for outdoor storage areas ) to permit individual(s) to perform their duties, provide appropriate surveillance, an d properly utilize all security equipment (e.g.

, CCTV systems).

With regard to B.2.1, material deviations from this guidance include any measure that does not meet the specific requirements in B.2.1

. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes security lighting comparable to the requirements of B.2.1 and how the measure accomplishes sufficient security requ ired within the relevant portions of the applicable RBPS, specifically: RBPS 1 (monitor the perimeter), RBPS 2 (monitor restricted areas and potentially critical targets ), and RBPS 4 (detect breach of the perimeter/critical assets) . For example, material deviation s from B.2.1 include d eploying security lighting in a manner th at is inconsistent with the above.

Page 22 of 62B.3 Inventory Control (RBPS 5 and 6) :

All facilities must have proper inventory management. Proper inventory management includes the following :

B.3.1 Written inventory procedures must be developed . These must require that at least one person be responsible for conducting inventories and outline the roles and responsibilities of individuals charged with conducting inventories . This must also outline the processes for how the facility conducts inve ntory. The procedures must include maintaining records , either in the form of logs, charts, or electronic systems . The records must be capable of demonstrating that the inventories have been conducted and when and by whom.

B.3.2 Facilities must achieve regular and recurring inventories through one of the below:

• P rocess control systems that monit or the level, weight, and/or volume of the COI continuously ; or

• Weekly (at a minimum) COI inventory checks (e.g.

, cycle counts) by an individual charged with maintaining and recording inventory.

With regard to B.3, material deviations from this guidance include any measure that does not meet the specific requirements contained in B.3. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), t his requires an explanation in the SSP of how the deviation accomplishes the inventory comparable to the requirements in B.3 and how the measure accomplishes sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 5 (monitor the shipping of hazardous materials and RBPS 6 ( deter theft and diversion of p otentially dangerous chemicals)

. For example, material deviation s from this guidance include conducting inventory via a method not described above.

Page 23 of 62

# Section C : Delay Me asures (RBPS 1, 2, 3, 4, 5, 6, and 7)

Background on Delay

Delay means physically limiting the accessibility of the facility or critical asset(s) such that there is a low likelihood of an adversary successfully breaching the facility perimeter or critical asset(s) or using the area immediately outside of the facility’s perimeter to launch an attack. Completely adequate perimeter security is rarely achievable through the deployment of a single security barrier; rather an optimal security solutio n typically involves the use of multiple protective measures providing layers of securi ty. For many facilities, their level of risk will be influenced by a finite number of assets contained within the facility. When this occurs, a facility may want to co nsider employing asset

- specific measures (as opposed to facility

- wide measures)

to address the risk associated with the highest risk asset(s) ( s ee CFATS SSP Lessons Learned Tips for Improving Your Submission on the CFATS Knowledge Center, http://csat

help. dhs.gov/ )

. As described in Section A.7, facilities must clearly identify and describe all COI and critical assets in order to justify taking an asset

- based approach versus a facility

- wide approach.

C.1 Human Barriers (RBPS 1, 2, 4, 6 and 7) :

B arriers provide both physical obstacles and psychological deterrents to unauthorized entry, thereby delaying or preventing forced entry.

C.1.1 To achieve appropriate delay measures, facilities must utilize barriers which completely enclose the perimeter or critical asset(s) utilizing walls or security fences. A facility’s SSP must explain how the facility perimeter or critical assets(s) are completely enclosed using fences and /or walls.

C.1.1.1 When choosing to utilize fencing, it must be constructed of chain

- link, barbed wire, or concertina and must be a minimum of seven (7 ) feet high (including topper

, where applicable )

.

Chain

- link fences must be constructed with nine ( 9 ) gauge or heavier wire and have opening s not larger than two ( 2 ) inches per side. The fencing must be stretched and fastened to metal posts and must reach within two ( 2 ) inches of the ground or pavement in order to further delay an intruder crawling under or lifting up the fence

. To protect the fence from washouts or channeling under, culverts or troughs should be provided at natural drainage points. Any such openings larger than 96 square inches must be provided additional physical barriers to limit access.

Page 24 of 62Barbed wire fences must be constructed of 13.5

- gauge twisted double strand wire with four (4) point barbs no more than four (4) inches apart. These must be placed on metal posts no more than six (6) feet apart.

Concertina wire can be used with one roll atop another or in a pyramid with two rolls along the bottom and one roll along the top. Ends must be fastened together and secured to the ground.

C.1.1.2 When utilizing walls as barriers, they must be constructed of brick, cinder block, poured concret e, wood, or metal panel and must be a minimum of seven (7) feet high (including topper, where applicable).

C.1.1.3 Facilities tiered for Theft/Diversion COI may decide to create a more robust delay capability in order to reduce the necessary detection requirement from every four (4 ) hours to every eight (8) hours ( s ee B.1.4.1) . In order to justify a reduced detection capability, facilities must have at least two layer s of barriers enclosing the facility or all critical asset ( s ) , one of which is made of wall s constructed of brick, cinder block, poured concrete, wood, or metal panel.

With regard to C.1.1 , material deviations from this guidance include a ny measure that does not meet the specific requirements contained in C .1.1. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation of how the deviation accomplishes the delay comparable to the requirements of C.1.1 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (secure the perimeter), RBPS 2 (secure restricted areas and potentially critical targets), RBPS 4 (d elay an attack for a sufficient period of time to allow appropriate response ), RBPS 6 (deter theft and diversion through securing perimeter/critical asset, and RBPS 7 ( deter insider sabotage through securing perimeter/critical asset). For example, s uch deviations include i mplementing barriers which do not completely enclose the perimeter or critical asset(s).

C.1.2 All facilities must also utilize locking mechanisms for entry poin ts to all perimeter or all critical asset(s) which must be of one or more types: locksets, deadbolts, magnetic locks, padlocks, cam locks, mortise locks, and/or cylinder locks. A ccess points must remain locked at all times when access point is not in use or manned

. This must take into account mechanisms associated with fire safety.

With regard to C.1.2, material deviation s from this guidance include any measure that does not meet the specific requirements contained in C.1.2

. P ursuant to 6 U.S. C. § 622(c)(4)(B)(ii) , this requires an explanation of how the deviation accomplishes the delay comparable to the requirements of C.1.2 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (secure the perimeter), RBPS

Page 25 of 622 (secure restricted areas and potentially critical targets), RBPS 4 (d elay an attack for a sufficient period of time to allow appropriate response ), RBPS 6 (de ter theft and diversion through securing perimeter/critical asset, and RBPS 7 (deter insider sabotage through securing perimeter/critical asset). For example, s uch deviations include: i mplementing locks which do not cover all entry points to the perimeter or all critical asset(s), and u tilizing a lock not described above.

C.1 .3 If facilities use key s /lock s , combination s, and / or access credential s , they must maintain a key/lock, combination, and/or access credential control and accountability program which ensures keys, locks, combinations

, and access credentials are only issued to authorized individuals, are collected upon termination of employment or change in work status, are periodically inventoried, and are changed when there is a loss or suspicion of compromise or upon termination of employment

. A periodic inventory of keys, combinations

, and/or access controls must be conducted at a minimum of annually.

With regard to C.1.3, material deviations from this guidance include any measure that does not

meet the specific requirements contained in C.1.3. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the delay comparable to the requirements of C.1.3 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 4 (d eter attacks through visible, professional, well

- maintained security measu res and systems and delay an attack to allow time for an appropriate response )

. For example, material deviation s from this guidance include conducting inventory of keys, combinations, and/or access controls at a frequency less than annually.

C.2 Vehicl e Barriers for Release COI (RBPS 1, 2, and 4) :

C.2.1 Fa cilities tiered for Release COI must employ vehicle barriers such as bollards, berms, ditches, revetments , cables, moats, capture nets, and/or jersey barriers at the perimeter or critical asset(s) in order to reduce the likelihood of access ing the facility or critical asset(s) by force or employing a Vehicle

- Borne Improvised Explosive Device (VBIED) in close proximity to a R elease COI. Vehicle barriers must be deployed in accordance with Unified Facilities Criteria (UFC) 4

- 010

- 01 and UFC 4

- 020

- 01 and be included on the DOD Anti

- Ram Vehicle Barrier List

. With regard to C.2

. 1, material deviations from this guidance include a ny measure that does not meet the specific requirements contained in C.2.1. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this

Page 26 of 62requires an explanation within the SSP of how the deviation accomplishes the delay comparable to the requirements of C.2.1 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 1 (secure the perimeter)

, RBPS 2 (secure restricted areas and potentially critical targets) , and RBPS 4 (d eter vehicles from penetrating the facility perimeter, gaining unauthorized access to restricted areas or otherwise presenting a hazard to potentially critical targets ) For example, s uch deviations include d eploying a vehicle barrier in a manner that is inconsistent with the requirements of UFC 4

- 010

- 01 and UFC 4

- 020

- 01

.

C.2.2 Facilities tiered for Release COI must also establish a standoff distance for Release COI assets. Standoff distances must be deployed in accordance with minimu m standoff distances established in UFC 4

- 010

- 01

. Where necessary, standoff distance may be increased to reduce the blast effects on a n asset . The required standoff distances will vary with building components used in the construction.

With regard to C.2 .2, material deviations from this guidance include any measure that does not meet the specific requirements contained in C.2.2. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the delay comparable to the requirements of C.2.2 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 4 (d eter vehicles from penetrating the facility perimeter, gaining unaut horized access to restricted areas or otherwise presenting a hazard to potentially critical targets and d eter attacks through visible, professional, well

- maintained security measures and systems )

. For example, material deviations from the guidance include reduced standoff distance with additional asset hardening, to include additional barriers.

C.3 Access Control (RBPS 3 and 7) :
Through access control measures to include identification, screening, and inspection, a facility is better able to prevent unauthorized access to the facility or its restricted areas and is more likely to deter and detect unauthorized introduction or removal of substances and devices that may cause a dangerous chemical reaction, explosion, or hazardous release. Restricting ac cess to only authorized individuals requires personnel identification. Personnel identification measures help a facility quickly determine whether or not an individual is permitted access to a facility or a restricted area, and certain identification meas ures can help both security officers and other employees quickly know whether or not an individual is authorized for access.

Page 27 of 62C.3.1 Facilities must establish a personnel identification program. This must include validating the identity of all visitors requesting access to the facility or critical asset(s) via government

issued photo identification (ID) card.

Note: Personnel surety requires four types of background ch ecks for unescorted visitors (s ee F.3). The above refers to all visitors regardless of access levels.

To further accomplish personnel identification, facilities must implement one or more of the following for all facility personnel, contractors and visitors.

C.3.1.1 Permitting facility or restricted area access only to those on approved en try lists and c onducting checks of government

- issued photo ID cards to verify that entering employees, contractors or visitors are on the lists.

C.3.1.2 Providing company

- issued , facility

- specific photo IDs , or access credentials to individuals permitted access to the facility or restricted areas of the facility . Photo identifications should identify whether the individuals have access to restricted areas and also should identify whether the individuals are :

o Employees,

o Regular contractors,

o Temporary contractors, or

o Visitors.

Photo ID cards or similar unique identifiers (e.g., key fobs, access, codes) may be linked with electronic access control systems, such as proximity ID readers or swipe

- access controls for an added layer of security. E lectronic access control systems can be tailored to specific locations within a facility, thus providing the ability to limit access to restricted areas to authorized individuals. They also have the additional benefit of maintaining a record regarding who has accessed what areas.

C.3.1.3 Utilizing employee training to recognize and identify facility personnel granted access. Note: This method is only appropriate for a small workforce, 50 personnel per shift or less, where manual personnel identification can be accomplished.

With regard to C.3.1, material deviations from the guidance include a ny measure that does not meet the specific requirements contained in C.3.1. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviat ion accomplishes the access control comparable to the requirements of C.3.1 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 3 (c ontrol access to the facilit y and to restricted areas ) and RBPS 7 (deter insider sabotage through

a ccess controls and screening). For example, s uch deviations include u tilizing a different method

Page 28 of 62of personnel identification rather than company

- issued, facility

- specific photo IDs, or access credential

.

C.3.2 Facilities must restrict access within the perimeter or restricted area(s) to only authorized individuals by one or more of the below means . This includes ensuring individuals are authorized through verifying the completion of ba ckground checks required under F.3.

C.3. 2 .1 A n electronic access control system (ACS). Electronic ACS consist of electronic locks, card readers, biometric readers, alarms (where applicable), and computer systems to monitor and control access. If choosing to implement access control via an ACS, facilities must utilize credential devi ces, coded devices, or biometric devices and must implement them in accordance with manufacturer’s specifications

.

C.3. 2 .2 P hysical locking mechanisms

. Physical locking mechanisms are identified above under C.1.2.

C.3. 2 .3 I mplementation by facility pers onnel (e.g.

, security guards or supervisors) of screening and inspection procedures , as further described in Sections C.3.3 and C.3.4

. With regard to C.3.2, material deviations from the guidance include a ny measure that does not meet the specific requirements contained in C.3.2. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the devia tion accomplishes the access control comparable to the requirements of C.3.2 and how the measu re accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 3 (c ontrol access to the facility and to restricted areas ) and RBPS 7 (deter insider sabotage through access controls and screening).

C.3.3 For Release and Sabotage facilities, i nspection of items brought into the facility or restricted area ( s ) of the facility must be done in one or more of the following ways , focusing on screening for firearms, explosives, or materials which could alter the security of Release and/or S abotage assets :

• Visual inspections, which include the examination of the contents of any item brought into the facility,

• X

- ray inspections,

• Use of metal detectors,

• Use of ionic explosives detection equipment, or

• Use o f trained explosive detection dog team

.

Page 29 of 62With regard to C.3. 3

, material deviation s from the guidance include a measure does not meet the specific requirements contained in C.3. 3

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the S S P of how the deviation accomplishes the access cont rol comparable to the requirements of C.3.3 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 3 (c ontrol access to the facility and to restricted areas ) and RBPS 7 (deter insider sabotage through access controls and screening).

C.3.4 Facilities tiered for Release COI must conduct screening and inspections of vehicles prior to allowing vehicle access to the perimeter and/or Release critical asset(s) in one or more of the following ways , focusing on screening for firearms, explosives, or materials which could alter the security of release assets :

• Visual inspections,

• Use of trained explosive detection dog team,

• Under/over vehicle inspection systems, or

• Cargo inspection systems.

During these inspections, drivers and passengers should remain with vehicles and the individual performing the inspections must conduct a thorough and systematic search of the vehicl es to include the vehicle exterior, interior, trunk , cargo, and other compartments.

With regard to C.3. 4

, material deviations from the guidance include a ny measure that does not meet the specific requirements contained in C.3.4

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the access control comparable to the requirements of C.3.4 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 3 (c ontrol access to the facility and to restricted areas ). For example, material deviations from the guidance include conducting screening or inspections to less than all vehicles prior to allowing access to critical asset(s) or in a manner inconsistent with the above

.

C.4 Receiving Procedures (RBPS 5 and 6):

Facilities which receive COI must :

C.4.1 Plan in advanc e all in

- bound shipments of COI.

Page 30 of 62C.4.2 Ensure COI is being received from a known and prior

- approved shipper.

C.4.3 Inspect trucks , trailers, and rail cars , where applicable, upon entering the facili ty or restricted area(s)

. Incoming trucks, trails, and rail cars to the facility must be inspected. If a cargo or rail car is sealed, the seal must be checked and verified. If the seal has been tampered with or broken, it must be reported . Inspections must be in accordance with vehicle inspections guidance within Section C.3.4

.

C.4.4 Transfer COI from unloading areas to storage or process areas in an expeditious manner in order to ensure the COI is not left unattended in the unloading area

. COI must be attended at all times by a facility employee with authorized access while in unsecured area s. Receiving and unloading procedures must ensure that COI are moved from unloading areas to storage or processing areas without being left unattended.

This includes coordinating effect ive business relationships and having p rocedures for handling the a rrival of an unknown carrier at the facility, including the staging of a vehicle and its driver until both the driver and the load are vetted and approved.

For facilities that do not receive COI, this must be noted in the SSP

. With regard to C.4, material deviations from the guidance include a ny measure that does not meet the specific requirements contained in each of the measures in C.4. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviation accomplishes the security comparable to the requirements of C.4 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 5 ( monitor the receipt of hazardous materials for the facility )

.

C.5 Shipping Procedures (RBPS 5, 6, and 7):

Facilities that ship or sell COI must :

C.5.1 Plan and approve all shipments of COI in advance using known and prior

- approved, carriers.

Page 31 of 62C.5.2 Have procedures or practices to ensure multiple levels of review and validation of all shipments.

C.5.3 Have a Know Your Customer program or similar practice which ensures customers of COI are properly vetted to include verifying a customer’s identity, business location, financial status, and COI end use.

An active, documented “ know your customer” program includes a policy of refusing to sell COI to those who do not meet the pre

- established customer qualification criteria. Examples of such criteria may include:

• Verification that shipping addresses are valid business l ocations,

• Confirmation of financial status,

• Establishment of normal business

- to

- business payment terms and methods (e.g., not allowing cash sales), and

• Verification of product end

- use.

C.5.4 Have a procedure or practice to refuse the sale of COI unless c u stomer s meet customer vetting and identification procedures.

C.5.5 Establish normal business

- to

- business payment terms and methods that prevent cash sales

to customers.

C.5.6 Ensure a ll sales and shipments of COI are documented including, the method of shipment, carrier information, the times and dates of shipments, and the destination. The records must be maintained a minimum of three years.

C.5.7 Utilize tamper

- evident mechanisms to identify tampering with COI prior to and during shipment

.

C.5.8 Inspect trucks , trail er s, and /or rail cars , where applicable, prior to loading and departing.

Page 32 of 62Incoming and outgoing trucks , trails, and rail cars to the facility must be inspected. If a cargo or rail car is sealed, the seal must be checked and verified. If the seal has been tampered with or broken, it must be reported

. Inspections must be in accordance with vehicle inspections guidance within C.3.4

.

C.5.9 Confirm all shipments have arrived at their final destination.

C.5.10 Ensure s ystems are in place to track and protect shipments en route to their destinations, such as driver call

- in schedules, GPS tracking, etc.

Facilities that do not ship or sell COI must document within the SSP that they do not ship or sell the COI.

With regard to C.5, material deviations from this guidance include any measure that does not meet the specific requirements contained in each of the measures in C.5. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the security comparable to the requirements of C.5 and how the measure accomplishes the sufficient security r equired within the relevant portions of the applicable RBPS, specifically: RBPS 5 ( monitor the shipping of hazardous materia ls for the facility ), RBPS 6 (deter the diversion of potentially dangerous chemicals), and RBPS 7 (deter insider sabotage through shipping procedures ).

Page 33 of 62

# Section D : Response Measures (RBPS 9, 11, 13, and 14)

Background on Response

R esponse within this context primarily refers to the response of appropriately trained personnel (either facility personnel or external first responders) to a threat or actual theft or release of COI

. This includes plans to mitigate and/or respond to the c onsequences of a security incident and to report security incidents internally and externally in a timely manner. An appropriate response

must involve not only designated facility emergency response personnel but all facility personnel (including security personnel), as well as local law enforcement and other off

- site emergency responders. Response security measures must address th e identification of the hazards and the equivalent response plans. Response plans must identify the number and capabilities o f the various responders, and the equipping and training of response personnel. Properly equipped personnel

, who understand the potential consequences of a security incident and the need for timely, effective actions, when coupled with well

- rehearsed resp onse plans, reduce the probability of an attack achieving the adversaries’ desired goals . Additionally, p racticed response plans help ensure that on

- site responders and emergency

- response units from local law enforcement, firefighting, ambulance, mutual ai d, and rescue agencies are familiar with the facility and chemicals stored on site and are not impeded from reaching the location of the security event.

D.1 Response Planning (RBPS 9 and 11)

D.1.1 Facilities must have a defined emergency and security response organization in order to respond to site emergencies and security incidents

. Facilities with less than 100 employees may utilize a single security official. Facilities with more than 100 employees must identify t wo or more security officials. Regardless of the size of th e security organization , it must include coordination with local first responders.

With regard to D.1.1, material deviations from this guidance would include a ny measure that does not meet the specific requirements contained in D.1.1. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation in the SSP of how the deviation accomplishes the security comparable to the requirements of D.1.1 and how the measure accompl ishes the sufficient security required within relevant portions of RBPS 9 ( develop an emergency plan to respond to security incidents )

.

Page 34 of 62D.1.2 In order to conduct proper response planning, t he facility must have a crisis management plan

, which includes at a minimum :

• E mergency response procedures ;

• S ecurity response plans; and

• P ost

- incident security plans (post

- terrorist attack, security incident, natural disaster, etc.)

. All three of the above plans and procedures must specifically address the COI, security concern, and associated attack scenarios. Facilities may also choose to include other elements in these plans , such as :

• Contingency plans,

• Continuity of operations plans,

• Notification control and contact requirements, and

• Re

- entry plans.

D.1.2.1 Facilities tiered for Release COI must have additional portions to their crisis management plan

, which include emergency shutdown plans, evacuation plans, re

- entry/recovery plans, and community notification plans , which ensure notification to all community personnel within the impact or affected zone

. With regard to D.1.2, material deviations from this guidance include any measure that does not meet the specific requirements contained in D.1.2. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation meets the security comparable to the requirements of D.1.2 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 9 (develop an emergency plan to respond to security incidents )

.

D.1.3 The facility must have designated individual(s) responsible for executing each portion of the crisis management plan and these individual(s) must be trained to execute all duties

. With regard to D.1.3, material deviations from this guidance include any measure that does not meet the specific requirements contained in D.1.3 . Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the security comparable to the requi rements of D.1.3 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 9 (develop and exercise

an emergency plan to respond to security incidents ) and RBPS 11 (e nsure proper security training, exercises, and drills of facility personnel ). For example, material deviations from this guidance include training only employees within specific areas or functions of the facility.

Page 35 of 62D.1.4 T he facility must have the appropriate resources ( e.g., staff, emergency/response equipment, building space, communications equipment, process controls/safeguards) to execute all response plans. These resources must be identified in the crisis management plan.

Emergency equipment must include all equipment identified within the response plans, which must include at least one of the following :

• A radio system that is redundant and interoperable with law enforcement and emergency response agencies.

• At least one b ackup communications syst em, such as cell phones / desk phones.

• An emergency notification system (e.g., a siren or other facility

- wide alarm system).

• Automated control systems or other process safeguards for all process units to rapidly place critical asset(s) in a safe and stable condition and procedures for their use in an

emergency.

• Emergency safe

- shutdown procedures for all process units.

These plans must be developed along with or shared with local law enforcement and appropriate first responders (see D.1.6)

. With regard to D.1.4, material deviations from this guidance include any measure that does not meet the specific requirements contained in D.1.4. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation meets the comparable security as required within D.1.4 and how the measure accomplishes sufficient security required within relevant portions of RBPS 9 ( develop and exercise an emergency plan to respond to security incidents internally )

. For example, material deviations from this guidance include utilizing outside resources in order to execute response plans.

D.1.5 Facilities must ensure that a ll facility personnel have been trained on all response plans (see F.2) and must exercise these plans on a regular basis and at a mini mum of biennially with employees and others with security responsibilities

. With regard to D.1.5, material deviations from this guidance include any measure that does not meet the specific requirements contained in D.1.5. Pursuant to 6 U.S.C. § 622(c)(4) (B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the comparable training as required within D.1.5 and how the measure accomplishes the sufficient security required within the relevant portions of the applicable RBPS, specifically: RBPS 9 (develop and exercise an emergency plan to respond to security incidents ) and RBPS 11 (e nsure proper security training, exercises, and drills of facility personnel ). For example, material deviations from this guidance include training only employees within specific areas or functions of the facility.

Page 36 of 62D.1.6 In order to ensure that external resources are properly prepared, the facility must have an active outreach program with local first responders ( including, but not limited to, the local Police Department and Fire Department) . The outreach program must include :

• P roviding resp onse and safety documentation to local first responders

,

• P roviding facility l ayout information to local first responders

,

• I nviting local first responders to facility orientation tours,

• N otifying local first responders of the facility’s COI (regulated COI and other chemical holdings identified on Appendix A)

, security concern

, and inclusion in CFATS , and

• M aintaining regular communication (at a minimum of annual) with local first responders

. With regard to D.1.6, material deviations from this guidance include a ny measure that does not meet the specific requirements contained in D.1.6. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements of D.1.6 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 9 ( exercise an emergency plan to respond to security incidents with the assistance of local law enforcement and first responders )

.

D.2 Elevated and Specific Threats (RBPS 13 and 14) :
The ability to escalate the levels of security measures for periods of elevated threat provide a facility with the capacity to increase security measures to better protect against known increased threats or generalized increased threat levels declared by the Federal government. DHS utilizes the National Terrorism Advisory System (NTAS) to communicate information a bout terrorist threats by providing timely, detailed information to the public, government agencies, first responders, airports, and other transportation hubs for the private sector. This system will alert at two different levels, elevated and imminent. Facilities are required to increase their security measures for these levels and when specific threats are identified and reported to them.

D.2.1 Facilities must have a documented process for increasing security measures commensurate to the designated thr eat level during periods of elevated threats tied to the NTAS and when notified by DHS of a specific threat.

D.2.2 The facility must begin to execute security measures for elevated and specific threats within eight ( 8 ) hours of notification.

Page 37 of 62D.2.3 Measu res which should be implemented for elevated or specific threats will depend on the threat and security posture of the facility. At a minimum, facilities must execute the following measures as a result of an elevated or specific threat:

D.2.3.1 Coordinate with f ederal, state, and /or local law enforcement agencies to identify recommended actions and additional security measures

.

D.2.3.2 Increase detection efforts through continuous monitoring of security systems (IDS or CCTV), hourly patrols of the perimeter and/or critical asset area(s), or continuous stationing of personnel at access points and/or critical asset area(s).

D.2.3.3 For Theft/Diversion facilities only, 100% screening and inspections of outbound vehicles or containers c apable of concealing COI

.

D.2.3.4 For Sabotage facilities only, 100% inspection of all outbound shipments.

D.2.3.5 For Release facilities only, 100% screening and inspections of inbound vehicles

. Facilities may choose to implement additional measures

. The follow ing are examples of measures for an elevated threat condition :

• Taking additional security precautions at public events held on

- site and possibly considering alternative venues or even t cancellation;

• Preparing to execute contingency procedures, such as moving to an alternate facility or d ispersing the workforce;

• Assigning emergency response personnel and pre

- positioning and mobilizing specially trained teams or resources;

• Adding additional barriers at vehicle access points and around critical assets and restricted areas to control traffic and increase standoff distances;

• Adding additional illumination for remote areas;

• Decreasing the number of personnel authorized to be on

- site;

• Extending physical protection of vulnerable points;

• Increasing f requency of perimeter patrols;

• Increasing security force allocations;

• Increasing rail car inspections;

• Increasing personnel and vehicle screening inspections;

• Requiring mandatory visitor escorts;

• Minimizing the number of gates in use;

• Instituting off

- site mail handling;

• Instituting parking restrictions;

• Postponing projects and activities where critical assets are more exposed or vulnerable;

Page 3 8 of 62• Instituting real

- time reporting capability between the security control center and the main process control center; a nd

• Reinforcing barriers at remote or unused gates.

The following are examples of measures for imminent threat conditions:

• Increasing or redirecting personnel to address critical emergency needs;

• Decreasing the number of personnel on

- site to “essential” pe rsonnel only;

• Performing constant perimeter patrols;

• Instituting maximum security force staffing;

• Inspecting 100% of rail cars;

• Performing100% personnel

- and vehicle

- screening inspections;

• Prohibiting visitors on

- site ;

• Prohibiting parking on

- site (except f or vehicles that are always kept inside the restricted area);

• Arranging to have in place a secure

, armed

- response capability by making use of any combination of proprietary, contract, local, state, and/or Federal resources where safety at the facility is n ot compromised.

With regard to D.2

, material deviations from this guidance include any measure that does not meet the specific requirements contained in each of the measures in D.2 . Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the security comparable to the requirements of D.2 and how the measure accomplishes the sufficient security required within the relevant p ortions of the applicable RBPS, specifically: RBPS 13 (e scalate the level of protective measures for periods of elevated threat ) and RBPS 14 (a ddress specific threats, vulnerabilities, or risks )

.

Page 39 of 62

# Section E : Cyber Security Measures (RBPS 8)

Background on Cyber Security

In order to meet the intent of RBPS 8, facilities must deter cyber sabotage and minimize the consequences of physical events , including preventing unauthorized access to critical process controls, such as Supervisory Control an d Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Process Control Systems (PCSs), Industrial Control Systems (ICSs), critical business systems, and other sensitive computerized systems. These cyber systems and the network they operate on are often integrated throughout the operations of chemical facilities

. Protecting against adverse cyber events is essential to the management of the overall risk for a facility. Comprehensive cyber security policies, practices and people are required t o protect, prevent, mitigate, respond and recover from adverse cyber events.

E.1 Cyber Security

– General (RBPS 8):

Cyber systems that a facility must consider critical for purposes of this RBPS include, but are not limited to, those that monitor and/or control physical processes that contain a COI; are connected to other systems that manage physical processes that contain a COI; or contain business or

p ersonal information that, if exploited, could result in the theft, diversion, or sabotage of a COI. Specific examples of cyber systems that must be consider ed critical include:

• A control system (including a remotely operated control system) that directly m onitors and/or controls manufacturing or other physical processes that contain COI;

• A business system at the headquarters that manages ordering and/or shipping of a COI;

• A business system (at the facility, headquarters, or outsourced) that contains person ally identifiable information for those individuals who could be exploited to steal, divert, or sabotage a COI;

• An access control or security monitoring system that is connected to other systems;

• Enterprise resource planning systems that conduct critical f unctions in support of chemical processes for COI or a COI supply chain activity;

• E

- mail and fax systems used to transmit sensitive information related to ordering and/or shipping of a COI;

• A noncritical control system on the same network as a critical con trol system;

• A sales system that is connected to the data historian for a critical control system;

• A watchdog system (e.g., Safety Instrumented System (SIS)) for a critical control system; and

• A system hosting critical or sensitive information that, if exp loited, could result in the theft or diversion of a COI or sabotage its processing (e.g., Web site, intranet).

Page 40 of 62When thinking about cyber security as it relates to CFATS, facilities should keep in mind their COI and the specific security issue. The cyber se curity measures described must address how cyber security systems impact the security of the COI and how they are utilized to protect the critical cyber systems from being utilized to caus e a release or divert or steal the COI depending

on the respective s ecurity issues(s).

E.1.1 Within the security plan, the facility must list all critical cyber assets.

The list must include the name of the cyber asset and a brief description, demonstrating how the cyber system may impact the security of the COI.

If a facility does not have any critical cyber systems, this must be stated in the SSP along with a description of how their cyber systems are not critical , as defined above

.

E.1. 2 The facility must develop

, maintain , and implement documented and distributed cyber security policies and procedures including change management policies, as applicable, to their critical cyber assets. Appropriate cyber security policies must cover all aspects of cyber security measures, as applicable to the facility, and must incl ude at a minimum the following topic areas:

• A ccess control,

• P assword management,

• P hysical security to cyber assets and media, and

• I ncident reporting.

Change management is a formal process for directing and controlling alterations to the information processing environment. The objectives of change management are to reduce the risks posed by changes to the information processing environment and improve the stability and reliability of the processing environment. Change management policies must cover a ccount policy mandates, security concerns, business impact, authorization, and oversight. All policies and procedures must be provided to all employees and contractors, as appropriate, who have a potential to impact the security of the critical cyber syst em.

E.1. 3 T he facility must designate a trained and qualified individual(s) to manage cyber security for the facility and to provide direction, accountability, and oversight for cyber security controls

. A trained a nd qualified individual must include having the time, resources, and training in order to carry out the required duties to include at a minimum identifying and protecting cyber assets and information, and detecting, responding to, and recovering from cyber security incidents

. This requires r ecurring training (at a minimum of biennially) on topics which must include:

Page 41 of 62• Access control methods for critical business and control network systems (including remotely operated control system or business systems);

• Personnel security;

• Cyber security controls, monitoring, response, and reporting;

• Disaster recovery and business continuity;

• System development and acquisition; and

• Configuration management and auditing.

E.1. 4 The facility must maintain account access control to critical cyber systems u tilizing the le ast privilege concept (i.e., granting people only as much access as they need to perform their assigned job functions ) and limit access to systems using limited administrator and u ser roles and responsibilities.

E.1. 5 The facility must maintain access control lists and ensure that accounts with access to critical/sensitive information or processes are modified, deleted, or de

- ac tivated immediately when personnel leave and when users no longer require access (e.g., when personnel leave the company, complete a transfer into a new role, or their responsibilities change).

E.1. 6 The facility must implement password management protocols to enforce password
structures, ensure all default passwords have been ch anged (where possible), and implement physical controls for cyber systems where changing default passwords is not technically feasible.

Physical controls to mitigate default passwords include the delay measures listed within C.1 in order to secure the building, room, access panel, or other element through physical security

measures.

E.1. 7 T h e facility must ensure that physical access to critical cyber assets and media is restricted to authorized users and affected individuals (as defined in F.3)

.

E.1. 8 The facility must provide cyber security training to all employees and contractors, as appropriate, who work with critical cyber assets. This includes the development of a cyber security training program, which establishes the types and frequency of traini ng. At a minimum this training must include the following elements o n a bie nn i al basis :

• General company policy review;

Page 42 of 62• Roles and responsibilities;

• Password procedures;

• Acceptable practices / Rules of behavior; and

• Incident reporting procedures.

With regard to E.1. 8

, material deviations from this guidance include any measure that does not meet the specific requirements contained in E.1.8. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the training comparable to the requirements within E.1.8 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage ) . For example, material deviations from this guidance include conducting c yber security training for only a selection of employees or conducting training which is inconsistent with the above.

E.1. 9 The facility must report significant cyber inciden ts to senior management and DHS Industrial Control Systems Cyber Emergency Response Team (ICS

- CERT) ( https://ics

- cert.us

cert.gov/ ) according to reporting timeframes as defined in US

- CERT’s Federal Agency Incident Categories

. Significant cyber incidents are those incidents with maliciou s intent to adversely affect operations of critical cyber assets, including IT equipment used to provide security for the facility, manage processes involving the COI, or manage critical assets of the facility. In order to ensure proper reporting, facilit ies must have a documented process for the identification and reporting of significant cyber incidents and must provide awareness and training to employees to carry out this function.

With regard to E.1

, material deviations from this guidance include any measure that does not meet the specific require ments contained in each of the measures in E.1 . Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes incident reporting comparable to the requirements within E.1 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

E.2 Remote Access (RBPS 8) :

E.2.1 Facilities with remote access to critical cyber systems must define allowable remote access and rules of behavior for issues related to remote access (e.g.

, Internet, Virtual private network (VPN), gateways, routers, firewalls, wireless access points, modems, vendor maintenance connections, Internet Protocol (IP), address ranges). Rules of behavior must be provided to and abided by all employees and contractors with access to the critical cyber systems

. The rules must describe user responsibilities and expected behavior with regard to information system

Page 43 of 62usage (e.g., appr opriate Web sites, conduct of personal business), including remote access activities. Further, user activities for all remote access must be captured through systems logs.

Facilities that do not have remote access must state in the SSP that there is no re mote access.

With regard to E.2

, material deviations from this guidance include any measure that does not meet the specific requirements contained in each of the measures in E.2 . Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the access control comparable to the requirements within E.2 and how the measure accomplishes the sufficient security required within rele vant portions of RBPS 8 ( prevent unauthorized remote access to critical cyber systems )

.

E.3 Control Systems (RBPS 8):

Facilities that have control systems that directly monitor and/or control manufacturing or other physical processes that contain COI must implement the following additional cyber security

measures :

E.3.1 The facility must conduct audits that measure compliance with the cyber security policies, pl ans , and procedures and results must be reported to senior management. Audits must be clearly documented and must occur on a regular and recurring basis and no less than every two years. Audits should identify new requirements for cyber security as well as unnecessary cyber

assets.

With regard to E.3.1, material deviations from this guidance include not conducting audits that meet the requirements in E.3.1. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation meets the security comparable to the requirements within E.3.1 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

E.3.2 The facility must document the busines s need and network/system architecture for all critical cyber assets (systems, applications, services, and external connections)

. No new connections can be established without management authorization and documentation.

With regard to E.3.2, material dev iations from this guidance include measures inconsistent with the requirements in E.3.2. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements wit hin E.3.2 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage ) . For example, such deviations i nclude n ot

Page 44 of 62documenting the business need for all critical cyber assets, n ot documenting the network/system architecture f or all critical cyber assets, and e stablishing connections without management authorization and/or documentation.

E.3.3 Upon identification, t he facility must disable all unnecessary system elements and must identify and e valuate potential vulnerabilities and implement appropriate compensatory security controls

. With regard to E.3.3, material deviations from this guidance include measures inconsistent with the requirements in E.3.3. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii)

, this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements within E.3.3 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage and prevent unauthorized on

- site or remote access to critical cyber systems )

.

E.3.4 The facility must integrate cyber security into the system lifecycle for all critical cyber

assets from system design through procurement, implementation, operation, and disposal

. With regard to E. 3

. 4 , material deviations from this guidance would include measures inconsistent with the requirements in E.3.4

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii)

, this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements of E.3.4 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

E.3.5 The facility must ensure that service providers and other third parties with responsibilities for and access to critical cyber systems have appropriate personnel security procedures/practices in place commensurate with the personnel surety requireme nts for facility employees (reference Section F.3 )

. With regard to E. 3

. 5 , material deviations from this guidance would include personnel security measures inconsistent with requirements in E.3.5

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements of E.3.5 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

E.3.6 The facility must identif y and document s ystems boundaries and implement security controls to limit access across those boundaries.

Page 45 of 62With regard to E.3.6, material deviations from this guidance would include measures inconsistent with the requirements in E .3.6

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation meets the security comparable to the requirements within E.3.6 and how the measure accomplishes the sufficient security required within relevan t portions of RBPS 8 ( deter cyber sabotage and prevent unauthorized on

- site or remote access to critical cyber systems )

.

E.3.7 The facility must monitor the critical networks in real

- time for unauthorized or malicious access and alerts, recognizes and log s events and incidents.

An intr usion detection system (IDS) must be used to monitor networks. An IDS is a system designed to capture network or host traffic, analyze it for known attack patterns, and take specified action when it recognizes an intrusion or attempted intrusion. An IDS can be software or hardware and can be network

- based (i.e., captures and analyzes all network traffic) or host

based (i.e., installed on, and analyzing traffic for, a single device).

With regard to E.3.7, material deviations f rom this guidance include monitoring critical networks via a system which is inconsistent with the requirements in E.3.7

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements within E.3.7 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage and prevent unauthorized on

- site or remote access to critical cyber systems )

.

E.3.8 The facility must have a defined incident response system for cyber incidents. This must include either an individual or computer emergency response function that can be contacted in the event of a cyber emergency and is trained to identify, contain, and resolve a cyber intrusion, denial

- of

- service attack, virus, worm attack, or othe r cyber incident.

With regard to E.3.8, material deviations from this guidance would include measures inconsistent with the requirements in E.3.8

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements of E.3.8 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

E.3.9 The facility must have back

- up power for all critical cybe r systems should an emergency or incident occur

.

Page 46 of 62With regard to E.3.9, material deviations from this guidance include any measure that does not meet the specific requirements contained in E.3.9. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the security com parable to the requirements of E.3.9 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage and prevent unauthorized on

- site or remote access to critical cyber systems )

. For example, mate rial deviations from this guidance include implementing a compensatory measure rather than back

- up power during emergencies or system failures.

E.3.10 The facility must have continuity of operations plans, IT contingency plans, and/or disaster recovery plans.

With regard to E.3.10, material deviations from this guidance would include implementing measures inconsistent with the requirements in E.3.10

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii)

, this requires an explanation within the SSP of how the deviatio n accomplishes the security comparable to the requirements of E.3.10 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 8 ( deter cyber sabotage )

.

Facilities that do not have control systems must state in the SSP that there are no control systems

.

Page 47 of 62

# Section F : Security Management Measures
(RBPS 7, 10

– 12 and 15

- 18)

Background on Security Management

A facility’s security plan cannot be effective without the integration of physical and cyber security measures with procedural security measures. These procedural measures are required to execute all aspects of the security plan. This section covers requ irements for maintenance, training, personnel surety, incident reporting and investigation, security organization and officials, and recordkeeping.

F.1 Maintenance, Inspection and Testing of Security Equipment (RBPS 10):

It is necessary t o maintain reliability of security systems. This includes conducting regular tests, making repairs as required , and installing improvements to the security systems as necessary. Complying with the manufacturers’ instructions and specifications for frequen cy of testing, repair, and replacement schedules increases the likelihood that the physical security equipment will function as it is expected . Facilities must include a ll of the following in their SSP for all appropriate security equipment:

F.1.1 The fac i lity must have written procedures to ensure that all security equipment applicable to the facility ( e.g., IDS, CCTV, ACS, lighting, locking mechanisms, process controls/safeguards ) is maintained in proper working order.

F.1.2 The facility must have identified individual(s) responsible for inspection, testing, and maintenance of security systems. These individuals must be trained and capable of performing all responsibilities.

F.1.3 The facility must maintain all security systems in working order and according to manufacturer’s specifications through daily use, inspections, testing, or a preventative maintenance program.

Page 48 of 62F.1.4 The facility must implement temporary/compensatory measures in the event of security system failures or outages to include deploying back

- up hardware and adding security or operations personnel patrols to affected areas. See additional information on back

- up power and compensatory measures within Section B.

With regard to F.1, material deviations from this guidance would in clude implementing inspections, testing, and maintenance of security systems inconsistent with the requirements contained in each of the measures in F.1

, to include implementing measures without documentation such as procedures and policies

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the inspection, testing, and maintenance comparable to the requirements within F.1 and how the measure accomplishes the sufficient security required w ithin relevant portions of RBPS 10 ( ensure security systems and equipment are in good working order and are inspected, tested, calibrated, and otherwise maintained )

.

F.2 Training (RBPS 11):

By performing proper security training, exercises, and drills, a facility enables its personnel to be better able to identify and respond to suspicious behavior, attempts to enter or attack a facility, or other malevolent acts by insiders or intruders.

F.2.1 Facilities must develop and implement a recurring (at a minimum of biennially) S ecurity
A wareness and T raining P rogram (SATP) for all facility personnel and for contractors with securi ty responsibilities

. F.2.1.1 Training topics must include :

• E mergency procedures,

• C risis management plans,

• S uspicious pe rsons and vehicles, and

• R ecognition and reporting of security incidents.

F.2.1.2 This training must highlight the COI and associated security concern and focus on identifying suspicious activities or security incidents with regard to the security concern.

F.2.1.3 Facilities tiered for Theft/Diversion COI must include within their tra ining identifying suspicious persons attempting to gain access to the perimeter or critical asset(s), suspicious persons attempting to remove COI, methods of concealing COI, suspicious COI orders, etc.

Page 49 of 62F.2.1.4 Facilities tiered for Release COI must inclu de within their training identifying suspicious vehicles, vehicle screening and inspections, and recognizing explosiv e devices.

F.2.2 The SATP must include recurring (at a minimum of biennially) training for senior officials (e.g. Corp orate Security Officer, Site Securi ty Officer, Alternative Site Security Officer, and Cyber Security Officer) on topics which include :

• S ecurity laws and regulations,

• T hreats,

• S ecurity organization, and

• S ecurity duties and responsibilities.

F.2.3 For facilities that employ security personnel, the SATP must include recurring (at a minimum of biennially) training on topics which include :

• E mergency procedures,

• C risis management planning,

• O peration of security equipment, and

• T esting and maintenance of security equipmen t and methods of screening persons and vehicles , where applicable

. With regard to F.2, material deviations from this guidance include measures that do not include a training program that meets the specific measures contained in each of the measures in F.2

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation within the SSP of how the deviation accomplishes the training comparable to the requirements of F.2 and how the measure accomplishes sufficient security required within relevant portions of RBPS 11 ( ensure proper security training of facility personnel ) . For example, such deviations include p roviding training to select but not all facility employees, p roviding training inconsistent with the topics identified above, and p roviding training on a frequency less than biennially.

F.3 Personnel Surety (RBPS 12):

A successful background check program can significantly improve a facility’s capability to deter, detect, and defend against insider threats or covert attacks. Personnel s urety establishes performance standards focused on this critical area and addresses the need for a high

- risk chemical facility to ensure that individuals allowed on

- site have suitable backgrounds for their level of access. See C.3 for further r equirements related to access control and credentials.

Page 50 of 62F.3.1 Facilities must identify and maintain lists of all affected individuals. Affected individuals are defined as :

• facility personnel who have or are seeking access, either unescorted or otherwise, to restricted areas or critical assets; and

• unescorted visitors who have or are seeking access to restricted areas or critical assets.

F acilities can define who facility personnel are for their specific situation. Often the facility includes long

- term contractors as facility personnel and other contractors such as cleaning or maintenance staff as visitors. At a minimum, facilities must identify all on

- site employees as facility personnel.

F.3.2 Facilities must verify and validate the identity of all affected individuals by a government issued ID or identification document as listed on the I

- 9 form prior to granting access to restricted area(s) and critical asset(s)

. Verifying ID includes comparing the picture on the card with the owner, comparing the physical characteristics against the person’s physical appearance, checking for tampering, reviewing both sides of the card, and checking the expiration date. If identity cannot be verified, the individual cannot be granted access to the critical asset(s ).

F.3.3 Facilities must verify and validate the legal authorization to work of all affected individu als by utilizing the I

- 9 process prior to granting access to restricted area(s) and critical asset(s ). For employees who were hired prior to the Immigrat ion Reform and Control Act of 1986 (Public
Law 99

- 603), facilities must verify and maintain evidence of proof of continuous employment since November 7, 1986. If legal authorization to work cannot be verified, the individual cannot be granted access to th e restricted areas or critical asset(s).

F.3.4 Facilities must conduct a criminal history check on all affected individuals through a third party background investigation company, national program, or local law enforcement agency

. This background check must check national, state, and local resources for a timeframe of no fewer th an five years and the report must identify all felonies

, at a minimum.

F.3.5 Facilities must have a process for adjudicating the results of these background checks and determining access restrictions in a reasonable manner

.

Page 51 of 62F.3.6 Upon notification from DHS, facilities must implement a process to identify all affected individuals with terrorist ties. Facilities must comply with th e requirements de scribed in the CFATS Personnel Surety Program implementation notice and must implement one or more of the options allowed under the CFATS Personnel Surety Program for identifying individuals with terrorist ties. 11

F.3.7 Facilities must escort all visitors that do not have all types of background investigations as described above via an approved and trained escort. Individual(s) serving as escorts must have background checks, have been trained on escort procedures, be instructed to and capable of reporting suspicious activities or violations which occur while they are escorting, provide escort either in

- person or via dedicated camera observation and escort no more than five (5) individuals at one time.

F.3.8 Facilities must maintain documentat ion (at a minimum : employee name, how the required check s were conducted, and the results of the check s ) of background checks for all current affected individuals in order to demonstrate compliance with personnel surety requirements 12

. With regard to F.3, material deviations from this guidance include a lack of personnel surety

measures or any program that does not meet the specific measures contained in each of the measures in F.3. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii) , this requires an explanation with in the SSP of how the deviation accomplishes the personnel surety measures comparable to the requirements of F.3 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 12 (verify and validate of identity, legal a uthorization to work, criminal history, and terrorist ties for all affected individuals ) . For example, such deviations include u tilizing a different document or method to verify identity, legal authorization to work and criminal history; c onducting criminal background checks which do not include national,

11 The Department is not yet applying RBPS 12(iv) to Tiers 3 and 4

– see footnote 1 on page 6 of this document for a more detailed discussion of the Department’s plans for implementation of RBPS 12(iv)

. DHS will notify EAP facilities when their obligation to conduct terrorist ties checks for affected individuals begins.

12 Although not protected by the Privacy Act of 1974, facilities are required to protect information under existing laws (as applicable), which provide protections for the information that has been collected by the facility in order to comply with RBPS 12(i

- iii). While under CFATS, no specific controls are required for information collected by high

- risk chemical facilities with regard to RBPS 12(i

- iii), DHS expects that high

- risk chemical facilities will protect and safeguard the information in accordance with any other f ederal, sta te, or local privacy laws that are applicable to the collection of the information, just as they would for other similar information collected under a facility’s normal business practices that is not related to the CFATS Program.

Page 52 of 62state, and local checks or do not report felonies ; c onducting criminal background checks dating back less than five (5) years; n ot providing escorts for visitors with access to restricted areas or critical assets that have not undergone background checks; and p ermitting visual verification of an existing f ederal credential that conducts identity checks, criminal history checks

, or validates the legal authorization to work.

F.4 Incident Reporting and Investigations (RBPS 15 and 16):

F acilities must develop and maintain an incident reporting and investigation program in order to promptly and adequately report all significant security incidents to the appropriate facility personnel , local law enforcement entities, and DHS.

F.4.1 Facilities must have written procedures which define incident reporting and investigation protocols, which include the identification of the types of incidents to report, to whom to report incidents, and the responsibilities of all individuals with reporting and investigation roles.

F.4.2 F acil ities must report the following to facility security personnel, local law enforcement, and DHS (via the National Infrastructure Coordinating Center (NICC) at nicc@dhs.gov or at 202 282 9201 ) 13 :

• unauthorized, successful or unsuccessful breaches of the perimeter ;

• unauthorized, successful or unsuccessful breaches of the critical asset (s) ;

• COI inventory control issues ;

• suspected theft of COI ;

• unauthorized releas e of COI ;

• sabotage or contamination of COI ;

• suspicious orders for COI ; and

• any act of tampering with malicious intent to crit ical physical or cyber asset(s)

. If a significant security incident is detected wh ile in progress, the first call should be to local law enforcement and emergency responders via 911. Similarly, it is recommended that a facility report the incident immediately to local first responders via 911 if the incident has concluded

, but

13 Note that this measure i n no way affects the obligation under the rail transportation security regulations in 49 CFR Part 1580 of a facility defined as a “rail hazardous materials shipper” or a “rail hazardous materials receiver located within an HTUA” (High Threat Urban Area, as defined in 49 CFR § 1580.3) to report significant security concerns to DHS in accordance with 49 CFR § 1580.105. Please contact surfacefrontoffice@tsa.dhs.gov for further information on this regulatory requirement.

Page 53 of 62an immediate emergency response is neces sary. Once the incident has concluded and any immediate resulting emergency has been mitigated , a facility should use a nonemergency number to inform local first responders (if they had not already been contacted) and DHS. Within DHS, incidents must be re ported to the NICC. In addition to the NICC, a facility may wish to contact its local FBI Field Office, whose phone number can be found online at www.fbi.gov/contact/fo/ focities.htm.

F.4.3 F acilities must have a security incident investigation program t o thoroughly investigate all significant security incidents through either internal or third party personnel, who are qualified and trained to perform such investigations

.

F.4.4 F acilities must document “ lessons learned ” from security incidents and incorporate these into employee training programs and policies

. With regard to F.4, material deviations from this guidance include any measure that does not meet the specific requirements contained in each of the measures in F. 4. Pursuant to 6 U.S.C. § 622(c)(4)(B)(ii), this requires an explanation in the SSP of how the deviation accomplishes the reporting measures comparable to the requirements within F.4 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 15 (r eport significant security incidents ) and RBPS 16 ( identif y , investigat e , report , and maintain records of significant security incidents and suspicious activities ) . For example, such deviations include i mplementing reporting and/or investigation programs without written procedures, r eporting security incidents inconsistent with the items listed herein, and n ot documenting lessons learned as part of reporting and ongoing training programs.

F.5 Security Organization ( RBPS 17):

Facilities must identify security official s , as well as the orga nization within the company that is responsible for securi ty and CFATS compliance . The manner in which a facility structures its security organiz ation to meet this specific requireme nt will likely depend on how large or complex a facility or its ownership structure is. A larger, more complex facility is likely to have a more complex organization responsible for complian ce than a smaller facility and also is more likely to employ an individual whose principal job responsibility is facility security , as further described below

.

Page 54 of 62F.5.1 Facilities must define a security organizational structure in writing that identifies specific security duties and responsibilities.

F.5.2 Facilities m ust designate a Site Security Officer (SSO), Alternate SSO, Cyber Security Officer, and, where applicable, a Corporate Security Officer with clear responsibilities and the qualifications and t raining to perform all duties. Individuals serving in these rol es may serve in more than one role; however, the SSO and Alternate SSO should not be the same individual unless the facility employs only one individual. Qualifications for being an SSO (or equivalent)

must include:

• Understanding the security organization of the facility;

• Understanding the requirement to comply with the CFATS RBPSs;

• Experience in emergency preparedness, response, and planning for disasters;

• Familiarity with responsibilities and functions of local, state, and f ederal law enforcement agencies; and

• Ability to recognize characteristics and behavioral patterns of persons who are likely to threaten security.

F.5.3 Individuals within the security organization must be designated to perform all of the following:

• Ensur e all individuals responsible for security perform their duties appropriately.

• Oversee the submission of Top Screens and Security Vulnerability Assessments, and the submission and implementation of SSP s or Alternative Security Programs to DHS.

• Host DHS ins pections.

• Develop, revise, and implement security policies and procedures.

• Develop, plan, and conduct security

- related training.

• Maintain records.

With regard to F. 5 , material deviations from this guidance would include not implementing a security organization or implementing an organization inconsistent with the description s and qualifications identified in each of the measures in F.5

. P ursuant to 6 U.S.C. § 622(c)(4)(B)(ii)

, this requires an explanation within the SSP of how the deviation accomplishes the security comparable to the requirements within F.5 and how the measure accomplishes the sufficient security required within relevant portions of RBPS 17 ( establish officials and an organization responsible for securit y and compliance )

.

Page 55 of 62F.6 Recordkeeping (RBPS 18):

No material deviations are permitted for this RBPS because these recordkeeping provisions are required by the regulation.

F.6.1 Per 6 CFR Part 27.2 55 Recordkeeping requirements, f acilities must create, maintain, protect , store , and make available for inspection by DHS all of the below records and other records related to its security program in order to demonstrate compliance with their security plan

.

F.6.2 The facility must retain security trai ning records, in paper or electronic format, for at least three ( 3 ) years. See 6 CFR § 27.255(a). The training records include the date and location of each training session, time of day and duration of each session, a description of the training, the name and qualifications of the instructor, a legible list of attendees (including each attendee’s sign ature), and the results of any evaluation or testing. See 6 CFR § 27.255(a)(1).

F.6.3 The facility must retain records of drills and exercises, in paper or electronic format, for at least three ( 3 ) years. See 6 CFR § 27.255(a). Such records include, for each drill or exercise, the date held, a description of the drill or exercise, a list of participants, a list of equipment (other than personal equipment) tested or employed in the exercise, the name(s) and qualifications of the exercise director, and any best practices or lessons learned that may improve the SSP

. See 6 CFR § 27.255(a)(2).

F.6.4 The facility must retain records of incidents and breaches of security, in paper or electronic format, for at least three (3) years. See 6 CFR § 27.255(a). Such r ecords include the date and time of occurrence, location within the facility, a description of the incident or breach, the identity of the individual(s) to whom it was reported, and a description of the response. See 6 CFR § 27.255(a)(3).

F.6.5 The facility must retain records of maintenance, calibration, and testing of security equipment, in paper or electronic format, for at least three (3) years. See 6 CFR § 27.255(a). Such records include the date and time, name and qualifications of the tec hnician(s) doing the work, and the specific security equipment involved for each occurrence of maintenance, calibration, and testing. See 6 CFR § 27.255(a)(4).

Page 56 of 62F.6.6 The facility must retain records of security threats, in paper or electronic format, fo r at least three (3) years. See 6 CFR § 27.255(a). Such records include the date and time of occurrence, how the threat was communicated, who received or identified the threat, a description of the threat, to whom it was reported, and a description of the response. See 6 CFR § 27.255(a)(5).

F.6.7 The facility must retain records of audits of the facility’s SSP or Security Vulnerability
Assessment , in paper or electronic format, for at least three (3) years. See 6 CFR § 27.255(a). Such records include, for each audit, a record of the audit, results of the audit, names(s) of the person(s) who conducted the audit, and a letter certified by the covered facility stating the date that the audit was conducted. See 6 CFR § 27.255(a)(6).

F.6.8 The facility must retain all Letters of Authorization and Approval from DHS and documentation identifying the results of audits and inspections conducted pursuant to §27.250, in paper or electronic format, for at least three (3) years. See 6 CFR § 27.255(a)(7).

F.6. 9 The facility must retain records of submitted Top

- Screens, Security Vulnerability Assessments, SSP s/Alternative Security Programs/Expedited Approval Submissions, and all related correspondence with the Department, in paper or electronic format, for at le ast six ( 6 )

years. See 6 CFR § 27.255(b).

Page 57 of 62

# Re sour ces

Business Continuity Guidelines, ASIS International, www.asisonline.org

Department of the Army, “Physical Security”, Army Techniques Publication (ATP) 3

- 39.32, April 2014

Introduction to Security, 8 th Edition , Robert J. Fischer, Edward Halibozek

, and Gion Green, April 2008

N ational Institute of Standards and Technology (N IST ) Special Publication 800

- 53 Revision 4

, Security and Privacy Controls for Federal Information Systems and Organizations , April 2013

Physical Security Manual, ASIS International, www.asisonline.org

Protection of Assets Manual , ASIS International, www.asisonline.org

Risk

- Based Performance Standards Guidance Document, May 2009

The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard, August 2013

Title 29

– Labor, Subtitle B

– Regulations Relating to Labor, Chapter XCII

– Occupational Safety and Health Administration, Department of Labor, Part 1926

– Safety and Health Regulations for Construction

Unified Facilities Criteria 4

- 010

- 01, DOD Minimum Antiterrorism Standards for Buildings, October 2013

Unified Facilities Criteria 4

- 020

- 01, Security Engineering: Facilities Planning Manual, September 2008

Unified Facilities Criteria 4

- 020

- 04FA, Security E ngineering: Electronic Security Systems, March 2005

Unified Facilities Criteria 4

- 022

- 01, Security Engineering: Entry Control Facilities / Access Control Points, May 2005

Page 58 of 62

# Attachment 1 : Certification Under Penalty of Perjury

Facilities choosing to subm it under the Expedited Approval Program must submit a certification, signed under penalty of perjury that meets the requirements of 6 U.S.C. § 622(c)(4)(C) along with the SSP. The following pages provide the certification for facilities to fill out and su bmit via CSAT either as part of or an attachment to the SSP

.

Page 59 of 62

## C ERTIFICATION FOR 

## E XPEDITED 

## A PPROVAL

I am the owner or operator of [ Name of Facility Here ] [ CFATS Facility ID Number H ere]

. I am familiar with the requirements of the Protecting and Securing Chemical Facilities from Terrorist At tacks Act of 2014 (Pub. L. 113

- 254 ) and part 27 of title 6 of the Code of Federal Regulations.
I am familiar with the site security plan being submitted for [ Name of Facility Here ] and certify that:

• The site security p lan includes s ecurity measures that, in combination, appropriately address the security vulnerability assessment and the risk

- based performance standards fo r security for the facility;

• The security measures in the site security plan do not materially deviate from the guidance for expedited approval facilities except where indicated in the site security plan ;

• Any deviations from the guidance for expedited approval facilities in the site security plan meet the risk

- based performance standards for the tie r to which the facility is assigned ;

• The site security plan includes explanations of how it meets the risk

- based performance standards for any material deviation s from the guidance for expedited approval facilities;

• I have visited, examined, documented, and verified that the facility meets the criteria set forth in the site security plan ;

• The facility has implemented all of the required performance measures outlined in the site security plan or set out planned measures that will be implemented within a

re asonable time period stated in the site security plan ;

• Each individual responsible for implementing the site security plan has been made aware of the requirements relevant to the individual’s responsibility contained in the site security plan and has demon str ated competency to carry out tho se requirements ;

• I have committed, or in the case of planned measures will commit, the necessary resources to fully implement the site security plan ; and

• Any planned measures in the site security plan include an adequate procedure for addressing events beyond my control in implementing any planned measures.

Page 60 of 62I certify under penalty of perjury that the foregoing is true and correct.

Executed on

__________________________________ (Date)

Signature

___________________________________

___________________________________ (Print Name and Title)

Page 61 of 62

# Attachment 2: Expedited Approval SSP Example

Note: The e xample includes a CVI coversheet, header, and footer. These are included as examples of properly marking Expedited Approval SSPs. The information contained within the example is fictitious and

, therefore, not CVI.

Page 62 of 62

## CHEMICAL-TERRORISM VULNERABILITY INFORMATION Requirements for Use

NONDISCLOSURE

WARNING: This record contains Chemical-terrorism Vulner ability Information controlled by 6 CFR 27.400. Do not disclose to persons without a “need to know” in accordance with 6 CFR § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or ju dicial proceeding, this information shall be treated as classified information in accordan ce with 6 CFR § 27.400(h) and (i).

By reviewing this cover sheet and accepting the attached CVI you are agreeing to abide by the guidance contained herein. Your acceptance provides i mmediate access only to the attached CVI.Access This information may not be further disclosed except to individuals who meet the following requirements:

• All individuals must be CVI Authorized Users

• All individuals must demonstrate a valid need-to-know for specific CVIHandling Storage : When not in your possession, store in a secure environment such as in a locked desk drawer or locked
container. Do not leave this document unattended

. Transmission : You may transmit CVI by the following means to a CVI Authorized User with a need to know. Hand Delivery : CVI may be hand carried as long as access to the material is controlled while in transit. Email : Encryption should be used. If encryption is not avai lable, send CVI as an encr ypted attachment or password protected attachment and provide the password under separate cover. Whenever the recipient forwards or disseminates CVI via email, place that information in an attachment. Do not send CVI to personal, nonemployment related email accounts. Mail : USPS First Class mail or commercial equivalent. Place in an opaque envelope or container, sufficiently sealed to prevent inadvertent opening and to show evidence of tampering, and then placed in a second envelope that has no marking on it to identify the contents as CVI. Envelope or container must bear the complete name and address of the sender and addressee. The envelope must bear the following statement below the return address:

“ POSTMASTER: DO NOT FORWARD. RETURN TO SENDER .”
Fax : Secure faxes are encouraged, but not required. When sending via non-secure fax, coordinate with the recipient to ensure that the faxed materials will not be left unattended or subjected to unauthorized disclosure on the receiving end. Telephone : Secure Telephone Unit/Equipment are encouraged, but not required. Use cellular or cordless phones to discuss CVI only in exigent circumstances. Do not en gage in a conversation in a public place or in environments that will allow anyone that does not have a need to kn ow to overhear the conversation. Reproduction : Ensure that a copy of this sheet is the first and last page of all reproductions containing CVI. Clear copy machine malfunctions and ensure all paper paths are checke d for CVI. Destroy all unusable pages immediately. Destruction : Destroy (i.e., shred or burn) this CVI document when no longer needed. For laptops or CPUs, delete file and empty recycle bin.SanitizedProducts You may use a CVI document to create a product that is rele ased to the public such as an advisory, alert or warning. In this case, the product must not reveal any information that:

• Exposes vulnerabilities of identifiable critical infrastructure or protected systems of a facility;

• Is proprietary, business-sensitive, or trade secret;

• Relates specifically to the submitting perso n or entity (explicitly or implicitly).DerivativeProducts Mark any newly created document containing CVI with “CHEMICAL-TERRORISM VULNERABILITY INFORMATION” on the top of each page that contains CVI and the distribution limitation statement at 6 CFR § 27.400(f)(3) on the bottom.

Place a copy of this cover page over all documents containing CVI. 

# CHEMICAL-TERRORISM VULNERABILITY INFORMATIONCHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CVI)



# Facility Name:

_________________________

CSAT Facility ID: _____________

Expedited Approval Site Security Plan

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classified information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CVI)

Expedited Approval SSP Organization :

Section A : General Facility Information

Section B : Detection Measures (RBPS 1, 2, 3, 4, 5, 6, and 7)

Section C : Delay Measures (RBPS 1, 2, 3, 4, 5, 6, and 7)

Section D : Response Measures (RBPS 9, 11, 13, and 14)

Section E : Cyber Security Measures (RBPS 8)

Section F : Security Management Measures (RBPS 7, 10, 11, 12, 15, 16, 17, and 18)

Attachments

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classified information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section A : General Facility Information

Facility Information

CSAT Facility ID:

_______________________________ Facility Name:

_______________________________ Owner/Operator:

_______________________________ Facility Address:

_______________________________

_______________________________ Facility Latitude

_______________________________ Facility Longitude:

_______________________________
Facilit y Type/Description:

Co

- Located Facility Information: Yes

____ No

____

Facility Personnel

Site Security Officer (SSO)

_______________________________ (Name and/or Title) :

Phone:

_______________________________
Alternate SSO

_______________________________ (Name and/or Title) :

Phone:

_______________________________ Corporate Security Officer

_______________________________ (Name and/or Title) :

Phone:

_______________________________ WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

Cyber Security Officer

_______________________________ (Name and/or Title) :

Phone:

_______________________________ Corporate Cyber Security Officer

_______________________________ (Name and/or Title) :

Phone:

_______________________________

Number of Facility Personnel:

_______________________________
Full

- Time:

_______________________________
Part

- Time:

_______________________________
Full

- Time Contractor:

_______________________________
Part

- Time Contractor:

_______________________________
On

- Site Security :

_______________________________
Work Shifts:

_______________________________

_______________________________

_______________________________ Operational 24/7 Yes

____ No

____

First Responder Information

Local Fire Department :

_______________________________
Phone:

_______________________________
Local Law Enforcement :

_______________________________
Phone:

_______________________________

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

Chemical Information

COI Tier Security Issue Portable (Y/N) Container Type Receive (Y/N) Manufacture (Y/N) Ship /Sell (Y/N)

Facility Assets

Asset Name:

_______________________________ Asset Description:

Asset Name:

_______________________________ Asset Description:

Asset Name:

_______________________________ Asset Description:

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

Asset Name:

_______________________________ Asset Description:

Facility Attachments

___ The facility verifies that it has uploaded a plot plan or facility schematic as an attachment to this security plan.

Describe other attachments uploaded (e.g. descriptions of deviations to security measures) :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section B: Detection Measures
(RBPS 1, 2, 3, 4, 5, 6, and 7)

B.1 Detection (RBPS 1, 2, 4, 6 and 7)

The facility has a monitoring capability at the perimeter, critical asset(s), or a combination of the two which allows for the identification of the presence of an intrusion in the area(s) containing the critical asset(s), including one or more of the following:

B .1.1

___ Intrusion Detection System (IDS) with the following attributes:

B.1.1.1

___ IDS includes one or more of the following types of sensors and is deploy ed in accordance with the manufacturer’s specifications: infrared (IR) sensors, microwave sensors, fiber

- optic sensors, buried cable, magnetic switches, balanced magnetic switches, volumetric motion sensors, glass

- breakage sensors, and passive IR mot ion sensors.

B.1.1.2

___ IDS is activated at all times when another detection method (see B.1.2 and B.1.3) is not available.

B.1.1.3

___ IDS c over s either all perimeter entry point(s) (doors and windows, as applicable) or all access point(s) leading to the critical asset(s)

.

B.1.1.4

___ IDS alarms to a responsible and trained individual(s) to initiate a response either through local alarm, central station, auxiliary connection (police or fire), or proprietary station.

B.1.1.5

___ IDS i nclude s backup power or personnel are deployed t o provide detection during system outages or failures

.

B.1.2

___ Closed Circuit Television (CCTV) with the following attributes:

B.1.2.1

___ CCTV includes the integration of cameras, recorders, switches, keyboards, and monitors

.

B.1.2.2

___ CCTV ensures the capability to detect an object, recognize the type of object, and identify the details of the object and is deployed in accordance with manufacturer’s specifications.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

B.1.2.3

___ CCTV is activated at all times when another detection method (see B.1.1 and B.1.3) is not available.

B.1.2.4

___ CCTV c over s all perimeter entry point(s) (doors and windows, as applicable)

, all critical asset(s) access point(s), or all critical asset(s) area(s).

B.1.2.5

___ CCTV has appropriate secu rity lighting (see B.2.1).

B.1.2.6

___ CCTV is monitored by a dedicated and trained individual(s) or is equipped with motion detection to alarm to a responsible and trained individual(s) to initiate a response.

B.1.2.7

___ CCTV i nclude s backup power or personnel are deploy ed to provide detection during system outages or failures

.

B.1.2.8

___ CCTV i ncludes information transmission via one of the following methods: metallic video cables, RF transmission, and/or fiber

- optic cable.

B.1.3

___ Facility personnel and/or on

- site security capable and trained to provid e detection of an intrusion are either dedicated to the perimeter or critical asset(s) access point(s) or conduct roving patrols of perimeter or critical asset(s) area(s)

For Theft/Diver s i on Facilities only: The facility has identified their level of delay and included details related to their detection in either B.1.4 or B.1.4.1

.

B.1.4

___ The facility has one layer of delay. Describe how the combination of the above measures ensures that the facility has a monitoring capability with breaks of no more than four (4 ) hours.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

B.1.4 .1

___ The facility has more than one layer of delay, only one of which is a fence. Describe how the combination of the above measures ensures that the facility ha s a monitoring capability with breaks of no more than eight (8) hours.

___ The facility is not regulated for any Theft/Diversion COI.

For Release facilities only:

B.1. 4.2

___ The facility has continuous monitoring through a detection method described above to ensure there are no breaks in detection capability, OR

Describe:

___ The facility is not regulated for any Release COI.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

For Sabotage facilities only:

B. 1.4.3

___ The facility can detect a COI contamination prior to shipment through one or more of the following:

___ Continuous monitoring through dedicated sources via one of the methods described above;

___ 100% screening and inspections for contraband upon entering the facility or critical asset(s) area(s) (See C.3.1 .3 ); or

___ Shipping procedures requiring 100% inspection of shipments and tamper evident devices upon egress (see C.5.8)

.

Describe:

___ The facility is not regulated for any Sabotage COI.

B.2 Security Lighting (RBPS 1, 2, and 4):

B.2.1

___ The facility provides and maintains sufficient illumination levels (at a minimum of 5 foot

- candles for indoor storage areas and 10 foot

- candles for outdoor storage areas) to permit individual(s) to perform their duties

, provide appropriate surveillance , and properly utilize all security equipment (e.g. CCTV systems).

B.3 Inventory Control (RBPS 5 and 6):

B.3.1

___ The facility has written procedures for inventory control , which identify at least one

person as responsible for conducting inventories and outline the roles and responsibilities of individuals charged with conducting inventories. The facility maintains records, either in the form of logs, charts, or electronic system s, which demonstrate that the inventories have been conducted and when and by whom.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

B.3.2

___ The facility either :

___ H as process control systems that monito r the level, weight, volume, or

___ C onducts COI inventory physically through documented inventory checks (e.g. cycle counts) at a minimum of weekly.

Detection Planned Measures

___ The facility does not have existing security measures for one or more of the required items above, but will implement the security measure through a planned measur e no later than twelve (12) months of approval as described below:

Material Deviation

___ The facility has materially deviated from the above detection measures; however, the facility has i ncorporated compensatory measures , which offer comparative security to the requirements in Section B

- Detection and meet the security concerns in the relevant portions of the RBPS as follows :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section C : Delay Measures (RBPS 1, 2, 3, 4, 5, 6, and 7)

C.1 Human Barriers (RBPS 1, 2, 4, 6 and 7):

C.1.1

___ The facility utilizes barriers which completely enclose the perimeter or critical asset(s) utilizing walls or security fences.

C.1.1.1

___ Fences are constructed of chain link, barbed wire, or concertina and are a minimum of seven (7 ) feet high (including topper , where applicable ).

C.1.1.2

___ Walls are constructed of brick, cinder block, poured concrete, wood, or metal panel are a minimum of seven (7) feet high (including topper, where applicable)

.

C.1.1.3

___ The facility has at leas t two layers of barriers enclosing the facility or all critical asset(s), one of which is made of walls constructed of brick, cinder block, poured concrete, wood, or metal panel in order to justify a less frequent level of detection in B.1.4.1.

C.1.2

___ The facility utilizes locking mechanisms for entry points to the perimeter or critical asset(s) which include one or more types: locksets, deadbolts, magnetic locks, padlocks, cam locks, mortise locks, and/or cylinder locks. Access points are locked at al l times when access point is not in use or manned.

C.1.3

___ The facility maintain s a key/lock, combination, and/or access credential control and accountability program which ensures keys, locks, combinations and access credentials are only issued to authorized individuals, are collected upon termination of employment or change in work s tatus, are periodically inventoried, and are changed when there is a loss or suspicion of compromise or upon termination of employment

. A periodic inventory of keys, combinations and/or access controls is conducted at a minimum of annually.

C.2 Vehicle B arriers for Release COI (RBPS 1, 2, and 4):

C.2.1

___ The facility employs vehicle barriers such as bollards, berms, ditches, revetments

, cables, moats, and/or jersey barriers at the perimeter or critical asset(s) in order to reduce the likelihood of access ing the facility or critical asset(s) by force or employing a Vehicle

- Borne Improvised Explosive Device (VBIED) in close proximity to the release COI.

C.2.2

___ The facility establishes a standoff distance for Release COI assets.

___ The facility is not regulated for Release COI.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

C.3 Access Control (RBPS 3 and 7):

C.3.1

___ The facility established a personnel identification program which includes validating the identity of all visitors requesting access to the facility or critical asset(s) via government

issued photo identification (ID) card.

The facility further accomplishes personnel identification through one or more of the following:

C.3.1.1

___ The facility permits access to the facility or restricted area(s) to only those on approved entry lists and conducts checks of government

- issued photo ID cards to verify that enter ing employees, contractors or visitors are on the lists.

C.3.1.2

___ The facility provides company

- issued , facility

- specific photo IDs , or access credentials to individuals permitted access to the facility or restricted areas of the facility

.

C.3.1.3

___ The facility utilizes employee training to recognize and identify facility personnel granted access.

C.3.2

___ The facility restricts access within the perimeter or restricted area (s) to only authorized individuals by one or more of the following means:

C. 3.2 .1

___ A n electronic access control system (ACS)

C. 3.2 .2

___ P hysical locking mechanisms

C. 3.2 .3

___ I mplementation by facility personnel (e.g. security guards or supervisors) of screening and inspection procedures

Describe:

For Release and Sabotage facilities only:

C.3.3

___ The facility conducts an i nspection of items brought into the facility or restricted

area ( s ).

___ The facility is not regulated for any Release or Sabotage COI.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

For Release facilities only:

C.3.4

___ The facility conducts screening and inspections of vehicles prior to allowing access to the perimeter and/or Release critical asset ( s )

.

___ The facility is not regulated for any Release COI.

C. 4 Receiving Procedures (RBPS 5 and 6):

C.4.1

___ The facility pl ans in advance all in

- bound shipments of COI.

C.4.2

___ The facility ensures COI is being received from a known, pre

- approved shipper.

C.4.3

___ The facility inspects trucks , trailers and rail cars

, where applicable, upon entering the facility or restricted area(s)

.

C.4.4

___ The facility transfers COI from unloading areas to storage or process areas in an expeditious manner in order to ensure the COI is not left unattended in the unloading area

.

___ The facility does not receive COI.

C.5 Shipping / Selling Procedures Shipping Procedures (RBPS 5, 6, and 7):

C.5.1

___ The facility plans and approves all shipments of COI in advance using known, pre

approved, carriers.

C.5.2

___ The facility has procedures or practices to ensure multiple levels of review and validation of all shipments.

C.5.3

___ The facility has a Know Your Customer program or similar practice which ensures customers of COI are properly vetted to include verifying a customer’s identity, business location, financial status , and COI end use.

C.5.4

___ The facility has a procedure or practice to refuse the sale of COI unless c ustomer s meet customer vetting and identification procedures.

C.5.5

___ The facility establishes normal business

- to

- business payment terms and methods that prevent cash sales to customers.

C.5.6

___ The facility documents a ll sales and shipments of COI including, the method of shipment, carrier information, the times and dates of shipments, and the destination. The records are maintained a minimum of t hree years.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

C.5.7

___ The facility utilizes tamper

- evident mechanisms to identify tampering with COI prior to and during shipment

.

C.5.8

___ The facility i nspects trucks , trailers, and rail cars, where applicable, prior to loading and departing.

C.5.9

___ The facility confirms all shipments have arrived to their final destination.

C.5.10

___ The facility ensures s ystems are in place to track and protect shipments en route to their destinations, such as driver call

- in schedules, GPS tracking, etc.

Delay Planned Measures

___ The facility does not have existing security measures for one or more of the required items above, but will implement the security measure through a planned measure no later than twelve (12) months of approval as described below:

Material Deviation

___ The facility has materially deviated from the above delay measures; however, the facility has
i ncorporated compensatory measures
, which offer comparative security to the requirements in Section C

- Delay and meet the security conc erns in the relevant portions of the RBPS as follows :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section D : Response Measures (RBPS 9, 11, 13, and 14)

D.1 Response Planning

D.1.1

___ The facility has a defined emergency and security response organization in order to respond to site emergencies and security incidents

.

D.1.2

___ The facility has a crisis management plan which includes emergency response procedures, security response plans, and post

- incident security plans (post

- terrorist attack, security incident, natural disaster, etc.)

. For Release facilities only:

D.1.2.1

___ The facility has additional portions to their crisis management plan, which include emergency shutdown plans, evac uation plans, re

- entry/recovery plans, and community notification plans to account for response to Release COI.

___ The facility is not regulated for Release COI.

D.1.3

___ The facility has designated individual(s) responsible for executing each portion of the crisis management plan and individual(s) have been trained to execute all duties

.

D.1.4

___ The facility has the appropriate resources (staff, emergency/response equipment

, building space, communications equipment, process controls/safeguards, etc.) to execute all

response plans. Emergency equipment includes at least one of the following:

• A radio system that is redundant and interoperable with law enforcement and emergenc y response agencies.

• At least one b ackup communications system, such as cell phones / desk phones.

• An emergency notification system (e.g., a siren or other facility

- wide alarm system).

• Automated control systems or other process safeguards for all process u nits to rapidly place critical asset(s) in a safe and stable condition and procedures for their use in an

emergency.

• Emergency safe

- shutdown procedures for all process units.

D.1.5

___ All facility personnel have been trained on all response plans and response plans are exercised on a regular basis and at a minimum of biennially

.

D.1.6

___ The facility has an active outreach program with local first responders (Police Department and Fire Department) which includes providing response documentation to agencies, providing facility layout information to agencies, inviting agencies to facility

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

orientation tours, notifying agencies of the facility’s COI (regulated COI and other chemical holdings identified on Appendix A) and security concern, and maintai ning regular communication with agencies.

D.2 Elevated and Specific Threats (RBPS 13 and 14):

D.2.1

___ The facility has a documented process for increasing security measures commensurate to the designated threat level during periods of elevated threats tied to the National Terrorism Advisory System (NTAS) and when notified by DHS of a specific threat.

D.2.2

___ The facility will begin to execute security measures for elevated and specific threats within 8 hours of notification.

D.2.3

___ The facility will execute the following measures as a result of an elevated or specific threat:

• Coordinate with Federal, state, and local law enforcement agencies.

• Increase detection efforts through either dedicated monitoring of security systems (IDS or CCTV ), increased patrols of the perimeter and/or asset area(s), or stationing of personnel at access points and/or asset area(s).

• For Theft/Diversion and Sabotage facilities only, increase frequency of outbound screening and inspections.

• For Sabotage facilitie s only, increase monitoring of outbound shipments.

• For Release facilities only, increase frequency of inbound screening and inspections.

Response Planned Measures

___ The facility does not have existing security measures for one or more of the required items above, but will implement the security measure through a planned measure no later than twelve (12) months of approval as described below:

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

Material Deviation

___ The facility has materially deviated from the above response measures; howe ver, the facility has incorporated compensatory measures
, which offer comparative security to the requirements in Section D

- Response and meet the security concerns in the relevant portions of the RBPS as follows :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section E : Cyber Security Measures (RBPS 8)

E.1.1

___ List all critical cyber assets that monitor and/or control physical processes that contain a COI; are connected to other systems that manage physical processes that contain a COI; or contain business or personal information that, if exploited, could result in the theft, diversion, or sabotage of a COI. Provide the name and a brief description of each :

E.1 Cyber Security

– General (RBPS 8):

E.1.2

___ The facility has developed and maintains documented and distributed cyber security policies and procedures including change management policies, as applicable, to their critical cyber assets.

E.1.3

___ The facility has designated a trained and qualified individual(s) to manage cyber security for the facility.

E.1.4

___ Th e facility maintains account access control to critical cyber systems utilizing the least privilege concept and limits access to systems based on administrator and user roles and responsibilities.

E.1.5

___ The facility maintains access control lists, and ensures that accounts with access to critical/sensitive information or processes are modified, deleted, or de

- activated in a timely

manner when personnel leaving under adverse action and when users no longer require

access

.

E.1.6

___ The facility impleme nts password management protocols to ensure all default passwords have been changed (where possible), enforces password structures, and implements physical controls for cyber systems where changing default passwords is not technically feasible.

E.1.7

___ The facility controls physical access to critical cyber assets and media.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

E.1.8

___ The facility provides cyber security training to all employees that work with critical cyber assets.

E.1.9

___ The facility will report significant cyber inciden ts to senior management and DHS Industrial Control Systems Cyber Emergency Response Team (ICS

- CERT)

.

E.2 Remote Access (RBPS 8):

E.2.1

___ The facility defines allowable remote access and rules of behavior (e.g. Internet, Virtual private network (VPN), g ateways, routers, firewalls, wireless access points, modems, vendor maintenance connections, Internet Protocol (IP), address ranges).

___ The facility does not have remote access to critical cyber system(s).

E.3 Control Systems (RBPS 8):

E.3.1

___ The facility conducts audits that measure compliance with the cyber security policies, plans, and procedures and results are reported to senior management.

E.3.2

___ The facility documents the business need and network/system architecture for all cyber

asset s (systems, applications, services, and external connections)

.

E.3.3

___ The facility disables all unnecessary system elements.

E.3.4

___ The facility integrates cyber security into the system lifecycle for all critical cyber

assets.

E.3.5

___ The facil ity ensures that service providers and other third parties with responsibilities for cyber systems have appropriate personnel security procedures/practices in place commensurate with the personnel surety requirements for facility employees.

E.3.6

___ The f acility identifies and document s systems boundaries and implements security controls to limit access across those boundaries.

E.3.7

___ The facility monitors the critical networks in real

- time for unauthorized or malicious access and alerts, recognizes and logs events and incidents.

E.3.8

___ The facility has a defined incident response system for cyber incidents.

E.3.9

___ The facility has backup power for all critical cyber systems.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

E.3.10

___ The facility has continuity of operations plans, IT contingency plans, and/or disaster recovery plans.

___ The facility does not have control systems which impact the security of the COI.

Cyber Secur ity Planned Measures

___ The facility does not have existing security measures for one or more of the required items above, but will implement the security measure through a planned measure no la ter than twelve (12) months of approval as described below:

Material Deviation

___ The facility has materially deviated from the above cyber security measures; howe ver, the facility has incorporated compensatory measures, which offer comparative security to the requirements in Section E

– Cyber Security and meet the security concerns in the relevant portions of the RBPS as follows :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Section F : Security Management Measures
(RBPS 7, 10

– 12 and 15

- 18)

F.1 Maintenance, Inspection and Testing of Security Equipment (RBPS 10):

F.1.1

___ The faci lity has written procedures to ensure all security equipment applicable to the facility (i.e. IDS, CCTV, ACS, lighting, locking mechanisms, process controls/safeguards, etc.) is maintained in proper working order.

F.1.2

___ The facility has identified indi vidual(s) , who are trained and responsible for inspection, testing, and maintenance of security systems.

F.1.3

___ The facility maintains all security systems in working order and according to manufacturer’s specifications through regular use, inspections, testing, or a preventative maintenance program.

F.1.4

___ The facility implements temporary/compensatory measures in the event of security system failures or outages to include deploying backup hardware and adding security or operations person nel patrols to affected areas.

F.2 Training (RBPS 11):

F.2.1

___ The facility develop ed and implement s a recurring (at a minimum of biennially) security awareness and training program (SATP) for all facility personnel and contractors with security responsibilities.

F.2.1.1

___ Tra ining topics include e mergency procedures, c risis management plans,

s uspiciou s persons and vehicles, and r ecognition and reporting of security incidents.

F.2.1.2

___ The training highlights the COI and associated security concern and focus on identifying suspicious activities or security incidents with regard to the security concer n.

For Theft/Diversion facilities only:

F.2.1.3

___ Theft/Diversion training includes suspicious persons attempting to gain access to the perimeter or critical asset(s), suspicious persons attempting to remove COI, methods of concealing COI, suspicious COI orders, etc.

___ The facility is not regulated for Theft/Diversion COI.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

For Release facilities only:

F.2.1.4

___ Release training includes identifying suspicious vehicles, vehicle screening and inspections, and recognizing explosive devices.

___ The fa cility is not regulated for Release COI.

F.2.2

___ The SATP includes training for senior officials such as the Site Security Officer and Corporate Security Officer on topics which include security laws and regulations, threats, security organization, and security duties and responsibilities.

F.2.3

___ For facilities which employ security personnel, the SATP includes training on topics which include emergency procedures, crisis management planning, operation of security equipment, and where applicable, test ing and maintenance of security equipment and methods of screening persons and vehicles.

F.3 Personnel Surety (RBPS 12):

F.3.1

___ The facility has identified all affected individuals as:

• facility personnel who have or are seeking access, either unescort ed or otherwise, to restricted areas or critical assets; and

• unescorted visitors who have or are seeking access to restricted areas or critical assets.

F.3.2

___ The facility verifies and validates the identity of all affected individuals by a government issued ID or identification document as listed on the I

- 9 form prior to granting access to restricted area(s) and critical asset(s)

.

F.3.3

___ The facility v erifies and validates the legal authorization to work of all affected individua ls by utilizing the I

- 9 process or E

- Verify prior to granting access to restricted area(s) and critical asset(s).

F.3.4

___ The facility conducts a criminal history check on all affected individuals through a third party background investigation company, national program, or local law enforcement

agency

. This background check includes national, state, and local resources for a timeframe of no fewer than five years and the r eport identifies all felonies, at a minimum

F.3.5

___ The facility has a process for adjudicating the results of background checks and determining access restrictions in a reasonable manner

.

F.3.6

___ Upon notification from DHS, the facility will implement a p rocess to identify all affected individuals with terrorist ties. The facility will comply with the requirements

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

described in the CFATS Personnel Surety Program implementation notice and will implement one or more of the options allowed under the CFATS Per sonnel Surety Program for identifying individuals with terrorist ties.

F.3.7

___ The facility escorts all visitors which do not have background investigations via an approved and trained escort.

F.3.8

___ The facility maintains documentation (at a minimum: employee name, how the required checks were conducted, and the results of the checks) of background checks for all current affected individuals in order to demonstrate compliance with personnel surety requirements.

F.4 Incident Reporting an d Investigations (RBPS 15 and 16):

F.4.1

___ The facility has written procedures which define incident reporting and investigation protocols, which include the identification of the types of incidents to report, to whom to report incidents, and the responsibilities of all individuals with reporting and investiga tion roles.

F.4.2

___ The facility will report all unauthorized, successful or unsuccessful breaches of the perimeter ; unauthorized, successful or unsuccessful breaches of the critical asset ; COI inventory control issues ; suspected theft of COI ; unauthoriz ed release of COI ; sabotage or contamination of COI ; suspicious orders for COI ; and any act of tampering with malicious intent to critical physical or cyber assets to facility security personnel, local law enforcement

, and DHS (via the National Infrastructure Coordinating Center (NICC) at nicc@dhs.gov or at 202 282 9201 )

.

F.4.3

___ The facility has a security incident investigation program to thoroughly investigate all significant security incidents through either internal or third party personnel, which are qualified and trained to perform all duties

.

F.4.4

___ The facility documents “ lessons learned ” from security incidents and incorporates these into employee training programs.

F.5 Security Organization (RBPS 17):

F.5.1

___ The facility has defined a security organizational structure in writing that identifies specific security duties and responsibilities.

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

F.5.2

___ The facility has designated a Site Security Officer (SSO), Alternate SSO, Cyber Security Officer, and, where appl icable, a Corporate Security Officer with clear responsibilities and the qualifications and training to perform all duties. Qualifications for being an SSO (or equivalent) include:

• Understanding the security organization of the facility;

• Understanding the requirement to comply with the CFATS RBPSs;

• Experience in emergency preparedness, response, and planning for disasters;

• Familiarity with responsibilities and functions of local, state, and Federal law enforcement agencies; and

• Ability to recognize charac teristics and behavioral patterns of persons who are likely to threaten security.

F.5.3

___ Individuals within the security organization have been designated to perform all of the following:

• Ensure all individuals responsible for security perform their dut ies appropriately.

• Oversee the submission of Top Screens, Security Vulnerability Assessments, and Site Security Plans or Alternative Security Programs to DHS.

• Host DHS inspections.

• Develop, revise, and implement security policies and procedures.

• Develop, p lan, and conduct security

- related training.

• Maintain records.

F.6 Recordkeeping (RBPS 18):

F.6.1

___ The facility creates, maintains, protects, stores, and makes available for inspection by DHS certain records related to its security program.

F.6.2

___ The facility retains security training records, in paper or electronic format, for at least 3 years. The training records include the date and location of each training session, time of day and duration of each session, a description of the training, the n ame and qualifications of the instructor, a list of attendees (including each attendee’s signature), and the results of any evaluation or testing.

F.6.3

___ The facility retains records of drills and exercises, in paper or electronic format, for at least three ( 3 ) years. Such records include, for each drill or exercise, the date held, a description of the drill or exercise, a list of participants, a list of equipment (other than personal equipment) tested or employed in the exercise, the name(s) and qualif ications of the

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

exercise director, and any best practices or lessons learned that may improve the Site Security Plan.

F.6.4

___ The facility retains records of incidents and breaches of security, in paper or electronic format, for at least three ( 3 ) years. Such records include the date and time of occurrence, location within the facility, a description of the incident or breach, the identity of the individual(s) to whom it was reported, and a description of the response.

F.6.5

___ The facility retains recor ds of maintenance, calibration, and testing of security equipment, in paper or electronic format, for at least three ( 3 ) years. Such records include the date and time, name and qualifications of the technician(s) doing the work, and the specific security e quipment involved for each occurrence of maintenance, calibration, and testing.

F.6.6

___ The facility retains records of security threats, in paper or electronic format, for at least three ( 3 ) years. Such records include the date and time of occurrence, h ow the threat was communicated, who received or identified the threat, a description of the threat, to whom it was reported, and a description of the response.

F.6.7

___ The facility retains records of audits, in paper or electronic format, for at least th ree ( 3 ) years. Such records include, for each audit, a record of the audit, results of the audit, names(s) of the person(s) who conducted the audit, and a letter certified by the covered facility stating the date that the audit was conducted.

F.6.8

___ Th e facility retains all Letters of Authorization and Approval from DHS and documentation identifying the results of audits and inspections conducted pursuant to §27.250, in paper or electronic format, for at least three ( 3 ) years.

F.6.9

___ The facility retains records of submitted Top

- Screens, Security Vulnerability Assessments, Site Security Plans /Alternative Security Programs/Expedited Approval Submissions , and all related correspondence with the Department, in paper or electronic format, for at least six ( 6 ) years.

Security Management Planned Measures

___ The facility does not have existing security measures for one or more of the required items above, but will implement the security measure through a planned measure no later than twelve (12 ) months of approval as described below:

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)

Material Deviation

___ The facility has materially deviated from the above security management measures; howe ver, the facility has incorporated compensatory measures
, which offer comparative security to the requirements in Section F

– Security Management and meet the security concerns in the relevant portions of the RBPS as follows :

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).CHEMICAL

- TERRORISM VULNERABILITY INFORMATION (CV I)



# Attachments

Facility Plot Plan

Facility Overhead Picture

Asset Area 1 Picture

Asset Area 2 Picture

WARNING: This record constitutes Chemical

- terrorism Vulnerability Information controlled under 6 C.F.R. § 27.400. Do not disclose to persons without a “need to know” in accordance with 6 C.F.R. § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classifie d information in accordance with 6 C.F.R. §§ 27.400(h) and (i).

## CHEMICAL-TERRORISM VULNERABILITY INFORMATION Requirements for Use

NONDISCLOSURE

WARNING: This record contains Chemical-terrorism Vulner ability Information controlled by 6 CFR 27.400. Do not disclose to persons without a “need to know” in accordance with 6 CFR § 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or ju dicial proceeding, this information shall be treated as classified information in accordan ce with 6 CFR § 27.400(h) and (i).

By reviewing this cover sheet and accepting the attached CVI you are agreeing to abide by the guidance contained herein. Your acceptance provides i mmediate access only to the attached CVI.Access This information may not be further disclosed except to individuals who meet the following requirements:

• All individuals must be CVI Authorized Users

• All individuals must demonstrate a valid need-to-know for specific CVIHandling Storage : When not in your possession, store in a secure environment such as in a locked desk drawer or locked
container. Do not leave this document unattended

. Transmission : You may transmit CVI by the following means to a CVI Authorized User with a need to know. Hand Delivery : CVI may be hand carried as long as access to the material is controlled while in transit. Email : Encryption should be used. If encryption is not avai lable, send CVI as an encr ypted attachment or password protected attachment and provide the password under separate cover. Whenever the recipient forwards or disseminates CVI via email, place that information in an attachment. Do not send CVI to personal, nonemployment related email accounts. Mail : USPS First Class mail or commercial equivalent. Place in an opaque envelope or container, sufficiently sealed to prevent inadvertent opening and to show evidence of tampering, and then placed in a second envelope that has no marking on it to identify the contents as CVI. Envelope or container must bear the complete name and address of the sender and addressee. The envelope must bear the following statement below the return address:

“ POSTMASTER: DO NOT FORWARD. RETURN TO SENDER .”
Fax : Secure faxes are encouraged, but not required. When sending via non-secure fax, coordinate with the recipient to ensure that the faxed materials will not be left unattended or subjected to unauthorized disclosure on the receiving end. Telephone : Secure Telephone Unit/Equipment are encouraged, but not required. Use cellular or cordless phones to discuss CVI only in exigent circumstances. Do not en gage in a conversation in a public place or in environments that will allow anyone that does not have a need to kn ow to overhear the conversation. Reproduction : Ensure that a copy of this sheet is the first and last page of all reproductions containing CVI. Clear copy machine malfunctions and ensure all paper paths are checke d for CVI. Destroy all unusable pages immediately. Destruction : Destroy (i.e., shred or burn) this CVI document when no longer needed. For laptops or CPUs, delete file and empty recycle bin.SanitizedProducts You may use a CVI document to create a product that is rele ased to the public such as an advisory, alert or warning. In this case, the product must not reveal any information that:

• Exposes vulnerabilities of identifiable critical infrastructure or protected systems of a facility;

• Is proprietary, business-sensitive, or trade secret;

• Relates specifically to the submitting perso n or entity (explicitly or implicitly).DerivativeProducts Mark any newly created document containing CVI with “CHEMICAL-TERRORISM VULNERABILITY INFORMATION” on the top of each page that contains CVI and the distribution limitation statement at 6 CFR § 27.400(f)(3) on the bottom.

Place a copy of this cover page over all documents containing CVI. 

# CHEMICAL-TERRORISM VULNERABILITY INFORMATION