TSA Releases Revised Pipeline Security Guidelines

The Transportation Security Administration (TSA) has released revised Pipeline Security Guidelines. The Guidelines were developed through a public-private partnership that included among others, industry and government members of the Pipeline Sector and Government Coordinating Councils as well as industry association representatives.

The Guidelines also include a HSAS Threat Level Protective Measures Supplement that contains “…a series of progressive security measures to reduce vulnerabilities to pipeline systems and facilities during periods of heightened threat conditions….” Though the Guidelines and Supplement supersede the 2002 DOT Pipeline Security Guidelines, note that both documents are merely guidance and do not impose any mandatory requirements.

DOD and Army To Use TWIC for Authentication

This week the Department of Defense (DOD) issued a brief notice announcing that as of October 1, 2011, it will require all commercial users of its transportation systems and applications to use a commercial PKI certificate or a Transportation Worker Identification Credential (TWIC) to access those systems and applications.

This initiative to enhance customer identification security and provide a stronger and more secure authentication process for accessing DOD information systems is the first instance in which TWICs will be utilized beyond their intended purpose—to gain unescorted access to Maritime Transportation Security Act (MTSA)-regulated facilities.

Congress Passes Food Safety Act

This week Congress passed the Food Safety and Modernization Act, representing the first major overhaul of the U.S. food safety system in over 70 years. In addition to various safety considerations, the bill also directs the FDA to “…promulgate regulations to protect against the intentional adulteration of food….” (emphasis added). These regulations will, among other things, “…specify appropriate science-based mitigation strategies or measures to prepare and protect the food supply chain at specific vulnerable points….” The bill will not likely be signed into law until President Obama returns in early January 2011.

H.R. 3082 Extends CFATS Through March 4, 2011

On Tuesday December 31, 2010, Congress passed H.R. 3082, amending the Continuing Resolution passed in September and thereby extending the authority for CFATS until March 4, 2011.

DHS Issues Helpful Tips for Completing a CFATS SSP

On December 10, 2010, DHS issued a new guidance document entitled “Helpful Tips for Completing a Chemical Facility Anti-Terrorism Standards (CFATS) Site Security Plan.” The tips are based on DHS’s experience with reviewing submitted SSPs, conducting pre-authorization inspections, and the general feedback and questions it has received from the regulated community.

The document specifically addresses five areas where DHS believes additional clarity would benefit the development of a SSP:

1. Appropriate Level of Detail
2. Identifying Specific “Assets” and “Systems”
3. Security Measures Appropriate to Specified Risk Levels
4. Facility-Wide v. Asset-Specific Security Measures
5. Year-Round View

DHS notes that it recognizes the SSP process is a considerable undertaking that requires a coordinated effort to develop and accurately complete. It suggests that facilities allocate sufficient resources and time for their “SSP planners, preparers, and submitters to thoroughly evaluate the processes and operations at the facility so that they can adequately answer the SSP questions….”

H.J. Res. 101 Extends CFATS Through December 18, 2010

On December 2, 2010, Congress passed H.J. Res. 101, which will provide discretionary funding for government operations at FY 2010 levels through December 18, 2010. As part of H.J. Res. 1010, the CFATS program is again temporarily extended in its current form until December 18, 2010. It is expected that Congress will pass another—likely longer (e.g., 1 year)—CFATS extension before the new December 18, 2010 expiration date.

Weekly CSAT-SSP Webinars

DHS is now holding weekly CSAT-SSP Webinars for any CFATS facility with a pending SSP. The webinar consists of a detailed briefing on the SSP tool functions, questions, and considerations. Webinars are held each Wednesday from 11:00 AM to 1:00 PM EST and 2:00 PM to 4:00 PM EST. A facility may register up to five persons to participate in one or more of the weekly webinars.

To register for the webinar, you must submit an email to cfatsssp@absconsulting.com with the following information:

• Name;
• Position;
• Company Name;
• Facility Name;
• Facility Number;
• SSP Due Date;
• Number of Participants;
• Names of Participants; and
• Session Preference (morning or afternoon).

Reservations are made on a first-come first-serve basis. A facility representative may participate in more than one webinar, but in the event a webinar is fully booked, preference is given to facilities within 30 days of a SSP due date followed by those facility representatives that have not previously participated in a SSP Webinar.

Temporary CFATS Extension

On September 29, 2010, Congress passed a stopgap spending bill (H.R. 3081) that ensures the federal government has funding to continue operating through 2010 until Congress returns from recess following the midterm elections. As part of the bill, the CFATS program was temporarily extended in its current form for two months (through December 3, 2010). Once Congress returns, it is expected that CFATS will again be extended for one year.

DHS Releases CSAT SSP Edit Process User Guide

The Department of Homeland Security (DHS) has released the CSAT SSP Edit Process User Guide. The manual “provides instructions to facilities for editing and resubmitting their submitted Site Security Plan (SSP) through the Chemical Security Assessment Tool (CSAT)” to make either an administrative or technical edit.

Administrative edits relate to changes pertaining to the facility’s description, contact information, local police, fire and Emergency Management Team (EMT) jurisdiction information, and employee and workshift information. Technical edits involve changes to the facility’s operations, security measures, and other non-administrative components of the SSP. Note that once DHS has approved a facility’s SSP, the facility may only make technical edits to its SSP once every 90 days.

It is important to remember that a facility’s current SSP remains in effect until the submitted edits are reviewed and approved by DHS. Further, even after a facility receives a letter from DHS authorizing/approving the SSP edits, the facility's original SSP approval date and Top-Screen re-submission deadlines do not change.

The U.S. Government Accountability Office (GAO) Issues Pipeline Security Report

In August 2010, the U.S. Government Accountability Office (GAO) issued a report reviewing the Transportation Security Administration’s (TSA’s) current efforts to address pipeline security. The GAO specifically reviewed the TSA Pipeline Security Division’s (PSD’s) risk assessment process and performance measures after observing 14 PSD inspections scheduled during the review period.

The report noted that the PSD pipeline risk assessment model could be improved by adding certain non-economic impacts such as public health and safety to its consequence component. Further, the GAO indicated that although PSD has taken steps to assess its progress in strengthening pipeline security, its ability to measure improvements is still limited as PSD is not utilizing performance measures or linking them to objectives. The GAO report recommended that TSA “establish time frames for improving risk model data, document its method for scheduling reviews, develop a plan for transmitting recommendations to operators, follow up on its recommendations, include performance measures linked to objectives in its pipeline strategy, and develop more outcome measures.”