Category Archives: FSO

3 Tips for a Successful USCG Inspection

Many companies aren’t prepared when they receive a letter from the U.S. Coast Guard notifying them of an upcoming facility security inspection. You might have documents that are out of date, or you may be missing the necessary forms. If left unchecked, you could be forced to waste time and money in enforcing corrective actions. When it comes to advising our clients to be prepared, these are the top three tips we give them for a successful USCG Inspection.

Review Your Documents

When you receive a notice from the USCG about an upcoming inspection, this is always a good time to review your FSP and required documents to make sure that you have everything in order. Also, this is a good time to verify that you have conducted the required quarterly drills, annual exercise, and annual audit of the FSP.

Training Moment

Training is very important for facility personnel and this is a good opportunity to make sure all your training is up to date and to have a general discussion regarding security of the facility. The training can focus on topics that will most likely be covered during the inspection; including TWIC, screening, security personnel (who is the FSO, Alt. FSO?), MARSEC security measures, etc.

Organize

One thing that we recommend and develop for majority of our clients is to have a single security plan binder with all relevant documents and forms. This is a perfect, centralized place to store and secure all the forms and documents that the USCG will want to review during the inspection. We have had great success with these binders for all of our regulated clients; MTSA, CFATS, TSA, DOT, etc. As we tell our clients, it is best to get the inspectors the requested material in a timely fashion and get the inspection over with as quickly as possible.

Recently one of our clients had a US Coast Guard inspection that they passed without any issues, “We went through our MARSEC book while the USCG was here and we were complimented on how all the files for MARSEC were in one book and not in different locations.  We didn’t spend much time with it, because everything was in the binder that they had questions about. “

Let us know if we can help you prepare for USCG Security Inspection and develop a security binder for you and help you succeed with your inspections.

CFATS Quarterly Update

Recently DHS released their Fall Quarterly Update providing more detail on the implementation of the CFATS program.

CFATS Update

As of September 1, 2017, CFATS covers 3,478 facilities. DHS has completed more than 2,700 Compliance Inspections (to read more about Compliance Inspections, click here). Since launching CSAT 2.0 a year ago, DHS has received more than 25,000 CSAT Top Screens. DHS is continuing to issue tiering letters to facilities as their Top Screens are received and reviewed.

You can read more about CSAT 2.0 here.

SVA/SSP Questions

One topic discussed in the update in the new questions that facilities will need to answer when submitting a new or revised SVA/SSP.

When submitting the SSP, the new questions facilities will need to address include:

  • Q3.10.050 Personnel Presence
  • Q3.10.400 through Q3.10.420 Inventory Controls
  • Q3.40.400 through Q3.40.430 Cyber Control and Business Systems
  • Q3.50.320 Personnel Surety, Types of Affected Individuals
  • Q3.50.710 Recordkeeping Affirmation

In addition to these new SSP question, facilities are asked to select whether a certain detection and delay security measure applies to perimeter and/or critical assets. The following SSP questions should be reviewed to ensure the location(s) are correctly associated with the security measures applied:

  • Q3.10.070 Mobile Patrols
  • Q3.10.120 Intrusion Detection Systems
  • Q3.10.180 through Q3.10.230 Intrusion Detection Sensors
  • Q3.10.290 and Q3.10.310 Closed Circuit Television
  • Q3.20.030 through Q3.20.160 Perimeter Security
  • Q3.20.430 and Q3.20.440 Access Control Systems
  • Q3.20.560 Anti-Vehicle Measures

Personnel Surety Program (PSP)

Tier 1 and Tier 2 facilities will see questions that address RBPS 12(iv), screening for terrorist ties. Questions Q3.50.330 through Q3.50.550 allow facilities to identify the option(s) chosen and measure(s) used to implement those options for compliance with RBPS 12(iv). To read more about those options, click here.

Additionally, DHS is going to integrate the Personnel Surety Program into the CSAT 2.0 Portal. This should make it much easier and provide better functionality for the user.

Chiefs of Regulatory Compliance

DHS also announced in this update that they have hired Chiefs of Regulatory Compliance (CRCs) for majority of their Regional Offices. CRCs will serve as the lead DHS representatives administering the CFATS regulation and serving as advisors to the Office of Infrastructure Protection Regional Directors.

Region CRCs:

  • Region 1 (VT, RI, ME, NH, CT, MA) – Charles Colley charles.colley@hq.dhs.gov
  • Region 2 (VI, PR, NJ, NY) – John Dean john.dean@hq.dhs.gov
  • Region 3 (DC, DE, WV, MD, VA, PA) – Don Keen donald.keen@hq.dhs.gov
  • Region 4 (MS, SC, AL, KY, FL, NC, TN, GA) – Cheryl Louck cheryl.louck@hq.dhs.gov
  • Region 5 (MN, WI, IN, MI, IL, OH) – Kathy Young kathryn.young@hq.dhs.gov
  • Region 6 (NM, OK, LA, AR, TX) – Steve Shedd steven.shedd@hq.dhs.gov
  • Region 7 (NE, KS, IA, MO) – Dave Martak david.martak@hq.dhs.gov
  • Region 8 (WY, ND, SD, MT, UT, CO) – Jim Williams james.williams@hq.dhs.gov
  • Region 9 (MP, GU, HI, NV, AZ, CA) – Marcie Stone marcie.stone@hq.dhs.gov
  • Region 10 (AK, ID, OR, WA) – Marc Glasser marc.glasser@hq.dhs.gov

Feel free to contact us if more information or support is needed.

Changes in USCG Leadership Indicate Strong Continued Interest in Port Security

  • Rear Adm. Paul Thomas moves from Prevention Policy to command of the Eighth District – New Orleans.
  • Rear Adm. John Nadeau assumes position as assistant commandant for Prevention Policy.

Rear Adm. Paul Thomas, in an article posted in Maritime Commons, stated:

This week marks my last as assistant commandant for prevention policy. I assume command of the Coast Guard’s Eighth District in mid-August. It has been a distinct privilege to lead and represent the men and women of the U.S. Coast Guard who are dedicated to ensure our national security and economic prosperity by ensuring the safety, security and environmental soundness of our Marine Transportation System globally . . .Thank you for your professional and productive relationship with the U.S. Coast Guard.

About Rear Admiral Nadeau, Thomas stated:

I am pleased to introduce Rear Adm. John Nadeau as the new assistant commandant for prevention policy effective today. His most recent assignment was as assistant commandant for capability, where he was responsible for identifying and sourcing new and extended capabilities, competencies, and capacity to meet mission requirements. Prior to that, he served as commanding officer of the Coast Guard Marine Safety Center where he led the review and approval of plans for the design, construction, alteration, and repair of U.S. and foreign flag commercial vessels subject to U.S. laws, regulations, and international standards. Rear Adm. Nadeau’s other assignments cover the full spectrum of marine safety and inspections and span the bulk of his nearly three decades long career: chief of inspections, senior investigating officer, MSU commanding officer, captain of the port and federal on scene coordinator, Officer In Charge, Marine Inspection, and chief of the Office of Design and Engineering Standards.

In summary: Prevention Policy is assumed by a strong advocate for robust port security with a background in marine safety and inspection, and the command of District Eight is assumed by the former assistant commandant for prevention policy.  These moves indicate a strong continued interest in port security programs.

Chemical Sector Security Summit

For the first time after 10 years, the annual Chemical Sector Security Summit will be held outside the D.C. area in Houston, Texas. The summit is scheduled to take place in July 2017.

This year’s Summit will feature vital chemical security information for 2017 and beyond, while bringing together industry owners and operators, key government officials, first responders, and law enforcement to engage in face-to-face discussions and share the latest in security best practices.

Summit registration will open in spring 2017, along with updates on the venue, agenda, and speakers.

For more information, click here.

CFATS Quarterly Update

On April 4, 2017, the Department of Homeland Security (DHS) began issuing tiering notifications to Chemical Facility Anti- Terrorism Standards (CFATS) regulated facilities based on the results of DHS’s new enhanced risk-tiering methodology.

To date, approximately 12,000 updated Top-Screens have been received from the 27,000 facilities that previously reported holdings of chemicals of interest (COI) at or above the screening threshold quantity.

DHS has sent out over 10,000 tiering determination letters to facilities that have submitted new Top-Screens. Tiering letters are being prioritized based on when DHS received the facility Top-Screen, upcoming compliance inspection schedules, and to consider workload for submitters that have a high number of covered facilities with changes.

Over the next 18 months we will continue to notify facilities of the requirement to submit new Top-Screens and issue tiering decisions on a rolling basis.

I’ve Received a Tiering Letter, Now What?

As facilities receive tiering letters, their next steps will depend on their results.

Facilities new to the CFATS program will be required to submit security plans. If a current facility receives a revised tiering assessment, it does not necessarily mean that it will be required to submit a Site Security Plan (SSP)/Alternative Security Program (ASP).

Facilities should review their tiering letter along with their approved SSP/ASP to determine whether it meets the security measures associated with all the chemicals of interest (COI), specific security issues (Theft/Diversion, Release, or Sabotage), and tiers in the letter. If not, an SSP/ASP update may be required.

Examples of situations in which a facility will need to update its SSP may include:

  • Facilities that add a newly tiered COI, which is located in a new asset area not currently addressed in the SSP/ASP;
  • Facilities that increase in tier and do not have sufficient security measures to account for the higher tier;
  • Facilities with an added security concern from a current COI that lacks sufficient security measures to account for the new security concern.

For example, if a facility possesses chlorine tiered for “theft/diversion” but now must also account for chlorine as a “release” concern, the existing SSP/ASP would need to be revised to include security measures to address risks associated with release COI.

DHS will assess facilities on a case-by-case basis to ensure security measures are appropriate to their level of risk.

2017 Port Security Grant Program (PSGP) Update 2.0 – May 2017

Port Security Grants possibly announced in two weeks.

FEMA Grant Programs Directorate provided a presentation regarding the FY2017 Port Security Grant Program (PSGP).

Summary:

  • Announcement expected May 19, 2017.
  • Grants will need to be submitted to FEMA by June 19, 2017.
  • Anticipated to be for the same amount as FY2016, $100,000,000.00.
  • Funding priorities remain the same as 2016:
    • Enhancing Maritime Domain Awareness
    • TWIC Readers
    • Cybersecurity Capabilities
    • Training and Exercises, etc.
  • Cost sharing remains the same as 2016, 25/75 split.

To read more about the PSCP, click here and here.

DHS Tiering Methodology

Today, the Infrastructure Security Compliance Division of DHS hosted a webinar on their new tiering methodology for CFATS facilities.

The presenters stated that the increases and decreases of theft/diversion and release-toxic chemicals of interest (COI) is due to improvements and implementation modeling data available to DHS. Facilities that possess Triethanolamine and MDEA, for example, will most likely be increased to Tier Two for theft/diversion chemical weapon precursor due to the implementation of the new modeling tools.

DHS began sending out letters to facilities earlier this month based on the new tiering methodology. Facilities are instructed to review their SSP/ASP to ensure that the existing security measures are sufficient for the tier level. If a facility determines that they need to resubmit their SSP/ASP, the facility has 30 days from the date of the letter to update the Security Vulnerability Assessment and Security Plan. Note: This deadline is not mentioned in the letters that our clients have received.

 During Compliance Inspections, inspectors will verify that the security measures are appropriate to address all tiers, security issues and COI.

Feel free to contact us if more information or support is needed.

TWIC Reader Clarification

Recently the Coast Guard shared a blog post to clarify the TWIC Reader Requirements Final Rule regarding CDC facilities.

The rule applies to facilities that are considered a Certain Dangerous Cargo (CDC) facility. These facilities are designated as Risk Group A facilities and will be expected to comply with the TWIC reader rule requirements effective August 23, 2018.

The blog post clarifies what a CDC facility is. According to PAC Decision 20-04 Certain Dangerous Cargo Facilities, in “order for a facility to be classified as a CDC facility, a vessel-to-facility interface must occur, or be capable of occurring, and involve the transfer of CDC’s in bulk”.

Blog can be read here and PAC 20-04 can be found here. To read more about the TWIC Reader Requirements Final Rule, click here.

2017 Port Security Grant Program (PSGP) Update

Last year the 2016 PSGP Notice of Funding Opportunity (NOFO) was released mid-February and applications had to be submitted by late April. It looks like this year, we will have to wait until late April or early May before the NOFO is released.

DHS/FEMA has an approved budget of $93 million for the 2017 PSGP, but are currently operating under a Continuing Resolution. The 2017 PSGP documents have been prepared and some are posted in draft. However, the actual launch of the program until the federal budget is approved. Again, this is expected in April.

This delay should not keep applicants from making sure their registrations are up to date and making sure they have a plan in place. This gives applicants more time to prepare their Investment Justifications (IJs) and ensure that their project budgets are ready to go when the NOFO is released.

To read more about preparing for the 2017 PSGP, click here.

USCG Issues Policy Regarding Reporting Suspicious Activity and Breaches of Security

This is CG-5P Policy Letter 08_16.   It discusses requirements and guidelines as summarized below for MTSA regulated ports.  The regulatory standing is quoted as 33 CFR 46, 70103.  It is dated December 14 and was distributed on January 16.  This renewed focus includes reporting requirements for cyberattacks and Unmanned Aircraft Systems activity.

The stated purpose of the letter is to “Promulgate policy for use by Maritime Transportation Security Act (MTSA) regulated vessels and facilities outlining the criteria and process for suspicious activity (SA) and breach of security (BoS) reporting”.

It states, “An owner or operator of a vessel or facility that is required to maintain an approved security plan . . . (a) shall, without delay, report activities that may result in a Transportation Security Incident (TSI) to the National Response Center (NRC), including SA or a BoS. And, (b), the Facility Security Plan (FSP) shall . . . be consistent with the requirements of the National Transportation Security Plan and Area Maritime Transportation Security Plans.”

“The COTP will affirm consistency to help ensure alignment of SA and BoS communication procedures within FSPs throughout their area of responsibility.” 

Regarding cyber activity the letter states, The target and intent of malicious cyber activity can be difficult to discern. The fact that business and administrative systems may be connected to operational, industrial control and security systems further complicates this matter. The Coast Guard strongly encourages vessel and facility operators to minimize, monitor, and wherever possible, eliminate any such connections.

The letter goes on to describe U. S. Coast Guard requirements for reporting BoS and SA for both physical and network or computer-related events.  The U.S. Coast Guard regulations define a breach of security as “an incident that has not resulted in a TSI but in which security measures have been circumvented, eluded, or violated.” This definition includes the breach of telecommunications equipment, computer, and networked system security measures where those systems conduct or support functions described in vessel or facility security plans or where successful defeat or exploitation of the systems could result or contribute to a TSI.

BoS incidents may include, but are not limited to, any of the following:

  •  Unauthorized access to regulated areas;
  • Unauthorized circumvention of security measures;
  • Acts of piracy and/or armed robbery against ships;
  • Intrusion into telecommunications equipment, computer, and networked systems linked to security plan functions (e.g., access control, cargo control, monitoring), unauthorized root or administrator access to security and industrial control systems, successful phishing attempts or malicious insider activity that could allow outside entities access to internal IT systems that are linked to the MTS;
  • Instances of viruses, Trojan Horses, worms, zombies or other malicious software that have a widespread impact or adversely affect one or more on-site mission critical servers that are linked to security plan functions; and/or
  • Any denial of service attacks that Any denial of service attacks that adversely affect or degrade access to critical services that are linked to security plan functions.

 The letter contains lists of Suspicious Activities and Breaches of Security that should be reported and concludes with a Glossary of Terms.

Click here  for the complete document.