Category Archives: Security Assessment

Identification of Additional Facilities and Assets at Risk

DHS Issues 60 Day ICR Notice for CSAT

From Chemical Facility Security News

Yesterday the DHS Cybersecurity and Infrastructure Security Agency, the agency that oversees the CFATS program, published a 60-day Information Collection Request (ICR) notice for revisions to the Chemical Security Assessment Tool (CSAT). The notice is intended to revise collection and burden estimates for data collection using CSAT 2.0.

Also included in yesterday’s ICR notice is a detailed review of the risk identification tool, Identification of Additional Facilities and Assets at Risk, that DHS is using to collect data during compliance inspections. At facilities that ship and receive COIs, the facilities are requested to voluntarily provide information on:

  • Shipping and/or receiving procedures
  • Invoices and receipts
  • Company names and locations that COI is shipped and/or received from

Facilities that are identified has having SCADA, DCS, PCS, or ICS systems are requested to voluntarily provide information on:

  • Details on the system(s) that controls, monitors, and/or manages small to large production systems as well as how the system(s) operates.
  • If it is standalone or connected to other systems or networks and document the specific brand and name of the system(s)

Thanks to PJ Coyle for the information on this ICR. To read a more detailed review of the ICR, click here. While there, subscribe the PJ’s blog.

Do you need a DOT HAZMAT Security Plan?

If you transport certain hazardous material, you probably need to implement a security plan. Many oil and gas operators are already familiar with the U.S. Coast Guard Maritime Transportation Security Act (MTSA) and DHS Chemical Facility Anti-Terrorism Standards (CFATS), but many are not familiar with the U.S. Department of Transportation’s (DOT) Pipeline and Hazardous Materials Safety Administration (PHMSA) HAZMAT Site Security Plan requirements (49 CFR Part 172.800). The rule took effect in September 2003 and requires companies that transport hazardous material to establish a written security plan. The regulation also requires specific security training requirements for HAZMAT drivers and HAZMAT employees.

Security Plan Requirements

The security plan must include an assessment of the transportation security risk for HAZMAT shipments, including site-specific and location-specific risks associated with the facilities at which the materials are prepared for transport, stored, or unloaded incident to movement, and appropriate measures to address the assessed risks. At a minimum, the security plan must include the following elements:

  • Personnel security;
  • Unauthorized access;
  • En route security;
  • Identification by job title the senior management official responsible for the development and implementation of the security plan;
  • Security duties for each position or department responsible for implementing the plan; and
  • A plan for training HAZMAT employees.

Training Requirements

The regulation requires the company/facility to ensure that each of its hazmat employees receive security awareness training as well as in-depth security training.

For more information of the DOT regulation, click here.

Last Minute Deal Extends CFATS Program

According to The Hill, Senators have struck a last-minute deal to extend the Chemical Facility Anti-Terrorism (CFATS) program. This program regulates how manufacturers must guard against potential terror attacks.

Congress will now vote on the bill to reauthorize the CFATS program for 15 months. The CFATS program was set to officially expire at the end of Thursday, January 17, 2019.

To read more about CFATS, click here.

To read The Hill, article click here.

To read more on the bill, click here.

 

The Adversary Sets the Agenda

Security planning must take into consideration that the Adversary sets the agenda and is better informed when plotting than the security strategist.

The threat adversary sets the agenda.  This is an important and too little discussed reality.

Building occupants, even building security, do not know that an adversary is considering an adverse attack or criminal intrusion.  The building and suite occupants “blindly” implement security measures that are customary and often “cosmetic”.  However, the adversary has an agenda:

  • They have an objective ranging from simple theft of purses and wallets to incidents of workplace violent, including rage killings.
  • They know the “territory” – they have studied and surveilled the building and avenues of access.  They know how ineffective the lobby guard is.  They have a target and a plan.
  • They want to enter incognito – their observations of building activity show they what to do to maintain a low profile.
  • In active shooter situations, they may be suicidal and have no plan of escape, which makes them very dangerous.
  • They will likely identify the same vulnerabilities that have been identified during a security assessment.

Security countermeasures must mitigate these risk as far as is reasonable and possible.  They should be deterred by at least two access-controlled perimeters to complicate their plan and increase their risk of detection.

Watch for our series of blogs on the security assessment process.

Is Your Building/Office Space Secure?

A recent FBI report reveals that a majority of active shooters spend at least a week planning their attack and often attack people and places with which they were already familiar. In the majority of active shooter cases, the active shooter knew and actively targeted at least one of the victims.

In this growing threat environment, employees are expressing concerns about acts of workplace violence and active shooter. The most important security measures for workplace protection are employee awareness training and a fundamental building security program.

A thorough and detailed building security vulnerability assessment (SVA) and report are the first steps in developing an effective building security program to protect people and critical assets. The SVA provides for the foundation of a risk management program.

 The objective of conducting a security assessment is to assess security risks as a means to assist management in identifying and understanding the risks that face the organization.  This assists management in making informed decisions on the adequacy of security and the need for additional security countermeasures to address threats, vulnerabilities and potential consequences.

Contact Don Greenwood & Associates, Inc. to have us conduct a security assessment on your building or office spaces.