What Chemical Facilities Need to Do to Protect CVI
On June 8th, 2007 the new federal Chemical Facility Anti-Terrorism Security (CFATS) regulation went into effect. This regulation (6 CFR part 27) will put a number of reporting requirements on chemical facilities. These requirements will force a large number of chemical facilities to submit sensitive information to the Department of Homeland Security (DHS). Some of the information will be sensitive business (inventories, pounds of products produced, estimated market share, etc) and security information (vulnerabilities, protective measures, worst case scenarios, etc) that neither the Federal Government nor the facility providing the information wants to let get into unauthorized hands.
To protect this information DHS set up a protected class of information called Chemical-terrorism Vulnerability Information (CVI). Rules were established for determining what information falls under the CVI rule, who has access to CVI, how CVI must be protected, transmitted and stored, and finally how out-of-date CVI should be destroyed. These rules effect DHS, the Federal Government, Courts, State and local governments, and first responders. More importantly it affects the chemical facility that produces implements and is required to maintain files of CVI.
Any chemical facility that is required to submit information for a Top Screen is going to need to have a CVI program. The copy of the Top Screen submission that each facility is required to maintain on file for three years is a CVI record. The letter that the facility receives from DHS that tells it that the facility is a high-risk facility regulated under 6 CFR part 27 is a CVI record as will be all of the other correspondence required between DHS and the facility. The Security Vulnerability Assessment (SVA) and the Site Security Plant (SSP) that high-risk facilities will be required to develop will be CVI as will be the training, drill, and maintenance records required to support the SSP.
The first thing that the chemical facility will have to do is to designate a CVI Point of Contact (CVI POC) who will be required to coordinate the facility CVI program with DHS, Federal, State and Local Agency officials. In effect this CVI POC will be the person that manages the CVI program at the facility level. The next thing that the facility will have to do is determine who will be required at the facility to handle CVI. Certainly the CVI POC, but also the person designated to enter information into the DHS on-line Chemical Security Assessment Tool (CSAT) (known as the Preparer), and the person responsible for the accuracy of that information (knows as the Submitter). Each member of the team that completes the SVA and the SSP will also be handling CVI. This is the absolute minimum number of people at the facility that will be handling CVI, but there will probably be many more as time goes by.
The CVI POC will then need to insure that the people that will be handling CVI are properly trained and cleared through DHS. This means that each of the people will need to go online to the DHS CVI training website. There they will complete the training, the after-training test and fill-out and submit the on-line non-disclosure form. When this is done, DHS will notify the CVI POC that those people at the facility will be Authorized Users of CVI. The CVI POC will maintain records of the Authorized Users at the facility and ensure that they are the only ones given access to CVI.
Any time that CVI is to be given to anyone outside of the chemical facility (except when transmitted through the CSAT system), the CVI POC is required to verify through DHS that the person destined to receive the information is an Authorized User. If not, the person will not be given access to the information. The only exception to this is that in the event of an emergency, the information may be released to some one the facility reasonably expects to have a need to know (for example a first responder), but the facility must notify DHS of the release of information as soon as practical afterwards.
The CVI POC needs to keep a log of the people that CVI documents are released to. The log needs to identify which document was released, when and to whom it was released, as well as when DHS confirmed that the receiver was an Authorized User. It would also seem reasonable for the log to document when a CVI document was produced or received at the facility and who initiated the document.
The facility also needs to insure that the people who are working with CVI, or holding CVI have adequate facilities to protect the documents when they are not actually using them. The documents must have a CVI cover sheet on the front and back of the document and it must be stored in a locked container. The CVI POC is responsible for auditing this requirement and making sure that the CVI protection requirements are being met within the facility.
It is certainly in the best interest of the chemical facility that CVI is properly secured and protected. These rules will be an added burden that will be unfamiliar to most chemical facilities. However, any facility that has worked with the Department of Defense on security issues or with the Department of Energy on nuclear issues will be familiar with these types of measures.
About the Author: Patrick J. Coyle has 15 years experience with the US Army, including a stint as a Physical Security NCO in Europe. He has also spent 12 years working as a Process Chemist is a specialty chemical manufacturing company.
Further information about the new regulations concerning protecting chemical plants from terrorist attack can be found at http://www.members.aol.com/ChemPlantSec/ChemPlantSecurity.htm
CVI Training: http:/
More articles by pjcoyle@aol.com
Print Article | Download PDF | 252 views | Jun 18 2007
|
|
