Back in November, CISA established a new voluntary chemical security program called ChemLock. Based on the experience that the Office of Chemical Security had developed overseeing the Chemical Facility Anti-Terrorism Standards (CFATS) program, the ChemLock program provides a number of free resources that chemical facilities can use to help protect chemicals produced, used, or stored at their facilities from use in a terrorist attack. The simplest of these are the seven fact sheets that provide brief looks at various aspects of a chemical security program. Those fact sheets include:
ChemLock: Chemical Security Considerations for No-Notice Events,
ChemLock: Reporting Suspicious Activities and Security Incidents
Overview
This fact sheet provides a brief look at the need for securing a variety of hazardous chemicals that could be used by terrorists. It goes on to provide an overview of the resources that CISA is able to provide to chemical facilities. It discusses free resources like:
On-Site Chemical Security Assessments and Assistance,
ChemLock Resources,
Chemical Security Exercises and Drills, and
Chemical Security Training
It also provides links to a number of other security resources that are available through other CISA offices.
Chemical Product Stewardship
This fact sheet addresses the fact that hazardous chemicals are vulnerable throughout their lifecycle, from the moment they are first produced, through consumption or proper disposal when they are no longer useful. With this in mind CISA defines product stewardship as a “a product-centered approach to the protection of dangerous materials so that manufacturers, distributors, retailers, and consumers share responsibility for reducing the potential for theft, contamination, or misuse of such chemicals for nefarious purposes.”
An effective product stewardship program includes:
Strict vehicle identification, entry authorization, shipping, and control procedures that are tested regularly
Procedures for handling the arrival of an unknown carrier at the facility, including the staging of a vehicle and its driver until both the driver and the load are vetted and approved
Confirmation from the facility employee who is responsible for a given shipment that the shipment is expected and approved
Advance planning and approval of inbound and outbound shipments of dangerous materials
An active, documented “know-your-customer” program
Proper identification checks and verification of transactions for customer pickup of dangerous materials
An audit procedure with appropriate redundancies in place for all shipping, receiving, and delivery of dangerous materials
This fact sheet also discusses the importance of a Know Your Customer program to ensure that chemicals are not simply shipped to terrorist organization. It also addresses the importance of reporting suspicious activity and security incidents to help prevent actual attacks.
No Notice Events
This fact sheet addresses the importance of being prepared for the unexpected. Facilities cannot afford the time or effort to prepare a plan for every possible occurrence that could potentially affect the safety and security of chemicals at that facility. The first thing facilities should do is to identify the most likely no-notice events that could reasonably be expected to occur in their area; fires, floods, tornados and earthquakes, each area has its own natural hazards. Then have a plan in place to deal with those likely events.
The folks at CISA also point out the benefit of turning ‘no-notice events’ to ‘short notice events’ which provide a little more time for considered reaction by subscribing to various governmental alerting notifications.
The fact sheet also discusses the following risk mitigation techniques:
Stay Informed of Current Events in Your Community,
Develop, Implement, Exercise, and Update Security and Response Plans,
Enhance Facility Security Posture, and
Cyber Protection
Security on a Budget
The ChemLock resources may be free, but any manager knows that actual security measures are never free. This fact sheet looks at some ways that facilities can prioritize their security spending to obtain adequate security at minimal costs. It provides specific suggestions for security measure considerations in the following categories:
Detection,
Delay,
Respond,
Cyber, and
Policies, plans and procedures.
Security Self-Assessment
A facility security plan is not a static document; external and internal situations change with time and security plans need to be periodically reviewed to ensure that they remain effective. This fact sheet provides a list of considerations that should be part of such an assessment. Those considerations include:
Ensure the plan meets its goals and is effective.
Confirm that all the information is up to date.
Identify security gaps and corresponding mitigation measures.
Review the implementation of additional planned measures.
Incorporate any changes as necessary to existing security measures.
Identify and remove obsolete measures that are no longer necessary.
Review relevant policies, plans, and procedures, such as roles and responsibilities, password procedures, reporting procedures for suspicious activity and security incidents, and response measures to an incident or hazard.
The second page of the fact sheet provides a check list that can be used during the conduct of the periodic assessment.
Drone Activity
This fact sheet provides a large amount of information about identifying potential threats from various forms of unmanned aircraft. The discussion about how to prepare for unauthorized drone activities is the most extensive (including links to other government resources) and addresses topics that include:
Engaging with law enforcement before incidents occur,
Posting FAA signage,
Connecting with local CISA Chemical Security personnel,
Conducting a site survey,
Developing, updating, implementing, disseminating, and exercising security plans,
Reviewing laws and regulations,
Training personnel on identifying and reporting suspicious indicators, and
Posting or sharing resources
Reporting Suspicious Activities
This fact sheet discusses the importance of reporting suspicious activities and security incidents. It provides a brief list of typical suspicious activities for a chemical facility and provides links to a variety of government agencies and incident reporting programs. The second page of the fact sheet is a template that facilities could use for their suspicious activity reporting program.
Moving Forward
These two-page fact sheets are not comprehensive educational materials. They provide facilities with some basic information and links to additional resources. CISA can be expected to add additional fact sheets to the ChemLock Resources page as time passes.