CFATS Program Extended, But, What is the Personnel Surety Requirement?

On January 18, 2019, President Trump signed a bill providing another 15 months of funding for the Department of Homeland Security’s (DHS) Chemical Facility Anti-Terrorism Standards program (CFATS). Trump signed the bill the day after the program was set to expire. News of the extension provides a moment to examine one of the more unusual aspects of the CFATS Personnel Surety Program—use of visual verification of credentials or documents to screen for terrorist ties of individuals with or seeking access to restricted areas or critical assets at high risk (Tier 1 and 2) chemical facilities.

The Personal Surety Provision is the 12th of 18 risk-based performance standards (RBPS) high-risk facilities must meet in their security plans (Site Security Plans or Alternative Security Programs, both referred to here as SSPs ) to be in compliance with CFATS. RBPS 12 requires high-risk facilities to perform appropriate background checks on and ensure appropriate credentials for facility personnel and, as appropriate, for unescorted visitors with access to restricted areas or critical assets. RBPS 12 comprises four parts:

• Measures designed to verify and validate identity;
• Measures designed to check criminal history;
• Measures designed to verify and validate legal authorization to work; and
• Measures designed to identify people with terrorist ties.

RBPS 12(iv)

In 2015, the DHS published a notice that implemented RBPS 12(iv) (December 18, 2015, Federal Register (FR)). The notice described four options for facilities to “consider” in implementing RBPS 12(iv). The options may be adopted singly or in combination. (The DHS permits high-risk chemical facilities to propose alternative measures for terrorist-ties identification in their SSPs; the DHS considers these alternatives on a case-by-case basis when evaluating SSPs.) The first three screening options involve some level of interaction with the federal government. Specifically:

Option 1. High-risk chemical facilities or their designees may submit certain information about affected individuals to the DHS through a Personnel Surety Program application in the Chemical Security Assessment Tool (CSAT).
Option 2. The facility/designee may submit information to the DHS about affected individuals to electronically verify their enrollment in the Transportation Worker Identification Credentials (TWIC) program, Hazardous Materials Endorsement (HME) program, or Trusted Traveler program. These programs conduct checks for terrorist ties that are equivalent to the check for terrorist ties performed by the DHS.
Option 3. The facility/designee uses electronic readers such as TWIC readers to verify the affected individual’s current enrollment in the TWIC program.

“The Department believes the greatest security benefit is achieved when a high-risk chemical facility selects either Option 1 and/or Option 2,” states the DHS. “Option 3 also provides significant security benefit. Option 4 provides some security benefit but less than Option 1, Option 2, or Option 3.”

Option 4—Visual Verification

Option 4 allows high-risk facilities to satisfy their RBPS 12(iv) obligation by using any federal screening program that periodically vets individuals against the Terrorist Screening Database (TSDB) if:

• The federal screening program issues a credential or document.
• The high-risk chemical facility is presented a credential or document by the affected individual.
• The high-risk chemical facility verifies the credential or document is current in accordance with its SSP.

Option 4 is specifically authorized by the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, which states that visual inspection to meet the requirements of the Personnel Surety requirement is “sufficient.” But should this method be employed, the Act adds that “the facility should consider other means of verification, consistent with the facility’s assessment of the threat posed by acceptance of credentials.”

In its 2015 notice, the DHS states that Option 4 verification has inherent limitations and provides less security value than the other three options. Accordingly, the DHS says that facilities should describe in their SSPs how visual inspections will be conducted and how the limitations of Option 4 will be addressed. Topics that should be covered include which documents or credentials are acceptable for visual verification, which specific procedures the facility will follow to visually verify the document or credential, and which specific facility personnel or unescorted visitors Option 4 will be used for and under which conditions. The notice includes the following example:

Option 4 could be implemented by leveraging the vetting conducted by the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) on affected individuals who are employee-possessors of a federal explosives licensee/permittee applicant. For example, a high-risk chemical facility may rely on a letter of clearance issued by the ATF when presented by an affected individual who is also an employee-possessor of explosives. The facility should describe in its SSP the procedures it will use to verify that the letter of clearance is current.

igh risk (Tier 1 and 2) chemical facilities.