By Ryan Loughin, Director of Petrochemical & Energy Solutions for the Advanced Integration division of ADT -
CFATS legislation may be at a standstill for now, but it is important to remember that the Department of Homeland Security (DHS) is moving forward with the implementation of the mandates. DHS has hired new staff, including 93 field inspectors, which has allowed the department to pick up the pace of inspections and also pre-authorization inspections (PAIs).
The feedback we constantly hear from DHS and inspectors is that facilities are not putting enough detail into the Site Security Plan (SSP). That means DHS has to contact companies for more information, and in many cases, they are scheduling PAIs to get a real look at a facility and its procedures.
The purpose of the PAI is to make sure that the SSP the facility has submitted is operating, functional and ultimately can meet the mandates set out by CFATS. To do that, DHS has to see the plan in action. Facilities should expect these inspections to be true inspections. They will not just take place in an office or board room with a review of paperwork. They will include an extensive tour of the facility or facilities and discussions with personnel who will be hands-on implementing the plan. If the receptionist is part of the visitor access process, then DHS will want to talk with that individual. DHS will want to know if that person understands his/her role and knows the procedures to follow. The idea is that a company’s SSP is only as good as the people implementing it.
Knowing that DHS will want to come in and kick a few tires means that you have to be prepared. Rehearsing or running through your plan ahead of time is essential. Try to put yourself in the shoes of the inspector – what questions would you ask and what areas would be critical to view? Conducting a dry run will also help you catch any problems or gaps and give you time to fix them before the inspection process.
DHS inspectors want to see the technology solutions you have, but remember not to get too caught up in technology. All of your solutions should be built around goals and standards. The heart of CFATS is the 18 Risk-Based Performance Standards (RBPS) and the goal is to meet those standards. That is what the inspector will be looking for during a PAI.
Lastly, make sure to take notes and ask questions during your PAI. The DHS inspector is there to help you with compliance, so get as much information as possible. In the long run, it’s going to save you time and resources, and most importantly, make your facility more secure.