The Chemical Facility Anti-Terrorism Standards (CFATS) program requires high-risk facilities to ensure security measures are in place to reduce the risk of more than 300 chemicals of interest (COI) being weaponized. High-risk facilities are assigned to one of four (4) risk-based tiers and must develop a security plan meeting the 18 Risk-Based Performance Standards (RBPS). Due to the nature of the chemicals they possess and the method by which they transport their materials, many of the high-risk facilities covered by the CFATS program may also be subject to other federal regulations.
Because of the non-prescriptive nature of the RBPS, security measures that high-risk chemical facilities have implemented to comply with CFATS may also satisfy components of other regulations. Similarly, actions taken to comply with other regulations (PSM/RMP) may meet the RBPS requirements under the CFATS program.
Environmental Protection Agency (EPA) Risk Management Program (RMP)
The RMP Rule implements Section 111(r) of the 1990 Clean Air Act amendments. The RMP requires facilities that use extremely hazardous substances to develop a Risk Management Plan. These plans must be revised and resubmitted to the EPA every five years. Risk Management Plans include measures for monitoring, detection, control, and response and therefore may meet portions of several RBPS, including
RBPS 2 – Secure Site Assets;
RBPS 3 – Screen and Control Access;
RBPS 4 – Deter, Detect, and Delay;
RBPS 5 – Shipping, Receipt, and Storage;
RBPS 9 – Response;
RBPS 11 – Training;
RBPS 12 – Personnel Surety;
RBPS 15 – Reporting of Significant Security Incidents; and
RBPS 16 – Significant Security Incidents and Suspicious Activities.
Occupational Safety and Health Administration (OSHA) Process Safety Management of Highly Hazardous Chemicals Standard (PSM)
To help ensure safe and healthful workplaces, OSHA has issued the PSM, in accordance with 29 CFR 1910.119, which contains requirements for the management of hazards associated with processes using highly hazardous chemicals. PSMs include measures for monitoring, detection, control, and response and therefore may meet several RBPS, including
RBPS 2 – Secure Site Assets;
RBPS 3 – Screen and Control Access;
RBPS 4 – Deter, Detect, and Delay;
RBPS 5 – Shipping, Receipt, and Storage;
RBPS 9 – Response;
RBPS 11 – Training;
RBPS 15 – Reporting of Significant Security Incidents; and
RBPS 16 – Significant Security Incidents and Suspicious Activities.
Conclusion
It is important to note that while another agency’s security plan or guidance may satisfy one or more measures of the CFATS RBPS, the CFATS program requires that all 18 RBPS be addressed according to a facility’s tier and security issues.
To begin the process of complying with the CFATS program, visit cisa.gov/cfats-process
Source: https://www.cisa.gov/sites/default/files/publications/fs-regs-satisfy-cfats-rbps-508.pdf