Risk-Based Performance Standards Guidance Chemical Facility Anti-Terrorism Standards May 2009 Department of Homeland Security Office of Infrastructure Protection Infrastructure Security Compliance Division Mail Stop 8100 Washington, DC 20528 Website: www.dhs.gov/chemicalsecurity 2 Note: This document is a “guidance document” and does not establish any legally enforceable requirements. All security measures, practices, and metrics contained herein simply are possible, nonexclusive examples for facilities to consider as part of their overall strategy to address the risk-based performance standards under the Chemical Facility Anti Terrorism Standards and are not prerequisites to regulatory compliance. Table of Contents Disclaimer Notice............................................................................................................................. 7 Overview.......................................................................................................................................... 8 Inquiries on RBPS Guidance or Other CFATS Issues..................................................................... 9 CFATS Risk-Based Performance Standards ...................................................................................... 10 How to Use this Guidance Document ............................................................................................ 13 General Considerations for Selecting Security Measures to Comply with CFATS................................................................................................................................ 17 RBPS 1 – Restrict Area Perimeter .................................................................................................... 22 Security Measures and Considerations for Restricting Area Perimeter ........................................ 24 Security Measures .................................................................................................................. 24 Security Considerations.......................................................................................................... 26 RBPS Metrics .............................................................................................................................. 28 RBPS 2 – Secure Site Assets............................................................................................................. 32 Security Measures and Considerations for Securing Site Assets................................................... 34 Security Measures .................................................................................................................. 34 Security Considerations.......................................................................................................... 36 RBPS Metrics .............................................................................................................................. 38 RBPS 3 – Screen and Control Access ............................................................................................... 41 Security Measures and Considerations for Screening and Controlling Assets.............................. 41 Security Measures .................................................................................................................. 41 Security Considerations.......................................................................................................... 44 RBPS Metrics .............................................................................................................................. 46 RBPS 4 – Deter, Detect, and Delay.................................................................................................. 50 Security Measures and Considerations to Deter, Detect, and Delay ............................................ 51 Security Measures .................................................................................................................. 51 Security Considerations.......................................................................................................... 53 RBPS Metrics .............................................................................................................................. 55 RBPS 5 – Shipping, Receipt, and Storage........................................................................................ 59 Security Measures and Considerations for Shipping, Receipt, and Storage ................................. 59 Security Measures .................................................................................................................. 59 Security Considerations.......................................................................................................... 61 RBPS Metrics .............................................................................................................................. 62 RBPS 6 – Theft or Diversion ........................................................................................................... 64 Security Measures and Considerations for Theft or Diversion .................................................... 64 Security Measures .................................................................................................................. 64 Security Considerations.......................................................................................................... 65 RBPS Metrics .............................................................................................................................. 66 RBPS 7 – Sabotage .......................................................................................................................... 68 Security Measures and Considerations for Sabotage ................................................................... 68 Security Measures .................................................................................................................. 68 Security Considerations.......................................................................................................... 70 RBPS Metrics .............................................................................................................................. 70 RBPS 8 – Cyber............................................................................................................................... 71 Security Measures and Considerations for Cyber........................................................................ 72 Security Measures .................................................................................................................. 72 Security Considerations.......................................................................................................... 77 3 Note: This document is a “guidance document” and does not establish any legally enforceable requirements. All security measures, practices, and metrics contained herein simply are possible, nonexclusive examples for facilities to consider as part of their overall strategy to address the risk-based performance standards under the Chemical Facility Anti Terrorism Standards and are not prerequisites to regulatory compliance. RBPS Metrics .............................................................................................................................. 78 RBPS 9 – Response ......................................................................................................................... 82 Security Measures and Considerations for Response .................................................................. 82 Security Measures .................................................................................................................. 82 Security Considerations.......................................................................................................... 84 RBPS Metrics .............................................................................................................................. 85 RBPS 10 – Monitoring.................................................................................................................... 87 Security Measures and Considerations for Monitoring............................................................... 87 Security Measures .................................................................................................................. 87 Security Considerations.......................................................................................................... 88 RBPS Metrics .............................................................................................................................. 88 RBPS 11 – Training ........................................................................................................................ 90 Security Measures and Considerations for Training.................................................................... 90 Security Measures .................................................................................................................. 91 Security Considerations.......................................................................................................... 93 RBPS Metrics .............................................................................................................................. 95 RBPS 12 – Personnel Surety............................................................................................................ 96 Security Measures and Considerations for Personnel Surety......................................................