Chemical Processing - March 2008 - (Page 28)

>> Scenario worksheet SIX TIPS FOR SVA SUCCESS 1. Plan the activity well in advance; senior leadership should communicate to the entire organization about the assessment and seek candid input. 2. Ensure the full support and authorization of management before proceeding with the SVA. 3. Insist upon data that are veriﬁed and complete. Consider the use of a scenario worksheet in documenting the information in your SVA. (Figure 2 shows a sample worksheet.) Such a form will greatly aid in getting your information organized in the way it will need to be entered into CSAT at the conclusion of the SVA. 4. Keep the objectives and scope concise; DHS will provide structure in the initial written communication after the Top Screen is complete. 5. Staff the team with people knowledgeable of and experienced at the process they are reviewing (release, theft/diversion, etc.). 6. Use a team leader who is skilled in the SVA process methodology so it can be properly facilitated. Scenario 1: Risk matrix A I II III IV V B C D E Legend S = Safety of People I = Information F = Financial C = Continuity of Ops P = Public Relations B = Risk Before A = Risk After Causes / Vulnerabilities: Consequences: Existing Countermeasures: Risk Before (Initial Risk) S= I= F= Recommendations: Risk after (mitigated risk) S= I= F= C= P= C= P= WARNING: This record contains Chemical-terrorism Vulnerability Information controlled by 6 CFR 27.400. Do not disclose to persons without a "need to know" in accordance with 6 CFR 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classiﬁed information in accordance with 6 CFR 27.400(h) and (i). Figure 2. A form like this can ease data entry into CSAT. Vulnerability assessment. The identi cation of security vulnerabilities underpins the validity of the whole process. Existing security measures must be evaluated to ensure they are being managed in a manner that provides the most value to the organization. Ultimately, the deliverable of this phase is the assessment of the level of effectiveness in reducing vulnerability and meeting applicable risk-based performance standards. This is the phase where your security professional should be doing most of the work. Risk analysis. This includes a determination of the relative initial degree of risk to the chemicals of interest in terms of the expected effect on each critical asset and the likelihood of the success of an attack; it typically is represented in a matrix (Figure 1). Improvement (risk reduction) is derived from identifying additional countermeasures that can be applied to: • reduce the probability of a successful attack on a chemical of interest; • enhance the degree of risk reduction; • increase the reliability/maintainability of security; and • decrease the consequences of an event. Risk is reassessed after proposed countermeasures are applied to the scenarios addressed in your SVA. Measures accepted by management must then be incorporated into your site security plan. Results of the SVA will be entered into CSAT and will form the basis of the site security plan. In fact all vulnerabilities identi ed in the SVA must be addressed in the site security plan, which is due 120 days after your SVA is complete. 28 • March 2008 Protecting information It’s crucial to safeguard Chemical-Terrorism Vulnerability Information (CVI) from disclosure to unauthorized persons. While a company likely will certify only a limited number of employees as able to handle CVI, all employees must know enough about what to do if CVI documents are found unsecured. Staff must be taught how to recognize this information based on this labeling: Chemical-terrorism Vulnerability Information (Placed in the header of each page.) Each cover page, title page and page within the document should have the following statement inserted: WARNING: This record contains Chemical-terrorism Vulnerability Information controlled by 6 CFR 27.400. Do not disclose to persons without a “need to know” in accordance with 6 CFR 27.400(e). Unauthorized release may result in civil penalties or other action. In any administrative or judicial proceeding, this information shall be treated as classi ed information in accordance with 6 CFR 27.400(h) and (i). Any documentation prepared due to your SVA should be labeled accordingly. A start towards security These new standards will substantially expand the security requirements for many chemical facilities that have never before been covered under government security guidelines. Clearly, it’s necessary to get a start on them. However, much work by both the private sector and the government will have to be done before all of the high risk chemical facilities in the United States can fully meet the standards. CP Frank Pisciotta, CSC, is president of Business Protection Specialists, Canandaigua, N.Y. E-mail him at fp@securingpeople.com. Deborah Allen, CPP, is director of product stewardship and security at Potash Corp., Northbrook, Ill. E-mail her at dlallen@potashcorp.com. www.chemicalprocessing.com http://www.chemicalprocessing.com

Table of Contents Feed for the Digital Edition of Chemical Processing - March 2008

Chemical Processing - March 2008 Contents From the Editor ChemicalProcessing.com Field Notes In Process Energy Saver Compliance Advisor Distillation is Bubbling Feel Secure About Vulnerability Assessments The Door Opens For Membranes Achieve Effective Heat Exchanger Control Epoxy Maker Finds the Right Glue for Its Business Process Puzzler Plant InSites Equipment & Services Product Spotlight/Classifieds Ad Index End Point

Chemical Processing - March 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.