Risk-Based Performance Standards

Following a facility s submission of the security vulnerability assessment and its analysis by the DHS, the DHS will either confirm that a facility is high risk or inform a facility that the DHS no longer considers the facility to be high risk or subject to further regulation under CFATS. For facilities confirmed to be high risk, the DHS will communicate the final facility tier determination, and the facilities must develop and implement site security plans that satisfy the risk-based performance standards enumerated in 6 CFR 27.230. 

The site security plan must meet the following standards  

Address each vulnerability identified in the facility s security vulnerability assessment, and identify and describe the security measures to address each such vulnerability. 

Identify and describe how security measures selected by the facility will address the applicable risk-based performance standards and potential modes of terrorist attack, including, as applicable, vehicle-borne explosive devices, waterborne explosive devices, ground assault, or other modes or potential modes identified by the DHS. 

Identify and describe how security measures selected and utilized by the facility will meet or exceed each applicable performance standard for the appropriate risk-based tier for the facility. 

---

The secretary, under the law, must review and approve the required assessment, plan, and implementation for each facility. The statute prohibits the secretary from disapproving a site security plan on the basis of the presence or absence of a particular security measure, but the secretary may disapprove a site security plan that does not meet the risk-based performance standards. The secretary may approve vulnerability assessments (see chapter 5) and site security plans created through security programs not developed by DHS, so long as the results of these programs meet the risk-based performance standards established in regulation. 

Facilities that complete the CSAT Top-Screen and do not meet the consequence thresholds do not need to comply with CFATS. The DHS recognizes that facilities have dedicated and invested time, resources, and capital to identify vulnerabilities and improve overall security. Facilities will be able to make use of information from these improvements. Facilities may also leverage their existing security measures to work toward compliance with CFATS, specifically the risk-based performance standards. 

The security measures needed to satisfy the risk-based performance standards for each covered facility correspond to the security risks presented by the facility. Accordingly, facilities that present a higher risk will be required to meet more rigorous risk-based performance standards. 

The amount and type of hazards will determine the performance standard specified in site-specific control plans. This includes the content, detail, and formality of review. The approval of the plans is based on risk and hazard potential. Using the hazard-based approach, levels of risk or methods to rank risk (degree) are standardized. 

The determination of hydrocarbon contaminants in soil is one of the most frequently performed analyses in the study of contaminated sites and is also one of the least standardized. Given the wide variety of hydrocarbon contaminants that can potentially enter and exist in the soil environment, a need exists for methods that quantify these chemicals satisfactorily. Formerly, the idea of total hydrocarbon determination in soil was seen as providing a satisfactory tool for assessing contaminated sites, but the nature of the method and the site specificity dictate a risk-based approach in data assessment. Quantitation of particular hydrocarbon species may be required. 

The CPSC staff performed quantitative risk assessments on various flame-retardants for both upholstered residential furniture fabrics and foam.89 CPSC addresses chemical hazards under the Federal Hazardous Substances Act (FHSA), which is risk based. For fabrics, five flame-retardants were evaluated, that include antimony trioxide, deca-BDE, HBCD, phosphonic acid, (3- [hydroxymethyl]amino)-3-oxopropyl)-, dimethyl ester (PA), and tetrakis (hydroxymethyl) phosphonium chloride (THPC). These flame-retardants were selected for study because they are used to comply with the U.K. upholstered furniture flammability standard (except THPC) and fabric samples were available for testing. The staff concluded in 2006 that deca-BDE, HBCD, and PA would not present a hazard to consumers and that additional data would be needed to assess antimony trioxide and THPC. 

In military operations, it is impossible to have zero risk, and indeed, the acceptable risk level in most cases may well be higher than that set for civilian operations. Determining the appropriate level of decontamination for a situation is the result of assessment and decision making based on all of the risks. Setting the appropriate risk levels and decontamination specifications is an area in need of Navy doctrine. Once established, that doctrine could then lead to the development of testing and performance standards to be used for field decontamination, as well as to base and long-term equipment decontamination procedures. The Navy must be able to provide doctrine, guidelines, and expertise in this area. 

S.la Asset-Based Analysis (Assign Performance Standard Based on Risk Ranking, Identify Recommendations, Site Security Review)... 

All results from both laboratories for the blind standards were not as accurate as the laboratories report for known performance standards and internal QA/QC samples. That is, if the analyst knows that performance standards are being analyzed, apparently the person is more careful or perhaps the supervisor will perform the critical analyses. The use of blind standards is essential in evaluating laboratory quiity. Based on such analyses, much of the fourth quarter data on the CC/CC project was used with caution or not used at all for modeling and risk assessment. 

Non-risk Remedial Action Objectives - A set of objectives based on non-risk considerations for current and future site management. These objectives may include resource protection standards or nuisance and odour control standards with numeric remedial action levels. In addition, non-risk objectives may include performance standards not based on contaminant concentrations such as remediation timeframe,... 

Depending on the date of the release and nature of contaminated media, EPA provides several cleanup and disposal options. Any party may proceed to clean up any PCB remediation waste based on the concentration of PCBs found, and may do so either (i) as a self-implementing on-site cleanup and disposal (ii) consistent with performance-based disposal standards or (iii) pursuant to a risk-based cleanup and disposal approval received from the Administration. In addition, and with regard to a more limited class of PCB spills and releases, a party may proceed with cleanup and disposal under the EPA s PCB Spill Cleanup Policy. ... 

---