Security Vulnerability Assessments

Definition of Terms (American Petroleum Institute/National Petroleum Refiners Association, Security Vulnerability Assessment Methodology for the Petroleum Industry, 2004.)... 

Security Vulnerability Assessment A security vulnerability assessment is intended to identify security vulnerabilities from a wide range of threats ranging from vandalism to terrorism. With the recognition of threats, consequences, and vulnerabilities, the risk of security events can be evaluated, and a security management system can be organized that will effectively mitigate those risks. 

This chapter provides a discussion of current security guidelines and regulations (Section 6.2) and a methodology for adapting and applying security vulnerability assessment (SVA) techniques designed for fixed chemical facilities to account for the differences specific to transportation (Sections 6.3 and 6.4). Practical transportation security elements are provided in Section 6.5. Finally, at the end of the chapter, the XYZ Chemical example highlights the unique issues of a security vulnerabiUty assessment as compared to a safety risk analysis. 

This section outlines the basic information needed for conducting or participating in a transportation security vulnerability assessment (TSVA). A protocol for prioritizing security issues and a methodology for conducting a more detailed TSVA of escalated security issues are described in Sections 6.3 and 6.4, respectively. The purpose of this section is to provide a background and resources for ... 

American Petroleum Institute, National Petrochemical Refiners Association, Security Vulnerability Assessment for the Petroleum and Petrochemical Industries, Second Edition, August 2004... 

P. Anastasio, Security Vulnerability Assessment Application, 46th Chlorine Institute Plant Operations Seminar, Chicago, IL (2003). 

Evaluate facilities and address weaknesses. The role of physical access control in improving security of chemicals, equipment, and occupants of buildings in which chemicals are stored and used should be addressed specifically. This will require development of a comprehensive security vulnerability assessment and policy setting (see Guidelines for Eacility Access and Use later in this chapter). 

Conducting a security vulnerability assessment (SVA) and developing and writing a site security plan as described below are meant to be in conjunction with establishing an effective safety and security program (see Step 5 above). ... 

Koch was a member of the American Chemistry Council and Center for Chemical Process Safety Security Task Forces that developed a Security Vulnerability Assessment (SVA) criterion and methodology for the chemical industry. He is vice chairman of the Compressed Gas Association Security Committee and the National Petrochemical and Refiners Association Security Committee. The National Petrochemical and Refiners Association... 

Assignment of tiers is based on an assessment of the potential consequences of a snccessfnl attack on assets associated with chemicals of interest. The DHS uses information snbmitted by facilities through the Top-Screen and security vulnerability assessment processes to identify a facility s risk, which is a function of the potential impacts of an attack, the likelihood that an attack on the facility would be successful, and the likelihood that such an attack would occur at the facility. 

If the DHS makes a determination that a facility is high risk, they will require the facility to complete a security vulnerability assessment to identify and assess... 

Following a facility s submission of the security vulnerability assessment and its analysis by the DHS, the DHS will either confirm that a facility is high risk or inform a facility that the DHS no longer considers the facility to be high risk or subject to further regulation under CFATS. For facilities confirmed to be high risk, the DHS will communicate the final facility tier determination, and the facilities must develop and implement site security plans that satisfy the risk-based performance standards enumerated in 6 CFR 27.230. 

Address each vulnerability identified in the facility s security vulnerability assessment, and identify and describe the security measures to address each such vulnerability. 

Specify other information that the assistant secretary deems necessary regarding chemical facility security. A covered facility must complete the site security plan through the CSAT process, or through any other methodology or process identified or issued by the assistant secretary. Covered facilities must submit a site security plan to the DHS in accordance with the schedule provided in 27.210. When a covered facility updates, revises, or otherwise alters its security vulnerability assessment pursuant to 27.215(d), the covered facility shall make corresponding changes to its site security plan. A covered facility must also update and revise its site security plan in accordance with the schedule in 27.210. A covered facility must conduct an annual audit of its compliance with its site security plan. 

---