Facility Risk-Assessment And Security Guide

tampering”; 3) actions to be taken in the event of a“national emergency”; and 4) emergency contactinformation for local security authorities. For moreinformation from the NGFA, click here.breaches that could compromise the safety of theU.S. food supply. HSPD-9 is a sweeping executiveorder that directs several federal agencies to workcooperatively to develop plans to protect the safetyand security of the nation’s plant and animal-basedfood supply. USDA’s Requirements for Suppliers of Do-mestic and International Food Assistance:Similarly, USDA has indicated its intent to soonrequire contractually that companies supplying rawor processed agricultural commodities for itsdomestic or foreign food aid programs (such as theSchool Lunch Program and P.L. 480 food aidshipments) conduct facility vulnerability assessments and implement facility security plans.Among other things, HSPD-9 directs the secretaries of agriculture; health and human services(which includes the Food and Drug Administration),and homeland security to “expand and continuevulnerability assessments of the agriculture andfood sectors,” and to update those assessmentsevery two years. It also requires USDA and theDepartments of Homeland Security, Health andHuman Services, and Justice (including the FBI), aswell as the Environmental Protection Agency, CIAand other federal agencies, to “prioritize, developand implement mitigation strategies to protectvulnerable critical nodes of production or processingfrom the introduction of diseases, pests or poisonous agents.” And it calls on federal agencies toexpand on the development of “common screeningand inspection procedures” for agriculture and foodproducts imported into the United States, and to“maximize effective domestic inspection activities”for domestic shipments of food products. Bioterrorism Act Facility Registration: Underthe Bioterrorism Act of 2002, the U.S. Food andDrug Administration (FDA) requires domestic andforeign facilities (and their U.S. agents) that“manufacture, process, pack or hold (i.e., store)food” for human or animal consumption in theUnited States to register with the agency. Amongthe types of facilities covered by this regulation aregrain elevators, commercial feed mills, flour mills,corn and oilseed processing plants, pet food manufacturers, renderers and others. The facilityregistration requirement took effect on Dec. 12,2003. Click here for more information. USDA’s Uniform Grain and Rice Storage Bioterrorism Act Recordkeeping Regulations:Agreement (UGRSA) Contract: The U.S.Department of Agriculture (USDA) since Sept. 1,2004 has required that grain elevators entering intoa Uniform Grain and Rice Storage Agreement(UGRSA) contract with the Commodity CreditCorp. (CCC) conduct a facility vulnerability assessment and implement a facility security plan.UGRSA contracts are required for grain elevatorsthat store or handle CCC-owned grain, or that offermarketing assistance loans to producers under theU.S. farm programs. Among other things, Part IIIof the UGRSA contract – which addresses thewarehouse operator’s contractual responsibilities –specifically requires facilities to implement asecurity plan that “includes measures to protectgrain handled and stored” under the contract. Thefacility vulnerability assessment most warehouseoperators are required to conduct addresses fourmajor components: 1) The general security of thephysical structures and grounds of the grain storagefacility; 2) the warehouse’s shipping and receivingprocedures to ensure grain is “not subject toUnder the Bioterrorism Act of 2002, FDA requiresthose who “manufacture, process, pack, transport,distribute, receive, hold (i.e., store) or import foodinto the United States establish and maintainrecords sufficient to identify the immediate previoussource(s) and immediate subsequent recipient(s) ofsuch food, as well as transporters used to receiveand ship such products. Put simply, this regulationrequires “one-step-forward, one-step-back”product-tracing recordkeeping. The requirement tomaintain such records was phased in based uponthe size of the company, with larger firms requiredto do so starting Dec. 31, 2005, medium-sizedcompanies on June 9, 2006 and small companies onDec. 11, 2006. Among others, these recordkeepingrequirements apply to domestic and export grainelevators, feed and flour mills, dry and wet cornmills, and oilseed processing plants. Click here fora comprehensive NGFA compliance guide on thisstandard; click here for a comprehensive guide formillers authored by NAMA.4

Chemical Facility Antiterrorism Standard: The U.S. Department of Homeland Security (DHS) inApril 2007 issued a chemical facility antiterrorismstandard (CFATS) regulation, which may apply tograin elevators, commercial feed and feed ingredient manufacturers, flour mills, grain and oilseedprocessors, farm supply retailers and other food,agricultural and chemical facilities depending uponwhether they “possess or plan to possess” any ofmore than 300 “chemicals of interest” at thresholdquantities designated by DHS as potential threats oftheft, release or sabotage/contamination. Affectedfacilities are required to provide information aboutsuch chemicals and their operations to DHS using aweb-based tool known as “Top Screen,” and maybe required to implement more stringent facilitysecurity plans based upon the result of DHS’sanalysis. DHS has said it will audit implementationof such security plans. Click here for guidancedocuments on this standard prepared by the NGFAand NAMA.Personnel Security: Measures to confirminformation provided by job applicants hired forpositions that involve access to and handling ofhazardous materials covered by the securityplan. Employers are required to include themeasures they have implemented to confirminformation provided by applicants in thewritten security plan, but are not required todocument the results of their efforts to confirminformation on specific applicants. Unauthorized Access: Measures to addressthe possibility that unauthorized persons maygain access to the hazardous materials coveredby the security plan or to transport conveyances being prepared for transport of suchmaterials. En Route Security: Measures to address thesecurity risks of shipments of hazardousmaterials covered by the security plan en routefrom origin to destination, including shipmentsstored prior to shipment. Hazardous Materials Transportation Law:Agricultural facilities transporting specific chemicals, such as farm supply businesses, may becovered under the federal hazardous materialstransportation law and regulations implemented bythe U.S. Department of Transportation (DOT).Importantly, this law and regulations are distinctfrom the chemical facility antiterrorism standardand regulations cited previously. The hazardousmaterials transportation law authorizes the secretary of transportation to designate specific materialsor groups/classes of materials, such as fertilizersand pesticides, as hazardous when he/she determines that transporting the material in commerce ina particular amount and form may pose unreasonable risk to health, safety or property.DOT inspectors are authorized to review thesesecurity plans if they conduct a compliance reviewat the facility. Click here for more information onDOT’s hazardous materials regulations. Voluntary Private Sector Preparedness Stan-dards: A law (P.L. 110-53), enacted in August2007 to implement recommendations of the Congressional 9/11 Commission, contains a section(Title IX) creating a voluntary private sectorpreparedness standards program. The law authorizes the U.S. Department of Homeland Security(DHS), in consultation with the private sector, todevelop guidance or recommendations, as well as toidentify best practices, that assist or foster action bythe private sector to: 1) identify potential hazardsand assess risks and impacts; 2) mitigate the impactof a “wide variety of hazards, including weapons ofmass destruction; 3) manage necessary emergencypreparedness and response resources; 4) developmutual aid agreements; 5) develop and maintainemergency preparedness and response plans, andassociated operational procedures; 6) develop andconduct training and exercises to support andevaluate emergency preparedness and responseplans, as well as, operations procedures; 7) developand conduct training programs for security guardsto implement emergency preparedness and re-Regulations issued by DOT’s Pipeline and Hazardous Materials Safety Administration require thosecovered to develop and implement plans to addresssecurity risks associated with the transport of suchmaterials in commerce. Substances covered arethose, including fertilizers and pesticides, transported in a quantity that require the shipment to beplacarded. The security plan is required to be inwriting and include an assessment of possibletransportation security risks associated with theshipment, as well as appropriate measures toaddress those risks. At a minimum, the securityplan is to contain:5

tal shelf facilities, as well as all credentialed merchant mariners. Mandated by Congress underMTSA, all of the nation’s ports were required to bein compliance with the TWIC program by April 14,2009. TWIC requirements and information areavailable on the U.S. Coast Guard’s Homeport website at: http://homeport.uscg.mil/.sponse plans and operations procedures; and 8)develop procedures to respond to requests forinformation from the media and public. The lawalso requires DHS to enter into agreement with oneor more nongovernmental entities to create anaccreditation and certification program for facilitiesadopting consensus preparedness standards or bestpractices. Customs-Trade Partnership Against Terrorism (C-TPAT): Implemented by the U.S. Department of Homeland Security Customs and BorderProtection (CBP) division, this voluntary program isdesigned to provide tiered benefits to importers ofcargo, including expedited entry, depending upon thedegree to which such importers have implementedsecurity measures within their international supplychain. Program benefits are minimal until after CBPconducts an on-site validation of the user’s securitymeasures. C-TPAT participants receiving CBPcertification are given access to several potentialbenefits, including a reduced number of inspectionsand priority processing when inspections do occur.In addition, C-TPAT-certified importers haveaccess to “free and secure trade” (FAST) designated lanes at border-crossing points for C-TPATcompliant imports into the United States from eitherCanada or Mexico. C-TPAT also offers a “stratified exam” for import line items that are subjectedto inspection that allows the importer to move allbut the container that has the actual line item inquestion to their premises, thereby avoiding storagecosts at the border. Containers that are moved arerequired to remain sealed and available for inspection in the event CBP decides to examine them.Click here for more information on C-TPAT. Maritime Facility Security: Under the 2002Marine Transportation Security Act (MTSA), theU.S. Coast Guard on Oct. 22, 2003 issued finalregulations that require facilities that receivecommercial vessels greater than 100 gross registertons on international voyages – such as grainexport facilities – to develop and implement afacility security plan approved by the Captain ofthe Port, or a Coast Guard-approved alternativesecurity program meeting specific requirements.Other types of facilities required to develop facilitysecurity plans under the Coast Guard regulationsare those handling certain explosive or hazardouscargoes (including ammonium nitrate fertilizer orfertilizer mixtures), as well as facilities that load orunload barges with animal fats or vegetable oils.More information is available by clicking here.Among the requirements for MTSA-regulatedfacilities is to comply with the TransportationWorker Identification Credential (TWIC) program,operated jointly by the Coast Guard and Transportation Security Administration. TWICs are tamperresistant biometric credentials issued following asecurity background check to persons who requireunescorted access to designated secure areas ofMTSA-regulated ports, vessels and outer continen-ConclusionWe trust you find this guidance useful, and welcome your ideas and comments on additional information thatwould be helpful in further protecting facility security and the safety of the U.S. food and feed supply. Commentsmay be directed to:Randy GordonVice President, Communicationsand Government RelationsNational Grain and Feed Association1250 I St., N.W., Suite 1003Washington, D.C., 20005Phone: 202-289-0873Email: rgordon@ngfa.orgJess McCluerDirector of Regulatory AffairsNational Grain and Feed Association1250 I St., N.W., Suite 1003Washington, D.C., 20005Phone: 202-289-0873Email: jmccluer@ngfa.org6Jane DeMarchiDirector of Government RelationsNorth American Millers Association600 Maryland Ave., S.W.Suite 825 WestWashington, D.C., 20024Phone: 202-484-2200Email: jdemarchi@namamillers.org

Part IGuidance for Conductinga Facility Risk AssessmentThe starting point in developing a rational and prudentsecurity plan is to conduct a risk assessment of the facilityand its surroundings.put to the best use. It is this risk-assessment process thatprovides the basis from which all other security issues canbe addressed, including how many resources and what typeof security infrastructure or procedures will be committed tomitigate the potential for such an incident to occur.The risk-assessment process involves “out-of-the-box”thinking using an “all-hazards, total-risk approach.”Identify the assets, products and operations that constitutethe most realistic source of risk at the facility, such asnatural disasters (e.g., hurricanes, tornadoes, etc.), unintentional human or mechanical events or errors, and intentionalhuman actions. All aspects of the facility’s operation needto be considered, including receiving of inbound commodities, ingredients, products and materials; storage, handlingand processing; shipping and distribution; and other areas.Further, it requires making these determinations subjectivelyfrom the perspective of an attacker (whether an outsider orinsider), since risk is present whenever an attacker has theability, opportunity and desire to do harm.The following is a step-by-step approach for conducting afacility risk assessment.Step 1: Plan for Conducting a Risk AssessmentWhile many grain-handling, feed-manufacturing, flour andgrain-processing facilities have certain similarities, therefrequently are unique characteristics or considerations thatdeserve individual attention and thought when conductinga facility risk assessment.Generally, grain, feed, feed ingredients, flour and othergrain-based products may be contaminated by:It involves thinking about: How likely is an attack on the facility or one of its keyassets? How harmful will such an attack be if it does occur andsucceeds? What impact will an attack on other key assets (e.g.,transportation, power sources) have on the facility’sability to recover and resume operations?Think about this from a triad approach: Is there a desire ormotive of an individual to do harm to the facility? Does theindividual have the physical or mental capability to carryout an incident? And does the individual have an opportunity to carry out an incident? Importantly, one of the major goals of the risk-assessmentprocess is to differentiate between real, versus perceived,risks, so that scarce human and financial resources can be biological agents (such as toxins, bacteria,viruses, parasites, etc.); chemical agents (such as nerve gas and toxicindustrial chemicals – pesticides, rodenticidesand heavy metals); radiological agents (such as those that can bedelivered in liquid or solid form); and/or physical agents (such as ferrous and non-ferrousmetal, glass and plastic).Consider Who to Designate to Conduct the RiskAssessment: Consider designating an experiencedcompany individual to be the “security coordinator” atthe facility. In many cases, this may be the personalready responsible for safety, health and environmental compliance. In other cases, it may be the manager.For facilities engaged in multiple operations, such asgrain handling, feed manufacturing, grain milling andfarm supplies, consider a “team” approach consistingof cross-functional representation from the differenttypes of operations in which the facility is engaged.The person(s) designated with this responsibilityshould be objective and empowered to make a thor-7

ough, honest and realistic assessment of the facility’ssecurity given the type of commodities handled, type ofoperation(s), location and surroundings (neighborhood). Identify Critical Physical Assets: Knowing andidentifying the facility’s most valuable physical assetsare essential to any security plan. This allows limitedsecurity resources to be used most efficiently. Examplesof potential critical assets include: Receiving areas (rail/truck; liquid and dry) –potential contamination points. Energy sources (transformers, gas service, fueltanks, boilers, air compressor equipment) –potential critical infrastructure targets. Control rooms and motor control rooms –potential critical infrastructure targets. Information technology (e.g., computer)system – potential critical infrastructure target. Production processes (e.g., mixers) – potentialcontamination point. Bulk trucks/delivery – potential contaminationpoints. Access to product storage to finished andproduct materials – potential contaminationpoints. Hazardous chemicals – potential threat agent.Consider the Degree to which Risks May Exist: Forinstance, consider the:types and capacity of storage at the facility; effectiveness of controls on access to thefacility and grounds; history of previous incidents or “close calls”;number of employees; satisfaction level of employees and the degreeto which some of them bring personal problemsinto the workplace; and surroundings and characteristics of theneighborhood in which the facility is located.Other factors to consider include:Consider Most Likely Types of Risk and Who MayPose Them: Before conducting a facility risk assessment, consider the type(s) of risk (sabotage, threat orattack) and whether it most likely could originate froman internal source (such as from a disgruntled employee) or external entity (such as an activist, terrorist ordisgruntled neighbor). Your facility’s location – urbanor rural – and the type of operations in which it’sengaged (such as strictly grain handling, or also feedmanufacturing, flour milling and/or farm supply enterprise) may have a bearing on the types of vulnerabilitiesto which attention should be paid. Potential threat intentions [for instance, arethere or have there been any threat(s) to thecompany or facility, or a history of troublesome activity in the area]. Specific targeting [does the company name, itsnotoriety or the nature of the facility’s activitymake it a likely target?]. Visibility and recognizability of the facility andits operations within the community. Potential on-site hazards [such as the presenceof hazardous materials, biologics or chemicals that potentially could be used as a threator weapon]. The security environment and overall vulnerability of the facility to attack [e.g., theeffectiveness of security procedures used at thefacility; public accessibility to facility; natureof facility assets; degree of law enforcementpresence in area; etc.]. Critical nature of the facility’s products andservices [e.g., nature of the facility’s assets(hazardous materials, uniqueness andpotential danger); importance of the facilityto the infrastructure and continuity of basicservices to the community, state or nation;etc.]. The “cascading” impact an attack could haveon the facility or on the supply chain/infrastructure upon which the facility depends. The presence of large numbers of people at thefacility who could be harmed. The pote

vides a sample template for developing a facility security plan. How this Guide is Organized This document is organized in the following manner: Part I provides guidance for conducting a facility risk assessment. Part II provides guidance for developing and implementing a facilit