Blog

As the FSO, you get this! After all, your job depends on it. The company is depending on you. The local community and beyond is depending on the company. Trade secrets, competitive advantage, threats, vulnerabilities… the list goes on. Oh, and Coast Guard Inspectors do make unannounced visits to ensure you’re in compliance with MTSA, 33 CFR 105, NVIC 03-03 Change 2, and NVIC 03-07 along with other applicable regulations.

Remember the 3 P’s of access control –

• Physical – security infrastructure and systems
• Presence – bearing and attitude of security force personnel
• Performance – security training, experience and application

The first of the 3 P’s, Physical security, forms the first impression – for compliance with the regulations, as well as target desirability for the would-be attacker. Is the physical security well maintained, shiny and new looking, or not so much?

We’re talking about things like fencing, vehicle/rail/pedestrian gates, emergency egress points, sensor detection systems, lighting, and operational and/or security camera systems. Much of this is not specifically spelled out in the CFR. Look to security Best Practices and Industry Standards; and/or look to Seebald & Associates for their expertise by giving us a call.

The more sensitive the facility/product/location, the more formidable the physical infrastructure should be. Ask yourself, is your facility a hard or soft target?

We’ve listened to your feedback! The blogs this month are designed to you assist you in controlling facility access points and remaining compliant with random screening requirements. Topics include:

3 P’s of access control –

• Physical – security infrastructure and systems
• Presence – bearing and attitude of security force personnel
• Performance – security training, experience and application

Just what does random screening mean?

Random screening is just that – screening that occurs without definite aim, reason, or pattern. Random is NOT every 10^th person or vehicle. You are required to develop a protocol for randomizing your screening. A best practice in random selection is the “Marble Method,” which is recognized and approved by the Coast Guard. Other randomizing techniques may include a software program that randomly selects a person or vehicle to screen. DO NOT rely on individuals determining off the top of their head when to screen – their choices are NOT random.

Randomizing your screening makes your access control effective by eliminating predictability, and will deter folks entering your facility from trying to bring on prohibited items. A random screening protocol will increase your facility’s security reliability!

Join us this month while we review the regulatory requirements for the sake of building your security awareness. Suggested Reading – 33 CFR 105.255.

An FSP is required to be resubmitted every five years to include a new FSA. You are required to submit one copy of the FSP for review and approval to the cognizant COTP and a letter certifying that the FSP meets applicable requirements of Subpart D – Facility Security Plan. The FSP must be submitted 60 days prior to allow the COTP enough time to review, and if your FSP consists of new operations, then you cannot start operations until your FSP is approved. The COTP will examine each submission for compliance and either:

• Approve it and specify any conditions of approval, returning to the submitter a letter stating its acceptance and any conditions;
• Return it for revision, returning a copy to the submitter with brief description of the required revisions
• Disapprove it, returning a copy to the submitter with a brief statement of the reasons for disapproval

Remember, completing a thorough and proper FSP, which is based on your FSA, is a lengthy process and you should not wait until the last minute. When Seebald & Associates conducts an FSA, and writes an FSP we start the process at least 6 months before your FSP is due for submission.

There is often confusion on when an amendment to your FSP is only needed or when an audit in addition to an amendment is required. Essentially, an amendment documents a change to your FSP and maybe initiated by the owner or operator or the cognizant COTP to maintain the facility’s security. If the facility owner or operator initiates the amendment, the proposed amendment must be submitted at least 30 days before the amendment is to take effect unless the cognizant COTP allows a shorter period.

If the COTP gives the facility written notice an amendment is required, the facility owner or operator will have at least 60 days to submit its proposed amendments. Until the amendments are approved, the facility owner or operator shall ensure temporary security measures are implemented to the satisfaction of the COTP.

You amend your plan when there is a change to your FSP such as a new FSO or Alternate FSO is assigned. Where the confusion lies is when an audit is required to be conducted along with an amendment. Such as the case when the owner or operator at the Facility changes, the FSO must amend the FSP to include the name and contact information of the new facility Owner or Operator and submit the affected portion of the FSP for review and approval to the COTP as well as conduct an audit for submission to the new Owner or Operator. Other examples where the FSP must be audited along with amendments are if there have been modifications to the facility including but not limited to physical structure, emergency response procedures, security measures or operations. There is an inclination to only submit an amendment on these changes when actually an audit is required as well. Auditing the FSP as a result of modifications to the facility may be limited to those sections of the FSP affected by the facility modifications. If the change in operations and modifications to the facility are significant enough, the audit will determine if you need to complete a new FSA and rewrite of the FSP. This is laid out in 33 CFR 105.415. Visit our February blogs for more information on your FSP audit.

Remember – before you draft an amendment or conduct an audit, be sure to check with Seebald & Associates or your local COTP to provide you with the proper way ahead.

The facility owner or operator must ensure the FSP consists of the 18 individual sections listed below per 33 CFR 105.405. If the FSP does not follow the order as it appears in the list, the facility owner or operator must ensure the FSP contains an index identifying the location of each of the following sections:

1 – Security administration and organization of the facility

2 – Personnel training

3 – Drills and Exercises

4 – Records and Documentation

5 – Response to change in MARSEC level

6 – Procedures for interfacing with vessels

7 – Declaration of Security (DoS)

8 – Communications

9 – Security systems and equipment maintenance

10 – Security measures for access control, including designated public access areas

11 – Security measures for restricted areas

12 – Security measures for handling cargo

13 – Security measures for delivery of vessel stores and bunkers

14 – Security measures for monitoring

15 – Security incident procedures

16 – Audits and security plan amendments

17 – Facility Security Assessment

18 – Facility Vulnerability and Security Measures Summary (Form CG-6025)

The FSP must describe in detail how the requirements of 33 CFR 105 subpart B Facility Security Requirements will be met. Note that when Seebald & Associates helps you in writing your FSP, there are additional FSP sections that we create to improve your FSP, make it meaningful, and easier to use.

What is a Facility Security Plan? It is more than a plan describing your facility’s security measures. This month’s S&A blog series focuses on what is your FSP’s purpose; What content is required in your FSP; Amending and Auditing your FSP; and Your FSP Submission and Approval.

A Facility Security Plan (FSP) is a promise to the U.S. Government that you will carry out documented security measures to protect your facility. The FSP must identify the Facility Security Officer by name and position, and provide a 24-hour contact information. It is a written plan that identifies vulnerabilities and how to deal with security threats captured in the Facility Security Assessment (which we covered in last month’s blogs). Your FSP defines the roles and responsibilities of all facility employees – FSO, Personnel with Security Duties and All Others. The FSP also describes security measures to be taken for each MARSEC level as well as defines appropriate actions in emergency situations. The FSP is required for re-submission every five years on its anniversary date. Also remember, the FSP is Sensitive Security Information and must be protected per 49 CFR part 1520.

Friends and Maritime Professionals,

We pray for our fellow professionals and hope they and their families are safe and sound in the aftermath of Harvey. Whenever we go through a crisis, we focus (as we should) on our families, loved ones, and friends. Lower on our list of priorities is often the security of our facility.

We learned many lessons during and after events like Super Storm Sandy and Hurricanes Katrina, Ike, and Rita, when complete facilities were under water. Many facilities had no operational back-up plans, or their plans overlooked the security aspect of recovery. Other facilities had plans, but did not exercise or practice their plans, so the stage was not set for success when the time came for action.

While those affected by this storm respond and recover, we can take this moment to ensure our Facility Security Plans are fully integrated with our Emergency Response Plan and Natural Disaster Plans. The time to test our FSP is not when the storm hits!

While there are many aspects to security’s role in an event requiring emergency response, some minor preparation can save countless hours in the recovery operations aftermath. Your security continuity of operations plans should address protecting your facility and what remains after an event.

For example, simple things like protecting your Sensitive Security Information and having electronic back-ups should be on your checklist. Maintain a secondary site for your SSI material. When disaster strikes and you have to conduct a full evacuation, you should have at least electronic copies of your Plans, including your FSP, and lock up your documents in a Restricted Area. If your hard copies are completely destroyed, then you can reproduce your (password protected) files from an external memory device. If you find yourself in this situation and your documents are destroyed, then we can help you recover with a documentation kit that can be repopulated with your documents very quickly.

Remember, we all need to stay prepared. Integrate your facility’s plans, exercise your plans, conduct drills to test individual elements of your plans, and use checklists to ensure consistent, reliable performance.

Keep your powder dry…

ed

We audit a lot of Facility Security Plans, so we get to see many Facility Security Assessments. This week we’ll look at the good ones, the bad ones, and the “how the heck did this ever get approved?” ugly ones.

It’s easy to find the good FSAs – they comply with Subpart C of 33 CFR 105 and have all the “Satisfactory” blocks checked in Enclosure 3 to NVIC 03-03 Change 2. The FSA is contemporary (no more than five years old) and it includes a quality Risk Based Analysis. Many facility respresentatives participated and their viewpoints are reflected in the FSA.

Bad FSAs miss key elements we discussed in previous blogs – they don’t include a wide represtation of the many aspects of a facility (Managment, Human Resources, Operations, Engineering, Maintenance, Security, IT/Cyber, Legal, Safety), they don’t reflect current threats (Does your FSA consider Cyber & Active Shooter threats>), and they don’t fulfill the many regulatory requirements (Check the checklist!)

It’s not rare to find ugly FSAs. Heck, even, sometimes we see FSPs that don’t contain an FSA at all! Incredible as it seems, there are Coast Guard approved FSPs that don’t have an FSA – thats ugly on the facility and the Coast Guard. Also, there are far too many FSAs that do not contain a Risk Based Analysis (RBA). That’s “low-hanging fruit” for your Coast Guard Inspector’s deficiency list. If you don’t have an RBA, then your FSA is incomplete. Lastly, if your FSA contains the same typos as its predecessor, then you probabley have yourself a gun-decked FSA. That’s not only lazy, it’s a set-up for failure.

Remember, you can and should have an FSA that services as the foundation for your facility security organization. It takes expertise, energy, and time to build your reliable foundation, but it’s worth it in the long run.

One of the persistent questions from our students and mentees involves how to conduct a Facility Security Assessment. If you refer to Subpart C of 33 CFR 105, you can see that the Coast Guard spends a lot of effort to ensure we cover all the bases in our FSA. Also, Enclosure 3 to NVIC 03-03 Change 2 gives you the checklist your Coast Guard Inspector should use when reviewing your FSA.

As we previously noted, you need expertise, energy, and time to assemble the facility’s background information, conduct an on-scene survey, compile observations, analyze the data, and make recommendations to improve security performance – thus, mitigation business, operational, and compliance risks. That’s already a lot of work! Your FSA should contain the many areas of emphasis that reflects your facility’s vulnerabilities and mitigation actions that can reduce your risk exposure. Using a checklist (like the one in Enclosure 3 to NVIC 03-03 Change 2) helps ensure your FSA addresses the key elements.

But it’s not about just checking the boxes. Writing the FSA takes quite a lot of perspective and effort. You need to document how the FSA was conducted, the facility elements your FSA addressed, a list of things “important to protect,” the faciltiy’s vulnerabilities, and a discussion and evaluation of key facility measures and operations. That’s a lot of ground to cover!

Remember, your FSA must be a product of many facility viewpoints! A one- or two- author FSA that doesn’t involve the many experts on your facility is a prescription for a narrow-minded assessment.

Ultimately, the Facility Security Officer is responsible for ensuring that the Facility Security Plan is based on a quality Facility Security Assessment. We at S&A audit a lot of FSPs, and a lousy FSP is often linked to a poor FSA. That reflects poorly on the FSO, the FSP, and then entire Facility Security Organization (remember the pyramid!)

The FSA must involve representatives from as many facility disciplines as possible – Management, Human Resourses, Operations, Engineering, Maintenance, Security, IT/Cyber, Legal, and Safety to name a few. It takes expertise, energy and time to do an FSA! Most FSOs have the expertise and energy, but few have the time. That’s why many FSAs are superficial, and all too many are simple repetitions of the previous FSA- many times including the same typos! If you don’t have all three requirements (expertise, energy, and time), then you need help conducting a trustworthy FSA.

Remember, if you want a solid FSP, then you need a reliable FSA. There’s no getting around it.