Blog

According to the 2016 Coast Guard Office of Port and Facility Compliance annual report, eleven percent of enforcement actions are due to Facility Security Plan citations. One of the biggest challenges facing a Facility Security Officer is ensuring your Facility Security Plan is solid. Recall your FSO training and the Security Organization Pyramid.

Your FSP is based on the Facility Security Assessment required by 33 CFR 105 and explained in NVIC 03-03 Change 2. Your FSA is critical in summarizing your facility’s vulnerabilities and security measures used to mitigate them. Without a solid FSA, your FSP is a house built on sand. This month’s S&A blogs will focus on your FSA – Who conducts FSAs, How to do an FSA, What’s in a reliable FSA, and Common Faulures we see in FSAs when we audit FSPs. Stay tuned!

Key Responsibilities:

– Strategic management and implementation of the Corporate health and safety standard an d performance measures.
– Oversee Corporate health and safety programs designed to train and motivate personnel to minimize occupational accidents, injuries and hazards.
– Coordinate the development and implentation of Health and Safety Plans, Documents and Systems including, but not limited, to Emergency response, Incident Investigation, Business Continuity, HSE Management System, Behavior Based Safety Programs, and Internal audit programs for all Compnay Assets, including liquefied natural gas (LNG) terminals, pipelines, and new Projects as nexessary.
– Direct and support Terminal and Pipeline HSE Managers in the implementation of the health and safety programs, procedures, and guielines for construction, operations and maintenance activities.
– Monitors and reviews all new Health and Safety regulatory initiatives and ensures compliance with existing regulations dealing with health and safety. Review all major captial projects and other projects to ensure compliance with health and safety-related regulations.
– Develop a comprehensive, logical and coherent emergency response philosophy with policies and procedures aimed at safeguarding personnel and resources at the LNG terminals and pipelines.
– Oversee and support safety initatives and activties at asset locations such as emergency response procedures and safety drills.
– Support and coordinate health and safety needs and programs for long-term constrution projects. Including close coordination with EPC contractor leads, and communication to Corporate Management on safety trends. Offer suggestions and feedback to EPC contractors on observations and potential areas of improvement.
– Audit EPC contractors on the implementation of their respective HSE Management Systems while working on projects.
– Participates in the development of the annual O&M budget and cost control process, specifically costs related to health, safety, training and fire protection.
– Represent the Company in industry association meetings, and at other meetings pertinent to LNG. Educate the public on LNG by speaking to civic and professional organizations.
– Coordinates with Human Resources on HS staffing-related activties including recruiting, interviewing, selection, hiring, discipline, development, training, promotions, etc.

Experience:

– Minimum of ten years of related experience with at least seven years of management experience. Recent terminal operations or relevant experience including health and safety. Experience designing, documenting, implementing and testing safety procedures.

Qualifications:

– Bachelor’s Degree in engineering or relevant techinical discipline. Certification in safety (CSP), industrial hygenie, or enviromental management.
– Strong leadership and administrative abilities
– Exceptional written, verbal and interpersonal communication skills.
– Ability to communicate effectively at all levels of an organization and with individuals and groups from different disciplines, industries and governmental agendies.
– Organized and able to manage multiple activties and programs timely and with a high degree of accuracy.
– Exceptional problem solving and analytical skills.
– Accomplished public speaker, able to create and deliver industry-specific presenations.

Reporting:

– Reports to VP, Health Safety, and Environmental
– Direct reports include:
– Industrial Hygiene Specialist
– Manager, Health and Safety

Travel:

– Job is performed in a both a typical office environment and construction sites.
– Required to travel to Asset locations, as buisiness conditions dictate.

Please send inquires to gretchen@seebald.com
Subject Line: Director of Health and Safety

Maritime Security Colleagues,

Yesterday RADM Paul Thomas addressed the American Association of Port Authorities regarding physcial & cyber security, and the threat of complacency, as reported in the Coast Guard Maritime Commons. We at Seebald & Associates apprecated RADM Thomas’s sentiment that

“The face of the matter is that regulation can help form a baseline or foundation for a secure port facility – but it can never really provide security. That’s your job.”

I suggest you read RADM Thomas’s remarks. THey convey a keen sense of what we see in the field nationwide practically every day when we conduct facility security training, audits, and assessments. Regulations and agency guidelines establish our standards. Whether it’s physical or cyber security, the onus is on each facility and individual to make security work, and in turn our Nation’s maritime border more secure.

As the FSO, you should ask your Cybersecurity staff, or the IT staff if your company does not yet have a cyber security department:

– Is our Cybersecurity policy in writing?

– Is the policy up-to-date?

– How often are our computers updated with the latest security patches?

– Are our computers and the network backed-up at least daily?

– Are thumb drives or other devices permitted to be plugged into our computer system?

For more information, checkout the FBI’s Randsomware website:
https://www.fbi.gov/file-repository/ransomware-prevention-and-response-for-cisos.pdf/view
Soon, your Coast Guard Compliance Inspector will be asking more specific Cybersecurity-related questions and Coast Guard guidance will be forthcoming on how and what will be required. The best way to prevent being a cyberattack victim, and be best prepared to respond to the Coast Guard’s questions, is by working closely with your cyber or IT department.

Exercises also need to be conducted as required. These don’t need to be a major undertaking. The important thing here is to include all of your key personnel (FSO, Alternate FSO, security supervisor, terminal manager, operations supervisor, etc.) A tabletop exercise is the most manageable process. The key is to test all aspects of your plan through the three MARSEC Levels. If a vessel is at the facility, invite their VSO or master to participate.

Much like drills – Plan, Execute, Evaluate and Document.

Remember that Drills and Exercises are conducted to improve the security of your facility …… not just to meet a regulatory requirement!

We all know that to get better at anything (golf, tennis, etc.) you need to do it frequently and with intensity and focus. The same is true for conducting Drills. Although the regulation requires one every three months, that level of frequency just can’t make you better. We need to conduct at least one drill each month to improve our security posture and capability. Keep the drills simple. Our Seebald and Associates Platinum Members receive a Drill every month from us. Use it!

We also recommend a simple process:

Plan – Select or design a drill and the personnel involved;
Execute – Conduct the drill as planned;
Evaluate – As the drill proceeds, take notes and then evaluate the performance of your personnel. This is not a time to teach;
Document (Lessons Learned) – Summarize the performance of personnel and identify the Best Practices and those issues that need to be addressed. Complete that paperwork and include it with your Records & Documents.

Last week we addressed the regulatory requirement for Drills and Exercises, but there are more important reasons for conducting these. At a truly secure facility, the FSO must know the security strengths, weaknesses and vulnerabilities. In order to accomplish this, drills and exercises are used to test your FSP and test your personnel. A powerful way to uncover potential weaknesses is to conduct meaningful drills. Are there confusing or ineffective parts of your FSP? Are there post orders that are confusing to your security guards (PSDs)? Are there particular guards that need re-training or does the entire guard force need a training refresher? Frequent drills improve your FSP, strengthen the skills of your people, and make your facility more secure!

Next week we’ll address some tips & tricks for conducting drills.

…It’s the law! Let’s start by reviewing the regulatory requirements for Drills and Exercises. 33 CFR 105.220 requires that all facilities conduct at least one drill every three months and must test one element of the Facility Security Plan (FSP), including response to security threats and incidents. Drills should take into account the types of operations of the facility, facility personnel changes, the type of

vessel the facility is serving, and other relevant circumstances.

Exercises must be conducted at least once each calendar year, with no more that 18 months between exercises. Exercises are a full test of the security program and must include substantial and active participation of FSOs, and may include government authorities and vessels visiting the facility.

We’ve highlighted it several times, and discuss it in every training session we conduct. The Cyber threat is a real and present danger!

The WannaCry Ransomware Attack is the most recent, highly publicized breach of cyber security event. WannaCry is the most wide-spread, globally coordinated cyberattack of its kind; affecting multiple businesses and organizations in 150 or more countries, and infecting some 200,000 computers. However, there are many attacks or attempted attacks we never hear about.

Ransomware is designed to encrypt any file it reaches and lock it until ransom money is paid and then the file is unlocked. Ransomware’s objective is to take control of your network.

The takeaway here is – Make sure your IT or Cyber staff is backing up your network on a regular basis if not daily to avoid becoming a Cyber victim.

Next week we’ll discuss what you as the FSO can do, in coordination with your Cybersecurity and/or IT staff, to deter Ransomware or other types of cyber-attacks.

We’ve confirmed with our Coast Guard contacts that there most likely will be a delay in implementing the TWIC Final Rule. Bottom line is Don’t make any big decisions until the government provides further information. The Coast Guard is exploring all options and will issue guidance. We at Seebald & Associates expect that guidance in the coming months.

We’ll strive to be the first to keep you informed with maritime security news and perspective. Be well – Stay secure & safe!