Blog

Maritime Security Colleagues,

You may have heard that the TWIC Final Rule implementation date may be delayed as the Coast Guard considers reopening the rule for further comment. This news comes from a report of a recent meeting between the Coast Guard, congressional representatives, and industry. We made inquires to clarify this report. The verdict is still out on its accuracy. We’ll keep looking for an official Coast Guard statement on this and will pass it to you as soon as we receive it.

In the meantime, how does this impact you? If you’re a Risk Group A facility, you can continue your planning toward impleneting electronic TWIC readers. We still advise you to wait on purchasing any electronic TWIC readers or integrated Physical Access Control System pending more specific Coast Guard guidance.

Physical Access Control System – PACS can satisfy the requirement for electronic TWIC inspection on Risk Group A facilities in one of two ways:

– PACS (with facility access card) registered to an individual whose TWIC and biometric data is stored in the facility’s access control system. The facility access card holder presents access card, submits biometric at entry point and the system validates the TWIC card has not been canceled or expired against the TSA Canceled Card List (CCL).

– PACS (with biometric only) registered individual whose TWIC and biometric data is stored in the facility’s access control system. The indiviual submits biometric at entry point and the PACS validates the TWIC card has not been canceled or expired against the CCL.

Remember – Everyone in a PACS authorized to access the secure or secure-restricted portion of a maritime facility is also subject to random screening.

During the month of May, we covered the TWIC Final Rule that requires Risk Group A maritime facilities to incorporate TWIC readers into their maritime security regime no later than August 23, 2018. This month we’ll continue that discussion as it relates to TWIC reader technology. Additionally, given the recent Ransomware cyber attack, we’ll review ways to enhance your cyber security to help prevent becoming a cyber statistic.

TWIC reader technology is continually evolving. TSA and the Coast Guard recognize this reality; there are three options for facilities to comply:

• Purchase a TWIC reader from TSA’s Qualified Technology List, or

• A TWIC reader thata adequately performs and electronic TWIC inspection:
– Card Authentication
– Validity
– Holder Identity

• Use a Transparent reader, which sends the TWIC information with biometric to a back-end system that performs card authentication, validity, and holder identity authentication.

Remember – Everyone presenting a TWIC, along with a reason to access the secure or secure-restricted portion of a maritime facility is also subject to a random screening.

But wait! There is another TWIC reader option that we’ll cover next week.

How August 23, 2018, or 448 days and a wake up. That’s when your Risk Group A facility must be read to go, which includes:

• Having the required electronic TWIC readers or PACS operational.

• Having a Coast Guard COTP approved FSP or FSP amendment that includes electronic TWIC inspection.

Remember, you should plan to submit your new FSP (that will require a new/updated FSA) or FSP amendment in ample time to obtain Coast Guard approval. That means at least 60 days prior to August 23, 2018. Trust us, it’ll take you at least 60 days to adequately prepare/amend your FSP to meet the TWIC Final Rule requirements. All considered, that’s 120 days before August 23, 2018.

Are you paying attention? August 2018 just became April 2018 on your TWIC Final Rule planning calendar. That’s the latest when you should be underway and making way in preparing to comply with the TWIC Final Rule.

Thoroughly review the TWIC Final Rule requirements and research wisely in what system will meet your needs. Be wary of vendors trying to sell you more than what is needed! Develop contingency plans for when your TWIC readers or PACS malfunction. Remember your documentation requirements – how will you record the information, which is Sensitive Security Information and where will you maintain the entry records in a restricted area for two years?

How can Risk Group A facilities comply with TWIC Final Rule requirements? These are some of the capabilities and capacities to bring you into compliance:

• TWIC Readers & Physical Access Control Systems (PACS) – Not required to be stationary/fixed – portables are acceptable

• TWIC Reader – If not on TSA’s Qualified Technology List (QTL), it must meet electronic TWIC inspection requirements. You can verify if your TWIC reader is approved by check the TSA QTL at: https://homeport.uscg.mil/mycg/portal/ep/contentView.do?contentTypeId=2&channelId=-24886&contentId=544123&programId=50398&pr

• PACS – facilities are authorized to enhance their current PACS to meet electronic TWIC inspection requirements.

• TWIC Reader or PACS malfuntions – Must have a back-up system or portables that perform Electronic TWIC inspection requirements (Note: A visiual inspection is NOT authroized.)

• If your electronic TWIC reader fails and you do not have an operable back-up, you MUST report it to COTP and obtain permission to operate. The Coast Guard will require suitable risk mitigation before granting permission to operate.

• TWIC Reader or PACS – must record/document ENTRY into a secure area and Risk Group A facilities are required to maintain these records for two years.

Remember:

The TWIC Final Rule is a credentialing law, it does NOT replace screening.

Greetings, Facility Security Colleagues,

The Coast Guard Office of Port and Facility Compliance (CG-FAC) recently released their 2016 Facility Year in Review. While busy with many initiaves, TWIC and reporting Suspicious Activity and Breaches of Security were prominent.

The Coast Guard published a policy letter regarding criteria and procedures for reporting Suspicious Activity (SA) and Breaches of Security (BoS). (Note: We’re already addressing this in our courses, audits, assessments, and plans.) Basically, the Department of Homeland Security (DHS) National Cyber Security and Communications Integration Center (NCCIC) may be contacted directly for cybersecurity incidents and suspicious activity NOT resulting in phyical or pollution effects (physical and pollution incidents must be reported to the National Response Center (NRC)). When reporting a cybersecurity SA or BoS, maritime owners and operators must identify themselves as a MTSA regulated entity in order to satisfy the reporting requirements of 33 CFR 101.305. NCCIC will document the activity, evaluates it against operations, provides technical assistance if requested, and passes the information to the NRC. Information-sharing between NCCIC and NRC may contain Sensitive Security Information and is protected per 49 CFR 1520.

In 2016, the Coast Guard conducted 6,002 MTSA compliance inspections covering 3,476 MTSA regulated facilites, resulting in 1,648 deficiencies. This resulted in 180 enforcement activites. More than half of the citations were in three cateories: Security Measures for Access Control (61), Owner or Operator Requirements (32), and Drill and Exercise Requirements (17). Remember from your training, Access Control is crucial in your first line of defese against security incidents.

Over 54,000 TWIC cards were inspected visually or electronically resulting in 515 instances of non-compliance. This shows that facilities are not preoperly inspecting TWIC cards or individuals are not carrying them when working on the regulated secure footprint. Remember, TWIC cards need to be inspected at 100% and everyone must have them on their person.

There is a lot of interesting information in the 2016 report, such as Rulemakings, Training, Cyber Risk Management, and much more. Please take the time to read it and learn how these policy changes or recommended advice affects your facility. Have a safe and secure day.

Under the TWIC Final Rule, electronic TWIC inspection is required each time a person is granted unescorted access to a secure area for facilities in Risk Group A. TWIC readers or a Risk Group A facility’s Physical Access Control System (PACS) must perform three functions:

1. Card Authentication – The TWIC reader or PACS determines that the TWIC is authentic via the Card Holder Unique Identification (CHUID) and validates the Federal Agency Smart Credential – Number (FASC-N)

2. Card Validity – Checks the TWIC against the Cancelled Card List (CCL), which determines whether a TWIC is valid (i.e., not revoked or expired.) Learn more about the TSA CCL at https://universalenroll.dhs.gov/

The TWIC reader or PACS must stay current with the CCL, with the following update requirements:

• MARSEC 1 – update CCL every 7 days

• MARSEC 2 & 3 – update CCL daily

3. Identity Verification – The TWIC reader or PACS verifies the card holder’s identity, which is confirmed with accepted biometrics templates:

• Fingerprints

• Digital facial image with PIN (Do you remember your TWIC’s PIN?)

• Alternate biometrics (vascular) are authorized if this biometric temnplate is tied to the TWIC holder & approved with your FSP

This month’s Seebald & Associates blogs focus on the TWIC Final Rule impacts of Who needs it? What is needed? How you can meet the requirements? What are your Next Steps? When you need to submit your amendments or new FSP to be compliant

The TWIC Final Rule defines Risk Group A as facilities that handle Certain Dangerous Cargo (CDC) in bulk or receive vessels carrying CDC in bulk, as well as facilities that receive vessels certificated to carry more than 1,000 passengers.

Bulk or in bulk means a commodity that is loaded or carried on board a vessel without containers or labels, and that is received and handled without mark or count. This includes cargo transferred using hoses, conveyors, or vacuum systems.

There seems to be a level of confusion in industry as to what determines whether a facility is a CDC facility or not regarding the TWIC Final Rule, especially facilities that receive CDCs by truck or rail. Because of this confusion, the Coast Guard is considering additional guidance, policy determinations, and/or regulatory updates. Seebald & Associates will stay tuned for guidance the Coast Guard provides and we’ll keep you up to date on Coast Guard policy decisions.

Still, lack of guidance does NOT relieve you of being compliant with the TWIC Final Rule – because it is the law.

33 CFR 105 requires the Owner/Operator (read as ‘FSO,’ that’s YOU!), to conduct an Audit annually. This is the FSO’s opportunity to show the Auditor, your ‘critical best friend,’ how well you know your duties and are doing your job; nearly instantaneous feedback on how you’re doing as an FSO, now that’s job satisfaction! (Assuming you know the regulations and what the facility’s FSP says; and are routinely conducting drills and applying best practices and lessons learned.)

If the Owner/Operator/FSO are not gaining security perspective and insights from your Auditor every year, it’s time to bring on the regulatory and practical experience that comes with each Seebald Associate; we pride ourselves in being your expert ‘critical best friend.’

Have you and your alternates attended a certified FSO Course or FSO Refresher Course? The FSO Course is recommended every 5 years, the FSO Refresher Course every 2-3 years. See Seebald.com for a location and date that works for you; or give Ed a call and arrange a private course tailored for you, your facility and personnel.