Thank you to everyone who tuned into the 2021 Chemical Security Seminars! These live, virtual events were a great way to continue to engage with our chemical security partners across the nation, while still being mindful of the ongoing pandemic.  

 The themes for the three weeks included chemical threats and countermeasures, cyber threats and emerging trends, and chemical security planning and preparedness.  

 Select presentations from each week are now available. Please continue to check out the Chemical Security Summit webpage for news about the 2022 Chemical Security Summit.  

Facilities that are required to report their chemicals of interest to CISA as part of the CFATS program do so via the Chemical Security Assessment Tool (CSAT) 2.0. The CSAT 2.0 portal is also the location where facilities review official correspondence and submit any other required documentation, such as site security plans. CISA encourages facilities to periodically review the roles they’ve set for their employees to ensure they’re up to date with current operations and duties. 

There are five user roles that a facility can set for their personnel depending on their role so that they can access the CSAT 2.0 Portal: Authorizer, Administrator, Submitter, Preparer, and Reviewer. Each of these roles is designed to assist a facility in setting up their profile to work most effectively for their business operations. For more information about these roles or how to use CSAT 2.0, please see the CSAT Portal User Manual posted on the CSAT webpage.  

Authorizer:   

The Authorizer role can register facilities, invite other individuals to register with CSAT, manage user roles, view surveys, and transfer the Authorizer role to another individual.  Note: There can only be one Authorizer per facility.  

To receive access to CSAT, an Authorizer must first register on the CSAT Registration webpage. The registration process will allow an Authorizer to register one or more facilities at a time. CISA will validate the registration and notify the user on how to access CSAT. The Authorizer can then invite new or existing CSAT users to gain access to their facility data to complete CFATS requirements.  

If a facility has access to the Personnel Surety Program (PSP), see below for additional privileges.   

Administrator:  

The Administrator role can create facilities and manage users but cannot review any survey information. Note: There can be multiple Administrators per Authorizer.   

Users with the Authorizer and Administrator role have user management capabilities that allow them to add, change, or delete users for any CSAT role for that facility. 

Submitter:  

The Submitter role is responsible for filling out, editing, and submitting the surveys in CSAT, and is the only role that can submit a completed survey to CISA. A Submitter role can also manage the Reviewer and Preparer roles. Note: There can only be one Submitter per facility. An individual can be assigned to the Submitter role for multiple facilities.  

Preparer:  

The Preparer role fills out or edits the surveys in CSAT but cannot submit a completed survey to CISA. Note: There can be multiple Preparers per facility.  

Reviewer:  

The Reviewer role can view the surveys in CSAT in read-only permission and cannot edit or submit a completed survey to CISA. There can be multiple Reviewers per facility.  

CSAT Personnel Surety Program (PSP) User Roles  

The PSP tab will only be available to users if your facility is approved to submit affected individuals under PSP and if you have an Authorizer, Administrator, or PSP Submitter role.  

Authorizer and Administrator: 

Chemical facilities covered under the CFATS program should have in their Site Security Plans (SSPs) protocols regarding the identification and reporting of an incident to appropriate facility personnel, as well as protocols determining whether the incident is “significant” and thus should be reported to appropriate facility personnel, local law enforcement, and/or CISA. 

If a significant security incident is detected while in progress, the facility should immediately call local law enforcement and emergency responders via 9-1-1. Similarly, if the event has concluded but an immediate response is still necessary, the facility should immediately call 9-1-1. 

As outlined in Risk-Based Performance Standard (RBPS) 15 – Reporting of Significant Security Incidents and RBPS 16 – Significant Security Incidents and Suspicious Activities, once an incident has concluded and any emergency has been addressed, CFATS facilities should report significant cyber and physical incidents to CISA Central at central@cisa.gov.

CISA Central provides the infrastructure for around the clock management and access to critical CISA services for owners and operators.