This week we’ll provide more examples of “The Good” highlighting what it takes to better your facility security.

Access Control

  • Security Measures for Restricted Areas – How is access to certain restricted areas for employees and visitors determined and who authorizes it? The FSO is ultimately responsible and should be the person making this decision.  FSOs authorizing access based on a person’s duties and responsibilities and not delegating that authority can greatly reduce unauthorized access and potentially other security violations.  FSOs need to make the time to exercise this authority and not delegate it to facility supervisors because the FSO is too busy.  When this authority is delegated, it increases your risk of an employee or visitors being given access to restricted areas where those individuals have no business being.

Physical Security

  • Gates – Whether it is the main vehicle gate, the rail gate or the pedestrian gate to the parking lot, they should be kept secured and not left opened for convenience. In addition to keeping gates closed, make sure there are no gaps between or underneath them for personnel to easily gain access.  Leaving gates opened for convenience and not closing gaps enables a breach of security to take place, which may lead to worse things. 

Security procedures

  • Linking company proximity & TWIC cards – Greatly reduce the chance of a breach of security of an expired TWIC card. A lot of facilities integrate their company proximity card, used to gain access to the facility and other areas to include restricted areas, with a person’s TWIC card.  When the TWIC card expires, the connected proximity card’s access is denied.  Some facility’s Physical Access Control System (PACS) also alert the person at least a month prior to the TWIC card expiring.  A way to use technology to reduce human error.
  • Training – An established security training program provides PSDs and All Others with the necessary knowledge required by 33 CFR 105.210 and 105.215 respectively. Since the Maritime Transportation Security Act is a performance based law, some FSOs want to guarantee their PSDs and All Others know their security knowledge by requiring annual training.  The “best of the best” shun computer-based training and use classroom training.  Using technology to ensure everyone completes it annually, the company proximity card is used to document attendance or is associated to the person’s online training account and when annual training is not completed, ACCESS DENIED.  This saves the FSO a lot of time trying to figure out who has and who hasn’t had training, plus everyone stays knowledgeable in their security duties.

Again, how did we find all these best practices?  By getting out and physically checking, confirming and testing all aspects of the Coast Guard’s facility compliance inspection checklist – NVIC 03-03 change 2 during our audits.

The Good, The Bad, & The Ugly will be broken down into three security categories with this week’s blog focusing on “The Good”

Access Control

  • 100% TWIC Credentialing - is required by law and facilities properly carrying this out significantly reduce their risk for a potential security breach. That means each TWIC card is physically inspected to verify TWIC picture matches the person entering, the TWIC card has not expired and it is not a fake by using an ultra violet flashlight.
  • Random screening techniques - properly carried out to the prescribed screening rate per your facility’s security plan deters personnel from trying to enter the facility with prohibited items especially weapons or explosive devices. Randomly screening personnel leaving the facility will greatly reduce tool theft.

Physical Security

  • Perimeter fencing – fencing that meets industry standards (chain link fence, minimum height – 7ft, taut wire or cable at top, bottom rail, outriggers facing the proper direction with barbed wire or razor wire) with proper signage informs outsiders the facility is a restricted area and deters unauthorized access. Some areas commonly overlooked are pipelines entering the facility and around piers or shoreline.  These areas can be an easy access for unauthorized personnel.

Security procedures

  • Drills and Exercises – drills are required to be conducted once every three months and they cover at least one element of the facility security plan (FSP). Facility security officers that regularly use drills to test themselves, their Alternate FSOs, Personnel with Security Duties (PSD) and All Others stay proficient in their security duties.  Do not simulate during drills and exercises unless it’s a necessity because too often procedures, information (e.g., phone numbers), knowledge, or policy is found to be outdated, in error or not being carried out.  Remember, we do not master anything by only completing the minimums.  Exercises are a full test of the security program and is an excellent barometer on identifying areas of improvement or that your training program and security procedures are working.

How does Seebald & Associates discover all “The Good” or best practices?  Our audits, security assessments and plan developments are not just a paper drill.  It requires getting out and physically inspecting the facility, questioning PSDs and All Others, and observing security procedures not to assume someone knows something or that a procedure is being carried out properly per their FSP.

 

 

 

The Transportation Security Administration (TSA) began issuing a new, more secure Transportation Worker Identification Credential (TWIC) on July 10, 2018.

Current TWIC card holders do not need to replace a valid TWIC card with the new TWIC card design. 

  • Regulated entities that require TWIC for access will accept and recognize both the current and new TWIC designs until the card’s expiration.
  • The new card design is compatible with qualified TWIC readers.
  • To deter alteration of the card’s expiration date, the new card includes a color-coded expiration date box that will update on an annual basis.
  • The fee for the newly re-designed TWIC card remains unchanged ($125.25) and the credential is valid for five years.

New TWIC Card

 

In case you missed last week’s blog because you were being a patriot and enjoying the 4th of July holiday, here is a recap and what additional information that needs to be in the amendment.  With the TWIC Reader Final Rule going into effect on August 23, 2018, means Risk Group A facilities that are expected to comply and submit an amendment by July 24, 2018 are:

  • CDC Facilities – facilities that receive vessels and engage in vessel to facility interface that involves the transfer of CDCs, in bulk, to or from the vessel they receive
  • Facilities that receive vessels certificated to carry more than 1,000 passengers

TWIC Reader amendment – What needs to be in the amendment?  It is not as simple as stating that we are in compliance with the TWIC Reader Final Rule because we bought TWIC readers.

You need to first review all the additional 33 CFR 105 requirements for TWIC Reader Final Rule.  In short, it explains in detail what electronic TWIC inspection requirements are (card authentication, card validity check, & identity verification), Cancelled Card List (CCL) frequency updates, facility recordkeeping requirements, Physical Access Control System (PACS) requirements, and what is required content for outlining your TWIC program.

If your facility is using or plans to use a TWIC reader on the Transportation Security Administration’s Qualified Technology List (QTL), then your amendment process just got a little easier because these readers meet the electronic TWIC inspection requirements.  You are still required to document in your amendment CCL updates, recordkeeping and the security measures for access control using your TWIC readers.

With that said, those facilities using a PACS must outline in your amendment that an electronic TWIC inspection is being completed along with all the other security measure requirements that are being changed with the enhancement of the PACS.  Since a lot of these requirements are all done electronically, how do you show the Coast Guard during a compliance inspection you meet all the requirements?  You need to work closely with your information technology department to figure this out and remember this data is Sensitive Security Information (SSI) and must be protected in accordance with 49 CFR 1520.

Again, please do not hesitate to contact us if you have any questions or need assistance in becoming compliant with the TWIC Reader Final Rule.

With the TWIC Reader Rule enforcement right around the corner, this month’s blogs will focus on the 30-30-60 rule:

  • 30 days - An amendment to a facility security plan (FSP) must be submitted to the Coast Guard at least 30 days prior to the change in your FSP going into effect – 33 CFR 105.415
  • 30 days – If the audit results require an amendment to your FSA or FSP, the amendments must be submitted no later than 30 days after the completion of the audit and a letter certifying that the amended FSP meets the applicable requirements of this part – 33 CFR 105.415
  • 60 days – A 5 year FSP rewrite needs to be submitted at least 60 days prior to the FSP’s 5 year anniversary date – 33 CFR 105.410

Submit Your Electronic TWIC Reader FSP Amendment 30 Days in Advance

30 days – Remember that we have to submit an amendment to our plan at least 30 days prior to that change in our FSP going into effect.  With the TWIC Reader Final Rule going into effect on August 23, 2018, means Risk Group A facilities that are expected to comply and submit an amendment by July 24, 2018 are:

  • CDC Facilities – facilities that receive vessels and engage in vessel to facility interface that involves the transfer of CDCs, in bulk, to or from the vessel they receive
  • Facilities that receive vessels certificated to carry more than 1,000 passengers

July 24, 2018 is little more than three weeks away, so if you are a Risk Group A facility to which the TWIC Reader Final Rule applies - Where are you in preparing your facility to be compliant with the TWIC Reader Final Rule and the amendment process?

If you need assistance or have any questions, please do not hesitate to contact Seebald & Associates.