~' ~

__

__

__

REQUEST FOR RECO~DS

"

DISPOSITION AUTHORITY

To: NATIONAL ARCHIVES & RECORDS ADMINISTRATION 8601 ADELPHI ROAD, COLLEGE PARK, MID 20740-6001

1. FROM (Agency or establishment)

Department of Homeland Security

2. MAJOR SUB DIVISION

1-

N_a_t_io

n_a_l_p_ro_t_e_c_t_io_n

a_n_d_P_r_o_g_r_a_m_s

D_i_re_c_t_o_ra_t_e

3 MINOR SUBDIVISION

Chemical Security Compliance Division

4. NAME OF PERSON WITH WHOM TO CONFER 5 TELEPHONE

Kathy Schultz

202-447-5075

6

AGENCY CERTIFICATION

I hereby certify that I am authorized to act for this agency in matters pertaining

~'---~

LEAVE Be

.t<

(NARA use only)

JOB NUMBER

N/ - 5iP3 -07-7

Date Received

NOTIFICATION TO AGENCY

In accordance With the provisions of 44 U.S.C 3303a, the disposrnon request, Including amendments IS approved

-I except for items that may be marked "disposition not approved" or "Withdrawn" in column 10.

DATE A~C~'YIST OF THE UNITED STATES

1~11.2--

~w.----f2-.-to the disposition of its records and that the records proposed for disposal on the attached

_---

)( -; page( s) are not needed now for the business of this agency or will not be

\

needed after the retention periods specified, and that written concurrence from the General Accounting Office, under the provisions of Title 8 the GAO Manual for Guidance of Federal Agencies,

181

IS not required

D

is attached; or

D

has been requested. DATE SIGNATURE OF AGENCY REPRESENTATIVE TITLE

5/7/07

~,Sc~

Senior Records Officer

9. GRSOR

10. ACTION TAKEN 7. ITEM NO. 8 DESCRIPTION OF ITEM AND PROPOSED DISPOSITION SUPERSEDED JOB

(NARA USE ONLY) CITATION

1

See attached sheet(s) for:

u.s.

Department of Homeland Security

Headquarters Systems Schedules

National Protection and Programs Directorate

Chemical Security Assessment Tool (CSAT)

NARA #

N1-563-07-7

Section 550 of Public Law 109-295 provided the Department of Homeland Security (DHS) the responsibility and authority to regulate high risk chemical facilities. Further, it requires the Secretary of the Department of Homeland Security (the Secretary) to identify high risk facilities and provide for the protection of the information regarding and provided by those factlrties. Currently, the federal government does not possess the asset specific risk data to regulate high risk chemical facilities. The Chemical Security Assessment Tool (CSAT) has been identified by DHS/PREP/IP as the Information Technology (IT) system to obtain and quantify this key risk data from facilities covered under the Statute. It is the intent of the Secretary to begin the assessment of the chemical sector upon the issuance of the interim final regulations. Interim final regulations are required to be Issued 6 months from the date of enactment, or April 4, 2007. In conjunction with the release of the interim final regulation that will be published in the Federal Register, Infrastructure Protection (IP) will inform the public and private sector of its goals and purpose via public announcements, participation In trade shows, and other means of public relations.

CSA T's functionality revolves around the need to (1) collect data necessary to determine is a facihty is regulated under the Interim final rule, (2) determine the extent to which a facility may be regulated through Its risk tier designation, (3) provide the facility with a means to conduct an in-depth Security Vulnerability Assessment (SVA) and (4) provide the facihty with a means to prepare a Site Security Plan (SSP) All data collected through CSAT will be stored electronically on the CSAT back-end database

Input:

Disposition (Media Neutral): 1 The data is keyed in through an online questionnaire. Information

TEMPORARY. Destroy/delete Inactive file 6 years after user IS collected through the User Approval Process and may be input by

account is terminated or when no longer needed for one of two roles personnel at a facility may receive. The first IS a

investigative or security purposes, whichever is later "Submitter" who is an authorized Individual who may send information

to DHS on behalf of the company. The second is a "Preparer" who IS authorized to complete the top screen or SVA but not send or submit the Information Some data may also be uploaded by the Individual In files (Microsoft Word, Adobe Acrobat).

Once the information is Input, the completed registration Information is /

printed, signed and mailed to DHS by the requestor. The form with the original signature is maintained once It has been reviewed and approved by DHS personnel

Headquarters

National Protection

Master File I Data:

2. The content consists of facilities specific data, in two forms: a Top Screen assessment (used to determine the level of risk of an

Individual facility) and a Security Vulnerability Assessment (used to determine specific vulnerabilities of an Individual facility) The data is used to determine If a facility IS required to develop and submit facility security plans to DHS for review and subsequent inspection.

The records are assigned unique identifiers and can be sorted and arranged for analysis and reporting purposes. The data collected will be stored In an Oracle database.

Classified information IS appropnately stored In a secured facility, in secured databases and containers, and in accordance with other applicable requirements, including those pertaining to classified Information Access IS limited to authorized personnel only.

Output:

3 Threat Assessment Reports

Results from the SVA are combined With government threat

assessments. The threat assessments incorporate data provided by the intelligence and law enforcement

cornmurutres

The resulting products Will allow the facility to receive a final tier designation and support for the development of a facility secunty plan.

Systems Schedules

and Programs Directorate

Disposition:

TEMPORARY. Destroy or delete 10 years from the date the facility IS no longer active.

Disposition (Media Neutral):

TEMPORARY. Destroy or delete 10 years from the date the faCIlity is no longer active

u.s.

Department

Headquarters

National Protection

Output:

All Otl'ler Reports

• Status and User reports will be run for monltorin§ j3l:1rj3oses • VlI'orkflo'tv'~riofitizatiofl fe~oFts

• Sl:Immory rej30rts tRot do not Involve sensitive In~oFmation may be provided to the public

• Ad Roe Rej30rts respondlA§ to spe61~c Eluestions or queries

of Homeland Security

Systems Schedules

and Programs Directorate

Disposition (Media Nel:ltFaI):

GRS 20, item 05. lD ~

'1

Delete WRen tl'le o§eney determines tl'lat tRey are no lon§ler needed for Administrative, legal, audit, or other operational purposes.

u.s.

Department of Homeland Security

Headquarter Offices, National Protection and Programs Directorate Chemical Security Compliance Division, Chemical Security Assessmen

Chemical Security Assessment Tool

Section 550 of Public Law 109-295 provided the Department of Homeland Sec ity (DHS) the responsibility and authority to regulate high risk chemical facilities. Further, it r quires the Secretary of the Department of Homeland Security (the Secretary) to identify igh risk facilities and provide for the protection of the information regarding and provided by ose facilities. Currently, the federal government does not possess the asset specific risk ata to regulate high risk chemical facilitles. The Chemical Security Assessment Tool (CSAT) as been identified by DHS/PREP/IP as the Information Technology (IT) system to obtain and uantify this key risk data from factlrtres covered under the Statute. It is the intent of the Secreta to begin the assessment of the chemical sector upon the issuance of the interim final regulatio s. Interim final regulations are required to be issued 6 months from the date of enactment, or ril 4,2007. In conjunction with the release of the interim final regulation that will be published n the Federal Register, Infrastructure Protection (IP) will inform the public and private sec or of its goals and purpose via public announcements, participation in trade shows, and other ans of public relations.

CSAT's functionality revolves around the need to (1) collect d ta necessary to determine is a faculty is regulated under the interim final rule, (2) determine he extent to which a facility may be regulated through its risk tier designation, (3) provide the f ility with a means to conduct an In-depth Security Vulnerability Assessment (SVA) and (4) pr vide the facility with a means to prepare a Site Security Plan (SSP). All data collected thr ugh CSAT will be stored electronically on the CSAT back-end database.

Unless otherwise noted, these disposition instruction are media neutral; they apply regardless of the media or format of the records.

1. Inputs

The data is keyed in through an online uestionnaire. Information is collected through the User Approval Process and may b input by one of two roles personnel at a facility may receive. The first is a "Submitte 'who is an authorized individual who may send information to DHS on behalf of the ompany. The second is a "Preparer" who is authorized to complete the top scr en or SVA but not send or submit the information. Some data may also be uploade by the individual in files (Microsoft Word, Adobe Acrobat).

Information IS input directly t the Master File. See Item 2, Master File

I

Data for retention.

a. User Access Inf rmation: Once the information is input, the completed registration info

anon

is printed, signed and mailed to DHS by the requestor. The form with e original Signature is maintained once it has been reviewed and approved by HS personnel.

isposition: TEMPORARY. Cutoff annually. Destroy or delete 10 years after cutoff.

2. Master File

lata

The content onsists of facilities specific data, in two forms: a Top Screen assessment (used to de rmine the level of risk of an individual facility) and a Security Vulnerability Assessm t (used to determine specific vulnerabilities of an Individual facility). The data

is used to determine if a facility is required to develop and submit facility securi plans to

DHS for review and subsequent inspection.

The records are assigned unique identifiers and can be sorted and arrange for analysis

and reporting purposes. The data collected will be stored in an Oracle da base.

Classified information is appropriately stored in a secured facility, in se red databases

and containers, and in accordance with other applicable requirements including those

pertaining to classified information. Access is limited to authorized p rsonnelonly.

Disposition: TEMPORARY. Destroy or delete 10 years rom the date the

facility is no longer active.

3. Outputs

a. Results from the SVA are combined with governme t threat assessments. The

threat assessments incorporate data provided by e intelligence and law

enforcement communities. The resulting produc will allow the facility to receive

a final tier designation and support for the deve pment of a facility security plan.

Disposition: TEMPORARY. Destr y or delete 10 years from the date

the facility is no longer active.

b. Status and User reports will be run for

c. Workflow prioritization reports

d. Summary reports that do not involve

nsitive information may be provided to the

public

e. Ad hoc Reports responding to spe fic questions or queries

Disposition: TEMPO

RY. Destroy or delete when no longer needed

for business purposes