New Maritime Developments Update July 2003 No. 12 www.blankrome.com Analysis of Outer Continental Shelf (OCS) Facility Security Requirements New Development The United States Coast Guard published on July 1, 2003, an interim rule providing for security measures applicable to certain facilities operating on the U.S. Outer Continental Shelf (OCS) that are effective immediately. Comments are due by July 31, 2003. Owners and operators of facilities subject to this rule must submit to the Coast Guard an OCS facility security plan (FSP) for such facilities no later than December 29, 2003, for review and approval. Each OCS facility must be operating in compliance with its FSP and this rule no later than June 25, 2004. Applicability This rulemaking applies to the owner or operator of: 1. Fixed or floating platforms, including Mobile Offshore Drilling Units (MODUs) not subject to the International Convention for the Safety of Life at Sea (SOLAS), operating on the OCS that either: host more than 150 persons for 12 hours or more during each 24-hour period continuously for 30 days or more, produce more than 100,000 barrels of oil per day, or produce more than 200 million cubic feet of natural gas per day; 2. Other OCS facilities deemed to be at risk by the Coast Guard based on local conditions, specific intelligence, or other identifiable and articulable risk factors. Operating in Compliance with a OCS VSP by June 25, 2004 By July 1, 2004, facilities required to have an FSP must have one of the following: (1) an approved FSP (plus a letter of approval), (2) a copy of the FSP submitted for approval (plus an acknowledgement letter from the Coast Guard stating that the FSP is under review for approval), or (3) a copy of an Alternative Security Program (plus written confirmation by the owner/operator that the facility is in full compliance). OCS facility owners or operators may apply for a waiver of the requirements where they consider any requirement unnecessary in light of the nature or operating conditions of the OCS facility. The Coast Guard may grant a waiver of any requirement of this rule only if the waiver will not reduce the overall security of the OCS facility, its personnel, or visiting vessels. An OCS facility owner or operator also may propose equivalent security measure for consideration by the Coast Guard. Finally, the Coast Guard may approve an industry or third-party developed Alternative Security Program (ASP) in lieu of the requirements under this rule if it provides an equivalent level of security. The ASP must be appropriate for the OCS facility, the OCS facility must not serve vessels on international voyages, and the alternative program must be executed in its entirety. Analysis The OCS Facility Security rulemaking may be divided into three distinct categories. First, the rulemaking imposes a variety of security measures and requirements on OCS facility owners or operators. Second, owners or operators must conduct an OCS Facility Security Assessment (FSA). Last, owners or operators must create an FSP, based on the FSA, and submit it to the Coast Guard for approval. 1. Security Measures and Requirements Overview must undertake the following general activities: 3. Define the security organizational structure for each OCS facility and provide each person exercising security duties or responsibilities the support 2003, BLANK ROME LLP. The purpose of the New Maritime Developments Update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. The Update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.
necessary to fulfill security obligations; 2. Designate a Company Security Officer (CSO) and a Facility Security Officer(s) (FSO); 3. Ensure that an FSA is conducted; 4. Ensure the development and submission for approval of an FSP; 5. Ensure that the OCS facility operates in compliance with an FSP; 6. Ensure coordination of security issues between OCS facilities and vessels, including execution of Declaration(s) of Security (DOS); 7. Ensure implementation of additional security measures, as required by the FSP, for any change in Maritime Security (MARSEC) Level within 12 hours of notification of changed level; 8. Ensure that all breaches of security and security incidents are reported to the National Response Center. Company Security Officer An OCS facility owner or operator must designate one or more CSOs. Among other responsibilities, the CSO must oversee company OCS facility security; ensure a FSA is carried out; oversee the completion, development, implementation, and maintenance of a FSP; arrange for OCS facility security audits; ensure the timely or prompt correction of problems identified in such audits and inspections, provide awareness and training to company and security personnel; and oversee vessel-ocs facility interfaces. A CSO may perform collateral duties, but remains responsible for all CSO-related obligations. A CSO must meet specified qualification requirements. Specifically, a CSO must have general knowledge, through training or equivalent job experience, in 19 particular areas detailed in the rule. OCS Facility Security Officer A FSO must be designated for each OCS facility. The same person may serve as FSO for multiple facilities so long as the facilities are reasonably close to one another. Among other things, an FSO is responsible for regularly inspecting and maintaining the OCS facility s security measures (which includes training, notifying the CSO of security incidents, coordinating and handling stores of industrial supplies, notifying personnel of MARSEC Level changes, equipment installation maintenance, etc.), supervising implementation of the Plan, ensuring that problems identified during audits or inspections are reported to the CSO and promptly corrected, and ensuring proper coordination for OCS facility-vessel interfaces. With respect to MARSEC Level changes, the FSO must have a means and a procedure for quickly and effectively communicating security developments with OCS facility security personnel, personnel at facilities and other vessels interfacing with the OCS facility, and national and local authorities. The qualification requirements for FSOs are almost identical to CSO job qualification requirements. However, FSOs are also expected to have general knowledge, through training or equivalent job experience, of the OCS facility layout, the FSP and attendant procedures, and technical requirements (e.g. testing and maintenance of security systems and equipment). FSOs may perform other duties within the company provided that the FSO is able to perform the duties and responsibilities required of the FSO on the OCS facility. The FSO is further responsible for maintaining and protecting the following records of the following activities for a period of at least two years: training, drills and exercises, incidents and breaches of security, changes in MARSEC Levels, maintenance, calibration, and testing of equipment, security threats, Declarations of Security, and the annual audit of the OCS FSP. Training Requirements Company or OCS facility personnel responsible for security duties must have knowledge, through training or equivalent job experience, in 12 areas specified by the regulations. All other OCS facility personnel, including contractors, must have knowledge, through training or equivalent job experience, in five specified areas. The rule does not specify any particular time period for training or refresher training. Drill and Exercise Requirements Drills and exercises must test the proficiency of facility personnel in assigned security duties at all MAR- SEC Levels and the effective implementation of FSP. Such drills and exercises must enable the FSO to identify any related security deficiencies. The FSO must generally conduct security drills (testing individual elements of the FSP, such as response to alarms) at least every three months. Exercises, which are considered a full test of the security program and must include the substantial and active participation of relevant company and OCS facility personnel, must be conducted every calendar year, with no more than 18 months between exercises. While there are four different types of exercises specified, each exercise must test communication and notification procedures, and elements of personnel coordination, resource availability, and response. BLANK ROME LLP 2
MARSEC Level Coordination and Implementation An OCS facility owner or operator must ensure compliance with the security requirements for the MAR- SEC Level in effect for the OCS facility. must take the following actions when notified of an increase in the MARSEC Level: Vessels conducting operations with the OCS facility and vessels scheduled to arrive at the OCS facility within 96 hours of the MARSEC Level change are notified of the change and the Declaration(s) of Security is revised as necessary; The OCS facility complies with the required additional security measures within 12 hours; The OCS facility reports compliance and noncompliance to the cognizant District Commander; and For MARSEC Levels 2 and 3, the FSO must brief personnel on identified threats, reporting procedures, and the need for vigilance. Owners or operators whose OCS facility is not in compliance with these requirements must notify the cognizant District Commander and secure prior approval before interfacing with another vessel or continuing operations. Interfacing, Communications, and Declarations of Security (DOS) The FSO must have effective means to notify OCS facility personnel of changes in security conditions at the OCS facility. Further, owners or operators must ensure that procedures exist for continuous communication between the OCS facility security personnel and vessels interfacing with the OCS facility, the cognizant District Commander, and appropriate national and local authorities. Each OCS facility owner or operator must ensure that procedures are in place for interfacing with vessels at all MARSEC Levels and that a procedure is in place for requesting and processing DOS requests from vessels. A DOS is an agreement executed between responsible OCS FSOs and Vessel Security Officers that provides a means for ensuring that all shared security concerns are properly addressed and security will remain in place for the duration of the OCS facility-to-vessel interface. At MARSEC Level 1, owners or operators of OCS facilities interfacing with a manned vessel carrying certain dangerous cargoes in bulk(as defined by the Ports and Waterways Safety Act) must complete a DOS. At MARSEC Levels 2 and 3, all other manned vessels subject to the vessel security rulemaking must complete, sign, and implement a DOS. At MARSEC Levels 1 and 2, FSOs of OCS facilities that frequently interface with the same vessels may implement a continuing DOS for multiple visits, provided that certain requirements are met. Other Security Measures There are specific requirements for the maintenance of security systems and equipment. This rulemaking also imposes several security measure requirements on various aspects of OCS facility management. 1. Access Control To prevent unauthorized access to the facility and to control the threat posed by dangerous substances and devices, the rulemaking requires the owner or operator to ensure control over physical access points to the OCS facility, implement access restrictions to these points, and implement an identification system for each MARSEC Level. 2. Restricted Areas The owner or operator must designate restricted areas in the FSP to protect the OCS facility, its personnel, vessels using the facility, sensitive security areas, security and surveillance equipment and systems, and stores and industrial supplies from tampering. These areas must include, as appropriate, areas containing sensitive security information, areas containing security control devices, surveillance equipment and lighting system controls, and areas containing critical infrastructure equipment (e.g., water supplies, telecommunications, areas with hazardous materials, etc.). The OCS FSP must describe personnel that have access to restricted areas, and the conditions and times when access will be granted. 3. Delivery of Stores and Industrial Supplies The OCS facility owner or operator must implement security measures relating to the delivery of stores or industrial supplies to determine the integrity of such stores or industrial supplies, to prevent acceptance of stores or industrial supplies without inspection, to deter tampering, and to prevent acceptance of unordered stores or industrial supplies. 4. Monitoring As specified in the FSP, the owner or operator must monitor the OCS facility, restricted areas of the OCS facility, and the immediate area around the OCS facility using a combination of lighting, watchkeepers, security BLANK ROME LLP 3
guards, deck watches, waterborne patrols, and detection devices. These security requirements will very depending on the MARSEC Level. Under all circumstances notwithstanding the MARSEC Level, OCS facility security personnel must be able to respond to security threats or breaches of security, deny access to the OCS facility, evacuate the OCS facility if necessary, report the security incident, brief all OCS facility personnel on potential threats, and secure noncritical operations (to allow focus on critical operations). 2. Facility Security Assessment Owners and operators of OCS facilities are required to perform a FSA, which will form the basis of the FSP. The FSA is a written document that provides an analysis of background information and an on-scene survey. Background Information Owners and operators must provide the person conducting the FSA with the following information prior to the assessment: the layout of the OCS facility including the location of secured areas and equipment; procedures for emergency conditions, monitoring the facility and its personnel, controlling keys and other access prevention systems; response capability; threat assessments; previous reports on security needs; and any other relevant information. On-scene Survey and Analysis and Recommendations An on-scene survey must be conducted to examine and evaluate existing protective procedures to verify the information collected from the background investigation. Oversight and Methodology Owners and operators must ensure that the FSA is completed in compliance with the requirements. Third parties may conduct any aspect of the FSA if the Company Security Officer (CSO) reviews their work. Persons involved in conducting the FSA must be able to draw on expert assistance from many areas, including recognition of security threats and applicable regulations. The CSO is responsible for analyzing the background information and the on-scene survey and providing recommendations to establish and prioritize the security measures that should be included in the FSP taking into consideration identified vulnerabilities and deficiencies. That analysis must consider each vulnerability found during the on-site survey (10 are listed), possible security threats (5 are listed), threat assessments by Government agencies; vulnerabilities, including human factors, in the facility s infrastructure, policies, and procedures; the likelihood of an attack at the facility and the consequences thereof; and locations where access restrictions will be applied for each MARSEC Level. The results of the FSO s evaluation will result in an assessment report for inclusion into the FSP. The FSA Report The report must include the following elements: 1. A summary of how the onscene survey was conducted; 2. A description of existing security measures including equipment, identification procedures, and communication, alarm, lighting, and access systems; 3. A description of the vulnerabilities found during the on-scene survey; 4. A description of security measure to address those vulnerabilities; 5. A list of the key OCS facility operations that are important to protect; 6. A list of identified weaknesses in the infrastructure, policies and procedures; and 7. A description of the OCS facility physical security, structural integrity, personnel protection systems, procedural policies, radio and telecommunication systems, and essential services. One FSA may be performed for more than one OCS facility provided that they share the same types of physical characteristics, locations, and operations. The FSA must be incorporated into the FSP and included in the submission to the Coast Guard. 3. OCS Facility Security Plan Oversight and Methodology must ensure that the FSO develops and implements an FSP. The FSP must (1) identify the FSO by name and provide 24-hour contact information; (2) be written in English; (3) address each vulnerability identified in the FSA; and (4) describe security measures for each MARSEC Level. The FSP may include more than one OCS facility if authorized and approved by the cognizant District Commander. Plan Requirements The FSP must include the following sections: 1. Security organization of the OCS facility; 2. Personnel training; 3. Drills and exercise; 4. Records and documentation; 5. Response to change in MARSEC Level; BLANK ROME LLP 4
6. Procedures for interfacing with vessels; 7. Declarations of Security; 8. Communications; 9. Security systems and equipment maintenance; 10. Security measures for access control; 11. Security measure for restricted areas; 12. Security measures for delivery of stores and industrial supplies; 13. Security measures for monitoring; 14. Security incident procedures; 15. Audits and FSP amendments; and 16. FSA report. The owner or operator must also ensure that the FSP describes in detail how the security measures required by the rulemaking and as discussed in this Advisory will be met. Amendments and Audits Amendments to the FSP may be initiated by the owner or operator or by the Coast Guard. If an amendment is required, the cognizant District Commander will provide written notice and will request that the owner or operator propose amendments within 60 days regarding the specific matter. Owners or operators are required to address the concern temporarily until the amendment is approved. The FSP must also be amended when there is a change in owner or operator. The FSO must ensure that the FSP is audited on an annual basis, when there is a change in ownership, or if there have been modifications to the OCS facility. Audits that result in a change to the FSP must be incorporated into the FSP by amendment and submitted to the District Commander no later than 30 days after the audit. Costs The Coast Guard estimates that this rulemaking will affect 40 OCS facilities under U.S. jurisdiction and will cost $37 million dollars Present Value for compliance. Recommendations Owners and operators of OCS facilities affected by these new security requirements should review this rule to determine the implications of those regulations on their operations and initiate measures to comply with applicable requirements in accordance with the listed timelines. OCS facility owners and operators are urged to comment on, among other things, those provisions that do not appreciably enhance security and result in unreasonable burdens and costs on OCS facility operations. Interested parties have only until July 31 to submit their comments.! If you have questions or desire assistance please contact: Jon Waldron Waldron@BlankRome.com Jeanne Grasso Grasso@BlankRome.com or Andrew Dyer Dyer-a@BlankRome.com Additional information on Blank Rome may be found on our website www.blankrome.com. Maritime Group Members Jonathan K. Waldron 202.944.3056 Alex Blanton 202.944.3041 Joan M. Bondareff 202.844.3580 James S.W. Drewry 202.944.3042 Thomas M. Dyer 202.944.3054 James B. Ellis 202.944.3051 Brett M. Esber 202.944.3059 Jeanne M. Grasso 202.944.3558 Lara B. Mathews 202.944.3044 J. Christopher Naftzger 202.944.3565 R. Anthony Salgado 202.944.3055 William L. Schachte 202.944.3000 Duncan C. Smith III 202.944.2668 Sidney A. Wallace 202.944.2662 www.blankrome.com Blank Rome LLP publishes Updates on the following topics: Affordable Housing and Community Development, Consumer Lending/Retail Banking, Corporate Alerts on the Sarbanes-Oxley Act, Employment Benefits & Labor, Environmental, Financial Services, Health Care, Maritime, Privacy and Security, Public Contracts and Tax and Fiduciary. To sign up to receive any of these Updates, please visit us at http://www.blankrome.com/publications/newslogin.asp or contact Kristen Azzam at 215.988.6933 or at azzam-k@blankrome.com. Office Locations 1620 Pond Road.......................Allentown, PA 18104.........................(610) 706-4300 250 W. Pratt Street.....................Baltimore, MD 21201........................(410) 659-3939 1200 N. Federal Highway................Boca Raton, FL 33432........................(561) 417-8100 210 Lake Drive East....................Cherry Hill, NJ 08002........................(856) 779-3600 201 East Fifth Street....................Cincinnati, OH 45202........................(513) 362-8700 1400 N. Providence Road................Media, PA 19063............................(610) 891-7800 405 Lexington Avenue..................New York, NY 10174-0208....................(212) 885-5000 One Logan Square.....................Philadelphia, PA 19103-6998..................(215) 569-5500 200 W. State Street.....................Trenton, NJ 08608...........................(609) 278-2320 600 New Hampshire Avenue, N.W..........Washington, DC 20037.......................(202) 772-5800 1201 Market Street.....................Wilmington, DE 19801.......................(302) 425-6400 BLANK ROME LLP 5