Known by many names, but referred to in the Hazardous Material Regulations at 49 CFR 172.802 as a Security Plan; it is a requirement for certain shippers and carriers of hazardous materials.  An earlier article explained the regulatory process @ §172.800(b) for determining if you are required to complete a Security Plan which, in turn, requires you to conduct In-Depth Security Training for your HazMat Employees [§172.704(a)(5)].  The purpose of this article is to explain the components of a Security Plan as required by §172.802.

The Security Plan must include an assessment of the transportation security risks faced by the hazardous materials you handle that are also listed in §172.800(b).  In other words, only the HazMat that makes you subject to these regulations is required to be included in the assessment.  However, you may wish to consider other hazardous materials that may pose a security risk.  Your assessment must be specific to your site, your operations, and how the subject hazardous material is handled while it is being prepared for transportation and stored or unloaded incidental to transportation.

Your Security Plan must include appropriate measures (you decide) to address the assessed risks.  Specific measures may vary depending on the level of the threat at a particular time.  Therefore, it is you that must determine an appropriate response to the risks posed by, or to, your subject HazMat.

While so far the regulations have provided you the freedom to determine your risks and fashion a response, they now get specific about what three elements your Security Plan must include:

1.  Personnel Security:  Measures to confirm information provided by job applicants who will have access to the subject hazardous materials.  Likely you are already doing some form of pre-employment screening for all of your employees.  This element is not affected by the risk assessment you have already conducted; rather, it is meant to be a general security measure independent of your assessed risk.  Your Security Plan must describe what procedures you have to screen employees prior to employment to ensure you’re not hiring a security risk.
2. Unauthorized Access:  Based on your risk assessment (unlike the Personnel Security element), your Security Plan must describe the measures in place to prevent unauthorized persons from gaining access to the subject hazardous materials or the transport conveyances (eg. truck, train, boat, etc.) to be used for the subject hazardous materials.
3. En Route Security:  Based on your risk assessment (like the Unauthorized Access element), your Security Plan must include measures to address security risks posed to, or by, the subject hazardous materials while in transportation.  This includes times when the HazMat may be stored incidental to transportation.  This poses a significant challenge for shippers of a hazardous material because in most cases the HazMat is out of your physical control when it is in transportation.  No matter, the USDOT/PHMSA requires you to address an assessed risk when subject HazMat is en route to its destination.  A critical requirement in meeting this element is to choose your carrier carefully and ensure they are aware of their requirements under these regulations.

The Security Plan must also include:

• Identify by job title (name, address, phone number, etc. not required) the senior management official responsible for overall development and implementation of the Security Plan.  Note the level of management required; this may mean that your EHS Administrator or Shipping and Receiving Manager are not acceptable for this role.
• The security duties for each position or department responsible for implementing (putting into affect) the Security Plan.
• How you will notify employees when an element of the Security Plan is to be implemented.
• How you intend to train HazMat Employees for both levels of security training:
• §172.704(a)(4) – Security Awareness Training:  Required for all HazMat Employees.
• §172.704(a)(5) – In-Depth Security Training:  Required only for HazMat Employees who will handle or perform a regulated function related to the subject HazMat, or are responsible for implementing the Security Plan.

Additional requirements for the Security Plan:

• Must be in writing.
• Must be retained for as long as it remains in effect, ie. until you no longer handle a subject HazMat.
• Must be reviewed annually and revised and/or updated as necessary.
• Must be available to the employees who are responsible for implementing it.  However, this availability can be restrained depending on personnel security clearance, background investigation restrictions, and a demonstrated need to know.  In other words, you may withhold some or all of your Security Plan, even from your own HazMat Employees if you feel it is necessary.
• All employees with a responsibility to implement the Security Plan must be notified when it is updated or revised,.
• A copy of the Security Plan (an electronic copy is OK) must be accessible at or through the principal place of business and made available upon request to an official of either the USDOT or the Department of Homeland Security.

For more information about Security Plans, security training, rulemakings, guidance documents, and more; refer to the USDOT/PHMSA Security website.

I can provide all the training required by the regulations for your HazMat Employees:  the mandatory Security Awareness Training and the potential In-Depth Security Training.  Contact me to discuss your HazMat Security training requirements.