The Chemical Facility Anti-Terrorism Standards (CFATS) includes both physical and cyber security recommendations (though mostly physical). INL made a comparison (actually a correlation) of the CFATS risk-based performance standards recommendations to those in ISA99.00.02. The approach on the surface appeared to be similar to what NIST (and support staff including myself) did for comparing the NIST standards to the NERC CIPs. The NIST approach was a true cross-comparison – not only checking for adequacy but cross-correlating what each document had that the other did not. It required a detailed reading of both documents as the titles did not always provide the level of detail needed. The INL approach appears to be a cursory one-way correlation. That is, it provided a correlation of what was in CFATS to its companion title in ISA99.00.02. Similar to the NIST Framework, ISA99.00.02is a very comprehensive standard. In order to determine the adequacy of the CFATS recommendations, there needs to be a determination of what, if anything, is missing from CFATS that is included in ISA99.00.02and/or the NIST Framework. This is important as the NIST cross-correlation effort resulted in identifying significant limitations in the NERC CIPs.
Joe Weiss
