33 CFR § 106.305 - Facility Security Assessment (FSA) requirements.
(a) Background. The OCS facility owner or operator must ensure that the following background information, if applicable, is provided to the person or persons who will conduct the assessment:
(1) The general layout of the OCS facility, including:
(i) The location of each access point to the OCS facility;
(ii) The number, reliability, and security duties of OCS facility personnel;
(iii) Security doors, barriers, and lighting;
(iv) The location of restricted areas;
(v) The emergency and stand-by equipment available to maintain essential services;
(vi) The essential maintenance equipment and storage areas;
(vii) Location of escape and evacuation routes and assembly stations; and
(viii) Existing security and safety equipment for protection of personnel;
(2) Response procedures for fire or other emergency conditions;
(3) Procedures for monitoring OCS facility and vessel personnel;
(4) Procedures for controlling keys and other access prevention systems;
(5) Response capability for security incidents;
(6) Threat assessments, including the purpose and methodology of the assessment, for the OCS facility's location;
(7) Previous reports on security needs; and
(8) Any other existing security procedures and systems, equipment, communications, and OCS facility personnel.
(b) On-scene survey. The OCS facility owner or operator must ensure that an on-scene survey of each OCS facility is conducted. The on-scene survey examines and evaluates existing OCS facility protective measures, procedures, and operations to verify or collect the information required in paragraph (a) of this section.
(c) Analysis and recommendations. In conducting the FSA, the OCS owner or operator must ensure that the Company Security Officer (CSO) analyzes the OCS facility background information and the on-scene survey, and considering the requirements of this part, provides recommendations to establish and prioritize the security measures that should be included in the FSP. The analysis must consider:
(1) Each vulnerability found during the on-scene survey, including but not limited to:
(i) Access to the OCS facility;
(ii) Structural integrity of the OCS facility;
(iii) Existing security measures and procedures, including identification systems;
(iv) Existing security measures and procedures relating to essential services;
(v) Measures to protect radio and telecommunication equipment, including computer systems and networks;
(vi) Existing agreements with private security companies;
(vii) Any conflicting policies between safety and security measures and procedures;
(viii) Any conflicting OCS facility operations and security duty assignments;
(ix) Any deficiencies identified during daily operations or training and drills; and
(x) Any deficiencies identified following security incidents or alerts, the report of security concerns, the exercise of control measures, or audits.
(2) Possible security threats, including but not limited to:
(i) Damage to or destruction of the OCS facility or of a vessel adjacent to the OCS facility;
(ii) Smuggling dangerous substances and devices;
(iii) Use of a vessel interfacing with the OCS facility to carry those intending to cause a security incident and their equipment;
(iv) Use of a vessel interfacing with the OCS facility as a weapon or as a means to cause damage or destruction; and
(v) Effects of a nuclear, biological, radiological, explosive, or chemical attack to the OCS facility's shoreside support system;
(3) Threat assessments by Government agencies;
(4) Vulnerabilities, including human factors, in the OCS facility's infrastructure, policies and procedures;
(5) Any particular aspects of the OCS facility, including the vessels that interface with the OCS facility, which make it likely to be the target of an attack;
(6) Likely consequences, in terms of loss of life, damage to property, or economic disruption, of an attack on or at the OCS facility; and
(7) Locations where access restrictions or prohibitions will be applied for each MARSEC Level.
(d) FSA Report.
(1) The OCS facility owner or operator must ensure that a written FSA report is prepared and included as a part of the FSP. The report must contain:
(i) A summary of how the on-scene survey was conducted;
(ii) A description of existing security measures, including inspection, control and monitoring equipment, personnel identification documents and communication, alarm, lighting, access control, and similar systems;
(iii) A description of each vulnerability found during the on-scene survey;
(iv) A description of security measures that could be used to address each vulnerability;
(v) A list of the key OCS facility operations that are important to protect; and
(vi) A list of identified weaknesses, including human factors, in the infrastructure, policies, and procedures of the OCS facility.
(2) A FSA report must describe the following elements within the OCS facility:
(i) Physical security;
(ii) Structural integrity;
(iii) Personnel protection systems;
(iv) Procedural policies;
(v) Radio and telecommunication systems, including computer systems and networks; and
(vi) Essential services.
(3) The FSA report must list the persons, activities, services, and operations that are important to protect, in each of the following categories:
(i) OCS facility personnel;
(ii) Visitors, vendors, repair technicians, vessel personnel, etc.;
(iii) OCS facility stores;
(iv) Any security communication and surveillance systems; and
(v) Any other security systems, if any.
(4) The FSA report must account for any vulnerabilities in the following areas:
(i) Conflicts between safety and security measures;
(ii) Conflicts between personnel duties and security assignments;
(iii) The impact of watch-keeping duties and risk of fatigue on personnel alertness and performance;
(iv) Security training deficiencies; and
(v) Security equipment and systems, including communication systems.
(5) The FSA report must discuss and evaluate key OCS facility measures and operations, including—
(i) Ensuring performance of all security duties;
(ii) Controlling access to the OCS facility through the use of identification systems or otherwise;
(iii) Controlling the embarkation of OCS facility personnel and other persons and their effects (including personal effects and baggage, whether accompanied or unaccompanied);
(iv) Supervising the delivery of stores and industrial supplies;
(v) Monitoring restricted areas to ensure that only authorized persons have access;
(vi) Monitoring deck areas and areas surrounding the OCS facility; and
(vii) The ready availability of security communications, information, and equipment.
(e) The FSA, FSA report, and FSP must be protected from unauthorized access or disclosure.