Counter-Terrorism Regulatory
Compliance
Compliance work often starts with a new regulation, scheduled visit, audit, or inspection.
What happens next depends on the plans and records you can produce.
WHY ORGANIZATIONS TRUST BPS
- 36 years in business
- 150+ years of combined expertise
- Independent and product neutral
- 96% Net Promoter Score
Thank you for your message
We’ll be in touch within 48 hours.
In the meantime, here’s a quick look at our approach.
- We help food and maritime facilities address the Food Safety Modernization Act (FSMA) Intentional Adulteration (IA) Rule and Maritime Transportation Security Act (MTSA) requirements, from initial notification through responses, plans, and submittals.
- We also advise chemical, oil, and gas facilities that continue to maintain security measures after the expiration of the Chemical Facility Anti-Terrorism Standards (CFATS) and that align to industry frameworks such as the Responsible Care® Security Code, Transportation Security Administration (TSA) Pipeline Security Guidelines, and CSA Z246.1.
When is Counter-Terrorism Compliance Support Needed?
Some facilities need to create the required plans and records. Others need to keep them current or respond when a regulator asks.
We work with facilities that want to test compliance in practice, not just check a box. We review what you have in place and prioritize the gaps.
You may need support when:
- You’re responding to a regulatory change or preparing for a formal review.
- You need to prepare or update a food defense plan or Facility Security Plan.
- Your facility has a new owner or operator, or has been modified.
- An annual MTSA audit or five-year Facility Security Plan renewal is due.
- Responses, records, or submittals are due for regulatory review.
- Facility Security Officers or personnel with security duties are due for training.
- You’re maintaining CFATS-aligned measures or working to an industry security framework in the chemical, oil, gas, or pipeline sectors.
What are the FSMA IA Compliance Requirements?
The FSMA Intentional Adulteration Rule, 21 CFR Part 121, requires covered food facilities to prepare and implement a written food defense plan.
Our food defense and physical security consultants can prepare or update that plan for your facility. It must include:
- A vulnerability assessment identifying significant vulnerabilities and actionable process steps.
- Mitigation strategies for those vulnerabilities.
- Procedures for food defense monitoring, corrective actions, and verification.
We write the plan against what’s actually in place, so the documented mitigation strategies match how your products, people, and processes are protected.
If you already have a plan and need an independent review before inspection, see our Food Defense Audit service.
Training and recordkeeping are separate obligations under the rule. We develop detailed training plans and organize records specific to your food defense plan.
What are the MTSA Compliance Requirements?
The Maritime Transportation Security Act of 2002 requires regulated maritime facilities to maintain an approved Facility Security Plan based on a Facility Security Assessment.
FOR MARITIME FACILITIES, OUR WORK INCLUDES:
- Preparing or independently reviewing your Facility Security Plan.
- Annual security audits that include a gap analysis of your plan against recent MTSA updates or modifications.
- Reviewing your Facility Security Assessment and preparing the plan for five-year renewal.
- Audit documentation, including the letter attached to the Facility Security Plan certifying that it meets the applicable requirements.
- Security design and planning to address identified risks.
We identify where Facility Security Officers and personnel with security duties need retraining to manage change. For course delivery, see our Security Training service.
Post-CFATS Security and Industry Frameworks
The statutory authority for the Chemical Facility Anti-Terrorism Standards program (6 CFR Part 27) expired on July 28, 2023. The Cybersecurity and Infrastructure Security Agency (CISA) cannot currently enforce CFATS regulations.
If you operate in the oil, gas, or chemical industries and choose to retain CFATS-aligned measures, we can assess your risks and vulnerabilities, then develop or refine security plans based on what we find. The risks behind those measures remain, so keeping them in place can still help protect facilities, personnel, and critical assets.
Many operators also work to voluntary industry frameworks that sit alongside federal chemical security rules or continue after those rules lapse. We support that work without product bias.
American Chemistry Council (ACC) members and Responsible Care® Partners implement the Responsible Care® Security Code as a membership commitment. It requires a risk-based security management system for people, property, products, processes, information, and information systems, organized around ten management practices covering leadership, risk assessment, verification, management of change, and continual improvement.
The Department of Homeland Security (DHS) recognizes the Code as a Qualified Anti-Terrorism Technology under the SAFETY Act.
Our work under the Code includes gap analysis, vulnerability assessment inputs, documentation, verification readiness, and the practical alignment of physical security with the management system.
TSA published the Guidelines in March 2018 and updated them in April 2021. Major U.S. pipeline operators use them as their primary voluntary security framework.
They call for a corporate security program and plan, criticality assessment, security vulnerability assessments for critical facilities, and baseline or enhanced measures matched to risk, including cyber and control-system considerations.
We support independent criticality and vulnerability assessments, review plans against the Guidelines, and make clear recommendations for physical security and access control.
CSA Z246.1 specifies criteria for security management programs across petroleum and natural gas industry systems, including pipelines, liquefied natural gas, storage, and petrochemical operations.
It focuses on identifying and managing security threats and risks, and on mitigation and response processes that protect people, the environment, assets, and economic stability.
Frank Pisciotta has contributed to the development of CSA Z246.1 for 15 years.
We help operators put its requirements into practice through a security management program that stays current.
We also monitor CFATS and related regulatory developments so you can prepare for possible changes.
