Petrochem/Utilities Industry Trends

A New Tool for Security Assessments

Issue Table of Contents

Security on the High Seas Building a Pipeline to a Secure Future A New Tool for Security Assessments Related Standards and Publications

This October, the American Petroleum Institute (API) released Security Assessment Methodology for the Petroleum and Petrochemical Industries, which it developed in partnership with the National Petrochemical & Refiners Association (NPRA). The document is the latest in a series of publications created by API that are designed to help companies in the petroleum and petrochemical industries strengthen the security of their operations.

The new document is the second edition of vulnerability assessment guidelines that were first published in 2003. And as the industry continues to learn more about security, API plans on continuing to revise the document as well, says Bill Erny, senior regulatory analyst, API. “Since 9/11, the petroleum and petrochemical industries — as well as many other critical industries in the United States — are really reevaluating how to handle security. We’re learning more and more all the time, so we’re trying to incorporate new information such as threat stream information, best practices and lessons learned.”

A security vulnerability assessment is an important tool for any company developing or updating its security plans. While there are several vulnerability assessment methodologies available for companies to use, API and NPRA created their guidelines specifically for the companies in the petroleum and petrochemical industries.

“The whole purpose of a security vulnerability assessment is to really put a finger on the standing of your security practices as they are currently and identify those gaps in the security where you think you may need to do some further work and provide more security,” says Erny. “This document is very generic in the way it’s written, so it can be tailored by anybody within our industry, regardless of what they’re doing.”

The guidelines outline five steps for the security assessment methodology: asset characterization, threat assessment, vulnerability analysis, risk assessment and countermeasures analysis. It then walks users through each of these steps. The document also offers an appendix filled with examples of how the methodology can be applied to different environments and situations.

This second edition expands upon the range of application examples offered in the previous edition of the document. It now includes examples of the methodology being applied to mobile assets, such as truck-based and rail-based transportation systems. These additions were made based on feedback from API’s and NPRA’s member organizations. “Traditionally, a lot of these methods have been applied very specifically to fixed facilities, so when you get into things like pipeline transportation and other modes of transportation in particular, there are a lot of questions,” Erny says.

The guidelines are only one piece of the puzzle for companies trying to enhance their security profile. API has released several other documents that companies can use to create and strengthen their security programs, including two recommended practices designed for operators with offshore facilities: RP 70, Security for Offshore Oil and Natural Gas Operations, and RP 70I, Security for Worldwide Offshore Oil and Natural Gas Operations. API also offers an overview document entitled Security Guidelines for the Petroleum Industry, and, as with its security assessment guidelines, provides it as a free download through its website.