To help it implement the final reader rule entitled "Transportation Worker Identification Credential (TWIC)-Reader Requirements," the U.S. Coast Guard (USCG) asked the Homeland Security Operational Analysis Center (HSOAC) to estimate the population of the Maritime Transportation Security Act-regulated facilities that the rule might affect; develop a transparent, objective risk assessment model for these facilities; and conduct a cost-benefit analysis of the regulation.This report describes our analytical efforts to address the three research areas mentioned above. Because there is no database of Maritime Transportation Security Act-regulated facilities with all the requisite information about certain dangerous cargoes that facilities handle in bulk, we resorted to other data sources, such as the U.S. Environmental Protection Agency's databases, an online survey, and interviews, to estimate the facility population. For the facility risk model, we used the modeling approach for assessing potential consequence included in the risk engine of the Cybersecurity and Infrastructure Security Agency's Chemical Facility Anti-Terrorism Standards (CFATS) program, harmonizing the TWIC and CFATS programs in consequence assessment. Because there was no credible estimate for the probability of a transportation security incident, we used a break-even analysis to assess whether the final reader rule is cost-effective.This research was sponsored by the USCG Office of Standards Evaluation and Development and conducted within the Strategy, Policy, and Operations Program of the HSOAC federally funded research and development center (FFRDC).Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements vi
S.2. Our ApproachThe overarching principle of our study is transparency and defensibility in support of rulemaking and implementation. To that end, we • used only unclassified and nonproprietary data • applied consistent, reproducible approaches • clearly documented the formulations, assumptions, and limitations of our approaches.For example, because a single comprehensive data source with the requisite information does not exist, we collected and collated facility-level information from multiple unclassified data sources to estimate the population of facilities subject to the reader rule delay. We decided to conduct a consequence-based risk assessment for this study because threat and vulnerability information is typically restricted.Our facility risk model is based on the Cybersecurity and Infrastructure Security Agency's well-known and well-documented Chemical Facility Anti-Terrorism Standards risk engine (Cybersecurity and Infrastructure Security Agency, 2021), whose consequence (in terms of the number of fatalities resulting from a potential CDC release) assessment methodologies are objective (i.e., physics-based and reproducible) and transparent (i.e., with ample documentation). We further developed a facility typology to practically group facilities based on observable attributes, such as CDC quant...