Security Threats: Terrorism, Spills and Cyber Incidents

1. Why This Topic Matters for the CSP Exam

The BCSP Certified Safety Professional (CSP) exam treats emergency management as an all-hazards discipline. A safety professional is no longer judged only on how well they prevent slips, trips and falls; they are expected to protect people, property and operations from deliberate attacks, uncontrolled hazardous releases, and digital intrusions that can trigger physical harm. This content area sits within the CSP blueprint domain covering Emergency Preparedness, Fire Prevention and Security, and questions on it are typically scenario-based, asking you to prioritize actions, apply a regulation or standard, or select the best control.

Three realities make this topic high-value:
• Convergence: Physical security, process safety and cybersecurity now overlap. A phishing email can shut down a safety instrumented system; a disgruntled insider can open a valve; a truck bomb can breach a tank farm. The exam expects you to see these as one integrated risk picture.
• Regulatory weight: OSHA (29 CFR 1910.38, 1910.120, 1910.119, 1910.165), EPA (40 CFR 112 SPCC, 40 CFR 68 RMP, 40 CFR 355 EPCRA), DHS (CFATS, 6 CFR Part 27), DOT (49 CFR, Emergency Response Guidebook) and voluntary frameworks (NFPA 1600, NFPA 730/731, NIST Cybersecurity Framework, NIST SP 800-61, ISO 27001, IEC 62443, ASIS standards) all appear as answer options.
• Consequence severity: These are low-frequency, high-consequence events. Exam writers love them because the correct answer usually hinges on a principle (life safety first, defense in depth, recognize before you act) rather than a memorized fact.

2. What the Topic Covers – Definitions and Scope

2.1 Terrorism and Intentional Security Threats
Terrorism is the unlawful use or threatened use of force or violence against persons or property to intimidate or coerce a government or civilian population in furtherance of political, religious or ideological objectives. For the CSP, the practical categories are:
• CBRNE – Chemical, Biological, Radiological, Nuclear and Explosive agents. Chemical agents are grouped as nerve (sarin, VX), blister/vesicant (mustard, lewisite), blood (cyanide), choking (chlorine, phosgene) and riot-control agents. Biological agents are classified by the CDC as Category A (anthrax, smallpox, plague, botulism, tularemia, viral hemorrhagic fevers – highest priority), B and C. Radiological threats include the radiological dispersal device (dirty bomb); explosives include IEDs and VBIEDs (vehicle-borne IEDs).
• Workplace violence and active shooter – OSHA classifies workplace violence into four types: Type I (criminal intent, no legitimate relationship), Type II (customer/client), Type III (worker-on-worker), Type IV (personal relationship/domestic). The DHS guidance is Run, Hide, Fight.
• Insider threat – Employees or contractors with authorized access who intentionally or unintentionally cause harm. Controls include background screening, access control, separation of duties and behavioral threat assessment teams.
• Sabotage, theft and diversion – Especially of chemicals of interest (COI) under CFATS, radioactive sources (NRC increased controls), and precursors.

2.2 Spills and Hazardous Material Releases
A spill is an uncontrolled release of a hazardous substance to the workplace or environment, whether accidental, from natural hazards (Natech events) or deliberate. Key regulatory anchors:
• OSHA HAZWOPER, 29 CFR 1910.120 – Defines emergency response training levels: First Responder Awareness (sufficient training, often cited as 4 hours or demonstrated competency), First Responder Operations (8 hours), Hazardous Materials Technician (24 hours), Hazardous Materials Specialist (24 hours plus technician competency), and On-Scene Incident Commander (24 hours). Site cleanup workers require 40 hours plus 3 days supervised field experience (24 hours plus 1 day for occasional/limited exposure), with 8 hours annual refresher and 8 additional hours for supervisors. An incidental release (can be absorbed, neutralized or controlled by employees in the immediate area) is NOT an emergency response and does not trigger 1910.120(q).
• PPE levels – Level A (fully encapsulating vapor-protective suit with SCBA; highest respiratory and skin protection), Level B (SCBA with splash-protective non-encapsulating suit; highest respiratory, lesser skin), Level C (air-purifying respirator; contaminant known, oxygen adequate, concentrations below IDLH), Level D (work uniform, no respiratory protection).
• OSHA Process Safety Management, 29 CFR 1910.119 and EPA Risk Management Program, 40 CFR 68 – Threshold quantities of highly hazardous chemicals, process hazard analysis, emergency planning and worst-case release scenarios.
• EPA SPCC, 40 CFR 112 – Oil storage facilities with greater than 1,320 gallons aboveground (or 42,000 gallons underground) that could reasonably discharge to navigable waters must have a Spill Prevention, Control and Countermeasure plan, including secondary containment sized for the largest tank plus freeboard for precipitation.
• EPCRA / SARA Title III – Extremely Hazardous Substances, Reportable Quantities (RQ), Tier II reporting, Local Emergency Planning Committees (LEPC) and State Emergency Response Commissions (SERC). A release of a CERCLA hazardous substance at or above its RQ must be reported immediately to the National Response Center.
• DOT Emergency Response Guidebook (ERG) – Orange-bordered guide pages for response actions, green-bordered pages for initial isolation and protective action distances for toxic inhalation hazard materials, UN/NA identification numbers and placards. NFPA 704 diamond gives health (blue), flammability (red), instability (yellow) and special hazard (white) ratings 0-4.

2.3 Cyber Incidents Affecting Safety
A cyber incident is an event that jeopardizes the confidentiality, integrity or availability of information or control systems. For safety professionals the concern is Operational Technology (OT) – Industrial Control Systems (ICS), SCADA, Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs) and Safety Instrumented Systems (SIS) – where a compromise can produce a physical release, fire, explosion or equipment failure. Important reference events: Stuxnet (2010, centrifuge damage via PLC manipulation), the Ukrainian grid attacks (2015-2016), Triton/Trisis (2017, malware targeting a petrochemical plant safety system), Colonial Pipeline ransomware (2021, IT compromise forcing OT shutdown), and the Oldsmar water treatment intrusion (2021, attempted chemical dosing change). Common attack vectors: phishing and credential theft, ransomware, unpatched remote access, removable media (USB), compromised vendors and supply chain, and insider misuse.
Key frameworks: NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover, plus Govern in version 2.0); NIST SP 800-61 incident response life cycle (Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity); IEC 62443 for industrial automation security with zones and conduits; the Purdue Enterprise Reference Architecture for segmenting enterprise IT from plant control layers; and CISA as the lead US agency for critical infrastructure cyber guidance.

3. How It Works – The Management Framework

3.1 Risk Assessment
Security risk is commonly expressed as Risk = Threat x Vulnerability x Consequence. A Security Vulnerability Assessment (SVA) follows: characterize assets and criticality, identify threats (design basis threat), analyze vulnerabilities, estimate consequences, evaluate existing countermeasures, and recommend risk reduction. The CCPS/API SVA methodology and the DHS CFATS Top-Screen, SVA and Site Security Plan process (with Risk-Based Performance Standards) are frequently referenced. Under CFATS, facilities holding Chemicals of Interest above Screening Threshold Quantities are tiered 1 (highest) to 4.

3.2 Layered Protection – Defense in Depth
Physical security is built on the functions Deter, Detect, Delay, Deny/Defend, Respond. Layers move outward-in: perimeter (fencing, standoff distance, vehicle barriers rated by ASTM F2656, lighting, CPTED landscaping), building envelope (access control, intrusion detection, blast-resistant glazing), interior (zoned access, badge systems, visitor management), and asset level (locked controls, tamper seals). Delay time of barriers must exceed the response time of the security force for the layer to be effective. Crime Prevention Through Environmental Design (CPTED) principles are natural surveillance, natural access control, territorial reinforcement and maintenance. In cyber, defense in depth means network segmentation (demilitarized zone between IT and OT, unidirectional gateways/data diodes where justified), least privilege, multifactor authentication, patch and configuration management, application whitelisting on control systems, secure remote access, monitoring/intrusion detection, offline backups and physical port control.

3.3 Planning and Preparedness
• Emergency Action Plan (OSHA 1910.38) minimum elements: procedures for reporting emergencies; evacuation policy, procedures and exit route assignments; procedures for employees who remain to operate critical operations before evacuating; accounting for all employees after evacuation; rescue and medical duties; and names/titles of contacts. Employers with more than 10 employees must have it in writing. Alarm systems must comply with 1910.165.
• NFPA 1600 (Standard on Continuity, Emergency and Crisis Management) provides the program framework: program management, planning, implementation, training, exercises, and program maintenance.
• NIMS and the Incident Command System (ICS) – Standardized, scalable command with the functions Command, Operations, Planning, Logistics and Finance/Administration; span of control of 3-7 (optimum 5); unity of command; common terminology; Unified Command for multi-jurisdictional events. HAZWOPER requires that the senior emergency response official on scene implements ICS.
• Protective action decisions – Evacuation versus shelter-in-place. Shelter-in-place is preferred when a toxic plume is transient and moving quickly, when evacuation routes pass through the hazard, or when there is insufficient time. For active threats, lockdown; for bomb threats, use a bomb threat checklist (keep the caller talking, note exact wording, background sounds, voice characteristics), do not use radios or cell phones near a suspected device, and let trained personnel decide on evacuation and search. Suspicious packages: do not handle, isolate the area, wash hands, notify security.
• Exercises – Progressive series: seminar, workshop, tabletop, drill, functional, full-scale (HSEEP). Evaluate, write after-action reports, and track corrective actions.

3.4 Response Sequence for a Spill
1. Recognize the release and identify the material (labels, SDS, placards, ERG, shipping papers, detection instruments).
2. Protect life – alarm, isolate and deny entry, evacuate upwind and uphill, account for personnel.
3. Notify – internal emergency organization, then external agencies (fire department/HazMat, NRC, SERC, LEPC as applicable within required timeframes).
4. Evaluate – quantity, toxicity, flammability, weather, receptors; decide incidental versus emergency.
5. Control – only trained and equipped responders enter; establish hot, warm and cold zones, decontamination corridor, backup team (2-in/2-out concept), containment (dike, absorb, plug, patch, stop flow at source if safe).
6. Recover and document – cleanup under HAZWOPER, waste disposal under RCRA, incident investigation, regulatory reporting, plan revision.

3.5 Response Sequence for a Cyber Incident Affecting Operations
1. Preparation – incident response plan integrating IT, OT, engineering and safety; asset inventory; backups; contact lists including CISA and law enforcement; tabletop exercises combining cyber and physical scenarios.
2. Detection and analysis – anomalous process behavior, alarms, unexpected setpoint changes, lost HMI visibility; verify through independent instrumentation; treat unexplained control behavior as potentially malicious.
3. Containment – move the process to a safe state (manual control or safe shutdown if integrity of controls is in doubt), isolate affected network segments, preserve forensic evidence, do not blindly restore.
4. Eradication and recovery – remove malware, rebuild from trusted images, validate safety system logic before restart, restore from offline backups.
5. Post-incident – root cause analysis, lessons learned, report to CISA/regulators as required, update SVA and controls.
The safety principle that governs exam answers: when control system integrity is uncertain, bring the process to a safe state first; information recovery is secondary to preventing a physical release.

3.6 Business Continuity and Recovery
Business Impact Analysis identifies critical functions, Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Continuity plans address alternate sites, redundant utilities, supply chain contingencies, crisis communications and employee support. ISO 22301 is the international business continuity standard. The exam may ask which plan addresses a particular gap: EAP (immediate life safety), Emergency Response Plan (hazard-specific response), Crisis Management Plan (strategic decisions and communications), Business Continuity Plan (sustaining operations), Disaster Recovery Plan (IT/system restoration).

4. How to Answer Exam Questions on This Topic

Step 1 – Identify the phase. Is the question about prevention/mitigation (controls, SVA, CPTED, segmentation), preparedness (plans, training, drills), response (first actions, ICS, PPE), or recovery (continuity, investigation)? The correct answer must match the phase.
Step 2 – Apply the priority hierarchy. Life safety first, then incident stabilization, then property and environment, then business and reputation. If an option protects people and another protects equipment or data, the people option wins unless the question explicitly states people are already safe.
Step 3 – Look for the governing standard. Keywords point to the source: training hours and PPE levels mean HAZWOPER; oil and 1,320 gallons mean SPCC; worst-case scenario and offsite consequence mean RMP; Chemicals of Interest and tiers mean CFATS; Identify-Protect-Detect-Respond-Recover means NIST CSF; zones and conduits mean IEC 62443; span of control means ICS/NIMS.
Step 4 – Eliminate options that violate a core principle. Untrained employees cleaning up an emergency release, using a radio next to a suspected bomb, continuing to run a process on a compromised controller, evacuating through the plume, or relying on a single barrier are all wrong by principle.
Step 5 – Prefer systematic over heroic. The CSP exam rewards recognize-evaluate-control, risk-based prioritization and management system answers over improvised individual action.
Step 6 – Watch qualifiers. Words such as FIRST, BEST, MOST appropriate, MINIMUM, and NOT change which option is correct. For FIRST questions in a release scenario, the answer is almost always protect/alert/isolate people, not clean up.

5. Exam Tips: Answering Questions on Security Threats: Terrorism, Spills and Cyber Incidents

• Memorize the numbers that recur: HAZWOPER 8/24/24/24 hour responder levels, 40 hours plus 3 days for cleanup workers, 8-hour annual refresher; SPCC 1,320 gallons aboveground; ICS span of control 3 to 7 with 5 optimal; NFPA 704 ratings 0-4 and color meanings; CFATS tiers 1-4; written EAP required above 10 employees; CDC bioterrorism Category A agents.
• Know the PPE logic, not just the letters. Level A is chosen when the skin hazard is a vapor or unknown; Level B when respiratory protection must be maximal but skin hazard is splash-only; Level C requires a known contaminant, adequate oxygen and concentrations below IDLH; Level D is nuisance-only. If the question says unknown substance, think Level A or B, never C.
• Distinguish incidental from emergency release. If employees in the immediate area can safely handle it with their routine training and equipment, it is incidental and 1910.120(q) does not apply. If evacuation, outside responders or an uncontrolled hazard is involved, it is an emergency response.
• Defense in depth is the default best answer for how to protect against intentional threats, both physical and cyber. Single-point solutions (a bigger fence, one firewall, one guard) are usually distractors.
• For cyber-physical scenarios, choose safe state first. If a control system shows unexplained behavior, the best first action is to transition to manual control or safe shutdown and isolate the network segment – not to reboot, not to pay a ransom, not to keep running while IT investigates.
• Segmentation language: If the question asks how to reduce the chance that an office network compromise reaches plant controls, the answer involves network segmentation, DMZ, firewalls between zones, or unidirectional gateways – aligned with the Purdue model and IEC 62443.
• Insider threat questions favor layered administrative controls: pre-employment screening, access based on need, separation of duties, prompt revocation of access at termination, and a behavioral threat assessment process. Avoid answers that rely solely on surveillance or solely on trust.
• Bomb threat etiquette: keep the caller on the line, use a checklist, note details, notify the designated authority, do not transmit on radios or cell phones near a suspicious item, and let trained personnel direct search and evacuation decisions. Employees familiar with the area search because they recognize what does not belong.
• Active shooter: Run, Hide, Fight in that order of preference; when law enforcement arrives, keep hands visible and follow commands. Training and drills, not armed employees, are the expected program control.
• Shelter-in-place versus evacuation: shelter in place for short-duration toxic plumes, when evacuation routes cross the hazard, or when time is insufficient; evacuate for fires, explosions, structural threats and long-duration releases. Shelter actions include shutting HVAC, closing doors and windows, and moving to interior rooms.
• Reporting chains: Internal notification and life safety come before external calls, but once the release meets a Reportable Quantity, the National Response Center must be notified immediately, with SERC and LEPC notifications under EPCRA. Know that the LEPC is the local community planning body and the SERC is the state body.
• ICS principles that are tested: unity of command (each person reports to one supervisor), manageable span of control, common terminology, modular organization that expands and contracts, unified command for multiple agencies, and the Incident Commander owning the incident while safety officer has authority to stop unsafe acts.
• Plan hierarchy: Match the gap to the plan – EAP for evacuation and alarms, ERP for hazard-specific tactics, Crisis Management Plan for executive decisions and media, BCP for keeping the business running, DRP for restoring IT systems.
• Risk formula questions: Threat x Vulnerability x Consequence. Reducing any factor reduces risk; a facility usually cannot control threat, so controls target vulnerability (hardening) and consequence (inventory reduction, inherently safer design, setback distance). Inventory reduction or substitution of a less hazardous chemical is often the BEST long-term answer because it removes the target.
• Exercise progression: from discussion-based (seminar, workshop, tabletop) to operations-based (drill, functional, full-scale). A question asking for the least disruptive way to test a new plan points to a tabletop exercise; one asking to validate actual capability points to functional or full-scale.
• Beware of absolute or heroic distractors such as attempting to stop a leak at the source without PPE, confronting an intruder, or shutting down the entire plant for every phishing email. Proportionate, risk-based, pre-planned action is the CSP answer.
• Read for the role. The exam asks what the safety professional should do or recommend – typically plan, train, coordinate, assess and advise – not what a SWAT officer or forensic analyst would do.

6. Worked Practice Questions

Question 1. A forklift punctures a 55-gallon drum of an unidentified solvent in a warehouse. Vapors are spreading and two workers report dizziness. What should be done FIRST?
A. Apply absorbent to the pool and ventilate the area.
B. Evacuate the area upwind, sound the alarm and account for personnel.
C. Consult the SDS to determine the chemical identity.
D. Don Level C PPE and plug the drum.
Answer: B. Symptomatic exposure and an unknown material make this an emergency response, not an incidental release. Life safety and isolation come first; identification and control follow by trained responders. Level C is inappropriate for an unknown.

Question 2. An operator notices that a reactor temperature setpoint changed without any logged operator action, and the HMI intermittently loses communication with the PLC. What is the MOST appropriate immediate action?
A. Reboot the HMI workstation to restore communication.
B. Contact the vendor to request a software patch.
C. Transition the process to a safe state under manual control and isolate the affected network segment.
D. Continue operation while the IT department reviews firewall logs.
Answer: C. Unexplained control behavior is treated as a potential compromise of control integrity; the safety priority is a safe state and containment, preserving evidence rather than rebooting.

Question 3. A chemical facility wants to reduce its attractiveness as a terrorist target and lower its CFATS tier. Which measure is MOST effective?
A. Increase the number of security cameras at the perimeter.
B. Reduce the on-site inventory of the Chemical of Interest below the screening threshold quantity.
C. Issue new photo ID badges to all employees.
D. Conduct monthly bomb-threat drills.
Answer: B. Reducing consequence by eliminating or minimizing the hazardous inventory is inherently safer and directly affects CFATS applicability; the other options address vulnerability only marginally.

Question 4. Under OSHA HAZWOPER, the MINIMUM training for a Hazardous Materials Technician who will approach a release to plug or patch a leaking container is:
A. 8 hours. B. 16 hours. C. 24 hours. D. 40 hours.
Answer: C. Technician level requires 24 hours at the operations level plus demonstrated technician competencies.

Question 5. During a toxic gas release from a neighboring plant, a cloud is expected to pass over a facility within 10 minutes and dissipate within 30 minutes. The BEST protective action for employees is to:
A. Evacuate by vehicle to the designated offsite assembly point.
B. Shelter in place, shut down HVAC and seal interior rooms.
C. Issue escape respirators and continue working.
D. Move everyone to the roof for fresh air.
Answer: B. A short-duration transient plume with little warning is the classic shelter-in-place scenario; evacuation could place people in the cloud.

7. One-Page Recall Summary

• Risk = Threat x Vulnerability x Consequence; manage vulnerability and consequence.
• Physical security functions: Deter, Detect, Delay, Deny, Respond; barrier delay must exceed response time.
• CPTED: natural surveillance, natural access control, territorial reinforcement, maintenance.
• HAZWOPER levels and hours: Awareness, Operations 8, Technician 24, Specialist 24, IC 24; cleanup 40 plus 3 days; refresher 8 annually.
• PPE: A (vapor, full encapsulation, SCBA), B (SCBA, splash suit), C (APR, known contaminant), D (no respiratory).
• Incidental release handled by local workers; emergency release requires trained responders and ICS.
• EAP elements under 1910.38; written if more than 10 employees; alarms under 1910.165.
• ICS: command, operations, planning, logistics, finance/admin; span of control 3-7; unity of command; unified command.
• SPCC 1,320 gallons aboveground; RMP worst-case scenario; EPCRA RQ to NRC, SERC, LEPC; CFATS tiers 1-4.
• NIST CSF: Identify, Protect, Detect, Respond, Recover (Govern in 2.0); NIST 800-61 incident life cycle; IEC 62443 zones and conduits; Purdue model segmentation.
• Cyber-physical rule: safe state first, isolate, preserve evidence, validate safety logic before restart.
• Active shooter: Run, Hide, Fight. Bomb threat: checklist, keep caller talking, no radios near device. Suspicious package: do not touch, isolate, notify.
• Exercise ladder: seminar, workshop, tabletop, drill, functional, full-scale.
• Plans: EAP, ERP, Crisis Management, Business Continuity, Disaster Recovery – match the plan to the gap.

Master these principles and the regulatory anchors, apply the life-safety-first hierarchy, and read each stem for its phase and qualifier, and you will handle any CSP question on terrorism, spills and cyber incidents with confidence.