CFATS established eighteen Risk-Based Performance Standards (RBPSs) that covered facilities are required to satisfy in their Site Security Plans (SSPs) or Alternate Security Programs (ASPs). The RBPSs are the essence of CFATS; each identifies the areas for which a facility’s security measures must be examined and addressed. Compliance with each RBPS is performance-based. In other words, DHS cannot mandate the precise manner by which a facility achieves the specific security outcome.
