Implementation of Chemical Facility Anti-Terrorism Standards (CFATS): Issues for Congress

The Department of Homeland Security (DHS) implements the Chemical Facility Anti-Terrorism Standards (CFATS) regulations, which regulate security at high-risk facilities possessing more than certain amounts of one or more chemicals of interest. Facilities possessing more than the specified amount must register with DHS through this program (a process known as the Top- Screen) and perform security-related activities. The DHS identifies a subset of high-risk chemical facilities from among those that register. These high-risk chemical facilities must submit a security vulnerability assessment, which DHS uses to confirm their high-risk designation, and a site security plan, which DHS then authorizes. The DHS also inspects high-risk chemical facilities for adherence to their submitted site security plans and later for compliance with these plans following DHS approval. The DHS regulates approximately 4,300 facilities under this program and is in the process of implementing requirements for security vulnerability assessment, site security planning, and inspection.

The DHS has had challenges meeting its own projections and congressional expectations regarding program performance, raising questions about its ability to achieve steady-state regulatory implementation. As of February 2014, DHS had made final risk assignments to 3,325 of the approximately 4,200 regulated facilities. The DHS authorizes a site security plan when the submitted plan satisfies CFATS requirements. Following a successful authorization inspection, DHS approves the site security plan. As of April 2014, DHS had authorized 1,335 site security plans; conducted 912 authorization inspections; and approved 649 site security plans. Between October 2012 and April 2014, DHS authorized an average of 73 and approved an average of 38 site security plans per month. The DHS increased its average authorization and approval rate over time; between October 2013 and April 2014, DHS authorized an average of 98 and approved an average of 50 site security plans per month.

This report analyzes data from a variety of DHS presentations, testimony, and other sources to present a historical overview of program performance to date. It identifies an ongoing gap between the number of facilities that have received final risk tier assignments and the total number of regulated facilities. This makes it appear likely that DHS will not have inspected or approved site security plans for some portion of the regulated facility universe for at least several years. In addition, the current rates of authorization of site security plans, authorization inspection, and approval of site security plans make it appear likely that DHS will not have completed implementation for the initial facilities before the date when it will potentially need to begin reinspecting already approved facilities. With the onset of compliance inspections, congressional policy makers may have further questions about the ability of the CFATS program to meet congressional expectations regarding timeliness.