Roberts Law Group News

GAO CFATS Report

 

The U.S. Government Accountability Office (GAO) has published a report on the Chemical Facility Anti-Terrorism Standards (CFATS) titled, “Progress and Challenges in DHS’s Management of Its Chemical Facility Security Program.” Across five main areas, GAO found that the Department of Homeland Security (DHS) made progress addressing many of the challenges that GAO previously identified in DHS’s management of the CFATS program, but that other challenges remain.
 
  1. Identifying High-Risk Chemical Facilities
 
Based on its 2014 recommendation to improve data sharing with other federal and state agencies to identify potentially noncompliant facilities, GAO noted that DHS subsequently compared its data with data from other federal agencies, such as the Environmental Protection Agency (EPA) and Chemical Facility Safety and Security Working Group member states. As a result, DHS identified approximately 1,000 additional facilities that should have reported information to comply with CFATS. In addition, DHS received 43 lists of potentially noncompliant facilities from 34 state governments, and DHS has hired an individual to serve as the lead staff member responsible for overseeing the review of these lists.
 
Furthermore, based on its 2015 recommendation to verify the accuracy of self-reported release-toxic chemical information, GAO noted that DHS revised its Top-Screen methodology so that it now calculates the risk of release-toxic chemicals, rather than relying on facilities to do so.
 
  1. Assessing Risk and Prioritizing Facilities
 
Based on its 2013 recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, GAO noted that DHS revised the CFATS risk assessment methodology to include threat, vulnerability, and consequence and conducted peer and technical reviews to verify and validate the CFATS program’s new risk assessment approach.
 
  1. Reviewing and Approving Facility Security Plans
 
GAO noted that DHS made progress reviewing and approving facility security plans by reducing the time it takes to review these plans and eliminating the backlog of plans that were awaiting review.
 
  1. Inspecting Facilities and Ensuring Compliance
 
In 2015, GAO found that nearly half of the facilities DHS had inspected were not fully compliant with their approved security plans, but that DHS did not have documented procedures for managing facilities’ noncompliance. GAO recommended that DHS document processes and procedures for managing compliance, and it is currently reviewing the revised CFATS Standard Operating Procedures that DHS developed in response.
 
In 2018, GAO noted that DHS’s methodology did not measure the CFATS program’s impact on reducing a facility’s vulnerability to an attack. GAO recommended that DHS incorporate methods to help measure vulnerability-reduction to high-risk facilities, and use that data to assess the CFATS program’s performance in lowering risk and enhancing national security. In response, DHS stated that it intends to implement two new performance metrics by the end of Q1 2019 to: (1) evaluate the progress of individual facilities in enhancing their security while part of the CFATS program; and (2) demonstrate an increase in the security posture across the population of CFATS facilities.
 
  1. Conducting Stakeholder and First Responder Outreach
 
Based on its 2013 recommendation that DHS take action to solicit and document feedback on its facility outreach initiatives, GAO noted that DHS developed a questionnaire to solicit feedback on outreach with industry stakeholders, which it began using in 2016.
 
In 2018, GAO found over 200 CFATS chemicals that are not covered under Emergency Planning and Community Right-to-Know Act reporting requirements, but acknowledged DHS’s Infrastructure Protection (IP) Gateway interface that provides access to CFATS facility-specific information missing from these other required reports. GAO found, however, that the IP Gateway is not widely used and that most Local Emergency Planning Committees do not have access to the IP Gateway. In response, DHS included IP Gateway information in three revised fact sheets and an outreach presentation. In addition, DHS intends to contact first responders representing the top 25% of CFATS high-risk chemical facilities no later than March 2019 to help ensure they are prepared to respond to incidents at these facilities.