DHS Has Made  Progress Addressing  Past Challenges, But  Some Actions are Still  In Progress Our past work has identified progress and challenges in a number of  areas related to DHS’s management of the CFATS program including (1)  the process for identifying high risk chemical facilities; (2) how it assesses  risk and prioritizes facilities; (3) reviewing and approving facility security  plans; (4) how it conducts facility compliance inspections; and (5) efforts  to conduct stakeholder outreach and gather feedback. DHS has made a  number of programmatic changes to CFATS in recent years that may also  impact its progress in addressing our open recommendations; these  changes are included as part of our ongoing review of the program. Identifying High-Risk  Chemical Facilities In May 2014, we found that more than 1,300 facilities had reported having  ammonium nitrate to DHS. However, based on our review of state data  and records, there were more facilities with ammonium nitrate holdings  than those that had reported to DHS under the CFATS program. Thus,  we concluded that some facilities that were required to report may have  failed to do so. We recommended that DHS work with other agencies,  including the Environmental Protection Agency (EPA), to develop and  implement methods of improving data sharing among agencies and with  states as members of a Chemical Facility Safety and Security Working  Group. DHS agreed with our recommendation and has since addressed  it. Specifically, DHS compared DHS data with data from other federal  agencies, such as EPA, as well as member states from the Chemical  Facility Safety and Security Working Group to identify potentially  noncompliant facilities. As a result of this effort, in July 2015, DHS  officials reported that they had identified about 1,000 additional facilities  that should have reported information to comply with CFATS and  subsequently contacted these facilities to ensure compliance. DHS  officials told us that they continue to engage with states to identify  potentially non-compliant facilities. For example, as of June 2018, DHS  officials stated they have received 43 lists of potentially noncompliant  facilities from 34 state governments, which are in various stages of review  by DHS. DHS officials also told us that they recently hired an individual to  serve as the lead staff member responsible for overseeing this effort. DHS has also taken action to strengthen the accuracy of data it uses to  identify high risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for  facilities that held toxic chemicals that could threaten surrounding  communities if released. At the time, DHS required that facilities self- report the Distance of Concern—an area in which exposure to a toxic  chemical cloud could cause serious injury or fatalities from short-term  exposure—as part of its Top-Screen. We estimated that more than  2,700 facilities with a toxic release threat had misreported the Distance of  Concern and therefore recommended that DHS (1) develop a plan to  implement a new Top-Screen to address errors in the Distance of  Concern submitted by facilities, and (2) identify potentially miscategorized  facilities that could cause the greatest harm and verify that the Distance  of Concern of these facilities report is accurate. DHS has fully  addressed both of these recommendations. Specifically, DHS  implemented an updated Top-Screen in October 2016 and now collects  data from facilities and calculates the Distance of Concern itself, rather  than relying on the facilities’ calculation. In response to our second  recommendation, in November 2016, DHS officials stated they completed  an assessment of all Top-Screens that reported threshold quantities of  toxic release chemicals of interest and identified 158 facilities with the  potential to cause the greatest harm. As of May 2017, according to ISCD  officials, 156 of the 158 facilities submitted updated Top-Screens and 145  of the 156 Top-Screens had undergone a quality assurance review  process. Assessing Risk and  Prioritizing Facilities DHS has also taken actions to better assess regulated facilities’ risks in  order to place the facilities into the appropriate risk tier. In April 2013, we  reported that DHS’s risk assessment approach did not consider all of the  elements of threat, vulnerability, and consequence associated with a  terrorist attack involving certain chemicals. Our work showed that DHS’s  risk assessment was based primarily on consequences from human  casualties, but did not consider economic consequences, as called for by  the National Infrastructure Protection Plan (NIPP) and the CFATS  regulation. We also found that (1) DHS’s approach was not consistent  with the NIPP because it treated every facility as equally vulnerable to a  terrorist attack regardless of location or on-site security and (2) DHS was  not using threat data for 90 percent of the tiered facilities—those tiered for  the risk of theft or diversion—and using 5-year-old threat data for the  remaining 10 percent of those facilities that were tiered for the risks of  release or sabotage. We recommended that DHS enhance its risk  assessment approach to incorporate all elements of risk and conduct a  peer review after doing so. DHS agreed with our recommendations and  has made progress towards addressing them. Specifically, with regard to our recommendation that DHS enhance its risk  assessment approach to incorporate all elements of risk, DHS worked  with Sandia National Laboratories to develop a model to estimate the  economic consequences of a chemical attack. In addition, DHS worked  with Oak Ridge National Laboratory to devise a new tiering methodology,  called the Second Generation Risk Engine. In so doing, DHS revised the  CFATS threat, vulnerability, and consequence scoring methods to better  cover the range of CFATS security issues. Additionally, with regard to our  recommendation that DHS conduct a peer review after enhancing its risk  assessment approach, DHS conducted peer reviews and technical  reviews with government organizations and facility owners and operators,  and worked with Sandia National Laboratories to verify and validate the  new tiering approach. We are currently reviewing the reports and data  that DHS has provided about its new tiering methodology as part of our  ongoing work and will report on the results of this work later this summer. To further enhance its risk assessment approach, in fall 2016, DHS also  revised its Chemical Security Assessment Tool (CSAT), which supports  DHS efforts to gather information from facilities to assess their risk.  According to DHS officials, the new tool—called CSAT 2.0—is intended to  eliminate duplication and confusion associated with DHS’s original CSAT.  DHS officials told us that they have improved the tool by revising some  questions in the original CSAT to make them easier to understand;  eliminating some questions; and pre-populating data from one part of the  tool to another so that users do not have to retype the same information  multiple times. DHS officials also told us that the facilities that have used  the CSAT 2.0 have provided favorable feedback that the new tool is more  efficient and less burdensome than the original CSAT. Finally, DHS  officials told us that as of June 2018, DHS has completed all notifications  and has processed tiering results for all but 226 facilities. DHS officials  stated they are currently working to identify correct points of contact to  update registration information for these remaining facilities. We are  currently assessing DHS’s efforts to assess risk and prioritize facilities as  part of our ongoing work and will report on the results of this work in our  report later this summer. Reviewing and Approving  Facility Site Security Plans DHS has also made progress reviewing and approving facility site  security plans by reducing the time it takes to review these plans and  eliminating the backlog of plans awaiting review. In April 2013, we  reported that DHS revised its procedures for reviewing facilities’ security  plans to address DHS managers’ concerns that the original process was  slow, overly complicated, and caused bottlenecks in approving plans.  We estimated that it could take DHS another 7 to 9 years to review the  approximately 3,120 plans in its queue at that time. We also estimated  that, given the additional time needed to do compliance inspections, the  CFATS program would likely be implemented in 8 to 10 years. We did not  make any recommendations for DHS to improve its procedures for  reviewing facilities’ security plans because DHS officials reported that  they were exploring ways to expedite the process, such as reprioritizing  resources and streamlining inspection requirements. In July 2015, we  reported that DHS had made substantial progress in addressing the  backlog—estimating that it could take between 9 and 12 months for DHS  to review and approve security plans for the approximately 900 remaining  facilities. DHS officials attributed the increased approval rate to  efficiencies in DHS’s review process, updated guidance, and a new case  management system. Subsequently, DHS reported in its December 2016  semi-annual report to Congress that it had eliminated its approval  backlog. Finally, we found in our 2017review that DHS also took action to  implement an Expedited Approval Program (EAP). The CFATS Act of  2014 required that DHS create the EAP as another option that tier 3 and  tier 4 chemical facilities may use to develop and submit security plans to  DHS. Under the program, facilities may develop a security plan based  on specific standards published by DHS (as opposed to the more flexible  performance standards using the standard, non-expedited process). DHS  issued guidance intended to help facilities prepare and submit their EAP  security plans to DHS, which includes an example that identifies  prescriptive security measures that facilities are to have in place.  According to committee report language, the EAP was expected to  reduce the regulatory burden on smaller chemical companies, which may  lack the compliance infrastructure and the resources of large chemical  facilities, and help DHS to process security plans more quickly. If a tier 3  or 4 facility chooses to use the expedited option, DHS is to review the  plan to determine if it is facially deficient, pursuant to the reporting  requirements of the CFATS Act of 2014. If DHS approves the EAP site  security plan, it is to subsequently conduct a compliance inspection. In 2017, we found that DHS had implemented the EAP and had reported  to Congress on the program, as required by the CFATS Act of 2014. In  addition, as of June 2018 according to DHS officials, only 18 of the 3,152  facilities eligible to use the EAP opted to use it. DHS officials we  interviewed attributed the low participation to several possible factors  including: DHS had implemented the expedited program after most eligible  facilities already submitted standard (non-expedited) security plans to  DHS;  facilities may consider the expedited program’s security measures to  be too strict and prescriptive, not providing facilities the flexibility of  the standard process; and  the lack of an authorization inspection may discourage some facilities  from using the expedited program because this inspection provides  useful information about a facility’s security. We also found in 2017 that recent changes made to the CFATS program  could affect the future use of the expedited program. As discussed  previously, DHS has revised its methodology for determining the level of  each facility’s security risk, which could affect a facility’s eligibility to  participate in the EAP. DHS continues to apply the revised methodology  to facilities regulated under the CFATS program and but it is too early to  assess the impact on participation in the EAP. Inspecting Facilities and  Ensuring Consistent  Compliance In our July 2015 report, we found that DHS began conducting compliance  inspections in September 2013, and by April 2015, had conducted  inspections of 83 of the 1,727 facilities that had approved security plans.  Our analysis showed that nearly half of the facilities were not fully  compliant with their approved site security plans and that DHS had not  used its authority to issue penalties because DHS officials found it more  productive to work with facilities to bring them in compliance. We also  found that DHS did not have documented processes and procedures for  managing the compliance of facilities that had not implemented planned  measures by the deadlines outlined in the plans. We recommended that  DHS document processes and procedures for managing compliance to  provide more reasonable assurance that facilities implement planned  measures and address security gaps. DHS agreed and has taken steps  toward implementing this recommendation. DHS updated its CFATS  Enforcement Standard Operating Procedure (SOP) and has made  progress on the new CFATS Inspections SOP. Once completed these  two documents collectively are expected to formally document the  processes and procedures currently being used to track noncompliant  facilities and ensure they implement planned measures as outlined in  their approved site security plans, according to ISCD officials. DHS  officials stated they expect to finalize these procedures by the end of  fiscal year 2018. We are examining compliance inspections as part of our  ongoing work and will report on the results of our work in our report later  this summer. Stakeholder Outreach and  Feedback In April 2013, we reported that DHS took various actions to work with  facility owners and operators, including increasing the number of visits to  facilities to discuss enhancing security plans, but that some trade  associations had mixed views on the effectiveness of DHS’s outreach.  We found that DHS solicited informal feedback from facility owners and  operators in its efforts to communicate and work with them, but did not  have an approach for obtaining systematic feedback on its outreach  activities. We recommended that DHS take action to solicit and document  feedback on facility outreach consistent with DHS efforts to develop a  strategic communication plan. DHS agreed and implemented this  recommendation by developing a questionnaire to solicit feedback on  outreach with industry stakeholders and began using the questionnaire in  October 2016. Chairman Shimkus, Ranking Member Tonko, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time. GAO Contact and  Staff  Acknowledgements If you or your staff members have any questions about this testimony,  please contact me at (404) 679-1875 or curriec@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this statement. Other individuals making key  contributions to this work include John Mortin, Assistant Director; and  Brandon Jones, Analyst-in-Charge; Michael Lennington, Ben Emmel, and  Hugh Paquette. This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.
Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. In accordance with the DHS Appropriations Act, 2007, DHS established the CFATS program in 2007 to, among other things, identify and assess the security risk posed by chemical facilities. DHS inspects high-risk facilities after it approves facility security plans to ensure that the facilities are implementing required security measures and procedures. This statement summarizes progress and challenges related to DHS's CFATS program management. This statement is based on prior products GAO issued from July 2012 through June 2017, along with updates conducted in June 2018 on DHS actions to address prior GAO recommendations. To conduct the prior work, GAO reviewed relevant laws, regulations, and DHS policies for administering the CFATS program, how DHS assesses risk, and data on high-risk chemical facilities. GAO also interviewed DHS officials and reviewed information on DHS actions to implement its prior recommendations. The Department of Homeland Security (DHS) has made progress addressing challenges that GAO's past work identified to managing the Chemical Facility Anti-Terrorism Standards (CFATS) program. The following summarizes progress made and challenges remaining in key aspects of the program. Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS used self-reported and unverified data to determine the risk of facilities holding toxic chemicals that could threaten surrounding communities if released. GAO recommended that DHS should better verify the accuracy of facility-reported data. DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so. Assessing risk and prioritizing facilities. In April 2013, GAO reported weaknesses in multiple aspects of DHS's risk assessment and prioritization approach. GAO made two recommendations for DHS to review and improve this process, including that DHS enhance its risk assessment approach to incorporate all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. DHS launched a new risk assessment methodology in October 2016 and is currently gathering new or updated data from about 27,000 facilities to (1) determine which facilities should be categorized as high-risk because of the threat of sabotage, theft or diversion, or a toxic release and (2) assign those facilities deemed high risk to one of four risk-based tiers. GAO has ongoing work assessing these efforts and will report later this summer on the extent to which they fully address prior recommendations. Reviewing and approving facilities' site security plans . DHS is to review security plans and visit facilities to ensure their security measures meet DHS standards. In April 2013, GAO reported a 7 to 9 year backlog for these reviews and visits. In July 2015, GAO reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS has since taken additional action to expedite these activities and has eliminated this backlog. Inspecting facilities and ensuring compliance. In July 2015, GAO reported that DHS conducted compliance inspections at 83 of the 1,727 facilities with approved security plans. GAO found that nearly half of the inspected facilities were not fully compliant with their approved security plans and that DHS did not have documented procedures for managing facilities' compliance. GAO recommended that DHS document procedures for managing compliance. As a result, DHS has developed an enforcement procedure and a draft compliance inspection procedure and expects to finalize the compliance inspection procedure by the end of fiscal year 2018.