ISCD has direct responsibility for  implementing DHS’s CFATS rule, including assessing potential risks and  identifying high-risk chemical facilities, promoting effective security  planning, and ensuring that final high-risk facilities meet applicable  standards through site security plans approved by DHS. ISCD Has Assigned Thousands of Facilities to Tiers, but ISCD’s Approach to Risk Assessment Does Not Reflect All Risk Elements

		ISCD Has Tiered Thousands of High-Risk Chemical Facilities and Resolved Some Problems Using Its Risk Assessment Approach to Assign Tiers

In July 2007, ISCD began reviewing information submitted by the owners  and operators of approximately 40,000 facilities. ISCD’s Risk Assessment Approach Does Not Consider All Elements of Risk

Our preliminary analyses indicates that the tiering approach ISCD uses to  assess risk and assign facilities to final tiers does not consider all of the  elements of risk associated with a terrorist attack involving certain  chemicals.   Consequence. ISCD’s risk assessment approach is also not consistent with  the NIPP because it does not consider threat for the majority of  regulated facilities.   Vulnerability. Similar to the NIPP, the CFATS rule calls for ISCD to review  facilities’ security vulnerability assessments as part of its risk-based  tiering process. ISCD Has Begun to Take Actions to Examine How Its Approach Could Be Enhanced

Our preliminary work indicates that ISCD has begun to take some actions  to examine how its risk assessment approach can be enhanced. For  example, in addition to engaging Sandia National Laboratories to develop  the framework for assessing economic consequences previously  discussed, ISCD has commissioned a panel of subject matter experts to  examine the strengths and weaknesses of its current risk assessment  approach. Given  the critical nature of ISCD’s risk assessment approach in laying the  foundation for further regulatory steps in improving facility security—such  as the development and approval of facility site security plans—it is  important that its approach for assigning facilities to tiers is complete  within the NIPP risk management framework and the CFATS rule. We will continue to monitor and assess  ISCD’s efforts to examine its risk assessment approach through our  ongoing work and consider any recommendations needed to address  these issues. ISCD Revised Its Security Plan Review Process, but Plan Approvals Could Take Years

		ISCD Revised Its Security Plan Review Process because of ISCD Managers’ Concerns, and Plans to Measure Related Improvements Moving Forward

Our preliminary work shows that ISCD has made various revisions to its  security plan review process to address concerns expressed by ISCD  managers about slow review times. The  memorandum stated that revising the process was a top program priority  because the initial security plan reviews were conducted using the risk- based standards as prescriptive criteria rather than as standards for  developing an overall facility security strategy. Moving  forward, ISCD officials said they intend to measure the time it takes to  complete parts of the revised process and have recently implemented a  plan to measure various aspects of the process. Collecting  data to measure performance about various aspects of the security plan  review process is a step in the right direction, but it may take time before  the process has matured to the point where ISCD is able to establish  baselines and assess its progress. Using ISCD’s estimated approval rate of 30 to 40 plans a month, our  preliminary analysis indicates that it could take anywhere from 7 to 9  years to complete reviews and approvals for the approximately 3,120  plans submitted by facilities that have been final-tiered that ISCD has  not yet begun to review. According to ISCD officials, they are actively exploring ways to expedite  the speed with which the backlog of security plans could be cleared, such  as potentially leveraging alternative security programs, reprioritizing  resources, and streamlining the inspection and review requirements. ISCD Has Increased Its Efforts to Communicate and Work with Facilities, but Does Not Solicit Systematic Feedback on Effectiveness of Its Outreach

		ISCD’s External Communication Efforts with Facilities Have Increased since 2007, but Selected Trade Associations Had Mixed Views about ISCD Efforts

Our preliminary work shows that ISCD’s efforts to communicate and work  with owners and operators to help them enhance security at their facilities  have increased since the CFATS program’s inception in 2007, particularly  in recent years. Trade  association officials reported that in general ISCD seeks informal  feedback on its outreach efforts and that members provide feedback to  ISCD. Specifically, our prior work on customer service efforts in the government  indicates that systematic feedback from those receiving services can  provide helpful information as to the kind and quality of services they want  and their level of satisfaction with existing services. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program in 2007 to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, which manages the program, places high-risk facilities in risk-based tiers and is to conduct inspections after it approves facility security plans. A November 2011 ISCD internal memorandum raised concerns about ISCD's ability to fulfill its mission.
This statement is based on GAO's ongoing work conducted for several congressional committees and subcommittees and provides preliminary observations regarding the extent to which DHS has (1) assigned chemical facilities to tiers and assessed its approach for doing so, (2) revised its process to review facility security plans, and (3) communicated and worked with owners and operators to improve security. To conduct this ongoing work, GAO reviewed DHS reports and plans on risk assessments, security plan reviews, and facility outreach and interviewed DHS officials. GAO received input from 11 trade associations representing chemical facilities about ISCD outreach. The results of this input are not generalizable but provide insights about DHS outreach efforts.

What GAO Found

Since 2007, the Department of Homeland Securitys (DHS) Infrastructure Security Compliance Division (ISCD) has assigned about 3,500 high-risk chemical facilities to risk-based tiers under its Chemical Facilities Anti-Terrorism Standards (CFATS) program, but it has not fully assessed its approach for doing so. The approach ISCD used to assess risk and make decisions to place facilities in final tiers does not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. For example, the risk assessment approach is based primarily on consequences arising from human casualties, but does not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation, nor does it include vulnerability, consistent with the NIPP. ISCD has begun to take some actions to examine how its risk assessment approach can be enhanced. Specifically, ISCD has, among other things, engaged Sandia National Laboratories to examine how economic consequences can be incorporated into ISCD's risk assessment approach and commissioned a panel of experts to assess the current approach, identify strengths and weaknesses, and recommend improvements. Given the critical nature of ISCD's risk assessment approach in laying the foundation for further regulatory steps in improving facility security, it is important that its approach for assigning facilities to tiers is complete within the NIPP risk management framework and the CFATS regulation.
DHS's ISCD has revised its process for reviewing facilities' site security plans-- which are to be approved by ISCD before it performs compliance inspections-- but it did not track data on the prior process so is unable to measure any improvements. The past process was considered by ISCD to be difficult to implement and caused bottlenecks in approving plans. ISCD views its revised process to be a significant improvement because, among other things, teams of experts review parts of the plans simultaneously rather than sequentially, as occurred in the past. Moving forward, ISCD intends to measure the time it takes to complete reviews, but will not be able to do so until the process matures. Using ISCD's expected plan approval rate of 30 to 40 plans a month, GAO estimated that it could take another 7 to 9 years before ISCD is able to complete reviews on the approximately 3,120 plans in its queue. ISCD officials said that they are exploring ways to expedite the process, such as reprioritizing resources.
DHS's ISCD has also taken various actions to work with facility owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but trade associations that responded to GAO's query had mixed views on the effectiveness of ISCD's outreach. ISCD solicits informal feedback from facility owners and operators on its efforts to communicate and work with them, but it does not have an approach for obtaining systematic feedback on its outreach activities. Prior GAO work on customer service efforts in the government indicates that systematic feedback from those receiving services can provide helpful information as to the kind and quality of services they want and their level of satisfaction with existing services. GAO will continue to assess ISCD's efforts in these areas and consider any recommendations needed to address these issues. GAO expects to issue a report on its results in April 2013.