	Observations on DHS Efforts to Identify Facilities, Assess Risk, Review Security Plans, and Verify Compliance

		Identifying Facilities Covered by CFATS

DHS has begun to take action to work with other agencies to identify  facilities that are required to report their chemical holdings to DHS but  may not have done so. The first step of the CFATS process is focused on identifying facilities that  might be required to participate in the program. As a result of the CFATS rule, about  40,000 chemical facilities reported their chemical holdings and their  quantities to DHS’s ISCD. Among other things, the hearing focused on whether the West, Texas,  facility should have reported its holdings to ISCD given the amount of  ammonium nitrate at the facility. On August 1, 2013, the same day as the hearing, the President issued  Executive Order 13650–Improving Chemical Facility Safety and Security,  which was intended to improve chemical facility safety and security in  coordination with owners and operators. In February 2014, DHS officials  told us that the working group has taken actions in the areas described in  the executive order. Assessing Risk and Prioritizing Facilities

DHS has also begun to take actions to enhance its ability to assess risk  and prioritize facilities covered by the program. ISCD uses a risk assessment approach to develop  risk scores to assign chemical facilities to one of four final tiers. As a result, in April 2013 we recommended that ISCD enhance its risk  assessment approach to incorporate all elements of risk and conduct a  peer review after doing so. Reviewing of Facilities’ Security Plans

DHS has begun to take action to lessen the time it takes to review site  security plans which could help DHS reduce the backlog of plans awaiting  review. The security plan is to describe security measures to be  taken and how such measures are to address applicable risk-based  performance standards. If ISCD determines that the site security plan is in compliance with  the CFATS regulation, ISCD approves the site security plan, and issues a  letter of approval to the facility, and the facility is to implement the  approved site security plan. We also  noted in April 2013 that ISCD had revised its process for reviewing  facilities’ site security plans. In February 2014, ISCD officials told us that they are taking a number of  actions intended to lessen the time it takes to complete reviews of  remaining plans including the following: providing updated internal guidance to inspectors and ISCD updating the internal case management system; providing updated external guidance to facilities to help them better  prepare their site security plans;  conducting inspections using one or two inspectors at a time over the  course of 1 day, rather than multiple inspectors over the course of  several days;  conducting pre-inspection calls to the facility to help resolve technical  issues beforehand;  creating and leveraging the use of corporate inspection documents  (i.e., documents for companies that have over seven regulated  facilities in the CFATS program);  supporting the use of alternative security programs to help clear the  backlog of security plans because, according to DHS officials,  alternative security plans are easier for some facilities to prepare and  use; and  taking steps to streamline and revise some of the on-line data  collection tools such as the site security plan to make the process  faster. In April 2013, we also reported that DHS had not finalized the personnel  surety aspect of the CFATS program. In implementing this provision, we reported that DHS intended to  (1) require facilities to perform background checks on and ensure  appropriate credentials for facility personnel and, as appropriate, visitors  with unescorted access to restricted areas or critical assets, and (2)  check for terrorist ties by comparing certain employee information with the  federal government’s consolidated terrorist watch list. However, as of  February 2014, DHS had not finalized its information collection request  that defines how the personnel surety aspect of the performance  standards will be implemented. As an interim step, in February 2014, DHS published a notice  about its Information Collection Request (ICR) for personnel surety to  gather information and comments prior to submitting the ICR to the Office   According  of Management and Budget (OMB) for review and clearance.to ISCD officials, it is unclear when the personnel surety aspect of the  CFATS program will be finalized. Inspecting to Verify Compliance with Facility Plans

DHS reports that it has begun to perform compliance inspections at  regulated facilities.
Why GAO Did This Study

Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations establishing standards for the security of these facilities. DHS established the CFATS program to assess risk at facilities covered by the regulations and inspect them to ensure compliance.
This statement provides observations on DHS efforts related to the CFATS program. It is based on the results of previous GAO reports issued in July 2012 and April 2013 and a testimony issued in February 2014. In conducting the earlier work, GAO reviewed DHS reports and plans on the program and interviewed DHS officials.

What GAO Found

In managing its Chemical Facility Anti-Terrorism Standards (CFATS) program, the Department of Homeland Security (DHS) has a number of efforts underway to identify facilities that are covered by the program, assess risk and prioritize facilities, review and approve facility security plans, and inspect facilities to ensure compliance with security regulations.
Identifying facilities. DHS has begun to work with other agencies to identify facilities that should have reported their chemical holdings to CFATS, but may not have done so. DHS initially identified about 40,000 facilities by publishing a CFATS rule requiring that facilities with certain types and quantities of chemicals report certain information to DHS. However, a chemical explosion in West, Texas last year demonstrated the risk posed by chemicals covered by CFATS. Subsequent to this incident, the President issued Executive Order 13650 which was intended to improve chemical facility safety and security in coordination with owners and operators. Under the executive order, a federal working group is sharing information to identify additional facilities that are to be regulated under CFATS, among other things.
Assessing risk and prioritizing facilities. DHS has begun to enhance its ability to assess risks and prioritize facilities. DHS assessed the risks of facilities that reported their chemical holdings in order to determine which ones would be required to participate in the program and subsequently develop site security plans. GAO's April 2013 report found weaknesses in multiple aspects of the risk assessment and prioritization approach and made recommendations to review and improve this process. In February 2014, DHS officials told us they had begun to take action to revise the process for assessing risk and prioritizing facilities.
Reviewing security plans. DHS has also begun to take action to speed up its reviews of facility security plans. Per the CFATS regulation, DHS is to review security plans and visit the facilities to make sure their security measures meet the risk-based performance standards. GAO's April 2013 report found a 7- to 9-year backlog for these reviews and visits, and DHS has begun to take action to expedite these activities. As a separate matter, one of the performance standards—personnel surety, under which facilities are to perform background checks and ensure appropriate credentials for personnel and visitors as appropriate—is being developed. Of the facility plans DHS had reviewed as of February 2014, it conditionally approved these plans pending final development of the personal surety performance standard. According to DHS officials, it is unclear when the standard will be finalized.
Inspecting to verify compliance. In February 2014, DHS reported it had begun to perform inspections at facilities to ensure compliance with their site security plans. According to DHS, these inspections are to occur about 1 year after facility site security plan approval. Given the backlog in plan approvals, this process has started recently and GAO has not yet reviewed this aspect of the program.

What GAO Recommends

In a July 2012 report, GAO recommended that DHS measure its performance implementing actions to improve its management of CFATS. In an April 2013 report, GAO recommended that DHS enhance its risk assessment approach to incorporate all elements of risk, conduct a peer review, and gather feedback on its outreach to facilities. DHS concurred and has taken actions or has actions underway to address them.