Facilities with toxic release  chemicals are to calculate and report in their Top-Screen submission  the Distance of Concern—which represents the radius of an area in  which exposure to a toxic chemical cloud from a release event could  cause serious injury or fatalities from short-term exposure. If ISCD does not categorize the chemical facility as high-risk, ISCD does  not assign the facility to one of these four risk-based tiers and the facility  is not subject to additional requirements under the CFATS regulation.Facilities that ISCD preliminarily categorizes to be high-risk—covered  chemical facilities—are required to then complete the CSAT security  vulnerability assessment, which includes the identification of potential  critical assets at the facility, and a related vulnerability analysis.to review the security vulnerability assessment to confirm and notify the  facility as to whether the facility remains categorized as high-risk and, if  so, about its final placement in one of the four tiers. ISCD Used Self-Reported Data That Is Not Verified to Categorize Thousands of Facilities

ISCD has used self-reported and unverified data to determine the risk for  facilities with a toxic release threat. Of these facilities,  we estimate that more than 6,400 facilities hold a chemical at or above  the screening threshold quantity that could pose a toxic chemical release  threat. On the basis of these results, we estimate more than 2,700 facilities, or at  least 44 percent of facilities with a toxic release chemical, misreported the  Distance of Concern. As described earlier, the Distance of Concern is one key input in the risk  assessment approach that ISCD uses to preliminarily categorize facilities  that could pose a toxic chemical release threat. On the basis of  ISCD’s pace of site security plan approvals in calendar year 2014— between 80 and 100 plans per month—as of April 2015, we estimate  that it could take between 9 and 12 months for ISCD to review and  approve site security plans for the 929 facilities currently awaiting  approval. For example, ISCD has  continued the revised site security plan review process implemented  in July 2012 in which teams of ISCD headquarters officials review  plans by assessing how layers of security measures meet the intent of  each of the performance standards;  issued updates to the online Chemical Security Assessment Tool  (CSAT) beginning in March 2014 to make the system more user- friendly and improve facility data collection; distributed updated internal guidance and lessons learned on plan  approvals to inspectors and plan reviewers;  transitioned to a new internal case management system in December  2013 that provides improved program and facility management  capabilities; begun using inspectors alongside ISCD headquarters officials to  review site security plans in order to leverage inspectors’ knowledge  of facility security and role conducting CFATS inspections;  implemented changes to inspection processes, such as employing  smaller inspection teams, conducting preinspection phone calls with  facilities to help them prepare for inspections, and enabling inspectors  to help facility personnel edit their site security plans during  inspections; distributed updated guidance to facilities to help them improve their  site security plans and worked to expand the use of alternative  security programs; and worked with corporations that have multiple covered chemical facilities  to leverage inspection documents and security procedures that are  standard across corporations to expedite the inspection process. ISCD began conducting compliance inspections in September 2013 and  as of April 2015 had conducted 83 compliance inspections out of 1,727  facilities with approved site security plans. Our analysis of compliance inspections conducted by ISCD as of  February 2015 indicated that inspectors made varying recommendations  relating to the 34 facilities that inspectors found had not implemented  planned measures as outlined in their site security plans by deadlines and  therefore were not fully compliant with their approved site security plans:  Inspectors recommended both a follow-on compliance inspection and  an enforcement action for 1 of the 34 noncompliant facilities. According to ISCD  officials, ISCD’s processes and procedures—although not documented— track noncompliant facilities through the compliance process and ensure  they implement planned measures. Variations in the process for  addressing noncompliant facilities—such as facilities having widely  varying amounts of time to implement measures—may be warranted on a  case-by-case basis. However, DHS has not taken steps to mitigate  errors in some facility-reported data and does not have reasonable  assurance that it has identified all of the nation’s highest-risk chemical  facilities. Additionally, DHS cannot ensure consistency in how it  addresses noncompliance in the CFATS program because it does not  have documented processes and procedures. Recommendations for Executive Action

We recommend that the Secretary of Homeland Security direct the Under  Secretary for NPPD, the Assistant Secretary for the Office of  Infrastructure Protection, and the Director of ISCD to take the following  two actions to ensure the accuracy of the data submitted by chemical  facilities: provide milestone dates and a timeline for implementation of the new  Top-Screen and ensure that changes to this Top-Screen mitigate  errors in the Distance of Concern submitted by facilities, and  in the interim, identify potentially miscategorized facilities with the  potential to cause the greatest harm and verify the Distance of  Concern these facilities report is accurate. In addition, to better manage compliance among high-risk chemical  facilities and demonstrate program results, we recommend the following  two actions: develop documented processes and procedures to track  noncompliant facilities and ensure they implement planned measures  as outlined in their approved site security plans, and  improve the measurement and reporting of the CFATS program  performance by developing a performance measure that includes only  planned measures that have been implemented and verified. DHS  concurred with all four recommendations and outlined steps that the  National Protection and Programs Directorate (NPPD), Office of  Infrastructure Protection (IP), Infrastructure Security Compliance Division  (ISCD) will take to address them. However, as stated in our  report, we based our estimates on a simple random sample and followed  a probability procedure based on random selections.
Why GAO Did This Study

Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. Within DHS, ISCD oversees this program.
GAO was asked to assess the CFATS program. This report addresses, among other things, the extent to which DHS has (1) categorized facilities as subject to the CFATS regulation, and (2) approved site security plans and conducted compliance inspections. GAO reviewed laws, regulations, and program documents; randomly selected data submitted to ISCD by facilities from 2007 to 2015, tested the data's reliability; and generated estimates for the entire population of facilities, and interviewed officials responsible for overseeing, identifying, categorizing, and inspecting chemical facilities from DHS headquarters and in California, Maryland, Oregon, and Texas (selected based on geographic location and other factors).

What GAO Found

Since 2007, the Office of Infrastructure Protection's Infrastructure Security Compliance Division (ISCD), within the Department of Homeland Security (DHS), has identified and collected data from approximately 37,000 chemical facilities under its Chemical Facility Anti-Terrorism Standards (CFATS) program and categorized approximately 2,900 as high-risk based on the collected data. However, ISCD used unverified and self-reported data to categorize the risk level for facilities evaluated for a toxic release threat. A toxic release threat exists where chemicals, if released, could harm surrounding populations. One key input for determining a facility's toxic release threat is the Distance of Concern (distance) that facilities report—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure. ISCD requires facilities to calculate the distance using a web-based tool and following DHS guidance. ISCD does not verify facility-reported data for facilities it does not categorize as high-risk for a toxic release threat. However, following DHS guidance and using a generalizable sample of facility-reported data in a DHS database, GAO estimated that more than 2,700 facilities (44 percent) of an estimated 6,400 facilities with a toxic release threat misreported the distance. By verifying that the data ISCD used in its risk assessment are accurate, ISCD could better ensure it has identified the nation's high-risk chemical facilities.
ISCD has made substantial progress approving site security plans but does not have documented processes and procedures for managing facilities that are noncompliant with their approved site security plans. Site security plans outline, among other things, the planned measures that facilities agree to implement to address security vulnerabilities. As of April 2015, GAO estimates that it could take between 9 and 12 months for ISCD to review and approve security plans for approximately 900 remaining facilities—a substantial improvement over the previous estimate of 7 to 9 years GAO reported in April 2013. ISCD officials attributed the increased approval rate to efficiencies in ISCD's security plan review process, updated guidance, and a new case management system. Further, ISCD began conducting compliance inspections in September 2013, but does not have documented processes and procedures for managing the compliance of facilities that have not implemented planned measures outlined in their site security plans. According to the nature of violations thus far, ISCD has addressed noncompliance on a case-by-case basis. Almost half (34 of 69) of facilities ISCD inspected as of February 2015 had not implemented one or more planned measures by deadlines specified in their approved site security plans and therefore were not fully compliant with their plans. GAO found variations in how ISCD addressed these 34 facilities, such as how much additional time the facilities had to come into compliance and whether or not a follow-on inspection was scheduled. Such variations may or may not be appropriate given ISCD's case-by-case approach, but having documented processes and procedures would ensure that ISCD has guidelines by which to manage noncompliant facilities and ensure they close security gaps in a timely manner. Additionally, given that ISCD will need to inspect about 2,900 facilities in the future, having documented processes and procedures could provide ISCD more reasonable assurance that facilities implement planned measures and address security gaps.

What GAO Recommends

GAO recommends, among other things, that DHS (1) verify the Distance of Concern reported by facilities is accurate and (2) document processes and procedures for managing compliance with site security plans. DHS concurred with GAO's recommendations and outlined steps to address them.