In 2007, DHS issued interim final regulations establishing risk-based performance standards known as the Chemical Facility Anti-Terrorism Standards (CFATS). As of February 2015, DHS had inspected and approved 1,526 site security plans, covering approximately 43% of the regulated facilities. Statute and Regulation

In 2006, Congress authorized the Department of Homeland Security (DHS) to issue interim final regulations establishing risk-based performance standards for chemical facility security and requiring facilities to develop vulnerability assessments and to develop and implement site security plans. The Secretary must review and approve the required vulnerability assessment, site security plan, and its implementation at each facility. The DHS then monitors facility compliance with these site security plans. When the facility receives a final tier assignment, it must develop and submit a Site Security Plan (SSP) to DHS. The following sections analyze DHS data to identify underlying challenges for the following steps: the process of DHS assigning a facility to a risk tier; the rate at which DHS authorizes site security plans; the rate at which DHS inspects and approves authorized site security plans; and the occurrence of compliance inspections. Chemical Facility Tier Assignment

In the CFATS process, all facilities possessing chemicals of interest above a certain threshold amount must report to DHS through the Top-Screen process. Some of these new submissions may be from high-risk facilities. This may reflect the dynamic nature of the pool of CFATS-regulated facilities with facilities joining, leaving, and being retiered within the CFATS program, or it may suggest that DHS is not resolving the gap between total facilities and facilities with a final tier. Site Security Plan Authorization

Regulated facilities must submit site security plans (SSPs) that meet the risk-based performance standards applicable to their final risk tier. Assuming that the total number of regulated facilities remains unchanged over time, DHS would need to authorize an average of 76 site security plans monthly to authorize a number of SSPs equal to the number of facilities within 1 year, an average of 38 monthly to authorize all within 2 years, an average of 15 monthly to authorize all within 5 years, and an average of 8 monthly to authorize all within 10 years. The DHS has generally increased its average authorization rate over time; between August 2014 and February 2015, DHS authorized an average of 135 SSPs per month. Between January 2015 and February 2015, DHS authorized 120 SSPs. Authorization Inspections and SSP Approvals

Following authorization of a site security plan, DHS inspects the facility to determine its adherence to its submitted SSP. Comparison of the current rate of approval against that necessary to approve all SSPs indicates that it will likely take more than a year for DHS to finish inspecting and approving the existing SSPs. As a point of reference, DHS approved an average of 85 site security plans monthly between February 2014 and February 2015. The DHS has generally increased this rate over time; between August 2014 and February 2015, DHS approved an average of 93 SSPs per month. Compliance Inspections

Following approval of a facility site security plan, DHS inspects the facility for compliance. The CFATS program has historically not met DHS-established deadlines for securing high-risk chemical facilities.
The Department of Homeland Security (DHS) implements the Chemical Facility Anti-Terrorism Standards (CFATS) regulations, which regulate security at high-risk facilities possessing more than certain amounts of one or more chemicals of interest. Facilities possessing more than the specified amount must register with DHS through this program (a process known as the Top-Screen) and perform security-related activities. The DHS identifies a subset of high-risk chemical facilities from among those that register. These high-risk chemical facilities must submit a security vulnerability assessment, which DHS uses to confirm their high-risk designation, and a site security plan, which DHS then reviews and authorizes. The DHS also inspects and approves high-risk chemical facilities for adherence to their submitted site security plans. It also later inspects for compliance with these plans following DHS approval. The DHS regulates approximately 3,600 facilities under this program and is in the process of implementing the regulatory requirements for security vulnerability assessment, site security planning, and inspection.
The DHS has had challenges meeting its own projections and congressional expectations regarding program performance, raising questions about its ability to achieve steady-state regulatory implementation. As of April 2014, DHS had made final risk assignments to 3,316 of the approximately 4,200 facilities then regulated. The DHS reported in December 2014 that it now regulates approximately 3,600 facilities, approximately 2,700 of which have final risk assignments. The DHS authorizes a site security plan when the submitted plan satisfies CFATS requirements. Following a successful authorization inspection, DHS approves the site security plan. As of February 2014, DHS had authorized 2,646 site security plans; conducted 1,969 authorization inspections; and approved 1,526 site security plans. Between February 2014 and February 2015, DHS authorized an average of 132 and approved an average of 85 site security plans per month. The DHS has generally increased its average authorization and approval rate over time; between August 2014 and February 2015, DHS authorized an average of 135 and approved an average of 93 site security plans per month. Between January 2015 and February 2015, DHS authorized 120 and approved 80 site security plans.
This report analyzes data from a variety of DHS presentations, testimony, and other sources to present a historical overview of program performance to date. It identifies an ongoing gap between the number of facilities that have received final risk tier assignments and the total number of regulated facilities. This makes it appear likely that DHS will not have inspected or approved site security plans for some portion of the regulated facility universe for at least several years. In addition, the current rates of authorization of site security plans, authorization inspection, and approval of site security plans make it appear likely that DHS will not have completed implementation for the initial facilities before the date when it will potentially need to begin reinspecting already approved facilities. With the onset of compliance inspections, congressional policymakers may have further questions about the ability of the CFATS program to meet congressional expectations regarding timeliness.