The CFATS program is intended to ensure the security of the nation’s  chemical infrastructure by identifying, assessing the risk posed by, and  requiring the implementation of measures to protect high-risk chemical  facilities. For expedited facilities that receive a letter of acceptance,  ISCD does not conduct an authorization inspection because the CFATS  Act of 2014 does not provide for this inspection at expedited facilities. Regarding the EAP, the CFATS Act of 2014 states that, among other  things, DHS is to  issue guidance for EAP facilities not later than 180 days after  enactment of the act that identifies specific security measures  sufficient to meet Risk-Based Performance Standards; approve a facility’s expedited security plan if it is not facially deficient  based upon a review of the expedited plan;  verify a facility’s compliance with its expedited security plan through a  compliance inspection;  require the facility to implement additional security measures or  suspend the facility’s certification if, during or after a compliance  inspection, security measures are insufficient to meet Risk-Based  Performance Standards based on misrepresentation, omission, or an  inadequate description of the site; and  conduct a full evaluation of the EAP and submit a report on the EAP  not later than 18 months after the date of enactment of the act to  Congress. DHS Has Fully Implemented the EAP and Reported to Congress on Its Assessment of the Program

		DHS Has Issued Guidance for the EAP and Fully Implemented the Program

On May 12, 2015, DHS issued EAP guidance for eligible facilities to use  to prepare their expedited plans. ISCD officials told us that, in developing prescriptive security measures  for the EAP, they considered various sources, including:  lessons learned from approving prior standard security plans and  Alternative Security Programs for tier 3 and tier 4 facilities and  conducting inspections at these facilities;
Risk-Based Performance Standards used to develop a standard  security plan or Alternative Security Program; and  relevant academic literature, and security directives, guidelines,  standards, and regulations issued by other federal agencies, such as  the U.S. Army and the Department of Labor. The CFATS Act of 2014 allows facilities to  submit only one expedited plan to DHS. Officials we interviewed at the three coordinating councils confirmed that  DHS had contacted them about the EAP. DHS’s Report on the EAP Discussed All Statutory Elements

DHS’s report to Congress on the EAP, issued on August 2, 2016,  discussed all elements listed in the CFATS Act of 2014, but did not  quantify costs associated with the EAP because most of DHS’s initial  costs were for salary and benefits and DHS did not require its employees  to track the hours they worked on the EAP. Assess the number of eligible facilities that used the EAP versus  the standard process to develop and submit a site security plan. ISCD  officials told us that if enough facilities use the EAP in the future, DHS  would evaluate the EAP’s effect on its CFATS operations. DHS reported that it is difficult to assess the impact of the  EAP on the security of chemical facilities because only one facility  submitted an expedited security plan. Low EAP Participation May Be Due to Various Factors

		Two Chemical Facilities Have Used the EAP since Its Inception

According to DHS, as of April 2017, 2 of the 2,496 eligible facilities had  used the EAP since ISCD implemented it; however, one of the two  facilities was no longer in the EAP because ISCD no longer considers the  facility to be high risk. ISCD had approved both facilities’ expedited  security plans—one before DHS issued the aforementioned report to  Congress and one after the report. They also said that the EAP is one of three  options—the expedited security plan, the standard security plan, and the  Alternative Security Program—that tier 3 and tier 4 facilities can use. Officials from both facilities also stated  that the EAP’s prescriptive nature helped them to quickly determine the  security measures required to be in their site security plans. ISCD  officials and officials from 6 of the 11 industry organizations we  interviewed stated that the prescriptive security measures required in the  expedited security plan likely deterred some facilities from using the EAP. This was consistent  with the views of the officials representing the two facilities that submitted  EAPs, as discussed earlier. The Effect of Recent Changes to the CFATS Program on Future Use of the EAP Is Uncertain

Two other factors that could influence facilities’ participation in the EAP  are the introduction of revised processes for (1) facilities to provide  information to ISCD and (2) ISCD to determine the risk tier for each  facility. If  the updated tool proves easier to use, it could affect future interest in  using the expedited program. Agency Comments

We provided a draft of this report to DHS for review and comment. If you or your staff have any questions about this report, please contact  me at (404) 679-1875 or CurrieC@gao.gov.
Why GAO Did This Study

Facilities that produce, use, or store hazardous chemicals could be of interest to terrorists intent on using them to inflict mass casualties in the United States. DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. DHS places high-risk facilities into one of four risk-based tiers and inspects them to ensure compliance with DHS standards. The CFATS Act of 2014 created the Expedited Approval Program as an option for the two lower-risk tier facilities (tiers 3 and 4) to reduce the burden and expedite the processing of security plans. The act further required that DHS report on its evaluation of the expedited program to Congress.
The CFATS Act of 2014 also included a provision for GAO to assess the expedited program. This report discusses (1) DHS's implementation of the expedited program and its report to Congress and (2) the number of facilities that have used the program and factors affecting participation in it. GAO reviewed laws and DHS guidance, analyzed DHS's report to Congress, and interviewed DHS officials. GAO also received input from officials with three industry groups that represented the most likely candidates to use the program, and officials representing eight of their member organizations. The results of this input are not generalizable, but provide insights about the expedited program.
GAO is not making recommendations in this report.
For more information, contact Chris Currie at (404) 679-1875 or CurrieC@gao.gov .
[ This page was updated to delete a typo .]

What GAO Found

The Department of Homeland Security (DHS) fully implemented the Chemical Facility Anti-Terrorism Standards (CFATS) Expedited Approval Program in June 2015 and reported to Congress on the program in August 2016, as required by the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). DHS's expedited program guidance identifies specific security measures that eligible (i.e., tiers 3 and 4) high-risk facilities can use to develop expedited security plans, rather than developing standard (non-expedited) security plans. Standard plans provide more flexibility in securing a facility, but are also more time-consuming to process. DHS's report to Congress on the expedited program discussed all required elements. For example, DHS was required to assess the impact of the expedited program on facility security. DHS reported that it was difficult to assess the impact of the program on security because only one facility had used it at the time of the report. DHS officials stated that they would further evaluate the impact of the program on security if enough additional facilities use it in the future.
As of April 2017, only 2 of the 2,496 eligible facilities opted to use the Expedited Approval Program; various factors affected participation. Officials from the two facilities told GAO they used the program because its prescriptive nature helped them quickly determine what they needed to do to implement required security measures and reduced the time and cost to prepare and submit their security plans to DHS. According to DHS and industry officials GAO interviewed, low participation to date could be due to several factors:
DHS implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS;
the expedited program's security measures may be too strict and prescriptive, not providing facilities the flexibility of the standard process; and
DHS conducts in-person authorization inspections to confirm that security plans address risks under the standard process, but does not conduct them under the expedited program. DHS officials noted that some facilities may prefer having this inspection because it provides them useful information.
Recent changes in the CFATS program could also affect future use of the expedited program. In fall 2016, DHS updated its online tool for gathering data from facilities. Officials at DHS and 5 of the 11 industry organizations GAO contacted stated that the revised tool is more user-friendly and less burdensome than the previous one; however, it is unclear how the new tool might affect future use of the expedited program. Also, in fall 2016, DHS revised its methodology for determining the level of facility risk, and one of the two facilities that participated in the expedited program is no longer