	DHS Has Made Progress Addressing Past Challenges, But Some Actions are Still In Progress

Our past work has identified progress and challenges in a number of  areas related to DHS’s management of the CFATS program including (1)  the process for identifying high risk chemical facilities; (2) how it assesses  risk and prioritizes facilities; (3) reviewing and approving facility security  plans; (4) how it conducts facility compliance inspections; and (5) efforts  to conduct stakeholder outreach and gather feedback. As a result of this effort, in July 2015, DHS  officials reported that they had identified about 1,000 additional facilities  that should have reported information to comply with CFATS and  subsequently contacted these facilities to ensure compliance. DHS has also taken action to strengthen the accuracy of data it uses to  identify high risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for  facilities that held toxic chemicals that could threaten surrounding  communities if released. We estimated that more than  2,700 facilities with a toxic release threat had misreported the Distance of  Concern and therefore recommended that DHS (1) develop a plan to  implement a new Top-Screen to address errors in the Distance of  Concern submitted by facilities, and (2) identify potentially miscategorized  facilities that could cause the greatest harm and verify that the Distance  of Concern of these facilities report is accurate. DHS has fully  addressed both of these recommendations. Specifically, DHS  implemented an updated Top-Screen in October 2016 and now collects  data from facilities and calculates the Distance of Concern itself, rather  than relying on the facilities’ calculation. In April 2013, we  reported that DHS’s risk assessment approach did not consider all of the  elements of threat, vulnerability, and consequence associated with a  terrorist attack involving certain chemicals. We also found that (1) DHS’s approach was not consistent  with the NIPP because it treated every facility as equally vulnerable to a  terrorist attack regardless of location or on-site security and (2) DHS was  not using threat data for 90 percent of the tiered facilities—those tiered for  the risk of theft or diversion—and using 5-year-old threat data for the  remaining 10 percent of those facilities that were tiered for the risks of  release or sabotage. We recommended that DHS enhance its risk  assessment approach to incorporate all elements of risk and conduct a  peer review after doing so. To further enhance its risk assessment approach, in fall 2016, DHS also  revised its Chemical Security Assessment Tool (CSAT), which supports  DHS efforts to gather information from facilities to assess their risk. We are  currently assessing DHS’s efforts to assess risk and prioritize facilities as  part of our ongoing work and will report on the results of this work in our  report later this summer. Reviewing and Approving Facility Site Security Plans

DHS has also made progress reviewing and approving facility site  security plans by reducing the time it takes to review these plans and  eliminating the backlog of plans awaiting review. In July 2015, we  reported that DHS had made substantial progress in addressing the  backlog—estimating that it could take between 9 and 12 months for DHS  to review and approve security plans for the approximately 900 remaining  facilities. Inspecting Facilities and Ensuring Consistent Compliance

In our July 2015 report, we found that DHS began conducting compliance  inspections in September 2013, and by April 2015, had conducted  inspections of 83 of the 1,727 facilities that had approved security plans. Our analysis showed that nearly half of the facilities were not fully  compliant with their approved site security plans and that DHS had not  used its authority to issue penalties because DHS officials found it more  productive to work with facilities to bring them in compliance. We recommended that  DHS document processes and procedures for managing compliance to  provide more reasonable assurance that facilities implement planned  measures and address security gaps. DHS agreed and has taken steps  toward implementing this recommendation. DHS updated its CFATS  Enforcement Standard Operating Procedure (SOP) and has made  progress on the new CFATS Inspections SOP. DHS  officials stated they expect to finalize these procedures by the end of  fiscal year 2018.
Why GAO Did This Study

Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. In accordance with the DHS Appropriations Act, 2007, DHS established the CFATS program in 2007 to, among other things, identify and assess the security risk posed by chemical facilities. DHS inspects high-risk facilities after it approves facility security plans to ensure that the facilities are implementing required security measures and procedures.
This statement summarizes progress and challenges related to DHS's CFATS program management. This statement is based on prior products GAO issued from July 2012 through June 2017, along with updates conducted in June 2018 on DHS actions to address prior GAO recommendations. To conduct the prior work, GAO reviewed relevant laws, regulations, and DHS policies for administering the CFATS program, how DHS assesses risk, and data on high-risk chemical facilities. GAO also interviewed DHS officials and reviewed information on DHS actions to implement its prior recommendations.

What GAO Found

The Department of Homeland Security (DHS) has made progress addressing challenges that GAO's past work identified to managing the Chemical Facility Anti-Terrorism Standards (CFATS) program. The following summarizes progress made and challenges remaining in key aspects of the program.
Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS used self-reported and unverified data to determine the risk of facilities holding toxic chemicals that could threaten surrounding communities if released. GAO recommended that DHS should better verify the accuracy of facility-reported data. DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so.
Assessing risk and prioritizing facilities. In April 2013, GAO reported weaknesses in multiple aspects of DHS's risk assessment and prioritization approach. GAO made two recommendations for DHS to review and improve this process, including that DHS enhance its risk assessment approach to incorporate all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. DHS launched a new risk assessment methodology in October 2016 and is currently gathering new or updated data from about 27,000 facilities to (1) determine which facilities should be categorized as high-risk because of the threat of sabotage, theft or diversion, or a toxic release and (2) assign those facilities deemed high risk to one of four risk-based tiers. GAO has ongoing work assessing these efforts and will report later this summer on the extent to which they fully address prior recommendations.
Reviewing and approving facilities' site security plans . DHS is to review security plans and visit facilities to ensure their security measures meet DHS standards. In April 2013, GAO reported a 7 to 9 year backlog for these reviews and visits. In July 2015, GAO reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS has since taken additional action to expedite these activities and has eliminated this backlog.
Inspecting facilities and ensuring compliance. In July 2015, GAO reported that DHS conducted compliance inspections at 83 of the 1,727 facilities with approved security plans. GAO found that nearly half of the inspected facilities were not fully compliant with their approved security plans and that DHS did not have documented procedures for managing facilities' compliance. GAO recommended that DHS document procedures for managing compliance. As a result, DHS has developed an enforcement procedure and a draft compliance inspection procedure and expects to finalize the compliance inspection procedure by the end of fiscal year 2018.

What GAO Recommends

GAO has made various recommendations to strengthen DHS's management of the CFATS program, with which DHS has generally agreed. DHS has implemented or described planned actions to address most of these recommendations.