ISCD uses a risk-based approach to evaluate chemical facilities of  interest that are required to report under CFATS and determine whether  these facilities are high-risk and therefore subject to further requirements  under the regulation. ISCD Has Strengthened Its Processes for Identifying High-Risk Chemical Facilities

		ISCD Implemented Processes to Verify Self- Reported Information from Chemical Facilities

In response to our prior recommendations, ISCD has taken action to  strengthen its processes for verifying the accuracy of data it uses to  identify high-risk chemical facilities. ISCD Has Nearly Completed Applying Its Revised Risk Assessment Methodology for Designating High-Risk Chemical Facilities

ISCD Revised Its Risk Assessment Methodology to More Accurately  Identify and Assign Tiers to High-Risk Chemical Facilities  Since we last evaluated it in 2013, ISCD took action to enhance the  CFATS program’s risk assessment methodology—used to determine  whether covered chemical facilities are high-risk and, if so, assign them a  risk-based tier—by incorporating changes to address prior GAO  recommendations, as well as the findings of an ISCD-commissioned peer  review conducted in 2013, among other efforts. In addition, among other  enhancements, the updated risk assessment methodology incorporates  revisions to the threat, vulnerability, and consequence scoring methods to  better cover the full range of chemical security issues regulated by the  CFATS program. As of  February 2018, a total of 29,195 chemical facilities were assessed using  ISCD’s revised risk assessment methodology, with 3,500 (or 12 percent)  of these facilities designated as high-risk (i.e., assigned to tiers 1 through  4). ISCD Has Made Progress Conducting Compliance Inspections but Does Not Measure Reduction in Facility Vulnerability ISCD Has Increased the Number of Completed Compliance Inspections and Issued Two Corrective Actions for Noncompliance with Security Plans

Since 2013, ISCD has reduced its backlog of unapproved site security  plans and increased the number of conducted compliance inspections. Our analysis of ISCD data since our 2015 report showed that ISCD has  made substantial progress conducting and completing compliance  inspections. For the 2,466 high-risk  facilities with an approved site security plan as of May 2018, ISCD had  conducted 3,553 compliance inspections. However, representatives from 3 of the 11 trade associations we spoke  with also noted some issues with the compliance inspection process. In 2015 we found  that while ISCD’s performance measure for the CFATS program was  intended to reflect security measures implemented by facilities and the  overall impact of the CFATS regulation on facility security, the metric did  not solely capture security measures that are implemented by facilities  and verified by ISCD. We recommended that DHS develop a  performance measure that includes only planned security measures that  have been implemented and verified. Officials stated  that a facility’s site security plan score is developed when the facility  submits its initial site security plan and again when ISCD approves its site  security plan and the facility has completed the CFATS inspection  process. While  ISCD officials stated the program is exploring how to use the site security  plan scores of a facility, this methodological approach may provide ISCD  an opportunity to begin assessing how vulnerability is reduced and, by  extension, risk is lowered, not only for individual facilities but for the  program as a whole. However, ISCD could  take steps to evaluate vulnerability reduction resulting from the CFATS  compliance inspection process. First Responders and Emergency Planners May Not Have Information Needed to Respond to Incidents at High-Risk Chemical Facilities

We found over 200 chemicals covered by CFATS that may not be  included in the chemical inventory information that officials told us they  rely on to prepare for and respond to incidents at chemical facilities. ISCD  shares some CFATS information with state and local officials, including  access to CFATS facility-specific data via a secure portal; however, this  portal is not widely used at the local level by first responders and  emergency planners. Additionally, while not generalizable to all  LEPCs, officials representing 7 of the 15 LEPCs we interviewed were not  aware of the IP Gateway and officials representing 13 of the 15 LEPCs  stated that they do not have access to CFATS information within the IP  Gateway. By improving information-sharing with first responders and  emergency planners, such as promoting access to and wider use of the  IP Gateway, DHS will have greater assurances that the emergency  response community has access to timely information about high-risk  chemical facilities that could help protect them from serious injury or  death. In its  comments, DHS concurred with both recommendations and outlined  efforts underway or planned to address them. Regarding the first recommendation that ISCD should incorporate  vulnerability into the CFATS site security scoring methodology to help  measure the reduction in the vulnerability of high-risk facilities and use  that data to further assess the CFATS program’s performance in lowering  risk and enhancing national security, DHS concurred but noted that  developing a system that could numerically evaluate vulnerabilities will be  challenging. Regarding the second recommendation that the Office of Infrastructure  Protection and ISCD take actions to encourage access to and wider use  of the IP Gateway and explore other opportunities to improve information- sharing with first responders and emergency planners, DHS stated that it  has various outreach activities underway, among other information- sharing efforts, to either directly share or ensure that high-risk chemical  facilities are sharing CFATS information with first responders and  emergency planners.
Why GAO Did This Study

Facilities that produce, use, or store hazardous chemicals could be targeted or used by terrorists to inflict mass casualties, damage, and fear. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. DHS places high-risk facilities in risk-based tiers and is to conduct inspections after it approves their security plans. Under the CFATS Act of 2014, authorization for the CFATS program expires in January 2019.
GAO assessed the extent to which DHS has (1) enhanced the process for identifying high-risk facilities and assigning them to tiers, (2) conducted facility inspections and measured facility security, and (3) ensured that information is shared with emergency responders to prepare them for incidents at high-risk facilities. GAO reviewed DHS reports and data on compliance inspections and interviewed DHS officials. GAO also obtained non-generalizable information from 11 trade associations representing chemical facilities regarding DHS outreach and from 15 emergency planning committees about their awareness of CFATS and the chemicals it covers.

What GAO Found

Since 2013, the Department of Homeland Security (DHS) has strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program. Among other things, DHS implemented a quality assurance review process to verify the accuracy of facility self-reported information used to identify high-risk facilities. DHS also revised its risk assessment methodology—used to assess whether chemical facilities are high-risk and, if so, assign them to a risk-based tier—by incorporating changes to address prior GAO recommendations and most of the findings of a DHS-commissioned peer review. For example, the updated methodology incorporates revisions to the threat, vulnerability, and consequence scoring methods to better cover the full range of security issues regulated by CFATS. As of February 2018, a total of 29,195 facilities—including all 26,828 facilities previously assessed and 2,367 facilities new to the program—were assessed using DHS's revised methodology. DHS designated 3,500 of these facilities as high-risk and subject to further requirements.
DHS has also made substantial progress conducting and completing compliance inspections and has begun to take action to measure facility security but does not evaluate vulnerability reduction resulting from the CFATS compliance inspection process. In 2013, GAO found that the backlog of chemical facility security plans awaiting review affected DHS's ability to conduct compliance inspections, which are performed after security plans are approved. Since then DHS has made progress and increased the number of completed compliance inspections. As of May 2018, DHS had conducted 3,553 compliance inspections. DHS has also begun to update its performance measure for the CFATS program to evaluate security measures implemented both when a facility submits its initial security plan and again when DHS approves its final security plan. However, GAO found that DHS's new performance measure methodology does not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process. Doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the CFATS program as a whole.
DHS shares some CFATS information, but first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. Facilities are currently required to report some chemical inventory information, but GAO found that over 200 CFATS chemicals may not be covered by these requirements. To improve access to information, DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting. However, GAO found that the IP Gateway is not widely used at the local level. In addition, officials from 13 of the 15 Local Emergency Planning Committees—consisting of first responders and covering 373 CFATS high-risk facilities—told GAO they did not have access to CFATS data in the IP Gateway. By encouraging wider use of the IP Gateway, DHS would have greater assurance that first responders have information about high-risk facilities and the specific chemicals they possess.

What GAO Recommends

GAO recommends that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance; and (2) encourage access to and wider use of the IP Gateway among first responders and emergency planners. DHS concurred with both recommendations and outlined efforts underway or planned.