U.S. GOVERNMENT PUBLISHING OFFICE

34–315 PDF WASHINGTON : 2019

S. Hrg. 115–477 

EXAMINING THE CHEMICAL FACILITY 

ANTI–TERRORISM STANDARDS PROGRAM 

ROUNDTABLE 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED FIFTEENTH CONGRESS 

SECOND SESSION 

JUNE 12, 2018 

Available via the World Wide Web: http://www.govinfo.gov 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

RON JOHNSON, Wisconsin, Chairman 

JOHN MCCAIN, Arizona 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

JAMES LANKFORD, Oklahoma 

MICHAEL B. ENZI, Wyoming 

JOHN HOEVEN, North Dakota 

STEVE DAINES, Montana 

CLAIRE MCCASKILL, Missouri 

THOMAS R. CARPER, Delaware 

HEIDI HEITKAMP, North Dakota 

GARY C. PETERS, Michigan 

MAGGIE HASSAN, New Hampshire 

KAMALA D. HARRIS, California 

DOUG JONES, Alabama 

CHRISTOPHER R. HIXON, Staff Director 

GABRIELLE D’ADAMO SINGER, Chief Counsel 

COLLEEN E. BERNY, Professional Staff Member 

WILLIAM G. RHODES III, Fellow 

MARGARET E. DAUM, Minority Staff Director 

J. JACKSON EATON IV., Minority Senior Counsel 

JULIE G. KLEIN, Minority Professional Staff Member 

LAURA W. KILBRIDE, Chief Clerk 

BONNI E. DINERSTEIN, Hearing Clerk 
(III) 

C O N T E N T S 

Opening statements: Page 

Senator Johnson ............................................................................................... 1 

Senator McCaskill ............................................................................................ 2 

Senator Peters .................................................................................................. 16 

Senator Carper ................................................................................................. 19 

Prepared statements: 

Senator Johnson ............................................................................................... 37 

Senator McCaskill ............................................................................................ 38 

WITNESSES 

TUESDAY, JUNE 12, 2018 

David Wulf, Acting Deputy Assistant Secretary for Infrastructure Protection, 

National Protection and Programs Directorate, U.S. Department of Homeland Security ........................................................................................................ 3 

Christopher P. Currie, Director, Homeland Security and Justice Team, U.S. 

Government Accountability Office ...................................................................... 5 

Jesse LeGros, Jr., Vice President, Infrastructure Protection, AFGE National 

Local #918 ............................................................................................................. 6 

Jennifer Gibson, Vice President, Regulatory Affairs, National Association of 

Chemical Distributors .......................................................................................... 6 

Randall Eppli, President and CEO, Columbus Chemical Industries, Inc. .......... 7 

William Erny, Senior Director, American Chemistry Council ............................. 8 

Justine Louchheim, Director, Government Affairs, The Fertilizer Institute ...... 9 

Linda Menendez, Director of Operations, Austin Powder Company ................... 10 

Debra S. Satkowiak, President, Institute of Makers of Explosives ..................... 11 

ALPHABETICAL LIST OF WITNESSES

Currie Christopher P.: 

Testimony .......................................................................................................... 5 

Prepared statement .......................................................................................... 53 

Eppli, Randall: 

Testimony .......................................................................................................... 7 

Prepared statement .......................................................................................... 67 

Erny, William: 

Testimony .......................................................................................................... 8 

Prepared statement .......................................................................................... 73 

Gibson, Jennifer: 

Testimony .......................................................................................................... 6 

Prepared statement .......................................................................................... 61 

LeGros, Jesse Jr.: 

Testimony .......................................................................................................... 6 

Prepared statement .......................................................................................... 57 

Louchheim, Justine: 

Testimony .......................................................................................................... 9 

Prepared statement .......................................................................................... 75 

Menendez, Linda: 

Testimony .......................................................................................................... 10 

Prepared statement .......................................................................................... 80 

Satkowiak, Debra S.: 

Testimony .......................................................................................................... 11 

Prepared statement .......................................................................................... 88 

Wulf, David: 

Testimony .......................................................................................................... 3 
Page

IV 

Wulf, David—Continued 

Prepared statement .......................................................................................... 41 

APPENDIX 

Statements submitted for the Record: 

Agricultural Retailers Association .................................................................. 98 

Chamber of Commerce ..................................................................................... 101 

Environmental Technology Council ................................................................ 103 

National Association of Manufacturers .......................................................... 107 

Responses to post-hearing questions for the Record: 

Mr. Wulf ............................................................................................................ 114 
(1) 

1The prepared statement of Senator Johnson appears in the Appendix on page 37. 

ROUNDTABLE EXAMINING THE CHEMICAL 

FACILITY ANTI-TERRORISM STANDARDS 

PROGRAM 

TUESDAY, JUNE 12, 2018 

U.S. SENATE, COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, Washington, DC. 

The Committee met, pursuant to notice, at 10:37 a.m., in room 

106, Dirksen Senate Office Building, Hon. Ron Johnson presiding. 

Present: Senators Johnson, McCaskill, Carper, Heitkamp, Peters, 

Hassan, and Harris. 

OPENING STATEMENT OF CHAIRMAN JOHNSON 

Chairman JOHNSON. Good morning. This roundtable will come to 

order. I want to thank everybody for your thoughtful testimony and 

your time appearing here today. 

This is an important issue. I will just consent to have my written 

statement entered into the record.1 I do not want to spend a whole 

lot of time because I would rather hear from you folks. But as I 

have gone through the testimonies, we have gone through this reauthorization once, and I really think it was a pretty good attempt, 

in 2014, to take what was originally authorized in 2007, recognize 

some of the problems with it and address them, and there have 

been improvements made. I do not think there is any doubt about 

it. 

We need to consider reauthorization for 2019. It sounds like just 

about everybody here is in favor of authorization. But I think there 

are some real serious issues we need to discuss. And without upsetting the apple cart, without making dramatic changes, anything we 

can do to streamline this, to take advantage of what is already 

happening in other agencies. 

Coming from a manufacturing background, I was talking to the 

witnesses beforehand we extruded a very inert plastic, very environmentally friendly, and yet we still had an Material Safety Data 

Sheet (MSDS) book that thick. We had our local fire department 

come in to do very detailed inspections, seeing what kind of dangerous chemicals would certainly create a fire hazard. We have the 

Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) doing 

a pretty darn good job when you take a look at the history of keeping explosives out of the hands of people that have maligned intent. 
2 

1The prepared statement of Senator McCaskill appears in the Appendix on page 38. 

So as much as possible you want to take advantage of other governmental agencies. You want to design programs that are very 

similar, to make them as identical as possible so industry is not 

forced to really comply with the whims of multiple masters. So that 

would be certainly my goal here in any kind of reauthorization, is, 

again, not come up with something entirely new but take a look at 

the current structure, look at the improvements made from 2007 

to 2014, and then moving forward for reauthorization that is due 

in January 2019. What can we do to further streamline this and 

take advantage of those other opportunities? So that is kind of 

what I am hoping this discussion will be about, and as we move 

forward over the next few months, prior to reauthorization, we can 

work cooperatively to achieve exactly that. 

With that I will turn it over to my Ranking Member, Senator 

McCaskill. 

OPENING STATEMENT OF SENATOR MCCASKILL1

Senator MCCASKILL. I apologize to all of you. I went to the wrong 

location. 

Chemical Facility Anti-Terrorism Standards (CFATS) program, 

initially began over a decade ago when Congress authorized it in 

late 2006. It became operational shortly thereafter, in 2007. As it 

is clear from the name, the CFATS program is part of our country’s 

counter-terrorism efforts. It is designed to secure facilities with 

hazardous chemicals, to reduce the possibility of those chemicals 

being used in a terrorist attack, as they were, for example, in the 

Oklahoma City bombing. 

CFATS uses a risk-based approach to determine which facilities 

should be covered by the program. Facilities that must comply with 

CFATS must manufacture or store at least 1 of 322 chemicals of 

interest, at or above a certain quantity and concentration. 

There are 18 risk-based performance standards (RBPS) that facilities must implement, from securing the perimeter to conducting 

background checks. However, it is up to each covered facility to determine and implement the appropriate measures that fit the 

unique needs of each facility. DHS does not mandate that fences 

be built to a certain height, for example, or that certain surveillance equipment must be used. The program is intended to be flexible and tailored to each facility. 

Obviously, CFATS has had a rocky start. At one point, the program faced an extensive inspection backlog, and as I understand it, 

the U.S. Department of Homeland Security (DHS) struggled to review the Site Security Plans (SSPs) in a timely manner. These 

issues were compounded by the fact that for a period of time, 

CFATS was authorized on a series of short-term spending measures. That is not an ideal way to structure and manage a regulatory program. It is very difficult for businesses to comply with 

necessary regulations. It is even more difficult if there is not certainty and predictability. 

The concern that the program would lapse or that Congress 

would dramatically change it prevented DHS from making longterm adjustments to develop a sustainable and fair regulatory re-
3 

1The prepared statement of Mr. Wulf appears in the Appendix on page 41. 

gime. I am told by both DHS and many in industry alike that the 

program has come a long way since it was reauthorized in 2014. 

We secured a 4-year authorization, which turned out to be a gamechanger. DHS had the space it needed to make adjustments to the 

program and improve the experience for covered facilities. 

By all accounts, CFATS is now more streamlined, user-friendly, 

and less cumbersome. Moreover, companies finally received the regulatory certainty and stability they needed to make lasting investments in the security of their facilities. 

The current authorization expires in January 2019. I am hopeful 

this roundtable will help us determine what aspects are working 

well and where we need to make changes. Obviously, we are all interested in addressing both gaps in the regulation and further improving the program’s applicability and efficiency as it relates to 

how easy it is for private businesses to manage. 

Given the tight legislative schedule remaining, this Committee 

has our work cut out for us to make sure CFATS does not lapse 

and that we go back to the old days of nobody being certain what 

is going to be or when it is going to be that. 

I am confident that we can get it done in a way that ensures we 

are keeping hazardous chemicals away from terrorists while also 

allowing businesses and communities to thrive. 

Thank you, Mr. Chairman. I look forward to hearing from our 

roundtable participants. 

Chairman JOHNSON. Thank you, Senator McCaskill. So we will 

just go from my left to right, and we will start with David Wulf, 

who currently serves as the Deputy Assistant Secretary for Infrastructure Protection of the National Protection and Programs Directorate (NPPD), U.S. Department of Homeland Security. Mr. 

Wulf. 

TESTIMONY OF DAVID WULF,1 ACTING DEPUTY ASSISTANT 

SECRETARY FOR INFRASTRUCTURE PROTECTION OF THE 

NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, 

U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. WULF. Thank you, Mr. Chairman, thank you, Ranking Member McCaskill and Members of the Committee. 

I really appreciate the opportunity to be here to day to provide 

an update on the progress of the Chemical Facility Anti-Terrorism 

Standards program, the progress we continue to make in fostering 

security at America’s highest-risk chemical facilities. 

When I last testified before this Committee I emphasized the importance of long-term authorization for this critical anti-terrorism 

program, and am very grateful for the leadership the Committee 

demonstrated in security the 4-year CFATS authorization that was 

signed into law in December 2014. 

As we now find ourselves nearly 31⁄2 years into the authorization 

period, I am grateful that the Committee is again taking the lead 

to continue long-term authorization of CFATS, and maybe even 

give some thought to permanent authorization. Just a thought. 

As I am sure you will hear me say once or twice today, the stability that has come along with long-term authorization has driven 
4 

unprecedented progress as we have worked with CFATS-covered 

facilities to make America’s high-risk chemical infrastructure a 

truly hard target, with literally tens of thousands of security measures having been put into place at high-risk facilities across the 

country. 

The stability afforded by long-term authorization has facilitated 

our planning and execution of important programmatic improvements while it has also afforded regulated industry stakeholders 

with the certainty that they deserved as they planned for and 

made significant investments in CFATS-related security measures. 

I do also want to take this opportunity to thank the Committee 

for including, in the recent DHS authorization bill legislation that 

would transform our parent organization, the National Protection 

and Programs Directorate, into the Cybersecurity and Infrastructure Security Agency (CISA). This new agency would continue 

NPPD’s mission of leading the national effort to improve critical infrastructure security, coordinating the protection of the Federal 

Government’s networks and physical infrastructure, and helping 

entities across the public and private sectors to manage potential 

cyber risks. As the threats facing our national security grow and 

evolve every day, we look forward to continuing to work with this 

Committee to pass that critical legislation. 

Turning back to CFATS, as we are all too aware, the threat of 

chemical terrorism remains a real and very relevant one. Around 

the globe, we continue to see bad actors seeking to acquire and 

using in attacks chemicals of the sort that trigger coverage under 

CFATS, and the threat stream continues to reflect that chemical 

facilities themselves remain an attractive target for terrorists. So 

I can tell you with certainty that the work we are doing in concert 

with our committed stakeholders across the wide variety of industries and facilities that comprise the CFATS-regulated universe is 

making a real difference in protecting this Nation. 

And having had the opportunity to work closely with my counterparts in other countries, I can absolutely tell you that what we are 

doing here, in the United States, through CFATS, what you have 

helped us to build with your support for long-term authorization, 

is absolutely the envy of the world. With its 18 comprehensive riskbased performance standards and it is non-prescriptive, flexible approach, CFATS is well suited to enhancing security across the very 

diverse universe of high-risk chemical facilities. 

So what have we been doing to make CFATS even stronger as 

we have enjoyed the stability of long-term authorization over the 

past 31⁄2 years? Well, we have improved processes and have seen 

unprecedented progress in the pace of inspections and in the review and approval of facility site security plans, eliminating a 

backlog of security plan reviews 6 years ahead of earlier Government Accountability Office (GAO) projections. We have developed 

and launched an improved risk assessment methodology that effectively accounts for all relevant elements of risk and have reassessed the level of risk associated with nearly 30,000 facilities 

across the Nation. 

We have implemented the CFATS Personal Surety Program, affording the highest tier at CFATS-covered facility, the ability to ensure that individuals with access to those facilities have been vet-
5 

1The prepared statement of Mr. Currie appears in the Appendix on page 53. 

ted for terrorist ties, and we have significantly reduced burden 

across our stakeholder community, having built and launched a 

streamlined, more user-friendly suite of online tools through which 

facilities submit risk assessment or top-screen surveys and develop 

their site security plans. 

So I have probably gone a minute or two long so my apologies 

for that, Mr. Chairman. But in closing, and just to finish on a positive note, I would like to again thank this Committee and your topnotch staff for your leadership in the CFATS reauthorization process. We are very fond of saying that chemical security is a shared 

commitment and not unlike the role of our industry stakeholders 

who have embraced and built this program in so many ways, and 

the role of our committed and very talented team at DHS. The role 

of Congress, the role of this Committee in shaping and authorizing 

CFATS for the long-term has been hugely important, and I am 

looking forward to working further with you as we drive toward reauthorization this year. 

So thank you very much. I look forward to the dialog here today. 

Chairman JOHNSON. Thank you, Mr. Wulf. Now, of course, everybody knows that that was just a bluff about the length of time. 

Mr. WULF. Sorry about that. 

Chairman JOHNSON. Our next witness is Christopher Currie. Mr. 

Currie currently serves as the Director of Emergency Management, 

National Preparedness, and Critical Infrastructure Protection, 

Homeland Security and Justice Team, U.S. Government Accountability Office. Mr. Currie. 

TESTIMONY OF CHRISTOPHER P. CURRIE,1 DIRECTOR, HOMELAND SECURITY AND JUSTICE TEAM, U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. CURRIE. Thank you very much, Mr. Chairman, Ranking 

Member McCaskill. As you said, I work for GAO. We have been assessing this program for almost a decade now. After about a billion 

dollars in taxpayer money spent, and more by the industry on the 

panel, numerous GAO recommendations, and heavy—and I emphasize heavy—oversight by Congress, the CFATS program has addressed many management challenges it faced early on. 

However, just fixing the past problems is not enough today. As 

Congress considers reauthorization there are other issues, I think, 

need to be discussed here. Some of these are addressed in our past 

work, others are addressed in our ongoing work that we will issue 

later this summer, and others, I think, warrant conditional attention as we move forward and continue to evaluate this program, 

even if it is reauthorized. 

First, the purpose of security regulations is to improve security. 

It is critical that the program be able to measure how risks are 

being reduced and not just focus on outputs, like inspection numbers. 

Second, the program has to evolve with new threats, like cyber 

and staff need and training awareness to help these facilities 

evolve with the threats. 
6 

1The prepared statement of Mr. LeGros appears in the Appendix on page 57. 

2The prepared statement of Ms. Gibson appears in the Appendix on page 61. 

Third, first responders, as you mentioned, the fire departments 

and others like that, need to know what they are responding to and 

how to address it at these facilities. A balance must be struck between sharing information with the communities and protecting security. 

Last, in such a regulated industry as this, the Federal Government should look for opportunities and efficiencies to leverage multiple regulatory programs as well. 

Thank you very much, and I look forward to the discussion. 

Chairman JOHNSON. Thank you, Mr. Currie. 

Our next witness is Jesse LeGros. Mr. LeGros is the Acting Vice 

President of Infrastructure Personnel at the American Federation 

of Governmental Employees (AFGE) National Local 918. Mr. 

LeGros also serves as a CFATS chemical security inspector for the 

Department of Homeland Security. Mr. LeGros. 

TESTIMONY OF JESSE LEGROS, JR.,1 VICE PRESIDENT, 

INFRASTRUCTURE PROTECTION, AFGE NATIONAL LOCAL #918 

Mr. LEGROS. Thank you, Chairman. I will be pretty quick on 

mine. I am one of the original chemical security inspectors that 

was detailed from Federal Protective Service (FPS) over, so I have 

been here through the good, the bad, the ugly, if you will. CFATS 

is a good regulation and it needs to be reauthorized. However, it 

needs to be an appropriate regulation, not a continuing one. 

Having said that, the main reason for me being here is to talk 

about the training issues, specifically in the cyber, or the lack of 

the cyber training that we are getting. With cyber being such a 

forefront issue, it is hard for us to, as inspectors, to regulate cyber 

issues at a facility when we have not had any substantive training 

on cyber. 

I give my time back to the Director so he has extra. 

Chairman JOHNSON. I appreciate that. 

Our next witness is Jennifer Gibson. Ms. Gibson is the Vice 

President of Regulatory Affairs at the National Association of 

Chemical Distributors (NACD). Ms. Gibson. 

TESTIMONY OF JENNIFER GIBSON,2 VICE PRESIDENT, REGULATORY AFFAIRS, NATIONAL ASSOCIATION OF CHEMICAL 

DISTRIBUTORS 

Ms. GIBSON. Good morning, Mr. Chairman, Ranking Member 

McCaskill, and Committee Members. Thank you so much for inviting NACD to participate in this roundtable today. 

NACD and our over 440 member companies are vital to the 

chemical supply chain, providing products to over 750,000 end 

users. NACD members are leaders in health, safety, security, and 

environmental performance through implementation of Responsible 

Distribution, established in 1991 as a condition of membership in 

a third-party-verified management practice. 

While security has always been an inherent element of Responsible Distribution, after the September 11th terrorist attacks, 
7 

1The prepared statement of Mr. Eppli appears in the Appendix on page 67. 

NACD added specific security elements to the program and we continue to enhance these requirements. 

Chemical distribution is also a very highly regulated industry, as 

you can imagine, and that being said we are very strong supporters 

of the CFATS program. I will tell you why. Unlike some other 

agencies, DHS has taken a very collaborative approach in implementing CFATS. Rather than coming in with a find-and-fine mentality, as many agencies do, inspectors and headquarters staff alike 

have had very productive conversations with the industry, the regulated community, with the ultimate goal of improving security. 

This has led to greater efficiencies such as the development of alternative security programs, which allow facilities to really take 

advantage of other measures that they have in place, both regulatory and through industry programs such as Responsible Distribution. 

A long-term CFATS reauthorization will provide stability for 

both industry and DHS. Industry has made substantial investments in CFATS and a long-term reauthorization will give companies the certainty that this will continue and those investments 

were worthwhile. It will also allow DHS to continue to build on the 

program efficiencies that they achieved following the 2014 reauthorization. 

So NACD strongly supports a long-term authorization of CFATS 

and we look forward to our discussion today. 

Chairman JOHNSON. Thank you, Ms. Gibson. 

Our next witness is Randall Eppli. Mr. Randall is the President 

and Chief Executive Officer (CEO) of Columbus Chemical Industries (CCI), headquartered in Columbus, Wisconsin. Mr. Eppli. 

TESTIMONY OF RANDALL EPPLI,1 PRESIDENT AND CEO, 

COLUMBUS CHEMICAL INDUSTRIES, INC. 

Mr. EPPLI. Good morning, Chairman Johnson, Ranking Member 

McCaskill, and distinguished Members of this Committee. 

Columbus Chemical Industries is a chemical distributor 

headquartered in Columbus, Wisconsin, and as Senator Johnson 

indicated, we are about 20 minutes outside of Madison. I want to 

thank you for allowing me to participate in this important roundtable and I am pleased to provide input to the CFATS program. 

CCI is a 40-year-old, family owned manufacturer and distributor 

of chemicals and chemical solutions for industries such as semiconductor, medical device, pharmaceutical, laboratory, and various 

other applications. CCI is a small business. Our 70-person team 

serves customers throughout North America, Europe, and Asia, 

from our facility in Wisconsin and our facility in Phoenix, Arizona. 

We have been an active member of the National Association of 

Chemical Distributors for 25 years. 

From the beginning, DHS generally took a non-adversarial, consultative and reasonable approach in implementing the CFATS 

regulations. It has been our experience that the DHS staff, in both 

the field and at headquarters, have generally been knowledgeable, 

professional, and courteous. Additionally, we have appreciated that 
8 

1The prepared statement of Mr. Erny appears in the Appendix on page 73. 

DHS arranges their site visits with us in advance, unlike many 

other government agencies. 

I believe the CFATS program has made the chemical industry 

and our Nation more secure. Since the program’s establishment in 

2007, we have invested significant capital and training resources 

toward enhanced security measures at our facilities. While these 

resources did not necessarily help us improve our business or grow 

our business, they were nonetheless important to ensure the security of my company, of our employees, and the community. 

CCI, as a company, supports the long-term authorization of 

CFATS. Thank you. 

Chairman JOHNSON. Thank you, Mr. Eppli. 

Our next witness is William Erny. Mr. Erny currently serves as 

Senior Director at the American Chemistry Council (ACC). 

TESTIMONY OF WILLIAM ERNY,1 SENIOR DIRECTOR, 

AMERICAN CHEMISTRY COUNCIL 

Mr. ERNY. Thank you, Chairman, Ranking Member, and other 

Members of the Committee. 

So I am a Senior Director with America Chemistry Council and 

ACC represents the major chemical producers across the United 

States, all of which are involved in the business of chemistry. The 

business of chemistry is a $760 billion enterprise and we are growing. We support roughly 800,000 jobs across the United States, 

good-paying, skilled, American jobs. And it is because of our role 

in the economy chemical security is a top priority for ACC and our 

members. 

This year marks the 30th anniversary of ACC’s Responsible Care 

Program. Responsible Care is the leading chemical industry stewardship program and it has become the gold standard in the industry. It is international in scope and serves as a model for regulatory programs. ACC members have invested more than $17 billion in security under the program. 

ACC also supports long-term authorization of the CFATS program. We agreed that DHS, over the past 4 years, has really made 

some significant strides and improvements in implementing the 

program, and I think this is mostly as a result of their demonstrated commitment to listen and work with the regulated community in a collaborative fashion. 

And while DHS has made some significant progress, ACC would 

like to throw out several recommendations for additional improvement. The first is they need to improve the transparency in their 

DHS risk-tiering determinations. Second, we need to eliminate the 

requirement for terrorist screen at these lower-risk Tier 3 and 4 

sites. And third, we need to establish a CFATS recognition program that provides regulatory recognition for responsible operators 

that go above and beyond mere regulatory compliance. 

In closing, CFATS has helped make our industry and our community safer and more secure. We encourage the Committee to 

consider these proposed changes and to reauthorize the program. 

Doing so will provide the needed regulatory certainty and stability 
9 

1The prepared statement of Mr. Louchheim appears in the Appendix on page 75. 

for companies to make long-term investments and sound risk management decisions. 

Thank you and I look forward to our future discussions. 

Chairman JOHNSON. Thank you, Mr. Erny. 

Our next witness is Justin Louchheim. Mr. Louchheim is the Director of Governmental Affairs at The Fertilizer Institute (TFI). 

Mr. Louchheim. 

TESTIMONY OF JUSTIN LOUCHHEIM,1 DIRECTOR, 

GOVERNMENT AFFAIRS, THE FERTILIZER INSTITUTE 

Mr. LOUCHHEIM. Thank you. Good morning, Chairman Johnson, 

Ranking Member McCaskill, Members of the Committee. My name 

is Justin Louchheim. I work for The Fertilizer Institute. TFI represents the Nation’s fertilizer industry, which includes companies 

that are engaged in all aspects of the fertilizer supply chain. This 

ranges from large production facilities to thousands of small agricultural retailers. 

So in terms of how we fit into the program, Dave, down the 

table, is going to tell me I am wrong in a second, but DHS estimates that there is about 3,500 facilities presently subject to 

CFATS program. TFI estimates that this includes about 1,500 fertilizer manufacturers and agricultural retail facilities, with the retail facilities accounting for the overwhelming majority. 

Retail facilities typically are generally located in rural communities, interface directly with farmers, typically employ about 5 to 

10 individuals per facility. So safe and secure handling of fertilizers 

is top priority for The Fertilizer Institute and our members. We actively participate, sponsor numerous safety initiatives. One example is ResponsibleAg. Mr. Erny talked about stewardship programs. 

ResponsibleAg would be our stewardship program. This exists to 

enhance compliance for agricultural retailers with a variety of Federal regulations. 

To date we have about 2,500 facilities registered with the 

ResponsibleAg program, over 1,000 facilities certified, 185 auditors 

have been trained, and about 2,000 audits have been completed. I 

am very proud of this industry stewardship program and invite you 

and your staff to come out and visit any time. 

So regarding the CFATS program, our members support the program. We recognize its importance and we would support a multiyear reauthorization. 

A couple of thought about where we could go forward. We have 

heard transparency talked about. That would be at the top of my 

list. We believe that implementation of the program will benefit 

from a bit more transparency between DHS and the regulated community. This includes the re-tiering process for facilities and 

chemicals covered under Appendix A. We think ultimately this will 

bolster the quality of site security plans around the country. 

Information sharing. We believe facility owner-operators should 

retain the discretion to determine how site security plans and related information is shared. I think that is very important. And 

then we have heard this discussed previously, the Personal Surety 

Program. We do not believe this obligation to check employee 
10 

1The prepared statement of Ms. Menendez appears in the Appendix on page 80. 

records against the terrorist screening database (TSDB) should currently be expanded to facilities and risk groups at Tier 3 and 4. 

Just in terms of numbers, this is a huge expansion of that program. Currently you have about less than 200 in Tiers 1 and 2 facilities, your most sort of at-risk facilities. To take it to 3 and 4 

would take it from that 200 to about 3,500. 

So we think if we want to look at this, perhaps a study would 

be a step to see if this makes sense, to see how it has worked for 

Tiers 1 and 2 first, before we expand it a great deal. Thank you. 

Chairman JOHNSON. Just a real quick question. Of your members, how many are Tier 1, 2, 3, and 4? Do you have a breakdown 

on that? 

Mr. LOUCHHEIM. Yes. 

Chairman JOHNSON. Like are all the retail stores, are they Tier 

4? 

Mr. LOUCHHEIM. Sure. I want to follow up in writing to make 

sure I am certain of this, but it would be, we are talking about 

1,500 manufacturer retail facilities for the fertilizer industry at 

large. I would say about 1,400 of those are agricultural retailers. 

The bulk of those are going to be 3 and 4, those 1,400. 

Chairman JOHNSON. OK. Thank you, Mr. Louchheim. 

Our next witness is Linda Menendez. Ms. Menendez is the Director of Operations for Austin Powder Company, headquartered in 

Cleveland, Ohio. Ms. Menendez. 

TESTIMONY OF LINDA MENENDEZ,1 DIRECTOR OF 

OPERATIONS, AUSTIN POWDER COMPANY 

Ms. MENENDEZ. Chairman Johnson, Ranking Member McCaskill, 

and Members of the Committee, on behalf of Austin Powder Company thank you for the opportunity to discuss the CFATS program 

and how this program can be improved. 

My name is Linda Menendez. I am the Director of Operations for 

Austin Powder Company, a 185-year-old privately held commercial 

explosives manufacturer headquartered in Cleveland, Ohio. I have 

worked for Austin Powder for over 30 years, 10 years in the field 

operations. 

As you are aware, commercial explosives are used today in mining, quarry, construction, pipeline trenching, avalanche prevention, 

and the like. Commercial explosives play a significant role in improving our quality of life. Our license to operate our sites is based 

on our compliance with the regulations of ATF. Not only do I represent Austin Powder Company, I also represent the boots on the 

ground, Austin Powder’s 1,200 employees, cleared by ATF as employee possessors or responsible persons, transporting and using 

explosives daily. Our employees are critical contributors to our 

safety, security, and compliance. 

It has been my experience that persons responsible to direct the 

management of an ATF-licensed facility rely on this orange book, 

27 Code of Federal Regulation (CFR) 555, to plan their sites and 

comply with ATF regulations for the safe and secure storage of explosives. 

My testimony today addresses the following points. 
11 

1The prepared statement of Ms. Satkowiak appears in the Appendix on page 88. 

First, additional regulations under the CFATS program for the 

same products, for the same purpose has resulted in additional expense and time and money without benefit. An example of this is 

one of our ATF-licensed facilities, a guarded former Navy ammunition depot with bunker-type military constructed magazines, required to install additional fencing, cameras, and monitor detection 

devices with over a cost of $300,000. 

Second, duplicative regulation really detracts the compliance efforts of those seeking to be confident that they understand these 

laws. 

As you reconsider the reauthorization of CFATS, I urge you to 

evaluate the overlapping burden placed on the explosives industry 

and exclude ATF federally licensed facilities from the CFATS bill. 

Thank you. 

Chairman JOHNSON. Thank you, Ms. Menendez. 

Let me just quickly ask you a question. Did you fight for that in 

the original authorization and the 2014 reauthorization? Did you 

fight to be excluded? 

Ms. MENENDEZ. Yes, we did. 

Chairman JOHNSON. You fought it and lost. 

Ms. MENENDEZ. And lost. 

Chairman JOHNSON. OK. 

Our next and final witness is Debra Satkowiak? 

Ms. SATKOWIAK. Yes. Good morning. 

Chairman JOHNSON. Ms. Satkowiak currently serves as the 

President of the Institute of Makers of Explosives (IME). Ms. 

Satkowiak. 

TESTIMONY OF DEBRA S. SATKOWIAK,1 PRESIDENT, 

INSTITUTE OF MAKERS OF EXPLOSIVES 

Ms. SATKOWIAK. Thank you. Chairman Johnson, Ranking Member McCaskill, and Members of the Committee, on behalf of the Institute of Makers of Explosives and the commercial explosives industry, thank you for the opportunity to discuss DHS CFATS and 

to be part of the process to improve the program. 

My name is Debra Satkowiak and I am the President of IME. 

Our association was founded in 1913, at the request of the U.S. 

Government, to develop industry best practices and to promote explosive safety. To this day, we remain the safety and security association for the commercial explosives industry. 

Over 5 billion pounds of explosives materials are consumed in 

the United States annually in the operations that Linda just recently mentioned. Explosives underpin our economy, and as Linda 

said, they improve and they keep us in the quality of life that we 

have today. IME is proud of our industry’s safety and security 

record and we continuously work with our member company experts to improve our best practices, many of which are adopted into 

regulation by Federal, State, and local entities. We also work closely with those government agencies that regulate us to keep explosives out of the hands of those who would do us harm. 

My testimony addresses the following points. 
12 

First, duplicative regulations. IME members are regulated by 

ATF and the DHS CFATS programs for precisely the same purpose, to prevent theft and diversion of explosives. There has been 

no justification provided for the duplication of DHS over ATF’s jurisdiction. 

Second, the millions spent on CFATS compliance by IME members have not had a measurable impact on security, according to 

the U.S. Government data. 

Third, CFATS duplicative regulations have caused conflict with 

other Federal regulations, leaving our members to de-conflict and 

clarify jurisdictional and policy interpretations. 

Finally, the lack of transparency in CFATS’ tiering impedes the 

ability of businesses to proactively plan and adapt operations. 

As a solution to the duplicative regulations, IME is requesting 

that ATF be given the same deference as U.S. Coast Guard 

(USCG), the Departments of Defense (DOD) and Energy (DOE), 

and the Nuclear Regulatory Commission (NRC) in the CFATS statutory exemptions. 

In closing, IME is not against regulation. Indeed, in the world of 

commercial explosives, smart regulation promotes good business. 

We only seek relief from redundant regulation. 

Thank you once again, and I look forward to answering your 

questions and being a resource for the Committee. 

And I do have to quickly take one moment to correct our written 

testimony, to adjust the hours estimated to complete a Top-Screen 

in accordance with the GAO’s 6-hour estimate and the update to 

the IME member company time spent that is mentioned in our testimony to 357 hours to fill out Top-Screens for their facilities. 

Chairman JOHNSON. OK. I appreciate that and we will have the 

staff make that correction. 

Again, I am here for the duration so what I will do is turn it over 

to our Ranking Member for questions first. But let me, so I do not 

forget, I do want to commend DHS. I think it is a really positive 

sign the number of businesses saying that you have approached 

this very cooperatively. I just think that is the best way to go, 

whether it is Occupational Safety and Health Administration 

(OSHA) or Environmental Protection Agency (EPA) or, in this case, 

DHS with CFATS. Businesses also want a secure America, and 

doing it cooperatively, I think, is just going to absolutely get the 

best results. 

So I really do appreciate hearing the fact that that is the way 

DHS has approached this, and I would encourage you to continue 

along that path. 

Mr. WULF. Absolutely. 

Chairman JOHNSON. With that, Senator McCaskill. 

Senator MCCASKILL. Sure. Just briefly a few questions for everyone. Just raise your hand if you disagree. CFATS should be reauthorized. Anybody think it should not be? Raise your hand if you 

think we should not reauthorize CFATS. 

OK. If you would go down the panel and give me an ideal length 

of time you think it should be reauthorized for. 

Mr. Wulf. 

Mr. WULF. We would certainly prefer a permanent reauthorization, though recognizing the progress of permanent is not in the 
13 

cards, we would be hoping for something significantly longer than 

the 4-years we received in 2014, so 10 years. 

Senator MCCASKILL. Mr. Currie. 

Mr. CURRIE. All right, ma’am. From GAO’s perspective, and we 

do not have an opinion, but I will say I can understand the benefits 

of having permanent reauthorization. It makes some sense for predictability and budgeting. However, I do think that the consistent 

reauthorizations every 4 years have brought a lot of additional 

oversight that have, frankly, improved the program. I think that is 

a big reason for the improvements. 

Senator MCCASKILL. Mr. LeGros. 

Mr. LEGROS. I agree with the Director, permanent, and I disagree with GAO as far as the oversight, because I think, as any 

legislation, you can always have the governmental oversight no 

matter what the timeframe is on the regulation. 

Senator MCCASKILL. Ms. Gibson. 

Ms. GIBSON. NACD would support a multi-year reauthorization, 

somewhere between 5 and 7 years. 

Senator MCCASKILL. OK. Mr. Eppli. 

Mr. EPPLI. A minimum of 4 years. 

Senator MCCASKILL. Minimum of 4 years. 

Chairman JOHNSON. What about maximum? I think it is interesting. The industry all of a sudden went from five to seven. I 

mean, do you also agree that reauthorization is important? 

Mr. EPPLI. I do. The concern I would have is if it is permanent, 

is there a chance to do the kind of thing we are doing here today 

to re-evaluate. 

Senator MCCASKILL. OK. 

Mr. ERNY. Yes, I would agree, and we think the oversight function here is really important. So to the extent that we can continue 

to have these discussions, I would say ACC would support a longerterm authorization, minimum of 4 years. 

Senator MCCASKILL. But what would be the longest you think 

would still be good without being counterproductive to oversight? 

Mr. ERNY. Right. I will just be frank. I think it depends on if we 

can see some of the changes made to the program that we are talking about here today, to help better streamline this, remove some 

of the regulatory burden associated on the regulatory community. 

Senator MCCASKILL. OK. 

Mr. ERNY. So I think it all depends. 

Senator MCCASKILL. OK. 

Mr. LOUCHHEIM. Thank you for the question. I would say, similar 

to some of the other comments, 4 to 6 years. I would probably prefer if we could get to an—whatever authorization period is, that we 

can get to an off-election year, for when it needs to be revised. 

Senator MCCASKILL. They all want everything to be in an offelection year. Trust me when I say that. Ms. Menendez. 

Ms. MENENDEZ. Thank you. I believe that the reauthorization 

should be a 4-year period, as long as duplicative regulations are removed. 

Ms. SATKOWIAK. Yes, of course. Assuming that ATF-regulated facilities are exempted from the program, we would support 4-year 

reauthorization. 
14 

Senator MCCASKILL. OK. Is there anyone who would like to 

speak up and say that some of the chemicals that we are regulating here should be removed from the list? Does everyone agree 

that chlorine, hydrogen fluoride, and ammonia nitrate should stay 

on the list? Does anybody disagree with that? 

[No response.] 

OK. What is your analysis, Director Currie, of the facilities communication and planning with local first responders as it stands 

today? 

Mr. CURRIE. Yes. That is something we are addressing and we 

will be reporting on later this summer. But what I can tell you, 

preliminarily, is that—I mean, the CFATS program has done a lot, 

when they go out and do inspections, to verify that the facilities are 

working with the local emergency planning community, so that is 

the formal mechanism. 

What we are looking at, though, is do first responders—the firefighters, the policemen—do they have access to everything that is 

at that facility? That is our biggest concern right now, from a safety perspective. I mean, real-world incidents have shown that people 

have died responding to things that they were not prepared to respond to. 

So we are looking at what DHS is doing, how they are working 

with EPA, how they are working with the States to figure out, do 

responders know exactly what is at that facility beforehand. 

Senator MCCASKILL. For any of the actual people who have companies that are here, thinking that it is too duplicative, is there 

anything specifically as it relates to first responders’ responsibilities and their role in this that you would like to see changed? Ms. 

Menendez. 

Ms. MENENDEZ. Thank you. We always reach out to our local responders. We are in their remote areas. Most of our first responders are volunteers. We had one instance where one of our managers, trying to reach out to a local fire department, said the only 

way to get their attention is to call 911. So that is really what we 

are dealing with, is that you have very remote facilities with volunteer organizations that are not available to spend the time to understand what chemicals are in their back yards. 

Senator MCCASKILL. Is this common among the explosives industry, that you are in remote areas? 

Ms. MENENDEZ. Yes, it is. 

Senator MCCASKILL. Because of the nature of what you do. 

Chairman JOHNSON. That is a good thing. 

Senator MCCASKILL. And that is a good thing, but it is also a big 

challenge for first responders. First of all, volunteer departments, 

in terms of the resources for training and the applicability of all 

of the technical knowledge that you would have to have here. That 

is really a challenge. I think that is something that we need to take 

a look at. Thank you. 

Ms. SATKOWIAK. Senator, if I may add to that. 

Senator MCCASKILL. Sure. 

Ms. SATKOWIAK. ATF requires that we notify the first responders, the fire authority, where we have explosives storage, because 

it is important to us that those first responders know where our 

materials are. However, on the flip side, for security proposes, we 
15 

do not want the general public to know where explosives are 

stored. And IME, as an association, we are asking ATF to make 

sure that that notification to the local fire authorities is done on 

an annual basis, and ATF has taken up that rulemaking on our behalf. 

Senator MCCASKILL. OK. Thank you, Mr. Chairman. 

Chairman JOHNSON. Before I go to Senator Heitkamp, you asked 

about ammonium nitrate. Mr. Louchheim, you made the distinction 

between ammonium nitrate and urea ammonium nitrate (UAN). 

Correct? Can you talk about the distinction and how big a difference that is, and how big a problem that is if we maintain urea 

ammonium nitrate under CFATS? 

Mr. LOUCHHEIM. Sure. Thank you for that. So ammonium nitrate 

would be more in prill solid form. Urea ammonium nitrate would 

be a liquid. Those are the key sort of physical, how you see it, differences. 

Yes, in the written testimony we sort of make some reference to 

some of this. So a little bit of background, I guess, is probably relevant for here. It is a little outside the scope of CFATS in some 

of this background here. DHS had this obligation still on the books 

to create a track-and-trace program for ammonium nitrate, purchase of ammonium nitrate. This is a decades-old directive from 

Congress. It has not yet been implemented. 

Sort of along the lines of this directive they, last year, commissioned a study by the National Academy of Sciences (NAS) to more 

broadly explore the use of improvised explosive chemicals and 

make recommendations on how they should be managed in commerce. 

So the NAS issued a report in late 2017. They identified 28 

chemicals for further consideration by DHS. One such chemical is 

urea ammonium nitrate, which is a liquid form. It is a widely used 

fertilizer. TFI believes that this product was a little 

mischaracterized as in the highest-risk category in this report, and 

one of our reasons is it has never been used as an explosive. 

And, so our focus here is we think DHS should focus its limited 

resources on those chemicals that have historically been used. 

Chairman JOHNSON. Tell me why that is a problem, and then I 

want somebody to either confirm what he is saying or defend why 

we would continue to regulate it under CFATS. Does it essentially 

put retailers into Tier 1 position? Or, what is the problem here? 

Mr. LOUCHHEIM. Part of the problem is, depending on what you 

are trying to track and trace. I guess, you could try to track and 

trace everything out there in the world, right? And, you can only 

track and trace so much. 

UAN is very widely used. Ammonium nitrate is sort of a shadow 

of what it once was in terms of usage and consumption right now 

by farmers. It has a valuable environmental role, as a fertilizer for 

crops, but its use is not what it used to be. And so UAN, being so 

widely used, would be a serious challenge to implement. 

Chairman JOHNSON. So you are saying urea ammonium nitrate 

is not a problem. It is not a dangerous chemical. 

Mr. LOUCHHEIM. And it is also never been used. 

Chairman JOHNSON. Does anybody want to confirm that or challenge that? 
16 

Mr. WULF. So if I could, Mr. Chairman. So urea ammonium nitrate liquid is not regulated—is not covered under CFATS right 

now, so I think what Justin is referring to is and he mentioned a 

separate framework that we were asked to put into place under the 

secure handling of ammonium nitrate provisions of the 2008 Appropriations Act. 

And, I think this, in many ways, is a good government story. So 

what the law asked us to try to do was to put in place a regulatory 

framework specific to ammonium nitrate that would have required 

registration and vetting against the terrorist screening database of 

all purchasers and sellers of ammonium nitrate. And we worked 

through the rulemaking progress. We pushed out notices of proposed rulemaking (NPR), did the whole notice and comment process. But we could not arrive at a proposed final rule that, in our 

view, struck an appropriate balance between cost and benefits and, 

importantly, the burdens that would have accrued to potentially 

regulated industry. 

So unlike CFATS, which is a facility security-focused regulatory 

framework, this would have been, or this would be a framework focused on commerce in ammonium nitrate, on the purchase and sale 

of ammonium nitrate. Our view is that in as much as ammonium 

nitrate is one of perhaps a dozen high-threat improvised explosive 

device (IED) precursor chemicals, it would not make sense to implement such a burdensome regulatory scheme for a single chemical. 

So what we did, we came to Congress, we talked with our industry stakeholders, and we are looking at a fresh start here, and that 

is why we sponsored this National Academy of Sciences study. And 

so that is the document to which Justin is referring. And so their 

recommendation was that urea ammonium nitrate is a chemical 

with which we should be concerned going forward. It is probably 

another discussion for another day. But, we are very open to that 

feedback. And those are recommendations from the National Academy. 

Chairman JOHNSON. So you are just trying to head something off 

at the pass. OK. 

Mr. WULF. Yes. 

Chairman JOHNSON. Senator Heitkamp. Oh, sorry about that. 

Senator Peters. 

OPENING STATEMENT OF SENATOR PETERS 

Senator PETERS. Thank you, Mr. Chairman. 

A question I have is related to cybersecurity threat. Mr. Currie, 

you mentioned that in your comments. Mr. LeGros, you did as well. 

Certainly when we are talking about critical infrastructure here 

and potentially dangerous chemicals that are being produced, and 

we all have to agree that cyber is a major threat to that. I would 

like to have both of you talk a little bit more about that, deficiencies that currently exist, things that we may be thinking about. 

Mr. Currie, if you could elaborate on your comments. My understanding is that a lot of these facilities do not have full-time folks 

on staff. Often it is contracted out. It may not have the kind of intensity of supervision that is necessary to make sure that these 

sites are secure. But if you could tell us a little bit about more of 
17 

your findings, what you think we should be doing, and then, Mr. 

LeGros, talk about the inspectors. You mentioned that in your testimony as well. 

Mr. CURRIE. Sure. I can start. I agree with you. This is a huge 

concern. It is not something that we have specifically studied or 

drilled down into in the CFATS program, although we have been 

working with staff on the Committee to do some future work. 

But I would just say that building cybersecurity expertise in the 

training is a huge challenge across all critical infrastructure sectors. It is a huge challenge at DHS in general, for them to just recruit and retain cyber professionals in their primary cyber missions, let alone getting inspectors trained. So I think you are absolutely right. This is something that we need to focus on, on this 

program, or else it is not going to be able to continue to evolve to 

address what is probably growing to be the biggest security challenge these facilities are going to face. 

Senator PETERS. Mr. LeGros. 

Mr. LEGROS. And I agree. Understand, I am not a cyber expert, 

by no means. I am more of a physical security expert. So back as 

far as the cyber goes, it depends on the facility. Cyber is what it 

is. It refers to everything in our daily lives. But on one side, as far 

as the CFATS go, a lot of times what we call chemical of interest 

(COI), has no cyber functions with it. A good example is like chlorine. A lot of facilities use chlorine to treat the water. It is basically 

a manual system, a standalone. They hook it up, they turn on the 

valve, and as the water goes by it sucks the chlorine out. 

So from that standpoint, under the CFATS, it is not really a 

cyber issue. However, it is being made into it because now headquarters is looking at emails, the other processes that a facility 

does. Because a facility could have five chemicals. Four of them, or 

all five of them be chemicals of interest under our regulation. However, they are not tiered for those other four chemicals. They are 

only tiered, like in this case, for the chlorine. 

So if DHS, with CFATS inspectors, are going to look more at the 

cyber section of it, we, the inspectors, have to have valid training, 

not what we have had in the past as far as training, which is basically how to fill out our inspection reports in order for it to get approved up to headquarters. 

Senator PETERS. Mr. Wulf, do you want to comment, your 

thoughts on this matter? 

Mr. WULF. Sure. Yes, I appreciate the opportunity. So cyber is 

certainly an important concern across the chemical sector, really 

across all 16 of our critical infrastructure sectors. In the chemical 

sector, as Jay alluded to, you see varying degrees of integration of 

cyber systems, with chemical processes, with facility security networks. And so, we have varying degrees of engagement on the 

cyber front. 

All of our inspectors are equipped to engage and address our 

risk-based performance standard focused on cybersecurity at the facilities where we have what we call minimal integration of cyber 

systems, where cyber systems are basically used to run the email 

but are not connected to the processes involving the chemicals, they 

are not connected to the facility’s security system, closed-circuit TV, 

or what have you. 
18 

We have done some advanced training for about half of our inspector cadre, equipping them to get out and inspect the more fully 

integrated facilities and their cyber systems and to work with facilities as they think through ways in which they can better secure 

those cyber systems. We have cyber subject matter experts in our 

headquarters office who are available to work with inspectors, who 

tee up the questions that should be asked, based upon their review 

of facility site security plans. 

So cyber very much at the top of our minds, and I think in many 

ways CFATS is at kind of the leading edge of cybersecurity in putting into the CFATS framework 10 years ago a risk-based performance standard focused on cybersecurity. Certain we can, on the 

training front, always improve, and I appreciate, really, Jay’s feedback on that front. We are always looking to expand and enhance 

our training for our really top-notch inspector cadre. So very much 

appreciate it. 

Senator PETERS. Right. 

Chairman JOHNSON. Thank you. 

Mr. LEGROS. Senator, can I ask a question of the Director? 

Chairman JOHNSON. Yes. 

Mr. LEGROS. So when you are referring to half the inspectors 

being trained, are you referring to partial or significant levels of 

cyber? 

Mr. WULF. I think when I am talking about the half I am talking 

about the half who have gone through the more advanced cyber 

training. 

Mr. LEGROS. OK. The problem we are having as inspectors, or 

the lead inspector, when I go into our database, which is ChemSec, 

to schedule an inspection, because we have the three levels of cyber 

integration—the minimum, the partial, and the significant—as the 

Director said, and I put it in my notes, there are the four questions 

that we ask for a minimum. Do they have cyber policies, do they 

conduct cyber training, etc. 

If I receive a facility that has a partial, when I go in there and 

click inspector with cyber training, the list that it gives me is the 

exact same list as a general inspector. I am on that list. I cannot 

do it. When you do a significant, it plainly states that it will be assigned by headquarters. And as I referred to in my statement, they 

are actually coming out with a new guidance document that it does 

talk about minimum, partial, and significant, and especially significant being done by a headquarters cyber subject matter expert 

(SME). But when you actually look at the other paragraphs under 

it, it says it will be determined by the branch chief for compliance, 

which is basically what they are doing is they are trying to push 

all this stuff onto us. And I understand that they say other inspectors have had training, but even the ones that I know have had 

training, they were not sent by headquarters. They have done it on 

their own time. They signed up for these classes because they have 

the interest on it. But as far as headquarters providing the training, they have not. 

And I will be honest with you. The way our schedule is, with so 

many inspections, because of the stuff that is being dumped on us, 

we do not have the time to do this stuff. As I explained in my statement, there are weeks that go by where I have inspections on Mon-
19 

days and Thursdays. So when I have an inspection on Tuesday, 

Monday I am preparing for an inspection, on Wednesday I am preparing for the inspection on Thursday, and it is a revolving door 

effect. And with so much being dumped on us—and I hate to use 

the word ‘‘dump,’’ but dumped on us—it is hard for the inspectors 

to complete the inspections in the time given, and, honestly, to be 

able to get the training. We do not have enough inspectors. Apparently we do not have enough people at headquarters to do what 

they need to do as far as the reports go. 

Senator PETERS. So if I gather from your comments, when it 

comes to reviewing the types of cybersecurity protections at a facility, given the lack of training, given the time constraints, other 

things that you have mentioned, basically inspectors—it is just a 

box that is being checked. There is not a deep dive as to whether 

or not this facility is secure? 

Mr. LEGROS. Well, the ones that are partial, again, it is, like I 

said, there are four questions but two are actually to the facility. 

The other two is based on our opinion. And I am not a cyber one, 

and it is hard for me to honestly say, are they able to thwart the 

ability. I do not know. A lot of times it is a conversation with the 

cyber person at the facility who either has a bachelor’s degree, a 

master’s degree in computer science, or some kind of certificate for 

cybersecurity, and that sort of thing. So my opinion is based on 

their opinion. 

Senator PETERS. Right. So you are asked to give an opinion 

based on—without any training, and you have to rely on what you 

are being told by the facility, basically. 

Mr. LEGROS. Well, the right training. 

Senator PETERS. Right. OK. 

Mr. LEGROS. At cyber things change daily, yearly, whatever. But 

we have not had the basic in-depth training on cybersecurity and 

cyber systems that we need. And, I am sorry, what was the other 

part of the question? 

Senator PETERS. No, that is it. I appreciate that. Thank you. 

Thank you, Mr. Chairman. 

Chairman JOHNSON. I think one thing we really need to be concerned about is mission creep, and I think CFATS is meant to address a particular problem. Cyber is incredibly complex and it is 

changing all the time. I think it is unrealistic to think that CFATS 

inspectors can be cyber trained and really ought to be doing a deep 

dive. I think it is just kind of outside the scope of what CFATS 

ought to be. That is my own personal opinion. 

So what I would recommend is focusing the efforts on the task 

at hand, prioritizing things, and kind of let the cyber issue be 

dealt by other people within DHS. I just do not think you can address—just because you are going in inspecting these sites, you 

should be addressing every possible risk that these businesses are 

subjected to. That is my own personal opinion. Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. Mr. Chairman, a number of years ago I was fortunate enough to become Chairman of this Committee, and Tom 

Coburn became the Ranking Member of this Committee. There was 

an article in, I do not know, Washington Post, one of these papers, 
20 

that talked about the new leadership of the Committee, who was 

Chair and Ranking Member. They mentioned that I was going to 

be the new Chairman of Homeland Security, and the article went 

on to describe me as the Senate expert on cybersecurity. And I took 

the article and I showed it to my wife and I said, ‘‘Your husband 

is now the expert on cybersecurity in the Senate,’’ and she said, ‘‘In 

the land of the blind the one-eyed man is king, and you are that 

one-eyed man.’’ To your point. 

What I want to do is just briefly ask, just to go down the list, 

and we will just start with Debra, and just give us, quickly, one 

thing you think you all agree on. Just one thing in the conversation 

here. What is one thing you all agree on? 

Ms. SATKOWIAK. We all agree that protecting the security of our 

great nation is of absolute importance, and particularly in today’s 

environment. 

Senator CARPER. Thank you. Ms. Menendez. 

Ms. MENENDEZ. I think that you will hear that theme across the 

board, but I do agree that we are all responsible for the security. 

Senator CARPER. OK. 

Mr. LOUCHHEIM. I will echo that. I will add that Mr. Wulf and 

his team do a great job to also forward that mission and deserve 

those accolades. 

Senator CARPER. Mr. Wulf, are you going to sit there and take 

that? 

Mr. WULF. I will gladly take that. 

Senator CARPER. All right. Mr. Erny. 

Mr. ERNY. I think we can all agree that the approach that DHS 

has taken over the history of their program has really made a big 

impact, and I think they should continue with this collaborative approach with the industry. Everybody benefits by this. We all have 

the same goal here, right? We want to improve security of our facilities, our operations, and the communities where we live. 

Senator CARPER. Thank. Mr. Mr. Eppli. 

Mr. EPPLI. I would echo that the security of this country is critical and CFATS is focused on that. I would also echo a comment 

that was just made that DHS has done a great job of being collaborative in working with us to get to that goal. 

Senator CARPER. Thank you. Ms. Gibson. 

Ms. GIBSON. I think we all agree that regulatory certainty is 

needed, and in that light I think we all—although one of our 

groups has a caveat—would support the multi-year reauthorization. 

Senator CARPER. Thank you, ma’am. Mr. LeGros. 

Mr. LEGROS. I agree that CFATS regulation is a great regulation. It just has its areas that it needs to be tweaked, if you will. 

Senator CARPER. All right. Thank you. 

Mr. CURRIE. I think we all agree that the security of chemical facilities is critical. Like aviation, this is one of the things that has 

actually been used in terrorist attacks in this country, so it is still 

a huge concern. But I think we all agree that the Federal Government needs to continue working across its departments and its programs to make sure that their oversight is sufficient. 

Senator CARPER. Good. Mr. Wulf. 
21 

Mr. WULF. And I would just pile on, I think we all agree that 

the chemical security threat is a real one. It is a very relevant one. 

I think we agree, as well, that CFATS is well suited to the task 

of securing our highest-risk chemical infrastructure and that its 

strength, as a program, really lies in the commitment of the entire 

community. This is not something that DHS can do alone without 

the buy-in of our industry stakeholders who have been great across 

the board. 

Senator CARPER. Thank you all. 

I want to go back to something Mr. Erny said. I think he suggested maybe three ideas, one dealing with transparency, second, 

I think, there was the term ‘‘elimination’’ was used in one of your 

suggestions. I think a third one you used the word ‘‘establish.’’ But 

just go back to your three recommendations, and very briefly say 

what they were. 

Mr. ERNY. Sure. Thank you. 

Senator CARPER. And what I am going to do is ask anybody else 

on the Committee panel to comment, favorably or not. 

Mr. ERNY. Sure. So the three top changes I think that would 

really do a big job in improving CFATS would—one is improve the 

transparency with the tiering determinations that are made. Often 

times I hear from our members that they are not directly engaged 

on what the risk factors are associated with their tiering. And so, 

there is no reason that the security manager of a site should not 

understand the details of the threat that he is supposed to be protecting against. This is the guy that has the responsibility for it. 

He has the authority, the resources to be able to put into it. 

So I think DHS has done a better job—— 

Senator CARPER. I am going to ask you—go ahead. I do not want 

to run out of time. 

Mr. ERNY. Just real quick—— 

Senator CARPER. Your next two ideas. 

Mr. ERNY. You got me on a roll, so—— 

Senator CARPER. Yes. Thank you. 

Mr. ERNY. And then, second, eliminate the requirement for this 

tariff screening personal surety item for the lower-risk tiers. And 

then, third, is establish a CFATS recognition program. This would 

essentially look at the industry stewardship programs in a way 

that would offer some regulatory recognition for those sites that are 

in full compliance. 

Senator CARPER. OK. And let me just ask the other members of 

the panel, anyone have a concern with any of the three points that 

Mr. Erny has made? If so, please share those with us. 

Ms. SATKOWIAK. Senator, if I may comment, please. I do want to 

mention—so I do agree, obviously, with transparency. Our member 

companies seem to feel that DHS, they are very friendly, very professional, and they will have that conversation with you, and we 

provide them the data, and then there is some delay as they go 

back to headquarters and they make decisions and then they provide a response, and then we have the opportunity to make adjustments, and then the process starts over. But we do not have that 

because it is not prescriptive. We do not have that ability to plan 

ahead. And so we would very much support some changes that 

way. 
22 

In regards to eliminating TSDB screening, I just want to remind 

the Committee that as ATF-regulated facilities, every single one of 

our employees and responsible persons must be screened in order 

to engage in the explosives business, whether it is constructive possession or whether it is physical possession. They must be screened 

against all prohibited person factors as ATF has established them. 

Now, ATF does screen against TSDB, although it is not considered 

a prohibitive factor. They do screen against it and then they will 

make referrals if there is a hit against TSDB. 

And then I do want to support, if there is any recognition for 

CFATS programs. So IME, we developed these safety library publications that are actually looked at globally, not just here in the 

United States but globally, and these are established by the member company experts, the people that have expertise in the industry 

with explosives specifically. And so our compliance with these has 

always, as an industry, you always have the minimum basic regulations that have been established by ATF and then our best practices that are piled on top. 

Senator CARPER. All right. 

Ms. SATKOWIAK. But thank you for the opportunity. 

Senator CARPER. And finally, Mr. Wulf, and then I think I need 

to step aside. 

Mr. WULF. Thank you, Senator. I appreciate it. I will say with 

respect to transparency in tiering, it is something that we have 

strived to foster. In building the new risk-tiering methodology, we 

did this as a community with the participation of our industry 

stakeholders. We have published tiering fact sheets in an effort to 

inform companies about the types of factors that inform tiering. 

We are certainly available to talk directly to facilities that have 

questions about their tiering, and for that matter, have, and continue to work with facilities as they are thinking about designing, 

building new facilities, to run a hypothetical risk assessment, a hypothetical top screen, to give them some feedback as to risk decisions they might be able to make to lower their risk profile and 

hopefully not find themselves covered by CFATS. But always eager 

to talk about ways in which we can do more. But in developing the 

new risk-tier methodology, we are very eager to try to do away 

with the historic black box that had been the perception of how our 

tiering was working. 

With respect to the personnel surety program, the checks for terrorist ties that are now applied to Tier 1 and 2 facilities, we are 

open to working on this issue, but the thing I would note is that 

across the other 16 critical infrastructure sectors many of the 

stakeholders in those sectors find themselves without the authority 

to access the terrorist screening database and to ensure that those 

who have access to their critical infrastructure have been vetted for 

terrorist ties. And in those sectors they are pretty much clamoring 

for that authority. 

So, I would worry a little bit about keeping that ability, that access to the terrorist screening database away from the vast majority of America’s highest risk chemical facilities, but certainly open 

to discussing that. 

And with regard to a recognition program, across our community, 

and, those who are sitting at this table representing some fine or-
23 

ganizations—NACD, ACC, IME—have in place stewardship programs and they do great work, and they raise the bar for security, 

not only at the 10 percent or so of facilities that find themselves 

covered under CFATS but at those other 90 percent. So, very interested in working with the Committee on prospects for ways in 

which we can recognize those programs within CFATS, whether 

that is the ability to place facilities that are in good standing with 

those programs on a less frequent inspection cycle, or other ways 

of recognizing. 

I think one thing we would want to ensure is that those programs are more or less in alignment with the 18 comprehensive 

risk-based performance standards that form the core of the CFATS 

program. 

Senator CARPER. Mr. Chairman, I just wanted to thank you 

again. I thanked him privately and Senator McCaskill, for hosting 

this roundtable. When Dr. Coburn and I and our staffs worked 

on this 4 or 5 years ago—we actually worked on it for quite a 

while—and I was not sure we were going to be able to come to a 

consensus and pass legislation that would be signed into law. But 

I am proud of the really collegial effort that we are privileged to 

take part in. 

At the time we realized that this is not the Ten Commandments. 

It is not written in stone, and we are going to learn some things 

as we go through the last 4 years, and learn some more things as 

we go through the next 4 or 5 years. But you have given us some 

wonderful feedback and it is interesting. Senator Johnson and I, a 

lot of times when we have these hearings we ask the witnesses, 

like, ‘‘What can we do to be helpful’’ in whatever issue we are dealing with. Almost always they say, ‘‘More oversight. More oversight.’’ And one of the nice things about having reauthorization period is it actually compels the oversight, and I think this has been 

actually most helpful. So thank you, one and all. Thank you. 

Chairman JOHNSON. Let me just say, Senator Carper, I think 

you and Dr. Coburn ought to be commended. When you did reauthorize this you improved it. You did not make it more complex. 

We actually started to streamline it, which really is the purpose of 

a reauthorization. Let us take a look at what we have learned, utilize that information, and let us make this even better moving forward. And that is exactly what you did in 2014 and that is the goal 

here, so appreciate that. 

In terms of streamlining, let me go right to the explosive industries and why did they lose that battle? Why were they not exempt 

like some of these other areas in our economy? And I will go to you, 

Mr. Wulf. 

Mr. WULF. Yes. So I was not at DHS to fight that battle. In fact, 

I was over at ATF at the time, so I am not sure I can comment 

on the battle. 

I was fighting some other battles. 

Chairman JOHNSON To me it makes perfect sense. It seems like 

ATF, from what I have read, has done a really good job at keeping 

explosives out of the hands of line actors. Why would we not just 

carve them out and say, you are not going to serve two masters. 

In this instance we are going to just leave you under ATF. 
24 

Mr. WULF. ATF, absolutely great organization with a long history 

of regulating explosives, explosives commerce, and they have a 

focus on a number of aspects of safety, in particular, security as 

well. I certainly do not want to get into the relative strengths of 

the program. They are different in many respects. And, I am not 

sure that CFATS is not an inappropriate supplement to ATF regulations at the highest-risk facilities. 

Chairman JOHNSON. OK. Tell me what CFATS adds in terms of 

the security of this Nation by doubly regulating the explosives. 

Mr. WULF. Yes. I think we are sympathetic to the duplicative 

regulation situation, and, there are by our count, about 30 or 31 

facilities that are regulated under CFATS only for explosives, that, 

if I am sort of counting things that I would not lose much sleep 

about exiting the program that would be pretty far up there. 

Chairman JOHNSON. So let me just say, barring a really strong 

justification for having both regulatory agencies, I am going to be 

strongly supportive of exempting explosive industries from CFATS. 

So I would need more information to actually convince me that is 

not the right thing to do. 

Mr. WULF. Yes. So I think there are some complexities and nuances among other things. ATF regulations do not cover IED precursor chemicals. So, the security and/or safety regulations that 

apply to explosives under ATF are not there for precursors. So I 

think, while we are certainly open to talking about the exit of explosives from the program, there is not similar coverage at ATF for 

the precursors. 

Chairman JOHNSON. Can you explain what that means? 

Ms. SATKOWIAK. That is a fair statement, actually. So ATF is 

very clear that they only have jurisdiction over explosive materials. 

And so if there is the materials, before they are mixed together and 

become an explosive material, they do not have jurisdiction there. 

Chairman JOHNSON. So are those precursors also in and of themselves dangerous? 

Ms. SATKOWIAK. No. Not in and of themselves. 

Chairman JOHNSON. But combined, I mean, they can be made 

dangerous very quickly. 

Ms. SATKOWIAK. Correct. I must point out here that there are 

materials that are on the retail market that do not fall under DHS 

CFATS such as the binary exploding targets that those are not our 

members’ materials, and they are available via the Internet, retail 

store, that are not explosive materials until they are mixed. Those 

are precursors. 

Chairman JOHNSON. OK. So again, I am very sympathetic to 

what they are making—— 

Mr. WULF. And we are sympathetic. 

Chairman JOHNSON. I will ask you both to argue your case, and 

give me your best shot. Give the Committee staff your best shot on 

that. 

Mr. Wulf, why four tiers? As we are talking about here, we are 

already basically breaking them into two tiers. You have 1 and 2, 

you have 3 and 4. 

Mr. WULF. Yes. 

Chairman JOHNSON. So why not just 1 and 4, or 1 and 2? 
25 

Mr. WULF. Yes. That is the way the program was historically arranged. It is fair to say there is—— 

Chairman JOHNSON. Is it time to fix it, maybe? 

Mr. WULF. We are open—— 

Chairman JOHNSON. That is why I am asking. 

Mr. WULF. We are open to that. I do not think there is too much 

difference in the way Tier 1s are treated versus Tier 2s, or the way 

Tier 3s are treated versus Tier 4s. 

Chairman JOHNSON. So again, in reauthorizing, I am trying to 

simplify this. Can anybody think of a reason why we have four 

tiers? Would it be every bit as safe and would it streamline things 

to just have, you have this tier and you have, number 1, you have 

number 2, and leave it at that? Is there any justification for having 

four, other than we just set it up that way? 

Mr. LEGROS. I think some facilities would have an issue with it, 

and actually doing it, because the way our RBPS guidance document, the way it is set up to where, for Tier 1 must have, Tier 2 

should have, examples like that. 

So as far as a tiering level is one thing, but when it comes to 

the implementation of security measures, if that was not also 

changed to coincide with those tiering levels—— 

Chairman JOHNSON. Again, I am concerned about overcomplicating these things, and, just because you are just below this 

threshold we are not going to make you do this. Maybe it would 

be just a lot easier for industry itself to say, no, I mean, if you are 

above this—everybody above that threshold is doing these things, 

rather than try and slice it and dice it so many different ways that 

it just makes it complex, and it makes it more difficult for industry. 

Again, I am asking industry on this thing. 

Mr. EPPLI. So, Senator, candidly, when we look at new opportunities, currently we are Tier 3 at both of our facilities. When we look 

at new opportunities for customers and there is a potential that it 

may pop us into a Tier 2, we will push back really hard and probably not say yes to that opportunity, because of the tiering requirements and the additional work that we will have to do with DHS. 

We see there is a break, maybe, in 3 and 4 and 1 and 2. 

Chairman JOHNSON. Anybody else want to chime in on that one? 

Ms. MENENDEZ. Chairman Johnson, I would like to express my 

concern over the tiering transparency that we have, and if you are 

going to go to a 1 and 2 tier, the tiering transparency really has 

to be clear as to where you fit in those tierings. 

As an example, we had a facility, the one that I opened up with 

on the former naval ammunition depot, that was previously tiered 

a 2, requiring us to implement all of these security measures. 

When CFATS 2.0 came about we had to re-tier. We dropped to a 

Tier 3, with no explanation. We had no change in the facility, no 

change in the chemicals, no change in the quantity of the chemicals, and we dropped down to a Tier 3. 

Chairman JOHNSON. And there was not a criteria that showed 

you, even though you did not change, we changed our criteria so 

this is why you are a 3? 

Ms. MENENDEZ. Correct. And so, of course, my management 

wants to know if capital investment was necessary. 
26 

Chairman JOHNSON. Mr. Wulf, how can that be? I mean, honestly. How can we have these four tiers, and industry does not even 

know what the definition is? 

Mr. WULF. So we do, as I mentioned, publish, and somewhere in 

my pile of papers I have a tiering fact sheet that outlines the factors that inform tiering. 

Chairman JOHNSON. How many pages is the tiering fact sheet? 

Mr. WULF. It a single page. Single page. Maybe double-sided. 

Chairman JOHNSON. Is that not sufficient? 

Ms. MENENDEZ. It is not prescriptive. 

Chairman JOHNSON. So this is one example where you actually 

want a little bit more information from the Federal Government. 

Mr. WULF. So I would say, as well, and I think I have said it before, that we are very open to talking directly, and we talk almost 

on a daily basis to facilities about their tiers, and again, to running 

prospective facilities through hypothetical tiering. So we appreciate 

that feedback and our goal is to provide maximum transparency. 

Chairman JOHNSON. So here is task number two. The first one 

is we have to figure out what we do with explosive companies. The 

second task, industry and DHS, we need to figure out what we are 

going to do with the tiering system, and, how do we define it and 

whether we really should have four tiers, three tiers, or two tiers. 

What can we do to make that completely transparent, where the 

criteria is incredibly obvious, and it actually matches what the risk 

is and what the reaction would be. This should have been done 

sooner, but let us do it—with this reauthorization, let us get this 

thing nailed. OK? I think that makes perfect sense. 

Mr. WULF. I think that is fair. And, I think important to note, 

though, that we have a new and improved risk-tiering methodology 

that now accounts more fully for all elements of risk. So while 

there has been some change in tiering as we have rerun everyone 

through that we are very eager to ensure that regulated facilities 

understand why tiers might have been changing. 

Chairman JOHNSON. OK. Well, I do not think they do, and I am 

always concerned, too, the mission creep and the greater complexity. Again, what I am trying to do in this reauthorization would 

be to simplify this, without risking safety. And, by the way, I think 

when you simplify things you are going to make it more safe and 

secure anyway. 

Yes, Ms. Gibson. 

Ms. GIBSON. I guess the only concern I would have is that DHS 

did just go through this whole re-tiering process with the new 

methodology, and facilities are settled into that now, and if we 

change the tiers we would have to go through that process yet 

again. 

Chairman JOHNSON. But did you understand what it was when 

you re-tiered them? 

Ms. GIBSON. From the association perspective, I heard a couple 

of comments from our members, but they were able to talk to people at DHS headquarters and talk through it, so it was more of an 

individualized basis where they had questions and they hooked up 

with the right people to give them some answers. 

Chairman JOHNSON. Mr. Erny, you are with the chemistry society. I mean, is that similar as well? 
27 

Mr. ERNY. Yes. 

Chairman JOHNSON. I do not want to force something—— 

Mr. ERNY. I think you have hit on a good thread here. I mean, 

we have an opportunity. There are probably a lot of good ideas like 

this, simplifying the tiering levels, reducing the number of COIs. 

Chairman JOHNSON. But again, if simplifying is to have to go 

through the entire process again, it may not be worth the simplification. 

Mr. ERNY. Yes. 

Chairman JOHNSON. OK? 

Mr. ERNY. Yes. There are going to be some rumbling about going 

through this process again. There is no doubt. I agree with Jennifer. 

Chairman JOHNSON. So again, I want to get a better assessment 

of exactly where we are in terms of definition, the criteria, the 

transparency of it, and if it really does make sense. Again, I do not 

want to upset the apple cart. I really do not. Even if it may be 

flawed, if it is working well—keep—if it ain’t broke at this point, 

do not fix it. OK? 

Ms. SATKOWIAK. Mr. Chairman, if I may add one more thing in 

terms of simplification. When you asked about the precursor materials, in the commercial explosives industry we treat precursor materials just like they are explosives, in terms of distribution. So if 

you are not qualified in the same way that an explosives licensee 

or permittee is to receive explosive materials, our industry members do not transfer those precursor materials to you. 

Chairman JOHNSON. OK. I am just looking at my notes I made 

with each witness here. Again, I need to underscore again, because 

I am asking tougher questions, how much I appreciate the fact that 

DHS really does approach this cooperatively. 

Now, that being said, when I talked about the Stockholm syndrome earlier, one of the things I will ask industry to do is view 

yourself potentially as whistleblowers and provide us—because, 

again, there is concern. I mean, you would be crazy not to be a little worried about something you might say that might rub DHS the 

wrong way, and potentially retaliation. I see that all the time in 

government. I am not accusing—OK. So I do want a completely 

open format for you to convey suggestions, complaints to our staff, 

not in an open hearing, not for publication, but really under the 

protection of whistleblower protection this Committee affords. OK? 

That would be the best way to actually get this done. 

So you may not be free to say everything you want to say on the 

record here today, but you are completely free to, and I encourage 

you to provide that kind of information to the staff. OK? Again, underscored by the fact that I truly do appreciate, and I do not doubt 

for a second that this is one example of government working 

cooperatively with industry—and I think your track record proves 

it—working together with that shared goal of keeping this Nation 

safe. I mean, this is actually a pretty good story from that standpoint. 

I want to ask, Mr. Erny, so, listen, I love awards for things, the 

leg lamp. But other than getting a leg lamp, what would be the 

purpose of a CFATS recognition program? 
28 

Mr. ERNY. So one thing that a lot of us have here in common are 

the stewardship programs, right, and we all have a security component to that, and we are largely doing the same—a lot of the same 

things that you see in the CFATS program—the requirement to do 

vulnerability assessments, establish site security plans, implement 

measures, all that kind of thing. 

We think there is a real opportunity here for CFATS to be able 

to leverage those programs. So some ideas about what kind of recognition could you give companies. I mean, you would have to lay 

out some criteria. We have some very definitive ideas about what 

kinds of criteria should be embedded in CFATS that outlines sort 

of this minimum performance for these programs. And so some of 

the incentives could be things like risk tiering credit for companies 

that are in compliance with these industry stewardship programs. 

Chairman JOHNSON. So it would not be for a leg lamp. It would 

be for—— 

Mr. ERNY. Regulatory recognition. 

Chairman JOHNSON [continuing]. Exemption of certain more onerous regulatory burdens. 

Mr. ERNY. Absolutely. 

Chairman JOHNSON. So you would be self-certifying in that type 

of thing. 

Mr. ERNY. Yes. 

Chairman JOHNSON. OK. I kind of figured that but I wanted you 

to get that on the record. 

Mr. ERNY. Yes. 

Chairman JOHNSON. Again, I come from industry where you had 

International Organization for Standardization (ISO) certification, 

based on that, if you were ISO certified at a certain level, when 

medical device manufacturers came in there were just things you 

did not have to go through—— 

Mr. ERNY. Correct. 

Chairman JOHNSON [continuing]. In terms of your audit again 

because you had done that yourself. 

Mr. ERNY. There are some good example out there in this regard. 

I mean, this is not a unique idea. And I think we just have not broken into the CFATS realm yet. 

Chairman JOHNSON. Mr. Wulf, do you have any problem with 

that? 

Mr. WULF. No. Not—— 

Chairman JOHNSON. Do not you think that is a really good idea? 

Mr. WULF. I do not have a problem with it, conceptually. I think 

we actually have the authority now to do that. I certainly would 

not have a problem with the recognition in a statute. 

Again, and we have certainly talked about this openly across 

CFATS industry stakeholder community, we would want to work, 

and I know that our industry stakeholders are committed to working to ensure that those stewardship programs, if they were to be 

recognized under some sort of CFATS recognition program, would 

align, in effect, with the 18 risk-based performance standards of 

CFATS. 

Chairman JOHNSON. So again, in industry they do that for their 

own benefit. Again, the medical device industry. Things like ship 

to stock type of certification programs. That saves their auditors 
29 

time. But they go and they have surveillance, those types of things, 

but it just is a far more efficient and effective method of doing it. 

So I think that is something, staff, we ought to seriously take a 

look into, if you even have the authority, something in this reauthorization to spur you on to actually using that authority to create 

those types of things. 

Mr. WULF. Thank you. 

Mr. EPPLI. Mr. Chairman, as an operator in the industry, we 

would be fully supportive of this. It would help us tremendously reduce the amount of duplicative work that we have to do, from the 

governmental side as well as from our own internal industry standards, which are really stringent. 

Chairman JOHNSON. No. It is bad for business to have chemicals 

stolen and used for nefarious purpose. 

Mr. EPPLI. That is exactly right. 

Chairman JOHNSON. We are kind of nibbling around a cost benefit. According to my briefing, CFATS costs about $70 million per 

year to the government. Actually, it surprised me. In the briefing 

it said some businesses have spent $100,000 to comply. I would 

think some businesses spend a whole lot more than $100,000 to 

comply. Does industry have any estimates in terms of the cost of 

complying with this so far? 

Mr. EPPLI. So I can give a little update. This year alone, to increase our site security cameras and our electronic security for our 

buildings, again, two facilities, one that is 66,000 square feet and 

one that is 44,000 square feet, we spent between $25,000 and 

$35,000 on each facility, just this year. That is just for capital 

equipment. That is not the training. That is not our own internal 

personnel. 

Chairman JOHNSON. And no offense, but you are a small business. 

Mr. EPPLI. And we are a small business. 

Chairman JOHNSON. Yes. So I would think the larger businesses spent far more than $100,000, which is, again—I think my briefing 

is just off here. I would think the industry has spent tens if not 

hundreds of millions. Ms. Gibson. 

Ms. GIBSON. That is a tough question because a lot of it depends 

on what the facilities already had in place before they became 

CFATS regulated. For example, a lot of the companies that are 

members of NACD practice Responsible Distribution. They already 

implemented security measures, as did others. So I think it is 

across the board, depending on what their status was before 

CFATS. 

Chairman JOHNSON. OK. 

Mr. ERNY. Yes. And from ACCs perspective, we do an annual 

survey, and it is not CFATS specific. But we estimate that companies annually spend anywhere from $50,000, depending on the size 

and complexity, up to about a half a million dollars a year. 

Chairman JOHNSON. So I think, to a certain extent, what your 

answers are confirming to me is industry is already doing an awful 

lot. This may organize the efforts but you are just kind of utilizing 

what resources you have already—what controls you have already 

put in place, and getting them to comply with what CFATS is asking you to do. 
30 

Along those same lines, what other methods of control are there? 

Other agencies—OSHA, EPA, local fire departments, insurance 

models. I mean, are we using CFATS and are we trying to leverage 

all these different control agencies to accomplish the same goal? 

Ms. SATKOWIAK. No. I would argue that we are not, particularly 

in the explosives arena. DHS specifically does not recognize the jurisdiction, not only—in our case—ATF, but DOD, the Pipeline Hazardous Materials Safety Administration (PHMSA), the Department 

of Transportation (DOT), and our members have had to layer on 

top of already—if you were to manufacture one type 1 magazine, 

you are already looking at a cost of $100,000, and then add on 

$700,000 for fencing around a 400-acre site. 

We have one member company that is DOD regulated, plus ATF 

regulated, and they were looking at options that they had to comply with DHS suggestions, which ranged from between $300,000 to 

$3 million, because it is in a very remote area, and to have the type 

of monitoring system which DHS was suggesting, and even to include a cell phone tower to send the signals back. That member 

company is a small, woman-owned business. They have 20 employees and they are spending $150,000 a year, which he figured was 

a bargain to have some security guard come through at the number 

of hours that DHS has prescribed. That is really hard on a 20-employee member company. 

Chairman JOHNSON. Yes. My own experience is government often 

is not particularly sympathetic with the cost of compliance to their 

regulations. 

Does anybody else want to chime in in terms of leveraging, or 

lack of leveraging, with some of these other control agencies? 

Mr. EPPLI. Yes, Mr. Chairman, if I could. First of all, I want to 

reiterate, we have appreciated DHS’s position, so I want to state 

that, David. But we are regulated by DOT, EPA, OSHA, the Drug 

Enforcement Agency (DEA), U.S. Food and Drug Administration 

(FDA), and those are the Federal programs, and there are a number of State programs and then a number of local programs, including the first responders, which we have a great relationship with. 

But we do not see any collaboration amongst those organizations 

to help reduce our burden. 

Chairman JOHNSON. Talk about the local responders. I am assuming you are basically talking about police, but mainly, in this 

case, fire department. 

Mr. EPPLI. Mainly fire. 

Chairman JOHNSON. Again, I have had experience, and Oshkosh 

local fire department really does a great job of just educating everybody, in terms of what they need to do, because if something were 

to happen, they need to know where things are. It was interesting, 

particularly in rural locations, the volunteer fire departments, you 

do not get that type of, I will call it attention, like we got from very 

professional, full-time firefighting force in Oshkosh. But what is 

your experience in Columbus? 

Mr. EPPLI. So in Columbus they do have a volunteer fire department. That is part of the staff. We have a close relationship with 

them. One of the things we realized is we needed to help them 

learn about our business, so we actually collaboratively worked 

with them, and they worked with us in scheduling an onsite train-
31 

ing session about 2 years ago. They brought in all types of other 

agencies and we worked together so they could understand the 

chemicals we have onsite. Because, candidly, one of the things we 

want to do is manage any hazardous issues we have internally. So 

we have our own hazmat team, probably better trained than the 

local fire departments. 

Chairman JOHNSON. So let me ask the two industry association 

reps, in terms of your experience with the cooperation between 

these different control agencies, but even local fire departments. It 

does not sound like it is as professionally prevalent as I experienced in Oshkosh. 

Ms. GIBSON. Yes. It depends on the area, because some are volunteer, as Randy said. One of our Responsible Distribution codes 

is coordinating with local responders, so all of our members are required to do that to the extent they can under our program. 

But yes, really, it depends on the area. Some, areas are very active groups and responders, but it is just a resource issue on their 

end, in some cases. But it is a top priority for our members. 

Chairman JOHNSON. Mr. Erny. 

Mr. ERNY. Yes. I mean, I would largely echo what Jennifer just 

said, with the only exception many of the large chemical complexes 

are self-responding. They have their own fire brigades right onsite. 

They interact with some of the locals, but most of them are selfsufficient in this regard, or like down around the Gulf Coast region, 

where there is a high density of chemical processing, oil and gas, 

they are involved in these co-op initiatives down there. 

So we are probably a little bit different in this regard. We do not 

have a lot of the small operators out in remote America that are 

dealing with volunteer fire companies. 

Chairman JOHNSON. OK. 

Ms. MENENDEZ. May I comment as well? 

Chairman JOHNSON. Sure. 

Ms. MENENDEZ. With regard to working with the local responders, I do agree. It really depends on the site. Every site is—whether 

it is in a large community, some of our employees, because it is 

such a small community, they are members, or their families are 

members of the local responders, so they are aware of what we do 

because of their family members. We reach out to them every year. 

We are required to report, under the Right to Know Act, the chemicals that we have in place, and we invite our members of the local 

fire departments to come out and learn what we do, see what we 

have onsite, understand how to respond properly. But it is difficult 

when you are dealing with a voluntary fire department. 

Chairman JOHNSON. So my last question, and then I will go 

down the table here and ask you for anything that you just have 

to get off your chest. But, the big chemical guys, they are going to 

have all the security, all these programs in place. It is really the 

smaller folks that are going to be more vulnerable, and do not have 

the resources to do that. To me, probably the best defense against 

that is a really good reporting system, because even small guys, 

hopefully, will notice if something is missing, and they will be concerned about inventory shrinkage, or whatever. 

As part of this, do we have a really good reporting system when 

that happens, kind of a no-fault, with no penalties, but literally a 
32 

small operator out in a rural area going ‘‘I am a little concerned 

because we are just missing three pallets of this dangerous chemical.’’ Is that a very streamlined reporting system up to DHS? 

Ms. MENENDEZ. Interesting enough, we account for every movement of our explosive materials. We double-count four in four different instances. So eight times a day we are counting, when we 

acquire the material, when we put it on our trucks, when we send 

it out to the customer sites, when we arrive at the customer site, 

when we use it, when we put it back in the trucks, and then put 

it back into our magazines. It is counted by two people every step 

along the way. 

So we feel that when we do incur a theft or a loss of explosives, 

while ATF requires us to report within 24 hours, we report by the 

end of the day. And we may have to amend if we discover where 

that product was, but we report immediately to ATF, we report immediately to our law enforcement, and we fill out a form and send 

that in to the bomb center. 

Chairman JOHNSON. OK. But again, you are an exception in this 

category, a good exception. What about in just basic chemistry? 

Mr. LOUCHHEIM. Well, I will take a stab first here, sort of with 

a lot of smaller facilities around the country in rural America. Like 

I said earlier, we probably estimate around 6 to 6,500 agricultural 

retail facilities around the country. About 1,500 facilities, or 1,400 

of those, approximately, are CFATS-regulated facilities. 

I would kind of circle back on our ResponsibleAg program, actually. This is, I think—which, along with recognition programs I 

think has a place to be part of a CFATS reauthorization in some 

fashion. For ResponsibleAg, for our industry, it is a third-party-audited system with auditors that go through these facilities. Like I 

said before these facilities typically only have 5 to 10 employees at 

them. So I think in your comments previously you mentioned, there 

is not always the same sophistication in those settings as there 

would be at a major billion-dollar production facility. 

So ResponsibleAg. That is working with these facilities to comply 

with OSHA, DOT, EPA, DHS regulations, to make these facilities 

safer, help them work to be safer and comply with basically a myriad of Federal regulations that are out there. 

Yes, the agencies could sometimes work together a little better 

to streamline things, but we are going to work to make sure our 

industry is as safe as possible through ResponsibleAg, and other 

initiatives. Theft and diversion, knowing your customer is essential. We preach that to our members, and our members already 

know it. 

Chairman JOHNSON. But again, the main point of CFATS is if 

these chemicals are stolen, to be used by maligned actors. Right? 

So again, I am just asking, as part of this, do we have a really 

good, well-communicated and well-executed reporting structure, 

even to the small guys, because, quite honestly, they are the ones 

that are going to be more vulnerable. If I wanted to steal chemicals, I would go to a little guy that does not have the million-dollar 

security system. 

Mr. WULF. Mr. Chairman, I think that is where CFATS makes 

a big difference. So, for high-risk chemical facilities, one of the riskbased performance standards is RBPS–9, focused on response. And 
33 

under that standard, facilities connect with their local responders, 

establish those reporting chains. In many cases we will help them 

to facilitate that contact, and I think that goes a long way. 

Chairman JOHNSON. But in order to have to comply with RBPS– 

9 do they have to be a Tier 1 or 2? 

Mr. WULF. No. That applies across the board. And I would mention, also, that, our detection and monitoring standards are aimed 

at ensuring that facilities have in place measures that enable them 

to detect thefts or diversions in near-real time, so as to promote an 

effective law enforcement response. We are certainly sensitive to 

the costs that those sorts of measures can bring to a facility, but 

we pride ourselves on compliance assistance. So our inspectors are 

not out there just doing compliance inspections. They are available, 

our headquarters staff is available to work with facilities, to talk 

through what, in many cases, can be lower-cost options to meet the 

spirit of the risk-based performance standards. 

Chairman JOHNSON. OK. Why do not we close this thing out, and 

we will start with Ms. Satkowiak. 

Ms. SATKOWIAK. Thank you again, Mr. Chairman, for this opportunity. IME has been asking for years. We have been seeking for 

regulatory relief to remove explosives from the chemicals of interest, Appendix A, and getting, again, relief from that duplicative 

regulation. We have been asking for data to show justification as 

to why explosives materials were included under the program. 

Certainly, again, the government data that is out there shows 

that in the bombings that have happened here in the United 

States, only between 1 and 2 percent of those have involved commercial explosives materials, and the number of thefts are so low, 

they have plummeted since 1985. In the years leading up to 

CFATS, they have plummeted more than 80 percent, and it was industry and ATF regulations that brought that down. So CFATS 

program did not have any demonstrated improvement in that security, despite the millions of dollars that our member companies 

have incurred. 

So I just also want to reinforce, as you are considering the removal of explosives materials through a statutory exemption, which 

is what we are looking for, is that by ATF requirements, which I 

sometimes get the feeling are being discounted by DHS, we have 

accountability for every single trace amount of explosives materials. There is no threshold. It is any amount of explosives materials, they are accounted for. I have heard the term ‘‘track and 

trace.’’ It is not exactly what it is called under ATF. We have accountability for every single movement. So we know if any piece 

has been missing, diverted, or has fallen into the wrong hands. 

Every single of our employees and responsible persons, again, are 

vetted. 

So for these reasons we feel that these duplicative regulations 

can be removed off of the explosives industry, and thank you again. 

Appreciate your time. 

Chairman JOHNSON. Ms. Menendez. 

Ms. MENENDEZ. Thank you. Each business has its own regulatory environment applicable and beneficial to its operations. It is 

with confidence that Austin Powder relies on the Federal explo-
34 

sives laws and regulations and 27 CFR 555, Commerce and Explosives, to remain compliant as we build our business. 

We respect those that appreciate the CFATS oversight in otherwise unregulated or minimally regulated businesses, but my testimony today was meant to provide evidence that in a highly regulated industry like the commercial explosives industry, layering additional DHS regulation on top of existing ATF regulation has 

proven to keep commercial explosives secure, is unnecessary and 

very confusing. 

Chairman JOHNSON. OK. I understand. Mr. Louchheim. 

Mr. LOUCHHEIM. Sure. Thank you, Mr. Chairman, for holding the 

roundtable today. I appreciate your kicking off the process and getting things moving. Like I said earlier, we support a multi-year reauthorization of the CFATS program. Four to 6 years seems to 

make sense. 

In general, the program provides a good framework for security 

measures for a number of our members’ facilities, and we think 

that is helpful and valuable. We think transparency is important 

to look at as we do reauthorization. We think that the Personal 

Surety Program, as has been mentioned, should be limited right 

now to Tiers 1 and 2. And we think stewardship programs have a 

valuable place in the program, to bolster our Nation’s security. 

Chairman JOHNSON. Again, you do not have to restate what you 

have already stated, but this is for new information. Mr. Erny. 

Mr. ERNY. Yes. They stole all my thunder. I think I probably 

would have said exactly the same thing. Appreciate the opportunity. I look forward to working with your staff to find more ideas 

about how we can streamline and make this program better. Thank 

you. 

Chairman JOHNSON. Mr. Eppli. 

Mr. EPPLI. Thank you for the opportunity to be here. We do want 

a safe country. For business, we need certainty, so we would like 

some certainty. I think that ties to how long this should be reauthorized. We believe it should be reauthorized. I would stick with 

at least a minimum of 4 years. DHS has been good to work with. 

I would like to get some recognition of some of the other duplicate work that we do, with either agencies or with the recognition 

of the stewardship programs that we have in place through Responsible Distribution, with NACD, or Responsible Care at ACC. 

Chairman JOHNSON. OK. Ms. Gibson. 

Ms. GIBSON. Yes. Thank you, Mr. Chairman, for holding this 

roundtable today. I would echo what my colleagues here have said 

and just want to reiterate that even though chemical distribution 

is very highly regulated by many agencies and we have a 28-page 

regulatory resource guide and checklist for our members; we do 

still strongly support the CFATS program and DHS’s approaches 

to implementing it. We think that should be a role model for other 

agencies, and we look forward to working with you and the Committee on reauthorization. 

Chairman JOHNSON. Mr. LeGros. 

Mr. LEGROS. Thank you, Chairman, for having me here today. I 

would just like to reiterate the reauthorization of the CFATS program, and again, the reason why I am here is as far as the cyber 

and the training issues that need to be addressed by the agency. 
35 

Chairman JOHNSON. Mr. Currie. 

Mr. CURRIE. Two quick adds to the discussion. One, I think we 

have been looking, at GAO, at this holistically across the country, 

and I think measuring risk reduction or the security benefit is really difficult. It is hard to do that with just outputs. So I think we 

need to continue to push DHS to try to measure across the country 

how we are reducing risk. 

The second piece is we have done a lot of work on overlapping 

Federal regulatory programs in a lot of areas, and the Federal fatigue that can set in when that happens. And I think there is a 

lot that can be done at the agency level, and with the States, to 

coordinate behind the scenes, to actually make a big impact on a 

lot of that. 

Chairman JOHNSON. Mr. Wulf. 

Mr. WULF. Excellent. Thank you. I thank you so much, Mr. 

Chairman. I think this has been a great dialogue. I think we are 

in agreement that CFATS does make America more secure, that 

long-term authorization affords important stability to the program, 

important certainty for our industry stakeholders. I would note 

that I am certainly not averse to, even during a longer term, 

10-, 20-, 30-year authorization period—— 

Chairman JOHNSON. That will never happen. I am just telling 

you, it would never happen. I am sorry. 

Mr. WULF. But I will say changes can be made. 

Chairman JOHNSON. Unfortunately, we have so many things to 

look into. The only reason we are looking at this today is because 

we have to reauthorize it. 

Mr. WULF. Yes. I appreciate that. And I also appreciate the active engagement of our industry stakeholder community. I think, as 

you have seen today, they are not a shy group, not shy about telling us how they think the program can improve. And, this is a 

shared enterprise, and I think it is a program that is well tailored 

to the task at hand. It is narrowly targeted to America’s highestrisk chemical facilities, and really do appreciate your leadership on 

reauthorization. 

Chairman JOHNSON. OK. Again, thank you for your service in 

leading an effort that really is recognized as being one that is cooperative. 

Just to reiterate, we would not be having this roundtable if it 

were not for the reauthorization. Permanency is, from my standpoint, off the table. It is really what is the proper length of time. 

Again, we have an opportunity here, and you have a Chairman 

who comes from industry, who looks with a great deal of skepticism, of government control over anything. But the goal that you 

laid out there, we all want a safe, secure America. And we face 

threats. It is a very unpleasant reality but it is one that we have 

to face. 

So I am encouraged by the cooperation. I am encouraged by the 

fact the last reauthorization honed this program a little bit better. 

I think there is definitely room for improvement. I come from a 

manufacturing background, continuous improvement. So I am really encouraging everybody at this table, I think the roundtable itself 

was very cooperative. But also recognize I have the folks here that 

could potentially be suffering from Stockholm syndrome. 
36 

I want you to be completely honest with whistleblower protections contacting our Committee. For the same thing, the GAO, as 

well as the Department. Let us be as honest and forthright as possible. Let us produce a better reauthorization than what is in law 

today. And again, let us not fix what is not broken. Let us not 

upset the apple cart just because it might be a little bit better. I 

think we have to really take a look at the cost of changing something versus the benefit of making it a little bit better. OK? 

So again, this is a really good opportunity. We have the time. 

This looks like a very cooperative group. I just really encourage you 

to work very closely with staff, be completely honest, and let us end 

up with a reauthorization that just makes this a lot better program. OK? 

With that, the roundtable record will remain open for 15 days, 

until June 27th, at 5 p.m., for the submission of statements and 

questions for the record, although you can always contact our staff. 

OK? 

With that, the roundtable is adjourned. 

[Whereupon, at 12:24 p.m., the Committee was adjourned.] 
(37) 

A P P E N D I X 
38 

U.S. Senate Committee on Homeland Security and Governmental Affairs 

"Examining the Chemical Facility Anti-Terrorism Standards Program" 

June 12, 2018 

Ranking Member Claire McCaskill 

Opening Statement 

Thank you, Mr. Chairman. I appreciate you holding this roundtable. 

The Chemical Facility Anti-Terrorism Standards program, commonly 

referred to as CF ATS, initially began over a decade ago when Congress authorized 

it in late 2006. The program became operational shortly thereafter in 2007. As is 

clear from the name, the CF ATS program is part of our country's counterterrorism 

efforts. It is designed to secure facilities with hazardous chemicals of interest 

(COl) to reduce the possibility of those chemicals being used in a terrorist attack, 

as they were, for example, in the Oklahoma City bombing in 1995. 

CFATS uses a risk-based approach to determine which facilities should be 

covered by the program. Facilities that must comply with CFATS manufacture or 

store at least one of 322 chemicals of interest at or above a certain quantity and 

concentration. Covered facilities must develop and implement site security plans 

that meet the risk-based performance standards established by DHS. 

There are 18 risk-based performance standards that facilities must 

implement, ranging from securing the perimeter of a facility to conducting 

background checks on employees who handle hazardous chemicals. However, it is 

up to each covered facility to determine and implement the appropriate measures 
39 

that fit the unique needs of each facility. DHS does not mandate that fences be 

built to a certain height, for example, or that certain surveillance equipment is 

used. The program is intended to be flexible and tailored to each facility. 

CF A TS had a rocky start its first few years. At one point, the program faced 

an extensive inspection backlog, and, as I understand it, DHS struggled to review 

facilities' site security plans in a timely manner. These issues were compounded 

by the fact that for a period of time, CF A TS was authorized on a series of shortterm spending measures. That is not an ideal way to structure and manage a 

regulatory program. The concern that the program would lapse or that Congress 

would dramatically change it prevented DHS from making long-term adjustments 

to develop a sustainable regulatory regime. And, businesses couldn't operate 

effectively and make thoughtful security investments in such an uncertain 

environment. 

I'm told by DHS and industry alike that the program has come a long way 

since it was last reauthorized in 2014. We secured a four-year authorization, which 

turned out to be a game changer. DHS had the space it needed to make 

adjustments to the program, and improve the experience for covered facilities. By 

all accounts, CF ATS is now far more streamlined, user friendly and less 

cumbersome. Moreover, companies finally received the regulatory certainty and 

stability they needed to make lasting investments in the security of their facilities. 

2 
40 

The current authorization for the CF ATS program expires in January 2019. 

I'm hopeful that this roundtable will help us determine which aspects of CF A TS 

are working well and perhaps identifY some areas that need to be tweaked to 

enhance security, address gaps in the regulation, and further improve the program's 

efficiency. Given the tight legislative schedule remaining, this Committee has our 

work cut out for us to make sure CF ATS does not lapse, but I'm confident that we 

can get it done in a way that ensures we are keeping hazardous chemicals away 

from terrorists while allowing businesses and communities to thrive. Ultimately, 

this program is about keeping Americans safe from terrorism. 

Thank you Mr. Chairman, and I look forward to hearing from our roundtable 

participants. 

3 
41 

Written Testimony 

of 

David Wulf 

Acting Deputy Assistant Secretary for Infrastructure Protection 

National Protection and Programs Directorate 

U.S. Department of Homeland Security 

Before the 

United States Senate Committee on 

Homeland Security and Governmental Affairs 

Regarding 

The Chemical Facility Anti-Terrorism Standards Program 

June 12,2018 
42 

Introduction 

Chairman Johnson, Ranking Member McCaskill, Members of the Committee, 

I appreciate the opportunity to appear before you today to discuss the development and 

maturation of the Department of Homeland Security's (DHS) regulation of high-risk chemical 

facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) Program. On behalf of 

NPPD, I also want to take this opportunity to thank this committee for including legislation 

transforming NPPD into the Cybersecurity and Infrastructure Security Agency in the recent 

DHS authorization bill. The new Agency would continue NPPD's mission of leading the 

national effort to improve critical infrastructure security, coordinating the protection of the 

Federal Government's networks and physical infrastructure, and helping entities in the public 

and private sectors manage potential cyber risk. As the threats facing our National security grow 

and evolve every day, we look forward to continuing to work with this committee to pass that 

critical legislation. 

CF A TS Program Overview 

The CFATS Program is a vital part of our nation's counterterrorism etTorts as we work 

with our industry stakeholders to keep dangerous chemicals out of the hands of those who wish 

to do us harm. Since the CF ATS Program was created, we have engaged with industry to 

identifY and regulate high-risk chemical facilities and to ensure they have security measures in 

place to reduce the risks associated with the possession of chemicals of interest. 

The cornerstone of the CFATS Program is the development, submission, and 

illlpiementation of Site Security Plans (SSPs), or Alternative Security Programs in lieu of 

SSPs that document the security measures that high-risk chemical facilities utilize to satisfy 

the applicable Risk-Based Performance Standards (RBPS) under CF ATS. Due to the diversity 

2 
43 

of facilities who hold chemicals of interest, it is important to note that these plans arc not 

"one-size-fits-all," but are in-depth, highly customized, and account for each facility's unique 

circumstances. 

In order to determine whether a facility is covered under CF A TS, the facility submits a 

Top-Screen to the Department's Infrastructure Security Compliance Division. Since we 

began collecting this information in 2007, more than 40,000 facilities have reported chemical 

holdings. Based on the information received in the Top-Screens, DHS determines which 

facilities are at high-risk of terrorist attack or exploitation and assigns each of these to a tier. 

Facilities determined to be high-risk must submit a Security Vulnerability Assessment 

and SSP or Alternative Security Programs to Dl-IS for approval. The plan must include 

security measures that meet the RBPS established by Dl-IS. The Department performs an 

authorization inspection at the facility prior to granting a security plan approval to ensure that 

the measures contained in the security plan are appropriate given the facility's specific 

security issues and unique characteristics. Once a facility's plan is approved, DHS conducts 

regular compliance inspections to verify that a facility is implementing the agreed-upon 

security measures. 

CFATS: Where We Were 

l recognize that for many on the Committee, today's roundtable represents the first 

significant engagement with the CFA TS Program. For this reason, I think it is important to first 

look back at the state of the program prior to 2014. 

The CFATS Program was born out of the recognition that, though we had worked hard to 

strengthen our homeland security in the aftermath of the September II, 200 I attacks, the nation 

continued to face very real threats. In particular, it was noted by Congress that there existed 

3 
44 

vulnerabilities at facilities holding chemicals that, in the wrong hands, had the potential to injure 

or kill large numbers of individuals and do significant physical and economic damage. It was 

this recognition that led Congress to establish the CFATS Program under Section 550 of the 

Homeland Security Appropriations Act for Fiscal Year (FY) 2007. 

The initial CF A TS statute required the issuance of interim final regulations within 6 

months of enactment, and, on April 9, 2007, the Department published the CF A TS regulations in 

the Federal Register. Yet, as with any complex regulatory program launched in a short amount 

of time, the early days of the program were not without their challenges, many of which have 

been documented in other forums. 

When we last appeared before the Committee, the CF A TS Program was making progress, 

however significant challenges remained. When we last met, lacking separate authorizing 

legislation, the program continued to be reliant upon the federal appropriations process for 

authority to regulate. This authorization structure not only affected employee morale, it failed to 

instill confidence in industry stakeholders making them hesitant to make critical investments in 

CF A TS-related security measures and enhance their security posture. 

Further, this reliance on the annual appropriations process put our nation at risk, as 

evidenced by the funding lapse in October 2013. During this lapse, not only did the 

programmatic activities of CF A TS cease, its authorization also expired. This gap caused many 

facilities to question whether the regulations were still in effect and the Department to question 

whether it had the authority to take enforcement action had there been an exigent need or 

imminent threat. 

During my previous testimony, I had informed the Committee that the Department had 

undertaken a thorough review of our risk assessment process. The CF ATS risk-assessment 

4 
45 

methodology is one of the foundational elements of the program, as DHS uses it to determine 

which of the tens of thousands of facilities in possession of threshold quantities of chemicals of 

interest are at high-risk of terrorist attack or exploitation and are, therefore, required to develop 

CF ATS security plans. 

The review included documenting all processes and procedures relating to the risk 

assessment methodology, conducting an internal review of the risk assessment process. and 

initiating an external peer review of the risk assessment methodology. All three of these had 

been completed, and after a review of the Peer Review Final Report, the Department began to 

consider changes to the tiering methodology. 

Finally, we were continuing to work our way through a backlog of SSP reviews. At the 

time of my 2014 testimony, CFATS covered over 4,200 facilities of which less than half had an 

authorized SSP and only one-fifth had an approved plan. Though the program had begun to 

improve the pace of authorizations, inspections, and approvals, the Government Accountability 

Office (GAO) had projected that it would take the Department seven to nine years to work 

through the backlog. 

CFATS: Where We Are 

As I noted at the outset of my testimony. it has been four years since our last CFATSrelated appearance before the Committee, and I am happy to report today, we have made 

significant accomplishments and the trajectory of our progress is clearly upward. Through the 

collective efforts of our dedicated federal workforce, stakeholders, and the leadership of 

lawmakers, the CF A TS Program has matured significantly in that time. 

5 
46 

Clearing the SSP Backlog 

In July 2016, after more than 6,000 inspections and Compliance Assistance Visits, and 

review of nearly 3,000 SSPs, I signed off on the approval of a milestone SSP of a chemical 

manufacturing facility. This approval, after three years of concerted effort to move the CF A TS 

program forward, effectively eliminated the backlog of SSP reviews 6 years ahead of GAO's 

projections. I am sure Chairman Johnson will appreciate knowing that this milestone facility 

was located in Wisconsin. 

With this achievement, we have transitioncd from "start up'' to a more mature 

"sustainment" posture, and are now able to more fully focus on conducting compliance 

inspections and creating a stronger culture of security. Whereas previously our inspections were 

overwhelmingly of the pre-approval Authorization Inspection variety, now the majority of the 

inspections we are conducting are post-security plan-approval Compliance Inspections (CI). To 

illustrate how far we have come in this regard, in FY2013, the Depm1ment had completed only a 

singular compliance inspection. In FY2017, the Depm1ment conducted 1,569 such inspections. 

Enhanced Risk Tiering Methodology and Chemical Security Assessment Tool (CSAT) 

Version 2.0 

In the fall of2016, the Department launched an enhanced risk-assessment and tiering 

methodology that appropriately accounts for all elements of risk and addresses statutory 

reqmrements laid out in the Protecting and Securing Chemical Facilities from Terrorist Attacks 

Act ol2014. The result of 3 years of work by DHS risk experts, the methodology has benefited 

from and has been informed by analysis and input from a panel of external experts fi·om industry, 

government, and academia. Sandia National Laboratories has also performed an independent 

verification and validation. 

6 
47 

The enhanced tiering methodology uses a scientifically supported approach to calculate 

each facility's risk as a function of information related to terrorist threat, the facility's inherent 

vulnerabilities, and the potential consequences of a terrorist attack. Enhancements include the 

addition of physics-based models for chemicals that could be taken offsite and used in an attack, 

updates to the threat model informed by intelligence, and improvements to the population 

modeling for release facilities. We believe that these changes make this methodology a more 

accurate reflection of a facility's risk. 

All facilities with holdings of chemicals of interest are required to resubmit information 

and are being assessed using the new methodology. To date, nearly all 28,000 facilities that had 

previously reported holdings of chemicals of interest at the screening threshold quantity have 

submitted a revised Top-Screen. All Top-Screens receive an eyes-on quality assurance review to 

ensure the data reported makes sense for the type of chemical and facility reporting. In cases 

where there are concems with the data reported, ISCD contacts the facility for clarifications. 

When necessary, the facility is asked to make corrections to appropriately reflect the data. 

DHS began issuing tiering determination letters using the enhanced methodology on April 4, 

2017. We anticipate that we will have tiered the entire current population of chemical facilities of 

interest using the new methodology by October 2018. The Department expected shifts in tiers 

and originally analyzed over 8,000 Top-Screens to identify the projected movements. Now that 

DHS has received almost all revised Top-Screens it completed analysis on those facilities and 

saw a shift in the populations as follows: 

All facilities that were high-risk (Tier 1-4) prior to CSA T 2.0 have been notified 

of their revised tier. 

7 
48 

Approximately 36% of the previous high-risk population remained at the same 

Tier 

Approximately 48% of the previous high-risk population moved from one tier to 

another tier 

Approximately 15% of the previous high-risk population has been determined not 

to be high-risk 

Approximately 4% of the previous not high-risk population has been determined 

to be high-risk 

In concert with the retiering effort, the Department also deployed CSAT 2.0, a 

streamlined. user-friendly update to its online portal and Top-Screen, Security Vulnerability 

Assessment (SV A), and an SSP suite of online reporting tools. The CSAT 2.0 Top-Screen 

collects the data necessary to process facilities through the enhanced tiering engine and improves 

the integration between the CSA T SV A application and the CSA T SSP application, which has 

resulted in a dramatically simplified experience tor facilities when submitting Top-Screens, 

SVAs. and SSPs. 

As an example, under the previous format, completing a Top-Screen was estimated to 

take just over 11 hours, the current format has reduced that to just 6 hours. In addition, building 

upon lessons learned over the life of the program, the Department reduced the number of 

questions on the Security Vulnerability Analysis from approximately 600 to 10 while the new 

Site Security Plan has less than one-third of the questions than the previous iteration. 

Personnel Surety Program 

Vetting those who have access to chemicals of interest and other sensitive parts of highrisk chemical facilities is a key aspect of facility security. Under RBPS 12, Personnel Surety, 

8 
49 

facilities must implement (I) measures to verify and validate identity, (2) check criminal history, 

(3) validate legal authorization to work in the United States, and (4) identify people with terrorist 

ties. While all tier 1 through 4 facilities have heen implementing the first three elements of 

RPBS 12, the Department began working with Tier 1 and Tier 2 facilities to implement the 

fourth element in December 2015 after the Office of Management and Budget approved the 

Department's Information Collection Request for the CFATS Personnel Surety Program 

(RPBS 12(iv)). 

This approval closed a critical gap in security plans by allowing facilities in these two 

tiers to submit names to DHS for vetting individuals' potential terrorist tics. Going forward, the 

Department is planning on expanding its implementation to tiers 3 and 4. The Department is in 

the process of requesting approval, through the Paperwork Reduction Act (PRA) process, to 

collect information about individuals with! or seeking access to high-risk chemical facilities for 

all four Tiers. In anticipation of this request, the Department published a 60-day notice in 

December of2017 and will be publishing a 30-day notice soon. 

The Road Ahead and Reauthorization 

Four years ago, I came before the Committee, outlined the improvements we had made so 

far, and assured the Members that we were moving forward strategically to address the 

challenges that remained. Today, lam proud to say that we have made good on that assurance. 

In 4 years we have: 

• Dramatically improved the pace of inspections, reviews, and approvals resulting in the 

elimination of a backlog once projected to take 7 to 9 years to clear, nearly 6 years ahead 

of schedule. 

9 
50 

• Developed and deployed an enhanced risk-tiering methodology that is 

scientifically based; vetted by external experts from across industry, 

government, and academia; and a more accurate reflection of a facility's risk. 

• Streamlined the SSP development process reducing the burden on facility 

operators without sacrificing security through the launch of CSAT 2.0. 

• Closed a critical gap in the security plans of our nation's highest risk facilities 

through the implementation of the Personnel Surety Program (screening for 

terrorist ties). 

In addition, the Department continues to make outreach to its various stakeholder 

communities a top priority particularly to first responders and emergency managers. By 

end of fiscal year 2017, DHS conducted nationwide outreach with more than 1000 State 

and local offices and 1400 Local/Tribal Emergency Planning Committees in 50 U.S. 

states, District of Columbia, and 9 U.S. territories. Specifically, the Department reported 

contacts with nearly all State Offices of the Homeland Security Advisor, First 

Responder/Manager, Fire Marshal, Public Safety, and plans to continue these meetings 

annually. Further, the Department regularly participates and presents at SERC/TERC 

meetings, Area Maritime Security Meetings, and HAZMA T conferences. 

The Department prioritizes engagement with LEPCs/TEPCs based on the 

existence of CFATS covered facilities in their counties as well as their level of activity. 

Further, DHS works to builds relationships with less robust LEPCs/TEPCs to create 

future opportunities for providing presentations/briefings on CFATS program 

requirements and resources. 

10 
51 

Also, outreach to tirst responders is incorporated into the development of site 

security plans through Risk Based Performance Standard 9 (RBPS 9) - Response. This 

standard requires covered facilities to have a documented, comprehensive crisis 

management plan that details how the facility will respond to security incidents and 

requires that the facility run exercises and drills to improve its ability to implement these 

provisions. DHS verifies this outreach during on-site compliance inspections. In many 

instances, the Department has faci !ita ted contact between the tirst responders and the 

facilities. 

Conclusion 

Indeed, we have accomplished much since 2014. A lot ofit is due, as I noted earlier. to 

the collective efforts of many individuals and institutions, and especially the leadership of 

Congress. It would be accurate to say that much of what we have been able to do in 4 years is 

attributable to Congress taking action and passing the Protecting and Securing Chemical 

Facilities from Terrorist Attacks Act of 2014. 

Until the passage ofthat legislation, the program had been authorized on a yearly basis 

through the appropriations process. Enacting a multi-year CF A TS authorization: 

Provided industry stakeholders with the certainty they needed to plan for and 

invest in CFATS-related security measures to harden their critical sites against 

possible terrorist attack or exploitation; 

• Allowed the Department to make strategic, long-term planning decisions 

regarding staffing, program development, and process efficiency; and 

• Sent a clear message to potentially regulated facilities storing threshold 

quantities of dangerous chemicals that the CF ATS Program is here to stay. 

II 
52 

With long-term authorization, chemical facilities of interest have become further 

incentivized to engage with the Department with regard to facility security and are deterred from 

ignoring CFATS obligations in hopes that the program will be allowed to expire. 

As we arc all too aware, we live in a dynamic threat environment and the threat of a 

terrorist attack using chemicals is as relevant today as it was when CFATS was first created. We 

continue to see terrorists seeking out and using chemicals of the sort regulated under CFATS. 

We need look no further than events which have taken place in Belgium, Syria, France, and the 

United Kingdom and the continuing threat stream to know that this is not a time to stop 

addressing the security threat posed by chemicals. 

Chemical security is very much a pressing need and reauthorization for the CF A TS 

Program is a major step toward meeting it. I look forward to working with each of you to chart a 

path forward for this critical national security program that includes reauthorization. 

I thank the Members of this Subcommittee and look forward to your questions. 

12 
53 

Chemical Facilities Anti-Terrorism Standards (CFATS) Roundtable Discussion 

June 12, 2018 

Key GAO Reports, Findings, and Recommendations (2013-2017) 

Chris P. Currie 

Director, U.S. Government Accountability Office 

CurrieC@gao.gov; 404-679-1875 

Summarv: Since 2013, GAO has issued several reports reviewing various aspects of the 

Department of Homeland Security's (DHS's) Chemical Facilities Anti-Terrorism Standards 

(CFA TS) program. These reports have identified challenges DHS has faced in implementing 

and managing the CFA TS program in various areas, including: 

1) the process for assessing chemical facility risk and placing these facilities into riskbased tiers; 

2) ensuring chemical facility compliance with CFATS regulations and measuring program 

performance; 

3) efforts to outreach and share information with chemical facilities; and 

4) establishing a process to obtain and investigate whistleblower complaints. 

GAO has made 10 recommendations to strengthen the program across these areas. DHS 

agreed with all of these recommendations and as of June 2018, has fully implemented 6 of them 

and is taking action to address the remaining 4. Further, GAO is currently assessing additional 

aspects of the program for this Committee and plans to report later this summer. 

1. Chemical facility risk assessment approach and tiering methodology 

In 2013, GAO found that between 2007 and 2013, DHS had placed about 3,500 high-risk 

chemical facilities to risk-based tiers under its CFATS program, but it had not fully assessed 

its approach for doing so. The approach DHS used to assess risk and make decisions to 

place facilities in final tiers did not consider all of the elements of consequence, threat, and 

vulnerability associated with a terrorist attack involving certain chemicals. GAO also found in 

2015 that DHS used self-reported and unverified data to determine the risk categorization 

for facilities that held toxic chemicals that could threaten surrounding communities if 

released. 

• Recommendation: GAO recommended that DHS develop a plan, with timeframes and 

milestones, that incorporates the results of the various efforts to fully address each of the 

components of risk and take associated actions where appropriate to enhance its risk 

assessment approach. 1 

Status: Not Fully Implemented: From 2013 through 2016, DHS conducted a multi-year 

effort to review and update the CFATS program's risk assessment approach, which 

incorporates improvements based on recommendations from an external peer review 

and GAO. GAO is currently evaluating these efforts as part of our ongoing work and will 

report later this Summer. 

1

GAO, Critical Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and Gather Feedback on 

Facility Outreach Can Be Strengthened, GA0-13-353 (Washington, D.C .. Apr 5, 2013). 
54 

• Recommendation: GAO recommended that DHS conduct an independent peer review, 

after it completes enhancements to its risk assessment approach, that fully validates and 

verifies its risk assessment approach consistent with prior recommendations of the 

National Research Council of the National Academies. 2 

Status: Not Fully Implemented: DHS worked with Sandia National Laboratories to 

conduct an independent verification and validation of the CFATS program's revised risk 

assessment methodology, which was completed in January 2017. GAO is currently 

evaluating these efforts as part of our ongoing work and will report later this Summer. 

• Recommendation: To ensure the accuracy of the data submitted by chemical facilities, 

GAO recommended that DHS provide milestone dates and a timeline for implementation 

of the new process for placing chemical facilities into risk-based tiers and ensure that 

changes to this process mitigate errors in data submitted by facilities. 3 

Status: Implemented: In January 2016, DHS developed milestone dates for 

implementing an updated process and stated that this new process will no longer rely on 

facilities to provide certain unverified data. Rather, DHS will begin calculating this data 

itself to enable better assessment of risk. 

• Recommendation: To ensure the accuracy of the data submitted by chemical facilities, 

GAO recommended that DHS identify potentially miscategorized facilities with the 

potential to cause the greatest harm and verify the data these facilities report is 

accurate.• 

Status: Implemented: As of May 2017, DHS completed an assessment of potentially 

miscategorized faciliites. Also, DHS's updated process, launched in October 2016, no 

longer relies on facilities to provide certain unverified data; rather, DHS is to calculate 

this data itself to enable better assessment of risk. 

2. Facility Compliance and Performance Measurement 

In 2015, GAO found that DHS has made substantial progress approving chemical facility 

security plans but did not have documented processes and procedures for ensuring facilities 

that are noncompliant with their approved security plans are taking actions to implement 

planned measures. Further, DHS's performance measure for the CFATS program did not 

solely capture security measures that were implemented by facilities and verified by ISCD; 

rather, the measure reflected both existing security measures and planned security 

measures that facilities had not yet implemented. 

• Recommendation: To better manage compliance among high-risk chemical facilities 

and demonstrate program results, GAO recommended that DHS develop documented 

processes and procedures to track noncompliant facilities and ensure they implement 

planned measures as outlined in their approved security plans. 5 

Status: Not Fully Implemented: According to DHS officials, the agency is nearing 

finalization of documentation of the processes and procedures being used to track 

noncompliant facilities and ensure they implement planned measures as outlined in their 

'GA0-13-353. 

3

GAO, Critical infrastructure Protection: DHS Action Needed to Verify Some Chemical Facility Information and 

Manage Compliance Process, GA0-15-614 (Washington, D.C., July 22, 2015). 

4

GA0-15-614. 

5

GA0-15-614. 

2 
55 

approved site security plans. GAO is currently evaluating these efforts as part of our 

ongoing work and will report later this Summer. 

• Recommendation: To better manage compliance among high-risk chemical facilities 

and demonstrate program results, GAO recommended that DHS improve the 

measurement and reporting of the CFATS program performance by developing a 

performance measure that includes only planned measures that have been implemented 

and verified. 6 

Status: Implemented: In December 2015, DHS implemented a new process whereby 

DHS inspectors verify that facilities implement planned measures during compliance 

inspections or other means before inclusion in the performance measure calculation. 

3. Program outreach and information-sharing 

In 2013, GAO found that DHS solicited informal feedback from chemical facility owners and 

operators on its efforts to communicate and work with them, but it did not have an approach 

for obtaining systematic feedback on its outreach activities. Additionally, GAO reported in 

2014 that, based on a review of state data and records, there were more chemical facilities 

with ammonium nitrate holdings than those that reported to DHS under the CFATS program 

and that, therefore, some facilities that were required to report may have failed to do so. 

• Recommendation: To enhance DHS's efforts to communicate and work with facilities, 

GAO recommended that the agency explore opportunities and take action to 

systematically solicit and document feedback on facility outreach. 7 

Status: Implemented: DHS developed a questionnaire to solicit feedback on outreach 

with facilities and industry stakeholders in the CFATS community. DHS started using the 

questionnaire in October 2016 during various CFATS outreach events to obtain 

stakeholder input and data. 

• Recommendation: To improve federal oversight of facilities with ammonium nitrate, 

GAO recommended that the Department of Labor, the Environmental Protection Agency 

(EPA), and DHS develop and implement methods for improving data sharing among 

federal agencies and with states. 8 

Status: Implemented: DHS and EPA developed various mechanisms to better share 

data related to chemical facilitates, which has enabled DHS to better identify facilities 

that are potentially non-compliant with CFATS. 

4. Whistleblower reporting process 

In 2015, GAO found that DHS implemented an interim process to respond to whistleblower 

reports involving CFATS and has followed its process since then; however, DHS did not 

have a documented process and procedures to investigate whistleblower retaliation reports. 

GAO also found that DHS's telephone tip line and whistleblower website provide limited 

guidance about the type of information that would be most useful to DHS for addressing the 

reports. 

6

GA0-15-614. 

7

GA0-13-353. 

8

GAO, Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate, GA0-14-

274 (Washington, D.C.: May 19, 2014). 

3 
56 

• Recommendation: To help ensure that whistleblower retaliation reports are addressed 

efficiently and effectively, GAO recommended that DHS develop a documented process 

and procedures to address and investigate whistleblower retaliation reports that could 

include recommended practices, such as those established by the Department of 

Labor's Occupational Safety and Health Administration. 9 

Status: Not Fully Implemented: DHS officials reported that a standard operating 

procedure for addressing and investigating whistleblower retaliation complaints was 

developed and is expected to be approved in Spring 2018 and subsequently provided to 

GAO for review. 

• Recommendation: To assist DHS in collecting the information needed to investigate 

whistleblower reports and make informed decisions, GAO recommended that DHS 

provide additional guidance on the ISCD whistleblower website and telephone tip line 

greeting to clearly communicate the information needed in the reports. 10 

Status: Implemented: As of December 2016, DHS had provided additional guidance on 

its whistleblower website and telephone tip line greeting to clarify the types of 

information that would be helpful for whistleblowers to provide to DHS. 

'GAO, Critical Infrastructure Protection: Improvements Needed for DHS's Chemical Facility Whist/eblower Report 

Process, GA0-16-572 (Washington, D.C .. Jul12, 2016). 

10GA0-16-572. 

4 
57 

Written Statement On CFATS 

Jesse (Jay) LeGros Jr. 

Chemical Security Inspector 

Good Morning Chairman Johnson, Ranking Member McCaskill, members of the Committee and 

fellow roundtable attendees. My name is Jesse LeGros Jr. and I am the Acting Vice President of 

Infrastructure Protection Personnel of American Federation of Governmental Employees 

(AFGE) Local 9I8. I am also a Chemical Security lnspector(CSI) with the Infrastructure 

Security Compliance Division(ISCD) within the Department of Homeland Security. I also 

worked in a law enforcement capacity with the Federal Protective Service. We help protect our 

nations chemical facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) 

program. On behalf of my fellow union members and Chemical Inspectors, I would like to thank 

you for this opportunity to speak to you today. 

CF A TS Inspector Training: 

I was in the first formal inspector academy class. This class was one-month long. Some of the 

later classes were two months and my understanding there was at least one that was three 

months. I am not sure as to when the last academy class was. Mostly all training today is 

acquired on the job. Our profession and mission is unique. I'm not sure that an academy class for 

Chemical Security Inspectors (CSI's) is necessarily warranted but they had been formally 

provided in the past. Since our controlling regulation is primarily focused on the physical 

security of the Chemicals oflnterest (COl), formal and specialized training on physical security 

measures should be required. The Federal Protective Service has an excellent physical security 

class at the Federal Law Enforcement Training Center (FLETC) and that would be a perfect 

place to start. We have hired a number of individuals with little to no physical security training 

or experience. These particular skills cannot be learned strictly by doing it under on-the-job 

(OTJ) training. It can be a challenge to try to perform complex assignments concerning physical 

security measures and practices without having received consistent, structured and formal 

academy-based training. Trying to learn or teach these skills during an inspection is imprudent 

and can distract from the quality of the inspection. There is a lot of pressure on CS!s to perform 

these scheduled inspections and to timely file reports within the program deadlines. As is often 

the case in governmental inspectional operations, those reports filing deadlines tend to become 

the dominant influence and control over the process itself. In some cases that pressure can result 

in reduced quality or comprehensiveness resulting in the reports being of less than maximum or 

optimal value. If all CSls were fully and consistently academy trained, then there would be less 

distraction from mission and product that currently results from inspectors trying to learn on the 

job. 

Cybersecurity Training: 

The agency does not provide any cyber security training as they claim. I have attended two 

"Cyber Training" classes. One was at Idaho National Laboratory, in Idaho. This class was about 

Hackers and how they can access cyber systems. The other was in Washington D.C. This is 

considered the Cyber Training class for all inspectors to enable them to do the cyber section or 

our reports. The class content was primarily related to providing instructions as to how to fill out 
58 

the cyber section of an Authorization lnspection(AI) Report. This class did not get into the 

various technical aspects of the Cyber world or Cyber Security. At the time I took the class, we 

weren't even doing AI's, we had moved on to Compliance Inspections (CI's). We have had 

numerous webinars involving cyber, but these were all geared on filling out an inspection report 

and not on analysis, understanding, or protecting cyber systems. The agency claims that it has 

qualified inspectors in our ranks that have cyber training and experience. However. there is no 

list of these qualified and trained specialist accessible to a lead inspector when it comes to 

scheduling an Inspection. The lack of such a roster make it difficult for an inspector to 

schedule the participation of another inspector- trained in cyber security related to to 

participate in the field assessment process. The absence of such a resource makes it difficult to 

accomplish this element of the program. Some inspectors pursue knowledge or training in this 

subject area on their own. If CSis are to continue performing this increasingly critical function, 

then formal academy and in-service training should be put in place. I talked to one inspector who 

has a lot more cyber training than most. He advised that all of the classes that he has taken 

besides the two stated were taken on his own initiative and were not assigned by the agency. 

The agency has three cyber integration levels that can be assigned to a facility, Minimal, Partial 

and Significant. A Minimal can be done by any inspector. A Partial is done by an inspector with 

cyber training. A Significant would be done by a cyber SME from HQ.ln January 2013 we were 

directed that for a minimal we only had to answer four questions: 

1. Does the facility have cyber security policies? 

2. Does the facility provide cyber training to users? 

3. Is there a vulnerability to the facilities ability to thwart a diversion in a holistic review of 

all security measures? 

4. Has the facility taken credit for all security measures to mitigate cyber vulnerabilities? 

In March of this year, I was advised by my Chief of Regulatory Compliance (CRC) that we 

would be filling out all cyber questions within the reports no matter what the designation was. 

The union then reached out to the Field Operations Branch Chief(FOBC) to verify if this was 

correct. We were told that was not true but sent us a new Authorization Inspection Report 

Amplification Guidance document. Under the cyber section it states that if a team lead feels that 

a Significant facility is outside their ability they can request the support of a cyber SME, but 

based on need, the Compliance Branch Chief will make the recommendation as to whether a 

CSI, CSJ with additional training, or a cyber SME will be used to perform the RBPS 8 section of 

the inspection. This results in too much subjectivity and reduced consistency in the application of 

these discretions. The union has been having numerous discussions with the FOBC about our 

concerns that this does not say that we do not have to answer all the questions and that they are 

changing significant from being done by an HQ cyber SME to an inspector. They insist that it 

does not, but the wording clearly says it. In one conversation the FOBC stated that he felt our 

complaint was more about the process than the guidance document. That the guidance document 

only reflects the process and that we should approve the document and then argue about the 

process. I advised him that if we approve the guidance document then we would be approving 

the process and that was not acceptable. 

CSls understand the importance ofCyber and Cyber Security. In order for us to do our 

job with due diligence, JSCD needs to provide the proper training on cyber and cyber security. 
59 

The employees that are trained to deal with cyber and cyber security at facilities all have 

certifications and degrees in those fields. We must make certifications in cyber and cyber 

security a minimum requirement for proper training to efficiently enforce the regulation. 

Regarding the CF A TS regulation, it is a valuable and important regulation and needs to be 

reauthorized. We have made great strides in helping protect and securing Chemicals oflnterest 

and facilities under this regulation. Especially the ones that have no security background or 

understanding. This regulation has brought a more security minded thinking approach to 

numerous facilities. We have made some valuable contacts because of the regulation. A good 

example is that a non CF A TS site was being flooded and was on the verge of a catastrophic 

situation. The facility was unable to make contact with the local first responders. The facility's 

corporate security officer was able to contact a CI, who was able to relay the information to the 

applicable emergency management and first responders. The first responders were able to 

contact the affected facility and provide the needed assistance and evacuations. This lowered the 

risk and could have possibly saved lives. There should be greater deployment and use ofCSis as 

members of emergency and contingency planning groups for response to undesirable events 

affecting sites of interest. But there are some issues with the regulation: 

1. It regularly needs congressional reauthorization. It needs to a free-standing regulation 

with no further reauthorizations needed. 

2. Background checks. The regulation says a facility must perform appropriate background 

checks, but it doesn't say what they consist of. This is one of the areas that must be 

clarified. The keeping and maintaining of these background checks needs to be part of 

the record keeping requirements. Within the current regulation the facility has no legal 

requirement to keep them for us to verify. Some facilities even dispose of the background 

check results leaving no proof that one was done. 

CF A TS Program: 

CF A TS program duties are routinely expanded and pushed down for the inspectors to do. 

CS!s started out doing inspections. Then they were assigned to do Post Inspection Reports (these 

were previously done by an analyst at HQ). Now we are doing Cis. Several months ago, they 

were tasked to do more outreach, a lot of which was being done beiore doing 

inspections. This outreach does not include Compliance Assistance Visits (CA V's) and Potential 

Non-Compliant Facility (PNCF) tasking/visits. CSis are only given 12 days to complete AI and 

CI reports and 5 days to do a CA V or PNCF. This would be manageable if only one 

inspection were in progress at a time and ifthere were no other administrative distraction. These 

goals become problematic to accomplish when multiple inspections are conducted 

simultaneously. Outreach such as attendance at a Local Emergency Planning Committee (LEPC) 

or some other similar activity is hard to accomplish with the limited available time. Reports must 

be timely filed. Field time is further limited by the need to conduct exhaustive pre-inspection 

paperwork review of varying type and sensitivity (Top Screen, SV A/SSP, AIR, CIR (depending 

on the inspection)) for an upcoming inspection. If an inspection is scheduled for 

a Tuesday and Thursday, the CSI would not be able to start the report for the Tuesday inspection 

until Friday (Wednesday would be used to prepare for the inspection on Thursday). Two days to 

work on the report. If they're lucky, they will finish the report on that Monday. Thursdays report 

won't be started until Tuesday, assuming they don't have an inspection on that Tuesday. You 
60 

also must include travel days if the facility is not local and holidays. Due to the Fl issue 

(whatever that was) and the infamous "Letter to Fox News" that claimed the inspectors weren't 

doing inspections, HQ is so focused on the number of inspections that they do not care that the 

time frame given to them to complete everything is unreasonable. It appears as if they are more 

concerned with reporting to Congress the number of inspections completed than provide them 

with sufficient staffing and training resources needed to provide the quality reports required for 

national security. 

This concludes my statement. I will be happy to answer any questions that you may have on the 

CFATS regulation or program. 
61 

Statement 

of 

Jennifer C. Gibson 

Vice President, Regulatory Affairs 

on behalf of the 

National Association of Chemical Distributors 

before the 

U.S. Senate 

Committee on Homeland Security and Governmental Affairs 

on 

The Chemical Facility Anti-Terrorism Standards 

June 12, 2018 
62 

Good morning, Chairman Johnson, Ranking Member McCaskill, and other distinguished 

committee members. My name is Jennifer Gibson, and I am vice president of regulatory 

affairs for the National Association of Chemical Distributors (NACD). On behalf of NACD, I am 

pleased to participate in this important roundtable and to provide this statement on the 

Chemical Facility Anti· Terrorism Standards (CFATS) program. 

About NACD 

NACD is an international association of nearly 440 chemical distributors and their supply-chain 

partners. NACO members represent more than 85 percent of the chemical distribution 

capacity in the nation and generate 93 percent of the industry's gross revenue. NACD 

members, operating in all 50 states through more than 2,800 facilities, are responsible for 

nearly 130,000 direct and indirect jobs in the United States. NACD members formulate, blend, 

re-package, warehouse, transport, and market the chemicals produced by manufacturers to 

750,000 end users in nearly every industry sector, including: 

Aerospace Metal Finishing 

Agriculture Paints and Coatings 

Automotive Pharmaceuticals 

Cosmetics Plastics 

Detergents Pulp and Paper 

Electronics Steel 

Energy Transportation 

Food Ingredients Water Treatment 

Fragrances And More 

While chemical distribution is big business, NACD members are predominantly small regional 

companies, many of which are multi-generational and family owned. The typical NACD 

distributor member has $26 million in annual sales, three facilities, and 26 employees. 

NACO Responsible Distribution® 

NACD members meet the highest standards in safety and performance through mandatory 

participation in NACD Responsible Distribution®, the association's third-party-verified 

environmental, health, safety, and security program. Through Responsible Distribution, NACD 
63 

members demonstrate their commitment to continuous performance improvement in every 

phase of chemical storage, handling, transportation, and disposal operations. 

While security has always been an inherent element of Responsible Distribution, following the 

terrorist attacks of September 11, 2001, distributors were the first sector of the chemical 

industry to mandate security measures for its members. NACD continues to assess Responsible 

Distribution's security measures against current threats. In 2013, NACD added a specific 

Security Code to Responsible Distribution that consolidated many prior requirements and 

enhanced others. These security requirements apply to all NACD members, including those 

who do not have facilities subject to the CFATS regulations. Over the past 16 years, NACD 

members- both CFATS·regulated and non-CFATS·regulated companies- have made 

substantial investments to make their facilities more secure. 

NACD Supports Long-Term Reauthorization of CFATS 

NACD strongly supports a long-term reauthorization of CFATS. The CFATS program has made 

the chemical industry and our nation much more secure. Since its establishment in 2007, the 

industry has invested millions of dollars and instituted thousands of new security measures. 

While these resources have not gone directly towards growing chemical distributors' 

businesses, NACD members recognize and appreciate the importance of making their 

companies, employees, and communities more secure. 

A Collaborative Approach Has Led to Success 

From the beginning, the Department of Homeland Security (DHS) has taken a collaborative, 

commonsense approach in implementing the CFATS regulations. Despite being dependent on 

temporary appropriations measures during the first seven years of the program, the agency 

did a commendable job in writing the regulations and setting up the internal infrastructure to 

be able to implement and enforce the new standards. While there were some growing pains in 

the first few years, by listening to and learning about industry DHS was able to use this 

information to make improvements to run the CFATS program more efficiently. 

One reason for the success of the CFATS program is the fact that DHS has taken the time to 

truly learn about the diverse chemical industry and work with companies on security 

measures that meet the CFATS Risk Based Performance Standards while providing flexibility to 
64 

each unique chemical facility in doing so. DHS has excelled in outreach to the industry by 

publishing numerous fact sheets and "lessons learned" documents; interacting with facility 

owners and operators during the Chemical Sector Security Summits and other industry 

meetings; and always making inspectors and headquarters personnel available to talk through 

issues and answer questions. DHS has spoken at numerous NACO meetings over the years to 

make sure our members were aware of the latest CFATS developments and lessons learned. 

In addition, DHS worked with NACO and the American Chemistry Council (ACC) to develop a 

CFATS Alternative Security Program (ASP) Guidance Document and Template to enhance the 

process for submitting site security plans. The ASP provides DHS with greater clarity about 

regulated facilities' security measures and how they meet or exceed CFATS requirements, 

while simplifying the compliance process and giving facility owners and operators a 

comprehensive security document to follow. 

The Diverse World of Chemical Facilities - Ensuring Different Industries Are Aware of 

CF A TS Obligations 

Following the tragic 2013 West Fertilizer fire and explosion, DHS doubled down on efforts to 

reach "outliers," those facilities that may not be aware of their obligations to inform the 

agency about their possession of chemicals of interest (COl) by filing Top Screens. Because 

NACO members sell COl to so many diverse industries, the association agreed to assist DHS 

with this effort by sharing CFATS information with these customers. NACO worked with the 

agency to create a special flyer to inform members' customers about CFATS, their obligation 

to file Top Screens if receiving threshold quantities of COl, and information on how to start 

the process. 

Regulatory Certainty Needed for Efficiency 

The "Protecting and Securing Chemical Facilities from Terrorist Attacks Act" of 2014 (P.L. 113· 

254), which for the first time provided CFATS a multi-year authorization, further enhanced 

security efforts by providing regulatory certainty to both industry and DHS. This stability 

allowed DHS to increase efficiencies in the program while streamlining the information 

submission process for regulated facilities. 

For example, in 2016, DHS rolled out an enhanced risk tiering methodology to identify more 

accurately high-risk facilities and assign them to appropriate risk tiers. DHS notified all 
65 

facilities with threshold quantities of CFATS chemicals of interest that they must submit new 

Top Screen surveys to the agency. At the same time, the agency launched version 2.0 of the 

Chemical Security Assessment Tool (CSAT 2.0), the online portal facilities use to submit Top 

Screens, Security Vulnerability Assessments, and Site Security Plans/ ASPs. CSAT 2.0 is much 

more streamlined and user friendly than the old version. The updated version allows facilities 

to submit their information and DHS to analyze the material more efficiently. DHS completed 

the re-tiering process in a timely and efficient manner and is now conducting authorization 

inspections and compliance inspections for facilities assigned to different tiers as well as 

newly regulated facilities. 

CFATS Going Forward 

NACD believes the CFATS program is strong and needs minimal change other than a multi-year 

reauthorization. One NACD priority is to make sure any changes to the Appendix A list of 

chemicals remain subject to notice and comment rulemaking. Changes to this COl list have 

major impacts on many companies' businesses and security investments. While changes may 

periodically be needed, it is important to give the regulated community the opportunity to 

provide information and explain the impacts of any proposed changes. 

NACD also supports the creation of a program under which DHS would recognize companies 

that meet certain criteria such as participation in an environmental, health, safety, and 

security program such as Responsible Distribution. Several state governments, including 

Indiana, Illinois, Michigan, and Ohio, have officially recognized Responsible Distribution. NACD 

members have made a strong commitment to operate their facilities safely and securely 

through Responsible Distribution. Recognizing these companies through measures such as less 

frequent inspections would allow DHS to prioritize resources to concentrate on the "outliers" 

or bad actors that may pose a greater security risk. 

Conclusion 

NACD supports the CFATS program and looks forward to working with the committee on 

legislation to reauthorize this important security regulation in the coming weeks and months. 

A multi-year reauthorization of CFATS would provide needed certainty and further enhance 

the security of chemical facilities and our nation. 
66 

On behalf of NACD, I appreciate this opportunity to present the association's views on this 

important issue. I look forward to your questions. 
67 

CCI Delivering Solutions through Chemistry 

COLUMBUS CHEMICAl INDUSTRIES 

Statement 

of 

Randall J. Eppli 

President and CEO 

Columbus Chemical Industries, Inc. 

before the 

U.S. Senate 

Committee on Homeland Security and Governmental Affairs 

on 

The Chemical Facility Anti-Terrorism Standards 

June 12, 2018 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TEMKIN ROAD. COLUMBUS, W! 53925 • 888.265.2436 

COLUMBVSCHEMICAL.COM • 
68 

CCI Delivering Solutions through Chemistry 

COlUMBUS CHEMICAL INDUSTRIES 

Good Morning, Chairman Johnson, Ranking Member McCaskiU, and distinguished members of the 

Committee. My name is Randall Eppli, and! am president and CEO of Columbus Chemical Industries, 

!nc. {CCI), a chemical distribution company headquartered in Columbus, Wisconsin. ! want to thank you 

for aHowing me to participate in this important roundtable and am pleased to provide lnput on the 

Chemical Facility Anti*Terrorism Standards (CFATS) program. 

About Columbus Chemical Industries, Inc; (CCI). 

Columbus Chemical Industries is a 40~year·otd, family owned manufacturer and distributor of specialty 

performance chemical solutions for numerous industries induding Semiconductor wafer chip 

production, medicat device manufacturing, pharmaceutical production and for various industrial 

applications. CC!'s 70-person team serves customers throughout North America, Europe and Asia from 

its facilities in Columbus, Wisconsin and Phoenix, Arizona. 

CCI has been an active member of the National Association of Chemica! Distributors (NACD) for 25 

years. NACO members meet the highest standards in safety and performance through mandatory 

participation in NACO Responsible Distribution®, the association's third-party-verified environmental, 

health, safety, and security program. NACO added a specific Security Code, which encompasses many 

CFATS regulations, to Responsible Distribution that consolidated many prlor security requirements and 

enhanced others. These requlrements apply to aU NACO members, induding those who do not have 

facilities subject to CFATS. 

Columbus Chemical Industries, Inc. Supports Long-Term Reauthorization of CFATS 

CCI supports a tong-term reauthorization of CFATS. I believe the CFATS program has made the chemical 

industry and our nation much more secure. Since the program's establishment in 2007, the industry has 

invested significant capital and training resources towards enhanced or augmented security measures 

at our facilities. White these resources did not necessarity assist in growing business, they were 

nonetheless important to ensure the security of my company, our employees, and the community. 

The Need for CFATS in Light of Threat Environment 

Evaluating and enhancing our security procedures based on the input of the experienced Department of 

Homeland Security (DHS) personnel has undoubtedly been beneficial to my company. However, I do 

believe it is possible the program coutd be administered with less of an administrative and financial 

burden on industry, especially smatt businesses. 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TEMKIN ROAD. COLUMBUS, WI 53925 • 888265.2436 

COLUMBVSCHEMICAL.COM • 
69 

CCI Delivering Solutions through Chemistry 

COLUMBUS CHEMlCALINOUSTRlES 

While it is true that in the program's first few years there where some growing pains, DHS was able to 

make improvements to run the CFATS program more efficiently by listening to those in chemical 

distribution. Many of the objectives of the Risk Based Performance Standards (RBPS) are already 

integral to the operations of the chemical industry, including complying with other regulatory agencies 

{such as the Drug Enforcement Administration), industry association standards (such as NACO 

Responsible Distribution®), insurance recommendations, and experience with good chemical 

management practices. However, there are still areas in which DHS could improve, such as clarifying 

what chemical facilities are expected to do in response to announced increased threat levels. The 

ongoing supply of chemicals and associated services is critical in times of emergency, therefore simply 

ceasing operations is not a viabte option for businesses during times of higher risk. 

Overall Experience with the CFATS Process Through DHS 

From the beginning, DHS generatty took a non·adversariai, consultative, and reasonable approach in 

implementing the CFATS regulations. Examples include achieving the intent of the RBPS, and the 

preparation of Site Security Plans (SSPs) and Alternate Security Plans (ASPs). That same approach has 

remained throughout the entirety of the program. While the initial process was burdened with 

cumbersome, confusing, and inefficient paperwork, this aspect of the program has improved over time. 

However, it should be noted that the process for SSP and ASP revisions and updates remains challenging 

for distributors. This is something we are anxious to continue to work with DHS to resotve. 

It has been our experience that DHS staff, in both the field and at headquarters, have generally been 

knowledgeable, professional, and courteous, Additionally, DHS typically arranges their site visits in 

advance, unlike many other government agencies. 

Recommendations for Improving the Process 

Adjudication of Background Checks 

Clarification on the adjudication of background checks is needed regarding: 

Exactly what background checks are required. 

What results for new job applicants are grounds for denying employment or otherwise 

restricting the applicant's employment opportunitles. 

If actions that employers may take regarding the results of background checks conform with 

government and company requirements or initiatives aimed at hiring ex-offenders. former 

addicts, etc. 

What actions employers are expected to take based on the resutts on background checks for 

legacy employees. 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TCMK!N ROAD. COLUMBUS, WI 53925 • 888.265 2436 

COLUMBUSCHEMlCAL.COM • 
70 

CCI Delivering Solutions through Chemistry 

COLUMBUS CHEMICAl INDUSTRIES 

In light of the darifications clted above, taws need to include provisions protecting employers from 

liability for the actions they take, or do not take, in good faith based on the crlminat background 

checks. The current situation is ambiguous. 

Recognition for Participation in Industry Pro!fam 

! support the consideration of incorporating, in whote or in part, verified industry-standard programs, 

such as NACO Responsibte Distribution@, into the evatuation of whether a facility has met the intent of 

the applicable RBPS. NACD members and others, such as ACC members who participate in Responsible 

Care, have made a strong commitment to operate their facilities safety and securely. Recognizing these 

responsible companies through simple measures Uke tess frequent inspections would atlow DHS to 

prioritize resources to concentrate on the "outliers" or bad actors who don't participate in these 

programs that may pose a greater security risk to themselves or the population at targe. 

Simplification of the Change Process 

To simplify the process of making non-substantive revisions, I recommend allowing the designated 

company to directly access their SSPs and ASPs to revise items such as personnel assignments, tittes, 

phone numbers, etc. Doing so wilt reduce the burden and time companies and their employees spend 

contacting DHS personnel to make these minor edits. 

While calls and emails placed to DHS's CFATS helpline regarding changes to SSPs and ASPs are generally 

acknowledged quickly, responses to these questions can sometimes take consider ably longer and may 

be too ambiguous to be usefuL A quicker response rate and dear guidance by DHS personnel in 

answering inquiries would ensure timely and accurate solutions for regulated companies. Rapid and 

frequent changes in product offerings, procurement, and inventory are core to the business of many 

chemical distribution companies. Prompt accommodation regarding DHS documents ls needed for new 

Chemicals of Interest (CO!} or newly increased Screening Threshold Quantities (STQ) for existing COL 

In most cases the existing facility infrastructure and procedures wiH suffice for meeting the intent of 

the RBPS. 

Cybersecurity Requirements 

CC! takes a comprehensive, broad-spectrum approach to securing our chemicals from cyber-attacks. 

We have found these defenses cannot be purely electronic based. Some of our cyber vu!nerabitity 

controls are cyber in nature, while others are designed to address some of the potential vulnerabilities 

inherent in increasingly autonomous cyber business procedures. 

Although our order receipt/processing/fulflltmentlpayment systems are increasingly efficient, we have 

intentionally incorporated "hard breaks" into the system. These hard breaks include a requirement for 

a minimum of two people from different departments to review the transaction and then take specific 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TEMKIN ROAD, COLUMBUS, WI 53925 • 888.265.2436 

COLUMBUSCHEMICAL.COM • 
71 

CCI DetivNing Solutions through Chemistry 

COlUMBUS CHEM!CALINOUSTR!ES 

le:-

IS09001 

action to enable it to continue. A transaction cannot be consummated without direct human 

intervention, and the system atso makes it infeasible for a single person to execute an entire 

transaction. 

CCI maintains a near real-time ERP inventory management system (Chempax c;s~~-~) to closety monitor 

physkal inventory and quickly identify discrepancies. Especially for more sensitive items (DHS, DEA, 

TTB, etc.), the electronic Inventory is periodicatly verified using direct physical inventory. Additionalty, 

CCI employs a cybersecurity consultant to establish and monitor a range of proven security protocols, 

both system-wide and for individual users, and to conduct system and individual penetration tests. 

CCI avoids circumvention of our electronic systems by not allowing cash transactions; not allowing 

shipments to other than pre-verified, bona·fide businesses; not aUowing product pickups by anyone 

other than authorized commercial chemical carrlers with applicable pre"dearance; maintaining close 

inspection of shipping papers prior to retease of an order; and physical inspections of transport vehicles 

before they are released. Alt CC! personnel involved with the transaction, from customer service 

receiving an order to the material handlers lauding a shipment into a truck, are authorized to stop the 

transaction if they feel anything is troublesome. 

Duplicative Regulations with Other Regulatory Agencies 

Contingency and Analogous Plans 

While each agency has a particular focus and certain subject-specific nuance, multiple agencies and 

programs require contingency plans/procedures, which entait multiple, often duplicative elements. 

These include DHS (CFATSIRBPS); DOT; EPA (RCRA- hazardous waste); EPA (Risk Management Plan 

(RMP)); WDNR (Off-Site Facility Plan); OSHA (Process Safety Management Plan (PSM)); DEA (especially 

for List 1 chemicals); FDA (especially the Food Safety Modernization Act (FSMA) ). 

Government agencies performing compliance inspections have sometimes required separate, 

comprehensive contingency plans for their particular agency program, even white acknowledging that 

such separate ptans may be redundant with other agency ptans. A single master contingency plan, with 

appropriate sections and nuance, would be much more efficient and, more importantly, effective in 

meeting the intent of a contingency ptan. Further, there are real security/confidentiality concerns, 

and inevitable jurisdictional confticts, with multiple agency personnel delving into a chemical 

company's contingency plans. 

Furthermore, NACO Responsible Distribution requirements also include contingency ptans and 

procedures, with third-party verifications {audits). Insurance carriers generally require a company have 

a special type of contingency plan, a Business Continuity Plan (BCP). These plans are often as 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TEMKIN ROAD, COLUMBUS. W! 53925 • 888.265.243G 

COLUMBUSCHEMICALCOM • 
72 

CCI Delivering Solutions through Chemistry 

COLUMBUS CHEMICAL INDUSTRIES 

comprehensive as the contingency plans required by government agencies, and often have much more 

applicability and effectiveness in reat·wor!d situations. 

Conclusion 

That said, as the threat environment islong·term, so too should the authorization of the CFATS 

program. CCI supports CFATS and looks forward to working with the subcommittee on legislation to 

reauthorize this important security regulation in the coming weeks and months. A multi·year 

reauthorization of CFATS would provide needed certainty and enhance the security of chemical 

facilities and our nation. Both industry and DHS need reasonable predictability. On behalf of Columbus 

Chemical Industries, Inc., 

I appreciate this opportunity to present our views on this important issue. 1 look forward to your 

questions. 

Chemical Processors & Packagers Specializing in Acids, High Purity Salts, and Custom Blended Solutions 

N4335 TEMKIN ROAD. COLUMBUS, Wl 53925 • 888.265 2436 

COLUMBUSCHEMICALCOM • 
73 

US Senate, Committee on Homeland Security and Government Affairs 

Roundtable: Examining the Chemical Facility Anti-Terrorism Standards (CFATS) Program 

Statement by Bill Erny on behalf of the American Chemistry Council 

10:00 am June 12, 2018, SD-106 Dirksen Senate Office Building 

The American Chemistry Council (ACC) represents the major chemical producers across the United 

States, including a diverse set of small and medium-sized companies engaged in the business of 

chemistry. ACC members make and enhance products that are critical to the everyday health and 

welfare of our Nation. Because of our critical role in the U.S. economy, and our responsibility to 

employees and our communities, chemical security is a top priority for ACC and our members. 

The business of chemistry is a $768 billion enterprise and growing; providing roughly 800,000 skilled 

and good-paying American jobs. Today, the industry is experiencing a renaissance in the United 

States thanks in large part to the growth in domestic shale gas production. In fact, ACC has 

identified over 300 new capital investment projects currently underway across the United States, 

worth over $185 billion in economic growth and adding thousands of new jobs. Ensuring that clear 

and workable programs such as CFATS remain in place is critical to establishing the stable regulatory 

environment needed that will help foster additional investments in expanding U.S. operations. 

This year marks the 30th anniversary of the ACC's Responsible Care® Program, the leading chemical 

industry stewardship initiative. Shortly after 9/11, ACC added the Security Code, a comprehensive 

security management system. Implementation of Responsible Care and the Security Code is 

mandatory for all members of the ACC. The program has enjoyed great success over the years and 

is a terrific complement to CFATS and other safety and regulatory programs. ACC members have 

invested more than $17 billion under the Security Code to further enhance their security. The 

Security Code has become a gold standard for the industry, is international in scope and serves as a 

model for regulatory programs. 

ACC supports long-term reauthorization of the DHS CFATS Program. Over the past four years, DHS' 

efforts have had a positive impact on enhancing security at chemical facilities. Several factors have 

led to the recent success of CFATS, including better site inspections, improved training of DHS 

headquarters and inspection staff and a more streamlined authorization process. Most importantly, 

DHS leadership has demonstrated a commitment to working with members of the regulated 

community to improve implementation of the CFATS program. 

While DHS has made considerable strides to improve CFATS, we have 3 major recommendations for 

enhancements to the program: 

1. Improve Transparency in DHS risk determinations. 

DHS should be more transparent with regulated facilities regarding risk tiering 

determinations and what actions the Agency may take to further mitigate risk. Often times 

the facility security director- the very person with the overall responsibility and authority 
74 

for making critical security risk management decisions for the site- is not aware of the 

determining factor(s) behind the assigned risk tier level;. DHS should provide a detailed 

explanation as to why a facility is being tiered at a certain level. 

2. Eliminate the requirement for TSDB Screening at lower risk facilities. 

Over the past year, DHS has been implementing the terrorist screening portion of the CFATS 

PSP or personnel surety program {RBPS 12{iv)) at all Tier 1 and Tier 2 high-risk facilities 

{around 200 sites). This process requires the facility to collect, manage and protect sensitive 

personal identifying information on employees and contractors and send that information 

to DHS for vetting against the Terrorist Screening Database (TSDB). 

DHS is planning to extend this program to an additional3,000 lower risk Tiers 3 and 4 

facilities, involving tens of thousands of employees and contractors and their personal 

information. ACC is concerned that such an expansion of the PSP program is unnecessary 

and will needlessly put personal employee information at risk. ACC believes the benefit 

associated with TSDB vetting is simply not worth the cost or the risk. While we support TSDB 

vetting at high risk Tier 1 and 2 facilities, ACC recommends elimination of this requirement 

for lower risk Tiers 3 and 4 facilities, or could be an option for those who choose to 

participate. 

3. Establish a CFATS Recognition Program 

DHS should leverage chemical industry stewardship programs, such as ACC's Responsible 

Care Security Code, with the goal of further enhancing the safety and security of hazardous 

chemicals across the Nation. Under CFATS, DHS can provide regulatory recognition for 

responsible operators that demonstrate superior performance and who exceed regulatory 

compliance. Such a program would incentivize the implementation of existing industry 

stewardship programs- and the creation of new ones where necessary-- thus enhancing 

chemical security across the sector and beyond the universe of CFATS regulated facilities. 

CFATS has helped make our industry and our communities safer and more secure. We hope that in 

considering long-term reauthorization of the program, this Committee will consider ACC's 

recommendations and supply the needed regulatory certainty and stability for companies to 

continue to make prudent risk management decisions and investments. ACC and its members 

encourage you to support this important program and take CFATS to the next level, while 

continuing to provide effective Congressional oversight and guidance. 
75 

THE 

FERTILIZER 

INSTITUTE 

Written Remarks of 

Justin P. Louchheim 

Director of Government Affairs 

The Fertilizer Institute 

Senate Committee on Homeland Security and Governmental Affairs 

Roundtable on 

Examining the Chemical Facility Anti-Terrorism Standards Program 

.June 2018 
76 

Good morning, Chairman Johnson, Ranking Member McCaskill, and members of the 

Committee. 

My name is Justin Louchheim. I am Director of Government Affairs for The Fertilizer 

Institute (TFI). TFI represents the nation's fertilizer industry, which includes companies that are 

engaged in all aspects of the fertilizer supply chain. Fertilizer is a key ingredient in feeding a 

growing global population, which is expected to surpass 9.5 billion people by 2050. Half of all 

food grown around the world today is made possible through the use of fertilizer. 

TFI represents companies that include large multi-billion dollar production facilities and 

thousands of small agriculture retailers, the latter of whom interact directly with American 

farmers. Agricultural retail facilities sell a variety of products to farmers, including fertilizers 

such as ammonia and ammonium nitrate, and often have just 5-l 0 employees at a location. 

Overall, the U.S. fertilizer industry generates more than $154 billion in economic benefit 

annually and provides approximately 89,000 direct jobs and 406,000 indirect jobs for a total of 

495,000 U.S. jobs. 

Under the Chemical Facility Anti-Terrorism Standards, or CFATS program, the 

Department of Homeland Security identifies chemicals which present potential security 

concerns. Included on this list are a few fertilizers, including ammonia, ammonium nitrate, 

sodium nitrate and potassium nitrate. 

The safe and secure handling of fertilizers is a high priority for TFT and its members. TFI 

and many of our members actively participate in and sponsor numerous safety initiatives, 

2 
77 

including ResponsibleAg, TRANSCAER, and the Advanced Tank Car Collaborative Research 

Program. 

ResponsibleAg --which is a joint effort between TFI and the Agricultural Retailers 

Association -- exists to enhance compliance by agricultural retailers with a variety of federal 

safety, security, environmental and transportation regulations, including those administered by 

the Department of Homeland Security (DHS), the Occupational Safety and Health 

Administration (OSHA), the Environmental Protection Agency (EPA) and the Department of 

Transportation (DOT). Each participating facility receives a federal regulatory compliance 

assessment. Any noted compliance deficiencies must be corrected by the facility before it may be 

designated as certified under the program. The assessments are then conducted every three years. 

To date, over 2,500 facilities are registered with the ResponsiblcAg program, over 1,000 

of these facilities have been certified, 185 auditors have been trained, and almost 2,000 audits 

have been completed. We are very proud of this industry-led compliance program. Periodically, 

we lead a tour of the training program and facility for federal and state officials. We welcome 

you and your staff to visit anytime. 

Regarding the CFATS program. it provides a good framework to ensure chemical 

facilities take the appropriate steps necessary to protect themselves and the security of the 

communities around them. Our members support the program, recognize its importance, and we 

support a multi-year reauthorization of the program. 

DHS has estimated that over 3,500 facilities are presently subject to the program and TFI 

estimates that this includes as many as 1,500 fertilizer manufacturers and agricultural retail 

3 
78 

facilities, with retail facilities accounting for the overwhelming majority. The retail facilities are 

generally located in rural communities, interface directly with farmers and employ a very small 

number of individuals. While we are largely satisfied with the CF A TS program, we believe that 

implementation of the program would benefit from a bit more transparency between DHS and 

the regulated community. For example, DHS recently completed a process for reclassifying 

facilities. As a result, some TFI facilities were reclassified into a higher risk classification. What 

was not clear to TFI members, was the underlying basis for the new categorizations. We believe 

this should be a more transparent effort between DHS and individual facilities, allowing for a 

more thorough discussion of the security risks posed by individual facilities. This could 

ultimately bolster the quality of site security plans. Nevertheless, the relationship between TFI 

members and DHS is generally very productive, and we see this as a communication issue that 

can be easily addressed. 

Another example of the need for increased transparency is the way DHS utilizes 

Appendix A, the list of chemicals potentially subject to the CFATS program. TFI and its 

members have encountered some confusing rulemaking interpretations, particularly how the 

program addresses ammonium nitrate and ammonium nitrate mixtures. The uncertainty 

regarding which mixtures arc or are not subject to CFATS has been the subject of many 

discussions, but has not been resolved to the satisfaction ofTFI members, owing to the limited 

explanations received from DHS. We believe these uncertainties could be remedied through a 

comprehensive notice and comment rulemaking. 

We are also sensitive to the way facility-specific information contained in site security 

plans is shared with the public. We believe the facility owner or operator should retain the 

discretion to determine how this information is shared. 

4 
79 

Lastly, regarding the personnel surety program, we don't believe this obligation to check 

employee records against the terror screening database should be applied to those facilities in 

risk groups Tier 3 and Tier 4. This would be an exponential expansion of the program from the 

less than 200 facilities presently covered to more than 3,500. Many of the 1,500 or so 

agricultural retail facilities are not equipped to implement this program at this time. TFI 

recommends that Congress commission a study from the Government Accountability Office of 

the merits of expanding this program beyond the Tier I and Tier 2 facilities that are presently 

covered. 

Finally, and a bit outside the scope of CF A TS, is an obligation for DHS to create a track 

and trace program for the sale and purchase of ammonium nitrate. This decade old directive from 

Congress has not been implemented, and DHS last year commissioned a study by the National 

Academy of Sciences (NAS) to more broadly explore the use of improvised explosive chemicals 

and make recommendations on how they should be managed in commerce. The NAS issued a 

report late in 2017, identifying 28 chemicals for further consideration by DHS. One such 

chemical is urea ammonium nitrate, a widely used liquid fertilizer. TFI believes that this product 

was mischaracterized as being a high-risk concern-as it has never been used to make an 

explosive. TFI believes that DHS should focus their limited resources on those chemicals that 

have historically be used to make improvised explosive devices. 

Thank you again for the opportunity to be with you all this morning. I am happy to 

answer any questions. 

5 
80 

Testimony of Linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

Testimony of 

Linda Menendez 

Director of Operations 

Austin Powder Company 

on 

Examining the Clu:mical Facility Anti-Terrorism Standards Program 

before the 

U.S. Senate Committee on Homeland Security and Governmental AtTairs 

June 12,2018 
81 

Testimony of Linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

Chairman Johnson, Ranking Member McCaskill, and members of the Committee, on behalf of 

Austin Powder Company, thank you for the opportunity to present at today's roundtable discussion 

regarding the reauthorization of the Department of Homeland Security's (DHS) Chemical Facility AntiTerrorism Standards (CFATS) program. 

Austin Powder Company, headqum1ered in Cleveland, Ohio, is a privately-owned U.S. company 

founded in 1833 as an explosives manufacturer. As we celebrate our 185'" anniversary, our legacy makes 

Austin not only the oldest explosives company in the U.S., but also the oldest in the world. Besides being 

a major U.S. manufacturer, Austin also performs the valuable service of blasting for its customers in mining, 

quarries, construction, and seismic exploration. Today, Austin Powder operates with more than 50 

distribution sites holding ATF Federal licenses, employing a U.S. workforce of 1,225. 

Like other !ME members, Austin Powder is committed to the safety and security of our employees 

and the general public. We adhere to and often times exceed the regulations set forth by the Department of 

Transpo11ation (DOT), the Occupational Safety and Health Administration (OSHA), the Mining Safety and 

Health Administration (MSHA), the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and, 

since 2007, the Department of Homeland Security (DHS), CFATS. Additionally, Austin Powder's safety 

and security professionals are responsible to design and implement our own business practices to ensure 

the reliability and integrity of our infrastructure, increase our security efforts, and address and eliminate 

security threats. 

Every aspect of the life cycle of explosives, from acquisition to disposition, has been regulated by 

the ATF since the 1970's. A major revision of the Federal Explosives Regulations went into effect in 2003 

to further improve the commercial explosive industry's security position. Duplicative regulation by DHS's 
82 

Testimony of linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

CFA TS program of the same products, for the same purpose, has resulted in additional compliance costin both time and money. Furthermore, double-regulation detracts the compliance efforts of those seeking 

to be confident that they understand the laws. 

The tirst Austin Powder example that I wish to illustrate is an ATF licensed facility on leased 

property,································· 

It is situated in a rural area with a ••••••••••••. These magazines,-

•••••••••••••••• are constructed in accordance with requirements set forth in 

Subpart K of the Federal Explosives Laws and Regulations in 27 CFR 555.207, Type 1 magazines, and are 

described in 207(b) as ''igloos", because they have at least 24-inches of an earthmound covering top, sides 

and rear. The doors of these bunkers are heavy steel doors weighing as much as Y, ton. Hinges to the steel 

doors are welded to ensure they could not be removed by mechanical means. Air vents in the magazines 

are protected by reinforced steel bars and arc incapable of human access. All explosives magazines are 

required to meet the standards set forth in Subpart K of 27 CFR 555.207 for locking mechanisms. The 

magazines arc secured by two (2) separate locking mechanisms per door, under steel hoods. All keys used 

to open padlocks are strictly controlled by adherence to Austin's Key Control Plan. The Key Control Plan 

is also part of this facility's U.S. DOT Security Plan. We lease 69 bunkers in this very remote, limited 

access, former government facility, 62 of which are used as storage of explosives that DHS has listed on 

Appendix A, Chemicals of Interest (COl). All COl are shipped in to this facility; we do not manufacturer 

COl here. We employ a third-party uniformed guard force contracted by the industrial park. There is only 

one authorized access point to the facility, guarded 24/7, requiring employees, visitors. and motor carriers 

to register and be esc011cd from the gate by an assigned and authorized Austin employee. The CO! 

explosives are routinely transferred from the facility to either of two other Austin Powder ATF Federally 

licensed plants that manufacture high explosives. Austin Powder transports the COl from this facility with 
83 

Testimony of Linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

either our own commercial motor vehicles operated by our own professional commercial drivers or by 

private motor carriers holding the same operating authorities as Austin and with whom Austin has a wellestablished business relationship. All truck drivers transporting COl explosives are required to have a 

Hazardous Materials Endorsement, conforming to TSA requirements. COl shipments arc point-to-point 

routes with no intermediate stops for loading or unloading of cargo. Austin vehicles arc equipped with 

electronic tracking systems required by 49 CFR Pa1t 395 and adhere to all requirements ofHazmat shippers 

under 49 CFR Part 173. 

All COl in this facility are considered Theft/Diversion Risks under the CFATS program. Our first 

Top Screen submitted in 2008 resulted in the facility being "Untiered'' However, upon submitting a DHS 

Top Screen in 2013 (identifying additional COl) and a subsequent Security Vulnerability Assessment, DHS 

determined it to be a Tier 2 high-risk facility, requiring either a Site Security Plan or an Alternative Security 

Program meeting the levels of performance established by the CFATS (18) "Risk Based Performance 

Standards (RBPS)." 

In order to meet DHS's Risk Based Performance Standards, Austin Powder made the following 

changes to the facility: 

Installed a fence around one of the COl magazines 

Changed locking mechanisms on all COl magazines 

Installed an Intrusion Detection System monitored 24/7 

Increased guard force security patrols 

Installed solar powered lighting in the COl magazine areas 

Installed motion detection lighting at one COl magazine 

Additional employee training 
84 

Testimony of Linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

Additional records of training, audits, equipment maintenance 

The man-hours and implementation cost for these additional security measures totaled 

$325,000 with a recurrent annual expense of $70,000 for contracted monitoring services. 

In 2016, following an update to the Chemical Security Assessment Tool (CSAT), Austin 

Powder was again required to submit a Top Screen for this facility. After submitting the Top 

Screen and an updated Alternative Security Plan Document, with no significant change in COl 

quantities from the last Top Screen submitted, DHS determined the facility's overall tier should 

be lowered to a Tier 3. It is our understanding the updates to the CSA T program enhanced their 

tiering methodology, which more accurately and appropriately tiered high-risk chemical facilities. 

But, quite frankly, the uncertainty of the reason behind DHS's determination to lower the facilities 

risk does not provide me with a way to determine if our $325,000+ spend was necessary or if the 

tier could change in the future. 

The second A TF licensed facility is a high-explosives manufacturing plant. It is located 

on 2,000 acres of mostly forested land. 1l1e main gate is manned 24/7 by a guard force that 

conducts security patrols and escorts all visitors and motor carriers within the plant All employees 

of this facility are vetted under the Federal Explosives License as an ATF Employee Possessor or 

Responsible Person, upon hire and upon the Federal License renewal. 

Because of the inherent nature of explosives, our facility is mandated to follow certain 

security-related regulations under ATF, OSHA's Process Safety Management (PSM) program and 

Pipeline Hazardous Materials Safety Administration (PHMSA). PHMSA, for example, requires 
85 

Testimony of linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

this facility to have and maintain a Site Security Plan, the components of which include an 

assessment of transportation security risks that include storage within the facility, movement of hazardous 

materials within the facility, movement incidental to transp01tation and unloading of Division l.l 

explosives. 49 CFR 172.802 directs the facility's Site Security Plan components to include Personnel 

Security, Unauthorized Access and Enroute Security. This one example of duplicative regulation requiring 

two separate Regulatory Agency security plans for the same facility demonstrates the unnecessa1y burden 

ofCFATs. 

COl explosives at this facility arc stored in 15 separate Type l, Type 2 and Type 5 magazines 

constructed in accordance with requirements set forth in Subpart K of the Federal Explosives Laws and 

Regulations in 27 CFR 555. The immediate areas surrounding the storage magazines are designated as 

"Restricted Areas" and only those employees who are authorized and assigned work duties may have access 

lo those areas. COl removed from the magazines are immediately transferred to the various manufacturing 

buildings on the plant and consumed within the shift, never left unattended and properly stored when not 

being used. 

All COl in this facility are considered Theft/Diversion Risks under the CFATS program. Diversion 

is defined in CF A TS as the act of acquiring a product by means of deception. As our facility uses an 

electronic tracking device on all of its commercial motor vehicles, is required in Subpart K of the Federal 

Explosives Laws and Regulations to obtain a certified statement of intended use and identification to 

transfer product to another Federal Explosive Licensee, is required by FMCSA to have a pre-determined 

route plan as well as a communication plan for departure and arrival of shipments, and ships primarily to 

Austin's Federally-licensed facilities throughout United States with either our own commercial motor 
86 

Testimony of linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

vehicles operated by our own professional commercial drivers or by private motor carriers, diversion of 

COl of this facility is highly unlikely. 

Our first Top Screen submitted in 2008 resulted in the facility being "Untiered.'' However, Top 

Screens completed in 2015 and 2017 resulted in a determination of the facility as a Tier 3 high-risk facility. 

In order to meet DHS Risk Based Perfom1ance Standards, Austin Powder made several significant 

changes to the facility, including: 

Perimeter fencing 

• Changed locking mechanisms on COl magazines 

Installed an Intrusion Detection System monitored 2417 

Reinforced gates 

Additional employee training 

Additional signage 

Additional records of training, audits, equipment maintenance 

The man-hours and implementation cost for these additional security measures totaled 

$837,400 with a recurrent annual expense for contracted monitoring services. 

Each business has its own regulatory environment applicable and beneficial to its 

operations. It is with confidence that Austin Powder relies on the Federal Explosives Laws and 

Regulations in 27 CFR 555 Commerce in Explosives to remain compliant as we build our business. The 

Chemical Facility Anti-Terrorism Standards (CFA TS) program, however, docs not provide us with 

the knowledge of risk-based tiering to draw accurate conclusions needed to manage our business 
87 

Testimony of Linda Menendez 

Director of Operations, Austin Powder Company 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

without government involvement. Without the right tools and analysis process there isn't a way 

to qualify or disqualify potential solutions to our business opportunities. 

We respect those that appreciate the CFATS oversight in an otherwise unregulated 

business. My testimony is meant to provide evidence that in a highly-regulated industry, like the 

commercial explosives industry, layering additional DHS regulation on top of existing ATF 

regulation that has proven to keep commercial explosives secure, is unnecessary and confusing. 

On behalf of Austin Powder, !urge you to support an exemption of ATF Federally licensed 

facilities in the CF ATS program. Thank you for the opportunity to testify today. 
88 

institute of makers of 

The safety and security institute of the commercial explosives industry since 1913 

Testimony of 

Debra Satkowiak 

President 

Institute of Makers of Explosives 

on 

the Chemical Facility Anti-Terrorism Standards Program 

before the 

U.S. Senate Committee on Homeland and Governmental Affairs 

June 12, 2018 
89 

Testimony of Debra Satkowiak 

President, Institute of Makers of Explosives 

Before the 

Senate Committee on Homeland Security and Governmental Affairs 

June 12, 2018 

Chairman Johnson, Ranking Member McCaskill, and members of the Committee, on 

behalf of the Institute of Makers of Explosives (I ME) and the commercial explosives industry, 

thank you for the opportunity to discuss the Department of Homeland Security's (DHS) Chemical 

Facility Anti-Terrorism Standards (CFATS) program and the critical role Congress plays in ensuring 

the effectiveness of CFATS while safeguarding our nation's security. 

We commend the Committee for its leadership on CFATS reauthorization and willingness 

to address the concerns of those affected by the program, namely the duplicative nature of the 

program for the explosives industry. 

Founded in 1913, IME is the safety and security institute for the commercial explosives 

industry, a charge we do not take lightly, as evidenced by the industry's excellent track record. 

Our work, in conjunction with the regulations set forth by the Bureau of Alcohol, Tobacco, 

Firearms, and Explosives (ATF), and our industry's dedication to continual improvement has 

resulted in an ever-increasing culture of security that has seen the use of regulated commercial 

explosives as a component of improvised explosives devices in bombing incidents remain below 

2% for the last 25 years, according to available ATF Explosives Incident Reports (EIRs). IME takes 

an active role in promoting responsible practices through the full life cycle of commercial 

explosives and regularly publishes, updates, and distributes free of charge, our series of Safety 

Library Publications (SLPs), including SLP 27 which covers Security in Manufacturing, 

Transportation, Storage and Use of Commercial Explosives, to the benefit of our workers and the 

general public. 
90 

Duplicative regulation of explosives should be eliminated 

While IME readily acknowledges the improvements the CFATS program has made in the last four 

years, we remain concerned that DHS' regulations on explosive materials continue to duplicate 

security regulations under the jurisdiction of ATF. This duplication of regulation imposes 

significant costs that impact jobs and industry investment without a commensurate increase in 

security. 

When the department promulgated the CFATS Chemicals of Interest (COl), Appendix A, 

in 2007, they included explosive materials that were already regulated by ATF for safety and 

security purposes for nearly a half century in accordance with the Organized Crime Control Act 

of 1970, and later by the Safe Explosives Act of 2002. Explosives are the only materials on the 

COl for which security regulations exist under the jurisdiction of another agency. Given that ATF 

regulatory requirements, along with industry best practices, have resulted in a sustained and 

exemplary security record for the commercial explosives industry, the costs incurred under the 

duplicative CFATS requirements far exceed any benefits. 

The inclusion of already regulated explosive materials on the COl may likely be the result 

of ATF's exclusion from the CFATS development process, a concern ATF mirrored in an August 

2007 correspondence to DHS, obtained by IME through a Freedom of Information Act {FOIA) 

request, stating "For reasons unclear to ATF, until this time ATF was not consulted or asked to 

comment on various drafts or prior versions of this rule. As you know, ATF has considerable 

experience and expertise regulating explosives to prevent their criminal misuse, including acts of 

terrorism." ATF has long held the role of regulating commercial explosives and the duplication 

2 
91 

of those regulations by DHS has only served to increase compliance costs and confusion, rather 

than security. 

The excessive costs and lacking security benefits of CFATS 

CFATS, despite augmenting facility security expenditures, has done little towards an 

actual increase in commercial explosive security. After reviewing the available Explosives 

Incident Reports (EIRs) issued by ATF from 1985 to 2014, IME found that while there has been a 

consistent and remarkable reduction in thefts of explosives over the last 30 plus years, there is 

no marked increase in that rate of decline following the beginning ofthe CFATS program. Clearly, 

the record shows that A TF regulations and industry best practices effectively ensure security of 

commercial explosives and prevent diversion for criminal other illicit use. 

250 

200 

E 150 

.! 

... 100 1; 

j so 

§ 0 z 

Thefts of Explosives from 1985 to 2014 

1985 1994 

Period of Time 

-Thefts of Explosives 

2004 ' 2014 

Start of CFATS 

While there is no empirical data that shows a need for CFATS regulation of commercial 

explosives under ATF jurisdiction, IME was able to gather data on how much CFATS compliance 

costs the industry. In 2017, IME prepared four case studies to identify these costs and found 

that, for the four sites reviewed, the total expected compliance cost reached over $2.6 Million; a 

sum that saw no proportionate increase in facility security. One facility, also regulated by the 

Department of Defense (DoD) and ATF, was asked to run electricity to a mandated no-spark 

3 
92 

environment. The result was the imposition of massive cost, upwards of $500,000 to run 

underground electricity in accordance with DoD regulations or the alternative option for roundthe-clock in person surveillance over multiple storage sites, which carried with it an estimated 

cost of $3M. Considering all four sites were already regulated for security by the ATF, CFATS 

requirements provided minimal additional security benefits despite the massive associated costs. 

During these case studies, it became evident that many IME member companies find the 

compliance measures germane to CFATS to be superfluous yet costly, an experience that is 

further detailed by the Austin Powder Company in their related testimony. 

In addition to monetary expenditures, the workforce burden of CFATS is exhaustive. 

While the commercial explosives industry only has approximately 24 sites regulated by CFA TS, 

all ATF regulated facilities must submit to Top-Screens. With an estimated 10,500 ATF licenses 

and permits in circulation, and the Office of Management and Budget estimated 6 hours it takes 

to complete a Top-Screen survey, the number of man-hours required to, in large part, find out 

you do not qualify for CFATS oversight can be immense and unnecessary. One IME company 

alone spent an estimated 357 hours filling out Top-Screens for facilities already effectively 

regulated by ATF for security, hours that could have been spent bolstering their existing 

security, safety, health and environmental safeguards. 

CFATS contradicts other federal regulations 

While I ME's first concern remains the duplicative nature of the CFATS program on our 

already regulated industry, we would be remiss if we neglected to address how this duplication 

lends itself to regulatory conflict. On occasion, CFATS regulations will challenge the mandates 

of other federal regulators, leaving our member companies to decide which body carries the 

4 
93 

bigger stick. One such example resulted in an explosives company being asked to move an 

explosives storage magazine to comply with CFATS, a magazine that had been approved by ATF 

according to the American Table of Distances (ATD}. The ATD was developed by IME and 

adopted by ATF to ensure safety in storing explosive materials to prevent both sympathetic 

detonations of surrounding storage sites and impact to surrounding communities. On other 

occasions, DHS personnel advised IME member companies and downstream customers that 

mobile bulk trucks that operate with blasting agents not subject to CFATS purview would be 

tiered into the program and would have continued down that regulatory path had IME not 

intervened with technical information and guidance. In addition to failure to respect ATF's 

jurisdictional lines, confusion has also been caused by DHS' oversight into operations that fall 

under the authority of the Department of Transportation. In the past, the explosives industry 

experienced reasonable certainty in regards to what types of operations fell under which 

agency's jurisdiction, but DHS has stated in no uncertain terms that they do not follow any 

jurisdictional boundaries typically respected by other agencies. 

Lack of transparency in the CFATS tiering process and challenges with non-prescriptive 

standards 

All regulations should be transparent: clear, concise and easy to follow in order to 

promote consistency, reliability and compliance. The CFATS program, by design, is none of 

these. At each step, from submission of top screens to security plans and through compliance 

inspections, the regulated party must wait for a decision from Washington, based on nonpublished algorithms before advancing to the next step. While CFATS personnel in Washington 

are willing to discuss a particular site's security issues over the phone to explain their thinking, 

5 
94 

there are no articulated guidelines, charts or tables available to the regulated industries to 

provide direct information on how they will be tiered. This presents an obstacle to business 

planning for existing and future operations, and limits the ability of a facility to make proactive 

choices to control operational aspects that could change a tiering status. 

As evidenced by Austin Powder's experience with the tiering process, a company does 

not know what tier level it may be assigned because the decision matrix is concealed from 

them. Companies do know if they possess chemicals of interest and the quantity but because 

the CFATS tiering program (the Chemical Security Assessment Tool (CSAT) includes other 

factors unknown to the company, determining a facility's tiering level prior to a Top-Screen is 

impossible for most companies. Tiering is simply the first challenging step. 

A facility's tier then determines what sort of Risk Based Performance Standards (RBPS) it 

must implement to meet CFATS compliance. DHS has produced a 199-page guidance document 

to "help" companies figure out how to comply with the 18 different standards. 

It is important for the committee to know that the guidance document says this: 

"To meet the RBPSs, covered facilities are free to choose whatever security programs or 

processes they deem appropriate, so long as they achieve the requisite level of 

performance in each applicable area. The programs and processes that a high-risk 

facility ultimately chooses to implement to meet these standards must be described in 

the Site Security Plan (SSP) that every high-risk chemical facility must develop pursuant 

to the regulations. It is through a review of the SSP, combined with an on-site 

inspection, that DHS will determine whether or not a high-risk facility has met the 

6 
95 

requisite levels of performance established by the RBPSs given the facility's risk 

profileY' 

Ultimately, a company must jump through a series of hoops and at each step and wait for 

approval. While these steps were created with the best of intentions, four facts make them 

problematic. 

1. DHS can change the tiering program (CSAT) without notice, which could increase or 

decrease a facility's tier. CSAT 2.0, for example, was released in September 2016. 

2. CFATS personnel have discussed the possibility of conducting are-tiering process on a 

multi-year schedule. 

3. The 199-page guidance document is a non-binding guidance that can also be changed or 

updated without notice. 

4. In 2014, DHS started working on an update of CFATS regulations in accordance with the 

Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, Pub. L. 

113-254. When initiated, DHS noted, "The NPRM will propose substantive modifications 

to CFATS based on public comments received on the ANPRM and based on program 

implementation experience the Department has gained since 2007. 2" While the effort 

was recently moved to long term actions on the Unified Regulatory Agenda, one can 

expect that if reauthorized in 2018, the effort will be renewed. 

1 DHS Risk~Based Performance Standards Guidance, Chemical Facility Anti-Terrorism Standards, May 2009 Pg &. 

7 

- Department of Homeland Security (DHS) Fa!f 2015 Statement o}Regulator:v Priorities, Chemical Facility Anti·Terrorism. Pg 

14 

7 
96 

As you can see, these four factors make pre-emptive compliance inherently difficult at best in 

the short-term. Predictably is impossible in the long-term. 

The Austin Powder Company, in their associated testimony, will explain in detail how the 

guarded tiering process has worked to increase their expenditures while leaving facility security 

unaffected. Had Austin Powder known the additional burdens CFATS compliance would entail, 

they may have changed their decision to lease the property. That negative experience will 

influence their future business decisions. 

Conversely, an IME member planning to build a new facility according to ATF regulations 

knows the construction, security, and compliance costs, therefore allowing for sound business 

decisions to be made. 

An exemption for ATF regulated facilities for industry 

IME has repeatedly requested that DHS relieve the industry from this duplicative 

burdensome regulation. IME met with Mr. Robert Kolasky, Deputy Under Secretary (acting), 

National Protection and Programs Directorate, in his position as Regulatory Reform Officer (RRO) 

for the department. The meeting was held on October 30, 2017 to discuss regulatory reform per 

Executive Order (EO) 13771 on Reducing Regulation and Controlling Regulatory Costs and EO 

13777 on Enforcing the Regulatory Reform Agenda. IME briefed him on the redundancy of CFATS 

on our industry and explained how removal of this duplicative regulation would allow DHS to 

focus valuable resources on other critical risks to our Nation. The Department did advise IME 

that they will not pursue rulemaking to remove explosive materials subject to ATF regulation, 

however, outside of the October meeting DHS officials indicated that they would not object to a 

legislative fix if IME choses to pursue that route. 

8 
97 

During the initial development of the CFATS legislative text, Congress wisely understood 

that a one-size-fits-all approach to chemical security was not necessary and exempted: 1) 

Facilities regulated pursuant to the Maritime Security Act of 2002; 2) Public Water Systems as 

defined by the Safe Drinking Water Act (Sec 1401); 3) Treatment Works as defined by the Federal 

Water Pollution Control Act (Sec. 212); 4) Dept. of Defense and Dept. of Energy facilities; and, 5) 

Facilities regulated by the Nuclear Regulatory Commission. Surprisingly, ATF regulated facilities 

are not provided similar deference. For this reason, and those previously stated, we request the 

Committee reduce the duplicative burden of CFATS on the explosives industry by providing an 

additional and equal exemption based on the comprehensive and effective ATF regulations 

outlined above. 

The commercial explosives industry is eager to work with this Committee in a bipartisan manner 

to reauthorize the CFATS program in a manner that enhances national security while reducing 

blatantly duplicative regulations; clearing the path for government to focus resources on actual 

threats to our national security and allowing industry to fully invest their time and resources in a 

regulatory system that has long proven to be effective. Thank you for the opportunity to testify 

today. 

9 
98 

The Honorable Ron Johnson 

Chairman 

Senate Committee on Homeland Security & Governmental Affairs 

U.S. Senate 

Washington, DC 20510 

The Honorable Clair McCaskill 

Ranking Member 

Senate Committee on Homeland Security & Governmental Affairs 

U.S. Senate 

Washington, DC 20510 

June 20, 2018 

Re: ROUNDTABLE Examining the Chemical Facility Anti-Terrorism Standards Program 

The Agricultural Retailers Association (ARA) appreciates this opportunity to comment on the 

reauthorization of the Chemical Facility Anti-Terrorism Standards (CFATS) program. The 

authorizing legislation ofCFATS is set expire in January of2019. ARA members have a 

substantial interest in the reauthorization of the CFATS program. 

ARA is a not-for-profit trade association that represents the nation's agricultural retailers and 

distributors. ARA members provide goods and services to farmers and ranchers which include: 

fertilizer, crop protection chemicals, seed, crop scouting, soil testing, custom application of 

pesticides and fertilizers, and development of comprehensive nutrient management plans. Retail 

and distribution facilities are scatter throughout all 50 states and range in size from small familyheld businesses or farmers cooperatives to large companies with multiple outlets. 

It is estimated that there are approximately 6,500 agricultural retail facilities in the United States. 

Approximately one-third of these facilities arc regulated under the CFATS program because they 

store or handle products included in Appendix A: Chemicals ofinterest (COI)-namely 

anhydrous ammonia and/or ammonium nitrate. The agricultural retail sector accounts for about 

half(50%) of all CFATS regulated facilities. 

While the initial rollout of the CFATS program was challenging, ARA is pleased with the 

Department of Homeland Security's (DHS) efforts to improve the program and enhance 

stakeholder engagement. ARA members expended capital resources to comply with the 

1156 15th Street NW, Suite 500 1 Washington. D.C. 20005 

Phone: (202) 457-0825 1 Fax: (202) 457-0864 

!nfo@aradc.org 1 www.aradc.org 
99 

program, but there have been benefits from participation. Today, the industry is focused on the 

common goal to ensure the products are properly stored, handled, and used for their intended 

purpose. In considering the benefits of participation, the industry now has a better idea of the 

security risks at facilities, which allows for prioritization on the most high-risk tacilities. 

Furthermore, CF ATS allows us to build stronger relationships with our neighbors and 

communities. 

With the current authorization ofCFATS through HR 4007 expiring in January 2019, ARA 

supports a iour-year reauthorization that continues to provide industry with the regulatory 

certainty needed to make long-term facility investments and enables DHS to efficiently nm the 

program. 

Periodic reauthorization is important tor continued congressional oversight and review of the 

program. The last four years ofCFATS has been dominated by DHS simply trying to identify 

the universe of CF ATS regulated facilities and working to get them into the program. Now that 

most of that work has been accomplished, DHS's efforts arc now shifting more towards 

compliance and enforcement. A four-year reauthorization will allow Congress an opportune 

time to check-in on DHS and ensure it continues a cooperative approach to enforcement-which 

is most appreciated by the industry. 

We believe it is important that any reauthorization prohibits the disclosure of sensitive site 

security information to the general public, or to anyone who does not have a "need to know," or 

the required security clearance to obtain such information. The program must ensure that highly 

sensitive information is protected !rom individuals that might pose a security threat to the 

facility's employees or property. 

In addition, we strongly support robust public engagement and believe any changes to the 

CF ATS program, including Appendix A, should be done through proper notice-comment 

rulemaking. 

Finally, we ask that Congress provide a statutory framework for a CF A TS recognition program. 

A CFATS recognition program would be beneficial to both industry and DHS. In exchange for 

regulatory incentives, industry participants would self-regulate the requirements ofCFATS and 

DHS would be able to better utilize its limited resources on £'lcilitics that might not otherwise be 

complying with the regulation. 
100 

Many industries have stewardship programs that promote compliance with government 

regulations, including security regulations. The agricultural retail industry's stewardship 

program is ResponsibleAg. ResponsibleAg is a voluntary, industry-led stewardship program 

launched in 2015 with the goal of assisting agribusinesses to comply with federal environmental, 

health, safety, and security rules focused on the safe handling and storage offertilizer products. 

At the core of the program is a federal regulatory compliance assessment addressing current 

federal regulations. These assessments identifY any issues of concern, provide recommendations 

for corrective action if needed, and provide a robust suite of resources to assist in compliance. 

ResponsibleAg is designed to protect employees, first responders, and the general public through 

an organized and comprehensive program of periodic and thorough assessments. 

Almost 2,600 agricultural facilities have signed up with ResponsibleAg, 1,900 facilities have 

been assessed, and nearly I ,000 facilities have been certified. In the three years of existence, 

more than one-third of agricultural retail facilities have voluntarily joined ResponsibleAg 

Thank you again for this opportunity to comment and CF ATS reauthorization. ARA is thankful 

for the committee's inspection of the program and grateful for your work to make this good 

government program better through reauthorization. We look forward to working with the 

committee on this shared goal and a successful reauthorization of the CF ATS program. 

Sincerely, 

Kyle Liske 

Public Policy Counsel 

Agricultural Retailers Association 
101 

CHAMBER OF COMMERCE 

OF THE 

UNITED STATES OF AMERICA 

NEILL. BRADLEY 1(,15 l! STRU~T, 1'\i\V 

L~ ri\'L \'!CE Pru:SJD! :-..; r & 

C!!lE!· POLICY Oi·l·lCLR 

The Honorable Ron Johnson 

Chairman 

Committee on Homeland Security and 

Governmental Affairs 

lJ. S. Senate 

Washington, D.C. 20510 

\XI \SII!:-.lG'! 

(202) 

June 26,2018 

The Honorable Claire McCaskill 

Ranking Member 

DC 20tl62 

5310 

Committee on Homeland Security and 

Governmental Affairs 

U.S. Senate 

Washington, D.C. 20510 

Dear Chairman Johnson and Ranking Member McCaskill: 

The U.S. Chamber of Commerce appreciates the roundtable that the committee held on 

June 12, Examining the Chemical Facility Anti-Terrorism Standards Program. We strongly 

support reauthorizjng the Chemical Facility Anti-Terrorism Standards (CFATS) program-a 

regulatory effort that is administered by the Department of Homeland Security (Dl-!S) to enhance 

security at high-risk chemical facilities. 

It is important that Congress act expeditiously to extend CF A TS. The Chamber is part of 

the CFATS Coalition, which is composed of an array of associations and companies that are 

impacted by CFATS regulations. Coalition members represent major sectors of the U.S. 

economy, including chemical production, chemical distribution and storage, manufacturing, oil 

and gas refining, utilities, mining, and agricultural goods and services. These businesses are 

critical to the health of the American economy. The ·'Protecting and Securing Chemical Facilities 

from Terrorist Attacks Act of2014" (P.L. 113-254) will expire in January 2019. The Chamber 

supports a multiyear reauthorization to provide the owners and operators the certainty they need 

to make long-term planning and investment decisions. 

Reauthorization legislation should also improve CFATS. In particular, new legislation 

should safeguard sensitive security information. Terrorists and other malicious actors should not 

be given the keys to unlock the security of a facility. The Chamber supports strictly limiting 

access to sensitive information (e.g., control system schematics and chemical vulnerability data) 

to the owners and operators of a facility, cleared individuals, and DHS. Any new law that would 

weaken controls governing site security information would be a step in the wrong direction. 

CF A TS should be more transparent to the regulated community. DHS should better 

explain the Department's risk-tiering methodology to a facility's security principals. Industry 

organizations often tell the Chamber that this process is unnecessarily vague, which inhibits a 

covered site's security and resilience posture. In addition. the Chamber recommends that any 
102 

changes to the Appendix A list of approximately 300 chemicals of interest, or COl, remain 

subject to public notice and comment. 

The Chamber looks forward to continuing to work with your committee, DHS, and 

relevant stakeholders as legislation extending CF A TS is developed and moves forward. 

Sincerely, 

Neil L. Bradley 

cc: Members of the Committee on Homeland Security and Governmental Affairs 

2 
103 

Environmental Technology Council 

1112 16'" Street NW • Suite 420 • Washington DC 20036 • (202) 783-0870 

Roundtable Date/June 12, 2018 

The llonorable Ron Johnson 

Committee Chairman 

Senate Committee on Homeland 

Security & Government Amlirs 

340 Dirksen Senate Office 

DC 20510 

The l !onorablc Claire McCaskill 

Ranking Member 

Senate Committee on Homeland 

& Government A!Tairs 

340 Dirksen Senate Office Bldg. 

DC 20510 

Statement for the Record 

Senate Committee on Homeland Security and Government Affairs 

Roundtable the Chemical Facility Anti-Tcrrm·ism Standards Program 

Member McCaskill and Members of the Committee, 

the Environmental Council (ETC) would like to express its for 

the opportunity to submit a statement for the record on our change to the 

Chemical Facilities Anti-Terrorism Standards (CFATS) as part of the Department of 

Homeland Security Reauthorization bill. 

The ETC is the national trade association for the commercial hazardous waste 

management 

customers for the safe and c!Tcctivc treatment, and secure of 

hazardous wastes incineration and other advanced 

For the reasons listed below, ETC is that RCRA Part B permitted 

and Facilities (TSDFs) be added to the list of excluded 

f~Kilitics under 6 CFR § 27.llO(b) ol'thc CFATS 

Due to the broad definition of"chcmical J:1citity'' in CFATS, many ETC member 

operate hazardous waste management lltcilitics that arc subject to the CFATS 

program. Many of these same EJCilities hold under the Resource Conservation 

and Recovery Act (RCRA) that impose stringent security and safety procedures that 

duplicate CFATS requirements. Some of these redundancies inclnde emergency 

tracking and discrepancy 

customer" container and 

Plans. The RCRA regulations at 40 CFR Part 264 describe the many procedures 

TSDFs must follow: 

and Prevention requires that facilities be 

maintaim:cL and c>perated to minimize lhc possibility of' a 

any unplanned sudd~n or non-sudckn release of hazardous 
104 

waste constituents to air. soil, or surfi1ce water which could threaten human 

health or the environment. In addition. facilities must have an internal 

communications or alarm system cnpabk of providing immediate emergency 

instruction to l'acility personnel; a device. such as a telt:phone (immediately 

available at the scene of operations) or a hand-held two-way radio, capable of 

summoning emergency assistance !'rom local pol icc departments. fire 

departments, or state or local emergency response teams; portable fire 

c>.tinguishers, fire control equipment (including special extinguishing equipment, 

such as that using foam. inert gas, or dry chemicals), spill control equipment. and 

decontamination equipment: and water at adequate volume and pressure to 

supply water hose streams, or foam producing equipment, or automatic 

sprinklers. or water spray systems. 

• 40 CFR 264 Subpart D Contingency Plan and Lmcrg.cm:y Procedures requires 

that each facilit; must have a contingency plan and said plan must be designed to 

minimize hazards to human health or the environment !l·om tires, explosions. or 

any unplanned sudden or non-sudden release of lwzardous waste or hazardous 

waste constituents to air. soil, or surface water. The provisions of the plan must 

be: carried out immediately \vhenevcr there is a tire. explosion. or release of 

hazardous waste or hazardous waste constituents \\hich could threaten human 

health or the environment. 

• 40 CFR 264 Subpart E Manifest System, Recordkeeping and Reporting requires 

that ira facility 1-.;:ceives hazardous waste accompanied by a manifest, the 

maniJ~sl must be signed and dated to certify that the hazardous waste covered by 

the manifest was received. This section also requires other rccordh·cping and 

reporting of hazardous waste to ensure that the waste is properly accounted for 

and managed. 

• 40 CFR 264 Subpart I requires that colllainers must be made or or lined with 

materials which will not react with. and arc otherwise compatible with. the 

hazardous waste to be stored, so that the ability of the container to contain the 

waste is not impaired. If a container holding hazardous waste is not in good 

condition (e.g .. severe rusting. apparent structural dcll:cts) or if it begins to leak. 

the hazardous \\astc must be transf'erred t'rom this container to a container that is 

in good condition or manage the waste in some other way that complies with 

regulations. 

• 40 CFR 264 Subpart J l'ank System Standards require that tank systems be 

inspected to ensure no leakage. Inspection assessments must be kept on file at 

the facility ami must be reviewed and certi lied by a qualified protessional 

engineer. This assessment must determine that the tank system is adequately 

2 
105 

designed and has sufficient structural strength and compatibility with the waste(s) 

to be stored or treated, to ensure that it will not collapse, rupture. or t~1il. 

The CFATS regulations at 6 CFR § 27.110(b) exclude hazardous wastes except a 

limited subset of wastes identified asP and U listed hazardous wastes in 40 CFR § 

261.33 (P and U listed wastes). Since some ETC member companies operate facilities 

that manage P and U listed wastes, the cuiTent CFATS requirements are potentially 

applicable to their commercial waste management operations. In order to address this 

issue, ETC and its member companies seek to add RCRA permitted TSDFs to the list of 

excluded facilities due to the many redundancies that exist between CFATS and RCRA 

regulations. The requested revision is to modify 6 CFR § 27.11 O(b) by adding the 

following language in bold type below: 

Section 27.110 Applicability 

(a) This part applies to chemical facilities and to covered facilities as set 

out herein. 

(b) This part does not apply to facilities regulated pursuant to the Maritime 

Transportation Security Act of2002, Pub. L. 107-295 as amended; Public 

Water Systems, as defined by section 1401 of the Safe Drinking Water 

Act, Pub. L. 93-523 as amended; Treatment Works as defined in section 

212 of the Federal Water Pollution Control Act, Pub. L. 92-500, as 

amended; any facility owned or operated by the Department of Defense or 

the Department of Energy, or any facility subject to regulation by the 

Nuclear Regulatory Commission, or Treatment, Storage and Disposal 

Facilities as defined in section 3004(a) of the Solid Waste Disposal Act, 

Pub. L. 94-580 as amended, that has obtained a permit issued 

pursuant to section 3005. 

Although there are many RCRA permitted TSDFs, there only a small number of 

these facilities that actually manage a Chemical of Interest (COl) over the threshold and 

hence have been tiered by DHS. It is worth noting that even facilities that are not tiered 

by DHS may still be negatively impacted by the CFATS program since they experience 

the administrative burden to managing inventory of COI below the established threshold. 

To quantify the high cost of CF ATS compliance for RCRA permitted TSDFs, an 

ETC member company calculated that based on the amount of time they spend 

monitoring their systems to ensure they stay below thresholds and for maintaining the 

program at sites where they have security programs, they estimate they spend $80,000 

annually to comply with CF ATS. In terms of monitoring their systems to ensure they 

stay below thresholds, the company noted the following factors were considered when 

calculating the annual compliance cost: 

• How many sites could conceivably manage chemicals regulated under the 

program? 

3 
106 

• How long it took trained compliance employees to review systems on a daily 

basis to determine whether or not the facility was approaching a threshold? 

• How many instances occurred where action had to be taken to avoid a facility 

exceeding a threshold (e.g., diverting an incoming waste, or shipping out a waste 

already on-site)? 

• How many man-hours were involved from a compliance and operating standpoint 

to avoid having a threshold exceedance? 

• Estimating costs for re-routing waste to other facilities (mostly transportation). 

• Factoring manpower hours for the above work against general salary rates. 

As for those RCRA TSDFs currently governed by CF ATS, the company noted 

that the following factors were considered when calculating the annual compliance cost: 

• Administrative salary hours and costs for maintenance and updating of security 

plans; 

• Salary hours and costs for training of new employees and refresher training of 

existing personnel; 

• Administrative costs for recordkeeping. 

These costs do not result in any increased safety or protection against terrorist 

activity particularly since the RCRA permitted TSDF already has in place all RCRA 

requirements for security, inventory tracking, and employee training. These cost and 

administrative burdens could be saved by adding commercial RCRA permitted TSDFs to 

the list of excluded facilities under 6 CFR § 27.11 O(b) of the CFATS regulations. 

4 
107 

Statement for the Record 

of Ross Eisenberg 

Vice President 

Energy and Resources Policy 

National Association of Manufacturers 

before the Senate Committee on Homeland Security and Governmental Affairs 

on "Examining the Chemical Facility Anti-Terrorism Standards Program" 

June i 2, 2018 
108 

STATEMENT FOR THE RECORD OF ROSS EISENBERG 

BEFORE THE SENATE COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL 

AFFAIRS 

Roundtable on: 

"Examining the Chemical Facility Anti-Terrorism Standards Program" 

JUNE 12,2018 

The National Association of Manufacturers (NAM) is the nation's largest 

industrial trade association, representing 14,000 small, medium and large 

manufacturers in every industrial sector and in all 50 states. Our members have 

a substantial interest and concern regarding requirements of facility site security 

programs, including compliance with the Department of Homeland Security's 

(DHS) Chemical Facility Anti-Terrorism Standards (CFATS) program. The current 

CFATS program, established by the Protecting and Securing Chemical Facilities 

from Terrorist Attacks Act (P.L. 113-254), will sunset on January 19, 2019. The 

NAM strongly supports efforts to ensure the continuity of the CFATS program. 

However, as Congress begins to consider reauthorization of the statute, 

manufacturers want to ensure legislation to reauthorize CFATS will provide 

regulatory certainty and not harm the intent of the program. 

Manufacturers are deeply committed to the communities in which they live 

and serve. Across the nation, they have demonstrated a firm resolve in protecting 

critical infrastructure, their facilities and key assets from terrorist exploitation. 

Securing the homeland is a partnership that involves government at all levels, the 

private sector and concerned citizens across the country that are committed to 

action. This is why our member companies prudently make security investments 
109 

and engage in risk management planning; it is something that is required by law 

and something that our members consider a core component of their business 

operations. The NAM represents 2,152 CFATS-regulated facilities that span 

across major industrial sectors, such as oil and gas refining; chemical production 

and distribution; mining; agricultural goods and services; and electrical utilities. 

As CFATS-regulated facilities, these sites are engaged in the manufacturing, 

storage and distribution of what DHS considers chemicals of interest (COl). 

Prior to the CFATS program's authorization in 2014, DHS's authority to 

regulate high-risk facilities was dependent on Congress approving an act of 

appropriations. Since its enactment in 2007, CFATS was bound to the 

appropriations process, and this acted as a barrier to making needed 

improvements to the program. DHS and industry were thrust into an environment 

steeped with regulatory uncertainty. Such programmatic uncertainty is 

detrimental because industry relies on stability to make sound, long-term 

investments and meet regulatory requirements. However, the authorization of 

CFATS in 2014 represented a turning point for the program and set an important 

precedent-namely, removing CFATS from the appropriations track allowed 

Congress, for the first time, to make significant improvements to the program. 

These improvements included the following: 

• Mandating congressional oversight, requiring the Secretary of 

Homeland Security and Comptroller General to provide Congress with 

progress updates on the implementation of the CFATS program. 

2 
110 

• Fostering continued information sharing between manufacturers and 

state and local officials to enhance security. 

• Requiring DHS to develop a security risk assessment approach and 

revised tiering methodology for CFATS-regulated facilities that 

considers facility vulnerabilities and threat information as well as potential 

economic harm and loss of life. 

• Modernizing the screening process for individuals seeking access to 

secure facilities. Utilization of the Personnel Surety Program eliminates 

duplicative regulatory requirements for facility owners and operators who 

need to vet individuals against the terrorist screening database. 

• Establishing an Expedited Approval Program (EAP) for Tier 3 and 4 

facilities. The EAP enables lower-tiered facilities to accelerate their site 

security plans through DHS's approval process. 

The NAM Supports a Multiyear CFATS Reauthorization 

Manufacturers believe that the multiyear congressional authorization of 

the CFATS program in 2014 was a pivotal moment for the longevity of the 

program. The NAM believes Congress should do so again. A multiyear 

reauthorization would continue to provide DHS with the ability to efficiently and 

effectively operate the CFATS program. Importantly, manufacturers would also 

greatly benefit from such regulatory certainty. This would enable industry to 

confidently make appropriate, economically justifiable, long-term investments to 

protect facilities' threat and vulnerability conditions. 

3 
111 

CFATS Reauthorization Must Safeguard Facility Site Security Information 

The current CFATS statute requires sharing information "with state and 

local government officials possessing a need to know and the necessary security 

clearances, including law enforcement officials and first responders."1 The NAM 

supports continued information sharing between manufacturers and federal, state 

and local officials to enhance security. 

Manufacturers are committed to doing their part to protect their facilities, 

personnel, surrounding communities and the environment. According to an NAM 

member company, information applicable to the safe response to an incident is 

shared with appropriate response organizations based on risk. With regards to 

unplanned events, information such as chemical inventories, facility layout and 

available onsite emergency equipment/capabilities are shared with appropriate 

first responders to ensure they are adequately prepared if an emergency arises. 

Facilities collaborate with agencies to plan and execute drills and exercises, as 

well as regularly participate at local emergency planning meetings. 

However, it is imperative that the submitters of confidential information to 

the government and first responders have a corresponding right to expect that 

the confidentiality of such information shall be preserved and properly protected 

against public disclosure. CFATS reauthorization should not expand Section 

2103 of the statute ("Protection and Sharing of Information") to permit public 

disclosure of facility site security information. Chemical-threat vulnerability 

information, such as security system designs, control system schematics, worst1 Protecting and Securing Chemical Facilities from Terrorist Attacks Act of2014. Pub. L. 113-254. Sec. 

2103: Protection and Sharing oflnforrnation. 

4 
112 

case scenario discharge data, COl records and tactical response information for 

emergency personnel, must be safeguarded from potential threats or individuals 

actively seeking to do harm. The only individuals that should have access to 

facility site security information are those who have appropriate security 

credentials and clearances. The NAM is concerned about the resultant harm to 

the industry, facility personnel, the surrounding community and environment and 

the nation at large when disclosure is indiscriminate and fails to protect sensitive 

and confidential business information. 

Manufacturers Must Be Consulted on Proposed CFATS Regulatory 

Changes 

The NAM believes that public participation in the agency decision-making 

process is an essential mechanism that ensures political accountability. Starting 

with the Administrative Procedure Act and enhanced by a series of executive 

orders, rules and procedures spanning multiple presidential administrations, the 

federal government has recognized the importance of public participation in 

rulemaking and non-regulatory proceedings. 

In this same vein, manufacturers must continue to be consulted on 

proposed regulatory changes to the CFATS program. For example, if DHS 

suggests alterations to Appendix A: Chemicals of Interest, these alterations must 

be subject to notice and comment rulemaking. Stakeholder engagement and 

participation is vital to the regulated community because changes to Appendix A 

could impact whether facilities are considered CFATS-regulated sites. In 

5 
113 

addition, DHS's decision to modify Appendix A must be based on level of risk, 

sound scientific data and a comprehensive cost-benefit analysis. 

Conclusion 

Manufacturers have established a strong record of facility security and 

strive to further protect the communities in which they live and serve. Facility 

security will remain a top priority for manufacturers, and as such, the NAM 

supports the continuity of the CFATS program. CFATS reauthorization must 

provide manufacturers with the regulatory certainty to make the necessary 

investments in their facilities and meet compliance requirements. 

6 
114 

Post-Hearing Questions for the Record 

Submitted to David Wulf 

From Senator Heidi Heitkamp 

"Examining the Chemical Facility Anti-Terrorism Standards Program" 

Topic: Guidance 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Heidi Heitkamp 

Committee: HOMELAND SECURITY (SENATE) 

Question: As you know, cyberattacks rely on vulnerabilities to exploit and infiltrate 

systems and networks, and these vulnerabilities are created and compounded when 

people use bad cyber practices. Systems are only as secure as the weakest link, and that is 

why it is critical that employees have a robust understanding of the steps they need to 

take to navigate their systems and networks safely and securely. 

How does DHS factor in a facility's plans and procedures to educate its employees on the 

best cyber hygienic practices? What type of guidance is provided to the facilities? Is 

enough attention being provided in this area? 

Response: Facilities determined to be high-risk under the CF A TS program are required 

to implement security measures to satisfy 18 risk-based performance standards (RBPS). 

RBPS 8- Cyber requires facilities to implement appropriate cybersecurity measures to 

prevent unauthorized onsite or remote access to critical cyber systems. 

To assist facilities in satisfying RBPS 8, DHS published the RBPS Guidance Document, 

which includes an appendix containing cybersecurity measures, cybersecurity 

considerations, best practices, and a list of resources and available training, such as those 

offered by the US Computer Emergency Readiness Team (CJ:RT) and National Institute 

of Standards and Technology (NIST). In addition, the Department has published a fact 

sheet on RBPS 8 and has cybersecurity professionals and Chemical Security Inspectors 

available for assistance and consultation. 

In evaluating RBPS 8, DHS first determines what types of systems the facility has in 

place that could affect the security of the chemicals of interest (COl). Based on this 

determination, DHS requires different levels of cybersecurity measures. These may 

include elements such as access control procedures utilizing the concept of least 

privilege, password management, system boundaries, network monitoring, virus 

protections, and incident reporting and response. 
115 

DHS acknowledges that often the human component is the most vulnerable aspect of a 

cyber system. As a result, all facilities with critical systems must implement 

cybersecurity policies, procedures, and training to ensure appropriate education and 

awareness of all employees with access to cyber systems. DHS confirms that facilities' 

cybersecurity training programs include topics such as a cybersecurity overview, roles 

and responsibilities, password procedures, acceptable practices, how to identify 

suspicious activity, and to whom to report suspected inappropriate or suspicious activity. 

DHS also ensures that individuals receive this training prior to or shortly after access is 

gained and that training is refreshed and reinforced on a regular schedule. 
116 

Question: Technology is continuously evolving, and I think it's important that DHS is 

regularly engaged with companies that offer innovative solutions. In North Dakota, 

DiamondB Technology Solutions has made notable advancements in the area of plume 

modeling. Using 3-D modeling, sensors, real-time maps and cloud technology, 

DiamondB's technology can locate chemical plumes within a few minutes, giving first 

responders the information they need to warn residents, take action, and save lives. A 

TechLink article published earlier this year, which I am submitting for the record, 

demonstrates how DiamondB's technology was able to provide real-time plume modeling 

to the West Fargo Fire Department in response to a chemical incident. 

From a broad DHS perspective, as technologies evolve, what steps does DHS take to 

identify and capitalize on innovative solutions? Do you believe DHS is providing enough 

attention in this area? 

With respect to plume modeling and the CF A TS program, are some facilities required to 

include plume modeling in their Site Security Plans? If so, how does DHS evaluate the 

quality of their plume modeling? 

Response: The DHS Science & Technology Directorate (S&T) is charged with 

delivering effective and innovative methods and solutions to meet the critical 

requirements and needs of both DHS operational components and the Homeland Security 

Enterprise (HSE). S&T has a number of initiatives that focus on identifying and 

capitalizing on innovative solutions. 

Specifically, S&T utilizes partnerships across federal, international, laboratory, academic, 

and private sector communities to maintain awareness of innovative activities and 

programs that may be leveraged for homeland security issues. In addition, DHS 

facilitates connections between the DHS operational components, the research and 

development community, and industry, so relevant parties across the Department are 

aware of innovative commercial products and can work to meet needs of operational end 

users. 

Furthermore, S&T's technology scouting program is continually searching for innovative 

ideas and solutions that meet DHS priority research and development needs. S&T scouts 

for existing commercial products that meet component operational requirements or can 

be readily adapted. If existing commercial or near-market solutions are not identified, 

S&T initiates its research and development process to evaluate options and pursue 
117 

Question#: 2 

Topic: Solutions 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Heidi Heitkamp 

Committee: HOMELAND SECURITY (SENATE) 

appropriate technology development paths. Within this process, S&T engages a broad 

range of industry innovators to develop or adapt technologies for homeland security 

applications. S&T's efforts are tailored to all sizes and types of industry innovators and 

designed to span the entire R&D process, from concept ideation to homeland security 

operators in the field. 

The Small Business Innovation Research (SBIR) program provides funding to 

spur small business ideation, prototype development, and commercialization of 

innovative technologies for homeland security. 

S&T's Long-Range Broad Agency Announcement is a standing, open invitation 

to businesses, R&D laboratories and organizations, and academic universities to propose 

creative concepts or prototypes that address DHS needs. 

S&T also hosts Prize competitions and challenges to inspire and mobilize a wide 

spectrum of innovators to address homeland security challenges through public crowdsourcing. Prizes may be open to companies of all sizes, entrepreneurs and startups, 

citizen inventors, and university student communities. 

Finally, the Silicon Valley Innovation Program, aimed at the startup community, 

provides a fast-track process for prototype development. 

With respect to plume modeling and the CF ATS program, DHS does not require facilities 

to include plume modeling in their Site Security Plans. 

The Interagency Modeling and Atmospheric Assessment Center (IMAAC), managed by 

DHS/FEMA, is an interagency consortium of federal agencies that research and produce 

atmospheric transport and dispersion modeling for planning and response purposes. 

These resources are available to federal, state, local, tribal, and territorial (FSL TT) public 

safety authorities for planning support purposes ( e.g.,CF ATS facility exercises and 

incident response). TMAAC includes Lawrence Livermore National Laboratory's 

National Atmospheric Release Advisory Center (NARAC),) which conducts active 

research on the next generation of atmospheric transport and dispersion modeling 

capabilities. 
118 

Post-Hearing Questions for the Record 

Submitted to David Wulf 

From Senator Claire McCaskill 

"Examining the Chemical Facility Anti-Terrorism Standards Program" 

Question#: 3 

Topic: Intersect 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: I The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

Question: How does the CFATS program intersect with the relevant regulatory 

frameworks administered by the following federal agencies: 

Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); 

Environmental Protection Agency (EPA); 

Occupational Safety and Health Administration (OSHA); 

Department of Transportation (DOT); and 

United States Coast Guard (USCG)? 

Response: The Infrastructure Security Compliance Division (ISCD) ofDHS, which 

administers the CF ATS program, routinely coordinates with the Departments and 

Agencies listed on chemical security issues. This includes active participation in the 

Chemical Sector Government Coordinating Council; memoranda of understanding and/or 

shared protocols with the Nuclear Regulatory Commission (NRC), Department of 

Defense, Department of Energy, and Environmental Protection Agency (EPA) regarding 

CF ATS exemptions; and routinely working with A TF to coordinate and share 

information on the regulation of facilities possessing explosives and explosive precursor 

chemicals. Additionally since 2014, DHS, EPA, OSHA, and ATF have made a concerted 

effort to work together to enhance the safety and security of chemical facilities and 

reducing risks associated with hazardous chemicals to facility workers and operators, 

communities, and responders. 

While many CF ATS covered facilities are regulated by other federal programs, CF A TS 

covers only the chemical facilities that arc determined to be at the highest risk for 
119 

I 

Question#: 3 

Topic: Intersect 

Hearing: 1 Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

security incidents and ensures those facilities have the security measures appropriate to 

their high level of risk. CF A TS is thus a complement to other programs that regulate 

safety and those with security requirements insufficient to cover the high level of risk 

presented by a CFATS covered facility. CFATS covered facilities also can take credit for 

applicable security measures implemented for other regulatory programs in their CF ATS 

site security plans. 

For example, many of the CFATS Release chemicals of interest (COI) are also part of the 

EPA's Risk Management Program (RMP). RMP is focused on protecting the 

environment and the health and safety of populations living in areas near to facilities 

possessing hazardous chemicals, and requires facilities that use extremely harmful 

substances to develop a Risk Management Plan. EPA RMP safety regulations 

complement the CF ATS security measures at CFATS covered chemical facilities tiered 

for release (approximately 28% of the CF A TS covered population). Further, measures 

that facilities put in place for RMP are sometimes used in their CFATS Site Security 

Plans. 

In some instances, DHS covers chemicals that may not be fully covered by other security 

regimes. For example, both ATF and DHS have the authority to regulate facilities that 

store, ship, sell, and/or manufacture Division 1.1 explosives. The ATF regulation does 

require some security measures to include requirements related to the conduct of 

inventories, the reporting of thefts/losses, and magazine-locking standards; however, the 

monitoring and detection standards in the CF A TS regulation are more robust than those 

required under the A TF regulations. Additionally, A TF regulations apply only to 

materials whose primary or common purposes is to function by explosion. A TF 

regulations do not apply to improvised explosive device (lED) precursor chemicals such 

as ammonium nitrate. CF A TS covers the lED precursor chemicals that ATF does not 

regulate. DHS meets with ATF on a quarterly basis for coordination and collaboration 

purposes. There are very few CFA TS covered facilities for explosives regulated by ATF. 

Facilities regulated by the Coast Guard under the Maritime Transportation Security Act 

of 2002 (MTSA) arc statutorily exempt from CF A TS, but USCG and DHS have worked 

together since the inception of CF A TS. USCG input and lessons learned from MTSA 

implementation were integral to the development of the CFATS regulations. As part of 

this coordination, a USCG dctailee is embedded with ISCD. 
120 

Question#: 4 

!----

I 

I 

Topic: Exemptions 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: I HOMELAND SECURITY (SENATE) 

Question: Do you support adding or removing exemptions to the CF i\ TS program? If 

so, please explain. If not, why not? 

Response: The Department is committed to continuing to explore ways to streamline 

CFATS while also ensuring that security is in place at high-risk chemical facilities_ DIIS 

believes that prior to making changes to the current statutory exemptions it may be worth 

studying the vulnerability of facilities that may be exempted or are currently exempt from 

the program to determine whether there is a gap that poses a risk to the American public. 
121 

! 

Question#: 5 

Topic: Inspectors 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

Question: Please describe the training that CFATS chemical security inspectors receive. 

How often is the training reevaluated and updated? Are there any plans currently in the 

works to adjust or enhance the curriculum? 

What specific training do CF A TS chemical security inspectors receive in order to 

properly conduct their evaluation of cybersecurity-related performance standards? 

Response: Developing and maintaining the knowledge of our chemical security 

inspectors (CSis) is a priority for the Department, and program-specific training is a 

constant and continuous process throughout an inspector's career. DHS updates and 

adjusts the content of the various types ofCSI training as the CFATS program evolves, as 

· policies and processes arc issued or honed, and in response to trends identified in 

stakeholder feedback and by DHS supervisors, analysts, and inspectors. 

The CSI training program in place today is made up of several types of training and 

learning elements: 

I. CSI Inspections Course, a 16-module series with three practical demonstrations of 

the business process systems the CSis utilize to conduct and capture their work. The 

course spans seven days and is taught by seasoned Supervisory CSis. Each student must 

pass an oral exam on the CFATS regulatory process as well as two written exams (a midcourse and final exam) to ensure mastery of the materials. Current modules include topics 

such as the RBPS and regulation, inspections procedures, principles of physical security, 

and how lSCD inspects cyber measures. 

2. On-the-job practical training. Following the Inspections Course, CSis begin onthe-job training where they work with supervisors, senior inspectors, and seasoned 

inspectors to gain the practical experience needed to function as an inspection team 

member and eventually an inspections team lead. 

3. Continuing Education. A series of fifteen on-line courses is assigned to each new 

inspector to be completed within the first six months as part of their on-the-job training 

program. Topics focus primarily on the regulation and various physical security measures 

with which inspectors must be familiar, and include chemical industry safety, closed 

circuit TV, and intrusion detection systems. 

4. Refresher and policy-specific training. ISCD regularly performs refresher or 

topic-specific training performed during regional and national all-hands meetings, 
122 

Question#: 5 

Topic: Inspectors 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

conducts monthly teleconference/webinar meetings with all inspectors to share best 

practices, and updates internal guidance for best practices on inspections. 

In addition to these job-specific trainings, inspectors must complete DHS mandatory 

training requirements, such as preventing workplace harassment and records management 

training. 
123 

Question#: 6 

Topic: Approach 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

Question: What is DHS's approach to ensuring cybersecurity at high-risk chemical 

facilities? Why is cybersecurity included in the CFATS program? 

Response: Within the CFATS program, cybersecurity is an essential component in 

managing overall risk for a facility. Attackers conducting malicious attacks on critical 

systems could result in theft, diversion, release, or sabotage of chemicals of interest. 

High-risk chemical facilities are required to have a comprehensive approach of 

appropriate security policies, practices, and people to prevent, protect, respond to, and 

recover from incidents helps deter cyber sabotage. 

Facilities determined to be high-risk under the CFATS program are required to 

implement security measures to satisfy 18 risk-based performance standards (RBPS). 

RBPS 8 - Cyber requires facilities to implement appropriate cybersecurity measures to 

prevent unauthorized onsite or remote access to critical cyber systems. Facilities detail 

their cybcrsccurity measures in their site security plans. Many facilities utilize cyber 

systems that if attacked could cause a release of COl or assist in a theft or diversion of 

COL These systems may include control systems, inventory management systems, 

business systems which manage the ordering and/or shipping COT, physical security 

systems such as cameras, alarms, and access control systems. 

In evaluating RBPS 8, DHS first determines what types of systems the facility has in 

place that could affect the security of the COL Based on this determination, DHS 

requires different levels of cybersecurity measures. This include elements such as 

cybersecurity policies and procedures, cybersecurity training, access control procedures 

utilizing the concept of least privilege, password management, system boundaries, 

network monitoring, personnel security, virus protections, business continuity and 

disaster recovery, lifecycle management, audits, and incident reporting and response. 

DHS inspects facilities to ensure they have cybcrsecurity measures appropriate to protect 

their critical cyber systems and satisfy RBPS 8. 
124 

I 

Question#: 7 

Topic: Steps 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

Question: What steps has DHS taken to improve communication, coordination, and 

emergency response planning among the Department, federal, state, and local emergency 

responders, and covered facilities? 

Response: First responders play an irreplaceable role in the safety and security of local 

communities, and DHS has gone to great lengths to make sure information on CFATS 

covered facilities in their jurisdictions is available to them both through the Department 

and through the facilities themselves. The Department conducts extensive outreach to 

educate Stale, local, fusion center and first responders on the CF A TS program and to 

make them aware of CF A TS facilities in their areas of responsibility. To guide this effort, 

the Department develops an annual CFATS Outreach Implementation Plan, which 

specifically addresses regular engagement with State and local officials to include State 

Emergency Response Commissions (SERCs)!Tribal Emergency Response Commissions 

(TERCs) and Local Emergency Response Committees (LEPCs). As part of this outreach 

with State, local, and tribal officials, DHS offers to share lists ofCFATS-covered 

facilities. If the officials have lists of facilities that may fall under the CFATS regulation 

that can be shared with the Department, DHS otTers to compare lists in order to identify 

potential chemical facilities of interest and create a common operating picture of facilities 

in the region. 

The Department continues to make CF A TS data available via the Infrastructure 

Protection (IP) Gateway Executive Order 13650 Portal. First responders and Federal, 

State, local, tribal, and territorial governments who have a need to know arc able to view 

facilities in their area of responsibility. The portal is a geospatial permission based 

platform where CFATS data is available in a For Official Usc Only (FOUO) layer and a 

Chemical-terrorism Vulnerability Information (CVI) layer. The FOUO access allows 

users to view information on a chemical facility (such as name, location, and geospatial 

information) within their State, county, and surrounding counties, whereas CVI access 

includes additional information, such as CFATS tiers. Where first responders have been 

reluctant to request an IP Gateway account or prefer access to the information via other 

means, DHS has provided electronic or hard copy lists of facilities and their chemical 

information to authorized individuals with a need to know. 
125 

! 

Question#: 8 

Topic: Tiering 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: · The Honorable Claire McCaskill 

Committee: I HOMELAND SECURITY (SENATE) 

Question: What steps has DHS taken to increase transparency in the CF ATS tiering 

methodology? 

Response: DIIS strives for transparency in tiering, balancing understandable interest in 

the process with security considerations. While the Department aims to be transparent, 

we must be mindful not to create a tool for an adversary to identify and locate facilities 

that have the potential to create the highest consequence events. 

DHS has publicly shared many details of the tiering methodology and continues to 

provide many opportunities for facilities to understand their tier. DHS worked with 

industry in the development of all elements of the current methodology, to include the 

data that facilities submit to allow DHS to assess their risk. DHS published a fact sheet 

on tiering that describes every element the Department considers in assessing facility 

risk. In addition to this effort, DHS streamlined the surveys that facilities submit and 

improved the user interface. DHS only collects the information needed to make the risk 

determination; the elements collected in the Top-Screen are the specific data points that 

are used for assessing a facility's risk. 

DHS assesses each facility on a case-by-case basis using the data that that facility 

submits. As each facility is assessed based on its specific information, the values used for 

each facility's risk score are unique to that facility. If after reviewing the available tiering 

resources a facility has questions about its risk determination, DHS meets (in-person or 

via phone) with a facility/company to discuss its individual risk determination and its 

unique clements (e.g. population, location, chemical quantities). 

DHS has conducted extensive outreach to ensure facilities understand the rationale 

behind their tier. Engagement efforts included eight in-person presentations across the 

country to demonstrate the tools and explain how risk is determined for each of the 

various security issues. DHS also hosted two webinars that discussed how risk 

determinations are made and what the main drivers oftiering changes were from the 

previous tiering engine to the enhanced tiering engine. Invitations to the webinars were 

provided to all registered facility representatives. This presentation remains available 

online through the CFATS Knowledge Center. The Department also briefed the tiering 

methodology at numerous industry conferences and via a number ofwebinars hosted by 

industry associations. Further, DHS discussed the tiering methodology at the 2017 

Chemical Sector Security Summit, held in Houston, TX, with approximately 500 

attendees. The Department continues to discuss the tiering methodology publicly, 

including at the 2018 DHSChemSecurityTalks the Department is hosting this summer. 
126 

~Question#: 8 

Topic: Tiering 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

~ .. 

Attendees at the DHSChemSecurityTalks are also being given the opportunity to make an 

appointment to talk with a CF A TS representative one-on-one about the specifics of their 

facility's tiering. 

Finally, if a facility is considering making a change to its operations, DHS has and will 

continue to discuss with facilities how these changes could impact (increase or decrease) 

its risk. This includes working with companies that are considering new facilities or 

bringing in new chemicals to an existing facility. 
127 

Question#: I 9 

Topic: I System 

I 

Hearing: I Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: ! The Honorable Claire McCaskill 

Committee: 1 HOMELAND SECURITY (SENATE) 

' 

Question: What steps is DHS taking to increase the automation of and access to the 

scientific and mathematical formulas underpinning its threat modeling system? 

Response: DHS has taken many steps to increase the automation of the tiering process 

and achieve efficiencies. DHS's risk engine is almost fully automated. Prior to CSAT 2.0 

implementation, the tiering process took over 300 days from the Top-Screen submission 

to tier notification. The process now takes an average of 11 days from facility submission 

to provide a facility a tier notification. 

DHS collects the unique data points from each chemical facility of interest through the 

electronic Top-Screen survey, which is located within the online Chemical Security 

Assessment Tool (CSAT) suite of tools. This data is automatically transferred to the 

classified risk engine where the data is used to calculate vulnerability, consequence, and 

threat scores. The consequence value is the loss of human life. The classified threat 

values are informed by the intelligence community and dependent on the chemical and 

facility location (i.e. urban or rural). The automated risk score is a function of the 

vulnerability, consequence, and threat values. The tier level assigned to a facility is based 

on the risk score. Each tier level is associated with a classified range of risk scores. The 

end risk tier is manually moved from the classified system to the unclassified system, so 

that the tier can be sent to the respective facility through CSAT. 

Other than the manual movement of the risk tier from the classified system to the 

unclassified system, the only other manual portion of tiering is a DHS eyes-on review of 

the data the facility enters in the Top-Screen. To help prevent incorrect risk 

determinations, the Department provides a human review of the data elements provided 

by a facility to make sure the data elements make sense for the type of facility and 

chemical reported by a facility. When potential errors are noted, a facility is contacted 

and, when appropriate, a facility submits a corrected Top-Screen. 1 

DHS strives for transparency in tiering, balancing understandable interest in the process 

with security considerations. While we aim to be transparent, we must be mindful not to 

create a tool for an adversary to identify and locate facilities that have the potential to 

create the highest consequence events. DHS has publicly shared many details of the 

1 DHS also retains the authority to apply additional reviews by our subject matter experts to tiering results, 

to account for unique circumstances if necessary, although exercising this authority is not part of our tiering 

methodology or standard business process, 
128 

I Question#: 9 

Topic: System 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

"--··-

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

tiering methodology and has provided and continues to provide many opportunities for 

facilities to understand their tier. DHS worked with experts from academia, government, 

and industry in the development of all elements of the current methodology. 

DHS has been speaking publically about the methodology since 2016. The discussions 

took place at many engagements, to include the annual Chemical Sector Security 

Summits, eight tiering roll-out events across the country in Fiscal Year 2017, numerous 

industry stakeholder conferences, and multiple webinars. The remarks at these events 

specifically discuss the threat variable, which is informed by the intelligence community 

and derived from DHS's Science and Technology's Chemical Threat Risk Assessment 

(CTRA). 

In addition to providing details on the threat score, the Department has also shared details 

on how vulnerability and consequence are calculated and the data points necessary for 

those clements. Since each risk score is unique to each chemical facility of interest, the 

Department continues to hold one-on-one consultations to discuss how each element 

impacted the facility's overall risk score and tier. DHS has and will continue to work to 

ensure that facilities understand the rationale behind their specific tier. 
129 

Question#: I I 0 

i 

Topic: Leverage 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMFI •NO SECURITY (SENATE) 

Question: How does CFATS currently leverage industry stewardship programs, and how 

could these programs be further leveraged in the future? 

Response: The Department applauds the efforts of the chemical industry to improve the 

safety and security of chemical facilities through industry stewardship program. CF ATS 

covers only the highest-risk chemical facilities, and the substantial majority of facilities 

that report chemicals of interest to the Department are determined to not be high-risk and 

consequently arc not covered by CFATS. The chemical industry's voluntary efforts to 

secure these facilities is therefore an important e!Tort towards safeguarding our nation's 

chemicals. DHS provides and promotes numerous security resources that the chemical 

industry can use on a voluntary basis to secure their facilities. We arc always interested in 

partnering with industry members to improve these resources and to promote security 

solutions that increase the resiliency of our nation's chemical industry and the safety and 

security of our communities. 

Under CFATS, DHS allows high-risk facilities to submit Alternative Security Programs 

(ASP) in lieu of Site Security Plans (SSP) to allow a tailored approach to meeting the 18 

risk-based performance standards. Some industry associations have developed ASP 

templates that take credit for and identify measures used in stewardship programs. Other 

facilities have leveraged existing security or safety plans by updating them to account for 

CF ATS requirements. DHS welcomes other ideas, to include suggestions for incentives, 

on how industry stewardship programs can best be used to improve security at chemical 

facilities. The Department is also open to exploring whether industry stewardship 

programs can be leveraged at CF A TS covered facilities but encourages careful study of 

any proposals that would reduce the frequency of reporting or regulatory inspections to 

determine if the proposed incentive could be offered without compromising security or 

impeding the current flexibility of the CFATS program. 

If DHS does offer incentives to high-risk facilities for participation in an industry 

stewardship program, there should be a clear con-elation between the security value 

created by participation in the stewardship program and the scope of benefits available to 

a facility or company for such participation. For example, given the anti-tenorism focus 

of CF ATS, regulatory incentives may be appropriate for participation in stewardship 

programs that require a security posture very similar to that currently required of covered 

facilities under CF A TS but should not apply to stewardship programs focused mostly on 

safety and little on security. 
130 

Æ 

Question#: II 

Topic: Programs 

Hearing: Examining the Chemical Facility Anti-Terrorism Standards Program 

Primary: The Honorable Claire McCaskill 

Committee: HOMELAND SECURITY (SENATE) 

Question: Does DHS have any reservations about incorporating aspects of stewardship 

programs into CF ATS that prevented the Department from taking such actions earlier? If 

yes, please discuss. 

Response: The CF A TS program has made great strides over the last four years, and with 

the implementation of the enhanced tiering methodology and completion of the backlog 

of security plans has entered a steady state of operations. This presents us with an 

opportunity to begin studying ways to enhance our program. The Department 

recommends careful study of any proposals to incorporate aspects of stewardship 

programs into CF ATS to ensure that such a program does not compromise security, limit 

the Department's ability to ensure that facilities are meeting their obligations under 

CFATS, or impede the current flexibility of the CFATS regulation. In the past, DHS has 

worked with industry associations, upon request, as they developed Alternative Security 

Program templates.