U.S. GOVERNMENT PUBLISHING OFFICE

35–379 PDF WASHINGTON : 2019

SECURING OUR NATION’S CHEMICAL FACILITIES: 

BUILDING ON THE PROGRESS OF THE CFATS 

PROGRAM 

HEARING 

BEFORE THE

COMMITTEE ON HOMELAND SECURITY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED SIXTEENTH CONGRESS 

FIRST SESSION 

FEBRUARY 27, 2019 

Serial No. 116–3 

Printed for the use of the Committee on Homeland Security 

Available via the World Wide Web: http://www.govinfo.gov 


Congress.#13
(II) 

COMMITTEE ON HOMELAND SECURITY 

BENNIE G. THOMPSON, Mississippi, Chairman 

SHEILA JACKSON LEE, Texas 

JAMES R. LANGEVIN, Rhode Island 

CEDRIC L. RICHMOND, Louisiana 

DONALD M. PAYNE, JR., New Jersey 

KATHLEEN M. RICE, New York 

J. LUIS CORREA, California 

XOCHITL TORRES SMALL, New Mexico 

MAX ROSE, New York 

LAUREN UNDERWOOD, Illinois 

ELISSA SLOTKIN, Michigan 

EMANUEL CLEAVER, Missouri 

AL GREEN, Texas 

YVETTE D. CLARKE, New York 

DINA TITUS, Nevada 

BONNIE WATSON COLEMAN, New Jersey 

NANETTE DIAZ BARRAGA ́ N, California 

VAL BUTLER DEMINGS, Florida 

MIKE ROGERS, Alabama 

PETER T. KING, New York 

MICHAEL T. MCCAUL, Texas 

JOHN KATKO, New York 

JOHN RATCLIFFE, Texas 

MARK WALKER, North Carolina 

CLAY HIGGINS, Louisiana 

DEBBIE LESKO, Arizona 

MARK GREEN, Tennessee 

VAN TAYLOR, Texas 

JOHN JOYCE, Pennsylvania 

DAN CRENSHAW, Texas 

MICHAEL GUEST, Mississippi 

HOPE GOINS, Staff Director 

CHRIS VIESON, Minority Staff Director 

(III) 

C O N T E N T S 

Page 

STATEMENTS

The Honorable Bennie G. Thompson, a Representative in Congress From 

the State of Mississippi, and Chairman, Committee on Homeland Security: 

Oral Statement ..................................................................................................... 1 

Prepared Statement ............................................................................................. 3 

The Honorable Mike Rogers, a Representative in Congress From the State 

of Alabama, and Ranking Member, Committee on Homeland Security: 

Oral Statement ..................................................................................................... 4 

Prepared Statement ............................................................................................. 6 

WITNESSES

Mr. David Wulf, Director, Infrastructure Security Compliance Division, Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security: 

Oral Statement ..................................................................................................... 7 

Prepared Statement ............................................................................................. 9 

Mr. Nathan Anderson, Acting Director, Homeland Security and Justice, U.S. 

Government Accountability Office: 

Oral Statement ..................................................................................................... 12 

Prepared Statement ............................................................................................. 14 

FOR THE RECORD

The Honorable Mike Rogers, a Representative in Congress From the State 

of Alabama, and Ranking Member, Committee on Homeland Security: 

Letter ..................................................................................................................... 4 

APPENDIX

Questions From Chairman Bennie G. Thompson for David Wulf ....................... 51 

Question From Honorable Xochitl Torres Small for David Wulf ......................... 52 

Questions From Honorable Cedric Richmond for David Wulf ............................. 52 

Questions From Honorable Michael Guest for David Wulf .................................. 53 

Question From Honorable Michael Guest for Nathan Anderson ......................... 54 

Questions From Ranking Member Mike Rogers for Nathan Anderson .............. 54 

(1) 

SECURING OUR NATION’S CHEMICAL FACILITIES: BUILDING ON THE PROGRESS OF THE 

CFATS PROGRAM 

Wednesday, February 27, 2019 

U.S. HOUSE OF REPRESENTATIVES, 

COMMITTEE ON HOMELAND SECURITY, 

Washington, DC. 

The committee met, pursuant to notice, at 10:08 a.m., in room 

310, Cannon House Office Building, Hon. Bennie G. Thompson 

(Chairman of the committee) presiding. 

Present: Representatives Thompson, Langevin, Richmond, 

Correa, Torres Small, Rose, Underwood, Slotkin, Cleaver, Green, 

Clarke, Barraga ́n, Demings, Rogers, McCaul, Walker, Higgins, 

Lesko, Taylor, Joyce, Crenshaw, and Guest. 

Chairman THOMPSON. The Committee on Homeland Security will 

come to order. At the request of the Ranking Member, we will 

begin the hearing. He will join us momentarily. 

The committee is meeting today to receive testimony on securing 

our Nation’s chemical facilities, building on the progress of the 

CFATS program. Since 2007, the Department of Homeland Security has administered a regulatory program that covers security 

measures at high-risk chemical facilities to protect against the 

threat of terrorist attack. 

Through CFATS, DHS works with chemical facility owners and 

operators to make sure they have safeguards in place to prevent a 

bad actor from gaining access to dangerous chemicals stored onsite. In the past, this program has enjoyed broad bipartisan support on and off the Hill. 

Officials in the Bush administration, including former Homeland 

Security Secretary Michael Chertoff, were among the first to call 

for a Federal rule to secure chemical facilities. Officials from the 

Trump administration, among the most recent, last November, 

DHS Secretary Kirstjen Nielsen wrote to Congress urging us to reauthorize CFATS. 

We continue to face one of the most serious terrorist threat environments since 9/11. Foreign terrorist organizations are urging recruits to use simple weapons, including toxic chemicals, to target 

public spaces and events. Clearly, this threat has not abated. 

Yet the Department’s authority to carry out CFATS came very 

close to lapsing last month which caused this committee to pass a 

short-term bill extending the program until 2020. For 8 years, 

CFATS was tied to the annual appropriations cycle. 

2 

Lacking the certainty of a multi-year authorization, DHS struggles to keep staff, develop long-term policies and work with a regulated community that did not know if the rules would apply the following year. In 2014, Congress worked on a bicameral, bipartisan 

basis to finally put an end to this pattern by passing a multi-year 

authorization. 

I had hoped to work collaboratively in the last Congress, as we 

did in 2014, to give CFATS a long-term reauthorization. Unfortunately, that did not come to pass, and we once again found ourselves with no alternative but to pass another short-term extension. As Chairman, I do not intend to let that happen again. 

This committee is acting early this Congress to get a reauthorization bill across the finish line. However, I do not plan to let reauthorization become an excuse to water down regulatory requirements or diminish the overall security value of the program. 

CFATS is already designed to give flexibility and deference to facility owners and operators. The requirements are non-prescriptive, 

meaning that regulated facilities can choose security measures that 

work for their unique environment so long as their site security 

plan generally adheres to a set of risk-based security principles. 

When DHS inspectors go out and find that a facility’s security plan 

falls short, they work with that facility to address vulnerabilities. 

Thanks in part to the leadership of Director Wulf, who is testifying here today, the CFATS program is in place where Congress 

can build on a foundation that has already been laid. For example, 

there are currently half as many high-risk facilities in the United 

States as there were in 2007. 

I would like to understand how DHS is encouraging facilities to 

voluntarily reduce and remove chemical security risk and how we 

might put that data to good use. 

I also see reauthorization as an opportunity to figure out what 

is working and what is not. That may mean taking another look 

at how CFATS handles whistleblowers or deciding if an expedited 

approval program is a good use of DHS’s limited resources. 

Finally, there are some areas where the program continues to 

fall short. Six years ago, there was a fertilizer plant explosion in 

West, Texas, that caused catastrophic damage and took the lives of 

first responders who had been called to the scene. 

On the screen above you is a picture of that scene where volunteer firemen went to that location not knowing what they were 

going to, and they lost their lives. So we need to close that loophole 

because as a volunteer fireman myself, those public-spirited first 

responders did not know what they were going to until it was too 

late. 

So if CFATS had been in place, those individuals probably, given 

the information available, would not have approached it in the 

same light. So whatever we need to do to make sure information 

is being shared, this is a challenge we will address. 

I look forward to hearing from the panel today about how we 

might improve CFATS and make sure we give DHS and the regulated community the civility and certainty of a long-term reauthorization program. 

[The statement of Chairman Thompson follows:] 

3 

STATEMENT OF CHAIRMAN BENNIE G. THOMPSON

FEBRUARY 27, 2019 

Since 2007, the Department of Homeland Security has administered a regulatory 

program that covers security measures at ‘‘high-risk’’ chemical facilities to protect 

against the threat of terrorist attack. Through CFATS, DHS works with chemical 

facility owners and operators to make sure they have safeguards in place to prevent 

a bad actor from gaining access to dangerous chemicals stored on-site. 

In the past, this program has enjoyed broad, bipartisan support on and off the 

Hill. Officials in the Bush administration, including former Homeland Security Secretary Michael Chertoff, were among the first to call for a Federal rule to secure 

chemical facilities. And, officials from the Trump administration are among the 

most recent. 

Last November, DHS Secretary Kirstjen Nielsen wrote to Congress urging us to 

reauthorize CFATS: ‘‘[W]e continue to face one of the most serious terrorist threat 

environments since 9/11. Foreign terrorist organizations are urging recruits to use 

simple weapons, including toxic chemicals, to target public spaces and events.’’ 

Clearly, this threat has not abated. 

Yet, the Department’s authority to carry out CFATS came very close to lapsing 

last month—until this committee passed a short-term bill extending the program 

until April 2020. 

For 8 years, CFATS was tied to annual appropriations cycles. Lacking the certainty of a multi-year authorization, DHS struggled to keep staff, develop long-term 

policies, and work with a regulated community that did not know if the rules would 

apply the following year. In 2014, Congress worked on a bicameral, bipartisan basis 

to finally put an end to this pattern by passing a multi-year authorization. 

I had hoped to work collaboratively in the last Congress, as we did in 2014, to 

give CFATS a long-term reauthorization. Unfortunately, that did not come to pass, 

and we once again found ourselves with no alternative but passed another shortterm extension. 

As Chairman, I do not intend to let that happen again. This committee is acting 

early this Congress to get a reauthorization bill across the finish line. However, I 

do not plan to let reauthorization become an excuse to water down regulatory requirements or diminish the overall security value of the program. 

CFATS is already designed to give flexibility and deference to facility owners and 

operators. The requirements are non-prescriptive, meaning that regulated facilities 

can choose security measures that work for their unique environment, so long as 

their site security plans generally adhere to a set of risk-based security principles. 

When DHS inspectors go out and find that a facility’s security plan falls short, they 

work with that facility to address vulnerabilities. 

Thanks in part to the leadership of Director Wulf, who is testifying here today, 

the CFATS program is in a place where Congress can build on the foundation that 

has already been laid. For example, there are currently half as many ‘‘high-risk’’ facilities in the United States as there were in 2007. 

I would like to understand how DHS is encouraging facilities to voluntarily reduce 

or remove chemical security risks, and how we might put that data to good use. I 

also see reauthorization as an opportunity to figure out what’s working, and what’s 

not. That may mean taking another look at how CFATS handles whistleblowers or 

deciding if the expedited approval program is a good use of DHS’s limited resources. 

Finally, there are some areas where the program continues to fall short. 

I was extremely troubled by a report GAO released last year showing that first 

responders and emergency planners are still not getting the information they need 

to respond to an incident at a CFATS facility. As a former volunteer fire fighter, 

I am deeply concerned that—6 years after the tragic fertilizer plant explosion in 

West, Texas—we still have not yet figured out how to put the right information in 

the hands of the brave men and women running into a building in an emergency 

while everyone else is running out. When first responders show up at an incident, 

they need to know what’s on the other side of the door. Period. 

Whatever we need to do to make sure information is being shared—this is a challenge we will address. 

I look forward to hearing from the panel today about how we might improve 

CFATS and make sure we give DHS—and the regulated community—the stability 

and certainty of a long-term reauthorization for the program. 

Chairman THOMPSON. I now recognize the Ranking Member of 

the full committee, the gentleman from Alabama, Mr. Rogers, for 

an opening statement. 

4 

Mr. ROGERS. Thank you, Mr. Chairman. Sorry I am late. Thank 

you for holding this important hearing. 

Before I begin, I would like to express my extreme disappointment that the Majority staff denied the Minority’s request for a 

witness at today’s hearing. Under Rule 11 of the rules of the 

House, the Minority is afforded at least one witness at each committee hearing. If denied a witness, the Minority is entitled to separate hearing to take testimony from its witnesses. 

So pursuant to rule of the House, I am providing the Chairman 

with a letter signed by the Republican Members of the committee 

formally invoking our right to a separate hearing of the full committee to hear from Minority witnesses. I ask unanimous consent 

that a letter be made part of the record. 

Chairman THOMPSON. Without objection. 

[The information follows:] 


h:\seals\11631.eps
5 

Mr. ROGERS. The rules require the Chairman to schedule a hearing in a reasonable period of time. We request a hearing as soon 

as possible. 

CFATS is a critical program aimed at keeping dangerous chemicals out of the hands of terrorists. In the past, Republicans and 

Democrats have worked together to reauthorize CFATS and make 

improvements to the program. I hope the tradition of bipartisanship on this issue can continue, despite the actions taken by the 

Majority today. 

CFATS has been a successful program because it gives industry 

flexibility to secure their facilities with guidance from the Department of Homeland Security based on each facility’s unique risks 

and attributes. Fortunately, we have a solid program that works 

well as a starting point. Only small tweaks are needed to make an 

already good program even better. 


h:\seals\11632.eps
6 

I believe that with bipartisan, bicameral process we can quickly 

give stakeholders the certainty they need and move a long-term reauthorization of CFATS to the President’s desk. I hope the Chairman will join me in providing stability and certainty regarding 

chemical security and avoid taking actions which would undermine 

enactment of a bipartisan long-term reauthorization. 

I look forward to working collaboratively with the Majority, the 

Senate, the stakeholders, and DHS to reauthorize CFATS program. 

I also look forward to today’s witnesses. 

With that, I yield back, Mr. Chairman. 

[The statement of Ranking Member Rogers follows:] 

STATEMENT OF RANKING MEMBER MIKE ROGERS

FEBRUARY 27, 2019 

CFATS is a critical program aimed at keeping dangerous chemicals out of the 

hands of terrorists. In the past, Republicans and Democrats have worked together 

to reauthorize CFATS and make improvements to the program. 

I hope the tradition of bipartisanship on this issue can continue, despite the actions taken by the Majority today. CFATS has been a successful program because 

it gives industry flexibility to secure their facilities, with guidance from the Department of Homeland Security, based on each facility’s unique risk and attributes. 

Fortunately, we have a solid program that works well as a starting point. Only 

small tweaks are needed to make an already good program better. I believe that 

with a bipartisan, bicameral process we can quickly give stakeholders the certainty 

they need and move a long-term reauthorization of CFATS to the President’s desk. 

I hope the Chairman will join me in providing stability and certainty regarding 

chemical security—and avoid taking actions, which would undermine enactment of 

a bipartisan, long-term reauthorization. I look forward to working collaboratively 

with the Majority, the Senate, stakeholders, and DHS to reauthorize the CFATS 

program. 

Chairman THOMPSON. Thank you very much. In response to the 

Ranking Member’s request, we will do so in writing. But consistent 

with the rules that we adopted for this committee, similar to the 

rules we have had before, we offered a Government witness to this 

Government panel. 

From my understanding, that was not accepted, but you could 

have had a Government witness. It was—we will respond in writing, but the rules we apply are the same rules that this committee 

has always operated under. Other Members of the committee are 

reminded that under the committee rules, opening statements may 

be submitted for the record. 

I welcome our panel of witnesses. First, I would like to welcome 

David Wulf, the director of the Infrastructure Security Compliance 

Division at the DHS Cybersecurity and Infrastructure Security 

Agency, CISA. 

Mr. Wulf has been CFATS through some of its difficult challenges and helped it mature into an internationally-renowned 

chemical security program. I am thankful for his leadership on 

CFATS and look forward to his testimony. 

Next, I would like to welcome Mr. Nathan Anderson from the 

Government Accountability Office Homeland Security and Justice 

Team. Mr. Anderson has contributed to GAO’s substantial body of 

work on the CFATS program, including a report GAO issued last 

July, which I expect will play a major role in informing CFATS’ reauthorization and provide important context to our conversation 

today. 

7 

Without objection, the witnesses’ full statement will be inserted 

in the record. I now ask each witness to summarize his or her 

statement for 5 minutes, beginning with Mr. Wulf. 

STATEMENT OF DAVID WULF, DIRECTOR, INFRASTRUCTURE 

SECURITY COMPLIANCE DIVISION, CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY, U.S. DEPARTMENT OF 

HOMELAND SECURITY 

Mr. WULF. Thank you so much, Mr. Chairman, Ranking Member 

Rogers, and other Members of the committee. I really do appreciate 

the opportunity to be here today to provide an update on the 

progress of the Chemical Facility Anti-Terrorism Standards program, or CFATS, the progress that the CFATS program continues 

to make in fostering security at high-risk chemical facilities across 

the Nation. 

When I last testified before this committee in 2014, the CFATS 

program was in a very different place, having faced some significant challenges in its early years. But we had implemented a comprehensive corrective action plan and had made some measurable 

forward progress. At that time, I emphasized the importance of 

long-term authorization for this critical National security program. 

I am very grateful for the leadership you and the committee 

demonstrated in securing the 4-year CFATS authorization that was 

signed into law in December 2014. I am grateful, of course, as well 

for your role in attaining the 15-month extension of that authorization through April 2020 that was enacted last month. 

I am very appreciative that this committee is holding today’s 

hearing and is again taking a lead role to ensure continuing longterm authorization of CFATS. I look forward to working with you 

to continue to enhance and to evolve our program. 

Now, as I am sure you will hear me say once or twice today, the 

stability that has come along with long-term authorization has 

driven unprecedented progress as our team has worked with 

CFATS-covered facilities to make America’s high-risk chemical infrastructure a truly hard target with literally tens of thousands of 

security measures having been put in place at high-risk chemical 

facilities across the Nation. 

These facilities have achieved, on average, a 55 percent increase 

in their security posture as a direct result of CFATS. The stability 

afforded by long-term authorization has facilitated our planning 

and execution of important programmatic improvements, a few of 

which I will detail in a moment, while it has also afforded regulated industry stakeholders with the certainty they deserved as 

they planned for and made significant investments in CFATS-related security measures. 

Now, I know that as the reauthorization process proceeds, you 

will have the opportunity to hear directly from industry and other 

stakeholders about their experience with CFATS. 

The gains I have just noted would not have been possible without 

the commitment and hard work of companies and our various other 

stakeholders across the Nation who have put into place CFATS-focused security measures and, in many cases, have provided important feedback and ideas that have helped us to improve our procVerDate Mar 15 2010 14:25 May 17, 2019 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6602 H:\116TH\19FL0227\19FL0227 HEATH
8 

esses and our effectiveness as we have evolved and enhanced the 

program over the past 4 years. 

So I see many of those stakeholders in the room, and I appreciate 

their presence here today. I would also like to acknowledge Nathan 

Anderson and the important role the GAO has played in reviewing 

our operations and making many helpful recommendations over the 

past several years. 

Of course, I want to acknowledge our hard-working CFATS team, 

some 250 folks here in Washington and across the Nation who have 

built a truly world-class program and who are laser-focused on securing America’s highest-risk chemical infrastructure. 

So about those programmatic improvements I mentioned, what 

have we been doing to make CFATS even stronger as we have enjoyed the stability of long-term authorization over the past 4 years? 

Well, we have improved processes. We have eliminated bottlenecks. 

We have seen unprecedented progress in the pace of inspections 

and in the review and approval of facility site security plans, eliminating a backlog of security plan reviews 6 years ahead of earlier 

GAO projections. 

We have developed and launched an improved risk assessment 

methodology that effectively accounts for all relevant elements of 

risk. We have reassessed the level of risk associated with nearly 

30,000 facilities across the country. 

We have implemented the CFATS personnel surety program, affording the highest-tiered CFATS-covered facilities the ability to 

ensure that individuals with access to critical assets have been vetted for terrorist ties. 

We have dramatically reduced burden across our stakeholder 

community, having built and launched a streamlined, more userfriendly suite of on-line tools through which facilities submit risk 

assessment surveys, also known as Top Screens, and develop their 

site security plans. 

While the stability afforded by long-term authorization has yielded all of this progress over the past 4 years, we are certainly not 

done yet. Continued long-term authorization will be absolutely critical to ensuring that we are able to focus on driving even more effective and even more efficient approaches to fostering chemical security across the Nation. 

Now, as we are all too aware, the threat of chemical terrorism 

remains a real and a very relevant one. Around the globe, our adversaries continue to seek, to acquire, and to use in attacks chemicals of the sort that trigger coverage under CFATS. The threat 

stream continues to reflect that chemical facilities themselves remain an attractive target for our adversaries. 

I can tell you with certainty that the work we are doing in concert with our committed stakeholders across the wide variety of industries and facilities that compose the CFATS-covered universe is 

making a real difference in protecting the Nation. 

Having had the opportunity to work closely with my counterparts 

in other nations and to co-chair the G7 Global Partnership’s Chemical Security Working Group, I can tell you as well that what we 

are doing here in the United States through CFATS, the culture of 

chemical security you have helped us to build with your support for 

9 

long-term CFATS authorization, is absolutely the envy of the 

world. 

With its targeted focused on the highest-risk facilities, with its 

18 comprehensive risk-based performance standards addressing 

physical, cyber, and insider threats, and with its non-prescriptive 

flexible approach to regulation, CFATS is well-suited to enhancing 

security across the very diverse universe of high-risk chemical facilities. 

So before I wrap up, I would like to again thank the committee 

and your top-notch staff for your leadership on CFATS and on 

chemical security writ large. 

We are fond of saying that chemical security is a shared commitment, and not unlike the role that industry and other stakeholders 

who have embraced and helped us to build this program in so 

many ways, and the role of our committed and very talented team 

at DHS, the role of Congress and the role of this committee in 

shaping and authorizing CFATS for the long-term has been hugely 

important. 

I am looking forward to working further with you, as we drive 

toward reauthorization this year. 

So thanks again. Thank you so much. I look forward to your 

questions, and to the dialog here today. 

[The prepared statement of Mr. Wulf follows:] 

PREPARED STATEMENT OF DAVID WULF

FEBRUARY 27, 2019 

INTRODUCTION

Chairman Thompson, Ranking Member Rogers, and Members of the committee, 

I appreciate the opportunity to appear before you today to discuss the development 

and maturation of the Department of Homeland Security’s (DHS) regulation of highrisk chemical facilities under the Chemical Facility Anti-Terrorism Standards 

(CFATS) Program. 

I also want to thank you for your efforts in extending the program’s authorization 

for an additional 15 months so that we may continue to work together toward the 

long-term reauthorization of this critical National security program. Since the program’s inception, CFATS has fundamentally improved chemical security in the 

United States. Our threat landscape is constantly evolving and the threat of chemical terrorism remains a very real and very relevant one. For this reason, fostering 

the security of high-risk chemical facilities continues to be of the utmost importance. 

Given the wide diversity of facilities that store chemicals, CFATS—and its flexible, 

targeted approach, is an essential tool in this effort. 

CFATS PROGRAM OVERVIEW

The CFATS Program is a vital part of our Nation’s counterterrorism efforts, addressing physical, cyber, and insider threats to our Nation’s highest-risk chemical 

facilities. Since the CFATS Program’s creation, we have engaged with industry to 

identify and regulate high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with the possession of chemicals of interest and to keep dangerous chemicals out of the hands of those who wish to do us 

harm. 

The cornerstone of the CFATS Program is the development, submission, and implementation of Site Security Plans (SSPs), or Alternative Security Programs in lieu 

of SSPs, documenting the security measures that high-risk chemical facilities utilize 

to satisfy the applicable Risk-Based Performance Standards (RBPS) under CFATS. 

Due to the diversity of facilities that hold chemicals of interest, it is important to 

note these plans are not ‘‘one-size-fits-all,’’ but are in-depth, highly customized, and 

account for each facility’s unique circumstances. 

In order to determine whether a facility is covered under CFATS, DHS utilizes 

a risk-assessment methodology that takes into account threat, vulnerability, and the 

10 

consequences of a potential attack. To begin the process, a facility in possession of 

threshold quantities of CFATS chemicals of interest submits a Top Screen to the 

Department’s Infrastructure Security Compliance Division. Since we began collecting this information in 2007, more than 40,000 unique facilities have reported 

chemical holdings. Based on the information received in the Top Screens, DHS determines which facilities are at high-risk of terrorist attack or exploitation and assigns each of these to a tier. 

Facilities determined to be high-risk must submit a Security Vulnerability Assessment (SVA) and a SSP, or a SVA and an Alternative Security Program (ASP), to 

DHS for approval. Tier 3 and 4 facilities also have the option of submitting an Expedited Approval Program (EAP) SSP in lieu of an SSP or ASP. The plan must include 

security measures meeting the RBPS established in the CFATS regulation. For facilities other than those submitting an EAP SSP, the Department performs an authorization inspection at the facility prior to approving a security plan to ensure 

that the measures contained in the security plan are appropriate given the facility’s 

specific security issues and unique characteristics. Once a facility’s plan is approved, 

DHS conducts regular compliance inspections to verify that the facility is implementing the agreed-upon security measures. 

CFATS ACT OF 2014 AFFORDED CRUCIAL STABILITY AND CERTAINTY

In December 2014, Congress passed the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). This statute, which enjoyed strong bipartisan and stakeholder support, brought stability for both the Department and the regulated community and provided stakeholders with confidence 

in the program’s future. Enacting a multi-year CFATS authorization as Congress 

did in 2014 marked an important turning point for the program. Among other 

things, it: 

• Provided industry stakeholders with the certainty they needed to plan for and 

invest in CFATS-related security measures to harden their critical sites against 

possible terrorist attack or exploitation; 

• Afforded the stability needed to enable the Department to make programmatic 

improvements as well as strategic, long-term planning decisions regarding staffing, program development, and process efficiencies; and, 

• Sent a clear message to potentially covered ‘‘outlier’’ facilities that the CFATS 

Program is here to stay. 

With long-term authorization, chemical facilities have become further incentivized 

to engage with the Department with regard to facility security. Returning to the instability of short-term renewal of CFATS Program either through regular order or 

the appropriations process would represent a significant step backwards for the Nation’s chemical security efforts, inhibit programmatic progress and long-term planning, and undermine stakeholder confidence in the longevity of the program. In 

short, the absence of long-term CFATS authorization puts America’s chemical security—and the security of our communities—at risk. 

ACCOMPLISHMENTS SINCE THE CFATS ACT OF 2014

Due in large part to the stability afforded by passage of the CFATS Act of 2014, 

I am pleased to report today that much has been accomplished and that our program continues to make significant forward progress. Through the collective efforts 

of our dedicated workforce, industry, and other stakeholders, and through the support and leadership of Congress, the CFATS program has matured significantly in 

this time and is poised to continue this progress in the coming years. 

Clear examples of the gains made by the CFATS Program since the passage of 

the CFATS Act of 2014 include: 

• A dramatic improvement in the pace of inspections, reviews, and approvals resulting in the elimination of a backlog once projected to take 7 to 9 years to 

clear, nearly 6 years ahead of schedule; 

• Development and deployment of an enhanced risk-tiering methodology that affords a more accurate reflection of a facility’s risk—a methodology that is 

grounded in science and has been vetted by external experts from across Government, industry, and academia; 

• Streamlining of the SSP-development process and the stakeholder ‘‘user experience,’’ reducing the burden on facility operators without sacrificing security 

through the launch of the CSAT 2.0 suite of on-line tools; and, 

• The closing of a critical gap in the security of our Nation’s highest-risk facilities 

through the implementation of the CFATS Personnel Surety Program (screening for terrorist ties). 

11 

EXTENSIVE OUTREACH

DHS continues to prioritize outreach designed to ‘‘get the word out’’ about the program, share information with partners, make available compliance assistance materials, provide education and training, and to otherwise foster chemical security. This 

outreach, which has been central to the success of CFATS, has involved extensive 

engagement with a diverse group of representatives across the chemical security 

community, including industry stakeholders; law enforcement and emergency responders; Federal and State partner agencies; labor organizations, Federal partners, 

industry associations, labor and interest groups, and international partners among 

many others. 

DHS conducts outreach to members of the chemical industry, other industries 

whose members routinely use threshold levels of CFATS chemicals of interest, and 

stakeholders with an interest in chemical facility security. The Department has also 

prioritized coordinating with Federal and State, local, Tribal, and territorial (SLTT) 

regulatory agencies to provide resource materials and to obtain data to assist with 

identifying Chemical Facilities of Interest. In fiscal year 2018, as a result of the 

data set comparisons, we identified approximately 697 potential chemical facilities 

of interest. From the program’s inception, DHS has made more than 3,500 presentations to its regulated community and attended more than 16,600 meetings with 

our Federal, SLTT, and industry stakeholders. 

The Department has developed strong relationships with national organizations 

to leverage their networks and outreach activities and, in fiscal year 2018, DHS conducted Nation-wide outreach to more than 350 State and local offices and more than 

850 Local Emergency Planning Committees/Tribal Emergency Planning Committees 

across the Nation. 

Also, outreach to first responders is incorporated into the development of SSPs 

through Risk-Based Performance Standard 9 (RBPS 9)—Response. This standard 

requires covered facilities to have a documented, comprehensive crisis management 

plan that details how the facility will respond to security incidents and requires the 

facility to run exercises and drills—and make contact with local first-responders. 

DHS verifies this outreach during on-site compliance inspections. In many instances, the Department has facilitated contact between the first responders and the 

facilities. 

During the summer of 2018, as part of the Department’s on-going efforts to maximize outreach to critical stakeholder communities and as a supplement to 11 previous annual Chemical Security Summits, the Cybersecurity and Infrastructure Security Agency’s (CISA) Office of Infrastructure Security held a series of 

DHSChemSecurityTalks in which we reached more than 300 facility owners and operators, Government partners, and industry stakeholders. This inaugural series of 

three 1-day events, held in Oakland, California, Chicago, Illinois, and Philadelphia, 

Pennsylvania, was designed to take the chemical infrastructure security discussion 

and CISA’s largest regulatory program, CFATS, beyond the National Capital Region 

and into the very communities that CFATS protects. 

The Department also continues to play a leadership role in encouraging a global 

culture of chemical security. In support of this, I am privileged to co-chair the 

Chemical Security Working Group of the G7 Global Partnership Against the Spread 

of Weapons and Materials of Mass Destruction, leading the U.S. engagement with 

the G7 on chemical security and helping to ensure cooperation among the international community on chemical security efforts. Additionally, in 2018, the Department, along with the Federal Bureau of Investigation and INTERPOL, co-hosted the 

inaugural Global Congress on Chemical Security and Emerging Threats in Lyon, 

France. The Global Congress convenes a community intent on countering chemical 

and explosive terrorism by non-State actors and their access to chemical agents. The 

Congress explored specialized case studies highlighting emerging trends, identified 

lessons learned and best practices relating to chemical incident attribution and response and discussed evolving technologies and tactics. CFATS is recognized globally as a model chemical-security framework world-wide and the Department regularly responds to requests to work with other governments as they strive to build 

cultures of chemical security on a par with the security-culture CFATS has fostered 

in the United States. 

PERSONNEL SURETY PROGRAM

Vetting those who have access to chemicals of interest and other sensitive parts 

of high-risk chemical facilities is a key aspect of facility security. Under RBPS 12, 

Personnel Surety, facilities must: (1) Implement measures to verify and validate 

identity, (2) check criminal history, (3) validate legal authorization to work in the 

United States, and (4) identify people with terrorist ties. While all Tier 1 through 

12 

4 facilities have been implementing the first three elements of RPBS 12, in December 2015 the Department began working with Tier 1 and Tier 2 facilities to implement the fourth element. This effort was begun in December 2015, after the Office 

of Management and Budget (OMB) approved the Department’s Information Collection Request for the CFATS Personnel Surety Program (RPBS 12[iv]) in accordance 

with the requirements of the Paperwork Reduction Act (PRA). 

The CFATS Personnel Surety Program closed a critical gap by enabling facilities 

in these two tiers to submit names to DHS for vetting individuals’ potential terrorist 

ties. Going forward, the Department is planning to expand its implementation to 

tiers 3 and 4, to enable all high-risk chemical facilities to ensure that those with 

access to critical assets have been vetted for terrorist ties. The Department is in the 

process of requesting OMB’s approval, through the PRA process, to collect information on individuals who have or who are seeking access to high-risk chemical facilities for all four Tiers. 

CONCLUSION

Through CFATS and the hard work of our industry stakeholders who continue to 

put in place security measures to harden America’s highest-risk chemical facilities, 

we have collectively accomplished much since 2014. This progress would not have 

been possible without the stability and certainty afforded by enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014. 

Long-term reauthorization will allow the Department and the chemical security 

community to continue to work together to secure the Nation’s chemicals and keep 

them out of the hands of our adversaries. The Department will be able to continue 

to focus on pursuing more efficient ways to implement the program, to include the 

enhancement of existing materials and tools, while industry will have the confidence 

to continue to make important investments in security. 

Chemical security is very much a pressing need, and, in view of the continuing 

high level of chemical-terrorism threats, must remain a continuing high priority for 

the Nation. The CFATS program has positioned the United States as a world-leader 

in building the culture of security necessary to secure our Nation’s highest-risk 

chemical facilities. I look forward to working with this committee to chart a path 

toward long-term—or permanent—reauthorization of this critical National security 

program, and I thank you in advance for your continuing leadership on this issue. 

I look forward to your questions. 

Chairman THOMPSON. Thank you, Mr. Wulf. We feel your passion. 

We now recognize Mr. Anderson to summarize his statement for 

5 minutes. 

STATEMENT OF NATHAN ANDERSON, ACTING DIRECTOR, 

HOMELAND SECURITY AND JUSTICE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. ANDERSON. Chairman Thompson, Ranking Member Rogers, 

and Members of the committee, good morning. My testimony today 

is primarily based on work we have conducted over the past few 

years. 

Compared to where CFATS’ program was shortly after its inception, DHS has made substantial progress in a number of areas. 

There is room for improvement, particularly in reaching out to first 

responders. 

I will speak first to the Department’s efforts to identify high-risk 

chemical facilities. Just identifying the universe of facilities that 

should even be regulated under CFATS, has been and may always 

be a huge challenge. 

There is no one complete data source of facilities that have 

chemicals. In 2014, we found that DHS used self-reported and 

unverified data to determine the risk of facilities holding toxic 

chemicals that could threaten surrounding communities if released. 

13 

We recommended that DHS should better verify the accuracy of facility-reported data. 

DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so. 

We have also reviewed the Department’s access to assess regulated facilities’ risks. We did those to place chemical facilities into 

the appropriate risk tier. 

Several years ago, we found that the Department’s risk assessment approach did not consider all of the elements of risk associated with a terrorist attack involving certain chemicals. They treated every facility as equally vulnerable to a terrorist attack, regardless of location or on-site security. 

We recommended that DHS enhance its risk-assessment approach to incorporate all elements of risk and conduct a peer review after doing so. 

DHS agreed with both recommendations and has implemented 

actions to address both of them. For example, DHS worked with 

Sandia National Lab to develop a model to more comprehensively 

estimate the consequences of a chemical attack. 

Our assessment of the Department’s efforts to review and approve chemical facilities’ security plans also identified challenges 

that DHS has taken steps to address. DHS is to review security 

plans and visit facilities to ensure their security measures meet 

DHS standards. 

In April 2013, we reported a 7- to 9-year backlog for those reviews and visits. At that time, DHS officials told us they were exploring ways to reprioritize resources and streamline inspection requirements. Recently, DHS reported to Congress that it had eliminated its backlog by realigning resources toward security plan reviews. 

A key quality assurance function involves actions to ensure compliance. In 2015, we reported that DHS had conducted compliance 

inspections of 83 of the roughly 1,700 facilities with approved security plans at that time. 

We found that nearly half of the inspected facilities were not 

fully compliant with their approved security plans, and that DHS 

did not have documented procedures for managing facilities’ compliance. 

We recommended that DHS document procedures from managing 

compliance. As a result, DHS revised CFATS procedures, which we 

are currently reviewing to determine if they sufficiently document 

the processes being used to track uncompliant facilities and ensure 

facilities implement plan measures as outlined in their security 

plans. 

On a positive note, DHS recently told us that they have conducted more than 2,000 compliance inspections. 

Let me now turn to our most recent work, which addresses 

DHS’s efforts to conduct outreach with stakeholders and first responders. 

In late 2018, we reported that DHS assured that some CFATS 

information that first responders and emergency planners may not 

have all the information they need to minimize the risk of injury 

or death when responding to incidents at high-risk facilities. 

14 

1Pub. L. No. 109–295, § 550, 120 Stat. 1335, 1388–89 (2006). 2See 72 Fed. Reg. 17,688 (Apr. 9, 2007) (codified as amended at 6 C.F.R. pt. 27). 

3DHS has enumerated 18 risk-based performance standards that chemical facilities must 

meet to comply with CFATS. See 6 C.F.R. § 27.230. 

We recommended that DHS should, among other things, take actions to improve information sharing with first responders and 

emergency planners. DHS concurred with this recommendation and 

reported in September 2018 that they are taking actions to implement it. 

In closing, our work has found that DHS has made progress in 

efforts to implement and manage its CFATS program. As CFATS 

continues to evolve, it will be important to focus on how DHS 

should measure the security impact of the program, what DHS is 

doing with all of the information it collects, and how such information is being communicated to the industry, first partners, and others. 

It will also be important to focus on how the program evolves to 

face new challenges, such as cybersecurity. 

Mr. Chairman, Ranking Member Rogers, Members of the committee, this concludes my statement. I will be happy to take any 

questions you may have. 

[The prepared statement of Mr. Anderson follows:] 

PREPARED STATEMENT OF NATHAN ANDERSON

FEBRUARY 27, 2019 

CRITICAL INFRASTRUCTURE PROTECTION.—PROGRESS AND CHALLENGES IN DHS’S

MANAGEMENT OF ITS CHEMICAL FACILITY SECURITY PROGRAM

Chairman Thompson, Ranking Member Rogers, and Members of the committee: 

Thank you for the opportunity to discuss our past work on the Department of Homeland Security’s (DHS) efforts to manage its Chemical Facility Anti-Terrorism Standards (CFATS) program. Thousands of facilities that produce, use, or store hazardous 

chemicals could be of particular interest to terrorists who might seek to use toxic 

chemicals to inflict mass casualties in the United States. These chemicals could be 

released from a facility to cause harm to surrounding populations; they could be stolen and used as chemical weapons or as their precursors (the ingredients for making 

chemical weapons); or they could be stolen and used to build an improvised explosive device. Past incidents remind us of the danger that these chemicals pose, including the 2013 ammonium nitrate explosion at a fertilizer storage and distribution 

facility in West, Texas, which killed at least 14 people and damaged or destroyed 

at least 200 homes, and the 1995 domestic terrorist attack on the Federal building 

in Oklahoma City, Oklahoma, where 168 people were killed using ammonium nitrate fertilizer mixed with fuel oil. 

The Department of Homeland Security Appropriations Act, 2007, required DHS 

to issue regulations to establish risk-based performance standards (performance 

standards) for securing high-risk chemical facilities.1 DHS subsequently established 

the CFATS program in 2007 to, among other things, identify high-risk chemical facilities and assess the risk posed by them; place facilities considered to be high-risk 

into 1 of 4 risk-based tiers (with tier 1 being the highest risk tier and 4 being the 

lowest); assess facility security; approve security plans prepared by facilities; and inspect facilities to ensure compliance with regulatory requirements.2 DHS’s CFATS 

rule established 18 performance standards that identify the areas for which a facility’s security posture are to be examined, such as perimeter security, access control, 

and cybersecurity.3 To meet these standards, facilities are free to choose whatever 

security programs or processes they deem appropriate so long as DHS determines 

that the facilities achieve the requisite level of performance in each of the applicable 

areas. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act 

of 2014 (CFATS Act of 2014), enacted in December 2014, in effect, reauthorized the 

CFATS program for an additional 4 years, while also imposing additional implemenVerDate Mar 15 2010 14:25 May 17, 2019 Jkt 000000 PO 00000 Frm 00018 Fmt 6633 Sfmt 6621 H:\116TH\19FL0227\19FL0227 HEATH
15 

4See Pub. L. No. 113–254, 128 Stat. 2898 (2014); 6 U.S.C. §§ 621–629. The act amended the 

Homeland Security Act of 2002, Pub. L. No. 107–296, 116 Stat. 2135 (2002), as amended, by 

adding Title XXI—Chemical Facility Anti-Terrorism Standards—and expressly repealing the 

program’s authority under the fiscal year 2007 DHS appropriations act. 5See Pub. L. No. 116–2, 113 Stat. 5 (2019). 

6GAO, Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical 

Security Program, but It Is Too Early to Assess Results, GAO–12–515T (Washington, DC: July 

26, 2012); Critical Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and 

Gather Feedback on Facility Outreach Can Be Strengthened, GAO–13–353 (Washington, DC: 

Apr. 5, 2013); Critical Infrastructure Protection: DHS Efforts to Identify, Prioritize, Assess, and 

Inspect Chemical Facilities, GAO–14–365T (Washington, DC: Feb. 27, 2014); Critical Infrastructure Protection: Observations on DHS Efforts to Implement and Manage Its Chemical Security 

Program, GAO–14–608T (Washington, DC: May 14, 2014); Chemical Safety: Actions Needed to 

Improve Federal Oversight of Facilities with Ammonium Nitrate, GAO–14–274 (Washington, DC: 

May 19, 2014); Critical Infrastructure Protection: DHS Action Needed to Verify Some Chemical 

Facility Information and Manage Compliance Process, GAO–15–614 (Washington, DC, July 22, 

2015); Critical Infrastructure Protection: Improvements Needed for DHS’s Chemical Facility 

Whistleblower Report Process, GAO–16–572, (Washington, DC: Jul 12, 2016); Critical Infrastructure Protection: DHS Has Implemented Its Chemical Security Expedited Approval Program and 

Participation Has Been Limited, GAO–17–502 (Washington, DC: June 29, 2017); Critical Infrastructure Protection: Progress and Challenges in DHS’s Management of Its Chemical Facility Security Program, GAO–18–613T (Washington, DC: June 14, 2018); and Critical Infrastructure 

Protection: DHS Should Take Actions to Measure Reduction in Chemical Facility Vulnerability 

and Share Information with First Responders, GAO–18–538 (Washington, DC: Aug. 8, 2018). 7GAO–14–274. We reviewed Emergency Planning and Community Right-to-Know Act of 1986 

data from Texas and Alabama, which have different reporting criteria than CFATS. Under section 312 of the act and Environmental Protection Agency’s regulations, facilities with 10,000 

pounds or more of ammonium nitrate generally must submit an annual chemical inventory report to their designated State and local authorities. 42 U.S.C. § 11022, 40 C.F.R. § 370.10(a)(2)(i). 

tation requirements on DHS for the program.4 In January 2019, the Chemical Facility Anti-Terrorism Standards Program Extension Act, was enacted and extended the 

authorization by 15 months.5

DHS’s Cybersecurity and Infrastructure Security Agency’s Infrastructure Security 

Compliance Division (ISCD) manages the CFATS program. According to DHS, the 

Department received approximately $911 million for the CFATS program for the period beginning fiscal year 2007 through fiscal year 2018. 

My testimony today summarizes our past work examining DHS’s management of 

the CFATS program, and provides updates on actions DHS has taken to address our 

prior recommendations. This testimony is based on our reports issued from July 

2012 through August 2018.6 For these reports, we reviewed applicable laws and regulations, DHS policies and procedures, DHS data on tiered facilities, information on 

the approach DHS used to determine a facility’s risk, and process for reviewing security plans. We also interviewed DHS officials about how facilities are placed in 

risk-based tiers, how DHS assesses risk, and how it reviews and approves facility 

security plans. Additional details on the scope and methodology are available in our 

published reports. In addition, this statement contains updates as of September 

2018 from DHS on actions it has taken to address the recommendations made in 

our prior reports. 

The work upon which this statement is based was conducted in accordance with 

generally accepted Government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to provide 

a reasonable basis for our findings and conclusions based on our audit objectives. 

We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

DHS HAS MADE PROGRESS ADDRESSING PAST CHALLENGES, BUT SOME ACTIONS ARE

STILL UNDER WAY

Our past work has identified progress and challenges in a number of areas related 

to DHS’s management of the CFATS program, including: (1) The process for identifying high-risk chemical facilities; (2) how it assesses risk and prioritizes facilities; 

(3) reviewing and approving facility site security plans; (4) inspecting facilities and 

ensuring compliance; and (5) efforts to conduct outreach with stakeholders and first 

responders. 

Identifying High-Risk Chemical Facilities 

In May 2014, we found that more than 1,300 facilities had reported having ammonium nitrate to DHS. However, based on our review of State data and records, there 

were more facilities with ammonium nitrate holdings than those that had reported 

to DHS under the CFATS program.7 Thus, we concluded that some facilities weren’t 

16 

8 Consistent with law and regulation, certain facilities—including, in general, facilities regulated under the Maritime Transportation Security Act of 2002 (Public Law 107–295, 116 Stat. 

2064), public water systems or wastewater treatment facilities, facilities owned and operated by 

the Department of Defense or the Department of Energy, and facilities subject to regulation by 

the Nuclear Regulatory Commission or in accordance with the Atomic Energy Act of 1954—are 

not subject to regulation under CFATS and are referred to as excluded facilities. See 6 U.S.C. 

§ 621(4); 6 C.F.R. § 27.110(b). In addition, pursuant to its authority under 6 C.F.R. § 27.210(c), 

DHS has extended the deadline for submitting CFATS reports until further notice for certain 

agricultural production facilities, such as farms, ranches, turfgrass growers, golf courses, nurseries, and public and private parks. See Notice to Agricultural Facilities About Requirement To 

Complete DHS’s Chemical Security Assessment Tool, 73 Fed. Reg. 1640 (Jan. 9, 2008). 9 Executive Order 13650—Improving Chemical Facility Safety and Security established a 

Chemical Facility Safety and Security Working Group, composed of representatives from DHS; 

EPA; and the Departments of Justice, Agriculture, Labor, and Transportation, and directed the 

working group to identify ways to improve coordination with State and local partners; enhance 

Federal agency coordination and information sharing; modernize policies, regulations, and 

standards; and work with stakeholders to identify best practices. See Exec. Order No. 13,650 

(Aug. 1, 2013), 78 Fed. Reg. 48,029 (Aug. 7, 2013). 10GAO–15–614. 11 Any chemical facility that possesses any of the 322 chemicals in the quantities that meet 

or exceed the threshold quantity or concentration outlined in Appendix A to the DHS CFATS 

rule is required to complete the Chemical Security Assessment Tool (CSAT) Top Screen—which 

is the initial screening tool or document whereby the facility is to provide DHS various data, 

including the name and location of the facility and the chemicals and their quantities at the 

site. See 6 C.F.R. § 27.200(b); see also 72 Fed. Reg. 65,396 (Nov. 20, 2007) (codified at 6 C.F.R. 

pt. 27, App. A). 12We recalculated the Distance of Concern for a generalizable sample of facilities—a simple 

random sample of 475 facilities from the population of 36,811 facilities that submitted Top 

Screens since the inception of the CFATS program in 2007 through January 2, 2015—and compared these results to what facilities reported in their Top Screen submission. Based upon this 

sample, we estimated that 4,173 facilities with a toxic release chemical misreported the Distance 

of Concern, with an associated 95 percent confidence interval of 2,798 to 5,822 facilities. 

required to report to DHS and some that were required may have failed to do so.8

We recommended that DHS work with other agencies, including the Environmental 

Protection Agency (EPA), to develop and implement methods of improving data 

sharing among agencies and with States as members of a Chemical Facility Safety 

and Security Working Group.9 DHS agreed with our recommendation and has since 

addressed it. Specifically, DHS compared DHS data with data from other Federal 

agencies, such as EPA, as well as member states from the Chemical Facility Safety 

and Security Working Group to identify potentially noncompliant facilities. As a result of this effort, in July 2015, DHS officials reported that they had identified about 

1,000 additional facilities that should have reported information to comply with 

CFATS and subsequently contacted these facilities to ensure compliance. DHS officials told us that they continue to engage with States to identify potentially noncompliant facilities. For example, as of June 2018, DHS officials stated that they 

have received 43 lists of potentially noncompliant facilities from 34 State governments, which are in various stages of review by DHS. DHS officials also told us that 

they hired an individual to serve as the lead staff member responsible for overseeing 

this effort. 

DHS has also taken action to strengthen the accuracy of data it uses to identify 

high-risk facilities. In July 2015, we found that DHS used self-reported and 

unverified data to determine the risk categorization for facilities that held toxic 

chemicals that could threaten surrounding communities if released.10 At the time, 

DHS required that facilities self-report the Distance of Concern—an area in which 

exposure to a toxic chemical cloud could cause serious injury or fatalities from shortterm exposure—as part of its Top Screen.11 We estimated that more than 2,700 facilities with a toxic release threat had misreported the Distance of Concern and 

therefore recommended that DHS: (1) Develop a plan to implement a new Top 

Screen to address errors in the Distance of Concern submitted by facilities, and (2) 

identify potentially miscategorized facilities that could cause the greatest harm and 

verify that the Distance of Concern of these facilities report is accurate.12 DHS has 

fully addressed both of these recommendations. Specifically, in response to the first 

recommendation, DHS implemented an updated Top Screen survey in October 2016 

and now collects data from facilities and conducts more accurate modeling to determine the actual area of impact (formerly called the Distance of Concern), rather 

than relying on the facilities’ calculation. In response to the second recommendation, 

DHS officials reported in November 2016 that they reassessed all facility Top 

Screens that reported threshold quantities of chemicals posing a toxic release threat, 

and identified 158 facilities with the potential to cause the greatest harm. In April 

17 

13GAO–13–353. 

2018, DHS officials reported that all of these facilities have since been reassessed 

using updated Top Screen information and, where appropriate, assigned a risk tier. 

Assessing Risk and Prioritizing Facilities 

DHS has also taken actions to better assess regulated facilities’ risks in order to 

place the facilities into the appropriate risk tier. In April 2013, we reported that 

DHS’s risk assessment approach did not consider all of the elements of threat, vulnerability, and consequence associated with a terrorist attack involving certain 

chemicals. Our work showed that DHS’s CFATS risk assessment methodology was 

based primarily on consequences from human casualties, but did not consider economic consequences, as called for by the National Infrastructure Protection Plan 

(NIPP) and the CFATS regulation. We also found that: (1) DHS’s approach was not 

consistent with the NIPP because it treated every facility as equally vulnerable to 

a terrorist attack regardless of location or on-site security, and (2) DHS was not 

using threat data for 90 percent of the tiered facilities—those tiered for the risk of 

theft or diversion—and using 5-year-old threat data for the remaining 10 percent 

of those facilities that were tiered for the risks of toxic chemical release or sabotage. 

We recommended that DHS enhance its risk assessment approach to incorporate all 

elements of risk and conduct an independent peer review after doing so. DHS 

agreed with our recommendations and has implemented actions to address both of 

them. 

Specifically, with regard to our recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, DHS worked with Sandia National Laboratories to develop a model to estimate the economic consequences of a 

chemical attack. In addition, DHS worked with Oak Ridge National Laboratory to 

devise a new tiering methodology, called the Second Generation Risk Engine. In so 

doing, DHS revised the CFATS threat, vulnerability, and consequence scoring methods to better cover the range of CFATS security issues. Additionally, with regard 

to our recommendation that DHS conduct a peer review after enhancing its risk assessment approach, DHS conducted peer reviews and technical reviews with Government organizations and facility owners and operators, and worked with Sandia 

National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology. 

To further enhance its risk assessment approach, in the fall of 2016, DHS also 

revised its Chemical Security Assessment Tool (CSAT), which supports DHS efforts 

to gather information from facilities to assess their risk. According to DHS officials, 

the new tool—called CSAT 2.0—is intended to eliminate duplication and confusion 

associated with DHS’s original CSAT. DHS officials told us that they have improved 

the tool by revising some questions in the original CSAT to make them easier to 

understand; eliminating some questions; and pre-populating data from one part of 

the tool to another so that users do not have to retype the same information multiple times. DHS officials also told us that the facilities that have used the CSAT 

2.0 have provided favorable feedback that the new tool is more efficient and less 

burdensome than the original CSAT. Finally, DHS officials told us that, as of June 

2018, DHS completed all notifications and processed tiering results for all but 226 

facilities. DHS officials did not provide an estimated target completion date for these 

pending risk assessments, noting that completing the assessments is highly dependent on the facilities providing the necessary Top Screen information. 

Reviewing and Approving Facility Site Security Plans 

DHS has also made progress reviewing and approving facility site security plans 

by reducing the time it takes to review these plans and eliminating the backlog of 

plans awaiting review. In April 2013, we reported that DHS revised its procedures 

for reviewing facilities’ security plans to address DHS managers’ concerns that the 

original process was slow, overly complicated, and caused bottlenecks in approving 

plans.13 We estimated that it could take DHS another 7 to 9 years to review the 

approximately 3,120 plans in its queue at that time. We also estimated that, given 

the additional time needed to do compliance inspections, the CFATS program would 

likely be implemented in 8 to 10 years. We did not make any recommendations for 

DHS to improve its procedures for reviewing facilities’ security plans because DHS 

officials reported that they were exploring ways to expedite the process, such as 

reprioritizing resources and streamlining inspection requirements. In July 2015, we 

reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve 

18 

14GAO–15–614. 15Department of Homeland Security, National Protection and Programs Directorate, Implementation Status of the Chemical Facility Anti-Terrorism Standards: Second Semiannual, Fiscal 

Year 2016 Report to Congress (Washington, DC: December 9, 2016). 16GAO–17–502. 17See 6 U.S.C. § 622(c)(4). Under the CFATS rule, once a facility is assigned a final tier, it 

is to submit a site security plan or participate in an alternative security program in lieu of a 

site security plan. An alternative security program is a third-party or industry organization program, a local authority, State, or Federal Government program, or any element or aspect thereof 

that DHS determines meets the requirements of the regulation and provides an equivalent level 

of security to that established by the regulation. See 6 C.F.R. § 27.105. Chemical facilities assessed by DHS and considered to be high-risk are placed into one of four risk-based tiers (with 

tier 1 being the highest-risk tier and 4 being the lowest). 18S. Rep. No. 113–263, at 9–10 (Sept. 18, 2014). 19 A facially-deficient site security plan is defined as a security plan that does not support a 

certification that the security measures in the plan address the security vulnerability assessment and risk-based performance standards, based on a review of the facility’s site security 

plan, the facility’s Top Screen, the facility’s security vulnerability assessment, or any other information that the facility submits to ISCD or ISCD obtains from a public source or other source. 

6 U.S.C. § 621(7). Specifically, ISCD determines that an EAP site security plan is deficient if 

it: Does not include existing or planned measures which satisfy applicable Risk-Based Performance Standard; materially deviates from at least one EAP security measure without adequately 

explaining that the facility has a comparable security measure; and/or contains a misrepresentation, omission, or inaccurate description of at least one EAP security measure. A facility is to 

implement any planned security measures within 12 months of the EAP site security plan’s approval because ISCD has determined that it is unlikely that all required security measures will 

be in place when a facility submits its plan to ISCD. 20GAO–17–502. 21 An authorization inspection consists of an initial, physical review of the facility to determine 

if the Top Screen, security vulnerability assessment, and site security plan accurately represent 

and address the risks for the facility. 22GAO–17–502. 

security plans for the approximately 900 remaining facilities.14 DHS officials attributed the increased approval rate to efficiencies in DHS’s review process, updated 

guidance, and a new case management system. Subsequently, DHS reported in its 

December 2016 semi-annual report to Congress that it had eliminated its approval 

backlog.15

Finally, we found in our 2017 review that DHS took action to implement an Expedited Approval Program (EAP).16 The CFATS Act of 2014 required that DHS create 

the EAP as another option that tier 3 and tier 4 chemical facilities may use to develop and submit security plans to DHS.17 Under the program, these tier 3 and 4 

facilities may develop a security plan based on specific standards published by DHS 

(as opposed to the more flexible performance standards using the standard, non-expedited process). DHS issued guidance intended to help facilities prepare and submit their EAP security plans to DHS, which includes an example that identifies prescriptive security measures that facilities are to have in place. According to committee report language, the EAP was expected to reduce the regulatory burden on 

smaller chemical companies, which may lack the compliance infrastructure and the 

resources of large chemical facilities, and help DHS to process security plans more 

quickly.18 If a tier 3 or 4 facility chooses to use the expedited option, DHS is to review the plan to determine if it is facially deficient, pursuant to the reporting requirements of the CFATS Act of 2014.19 If DHS approves the EAP site security 

plan, it is to subsequently conduct a compliance inspection. 

In 2017, we found that DHS had implemented the EAP and had reported to Congress on the program, as required by the CFATS Act of 2014.20 In addition, as of 

June 2018, according to DHS officials, only 18 of the 3,152 facilities eligible to use 

the EAP had opted to use it. DHS officials attributed the low participation to several possible factors including: 

• DHS had implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS; 

• facilities may consider the expedited program’s security measures to be too 

strict and prescriptive, not providing facilities the flexibility of the standard 

process; and 

• the lack of an authorization inspection may discourage some facilities from 

using the expedited program because this inspection provides useful information 

about a facility’s security.21

We also found in 2017 that recent changes made to the CFATS program could 

affect the future use of the expedited program.22 As discussed previously, DHS has 

revised its methodology for determining the level of each facility’s security risk, 

which could affect a facility’s eligibility to participate in the EAP. 

19 

23GAO–15–614. 24GAO–18–538. 25 In accordance with the CFATS regulations, as a general matter, DHS intends to require 

facilities in Tiers 1 and 2 to update their Top Screen every 2 years, and for Tiers 3 and 4 every 

3 years. DHS conducts compliance inspections on a regular and recurring basis. DHS officials 

stated that compliance inspections are prioritized based on several factors including tier and the 

number of planned security enhancements required at facilities. 26 In addition to these two corrective actions, we reported in August 2018 that, since fiscal 

year 2015, DHS has issued 5 additional orders to 4 high-risk facilities with final penalties totaling $38,691.88. Of these 5 orders, 3 included the failure of a facility to submit an approvable 

security plan and 2 included the failure of a facility to submit a Top Screen. 27GAO–13–353. 

Inspecting Facilities and Ensuring Compliance 

In our July 2015 report, we found that DHS began conducting compliance inspections in September 2013, and by April 2015, had conducted inspections of 83 of the 

inspected 1,727 facilities that had approved security plans.23 Our analysis showed 

that nearly half of the facilities were not fully compliant with their approved site 

security plans and that DHS had not used its authority to issue penalties because 

DHS officials found it more productive to work with facilities to bring them into 

compliance. We also found that DHS did not have documented processes and procedures for managing the compliance of facilities that had not implemented planned 

measures by the deadlines outlined in their plans. We recommended that DHS document processes and procedures for managing compliance to provide more reasonable 

assurance that facilities implement planned measures and address security gaps. 

DHS agreed and has since taken steps toward implementing this recommendation. 

Specifically, DHS revised CFATS Standard Operating Procedures that, as of February 2019, we are reviewing to determine if they sufficiently document the processes and procedures currently being used to track noncompliant facilities and ensure facilities implement planned measures as outlined in their approved site security plans. 

In August 2018, we reported that our analysis of DHS data since our 2015 report 

showed that DHS has made substantial progress in conducting and completing compliance inspections.24 Specifically, our analysis showed that DHS increased the 

number of compliance inspections completed per year since DHS began conducting 

compliance inspections in 2013 and that, for the 2,466 high-risk facilities with an 

approved site security plan as of May 2018, DHS had conducted 3,553 compliance 

inspections.25 Of these, DHS issued corrective actions to 2 facilities that were not 

in compliance with their approved site security plan.26

In our August 2018 report, we also found that DHS developed a new methodology 

and performance measure for the CFATS program in order to evaluate security 

changes made by high-risk chemical facilities, but that the methodology does not 

measure the program’s impact on reducing a facility’s vulnerability to an attack. We 

found that DHS could take steps to evaluate vulnerability reduction resulting from 

the CFATS compliance inspection process. We recommended that DHS incorporate 

vulnerability into the new methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the 

CFATS program’s performance in lowering risk and enhancing National security. 

DHS agreed and is taking steps to implement this recommendation. Specifically, in 

September 2018, DHS reported making progress toward the implementation of 2 

new performance metrics by the end of the first quarter of fiscal year 2019. DHS 

officials stated that these metrics should, among other things, evaluate the progress 

of individual facilities in enhancing their security while part of the CFATS program 

and be used to demonstrate an increase in the security posture across the population of CFATS facilities. 

Conducting Stakeholder and First Responder Outreach 

In April 2013, we reported that DHS took various actions to work with facility 

owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but that some trade associations had mixed views 

on the effectiveness of DHS’s outreach.27 We found that DHS solicited informal feedback from facility owners and operators in its efforts to communicate and work with 

them, but did not have an approach for obtaining systematic feedback on its outreach activities. We recommended that DHS take action to solicit and document 

feedback on facility outreach consistent with DHS efforts to develop a strategic communication plan. DHS agreed and has implemented this recommendation by developing a questionnaire to solicit feedback on outreach with industry stakeholders and 

began using the questionnaire in October 2016. 

20 

28GAO–18–538. 29 Under Section 312 of the Emergency Planning and Community Right-to-Know Act of 1986 

(EPCRA), facilities are required to submit an emergency and hazardous chemical inventory 

form—referred to as a Tier 2 form. See 42 U.S.C. § 11022. The purpose of this form is to provide 

State and local officials and the public with specific information on potential hazards. This includes the locations and amount of hazardous chemicals present at a facility during the previous 

calendar year. 

In August 2018, we reported that DHS shares some CFATS information with first 

responders and emergency planners, but these stakeholders may not have all of the 

information they need to minimize the risk of injury or death when responding to 

incidents at high-risk facilities.28 While certain facilities are required under the 

Emergency Planning and Community Right-to-Know Act of 1986 to report some 

chemical inventory information, which local officials told us they rely on to prepare 

for and respond to incidents at chemical facilities, we found over 200 chemicals covered by CFATS that may not be covered by these reporting requirements.29 We also 

reported that DHS developed a secure interface called the Infrastructure Protection 

(IP) Gateway that provides access to CFATS facility-specific information that may 

be missing from required reporting. However, we found that the IP Gateway is not 

widely used at the local level and officials from 13 of 15 selected Local Emergency 

Planning Committees we contacted—consisting of first responders and covering 373 

CFATS high-risk facilities—said they did not have access to CFATS data in the IP 

Gateway. We recommended that DHS should take actions to encourage access to 

and wider use of the IP Gateway and explore other opportunities to improve information sharing with first responders and emergency planners. DHS concurred with 

this recommendation and reported in September 2018 that they are taking actions 

to implement it. Specifically, DHS has revised 3 fact sheets and an outreach presentation to include information on the IP Gateway and how to request access to it. 

In addition, DHS plans to ensure contact is made with first responders representing 

the top 25 percent of CFATS high-risk chemical facilities by no later than March 

2019 so that they are properly prepared to respond to incidents at these facilities. 

Chairman Thompson, Ranking Member Rogers, and Members of the committee, 

this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. 

Chairman THOMPSON. I thank all the witnesses for their testimony. I remind each Member that he or she will have 5 minutes 

to question the panel. 

Now, I will recognize myself for questions. You saw the picture 

on the screen earlier about the 12 first responders in West, Texas 

who, unfortunately, lost their life because they were basically responding to an incident that we could possibly cover on the CFATS. 

Now, the law requires DHS to share such information as is necessary. So, Mr. Anderson, you indicated in your testimony that 

GAO surveyed first responders and emergency planners last year 

about whether such critical information is getting shared. Tell us 

what you found in that survey? 

Mr. ANDERSON. Of course. As part of our work, we looked at 13 

or interviewed 13 to 15 local emergency planning committees. 

These committees cover about 373 high-risk facilities. Thirteen of 

those 15 local emergency planning committees did not have access 

to the information in CFATS that could potentially be useful to 

first responders and emergency planners. 

Chairman THOMPSON. So the majority of the information that 

was available, just was not being shared? 

Mr. ANDERSON. I think it is a situation of access. DHS has stood 

up something called the IP Gateway, which is a forum and a vehicle for communicating that kind of information to first responders. 

I think this is a situation where the first responders either did not 

have access or were not familiar with how to use the IP Gateway 

system. 

21 

Chairman THOMPSON. So Mr. Wulf, can you provide the committee with what do you see as a way forward in this respect? 

Mr. WULF. Absolutely, Mr. Chairman. I appreciate the opportunity. 

So obviously the sharing of information with first responders is 

of the utmost importance and is something that we highly 

prioritize as a result. Those who may be called upon to respond to 

incidents at facilities, high-risk facilities, or other facilities, holding 

chemicals, need information about those facilities. 

They need information about the chemical holdings so they know 

what they are walking into when they attempt to save lives and 

property. 

So we have redoubled our efforts over the past couple of years, 

to reach to local emergency planning committees. 

In fact, in 2018, we visited more than 800 of those local emergency planning committees, and we are right now in the midst of 

a push to reach emergency planning committees associated with 

the highest population, CFATS-covered facilities in the various 

counties, the top 25 percent of those counties across the country. 

I think another important thing to remember is that CFATS and 

our chemical security inspectors across the country promote sharing of information with first responders and do that in a way that 

connects them directly with facilities. 

So one of the CFATS risk-based performance standards, RBPS 9, 

is focused on response, and it requires that every high-risk facility 

reach out to make contact with their local first responders. In 

many cases our inspectors, our CFATS team, facilitates that contact and that communication. 

So I think that is another important way in which we are continuing to get the word out. We are pushing, as well, information 

about that IP Gateway and signing more and more folks up every 

day—— 

Chairman THOMPSON. So—— 

Mr. WULF. To gain access to the portal. 

Chairman THOMPSON. Before I lose my time, you know, that was 

this requirement that at least 25 percent that you referenced in 

your comments would be done by the end of March. Where are you 

percentage-wise with hitting that target? 

Mr. WULF. We are on track to have that done by the end of 

March. 

Chairman THOMPSON. After that, what is the next target? 

Mr. WULF. We will continue, you know, circling back. We have 

met with literally thousands of local emergency planning committees. 

We are committed to continuing to ride that circuit and to ensure 

that relevant folks, those who have a need-to-know information 

about chemical facilities and chemical holdings, because they may 

be called to run into those facilities, have the information—— 

Chairman THOMPSON. Well, the reason I said that, as I look at 

the membership of the committee present, a lot of us represent volunteer fire departments in our respective districts. 

So I think it is really incumbent upon us to push this information out to those departments so that those first responders who 

22 

are unpaid, doing their civic duty, would not be put at risk simply 

because the information that is available is not being shared. 

Can you give the committee some kind of a guestimate as to 

when the process can be completed? 

Mr. WULF. Well, you know, I would say that it is going to be an 

on-going kind of continuing effort. I don’t think we will ever stop 

the outreach. 

But we will get through those 25 percent highest-density counties in the next month. I would suspect that, you know, toward the 

end of this calendar year we will have gotten to most of the other 

LEPCs across the country, as well. In many cases, those will be repeat visits. 

Chairman THOMPSON. Thank you. 

I will now recognize the Ranking Member of the full committee 

is the gentleman from Alabama, Mr. Rogers, for questions. 

Mr. ROGERS. Thank you, Mr. Chairman. I gather from your opening statements that CFATS is working well. Is that a fair—now 

you suggested some improvements, but generally, it is working 

well? 

Mr. ANDERSON. The program has progressed over the years and 

has implemented the majority of GAO’s recommendations so on 

that score, yes. 

Mr. ROGERS. You mentioned some recommendations, but I didn’t 

hear anything major that you thought needed to be improved. Is 

that accurate? 

Mr. ANDERSON. We don’t have any open recommendations that 

would be easily directed to, you know, like the safety of a facility 

itself. 

Our recommendations that are open and not implemented do 

deal with whether or not first responders have all the information 

they need. So on that score, I would consider that a major recommendation, ensuring that the people who respond to these 

events have the right kind of information. 

The other recommendation that we have that is currently open 

is on whether or not the program itself can speak to just how much 

risk is reduced. 

As the program evolves, we would like to see them get to the 

point where they can say, for X number of dollars invested, here 

is how much risk has been reduced through this process, through 

CFATS. 

Mr. ROGERS. OK. 

Mr. Wulf, how would you distinguish CFATS from other security 

regulatory programs, like EPA, OSHA, ATF? 

Mr. WULF. Yes, so I appreciate the question. CFATS is a very 

comprehensive, very security-focused regulatory program. So programs administered by EPA and OSHA focus primarily on safety. 

Our program, the CFATS program, is a security-focused anti-terrorism program. 

At its core our 18 risk-based performance standards addressing 

physical security measures to deter, detect, delay terrorist attacks, 

cybersecurity, insider threat, and the various security-focused 

threat streams. 

So I think it is a program that is flexible in its approach, which 

I think is well-suited to the wide diversity of facilities that compose 

23 

the CFATS-regulated universe. It is a program that is very wellsuited to its task. 

Mr. ROGERS. Great. Mr. Wulf, do you feel that any CFATS facilities are subject to duplicate security regulations from the jurisdiction of other Federal agencies? 

Mr. WULF. So that is a a good question. I would say that given 

the comprehensive nature of the CFATS program, although there 

are certainly facilities that are touched by a variety of different 

programs, CFATS is in all cases bringing something additional to 

the table. 

Where facilities are, perhaps, doing things under a different program, if they are putting in place measures, say, to satisfy ATF requirements, but those measures also work to satisfy our DHS 

CFATS requirements, we absolutely encourage facilities to take 

credit for and apply those measures within CFATS. They are not 

required to duplicate work for CFATS. 

Mr. ROGERS. Great, thank you. That is all I have. 

I yield back. 

Chairman THOMPSON. Thank you very much. 

The Chair now recognizes other Members for questions they may 

wish to ask the witnesses. In accordance with our committee rules, 

I will recognize Members who were present at the start of the hearing, based on seniority on the committee, alternating between Majority and Minority. Those Members coming in later will be recognized in the order of their arrival. 

The Chair now recognizes for 5 minutes the gentleman from 

Rhode Island, Mr. Langevin. 

Mr. LANGEVIN. Thank you, Mr. Chairman. I want to thank you 

for holding this important hearing. 

I want to thank our witnesses for your testimony this morning. 

I am glad we touched on the issue of cybersecurity in the facility 

issues and inspections that are done. 

So I want to start with Mr. Wulf, if I could? DHS does provide 

that cyber is one of the l8 performance standards facilities must 

address. 

So I want to start out with the question of what cybersecurity 

guidance does the CFATS program actually provide to facilities? 

What cybersecurity requirements does CFATS make of facilities? 

Mr. WULF. I appreciate that question. CFATS has been in many 

ways, I think, ahead of the curve with cybersecurity. So cybersecurity has been an important part of the program since its inception. 

I would say broadly speaking our focus is on working with facilities to ensure that they have policies and procedures in place essentially to deter, to detect, and/or to delay cyber intrusions. 

So, you know, we work with them. We have our inspectors 

trained. Many of our inspectors have been provided advanced cybersecurity training. 

We have cybersecurity experts in our headquarters who work 

with facilities as they develop their site security plans, as they 

think through ways in which they can appropriately restrict access 

to critical cyber systems, ways in which they can restrict privileges, 

ensure that they have appropriate patches in place, that they are, 

you know, that they are in the best position possible to protect 

24 

themselves against malware, against ransomware, against the, you 

know, the panoply of cyber threats that are out there. 

Mr. LANGEVIN. So what are the specific requirements, the cyber 

requirements that you put on these facilities? How do you audit 

those requirements to determine compliance? 

Mr. WULF. Yes, so we will conduct inspections of facilities across 

all of their risk-based performance standards and that includes 

cyber. 

So, you know, even before a facility site security plan is improved, our inspectors will be out helping facilities to develop the 

policies and procedures they will put in place from a cybersecurity 

perspective. When their plans have been approved, we will be back 

on a regular cycle of compliance inspections. 

So as I mentioned earlier, CFATS is a non-prescriptive, flexible 

program. So we don’t have hard and fast requirements. We have 

standards that facilities need to meet. 

So, you know, we will work with facilities to assess what works 

for a particular facility given its particular operations and the level 

of integration of its cyber systems with its chemical processes and 

industrial control systems, et cetera. 

Mr. LANGEVIN. So am I to understand that they are setting their 

own standards? 

Mr. WULF. They are not setting their own standards. They have 

some flexibility in the types of policies and procedures they can 

apply to meet the spirit of the cybersecurity standard under 

CFATS. 

But no two chemical facilities are alike. So some facilities have 

cyber systems that are very highly integrated with their industrial 

control systems, with their chemical processes. Some have no integrations whatsoever. So there may be a difference from facility to 

facility, as to what we are going to ask them to have in place to 

get to a place where we can approve their site security plan. 

Mr. LANGEVIN. OK. I have other questions for you, but I am 

going to go to Mr. Anderson, if I could? 

Mr. Anderson, staying on the topic of cybersecurity, what does 

GAO evaluate the maturity of the CFATS cybersecurity reviews to 

be? Do you have suggestions on how those elements of SSPs can 

be improved? 

Mr. ANDERSON. Thank you. We haven’t done a deep dive audit 

into the cyber realm. But we have touched on it in our recent work. 

I think our conclusion is that this may be an area, cyber specifically, where there may be a capability gap. 

As you may know, GAO produces a high-risk list every 2 years 

highlighting certain programs that are vulnerable and at high risk 

for fraud, waste, abuse, and mismanagement. 

The cyber area within DHS is one of those where recently we did 

raise the question about whether or not they have the right human 

capital resources to address the cyber threat. 

Mr. LANGEVIN. Thank you. 

Mr. Chairman, we may want to ask for a specific GAO report on 

this particular topic with respect to cyber to make sure that there 

is no gap, if we could—something you would consider? 

Chairman THOMPSON. Absolutely. I will work with Tim Richman 

on making sure we get that request. 

25 

Mr. LANGEVIN. Thank you. 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentleman from North Carolina, 

Mr. Walker. 

Mr. WALKER. Thank you, Mr. Chairman. 

Thank you to our panel today. 

Mr. Wulf, as the director of the infrastructure security compliance division, my question for you is does every employee at each 

location have access to all areas of the facility? Or do certain chemical facilities have Classified areas? Could you address that for me? 

Mr. WULF. Sure, I appreciate the question. The short answer is, 

it varies from facility to facility based upon, you know, the facility 

management, the facility security officers’ assessment as to what 

makes sense given that facility’s particular operation. 

So you may find a facility with restricted access to certain critical 

assets. You may have a facility on which all employees have access 

to all parts of the facility. 

Mr. WALKER. Are there any of those scenarios that concern you? 

Or are you familiar with enough to know, as you said, the varying 

scenarios? Can you deep dive a little bit more for me? 

Mr. WULF. Yes. So, you know, as we work with facilities on an 

individual basis, which we do as each one develops its comprehensive site security plan, you know, we assess whether it makes 

sense to have a more restricted area where high-risk chemicals of 

interest are stored. 

Whether it makes sense for a particular facility to more fully restrict access to some of its employees or perhaps to contractors who 

are, you know, coming in and out of the facility. 

Mr. WALKER. Yes. Do you have any concerns of any of the areas 

that you have overlooked or reviewed? 

Mr. WULF. I would say that we have, you know, identified areas 

of concern as we have worked with facilities to develop their site 

security plans. We have been able to address those in the course 

of that SSP development process. 

So I would not approve a plan about which I had concerns. 

Mr. WALKER. So let me make sure. Is that process in development or are you saying that it is past tense, that those have been 

resolved in those concerns? 

Mr. WULF. Those have been resolved and the site security plans 

have been approved. 

Mr. WALKER. Some proposed reforms have included requiring all 

employees at a facility to be notified of the security requirements 

under CFATS. Do you agree, Mr. Wulf, that having front office 

staff, like an accountant or receptionist, know the CFATS plan 

would add additional security to a chemical facility? Do you agree 

with that? 

Mr. WULF. So the law requires facilities, to the extent practical, 

to involve employees who have relevant security expertise in the 

development of their site security plans. That is, I would say, not 

likely to include administrative staff. 

Mr. WALKER. So going back to my previous question, that 

wouldn’t be a concern for you? That in this case the accountant or 

the receptionist know the CFATS plan? You don’t think that would 

help as far as adding additional security to a chemical facility? 

26 

Mr. WULF. I don’t imagine that would be particularly helpful. 

Mr. WALKER. OK. Could you describe the additional security 

risks that may arise from a proposal like this? Can you go in a little bit more detail? What—would be the issue here? 

Mr. WULF. Yes. So I think the core of the issue on the sharing 

of information in the employee context or otherwise is, you know, 

the importance of ensuring that those folks who have a need-toknow information, that includes certainly the first responders we 

discussed earlier, or sort-of a key facility security-focused personnel 

have the information that they need to develop plans and to execute security plans. 

There are processes in place within CFATS, within our riskbased performance standards, that ensure that other employees at 

facilities, even those who, you know, might not be privy to all the 

details of a security plan or of chemical holdings on the facility are, 

you know, are brought into training, are brought into exercises and 

drills on incident response so they have what they need in the 

event of an incident. 

But I don’t believe that all employees need access to the security 

features of a plan. 

Mr. WALKER. Thank you, Mr. Wulf. 

Mr. Chairman, I yield back. 

Chairman THOMPSON. Thank you very much. 

The Chair now recognizes the gentlelady from New Mexico, Ms. 

Torres Small. 

Ms. TORRES SMALL. Thank you, Chairman Thompson. 

Mr. Wulf, you spoke about—and I was glad to see that you mentioned DHS outreach to the chemical security community in your 

prepared statement and also to see that you had talked with over 

800 local emergency planning communities, based on your questions with Chairman Thompson. 

I would like you to speak specifically to outreach to rural communities. If there are any—I represent the bottom, more than onehalf, of New Mexico. So we have a fair number of large rural communities there. 

So I would like you to speak slightly to if there is any additional 

outreach you do in these communities where volunteer firefighting 

departments are in a deeper need. 

Mr. WULF. Absolutely. I appreciate that, and we certainly want 

to and do get out, you know, to both urban, suburban, and rural 

communities. We want to ensure that all who have a need-to-know 

information about high-risk chemical facilities, about the chemical 

holdings have access to that information. 

So absolutely, we make an extra effort to get out to rural communities. We have about 150 inspectors across the country. We have 

actually put in place across the country some new regional offices 

at which we have put in place regional outreach coordinators, 

training, and exercise coordinators. 

We have additional firepower at the kind-of agency level as well 

now to help with that outreach. So very much committed to continuing on that path. 

Ms. TORRES SMALL. Do you have any specific resources tailored 

toward these rural communities? 

27 

Mr. WULF. I think they are, essentially, the same resources that 

we provide to all first responders, so access to the IP Gateway tool. 

You know, we facilitate connections between those first responders 

and facilities in their areas of responsibility and ensure that that 

happens for each and every facility, rural or otherwise. 

Ms. TORRES SMALL. In the questions that Chairman Thompson 

asked, I am glad to hear that DHS is on track for the March 2019 

deadline for doing the outreach to the high-risk chemical facilities. 

Does that information sharing include the specific chemical holdings stored on the sites that the first responders would be responding to? 

Mr. WULF. Yes, it does. So first responders who have a facility 

in their sort-of area of jurisdiction can have access. We want them 

to have access to that information. 

Ms. TORRES SMALL. Right. I want to switch gears just a little bit 

in terms of it appears that DHS relies heavily on the CFATS facilities to reach out to local emergency responders. Then you have inspectors who come in and confirm that that has occurred. Is that 

accurate? 

Mr. WULF. In some cases, that is accurate. We will confirm in 

every case. In some cases we will actually proactively facilitate the 

introduction and make sure that that happens and in many cases 

participate in those meetings. 

Ms. TORRES SMALL. If it turns out that there hasn’t been outreach by the facility, would that result in disproving of a facility’s 

site security plan? 

Mr. WULF. It absolutely would. We would not approve a plan 

where that outreach connection has not been made. 

Ms. TORRES SMALL. Great. We also discussed a little bit the outreach that is done to employees of facility plans, so the training 

and exercise and drills that are done, but also limiting access on 

a need-to-know basis. 

I would like to know a little bit about the input requirement, 

that there is a requirement to get input from at least one employee, 

where applicable, or a labor union representative informing the facility plan. Do inspectors confirm that that input requirement has 

been complied with? 

Mr. WULF. Inspectors will raise that issue during an inspection 

and will hear from facilities to what extent they have involved employees and/or as kind-of relevant resident bargaining unit members in the process. So yes, those discussions happen during inspections. 

Ms. TORRES SMALL. Are inspectors required to speak with those 

employees or union representatives? 

Mr. WULF. It is not a requirement. 

Ms. TORRES SMALL. If it is determined, even if they are not 

speaking with the employees or labor unions, that there was not 

an employee or labor union representative consulted, does that result in disproving of the security plan? 

Mr. WULF. It does not. It does not. So, you know, we sort-of leave 

to the discretion of those who are responsible for security of the facility the extent to which it actually is practical to involve, you 

know, however many employees in the process. 

28 

Ms. TORRES SMALL. Even though the CFATS Act requires that 

input? 

Mr. WULF. Well, the CFATS Act talks about involvement to the 

extent practical. 

Ms. TORRES SMALL. Thank you. 

Chairman THOMPSON. Thank you. Thank you very much. 

The Chair now recognizes gentlelady from Arizona, Mrs. Lesko. 

Mrs. LESKO. Thank you, Mr. Chairman. My question is for Mr. 

Wulf. The question is, you know, some would say that Department 

of Homeland Security should mandate that CFATS facilities, regulated facilities, should adopt inherently safer technologies to improve security. 

I have been told that these facilities are opposed to that. So I 

guess I am asking if you think that is necessary and at what rate 

are the facilities already developing these safer technologies without Federal mandates? 

Mr. WULF. Yes, that is a good question. I appreciate it. I would 

say that organically CFATS has promoted the consideration and 

implementation of facilities of inherently safer technologies and 

processes. 

So, you know, over the course of the program’s history more than 

3,000 facilities have either reduced their holdings of high-risk 

chemicals of interest or eliminated them completely, substituting 

other less risky chemicals or have changed their processes and 

have actually come out of the program, been determined no longer 

to be high-risk. 

You know, to my mind that is a success. That is a win for the 

program without really the need for an inherently safer technology 

mandate. 

Mrs. LESKO. I have another question for either one of you and 

that is how do you work? I heard earlier how you work with local 

responders and a gateway program that they look at. I don’t know 

if that is on-line or what it was. 

But how do you work with the States and local agencies? How 

do you communicate with them or does every State have an agency 

that deals directly with you? How does this work? 

Mr. WULF. Yes, it varies by State, so, you know, some States 

have multiple agencies that touch facilities holding chemicals. 

Some States have one. In some States it is the State fire marshal, 

in some States it is the fire marshal plus the State Department of 

Environmental Quality, the State Railroad Commission or otherwise. 

So on a State-by-State basis, we engage with the relevant agencies both State and local levels. We prioritize the sharing of information about the list of facilities we have under our purview, both 

those that we have tiered as high-risk and those that we have determined to be not high-risk. 

We kind-of share lists with those State agencies. We crosswalk 

those lists and we strive to identify what we call potential chemical 

facilities of interest, essentially potential outlier facilities with an 

eye toward bringing into the program to ensure that we are getting 

the relevant reports to run through our risk assessment methodology from facilities that have threshold quantities of chemicals of 

interest. 

29 

So that is an area in which we have really stepped up our efforts 

in recent years. We have put into place a leader within our organization whose full-time responsibility is to coordinate the outreach 

that we do for the purpose of bringing into the fold those potential 

outlier facilities. 

Mrs. LESKO. One last question, Mr. Chairman. 

Yesterday, I think it was yesterday, we had testimony from some 

cybersecurity folks from the Federal Government and one of the 

things that was identified as a problem is in cybersecurity there 

are these different silos. They are always working on cybersecurity 

in just that one area and don’t really share information. 

Do you see that as a problem in this sector as well? Because 

what they were trying to say is usually attackers, hackers or foreign governments will not only attack one area, but they will try 

and attack all of the areas. 

Mr. WULF. Yes, and I think that is absolutely a concern and it 

is something that the design of CFATS guards very much against. 

So we have 18 risk-based performance standards that facilities 

work with us to, you know, as they work with us they put into 

place security measures focused not only on physical security, but 

also on cybersecurity, on insider threat, on the, you know, the wide 

variety of kind of threat vectors that exist. 

So, you know, we believe that a high-risk chemical facility that 

has an improved site security plan and is implementing that site 

security plan has hardened itself very effectively against multi-faceted attacks. 

Mrs. LESKO. Thank you, Mr. Chair. I yield back my time. 

Chairman THOMPSON. Thank you very much. 

The Chair now recognizes the gentlelady from Michigan, Ms. 

Slotkin. 

Ms. SLOTKIN. Good evening—or good morning—Lord, not good 

evening. Thanks for being here. I really appreciate you guys doing 

this. I am from Michigan and we have a large of number of these 

facilities, including two in my district. Then just outside my district 

in Detroit, we had a big chemical fire in years that passed. So this 

one is really of interest to my community. 

I guess my first question, Mr. Wulf, is just on accountability. So 

how would a Member of Congress know after March whether the 

facilities in his or her district have communicated effectively with 

local law enforcement, that there is a shared understanding of 

kind-of the risks? Like, how would I know that after March? 

Mr. WULF. Are you talking about the communication with the 

first responders? 

Ms. SLOTKIN. Yes, just making sure—yes, because I think we had 

this Detroit fire years ago, years ago. But my understanding is we 

did not have full awareness by the first responders. We didn’t lose 

anyone, but it certainly was a potential risk. So how would I feel 

comfort that my local responders have been informed with what 

they need? 

Mr. WULF. Yes. So I think I can tell you with confidence that all 

facilities within the CFATS program, all facilities covered by 

CFATS, will have made connections with their relevant local first 

responders. It is a requirement of the program. 

30 

It is the focus of one of our risk-based performance standards, 

number 9 of 18. It is something that we verify and facilitate. So 

you can rest assured that that is happening across the 3,300 highest-risk chemical facilities and their relevant first responders 

across the country. 

Ms. SLOTKIN. Then are you the senior accountable official if for 

some reason that didn’t happen, right? Of course, I want that all 

to happen and I want them to check the box, but if for some reason 

that hasn’t happened as it should, are you the senior accountable 

official for making sure? 

Mr. WULF. Yes. Yes. 

Ms. SLOTKIN. OK. 

Mr. WULF. Call me. 

Ms. SLOTKIN. OK, great. Then on cyber, similarly, so again, a 

Congresswoman was mentioning this. So if we started to see trends 

in, you know, these hacktivists or these cyber threats against 

chemical facilities, would you know about it? 

If we started to see a systematic attempt either in one State or 

in a series of States to go after these facilities, is there a reporting 

mechanism? Are people telling you about the threats that they see? 

Are you capturing the trends? 

Mr. WULF. Yes, so we have within our broader organization a cybersecurity division and National cybersecurity and communications integration center that is focused on threats Nationally. That 

is crunching all of the intelligence, the threat streams, and that is 

communicating with us. 

So we are in the mix to get that information and we are certainly 

on a daily basis focused on kind-of the continuing cyber and other 

threat streams that concern our facilities. 

Ms. SLOTKIN. Then I am a former CIA officer and so I get a lot 

of—I guess they would call them complaints from people back 

home, generally about the lack of information sharing between 

sort-of folks in Washington seeing maybe some of the Top Secretor Secret-level information on threats related to cyber and then 

what actually distills down. It is a consummate, you know, complaint that I hear. 

So what is your responsibility to go the other direction and inform facilities if you are seeing things that raise your eyebrows? 

What is your mandate to do that? 

Mr. WULF. Yes, and it something that we take very seriously 

and, you know, as the situation might warrant we have mechanisms in place to reach to facilities and talk to them about ways 

in which they can harden, you know, potentially even further 

against specific threats. 

In fact, CFATS program accounts for that, part of a couple of our 

risk-based performance standards are focused on specific threats 

and elevated threats. We require facilities to put into their site security plans measures that they would increase in the event we 

reach out to them and tell them that there is a specific or a more 

generalized elevated threat that they need to concern themselves 

with. 

Ms. SLOTKIN. Last, so again are you the senior accountable official if for some reason there was a threat against a specific facility 

or a bunch of facilities in one State and that information didn’t get 

31 

to the facility so they could protect themselves that is under your 

mandate? 

Mr. WULF. For CFATS facilities—— 

Ms. SLOTKIN. Yes. 

Mr. WULF. Absolutely. 

Ms. SLOTKIN. OK, great. 

Thank you, Mr. Chairman. 

Chairman THOMPSON. Thank you very much. But you raised two 

good questions. 

One is, Mr. Wulf, can you provide the committee with how many 

actions you have brought on facilities inspected that have been 

found in noncompliance? 

Mr. WULF. Sure. I guess it is kind-of a two-part answer because 

of the way the CFATS program and our enforcement processes 

work. Of course, you know, we strive to work with facilities to 

bring them into a compliance, and by and large, facilities have 

done a good job and are in compliance with their plans. 

In upwards of 80 cases we have had to resort to our enforcement 

authorities and to issue an administrative order that per the law 

gives facilities a certain amount of time to get their act together 

and alleviate whatever the issue might be. 

We have gotten to the point with 5 facilities where we have had 

to issue a civil monetary penalty and that has proven in those 

cases to be the additional impetus facilities needed to come into 

compliance. 

Chairman THOMPSON. So everybody is in compliance? 

Mr. WULF. Everybody is currently in compliance. You know, it is 

a dynamic population, right? So facilities are in different stages of 

perhaps working on their site security plans, getting them to approval, but facilities against which we have enforced and issued 

civil penalties have come into compliance. 

Chairman THOMPSON. The last question is those 2 facilities in 

Ms. Slotkin’s district, is there a directory that she can go to or is 

there is a way that she can get with you and you can say these 

2 facilities are compliant? 

Mr. WULF. Yes, absolutely. If they are CFATS facilities we are 

glad to sit down and talk through, you know, what exists in—— 

Chairman THOMPSON. Was really what she was trying to get to. 

Mr. WULF. Pardon me? 

Chairman THOMPSON. That was what she was trying to get to. 

Mr. WULF. Yes, we are glad to get you that information and talk 

through it with—— 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentleman from Texas, Mr. Crenshaw. 

Mr. CRENSHAW. Thank you, Mr. Chairman. Thank you both for 

being here and giving your testimony. I think we have made some 

important strides in streamlining this program. It is an important 

program for my constituents in Houston. 

We have a lot of these facilities, of course, and look forward to 

giving it a long-term extension to this program so that we can have 

some certainty for the industry and for the American people. 

Director Wulf, I want to quickly—I know you answered something inherently about safer technologies a minute ago. I just want 

32 

to get a sense from you, if we were to mandate inherently safer 

technologies, how feasible would that really be for you to regulate—— 

Mr. WULF. I think that would be a pretty tough—to crack from 

a pure regulatory standpoint. 

Mr. CRENSHAW. OK. You can expand on that a little bit if you 

would like. 

Mr. WULF. Yes. No, so I, you know, I think CFATS by its nature 

promotes the consideration of inherently safer technologies and the 

implementation of inherently safer technologies—— 

Mr. CRENSHAW. It is incentives based on the tiering system—— 

Mr. WULF. Right, exactly. 

Mr. CRENSHAW. To sort-of have safer technologies. 

Mr. WULF. So facilities make risk-based decisions to change their 

processes, to change their chemical holdings, maybe to substitute 

safer chemicals. But I would say, you know, we at DHS are focused 

on security. I think it would be difficult for us to regulate it in the 

area of what is safer or not. 

Mr. CRENSHAW. Right. 

For Director Anderson, has the GAO assessed how much new 

standards on inherently separate technologies would cost? 

Mr. ANDERSON. We have not looked at that question specifically. 

You know, just to expand upon what Director Wulf was saying, the 

waterfront of types of facilities is highly variable. You have huge, 

like, petrochemical facilities and then very, very small mom-andshop places that are in rural areas. So mandating a specific technology solution may encounter challenges. 

I think one of the things we have routinely heard in our conversations with industry is about the flexibility of the program and 

the implementation of the 18 risk-based performance standards. 

That is what I can speak to. To answer your question directly, we 

have not looked at the technology. 

Mr. CRENSHAW. Right. 

Director Wulf, back to you. Should the risk-based performance 

standards be modified or reflect evolving threats from drones or 

other unmanned aerial vehicles? 

Mr. WULF. Yes, so the drones question is an important one, for 

sure and it is a continually evolving sort-of threat vector. I think 

as they stand the risk-based performance standards account for, 

and we certainly engage with facilities, on the reporting of significant incidents. 

We do take in a, you know, decent number of reports associated 

with overflight or flights nearby high-risk chemical facilities of unmanned aircraft systems. 

So I think we have the tools in place from an incidents reporting 

standpoint. Our counterparts at the Federal Aviation Administration I know are working toward a broader framework, and we are 

working with them—— 

Mr. CRENSHAW. Right. 

Mr. WULF. On that for critical infrastructure. 

Mr. CRENSHAW. Because it is prohibited under Federal law to 

interfere with the operation of a drone right now. So is that part 

of the conversation? I mean to allow essentially facilities to defend 

themselves. 

33 

Mr. WULF. Yes. 

Mr. CRENSHAW. Is that conversation on-going? 

Mr. WULF. I think that is probably part of the broader conversation for sure. You know, it is an issue that we at the Department 

are looking at, not just from a chemical facility angle, but across 

all critical infrastructure sectors. 

Mr. CRENSHAW. OK. Again, I want to encourage all to focus on 

these new problems with drones as they become more prevalent. 

Last question I have for—either one of you can, I think, take 

this. Is there any discussion about the level of scrutiny placed on 

the tier 4 operators and whether that is necessary? Whether that 

really needs to be as stringent as it is, given that the low level of 

danger from tier 4 chemical facilities. 

Is that in discussion at all? What kind of feedback are you getting from the industry on this? 

Mr. WULF. So I think there is pretty broad consensus that tier, 

you know, Tier 4 facilities, Tier 3 facilities as well, which make up 

the majority of our covered chemical facilities are high-risk facilities. They are still among the less than 10 percent of facilities that 

we have determined to be at high risk of terrorist attack or exploitation. 

We do have the tiering system in place, so we do apply kind-of 

different standards to the lower-tiered but still high-risk facilities. 

It seems to be an approach and a framework that continues to 

work well. 

Mr. CRENSHAW. OK. Thank you very much. 

Mr. WULF. Absolutely. Thank you. 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentlelady from Orlando, Florida, 

Mrs. Demings. 

Mrs. DEMINGS. Thank you so much, Mr. Chairman. 

Thank you to both of our witnesses for joining us today. 

Mr. Wulf, my questions are for you. When DHS is considering 

whether a facility is high-risk, do you include in that methodology, 

or whatever process you use, would you factor in if the facility 

would be located to an elementary school for example or a nursing 

home or a hospital? 

Mr. WULF. Yes, so we factor in—that is a good question. We tier 

for a couple of major different threat streams, one of which focused 

on theft and diversion of chemicals, the other which is focused on 

facilities where there could be a release into a surrounding community. In those cases of release, we absolutely factor in the surrounding population. 

One of the things we were able to make some significant headway on, as we kind-of basked in the stability that was afforded by 

long-term authorization, was a complete retooling of our risk assessment methodology. So we are now more accurately able to 

model those surrounding populations and tier more accurately. 

Mrs. DEMINGS. Also, studies show that chemical facilities tend to 

be concentrated in low-income and minority communities. In determining facility risk, does DHS consider whether a facility is in 

close proximity to other chemical facilities that could exacerbate 

the impact of an attack on an already vulnerable population? 

34 

Mr. WULF. We certainly consider what is in the surrounding area 

by way of population as we do our tiering. 

Mrs. DEMINGS. So when you consider the proximity to those populations, those low-income, already very vulnerable areas, what do 

you factor into it? What is it exactly that you are considering or 

looking at? 

Mr. WULF. Well, we are considering where the population is located in proximity to a facility and we are kind-of modeling, you 

know, were there to be an incident that caused a release of chemicals, you know, what part of that population would be impacted 

and, you know and what number of fatalities could potentially 

occur as we are thinking about the tiering. 

Mrs. DEMINGS. OK, so when you say where the population is located, what exactly does that mean? Could you help me with that? 

Mr. WULF. It means, like, how many people are located either, 

you know, during the day or at night in their homes, in their businesses, the schools, and how close they are to the facility. 

Then we look at what type of chemical we are talking about, 

what quantities of chemicals we are talking about, what the prospect is for release of those chemicals, what quantity could be released. 

Then, you know, there is sort-of a plume modeling effort designed to get us to a place where we can model what the consequences would be of a release of chemicals caused by terrorists. 

Mrs. DEMINGS. OK. Finally, what are you doing to make sure security measures aren’t interfering with precautions taken in anticipation of extreme weather or natural disasters? 

As the Chairman indicated, I come from Florida, so I wonder 

what are you doing to make sure there are no conflicts there as you 

are implementing your security measures? Or at least that you are 

working together to make sure there are no conflicts? 

Mr. WULF. Yes, we, you know, we strive to, and we do, in fact, 

work in close cooperation with agencies that are focused on safety, 

that are focused on response to natural disasters. 

So that includes as we continue to implement the provisions of 

an Executive Order from 2014 that followed the West Texas incident, to work closely to coordinate with EPA, with OSHA, with 

ATF and to, you know, harmonize to the extent absolutely possible 

our respective programs. So and to communicate as frequently and 

effectively as we possibly can. 

Mrs. DEMINGS. OK, thank you very much. 

Mr. Chairman, I yield back. 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentleman from Texas, Mr. Taylor. 

Mr. TAYLOR. Thank you, Mr. Chairman. 

Just a question, Mr. Wulf, for you. So I understand that there 

are some facilities that are exempted by statute and some that are 

included. Do you have any thoughts for us on, you know these facilities I am worried about that are exempted and I am concerned 

that these facilities that I am doing, I don’t really see why I am 

doing that. 

So I mean, we write the laws with the best of intent, but not necessarily the implementation is the best. So you are implementing 

35 

so what do you see in terms of what should be in the mix and what 

isn’t in the mix? 

Mr. WULF. Yes. 

Mr. TAYLOR. Can you speak to that? 

Mr. WULF. So there are a number of exemptions, of exclusions, 

from the authorities. So, you know, broadly those exclusions apply 

to facilities that are covered by other security-focused programs, so 

nuclear facilities covered by the Nuclear Regulatory Commission, 

facilities owned by the Department of Defense and a handful of 

others. It also includes an exemption for water and wastewater facilities. 

I think that, you know, a dozen years into implementation of the 

program, a pretty opportune time to kind-of take a look at where 

we are with the exclusions and maybe to study what might make 

sense going forward with respect to facilities that are excluded 

from the program. We are open as well to talking about, you know, 

about what facilities are included. 

You know, as I mentioned earlier, I think the comprehensive nature of CFATS makes it very much value-added across the entire 

universe of 3,300-plus facilities that are currently covered as highrisk. I think it is an important program. So I would say there are 

not facilities that which I am saying, why are we doing this? 

Mr. TAYLOR. OK. 

Mr. WULF. We are adding value across the board. 

Mr. TAYLOR. Then sort-of building on that conflicts discussion, 

are you finding yourselves duplicating effort with other agencies 

and where they are, you know, where the person on the ground is 

saying, wow, you are telling me to do it this way but I have got 

this other agency telling me to do it another way. 

I mean, are you finding conflict or maybe even at the statutory 

level where one law says this and another law says that? Are you 

seeing conflict there that needs to be clarified? 

Mr. WULF. I don’t think we are seeing conflict. I think we are 

seeing rare instances in what is needed to require, what is needed 

to meet our standards, meet the intent and spirit of the 18 CFATS 

risk-based performance standards is above and beyond what might 

be required by other programs. 

So I don’t view that as a conflict. I view that as a facility that 

has been assessed to be at high risk of terrorist attack or exploitation having to have in place security measures beyond those that 

might be required or that might be needed by other programs at 

facilities that aren’t high-risk CFATS facilities. 

Mr. TAYLOR. So are you saying that you don’t see conflict? I 

mean, you are not running into other agencies in doing what you 

are doing? 

Mr. WULF. Well, I mean we are certainly covering facilities that 

are covered by other agencies and their programs. No question 

about that. I would say almost every facility we regulate is visited 

as well by, you know, EPA and/or OSHA, in some cases by Bureau 

of Alcohol, Tobacco, Firearms, and Explosives, and by State regulators. 

But I think CFATS is unique and it is an extraordinarily comprehensive program that is targeted at the highest-risk facilities, 

36 

facilities that are at the highest risk of terrorist attack or exploitation. 

So there is some overlap, absolutely, in the universes of facilities 

that we cover as compared to other facilities. You know, that is 

among the reasons we prioritize working closely both at the National and regional levels with other regulatory agencies. 

Mr. TAYLOR. Mr. Chairman, actually, one final question. 

How are you handling changes? I mean when a facility wants to 

change something, add a new cracker or whatever it may be, is 

what you are doing getting in the way of that or is securities just 

for the whole structure, doesn’t matter if they are subtracting or 

adding people, services, plant on the ground? 

Mr. WULF. Yes, unless they are changing their holdings of highrisk chemicals of interest, it should not have an impact. We are always, always willing and able to work with facilities as they are 

thinking about design changes, changes to their processes to talk 

them through what impact it might have and options they might 

have, if there is going to be a potential impact under CFATS. 

Mr. TAYLOR. Thank you. 

Mr. Chairman, I yield back. 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentlelady from California, Ms. 

Barraga ́n. 

Ms. BARRAGA ́ N. Thank you, Mr. Chairman. I want to start by 

thanking you for making this a priority and for pushing this and 

having this hearing. When I saw the photo before we started, of the 

explosion in West, Texas, it reminded me very much of a facility 

that is of great concern in my Congressional district. 

Now, I represent the Port of Los Angeles, and it is a huge economic engine. It touches every Congressional district. Should there 

be an incident there, certainly an explosion like that, it would be 

devastating to the economy and really to the surrounding areas. 

Mr. Wulf, I know you and I had a chance briefly to speak before 

the hearing started. I wanted to make sure to get over here to follow up. I want to talk a little bit about this facility that is of great 

concern in my district. As you are aware of it, it is, I call them the 

LPG storage tanks, they store large amounts of butane and some 

propane. 

Now, these are tanks that are right next to a park where children play, within a very close radius of schools where children go 

to school and not very far at all from residential neighborhoods and 

the Port of Los Angeles. 

I understand that you have been out to the facility, is that correct, Mr. Wulf? 

Mr. WULF. If we are talking about the same facility, then yes I 

have. 

Ms. BARRAGA ́ N. Yes, and is this facility part of the CFATS program? 

Mr. WULF. The facility I visited is part of the program. 

Ms. BARRAGA ́ N. Yes. Do you know if anyone at DHS has assessed 

the devastating impacts that would occur should there be a leak or 

an explosion to that facility? 

Mr. WULF. So, you know, so that is exactly what CFATS is focused on. So, you know, in determining the high-risk status of that 

37 

facility we absolutely would have modeled the potential effects of 

a release caused by a terrorist act on the surrounding population, 

absolutely. 

Ms. BARRAGA ́ N. So one of the questions I often get from constituents, will ask questions like how high-risk is it? Is that information 

public that you might be able to share with us on what the possible 

result would be if there was an explosion there and the risk level? 

Mr. WULF. Well, portions of our risk-tiering methodology are 

Classified—— 

Ms. BARRAGA ́ N. Yes. 

Mr. WULF. It is certainly a discussion we could have. 

Ms. BARRAGA ́ N. OK. You know, one group, a consulting group 

that has done a study on it, concludes that the devastation from 

a blast could stretch as far as 6.8 miles from the facility, and that 

is within the realm of not just residential homes, but the Port of 

Los Angeles. 

Again, when I see the photo of what happened in Texas, I noticed 

there wasn’t too many residential around there. I didn’t even see 

anything around that area. So it is critically important for me that 

we reauthorize the program, but that we are also making sure that 

there is on-going inspections. 

Because I think I read in our report that there had been lapses 

in safety regulations and things like that. Now, my understanding 

is because of CFATS’ early instability DHS did not begin carrying 

out compliance inspections for several years with the bulk of inspections conducted after 2015. 

However, since that time, compliance inspections have spiked to 

over 3,500, and now the question is whether inspectors are being 

pressured to rush through inspections to get numbers up. 

Mr. Wulf, how much time do inspectors have to carry out inspections and how can we be sure these inspections are not merely a 

paperwork exercise or rubber stamp? 

Mr. WULF. Yes, I appreciate that question and inspectors are absolutely not pressured to move through inspections quickly. We do 

have time frames in place for the submission of reports. I want to 

say generally about 2 weeks to get a report done, but if an inspector for whatever reason needs additional time, needs to spend an 

extra day at a facility, or make a return visit to a facility, absolutely is something that we make sure can happen under our program. 

You know, I would say as well with regard to the facility and potential impacts, I am glad to have additional discussions about that 

specific facility but that, you know, those are exactly the sorts of 

impacts that CFATS is designed to address. 

It is exactly the reason that high-risk facilities are in the CFATS 

program and have to put into place security measures focused on 

18 comprehensive risk-based performance standards and submit to 

inspections. So absolutely glad to have that—— 

Ms. BARRAGA ́ N. Well, thank you, and I will certainly follow up 

with you to have that conversation. 

I yield back. 

Chairman THOMPSON. Thank you. 

The Chair now recognizes the gentleman from Louisiana, Mr. 

Higgins. 

38 

Mr. HIGGINS. Thank you, Mr. Chairman. 

Mr. Wulf, Mr. Anderson, thank you both for appearing today. 

I represent south Louisiana. The chemical industry is vital to 

Louisiana’s economy. In Louisiana it is a $50.5 billion industry. It 

provides over 25,000 direct jobs and an additional 83,000 supporting jobs. 

In my district alone, this industry generates nearly $60 million 

in Federal tax revenue and employs nearly 7,000 direct employees. 

These are families that I work for. 

State-wide, Louisiana ships 7.9 billion in chemical-related products to customers world-wide. Needless to say, ensuring these facilities are secure is vital to my State and district and by extension 

the entire country. 

Mr. Wulf, based on your testimony, the CFATS program is effective and its success has positioned the United States as a world 

leader in chemical facility security. As with any Government program I understand there is always room for improvement. 

I am certainly willing to work with my colleagues and I thank 

the Chairman for his leadership and the Ranking Member as well. 

I am willing to work with my colleagues in this body to address 

how we can improve CFATS and provide a long-term authorization 

for this important program. A long-term authorization is a significant quest in my mind. 

Mr. Wulf, given the success of the program in its current state, 

do you believe it would be in the best interests of our National security to approve a clean, long-term, re-authorization of CFATS 

and then address any needed changes as issues arise in a bipartisan manner through this body and committee? 

Mr. WULF. I would say that absolutely a long-term authorization 

for CFATS is key to our ability to continue to focus on chemical security and it was the foundation for the improvements that we 

were able to make over the last 4 years. 

I think the foundation of the program is a very strong one. The 

program is effective and successful. 

Mr. HIGGINS. Thank you, sir. Reflective of your answer regarding 

protecting the people’s treasure, which we are responsible for in 

this body, do you believe that the increased certainty of a long-term 

or permanent re-authorization would allow Government and industry to work more uniformly to develop better practices, improve inefficiency of the program and thus maintaining the peoples’ investment? 

Mr. WULF. No question about it. So chemical industry companies 

across the country have made significant investments, have made 

capital investments in CFATS-focused security measures. They 

continue to deserve to know that the program is here for the long 

haul. 

Mr. HIGGINS. Mr. Anderson, do you concur with that assessment, 

sir? 

Mr. ANDERSON. GAO doesn’t take a position on that but we 

would note that—— 

Mr. HIGGINS. You work very closely with CFATS though do you 

not, sir? 

Mr. ANDERSON. I am sorry, what was that? 

39 

Mr. HIGGINS. You work very closely with CFATS and you recognize that long-term stability encourages efficiency in any program, 

do you not? 

Mr. ANDERSON. Long-term stability absolutely increases certainty 

in budgets and periodic reauthorization also provides a good catalyst for oversight, which is the role we fill. 

Mr. HIGGINS. Thank you, sir. But oversight is an on-going endeavor, is it not? Legislation can be changed as needed to a longterm program, a long-term authorization. 

Mr. ANDERSON. True. 

Mr. HIGGINS. Yes, sir. 

Mr. Wulf, last question. With political infighting in Congress 

over minor changes, again—and we had a bipartisan manner, we 

are willing to work together—but would political infighting in Congress over minor changes to the currently effective CFATS program 

while it remains in limbo under short-term authorization, be a disservice to our Nation’s mission to prevent terror attacks? 

Mr. WULF. We are absolutely better-positioned to secure America’s highest-risk chemical infrastructure with a long-term authorization. No question about it. 

Mr. HIGGINS. I thank you for your answer. 

Mr. Chairman, I apologize that I have not been able to attend 

the entire hearing. You know that happens sometimes, but I respect you, sir, and the Ranking Member, and I yield the balance 

of my time. 

Chairman THOMPSON. Thank you very much. 

The Chair now recognizes the gentleman from New York, Mr. 

Rose. 

Mr. ROSE. Chair, it is Staten Island. Thank you, Chair. 

Chairman THOMPSON. At some point I will get it right. 

[Laughter.] 

Mr. ROSE. Mr. Wulf, thank you again for being here. Thank you 

for your service to this country. Let us talk about fusion centers. 

What has been the role of fusion centers throughout the coordination process? Has this been an institutionalized role? Have they 

been your direct point of contact? 

I understand you could reply to that question by saying, they 

have been great and that is it, but I actually want to know what 

their role has been as mandated by the Department and if there 

has been a variable role across States? 

How we can use this as a point of improving the role of fusion 

centers as the lead in terms of coordinating issues such as this between the Federal Government, States, localities, and the private 

sector? 

Mr. WULF. I appreciate that question, and I do think there is 

probably more that we can do on a National basis. So fusion centers have been an important focal point for us in coordinating, in 

connecting the CFATS program with State and local law enforcement and first responders. So it is a node. 

In some cases we have had chemical security inspectors sit at fusion centers. Certainly on the other side of our house, the voluntary 

side of their house, our protective security advisors are very much 

looped in, tied to the fusion centers across the country. 

40 

But I think it is important for us to continue to think about ways 

we can even further harness across the country—— 

Mr. ROSE. So I take it then this has been ad hoc though? 

Mr. WULF. It has sort-of varied across the various jurisdictions, 

absolutely. 

Mr. ROSE. So what has been the best example of a fusion center 

taking the lead? You don’t have to name the State but I just want 

to know what the model looked like when that fusion center took 

the lead here. 

Mr. WULF. Yes, so I think the model looks like, you know, a 

chemical security inspector or a local supervisory inspector or chief 

of regulatory compliance being well-connected with a fusion center 

and being plugged in by virtue of that fusion center connection 

with law enforcement and first responders across a given, you 

know, either metropolitan area or a State and pushing tools like 

the infrastructure protection gateway through which first responders and law enforcement can have access to CFATS information 

about the high-risk facilities in their jurisdictions. 

So that is what I think the optimal model is. 

Mr. ROSE. So that is the optimal best model. What has been the 

worst case you have seen? 

Mr. WULF. I don’t know if I have a—I guess worst case are, you 

know, any situations in which, you know, those relationships 

haven’t been built. I am not going to say that has happened but 

it is a discussion of certain—— 

Mr. ROSE. Theoretically. 

Mr. WULF. Latitude we continue having. Yes. 

Mr. ROSE. OK, so moving on, in terms of the voluntary participation of the private sector, it seems as if this is actually a great case 

in which we have been very successful in that regard. 

What type of lessons learned can we draw out of this to transfer 

to issues of cybersecurity, general counterterrorism, where we have 

to involve the private sector but we are often struggling to get 

them to come forward? What type of lessons learned can we glean 

from this? 

Mr. WULF. Right. So I mean, in this case, we do have a regulatory framework so there, you know, there is an obligation for facilities that, and companies that operate facilities, that have 

threshold quantities of chemicals of interest in our regulation to report information to us. If they are assessed as high-risk to be part 

of the program to develop site security plans and be subjected to 

inspections. 

But I would say that on a purely voluntary basis the chemical 

industry writ large, and that cuts across a variety of critical infrastructure sectors, has been fully committed and bought in to this 

program and has helped us to drive forward key improvements to 

the program. 

So one of the ways that happens is through something we call 

the Critical Infrastructure Partnership Advisory Council framework. So we bring together sector councils of, you know, chemical 

industry or as the case may be, oil and natural gas industry folks, 

to talk about ways in which we can continue to enhance our respective critical infrastructure protection and/or chemical security efforts. 

41 

I do think that is a good model and it is one that the Department 

is also using on the cybersecurity front and across others. 

Mr. ROSE. Right. I take it that the best model in this case was 

that this was mandatory with private-sector involvement. That was 

the pathway to success then. 

Mr. WULF. The regulatory framework I think has helped for sure. 

Mr. ROSE. Thank you. 

I yield my time. 

Chairman THOMPSON. Thank you, gentleman from Staten Island. 

Now recognize the gentleman from Texas, Mr. McCaul. 

Mr. MCCAUL. Thank you, Mr. Chairman. It is great to be back 

in the old committee room. It looks kind-of nice. 

Just let me say at the outset, you and I, Mr. Chairman, I think 

enjoyed a very bipartisan relationship. We got along most of the 

time and that is how I think this committee should operate. 

It came to my attention that the Minority, and in this case our 

side of the aisle, was not entitled to call a witness at this hearing. 

I believe that both the House and committee rules do provide for 

the Minority to be able to call a witness at the hearing, and I hope 

that we can adhere to that in the future moving forward. 

Having said that, I commend both of you, you and the Ranking 

Member, for this hearing. I tried to get this thing, long-term extension, and we had resistance in the Senate. The best we could get 

was a 15-month extension. 

When I talk to chemical facilities in the private sector, they need 

that kind of certainty. They don’t really want to be regulated but 

if they are, and they prefer CFATS over other regulatory entities 

and they prefer DHS, how important, I guess, from—well, Mr. 

Wulf, I mean, I know how important it is. 

I applaud, again, the Chairman and Ranking Member for trying 

to get a long-term extension. I hope Senator Johnson and his committee will take this up as a long-term extension rather than a 

short-term because the private sector needs that kind of certainty, 

in my judgment. Can you explain to me how important that is? 

Mr. WULF. Yes, I think the importance cannot be overstated. I 

know we have personally visited CFATS-covered facilities that 

have put in place security measures and they need the certainty 

that comes along with knowing that the program is not going to go 

away. 

That if they are going to make capital investments in addressing 

the 18 CFATS risk-based performance standards, putting in place 

security measures that sometimes require on industry budget cycles 2-, 3-, 4-year capital planning, they need to know that the program will be around in 3, 4, 5 years. 

So long-term authorization is hugely important, not only for industry but for our ability in the Government to plan for and execute the program. 

Mr. MCCAUL. That is a great point. Not only from the private 

sector, any businessman is going to need more long-term certainty 

for sure, but the Government to be able to implement this effectively. I think the GAO probably points that out as an issue. Is 

that right, sir? Is that—— 

Mr. ANDERSON. While we at GAO don’t take a formal position on 

reauthorization, we do note the benefits that can accrue and to add 

42 

to the list that you both have talked about, it helps the DHS to retain top talent when there is a longer-term reauthorization period 

and that kind of certainty. 

At the same time I would simply note, though, that in the past, 

reauthorization has been an excellent catalyst for program improvement. So that is something that should be noted. 

Mr. MCCAUL. Thank you. Now, the report itself, though, I found 

some parts troubling and that was identifying high-risk facilities, 

not fully utilizing threat information and ensuring compliance. 

Director Wulf, what have you done to address those concerns? 

Can you also touch on your outreach efforts to the private sector 

in the chemical facilities? 

Mr. WULF. Yes, absolutely. So I think the, you know, I think you 

are referring to our risk-tiering methodology and the extent to 

which in the past we focused largely on the consequences of a potential terrorist attack, less so on vulnerability and threat. 

Actually one of the things that the long-term authorization, the 

4-year authorization we attained in 2014 enabled us to do was to 

completely retool that risk-tiering methodology so that we are now 

as fully as possible accounting for all relevant elements of risk to 

include not only consequences and vulnerability but threat as well. 

So, you know, that was a huge outgrowth of long-term authorization. 

Outreach, we continue very much to prioritize outreach, to continue to prioritize working with the various industries that are part 

of the CFATS-covered universe of chemical facilities. You know, 

one of the things we prioritize, you know, within that area is getting the word out about the program. 

So we work through National industry associations. We work 

through local chambers of commerce to ensure that we are communicating as widely, as broadly as possible the basics of the CFATS 

program so the facilities that are using chemicals, that are storing 

chemicals have the awareness they need to be able to meet their 

obligations to report to us information about their holdings—— 

Mr. MCCAUL. If I could just conclude, you know well GAO plays 

an important role. We make these kind of requests, not to be adversarial and for, like, gotcha moments, but rather working together to improve Government operations. I am glad so see that 

you are adhering to these recommendations to improve your operations. 

With that, I will yield back. 

Mr. WULF. It has been very helpful. 

Chairman THOMPSON. Thank you very much. 

In order to make sure the record is complete, let me assure the 

former Chairman that the rules we are operating under are the 

same set of rules. Both of these are Government witnesses. We offered the Minority a Government witness. They chose not to provide a Government witness, so that is really the only reason you 

don’t have a witness. 

We now recognize the gentlelady from north Chicago, Ms. Underwood. 

Ms. UNDERWOOD. Thank you, Mr. Chairman, and thank you for 

organizing this hearing on DHS’s Chemical Facility Antiterrorism 

43 

Standards program and for your leadership in extending this important program. 

Securing our chemical facilities is vital to our National security 

and to ensure that our communities remain safe. I consider it really important to have a robust security plan in place for high-risk 

facilities and am pleased that DHS can effectively reduce the risk 

for potential targeting by bad actors. 

So my questions are for Mr. Wulf. Sir, as we look to reauthorize 

the program there is interest in DHS developing voluntary best 

practices informed by lessons learned for facilities who may want 

to lower their risk and possibly their regulatory burden. Is that 

something that you think that facilities would find useful? 

Mr. WULF. I think it is. As I mentioned earlier in these proceedings, over the course of the program’s existence more than 

3,000 facilities have either reduced their holdings of high-risk 

chemicals, have eliminated them, have substituted safer chemicals 

or changed their processes such that they are no longer considered 

high risk and are not covered by the program’s requirements. 

So, you know, we have gathered information as these facilities 

have come out of the program. We have kind-of categorized the 

what, you know, the reduction, the elimination, the change in process, the change in sort-of delivery or other procedures. 

But, you know, we would certainly be open to discussing additional authority to enable us to further mine the how and to, you 

know, put us in a position to share that information on a voluntary 

basis with other facilities. 

Now, keeping in mind that CFATS is focused, you know, I think 

appropriately as a risk-based program, it is targeted at America’s 

highest-risk facilities, so those facilities at the highest risk of terrorist attack or exploitation. That is less than 10 percent of the facilities that submit Top Screens for risk assessment by us. 

So the additional 30,000 facilities that aren’t covered by CFATS 

could certainly benefit from the lessons that have been derived 

from the practices that have been used at facilities that have lowered their risk. 

Ms. UNDERWOOD. Thank you. So DHS has said that CFATS has 

encouraged many facilities, as you said, to voluntarily eliminate, 

reduce, or modify their holdings of certain chemicals of interest in 

order to reduce the number of high-risk facilities throughout the 

country. 

So does DHS, in fact, capture the data on how facilities are reducing the risk? If so, how can DHS use that data to help other 

facilities? 

Mr. WULF. Yes, I think, you know, we have captured what facilities have done, you know, whether they have reduced, whether 

they have eliminated, whether they have changed a process, but I 

think there is more that we can do to kind-of mine those practices, 

mine those approaches—— 

Ms. UNDERWOOD. Yes. 

Mr. WULF [continuing]. And share them more broadly. 

Ms. UNDERWOOD. OK, thank you. Now, we have seen a rise in 

cyber attacks against U.S. critical infrastructure often carried out 

by foreign governments, criminal organizations, or terrorist groups 

and obviously the chemical sector is among the most frequent tarVerDate Mar 15 2010 14:25 May 17, 2019 Jkt 000000 PO 00000 Frm 00047 Fmt 6633 Sfmt 6602 H:\116TH\19FL0227\19FL0227 HEATH
44 

gets, so what type of cybersecurity measures are CFATS facilities 

required to adopt? 

Mr. WULF. So that is a good question and cybersecurity is an important part of the CFATS program and, you know, our inspectors 

and other personnel are trained specifically in carrying out the 

cyber piece of the CFATS inspections. 

They work with facilities as they develop their site security plans 

and as they put in place policies and procedures that are designed 

to protect their cyber systems, to, you know, to detect cyber attacks 

and to address cyber attacks as they might occur. 

So, you know, CFATS is a non-prescriptive program. We 

can’t—— 

Ms. UNDERWOOD. Right. 

Mr. WULF [continuing]. Require any specific measures, but we 

can require a cybersecurity posture that is appropriate to the facility’s level of cyber integration. You know, facilities vary in the level 

to which cyber systems impact their chemical processes, their industrial control systems, or for that matter their physical security 

systems. 

So, you know, different measures might be appropriate depending upon that level of integration of the cyber system. So, you 

know, we work with facilities on an individual basis as they tailor 

cybersecurity postures that are appropriate to their operations. 

Ms. UNDERWOOD. So how much cybersecurity training do the inspectors then receive, the CFATS inspectors? 

Mr. WULF. So all inspectors receive a kind-of base level of training on cybersecurity and for that matter on the other risk-based 

performance standards. 

We have a more advanced cybersecurity training that we have 

run probably about half of our inspectors through. So that is an additional week or 2 of advanced cyber training and they are then capable of working with the facilities with somewhat more integration of their cyber systems with chemical processes. 

For those facilities that have the highest level of integration we 

have folks who focus on nothing but cybersecurity at our headquarters. So cyber experts—— 

Ms. UNDERWOOD. OK. 

Mr. WULF. Who actually have eyes on every facility’s site security plan and who are available to work with inspectors as they 

work with facilities that have that sort-of highest degree of cyber 

complexity. 

Ms. UNDERWOOD. Well, thank you, Mr. Wulf and Mr. Anderson 

for being here today. 

Thank you, Mr. Chairman. I yield back. 

Chairman THOMPSON. Thank you, Madam Vice Chair, a good 

question. 

Now, I recognize the gentleman from Houston, Mr. Green. 

Mr. GREEN. Thank you, Mr. Chairman. 

I thank the witnesses for appearing as well. 

Mr. Chairman, I want to extend a special expression of appreciation and gratitude to you because the intelligence that has been accorded me indicates that this is the first time since the 113th Congress that we have had a full committee hearing on this CFATS 

45 

program and that the program would have expired had you not intervened and enacted a stop-gap measure. 

So I appreciate greatly what you have done because this program 

is something that is near and dear to a good many Texans because 

of what happened in the town of West in Texas. We had a number 

of persons who were first responders, and I am sure the story has 

been told, but some things bear repeating. 

First responders didn’t know what they were rushing into. It is 

a wonderful thing to accord first responders the proper equipment. 

The equipment is necessary, but they also have to have intelligence 

and they rushed in. 

They were on the site without intelligence. Fifteen persons lost 

their lives, so this is important to a good many of us and especially 

to some of us who are from Texas. 

I would like to start with the CFATS Act of 2014 which requires 

DHS to create an experimental new program. DHS has performed 

diligently and the program has been implemented and seems that 

as of June 2018 only 18 facilities have taken advantage of this program. 

My query is does it make good sense to keep a program that appeals to 18 facilities? I am sure that there are some other projects 

that merit our attention. There are some other goals that we 

should review in the area of cybersecurity first responder outreach. 

DHS probably has a lot of energy that it has put into this that may 

have been used otherwise. 

So quickly if you would, please, give me some sense of why a program that has accommodated 18 facilities at some great expense 

should be maintained? 

Mr. WULF. Yes, I think it is—I appreciate the remarks, and it is 

a fair question. You are referring to the expedited approval program that enables on, I guess, an expedited basis the certification 

of facility security plans where those facilities adhere to a prescriptive list of security measures. 

You know, I think it is fair to say, as you noted, that a very 

small number of facilities have taken advantage and availed themselves of the program. 

Mr. GREEN. If I may? Just so that we may understand that is 

the size of the language. When you said small how many could 

have taken advantage of it and juxtapose that to the number that 

have? 

Mr. WULF. Yes. So it applies to, you know, Tier 3 and 4 facilities 

so that would be 90 percent of our regulated universe could have 

taken advantage, so upwards of 2,500 facilities could have. 

Mr. GREEN. Of the 2,500, 18 or thereabout? 

Mr. WULF. Eighteen have. 

Mr. GREEN. Yes, OK. Continue please. 

Mr. WULF. I think some of that owes itself to the fact that most 

facilities were well through the process of developing their site security plans through the normal process at the time the expedited 

approval program was rolled out, though we certainly, you know, 

did our best to publicize its availability. 

The fact that most facilities appreciate the contact that they are 

able to have with inspectors throughout the the normal process of 

46 

developing their site security plan. That tends to improve those 

plans. 

So, you know, although we have had a few additional facilities 

since the re-tiering of facilities occurred within the last couple of 

years that have availed themselves of the program, the overall 

number is very small. The fact of the matter is that our on-line system through which facilities develop their SSPs is now significantly 

more streamlined, significantly more user-friendly. So it is certainly—— 

Mr. GREEN. Permit me to—— 

Mr. WULF. Less—— 

Mr. GREEN [continuing]. Ask. It is I—— 

Mr. WULF [continuing]. To use this other program. 

Mr. GREEN. I don’t mean to be rude—— 

Mr. WULF. No worries. 

Mr. GREEN [continuing]. And unrefined, but I have to ask because I have another question. Is it time to review this program 

so that we can ascertain whether or not it is something that we 

should continue with? 

Mr. WULF. I would say yes, it is certainly time to take a hard 

look at it. 

Mr. GREEN. OK. I am going to leave it at that because I have 

another question. This relates to hexavalent chloride or chromium, 

excuse me, also known as chromium–6, which is quite prevalent 

around the country and is also a carcinogen. 

We have had a scare in my home town of Houston, Texas and 

we have gotten news reporters who have been looking into chromium–6. EPA has not provided us with the proper guidelines that 

we have been waiting on for some time. That doesn’t mean that we 

won’t get them. 

But OSHA not only regulates workplaces that use it, but also has 

referred to it as the most toxic form of chromium. My question is, 

is this something that you should give us some additional attention 

to? 

Mr. WULF. It is something that we will certainly look at. Offhand, I am not certain that it is one of the 322 chemicals of interest that trigger coverage under CFATS, but I will absolutely take 

a look. 

Mr. GREEN. I would greatly appreciate it. 

Mr. Chairman, I greatly appreciate the times you have extended, 

and I will yield back. 

Chairman THOMPSON. Thank you very much. If you will provide 

Mr. Green, Mr. Wulf, with whatever information you have on that? 

I am certain, based on Mr. Wulf’s comment he will give you whatever information in return. 

Mr. WULF. Absolutely. 

Mr. GREEN. Thank you, Mr. Chairman. I shall do so. 

Chairman THOMPSON. The Chair now recognizes the gentleman 

from Kansas City, Mr. Cleaver. 

Mr. CLEAVER. Thank you, Mr. Chairman. Thank you for calling 

this hearing because this is something that I am very much concerned about and at our hearing yesterday I raised similar issues. 

Because the EPA no longer updates its list of the locations of 

these facilities, chemical facilities, it is difficult for me to just pinVerDate Mar 15 2010 14:25 May 17, 2019 Jkt 000000 PO 00000 Frm 00050 Fmt 6633 Sfmt 6602 H:\116TH\19FL0227\19FL0227 HEATH
47 

point exactly where they are. Now, they have a map and you can 

look at the map and kind-of get an idea. 

I am from Missouri and so I am concerned about what the map 

suggests, which is the rural parts of Missouri. If you put a comma 

there for a moment, one of the things that I am concerned about 

and it has been driving me crazy since the days that I was mayor 

of Kansas City, and it is that for the most part the Federal Government ignores the middle of the country as it relates to the possibility of terrorist attacks. 

So we lean toward the East Coast, the West Coast, the North 

Coast and I remind people that it was shortly after Easter 1996, 

I think it was, when the Murrah Federal Building in Oklahoma 

City, not too far from Kansas City, was the first major terrorist attack. 

I can’t remember now. It was just under 200 people killed, about 

half of them little children at a preschool inside the Federal building. I have a little 3-year-old grandson who is at a Federal daycare 

center right now. 

We just can’t seem to get the kind of attention to deal with these 

issues. Now that there is no update we don’t know. I will also remind everyone, remind you and maybe everyone on the committee, 

that it was ammonium nitrate used by McVey, Timothy McVey. 

Ammonium nitrate is fertilizer. I represent a rural area. Everybody uses fertilizer to survive. We have 85,000 jobs in Missouri related to agriculture. We export about $14 billion a year that support those jobs and many of those are in my district, the soybeans 

and corn. I can’t tell you how—and so you know there are facilities 

all over. 

A terrorist with a IQ above room temperature can figure out the 

most vulnerable places in our country and the places that create 

the least amount of risk to them. It is, frankly, a part of the district 

I represent. 

I am open for you to tell me how we can correct this by next 

Thursday? 

[Laughter.] 

Mr. CLEAVER. Or Wednesday or whatever. 

Mr. WULF. I appreciate all that. I will take the first crack. Absolutely agree that, you know, the terrorist threat is not a, you know, 

bi-coastal threat. It is an all-of-America threat. 

You know, for our part, you know, we work closely with fertilizer 

retailers with fertilizer manufacturers, many of whom are part of 

the CFATS program and have put into place comprehensive security measures designed to address the CFATS risk-based performance standards. 

Our broader organization has placed a regional office in Kansas 

City to focus on some of the Midwestern States. There is one in 

Chicago as well. So, you know, very focused on working with retailers of fertilizer, with manufacturers of fertilizer, as with all other 

companies and entities that hold high-risk chemicals and that are 

covered under CFATS. 

Mr. CLEAVER. Are the facilities open in Kansas City? 

Mr. WULF. Pardon me? There is a regional office in Kansas City, 

so our chief of regulatory compliance sits in Kansas City. 

48 

Mr. CLEAVER. Yes. How many people? I am just curious. Because 

I wasn’t even aware. 

Mr. WULF. There are probably 20 folks across the infrastructure 

protection enterprise in that regional office and there are protective 

security advisors and our chemical security inspectors in every 

State in the region. 

Mr. CLEAVER. I will get in touch with them quickly. 

Mr. WULF. Yes. 

Mr. CLEAVER. Thank you, Mr. Chairman. I appreciate it very 

much. This is a major issue in my community, so thank you very 

much for this hearing. 

Chairman THOMPSON. Absolutely. 

A couple of takeaways, Mr. Wulf, I think based on what I heard, 

I think it would help us if you could provide us with a master list 

of the facilities that have been regulated. I think that would help 

a lot. 

Mr. WULF. Yes. 

Chairman THOMPSON. But I heard questions from several Members and we can just kind-of share that information. 

So the other has to do with the data of the inspections that you 

make. Do you collect that data? 

Mr. WULF. Oh, absolutely. Our inspectors produce a report of 

each and every inspection and that runs through our compliance 

branch here in—— 

Chairman THOMPSON. So who do you share that data with? Just 

internally? 

Mr. WULF. It is for our internal use for making decisions about 

approving site security plans and for, you know, as necessary engaging in enforcement activities. But some of that data is the type 

of data, you know, some of the data on the chemical holdings and 

specifics of the facility is the sort of information that we share with 

first responders, law enforcement, and others in the local community who have a need to know that information. 

Chairman THOMPSON. OK. 

Mr. Anderson, have you all looked at any of that data collection 

and sharing? 

Mr. ANDERSON. Well, we have certainly looked at both aspects, 

the data collection piece and the recommendation that we made in 

that report has been implemented by DHS. So from, you know, 

from our view in terms of the data on assessing risk, for example, 

DHS has implemented our recommendations. 

The information sharing point though, that is still open and I 

think that that is, you know, a valid point of emphasis from our 

standpoint. The information sharing with first responders so that 

there is full visibility over what those threats may be if there is 

an incident. 

Chairman THOMPSON. Well, and I think that is what Mr. Cleaver 

and Ms. Slotkin and Underwood, Rose, a number of Members are 

interested in, whether or not what we collect through our CFATS 

process is actually pushed out to especially first responders. 

Mr. ANDERSON. Absolutely. 

Chairman THOMPSON. Or communities that are at risk just given 

the location of many of those facilities. 

49 

So I want to thank the witnesses for their testimony and the 

Members for their questions. The Members of the committee may 

have additional questions for the witnesses and we ask that you respond expeditiously in writing to those questions. 

Pursuant to the Committee Rule VII(D), the hearing record will 

be held open for 10 days. Hearing no further business, the committee stands adjourned. 

[Whereupon, at 12:07 p.m., the committee was adjourned.] 

(51) 

1 CFATS Fact Sheet, https://www.dhs.gov/sites/default/files/publications/cfats-fact-sheet-07- 

16-508.pdf. 2Pub. L. 113–254. 

3GAO–18–538. 

A P P E N D I X 

QUESTIONS FROM CHAIRMAN BENNIE G. THOMPSON FOR DAVID WULF

Question 1a. Since 2007, DHS reports that ‘‘CFATS has encouraged many facilities to voluntarily eliminate, reduce, or modify their holdings of certain chemicals 

of interest in order to reduce the number of high-risk facilities’’ throughout the 

country.1 The total number of high-risk facilities in the United States has dropped 

from 7,000 in 2008 to only about 3,300 today. 

How does DHS verify the accuracy of the information facilities are submitting to 

show a reduction in risk? 

Answer. Response was not received at the time of publication. 

Question 1b. Can you explain some of the primary ways a facility might reduce 

their risk level—for instance by storing chemicals in lower quantities, using more 

secure containers, or building security into new constructions? 

Answer. Response was not received at the time of publication. 

Question 1c. Does DHS have a system in place to collect and analyze this data 

to help DHS understand how facilities are reducing risk? 

Answer. Response was not received at the time of publication. 

Question 2a. In your testimony, you agreed that there is an opportunity for DHS 

to use this data to develop voluntary best practices that could help other facility 

owners and operators find ways to reduce risk, while also maintaining the program’s 

non-prescriptive, risk-based approach. 

Are there additional authorities DHS would need in order to aggregate, 

anonymize, and analyze data on facilities that successfully reduce risk? 

Answer. Response was not received at the time of publication. 

Question 2b. Are there additional authorities DHS would need in order to use this 

data to develop best practices for reducing chemical security risks? 

Answer. Response was not received at the time of publication. 

Question 2c. Are there additional authorities DHS would need in order to share 

such best practices with other chemical facility owners and operators, or with the 

public? 

Answer. Response was not received at the time of publication. 

Question 3a. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) requires DHS to share ‘‘such information as 

is necessary to help ensure that first responders are properly prepared and provided 

with the situational awareness needed to respond to security incidents’’ at high-risk 

chemical facilities.2 In 2018, GAO surveyed first responders and local emergency 

planners and found that many of them either were not aware of CFATS facilities 

in their district, did not have access to the specific chemical holdings at those facilities, and sometimes had not even heard of the CFATS program.3 Specifically, GAO 

interviewed 15 local emergency planning committees (LEPCs), representing 373 

high-risk facilities, and found that 13 of the LEPCs interviewed did not have access 

to sufficient CFATS information. 

You testified that you can say ‘‘with confidence’’ that all 3,300 CFATS facilities 

‘‘have made connections with their relevant local first responders,’’ and that inspectors verify these connections in each and every case. How do you reconcile this with 

GAO’s recent reporting? 

Answer. Response was not received at the time of publication. 

Question 3b. Has DHS made contact with all 13 of the LEPCs GAO interviewed 

and found did not have access to information on CFATS facilities? Have those 

LEPCs been given an IP Gateway account? 

52 

Answer. Response was not received at the time of publication. 

Question 3c. What training does DHS provide new IP Gateway account holders 

on how to utilize the portal effectively? 

Answer. Response was not received at the time of publication. 

Question 3d. Has DHS successfully completed its goal of conducting outreach to 

LEPCs in the top 25 percent of districts with the highest number of CFATS facilities? What is the next milestone? 

Answer. Response was not received at the time of publication. 

Question 3e. Does DHS prioritize outreach to LEPCs in districts with one or more 

Tier 1 facilities, or is it based on the number of CFATS facilities, regardless of Tier? 

Answer. Response was not received at the time of publication. 

Question 3f. In your testimony, you agreed that first responders ‘‘need information 

about the chemical holdings so they know what they are walking into when they 

attempt to save lives and property.’’ Are there any circumstances where a facility 

would be justified in withholding such information on the grounds that it is protected chemical terrorism vulnerability information (CVI)? 

Answer. Response was not received at the time of publication. 

Question 3g. Are you aware of instances where a facility has withheld information 

on chemical holdings, or other information important for first responders to properly 

respond to an emergency or security incident, on the grounds it is protected under 

another Federal or State regulation? 

Answer. Response was not received at the time of publication. 

Question 3h. Is DHS currently working with Federal and State regulators, and 

chemical facilities, to harmonize information protection regimes and make sure first 

responders and LEPCs are given appropriate access to information? 

Answer. Response was not received at the time of publication. 

Question 3i. Going forward, does DHS plan to be more proactive in making sure 

first responders and LEPCs have IP Gateway access? Will the IP Gateway feature 

more specific information, and do so more broadly, on the basis of GAO’s 2018 report? 

Answer. Response was not received at the time of publication. 

Question 4. On December 6, 2016, I wrote to the Secretary of DHS requesting an 

IP Gateway account. On January 11, 2017, then-Under Secretary of the National 

Protection and Programs Directorate Suzanne Spaulding responded that ‘‘a representative of the Department’s Office of Legislative Affairs will contact your staff 

to coordinate the provision of access to the IP Gateway.’’ Despite multiple followup requests, I have yet to receive an IP Gateway account. Please provide the aforementioned IP Gateway account, as well as: 

(a) a master list of CFATS regulated facilities, per your testimony before the committee on Feb. 27, 2019; 

(b) a master list of facilities that were at one point covered by CFATS, but have 

since been determined to no longer present a high level of risk, and thus were released from the program; and 

(c) the standard operating procedures currently used by CFATS inspectors. 

Answer. Response was not received at the time of publication. 

QUESTION FROM HONORABLE XOCHITL TORRES SMALL FOR DAVID WULF

Question. Mr. Wulf, during the hearing you stated that DHS makes ‘‘an extra effort’’ to reach out to rural communities to ensure they have access to information 

on high-risk chemical facilities. Can you please elaborate on what these ‘‘extra efforts’’ entail and how they differ from DHS outreach efforts to non-rural communities? 

Answer. Response was not received at the time of publication. 

QUESTIONS FROM HONORABLE CEDRIC RICHMOND FOR DAVID WULF

Question 1a. The CFATS Act of 2014 requires facilities to seek input from at least 

one knowledgeable employee, and where applicable, labor union representatives, in 

the development of site security plans. 

At this time, do CFATS inspectors confirm, as part of each inspection, that a facility has complied with this requirement? 

Answer. Response was not received at the time of publication. 

Question 1b. Are inspectors required to speak with the employees or union representatives consulted, or check any records at the facility? 

Answer. Response was not received at the time of publication. 

Question 1c. Would failing to consult with an employee or union representative 

be grounds for disapproving a site security plan? 

Answer. Response was not received at the time of publication. 

53 

Question 1d. In your testimony, you mentioned that DHS gives facilities discretion 

on whether to consult with employees because the law provides for consultation only 

‘‘to the greatest extent practicable.’’ What authorities would DHS need to verify that 

this consultation is truly happening to the greatest extent practicable? 

Answer. Response was not received at the time of publication. 

Question 2a. In 2018, GAO found that DHS was missing an opportunity to show 

its value as a National security program by tracking and measuring facility security 

pre-CFATS, compared to security post-implementation of a CFATS site security 

plan. 

How is DHS planning to measure the extent to which facilities reduced 

vulnerabilities as a result of the CFATS program? 

Answer. Response was not received at the time of publication. 

Question 2b. Are there other Federal programs that have adopted similar mechanisms to track vulnerability reduction that the Department can use as a model? 

Answer. Response was not received at the time of publication. 

Question 2c. How might this recommendation help DHS understand the ways in 

which CFATS facilities are eliminating or reducing on-site vulnerabilities? 

Answer. Response was not received at the time of publication. 

Question 3a. We have seen a rapid rise in the frequency and sophistication of 

cyber attacks against U.S. critical infrastructure, often carried out by wellresourced, determined foreign governments, criminal organizations, or terrorist 

groups. The U.S. chemical sector is among the most frequent targets. 

What cybersecurity measures are CFATS facilities required to adopt? Are facility 

site security plans ever disapproved due to cybersecurity deficiencies? 

Answer. Response was not received at the time of publication. 

Question 3b. How much cybersecurity training do CFATS inspectors receive? 

Answer. Response was not received at the time of publication. 

Question 4. The CFATS program is carried out by a division of the Cybersecurity 

and Infrastructure Security Agency (CISA), which is DHS’s main cybersecurity arm. 

Does CFATS leverage the cyber resources and expertise of the NCCIC, the US– 

CERT, the ICS–CERT? Are there opportunities to do so? 

Answer. Response was not received at the time of publication. 

Question 5a. In the past, there have been questions about the CFATS risk-tiering 

methodology, and whether the program is capturing the Nation’s highest-risk facilities. 

When DHS is considering whether a facility is high-risk, does it consider characteristics about the neighboring infrastructure? For instance, would it matter if the 

facility was located next door to an elementary school, nursing home, hospital, or 

sensitive Government building (e.g., a military base)? 

Answer. Response was not received at the time of publication. 

Question 5b. Does the methodology consider the potential health consequences 

that could result from exploitation of chemicals of interest, or strictly potential loss 

of life? 

Answer. Response was not received at the time of publication. 

Question 5c. Studies show chemical facilities tend to be concentrated in low-income and minority communities. In determining risk, does DHS consider whether 

a facility is in close proximity to other chemical facilities that could exacerbate the 

impacts of an attack? 

Answer. Response was not received at the time of publication. 

Question 6. Because of CFATS early instability, DHS did not begin carrying out 

compliance inspections for several years, with the bulk of inspections conducted 

after 2015. However, since that time compliance inspections have spiked to over 

3,500, and now the question is whether inspectors are being pressured to rush 

through inspections to get numbers up. How much time do inspectors have to carry 

out inspections? 

Answer. Response was not received at the time of publication. 

Question 7. What should lawmakers be doing to address the statutory exemptions 

for certain types of potentially high-risk facilities like water treatment systems and 

nuclear power plants? Is there an opportunity to study security gaps? 

Answer. Response was not received at the time of publication. 

QUESTIONS FROM HONORABLE MICHAEL GUEST FOR DAVID WULF

Question 1. Of the 40,000 unique facilities that have reported chemical holdings 

since 2007, how many of them ultimately were secured through CFATS? 

• How many of them are still secured through the CFATS program? 

• What are some of the reasons a facility may no longer be in the CFATS program? 

54 

1GAO, Critical Infrastructure Protection: DHS Should Take Actions to Measure Reduction in 

Chemical Facility Vulnerability and Share Information with First Responders, GAO–18–538 

(Washington, DC: Aug. 8, 2018). 2GAO–18–538. 

3 Account requests for access to the IP Gateway are made via a web-based registration form 

that asks the individual requesting access to identify the type of employee they are. Options 

include: Federal, State, Local (City/County), and Tribal/Territory. 

Answer. Response was not received at the time of publication. 

Question 2. Why has participation in the Expedited Approval Program been so 

low? 

• What improvements can be made to encourage more participation? 

Answer. Response was not received at the time of publication. 

Question 3. How does DHS work with facilities to improve compliance? 

Answer. Response was not received at the time of publication. 

QUESTION FROM HONORABLE MICHAEL GUEST FOR NATHAN ANDERSON

Question. How does the CFATS program account for vulnerability in its performance measures, and what is the program’s methodology to improve security? 

Answer. In August 2018, we reported that DHS began development of a new 

methodology and performance measure for the CFATS program in 2016 called the 

guidepost-based site security plan scoring methodology.1 DHS officials stated they 

planned to use the methodology to evaluate the security measures a facility implemented from initial state—when a facility submits its initial site security plan—to 

the facility’s approved security plan. DHS officials stated the purpose of the methodology is to measure the increase in security attributed to the CFATS program and 

stated that the methodology is not intended to measure risk reduction. 

We found that DHS’s new methodology and performance measure for the CFATS 

program does not measure the program’s impact on reducing a facility’s vulnerability to an attack and that DHS could take steps to evaluate vulnerability reduction resulting from the CFATS compliance inspection process. We recommended 

that DHS incorporate vulnerability into the new methodology to help measure the 

reduction in the vulnerability of high-risk facilities to a terrorist attack, and use 

that data in assessing the CFATS program’s performance in lowering risk and enhancing National security. DHS agreed and is taking steps to implement this recommendation. Specifically, in September 2018, DHS reported making progress towards the implementation of two new performance metrics by the end of the first 

quarter of fiscal year 2019. DHS officials stated that these metrics should, among 

other things, evaluate the progress of individual facilities in enhancing their security and be used to demonstrate an increase in the security posture across the population of CFATS facilities. We are currently in the process of obtaining an update 

from DHS on the status of efforts to implement this recommendation. 

QUESTIONS FROM RANKING MEMBER MIKE ROGERS FOR NATHAN ANDERSON

Question 1. In regards to access to information for first responders: What is the 

difference between ‘‘did not use’’ and ‘‘did not have access to’’ Chemical Vulnerability 

Information through the portal? 

Answer. In August 2018, we reported that while the Infrastructure Protection (IP) 

Gateway is a mechanism for sharing names and quantities of chemicals at CFATS 

high-risk facilities with first responders and emergency planners, we found it is not 

widely used by officials at the local level.2 For example, according to DHS, there 

were 14 accounts categorized at the local level whose access to the IP Gateway layer 

includes the names and quantities of chemicals at CFATS facilities. A local account 

indicates the individual with access is a county- or city-level employee or contractor.3 Additionally, while not generalizable to all Local Emergency Planning 

Committees (LEPCs), officials representing 7 of the 15 LEPCs we interviewed were 

not aware of the IP Gateway and officials representing 13 of the 15 LEPCs stated 

that they do not have access to CFATS information within the IP Gateway. Of the 

13 officials that reported they did not have access, 11 said that it would be helpful 

or critical to have access for several reasons. Specifically, officials representing these 

LEPCs stated that this information would assist them to better prepare and respond 

to incidents and help emergency planners prioritize the most critical sites among 

the thousands of facilities that they oversee. We recommended that DHS should 

take actions to encourage access to and wider use of the IP Gateway and explore 

other opportunities to improve information sharing with first responders and emerVerDate Mar 15 2010 14:25 May 17, 2019 Jkt 000000 PO 00000 Frm 00058 Fmt 6601 Sfmt 6621 H:\116TH\19FL0227\19FL0227 HEATH
55 

4GAO–18–538. 

5We interviewed officials representing 15 LEPCs out of more than 3,000 known LEPCs. We 

selected LEPCs from different States to include counties with some of the highest number of 

facilities in each State. The number of high-risk CFATS facilities located in each LEPC ranges 

from a low of 11 to a high of 88 across our sample. 

gency planners. DHS concurred with this recommendation and reported in September 2018 that they are taking actions to implement it. 

Question 2. Of the first responders surveyed, how many of them failed to obtain 

statutorily-required training to review Chemical Vulnerability Information? 

Answer. We reported in August 2018 that CFATS data available in the IP Gateway includes, among other things, facility name, location, risk tier, and chemicals 

on-site and is accessible to authorized Federal and other State, local, Tribal, and 

territorial officials and responders with an established need to know, which is determined by DHS.4 We did not audit DHS officials nor the officials representing the 

15 LEPCs we interviewed to determine if any of them failed to obtain statutorilyrequired training to review Chemical Vulnerability Information. 

Question 3. Besides the Emergency Planning and Community Right to Know Act, 

first responders have access to chemical hazard information under the Clean Air 

Act’s Risk Management Plan, the Toxic Release Inventory, Toxic Substances Control 

Act, and other Federal statutes. Did GAO ask the first responders if they used these 

authorities to obtain information necessary to respond to facilities? 

Answer. In August 2018, we reported that in our interviews with 15 LEPCs— 

whose jurisdictions included 373 high-risk chemical facilities regulated by the 

CFATS program—we found that officials rely on information reported on chemical 

inventory forms required by the Emergency Planning and Community Right-toKnow Act of 1986 in order to prepare for and respond to incidents at CFATS facilities.5 While we interviewed officials to determine what Federal Government and 

other resources and information they have access to or may receive in order to prepare for or respond to an incident at chemical facilities in their area, we did not 

ask about each individual authority outlined above. Additionally, we did not review 

the extent to which the CFATS chemicals of interest are covered by the disclosure 

requirements outlined in the above-listed authorities. 

Æ