CRITICAL 

INFRASTRUCTURE 

PROTECTION

Progress and Challenges 

in DHS’s Management of 

Its Chemical Facility 

Security Program

Statement of Chris Currie, Director, 

Homeland Security and Justice

Testimony 

Before the Subcommittee on

Environment, Committee on Energy and 

Commerce, House of Representatives

For Release on Delivery 

Expected at 10 a.m ET

Thursday, June 14, 2018

GAO-18-613T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-613T, a testimony 

before the Subcommittee on Environment, 

Committee on Energy and Commerce, House 

of Representatives.

June 2018

CRITICAL INFRASTRUCTURE PROTECTION

Progress and Challenges in DHS’s Management of Its 

Chemical Facility Security Program

What GAO Found

The Department of Homeland Security (DHS) has made progress addressing

challenges that GAO’s past work identified to managing the Chemical Facility 

Anti-Terrorism Standards (CFATS) program. The following summarizes progress 

made and challenges remaining in key aspects of the program.

Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS

used self-reported and unverified data to determine the risk of facilities holding 

toxic chemicals that could threaten surrounding communities if released. GAO

recommended that DHS should better verify the accuracy of facility-reported 

data. DHS implemented this recommendation by revising its methodology so it 

now calculates the risk of toxic release, rather than relying on facilities to do so.

Assessing risk and prioritizing facilities. In April 2013, GAO reported

weaknesses in multiple aspects of DHS’s risk assessment and prioritization 

approach. GAO made two recommendations for DHS to review and improve this 

process, including that DHS enhance its risk assessment approach to 

incorporate all of the elements of consequence, threat, and vulnerability 

associated with a terrorist attack involving certain chemicals. DHS launched a 

new risk assessment methodology in October 2016 and is currently gathering 

new or updated data from about 27,000 facilities to (1) determine which facilities 

should be categorized as high-risk because of the threat of sabotage, theft or 

diversion, or a toxic release and (2) assign those facilities deemed high risk to 

one of four risk-based tiers. GAO has ongoing work assessing these efforts and 

will report later this summer on the extent to which they fully address prior 

recommendations.

Reviewing and approving facilities’ site security plans. DHS is to review 

security plans and visit facilities to ensure their security measures meet DHS 

standards. In April 2013, GAO reported a 7 to 9 year backlog for these reviews 

and visits. In July 2015, GAO reported that DHS had made substantial progress 

in addressing the backlog—estimating that it could take between 9 and 12 

months for DHS to review and approve security plans for the approximately 900 

remaining facilities. DHS has since taken additional action to expedite these 

activities and has eliminated this backlog.

Inspecting facilities and ensuring compliance. In July 2015, GAO reported 

that DHS conducted compliance inspections at 83 of the 1,727 facilities with 

approved security plans. GAO found that nearly half of the inspected facilities 

were not fully compliant with their approved security plans and that DHS did not 

have documented procedures for managing facilities’ compliance. GAO 

recommended that DHS document procedures for managing compliance. As a 

result, DHS has developed an enforcement procedure and a draft compliance 

inspection procedure and expects to finalize the compliance inspection 

procedure by the end of fiscal year 2018.

View GAO-18-613T. For more information, 

contact Chris Currie at (404) 679-1875 or 

curriec@gao.gov.

Why GAO Did This Study

Thousands of facilities have hazardous 

chemicals that could be targeted or 

used to inflict mass casualties or harm 

surrounding populations in the United 

States. In accordance with the DHS 

Appropriations Act, 2007, DHS 

established the CFATS program in 

2007 to, among other things, identify 

and assess the security risk posed by 

chemical facilities. DHS inspects highrisk facilities after it approves facility 

security plans to ensure that the 

facilities are implementing required 

security measures and procedures.

This statement summarizes progress 

and challenges related to DHS’s 

CFATS program management. This

statement is based on prior products

GAO issued from July 2012 through 

June 2017, along with updates 

conducted in June 2018 on DHS 

actions to address prior GAO 

recommendations. To conduct the prior 

work, GAO reviewed relevant laws, 

regulations, and DHS policies for 

administering the CFATS program,

how DHS assesses risk, and data on

high-risk chemical facilities. GAO also 

interviewed DHS officials and reviewed 

information on DHS actions to 

implement its prior recommendations.

What GAO Recommends

GAO has made various

recommendations to strengthen DHS’s 

management of the CFATS program, 

with which DHS has generally agreed. 

DHS has implemented or described 

planned actions to address most of

these recommendations.
Letter

Page 1 GAO-18-613T Critical Infrastructure Protection

Chairman Shimkus, Ranking Member Tonko, and Members of the 

Subcommittee:

Thank you for the opportunity to discuss our past work on the Department 

of Homeland Security’s (DHS) efforts to manage its Chemical Facility 

Anti-Terrorism Standards (CFATS) program. Thousands of facilities that 

produce, use, or store hazardous chemicals could be of particular interest 

to terrorists who are intent on using toxic chemicals to inflict mass 

casualties in the United States. These chemicals could be released from 

a facility to cause harm to surrounding populations; they could be stolen 

and used as chemical weapons or as their precursors (the ingredients for 

making chemical weapons); or they could be stolen and used to build an 

improvised explosive device. Past incidents remind us of the danger that 

these chemicals pose, including the 2013 ammonium nitrate explosion at 

a fertilizer storage and distribution facility in West, Texas, which killed at 

least 14 people and damaged or destroyed at least 200 homes, and the 

1995 domestic terrorist attack on the federal building in Oklahoma City, 

Oklahoma, where 168 people were killed using ammonium nitrate 

fertilizer mixed with fuel oil.

Letter
Page 2 GAO-18-613T Critical Infrastructure Protection

Figure 1: Photographs of Damage from the Explosion in West, Texas in April 2013
Page 3 GAO-18-613T Critical Infrastructure Protection

The Department of Homeland Security Appropriations Act, 2007, required 

DHS to issue regulations to establish risk-based performance standards 

(performance standards) for securing high-risk chemical facilities.1 DHS 

subsequently established the CFATS program in 2007 to, among other 

things, identify high-risk chemical facilities and assess the risk posed by 

them; place facilities considered to be high risk into one of four risk-based 

tiers (with tier 1 being the highest risk tier and 4 being the lowest); assess 

facility security; approve security plans prepared by facilities; and inspect 

facilities to ensure compliance with regulatory requirements.2 DHS’s 

CFATS rule established 18 performance standards that identify the areas 

for which a facility’s security posture are to be examined, such as 

perimeter security, access control, and cyber security.3 To meet these 

standards, facilities are free to choose whatever security programs or 

processes they deem appropriate so long as DHS determines that the 

facilities achieve the requisite level of performance in each of the 

applicable areas. The Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of 2014 (CFATS Act of 2014) enacted in December 

2014, in effect, reauthorized the CFATS program for an additional 4 

years, while also imposing additional implementation requirements on 

DHS for the program.4 DHS’s National Protection and Programs 

Directorate’s Infrastructure Security Compliance Division manages the 

CFATS program. According to DHS, the Department received 

approximately $911 million for the CFATS program for the period 

beginning fiscal year 2007 through fiscal year 2018.

My testimony today summarizes our past work examining DHS’s 

management of the CFATS program, and provides updates on actions 

DHS has taken to address our prior recommendations.5 This testimony is 

 1

Pub. L. No. 109-295, § 550, 120 Stat.1335, 1388-89 (2006).

2

See 72 Fed. Reg. 17,792 (Apr. 9, 2007) (codified as amended at 6 C.F.R. pt. 27).

3

DHS has enumerated 18 risk-based performance standards that covered chemical 

facilities must meet to comply with CFATS. See 6 C.F.R. § 27.230.

4

See Pub. L. No. 113-254, 128 Stat. 2898 (2014); 6 U.S.C. §§ 621-629. The Act amended 

the Homeland Security Act of 2002, Pub. L. No. 107-296, 116 Stat. 2135 (2002), as 

amended, by adding Title XXI—Chemical Facility Anti-Terrorism Standards—and 

expressly repealing the program’s authority under the fiscal year 2007 DHS appropriations 

act.

5

We are currently reviewing the CFATS program at the request of the Chairmen and 

Ranking Members of the Senate Committee on Homeland Security and Governmental 

Affairs and the House Committee on Homeland Security. We intend to issue a report 

based on that work later this summer.
Page 4 GAO-18-613T Critical Infrastructure Protection

based on our reports issued from July 2012 through June 2017.6 For 

these reports, we reviewed applicable laws and regulations, DHS policies 

and procedures, DHS data on tiered facilities, information on the 

approach DHS used to determine a facility’s risk and process for 

reviewing security plans. We also interviewed DHS officials about facility 

tiering, how DHS assesses risk, and how it processes security plans. 

Additional details on the scope and methodology are available in our 

published reports. In addition, this statement contains updates as of June 

2018 from DHS on actions it has taken to address the recommendations 

made in our prior reports. The work upon which this statement is based

was conducted in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives.

 6

GAO, Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its 

Chemical Security Program, but It Is Too Early to Assess Results, GAO-12-515T 

(Washington, D.C.: July 26, 2012); Critical Infrastructure Protection: DHS Efforts to 

Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be 

Strengthened, GAO-13-353 (Washington, D.C.: Apr. 5, 2013); Critical Infrastructure 

Protection: DHS Efforts to Identify, Prioritize, Assess, and Inspect Chemical Facilities, 

GAO-14-365T (Washington, D.C.: Feb. 27, 2014); Critical Infrastructure Protection: 

Observations on DHS Efforts to Implement and Manage Its Chemical Security Program, 

GAO-14-608T (Washington, D.C.: May 14, 2014); Critical Infrastructure Protection: DHS 

Action Needed to Verify Some Chemical Facility Information and Manage Compliance 

Process, GAO-15-614 (Washington, D.C., July 22, 2015); Critical Infrastructure Protection: 

Improvements Needed for DHS’s Chemical Facility Whistleblower Report Process, 

GAO-16-572, (Washington, D.C.: Jul 12, 2016); and Critical Infrastructure Protection: DHS 

Has Implemented Its Chemical Security Expedited Approval Program and Participation To 

Date Has Been Limited, GAO-17-502 (Washington, D.C.: June 29, 2017).
Page 5 GAO-18-613T Critical Infrastructure Protection

Our past work has identified progress and challenges in a number of 

areas related to DHS’s management of the CFATS program including (1) 

the process for identifying high risk chemical facilities; (2) how it assesses 

risk and prioritizes facilities; (3) reviewing and approving facility security 

plans; (4) how it conducts facility compliance inspections; and (5) efforts 

to conduct stakeholder outreach and gather feedback. DHS has made a 

number of programmatic changes to CFATS in recent years that may also 

impact its progress in addressing our open recommendations; these 

changes are included as part of our ongoing review of the program.

In May 2014, we found that more than 1,300 facilities had reported having 

ammonium nitrate to DHS. However, based on our review of state data 

and records, there were more facilities with ammonium nitrate holdings 

than those that had reported to DHS under the CFATS program.7 Thus, 

we concluded that some facilities that were required to report may have 

failed to do so.8 We recommended that DHS work with other agencies, 

including the Environmental Protection Agency (EPA), to develop and 

implement methods of improving data sharing among agencies and with 

states as members of a Chemical Facility Safety and Security Working 

 7

GAO, Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with 

Ammonium Nitrate, GAO-14-274 (Washington, D.C.: May 19, 2014). We reviewed 

Emergency Planning and Community Right-to-Know Act of 1986 data from Texas and 

Alabama, which have different reporting criteria than CFATS. Under section 312 of the Act 

and Environmental Protection Agency’s regulations, facilities with 10,000 pounds or more 

of ammonium nitrate generally must submit an annual chemical inventory report to their 

designated state and local authorities. 42 U.S.C. § 11022, 40 C.F.R. § 370.10(a)(2)(i). 

8

Consistent with law and regulation, certain facilities—including, in general, facilities 

regulated under the Maritime Transportation Security Act of 2002 (Public Law 107-295, 

116 Stat. 2064), public water systems or wastewater treatment facilities, facilities owned 

and operated by the Department of Defense or the Department of Energy, and facilities 

subject to regulation by the Nuclear Regulatory Commission or in accordance with the 

Atomic Energy Act of 1954—are not subject to regulation under CFATS and are referred 

to as excluded facilities. See 6 U.S.C. § 621(4); 6 C.F.R. § 27.110(b). In addition, pursuant 

to its authority under 6 C.F.R. § 27.210(c), DHS has extended the deadline for submitting 

CFATS reports until further notice for certain agricultural production facilities, such as 

farms, ranches, turfgrass growers, golf courses, nurseries, and public and private parks. 

See Notice to Agricultural Facilities About Requirement To Complete DHS’ Chemical 

Security Assessment Tool, 73 Fed. Reg. 1640 (Jan. 9, 2008).

DHS Has Made 

Progress Addressing 

Past Challenges, But 

Some Actions are Still 

In Progress

Identifying High-Risk 

Chemical Facilities 
Page 6 GAO-18-613T Critical Infrastructure Protection

Group.9 DHS agreed with our recommendation and has since addressed 

it. Specifically, DHS compared DHS data with data from other federal 

agencies, such as EPA, as well as member states from the Chemical 

Facility Safety and Security Working Group to identify potentially 

noncompliant facilities. As a result of this effort, in July 2015, DHS 

officials reported that they had identified about 1,000 additional facilities 

that should have reported information to comply with CFATS and 

subsequently contacted these facilities to ensure compliance. DHS 

officials told us that they continue to engage with states to identify 

potentially non-compliant facilities. For example, as of June 2018, DHS 

officials stated they have received 43 lists of potentially noncompliant 

facilities from 34 state governments, which are in various stages of review 

by DHS. DHS officials also told us that they recently hired an individual to 

serve as the lead staff member responsible for overseeing this effort.

DHS has also taken action to strengthen the accuracy of data it uses to 

identify high risk facilities. In July 2015, we found that DHS used selfreported and unverified data to determine the risk categorization for 

facilities that held toxic chemicals that could threaten surrounding 

communities if released.10 At the time, DHS required that facilities selfreport the Distance of Concern—an area in which exposure to a toxic 

chemical cloud could cause serious injury or fatalities from short-term 

exposure—as part of its Top-Screen.11 We estimated that more than 

2,700 facilities with a toxic release threat had misreported the Distance of 

Concern and therefore recommended that DHS (1) develop a plan to 

implement a new Top-Screen to address errors in the Distance of 

Concern submitted by facilities, and (2) identify potentially miscategorized 

 9

Executive Order 13650–Improving Chemical Facility Safety and Security established a 

Chemical Facility Safety and Security Working Group, composed of representatives from 

DHS; EPA; and the Departments of Justice, Agriculture, Labor, and Transportation, and 

directed the working group to identify ways to improve coordination with state and local 

partners; enhance federal agency coordination and information sharing; modernize 

policies, regulations and standards; and work with stakeholders to identify best practices. 

See Exec. Order No. 13,650 (Aug. 1, 2013), 78 Fed. Reg. 48,029 (Aug. 7, 2013). 

10GAO-15-614. 

11Any chemical facility that possesses any of the 322 chemicals in the quantities that meet 

or exceed the threshold quantity or concentration outlined in Appendix A to the DHS 

CFATS rule is required to complete the Chemical Security Assessment Tool (CSAT) Top 

Screen—which is the initial screening tool or document whereby the facility is to provide 

DHS various data, including the name and location of the facility and the chemicals and 

their quantities at the site. See 6 C.F.R. § 27.200(b); see also 72 Fed. Reg. 65,396 (Nov. 

20, 2007) (codified at 6 C.F.R. pt. 27, App. A). 
Page 7 GAO-18-613T Critical Infrastructure Protection

facilities that could cause the greatest harm and verify that the Distance 

of Concern of these facilities report is accurate.12 DHS has fully 

addressed both of these recommendations. Specifically, DHS 

implemented an updated Top-Screen in October 2016 and now collects 

data from facilities and calculates the Distance of Concern itself, rather 

than relying on the facilities’ calculation. In response to our second 

recommendation, in November 2016, DHS officials stated they completed 

an assessment of all Top-Screens that reported threshold quantities of 

toxic release chemicals of interest and identified 158 facilities with the 

potential to cause the greatest harm. As of May 2017, according to ISCD 

officials, 156 of the 158 facilities submitted updated Top-Screens and 145 

of the 156 Top-Screens had undergone a quality assurance review 

process.

DHS has also taken actions to better assess regulated facilities’ risks in 

order to place the facilities into the appropriate risk tier. In April 2013, we 

reported that DHS’s risk assessment approach did not consider all of the 

elements of threat, vulnerability, and consequence associated with a 

terrorist attack involving certain chemicals. Our work showed that DHS’s 

risk assessment was based primarily on consequences from human 

casualties, but did not consider economic consequences, as called for by 

the National Infrastructure Protection Plan (NIPP) and the CFATS 

regulation. We also found that (1) DHS’s approach was not consistent 

with the NIPP because it treated every facility as equally vulnerable to a

terrorist attack regardless of location or on-site security and (2) DHS was 

not using threat data for 90 percent of the tiered facilities—those tiered for 

the risk of theft or diversion—and using 5-year-old threat data for the 

remaining 10 percent of those facilities that were tiered for the risks of 

release or sabotage.13 We recommended that DHS enhance its risk 

assessment approach to incorporate all elements of risk and conduct a 

 12We recalculated the Distance of Concern for a generalizable sample of facilities—a 

simple random sample of 475 facilities from the population of 36,811 facilities that 

submitted Top-Screens since the inception of the CFATS program in 2007 through 

January 2, 2015—and compared these results to what facilities reported in their TopScreen submission. Based upon this sample, we estimated that 4,173 facilities with a toxic 

release chemical misreported the Distance of Concern, with an associated 95 percent 

confidence interval of 2,798 to 5,822 facilities. 

13For theft or diversion, DHS’s model assumes that a terrorist will steal or have the 

chemical of interest diverted to him or herself and then estimates the risk of a terrorist 

attack using the chemical of interest in a way that causes the most harm at an unspecified 

off-site location.

Assessing Risk and 

Prioritizing Facilities
Page 8 GAO-18-613T Critical Infrastructure Protection

peer review after doing so. DHS agreed with our recommendations and 

has made progress towards addressing them.

Specifically, with regard to our recommendation that DHS enhance its risk 

assessment approach to incorporate all elements of risk, DHS worked 

with Sandia National Laboratories to develop a model to estimate the 

economic consequences of a chemical attack. In addition, DHS worked 

with Oak Ridge National Laboratory to devise a new tiering methodology, 

called the Second Generation Risk Engine. In so doing, DHS revised the 

CFATS threat, vulnerability, and consequence scoring methods to better 

cover the range of CFATS security issues. Additionally, with regard to our 

recommendation that DHS conduct a peer review after enhancing its risk 

assessment approach, DHS conducted peer reviews and technical 

reviews with government organizations and facility owners and operators, 

and worked with Sandia National Laboratories to verify and validate the 

new tiering approach. We are currently reviewing the reports and data 

that DHS has provided about its new tiering methodology as part of our 

ongoing work and will report on the results of this work later this summer.

To further enhance its risk assessment approach, in fall 2016, DHS also 

revised its Chemical Security Assessment Tool (CSAT), which supports 

DHS efforts to gather information from facilities to assess their risk. 

According to DHS officials, the new tool—called CSAT 2.0—is intended to 

eliminate duplication and confusion associated with DHS’s original CSAT. 

DHS officials told us that they have improved the tool by revising some 

questions in the original CSAT to make them easier to understand; 

eliminating some questions; and pre-populating data from one part of the 

tool to another so that users do not have to retype the same information 

multiple times. DHS officials also told us that the facilities that have used 

the CSAT 2.0 have provided favorable feedback that the new tool is more 

efficient and less burdensome than the original CSAT. Finally, DHS 

officials told us that as of June 2018, DHS has completed all notifications 

and has processed tiering results for all but 226 facilities. DHS officials 

stated they are currently working to identify correct points of contact to 

update registration information for these remaining facilities. We are 

currently assessing DHS’s efforts to assess risk and prioritize facilities as 

part of our ongoing work and will report on the results of this work in our 

report later this summer.

DHS has also made progress reviewing and approving facility site 

security plans by reducing the time it takes to review these plans and 

eliminating the backlog of plans awaiting review. In April 2013, we 

Reviewing and Approving 

Facility Site Security Plans
Page 9 GAO-18-613T Critical Infrastructure Protection

reported that DHS revised its procedures for reviewing facilities’ security 

plans to address DHS managers’ concerns that the original process was 

slow, overly complicated, and caused bottlenecks in approving plans.14

We estimated that it could take DHS another 7 to 9 years to review the 

approximately 3,120 plans in its queue at that time. We also estimated 

that, given the additional time needed to do compliance inspections, the 

CFATS program would likely be implemented in 8 to 10 years. We did not 

make any recommendations for DHS to improve its procedures for 

reviewing facilities’ security plans because DHS officials reported that 

they were exploring ways to expedite the process, such as reprioritizing 

resources and streamlining inspection requirements. In July 2015, we 

reported that DHS had made substantial progress in addressing the 

backlog—estimating that it could take between 9 and 12 months for DHS 

to review and approve security plans for the approximately 900 remaining 

facilities.15 DHS officials attributed the increased approval rate to 

efficiencies in DHS’s review process, updated guidance, and a new case 

management system. Subsequently, DHS reported in its December 2016 

semi-annual report to Congress that it had eliminated its approval 

backlog.16

Finally, we found in our 2017review that DHS also took action to 

implement an Expedited Approval Program (EAP).17 The CFATS Act of

2014 required that DHS create the EAP as another option that tier 3 and 

tier 4 chemical facilities may use to develop and submit security plans to 

 14See GAO-13-353. A November 2011, internal ISCD memorandum, prepared by ISCD’s 

former Director in consultation with the former Deputy Director and designated by DHS as 

“for official use only” (FOUO), expressed concerns about the management of the CFATS 

program. The ISCD memorandum, which was leaked to the media in December 2011, 

cited an array of challenges that, according to these officials, hindered ISCD’s ability to 

implement and manage the CFATS program.

15GAO-15-614.

16Department of Homeland Security, National Protection and Programs Directorate, 

Implementation Status of the Chemical Facility Anti-Terrorism Standards: Second 

Semiannual, Fiscal Year 2016 Report to Congress (Washington, D.C.: December 9, 

2016). 

17GAO-17-502.
Page 10 GAO-18-613T Critical Infrastructure Protection

DHS.18 Under the program, facilities may develop a security plan based 

on specific standards published by DHS (as opposed to the more flexible 

performance standards using the standard, non-expedited process). DHS 

issued guidance intended to help facilities prepare and submit their EAP 

security plans to DHS, which includes an example that identifies 

prescriptive security measures that facilities are to have in place. 

According to committee report language, the EAP was expected to 

reduce the regulatory burden on smaller chemical companies, which may 

lack the compliance infrastructure and the resources of large chemical 

facilities, and help DHS to process security plans more quickly.19 If a tier 3 

or 4 facility chooses to use the expedited option, DHS is to review the 

plan to determine if it is facially deficient, pursuant to the reporting 

requirements of the CFATS Act of 2014.20 If DHS approves the EAP site 

security plan, it is to subsequently conduct a compliance inspection.

In 2017, we found that DHS had implemented the EAP and had reported 

to Congress on the program, as required by the CFATS Act of 2014.21 In 

addition, as of June 2018 according to DHS officials, only 18 of the 3,152 

facilities eligible to use the EAP opted to use it. DHS officials we

interviewed attributed the low participation to several possible factors 

including:

 18See 6 U.S.C. § 622(c)(4). Under the CFATS rule, once a facility is assigned a final tier, it 

is to submit a site security plan or participate in an alternative security program in lieu of a 

site security plan. An alternative security program is a third-party or industry organization 

program, a local authority, state, or federal government program, or any element or aspect 

thereof that DHS determines meets the requirements of the regulation and provides an 

equivalent level of security to that established by the regulation. See 6 C.F.R. § 27.105.

19S. Rep. No. 113-263, at 9-10 (Sept. 18, 2014). 

20A facially deficient site security plan is defined as a security plan that does not support a 

certification that the security measures in the plan address the security vulnerability 

assessment and risk-based performance standards, based on a review of the facility’s site 

security plan, the facility’s Top-Screen, the facility’s security vulnerability assessment, or 

any other information that the facility submits to ISCD or ISCD obtains from a public 

source or other source. 6 U.S.C. § 621(7). Specifically, ISCD determines that an EAP site 

security plan is deficient if it: does not include existing or planned measures which satisfy 

applicable Risk Based Performance Standard; materially deviates from at least one EAP 

security measure without adequately explaining that the facility has a comparable security 

measure; and/or contains a misrepresentation, omission, or inaccurate description of at 

least one EAP security measure. A facility is to implement any planned security measures 

within 12 months of the EAP site security plan’s approval because ISCD has determined 

that it is unlikely that all required security measures will be in place when a facility submits 

its plan to ISCD. 

21GAO-17-502. 
Page 11 GAO-18-613T Critical Infrastructure Protection

• DHS had implemented the expedited program after most eligible 

facilities already submitted standard (non-expedited) security plans to 

DHS;

• facilities may consider the expedited program’s security measures to 

be too strict and prescriptive, not providing facilities the flexibility of 

the standard process; and

• the lack of an authorization inspection may discourage some facilities 

from using the expedited program because this inspection provides 

useful information about a facility’s security.22

We also found in 2017 that recent changes made to the CFATS program 

could affect the future use of the expedited program.23 As discussed 

previously, DHS has revised its methodology for determining the level of 

each facility’s security risk, which could affect a facility’s eligibility to 

participate in the EAP. DHS continues to apply the revised methodology 

to facilities regulated under the CFATS program and but it is too early to 

assess the impact on participation in the EAP.

In our July 2015 report, we found that DHS began conducting compliance 

inspections in September 2013, and by April 2015, had conducted 

inspections of 83 of the 1,727 facilities that had approved security plans.24

Our analysis showed that nearly half of the facilities were not fully 

compliant with their approved site security plans and that DHS had not 

used its authority to issue penalties because DHS officials found it more 

productive to work with facilities to bring them in compliance. We also 

found that DHS did not have documented processes and procedures for 

managing the compliance of facilities that had not implemented planned 

measures by the deadlines outlined in the plans. We recommended that 

DHS document processes and procedures for managing compliance to 

provide more reasonable assurance that facilities implement planned 

measures and address security gaps. DHS agreed and has taken steps 

toward implementing this recommendation. DHS updated its CFATS 

Enforcement Standard Operating Procedure (SOP) and has made 

progress on the new CFATS Inspections SOP. Once completed these 

 22An authorization inspection consists of an initial, physical review of the facility to 

determine if the Top-Screen, security vulnerability assessment, and site security plan 

accurately represent and address the risks for the facility

23GAO-17-502. 

24GAO-15-614. 

Inspecting Facilities and 

Ensuring Consistent 

Compliance
Page 12 GAO-18-613T Critical Infrastructure Protection

two documents collectively are expected to formally document the 

processes and procedures currently being used to track noncompliant 

facilities and ensure they implement planned measures as outlined in 

their approved site security plans, according to ISCD officials. DHS 

officials stated they expect to finalize these procedures by the end of 

fiscal year 2018. We are examining compliance inspections as part of our 

ongoing work and will report on the results of our work in our report later 

this summer.

In April 2013, we reported that DHS took various actions to work with 

facility owners and operators, including increasing the number of visits to 

facilities to discuss enhancing security plans, but that some trade 

associations had mixed views on the effectiveness of DHS’s outreach.25

We found that DHS solicited informal feedback from facility owners and 

operators in its efforts to communicate and work with them, but did not 

have an approach for obtaining systematic feedback on its outreach 

activities. We recommended that DHS take action to solicit and document 

feedback on facility outreach consistent with DHS efforts to develop a 

strategic communication plan. DHS agreed and implemented this 

recommendation by developing a questionnaire to solicit feedback on 

outreach with industry stakeholders and began using the questionnaire in 

October 2016.

Chairman Shimkus, Ranking Member Tonko, and Members of the 

Subcommittee, this completes my prepared statement. I would be 

pleased to respond to any questions that you may have at this time.

If you or your staff members have any questions about this testimony, 

please contact me at (404) 679-1875 or curriec@gao.gov. Contact points 

for our Offices of Congressional Relations and Public Affairs may be 

found on the last page of this statement. Other individuals making key 

contributions to this work include John Mortin, Assistant Director; and 

Brandon Jones, Analyst-in-Charge; Michael Lennington, Ben Emmel, and 

Hugh Paquette. 

 25GAO-13-353.

Stakeholder Outreach and 

Feedback

GAO Contact and 

Staff 

Acknowledgements

(102837)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at https://www.gao.gov.

Contact:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.