17688 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

DEPARTMENT OF HOMELAND 

SECURITY 

6 CFR Part 27 

[DHS–2006–0073] 

RIN 1601–AA41 

Chemical Facility Anti-Terrorism 

Standards 

AGENCY: Department Of Homeland 

Security. 

ACTION: Interim final rule. 

SUMMARY: The Department of Homeland 

Security (DHS or Department) issues 

this interim final rule (IFR) pursuant to 

Section 550 of the Homeland Security 

Appropriations Act of 2007 (Section 

550), which provided the Department 

with authority to promulgate ‘‘interim 

final regulations’’ for the security of 

certain chemical facilities in the United 

States. 

This rule establishes risk-based 

performance standards for the security 

of our Nation’s chemical facilities. It 

requires covered chemical facilities to 

prepare Security Vulnerability 

Assessments (SVAs), which identify 

facility security vulnerabilities, and to 

develop and implement Site Security 

Plans (SSPs), which include measures 

that satisfy the identified risk-based 

performance standards. It also allows 

certain covered chemical facilities, in 

specified circumstances, to submit 

Alternate Security Programs (ASPs) in 

lieu of an SVA, SSP, or both. 

The rule contains associated 

provisions addressing inspections and 

audits, recordkeeping, and the 

protection of information that 

constitutes Chemical-terrorism 

Vulnerability Information (CVI). Finally, 

the rule provides the Department with 

authority to seek compliance through 

the issuance of Orders, including Orders 

Assessing Civil Penalty and Orders for 

the Cessation of Operations. 

EFFECTIVE DATES: This regulation is 

effective June 8, 2007, except for 

Appendix A to part 27. A subsequent 

final rule document will announce the 

effective date of Appendix A to Part 27. 

Comment related to the addition of 

Appendix A to part 27 only will be 

accepted until May 9, 2007. 

ADDRESSES: You may submit comments, 

identified by docket number 2006–0073, 

by one of the following methods: 

• Federal eRulemaking Portal: 

http://www.regulations.gov. Follow the 

instructions for submitting comments. 

• Mail: IP/CSCD/Dennis Deziel, Mail 

Stop 8100, Department of Homeland 

Security, Washington, DC 20528–8100. 

FOR FURTHER INFORMATION CONTACT: 

Dennis Deziel, Chemical Security 

Regulatory Task Force, Department of 

Homeland Security, 703–235–5263. 

SUPPLEMENTARY INFORMATION: This 

interim final rule is organized as 

follows: Section I explains the public 

participation provisions and provides a 

brief discussion of the statutory and 

regulatory authority and history; Section 

II summarizes the changes from the 

Advance Notice of Rulemaking and 

discusses the revised rule text; Section 

III summarizes and responds to the 

comments the Department received in 

response to the Advance Notice of 

Rulemaking; and Section IV contains 

the regulatory analyses for this interim 

final rule. 

Table of Contents 

I. Introduction and Background 

A. Public Participation 

B. Statutory and Regulatory Authority and 

History 

II. Interim Final Rule 

A. Summary of Changes From Advance 

Notice of Rulemaking 

B. Rule Provisions 

III. Discussion of Comments 

A. Applicability of the Rule 

1. Definition of ‘‘Chemical Facility or 

Facility’’ 

2. Multiple Owners or Operators 

3. Classifying Facilities Based on Hazard 

Class 

4. Applicability to Specific Chemicals or 

Quantities of Chemicals 

5. Applicability to Types of Facilities 

6. Statutory Exemptions 

B. Determining Which Facilities Present a 

High-Level of Security Risk 

1. Use of the Top-Screen Approach 

2. Assessment Methodologies 

3. Risk-Based Tiers 

C. Security Vulnerability Assessments and 

Site Security Plans 

1. General Comments 

2. Submitting a Site Security Plan 

3. Content of Site Security Plans 

4. Approval of Site Security Plans 

5. Timing 

6. Alternate Security Programs 

D. Risk-Based Performance Standards 

1. General Approach To Performance 

Standards 

2. Comments about Specific Performance 

Standards 

3. Variations in Performance Standards for 

Risk Tiers 

4. Adoption of MTSA Provisions 

E. Background Checks 

F. Inspections and Audits 

1. Inspections 

2. Third-Party Auditors and Inspectors 

G. Recordkeeping 

H. Orders 

I. Adjudications and Appeals 

J. Information Protection: Chemicalterrorism Vulnerability Information (CVI) 

1. General 

2. Disclosure of CVI 

3. Scope of CVI 

4. Relation of CVI to Other Categories of 

Protected Information and FOIA 

5. Sharing CVI with State and Local 

Officials, the Public, and Congress 

6. Litigation 

7. Protection of CVI 

K. Preemption 

L. Implementation of the Rule 

M. Other Issues 

1. Whistleblower Protection 

2. Inherently Safer Technology 

3. Delegation of Responsibility 

4. Interaction with Other Federal Rules and 

Programs 

5. Third-Party Actions 

6. Judicial Review 

7. Guidance and Technical Assistance 

8. Miscellaneous Comments 

N. Regulatory Evaluation 

IV. Regulatory Analyses 

A. Executive Order 12866: Regulatory 

Planning and Review 

B. Regulatory Flexibility Act 

C. Executive Order 13132: Federalism 

1. Background 

2. Propriety of the Department’s View on 

Preemption 

3. No Field Preemption 

4. Principles of Conflict Preemption 

D. Unfunded Mandates Reform Act 

E. Paperwork Reduction Act 

F. NEPA 

I. Introduction and Background 

A. Public Participation 

Interested persons are invited to 

participate in this rulemaking by 

submitting written data, views, or 

arguments on Appendix A of this 

interim final rule. Comments that will 

provide the most assistance to DHS in 

finalizing the Appendix will reference 

specific chemicals and Screening 

Threshold Quantities on the list, explain 

the reason for any recommended 

change, and include data, information, 

or authority that support such 

recommended change. 

Instructions: All submissions received 

must include the agency name and 

docket number for this rulemaking. All 

comments received will be posted 

without change to http:// 

www.regulations.gov, including any 

personal information provided. 

Comments that include trade secrets, 

confidential commercial or financial 

information, Sensitive Security 

Information (SSI), or Protected Critical 

Infrastructure Information (PCII) should 

not be submitted to the public 

regulatory docket. Please submit such 

comments separately from other 

comments on the rule. Comments 

containing trade secrets, confidential 

commercial or financial information, 

Sensitive Security Information (SSI), or 

Protected Critical Infrastructure 

Information (PCII) should be 

appropriately marked as containing 

such information and submitted by mail 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17689 

to the individual(s) listed in the FOR

FURTHER INFORMATION CONTACT section. 

Docket: For access to the docket to 

read background documents or 

comments received, go to http:// 

www.regulations.gov. Submitted 

comments by mail may also be 

inspected. To inspect comments, please 

call Dennis Deziel, 703–235–5263, to 

arrange for an appointment. 

B. Statutory Regulatory Authority and 

History 

On October 4, 2006, the President 

signed the Department of Homeland 

Security Appropriations Act of 2007 

(the Act), which provides the 

Department of Homeland Security with 

the authority to regulate the security of 

high-risk chemical facilities. See Pub. L. 

109–295, sec. 550. Section 550 requires 

the Secretary of Homeland Security to 

promulgate interim final regulations 

‘‘establishing risk-based performance 

standards for security of chemical 

facilities’’ by April 4, 2007. Id. Although 

interim final regulations are usually 

issued without prior notice and 

comment (and the Act requires neither), 

the Department issued an Advance 

Notice of Rulemaking (Advance Notice) 

seeking comment on the significant 

issues and regulatory text. See generally 

71 FR 78276 (Dec. 28, 2006). 

As discussed more fully in the 

Advance Notice, before the enactment of 

Section 550, the Federal government did 

not have authority to regulate the 

security of most chemical facilities. The 

Department has, however, worked 

closely with industry leaders in pursuit 

of voluntary enhancement of security at 

these facilities and provided both 

technical assistance and grant funding 

for security. In addition, through the 

Coast Guard’s Maritime Security 

regulations, the Department has 

addressed security at certain maritimerelated chemical facilities. See 33 CFR 

Part 105. Recently, the Departments of 

Homeland Security and Transportation 

also proposed security regulations for 

the rail transportation of hazardous 

chemicals. See 71 FR 76834, 71 FR 

76851 (Dec. 21, 2006). Other Federal 

programs have addressed chemical 

facility safety, but not security: the 

Environmental Protection Agency (EPA) 

regulates chemical process safety 

through its Risk Management Plan 

(RMP) program; the Department of 

Labor’s Occupational Safety and Health 

Administration (OSHA) regulates 

workplace safety and health at chemical 

facilities; the Department of Commerce 

oversees compliance with the Chemical 

Weapons Convention; and the 

Department of Justice’s Bureau of 

Alcohol, Tobacco, Firearms, and 

Explosives (ATF) regulates, through 

licenses and permits, the purchase, 

possession, storage, and transportation 

of explosives. 

With the authority under Section 550, 

the Department can now fill a 

significant security gap in the country’s 

anti-terrorism efforts. Section 550 

specifies that the regulations ‘‘shall 

apply to chemical facilities that, in the 

discretion of the Secretary, present high 

levels of security risk.’’ The statute 

requires that the regulations establish 

risk-based performance standards; 

requires Security Vulnerability 

Assessments and Site Security Plans; 

allows Alternative Security Programs; 

mandates audits and inspections to 

determine compliance with the 

regulations; provides for civil penalties 

for violation of an order issued under 

the statute; and allows the Secretary to 

order a facility to cease operations if the 

facility is not in compliance with the 

requirements. The statute also gives the 

Department the authority to protect 

from inappropriate public disclosure 

any information developed pursuant to 

Section 550, ‘‘including vulnerability 

assessments, site security plans, and 

other security related information, 

records, and documents.’’

As discussed in the Advance Notice, 

by directing the Secretary to issue 

‘‘interim final regulations,’’ Congress 

authorized the Secretary to proceed 

without the traditional notice-andcomment required by the 

Administrative Procedure Act. See 71 

FR 78276, 78277. The Department, 

however, saw great benefit in soliciting 

comments on as much of the program as 

was practicable in the short timeframe 

permitted under the statute. 

Accordingly, the Department 

voluntarily sought comment on a range 

of regulatory and implementation issues 

and responds to the comments below. 

II. Interim Final Rule 

A. Summary of Changes From Advance 

Notice of Rulemaking 

In this interim final rule, the 

Department has not changed the 

general, risk-based approach it proposed 

in the December 28, 2006, Advance 

Notice. See 71 FR 78276. As discussed 

in detail below, the Department plans to 

implement the regulation in phases, 

starting to work aggressively with 

chemical facilities presenting the very 

highest security risks first. The 

Department adopts a risk-based tiering 

structure in its regulatory approach, so 

that the Department’s scrutiny of 

facilities under this regulation increases 

as the level of risk increases. Even 

though this approach remains the same, 

the Department provides further details 

below on a number of unresolved issues 

presented in the Advance Notice. For 

example, the Department provides 

further detail on the issues surrounding 

background checks for those with access 

to high-risk facilities, and the 

Department describes its approach on 

facilities possessing ammonium nitrate. 

On several important issues, the 

Department has reconsidered and 

modified the position it proposed in the 

Advance Notice. For example, in 

response to comments, the Department 

has restructured its provisions 

concerning objections, consultations, 

adjudications, and appeals. As 

discussed below, the Department’s aim 

is to provide flexibility and assistance 

for facilities seeking to comply with the 

regulatory standards. The Department 

has decided, however, to incorporate a 

role for a neutral adjudicator where 

unresolved differences present 

themselves and result in significant 

fines or other penalties. In addition, the 

Department has modified a number of 

scheduling and timing requirements in 

response to comments, and the 

Department further explains its 

approach on preemption of state and 

local law after considering the 

numerous comments on that subject. 

Although the Department continues to 

view as important the opportunity for 

facilities to submit Alternative Security 

Programs, the Department modified the 

circumstances in which it will accept 

Alternative Security Programs. 

Finally, the Department will consider 

the issues surrounding the use of fees in 

this regulatory program. The 

Department is contemplating the 

assessment of different fees, including 

filing fees, fees for inspections and 

audits, and fees for the screening of 

individuals against the Terrorist 

Screening Database. The Department 

has not provided for fees in this interim 

final rule, but may, in the future, 

propose and seek comment on the 

issues surrounding fees for this 

regulatory program. 

B. Rule Provisions 

This section summarizes the 

regulatory text changes that the 

Department has made to this interim 

final rule. In addition to the summary 

contained in this section, we have, in 

many cases, provided a more extensive 

discussion of the change, and the reason 

for the change, in the response to 

comments below. See § III ‘‘Discussion 

of Comments.’’ Finally, to the extent 

that the Department has made technical 

corrections or corrected typographical 

errors, we do not specifically discuss 

them. 


rwilkins on PROD1PC63 with RULES_2
17690 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

Subpart A 

Section 27.100 Purpose 

The Department has added a Purpose 

section to the rule. It states the 

Department’s purpose and intent in 

issuing this rule and enforcing this 

regulatory program. 

Section 27.105 Definitions 

For purposes of clarity, DHS has 

added several definitions, including 

‘‘Chemical Security Assessment Tool,’’

‘‘Chemical-terrorism Vulnerability 

Information,’’ ‘‘Deputy Secretary,’’

‘‘Director of the Chemical Security 

Division’’ and ‘‘Screening Threshold 

Quantity.’’ The Department has also 

revised a few definitions, including 

‘‘Assistant Secretary’’ and ‘‘Under 

Secretary.’’ The Department revised 

‘‘Under Secretary’’ as a result of 

organizational changes in the 

Department following the Post-Katrina 

Emergency Reform Act, which the 

President signed on October 4, 2006. 

See Public Law 109–295, Title VI. In 

several places, the Department indicated 

that the named official, or his designee, 

has the specified responsibility under 

the regulation. The Department also 

revised the definition of ‘‘Alternate 

Security Program,’’ to provide 

consistency with changes the 

Department has since made to § 27.235, 

the Alternate Security Programs section. 

The Department expanded upon the 

definition of ‘‘tier,’’ adding that, for 

purposes of this part, there are four riskbased tiers. 

Finally, the Department made 

clarifying changes to ‘‘Chemical 

Facility,’’ ‘‘Covered Chemical Facility,’’

and ‘‘Owner.’’ With respect to the 

definition of ‘‘Chemical Facility,’’ the 

Department removed the circular nature 

of the definition in the Advance Notice 

(i.e., a chemical facility shall mean any 

facility) (emphasis added) and now 

provides that a chemical facility ‘‘shall 

mean any establishment that possesses 

or plans to possess * * *.’’

Section 27.120 Designation of a 

coordinating official; Consultations and 

technical assistance 

The language in revised § 27.120(a) 

makes clear that the Assistant Secretary 

will designate a Coordinating Official 

responsible for ensuring the uniform, 

impartial, and fair implementation of 

these regulations. The language in 

revised § 27.120(b) indicates that the 

Coordinating Official and his staff shall 

provide guidance to facilities, and while 

the Coordinating Official and his staff 

will be available for consultation and to 

provide technical assistance, they will 

be available only to the extent that 

resources permit. 

In § 27.120(c), the Department has 

provided specific details as to how a 

facility requests the assistance of the 

Coordinating Official. In the second 

sentence of § 27.120(c), the Department 

provides that requests for consultation 

or technical guidance do not serve to 

toll any of the applicable timelines set 

forth in this part. Accordingly, 

regardless of whether or when a facility 

submits a request for consultation or 

technical guidance, the Department will 

require the facility to comply with the 

regulatory requirements, such as 

completing the Top-Screen, identifying 

vulnerabilities in the Security 

Vulnerability Assessment, and 

developing and implementing a Site 

Security Plan. 

The Department has added a new 

provision in § 27.120(d). This provision 

provides that a covered facility may 

request a consultation with the 

Coordinating Official if it modifies its 

facility, processes, or the types or 

quantities of materials that it possesses, 

and believes such changes may impact 

the covered facility’s obligations under 

this part. The Department added this 

provision in response to commenters 

concerned about a facility’s ability to 

‘‘exit’’ the regulatory program. The 

Department recognizes that facilities 

that reduce risk to levels below those 

levels that the Department deems as that 

characterized for Tier 4 facilities (i.e., 

the lowest risk facilities of the ‘‘high 

risk’’ facilities) or that eliminate certain 

risks altogether may no longer need to 

be covered by this regulation. This 

provision allows the covered facility to 

request the initiation of the screening 

process (which determines whether or 

not the facility is high-risk and therefore 

whether the facility is or is not included 

in this regulatory program) prior to the 

facility’s next scheduled CSAT TopScreen submission pursuant to § 27.210. 

Through this consultation process, the 

facility may initiate discussions with 

the Department and ultimately 

accelerate the process for determining 

whether it can ‘‘exit’’ the regulatory 

program. 

Subpart B 

Section 27.200 Information regarding 

security risk for a chemical facility 

The Department has added several 

new provisions to this section. The 

Department has revised paragraph (b), 

by incorporating language from 

proposed § 27.200(a) of the Advance 

Notice and by also adding new 

provisions. The two sentences in 

paragraph (b)(1) come from the end of 

proposed § 27.200(a). Paragraph (b)(1) 

provides that the Assistant Secretary 

may seek the information listed in 

paragraph (a) by contacting chemical 

facilities individually or by publishing a 

notice in the Federal Register. It also 

provides that the Assistant Secretary 

may instruct facilities to complete and 

submit a Top-Screen through a secure 

Department Web site or through any 

other means approved by the Assistant 

Secretary. 

Paragraph (b)(2) is a new provision. It 

provides that a facility must complete 

and submit a Top-Screen in accordance 

with the schedule provided in § 27.210 

if it possesses any of the chemicals 

listed in Appendix A: ‘‘DHS Chemicals 

of Interest’’ at the corresponding 

quantities. For a further discussion of 

Appendix A, see the discussion of 

Appendix A further below in the Rule 

Provisions section. The purpose of this 

provision is to give facilities direction as 

to whether or not they must complete 

and submit a Top-Screen. 

As noted in the discussion of 

Appendix A, the presence or amount of 

a particular chemical is not an indicator 

of a facility’s coverage under this rule. 

The presence or amount of a chemical 

in the Appendix is merely a baseline 

threshold requiring a facility to 

complete and submit a Top-Screen. 

(Consistent with § 27.200(b)(1), DHS 

will retain the ability to notify facilities, 

through direct notification or Federal 

Register notice, that they need to 

complete and submit a Top-Screen.) The 

information that the Department will 

obtain through the Top-Screen process 

is only one of several factors that the 

Department will consider in 

determining whether a facility is ‘‘highrisk’’ and thus covered by this rule. 

Paragraph (b)(3) addresses the 

requirements for individuals who 

submit information to the Department 

through the CSAT system, which 

includes the Top-Screen process. 

Paragraph (b)(3) provides that, where 

the Department requests that a facility 

complete and submit a Top-Screen, the 

facility must designate a person to be 

responsible for the submission of 

information through the CSAT system. 

(The CSAT system is comprised of three 

sequential parts: the Top-Screen, the 

SVA, and the SSP). The Department 

provides that any such submitter must 

be an officer of the corporation or other 

person designated by an officer of the 

corporation, and must be domiciled in 

the United States. The Department had 

contemplated such requirements in 

Appendix A to the Advance Notice and 

now finalizes them here. 

Consistent with the explanation in 

Appendix A to the Advance Notice, the 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17691 

Department notes that a facility may 

choose to have another individual, in 

addition to the above-discussed 

‘‘submitter,’’ involved in the submission 

of information through the Top-Screen. 

That other individual is a ‘‘provider.’’ A 

provider would be a qualified 

individual who is familiar with the 

facility in question and who completes 

the information in the CSAT system. 

The provider, however, would not 

formally submit information to the 

Department. The individual responsible 

for sending information to the 

Department through the CSAT system 

(whether Top-Screen, SVA, or SSP) is 

always the submitter. And as indicated 

in paragraph (b)(3), the submitter is also 

responsible for attesting to the accuracy 

of the submitted information. 

Paragraphs (c)(1) and (2) address 

facilities that the Department deems as 

‘‘presumptively high risk.’’ Both 

paragraphs were in the Advance Notice, 

though they were located in proposed 

§§ 27.200(b) and (c). 

Section 27.205 Determination that a 

chemical facility ‘‘presents a high level 

of security risk.’’ 

The Advance Notice, at the end of 

§ 27.205(a), contained a provision about 

Departmental notification to facilities of 

their preliminary placement in a riskbased tier. The Department has moved 

that language to § 27.220 ‘‘Tiering,’’ so 

that it is located with the related tiering 

provisions. 

In addition, the Department has 

removed proposed § 27.205(c), along 

with §§ 27.220(b), and 27.240(c), all of 

which had contained a mechanism for 

objections. In the Advance Notice, the 

Department had provided facilities with 

the opportunity to object to the 

following three Departmental actions: 

determination that a facility ‘‘presents a 

high level of risk,’’ placement in a highrisk tier, and disapproval of a facility’s 

Site Security Plan. The intention behind 

those provisions was to provide 

facilities with an informal opportunity 

to consult with the Department. The 

Department believes that the rule 

(including existing provisions from the 

Advance Notice as well as new 

provisions in this interim final rule) 

provides facilities with several 

opportunities for consultation when 

they disagree with an initial decision on 

these matters. Specifically, revised 

§ 27.120(b) provides that the 

Coordinating Official and his staff shall 

be available to consult and to provide 

technical assistance to a facility owner 

or operator, revised § 27.120(c) provides 

the details for how a facility should 

initiate consultations or assistance, and 

revised § 27.120(d) provides that a 

covered facility may request a 

consultation if it modifies its facility, 

processes, or the types or quantities of 

materials that it possesses and believes 

such changes may impact the covered 

facility’s obligations under this part. In 

addition, §§ 27.240(b) and 27.245(b) 

provide that a facility shall enter further 

consultations following Departmental 

written notification that a Security 

Vulnerability Assessment or Site 

Security Plan is unsatisfactory. Given 

that the rule already provides 

consultation opportunities, coupled 

with the fact that the Department has 

greatly modified its adjudication and 

appeal provisions, the Department 

believes it is unnecessary to retain these 

objections provisions and has thus 

removed them from the interim final 

rule. 

Section 27.210 Submissions Schedule 

In § 27.210, the Department clarifies 

the submission schedule for the TopScreen, Security Vulnerability 

Assessment, and Site Security Plan. In 

§ 27.210(a) of the Advance Notice, the 

Department included a sentence 

indicating that the presumptive time 

frames were 60 days for the Security 

Vulnerability Assessment and 120 days 

for the Site Security Plan. In this interim 

final rule, the Department has added 

presumptive timeframes for the 

submission of the Top-Screen and 

revised the presumptive timeframes for 

SVAs and SSPs. See § 27.210(a) and (b). 

The presumptive timeframes for initial 

submissions are 60 calendar days for the 

Top-Screen, 90 calendar days for the 

SVA, and 120 calendar days for the SSP. 

The presumptive timeframes for 

resubmission vary depending on a 

facility’s tier. As a general matter, the 

Department will require facilities in 

Tiers 1 and 2 to update their TopScreen, SVA, and SSP every two years, 

and facilities in Tiers 3 and 4 to update 

their Top-Screen, SVA, and SSP every 

three years. 

In addition, the Department added a 

new paragraph (c), which addresses the 

Department’s authority to modify 

schedules as necessary. The Department 

removed § 27.210(c) as it appeared in 

the Advance Notice, because the 

provision was unnecessary in light of 

the new provisions in § 27.120(b) and 

(c), ‘‘Designation of a coordinating 

official; consultations and technical 

assistance.’’

Finally, the Department added a new 

paragraph (d), which addresses material 

modifications. In §§ 27.215(c)(3) and 

27.225(b)(3) of the Advance Notice, the 

Department provided that a covered 

facility had to notify the Department of 

material modifications to the SVA or 

SSP and that the Department would 

notify the facility within 60 days of 

whether the Department disapproved 

the revised SVA or SSP. The 

Department has re-located a new but 

similar requirement in § 27.210(d). The 

regulation now provides that if a 

covered facility makes material 

modifications to its operations or site, 

the covered facility must complete and 

submit a revised Top-Screen to the 

Department within 60 days of 

completion of the material modification. 

In accordance with the resubmission 

requirements in § 27.210(b)(2) and (3), 

the Department will notify the covered 

facility as to whether the covered 

facility must submit a revised Security 

Vulnerability Assessment, Site Security 

Plan, or both. As a result of this new 

paragraph (d), the Department removed 

the provisions that appeared in 

§§ 27.215(c)(3) and 27.225(b)(3) of the 

Advance Notice. 

Section 27.215 Security Vulnerability 

Assessments and Section 27.225 Site 

Security Plans 

The Department has revised several of 

the corresponding provisions in both 

§ 27.215 and § 27.225. First, the 

Department has revised the 

corresponding provisions regarding 

methodologies. Specifically, the 

Department has revised the language in 

§ 27.215(b) and added a new paragraph 

(b) in § 27.225. In both places, the 

Department explains that, except as 

provided in § 27.235, a covered facility 

must submit either the SVA/SSP 

through the CSAT process or any other 

methodology or process identified by 

the Assistant Secretary. 

By this change, the Department is 

making more explicit its intention to use 

the CSAT process at this time. The 

CSAT process includes completion of 

the Top-Screen process and, depending 

on the results of the Top-Screen process, 

may also include the development of a 

Security Vulnerability Assessment and 

the development of a Site Security Plan. 

Thus, for facilities that are determined 

to be high-risk, the CSAT process will 

consist of three sequential parts (i.e., the 

Top-Screen, SVA, and SSP). The 

Department also notes that facilities will 

have to obtain access to the CSAT 

system by submitting a user registration 

request. Section 27.200(b)(1) contains 

the requirements for individuals (i.e., 

submitters) who will be submitting 

information through the CSAT system 

and attesting to the accuracy of that 

information. 

Second, in paragraph (c) of both 

sections, the Department provides that a 

covered facility must submit an SVA or 

SSP to the Department in accordance 


rwilkins on PROD1PC63 with RULES_2
17692 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

with the schedule provided in § 27.210. 

This captures the requirement that had 

been located in proposed § 27.240(a)(1) 

of the Advance Notice. 

Third, in paragraph (d) of both 

sections, the Department revised the 

update/revision provisions for 

submitting SVAs and SSPs. In the 

Advance Notice, the Department 

indicated that covered facilities must 

update or revise their SVAs or SSPs 

based on a schedule set by the Assistant 

Secretary. Because the Department has 

established a submission schedule in 

§ 27.210, the Department now includes 

cross-references in § 27.215(d)(1) and 

§ 27.225(d)(2) to that schedule. As a 

related matter, in § 27.215(d), the 

Department moved the general 

submissions schedule requirement to 

§ 27.215(d)(1), thereby re-locating the 

provision formerly in § 27.215(d)(1) to 

§ 27.215(d)(2). 

Fourth, the Department has removed 

the language about material 

modifications from proposed 

§ 27.215(c)(3) and § 27.225(b)(3). As 

discussed in the summary of § 27.210, 

the Department added a new, but 

similar, provision to § 27.210(d). The 

new provision now captures the concept 

contemplated in proposed § 27.215(c)(3) 

and § 27.225(b)(3). 

With respect to changes to § 27.225 

only, the Department has added a 

provision that requires facilities to 

conduct annual audits of their Site 

Security Plans. See § 27.225(e). This 

provision had been implied in the 

recordkeeping requirement in the 

Advance Notice (see § 27.255(a)(6)) and 

is now explicit. DHS made some 

additional revisions to the 

corresponding recordkeeping provision, 

in which DHS more clearly specifies the 

audit-related records that covered 

facilities should maintain. 

Finally, throughout this document, 

the Department now uses the term 

‘‘Security Vulnerability Assessment’’ (or 

SVA) instead of the term ‘‘Vulnerability 

Assessment’’ or (VA), which the 

Department had used in the Advance 

Notice. The Department intends no 

change in meaning with this revision. 

Section 27.220 Tiering 

The Department has added several 

paragraphs to this section. Section 

27.220(a) addresses the Department’s 

preliminary determination as to a 

facility’s risk-based tier. Paragraph (a) is 

based on language that had been in the 

Advance Notice at the end of 

§ 27.205(a). The Department has 

elaborated on the Preliminary Tiering 

provision. Notably, the Department has 

indicated that it shall notify a facility of 

the Department’s preliminary tiering 

decision. This contrasts with the 

Advance Notice, which had merely 

indicated that the Department may 

notify a facility of the Department’s 

preliminary tiering decision. 

Section 27.220(b) is not a new 

subsection; rather, it contains the 

language that was previously located in 

§ 27.220(a). Note that the Department 

has removed paragraph (b) as proposed 

in the Advance Notice. Paragraph (b) 

had contained an objections provision. 

For a discussion of the Department’s 

decision to remove the objections 

provisions from this rule (in 

§§ 27.205(c), 27.220(b), and 27.240(c)), 

see the summary under § 27.205(c). 

Section 27.220(c) is a new subsection. 

The Department is reiterating, in part, 

what it provides in the definitions 

section. The Department will place 

facilities in one of four risk-based tiers. 

Tiers will range from Tier 1, which 

contains the highest-risk covered 

facilities, to Tier 4, which contains the 

lowest-risk covered facilities. Finally, 

the Department separated the sentence 

located at the end of proposed 

§ 27.220(a) into its own section, 

§ 27.220(d). 

Section 27.230 Risk-Based 

Performance Standards 

This section contains the risk-based 

performance standards that covered 

facilities must satisfy. The Department 

has added a sentence to § 27.230(a), 

noting that the ‘‘acceptable layering of 

measures used to meet the standards 

will vary by risk-based tier.’’ While all 

facilities must satisfy the performance 

standards, the measures sufficient to 

meet those standards will be more 

robust for those facilities that present 

higher levels of risk. In other words, the 

manner in which the standards are 

applied will require a higher level of 

security (and so provide for greater 

reduction in risk) for those facilities that 

present higher levels of risk. The 

Department will provide details about 

the application of these standards in 

guidance. 

In addition, for each of the 

performance standards, the Department 

has added a short descriptor at the 

beginning of the subparagraph (e.g., 

paragraph (a)(1) begins with ‘‘Restricted 

Area Perimeter,’’ paragraph (a)(2) begins 

with ‘‘Securing Site Assets,’’ and so 

forth). 

The Department has also revised some 

of the language related to specific 

performance standards. Section 

27.230(a)(4) now provides that facilities 

must select, develop, and implement 

measures designed to ‘‘[d]eter, detect, 

and delay an attack, creating sufficient 

time between detection of an attack and 

the point at which the attack becomes 

successful.’’ This revised language more 

adequately captures the concept that the 

Department had intended in the 

language in paragraph (a)(4) of the 

Advance Notice and is more complete. 

Section 27.230(a)(5) now requires 

facilities to secure and monitor the 

storage of hazardous materials, in 

addition to the shipping and receipt of 

hazardous materials. Section 

27.230(a)(8) now contains a broader 

description of critical process systems. 

In the Advance Notice, the Department 

had used the acronym ‘‘SCADA’’

(Supervisory Control and Data 

Acquisition) to refer to instrumented 

control systems in general. In this 

interim final rule, the Department has 

provided more descriptive terminology 

to refer to critical process systems. For 

a further discussion of SCADA, see the 

Department responses to ‘‘Comments on 

Specific Performance Standards.’’

Section 27.230(a)(12) contains an 

expanded standard for background 

checks. For a further discussion of 

background checks, see the Department 

response to comments about 

‘‘Background Checks.’’ Section 

27.230(a)(15) now provides that 

facilities should report significant 

security incidents to local law 

enforcement in addition to the 

Department. Finally, the Department 

has removed the paragraph that was 

paragraph 27.230(a)(19) in the Advance 

Notice, because that standard was 

already addressed in paragraph (a)(14). 

Section 27.235 Alternative security 

program 

The Department has revised this 

section to provide more detail about the 

process for Alternate Security Programs 

(ASPs). The basic requirement remains 

the same, in that certain covered 

facilities may submit ASPs, and the 

Assistant Secretary may approve those 

ASPs. See § 27.235(a). To accept an 

ASP, the Assistant Secretary must find 

that the program ‘‘provides an 

equivalent level of security to the level 

of security established by this part.’’

This language, which clarifies the 

standard for accepting ASPs, comes 

from the preamble of the Advance 

Notice and is consistent with the terms 

of Section 550. See 71 FR 78276, 78285. 

In § 27.235(a)(1)–(2), the Department 

specifies, by tier, which facilities may 

submit ASPs in lieu of Security 

Vulnerability Assessments (SVAs) and 

which facilities may submit ASPs in 

lieu of Site Security Plans (SSPs). A Tier 

4 facility may submit an ASP in lieu of 

a Security Vulnerability Assessment, 

Site Security Plan, or both. Tier 1, Tier 

2, and Tier 3 facilities may submit an 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17693 

ASP in lieu of a Site Security Plan. Tier 

1, Tier 2, and Tier 3 facilities may not 

submit an ASP in lieu of a Security 

Vulnerability Assessment. Accordingly, 

Tier 1, Tier 2, and Tier 3 facilities will 

have to submit their SVA through the 

CSAT system. 

With respect to Tier 4 facilities, the 

Department clarifies the following 

point: Given that the Department 

notifies a facility of its final placement 

in a risk-based tier following the 

Department’s review of a covered 

facility’s SVA (see § 27.220(b)), a facility 

will not know its final tier placement at 

the time it might decide to submit an 

ASP in lieu of a SVA. Because of that, 

the Department understands that 

facilities will rely on the Department’s 

preliminary tiering determination made 

pursuant to § 27.220(a). 

There are various reasons underlying 

the Department’s decision not to accept 

ASPs as SVAs for Tier 1, Tier 2, and 

Tier 3 facilities. The Department needs 

a consistent baseline against which to 

compare risks and vulnerabilities across 

chemical facilities. (For a further 

discussion of this issue, see the 

Department’s response to comments in 

§ III(B)(1)). As well, the Chemical 

Security Assessment Tool (CSAT) 

system uses an integrated approach to 

chemical facility security, and by 

considering SVAs that use the 

methodology in the CSAT system, the 

Department can take full advantage of 

that integrated approach. Furthermore, 

by using this electronic, integrated 

CSAT approach, the Department can 

more efficiently review and assess a 

greater number SVAs, and that is of 

importance considering the 

Department’s phased implementation 

scheme to address the highest risk 

facilities first. 

The Department acknowledges that 

many facilities have expended 

substantial resources and incurred 

significant expense to identify 

vulnerabilities and to develop security 

plans. The Department commends 

facilities for such efforts. The work 

performed on these efforts is valuable, 

and DHS is committed to capitalizing on 

these investments. The information 

developed in these efforts will be 

relevant to facilities as they complete 

the CSAT SVA. Facilities will be able to 

use the information from existing 

vulnerability assessments, and in many 

cases, the practical impact of requiring 

Tiers 1, 2, and 3 facilities use the CSAT 

SVA system will be one of formatting, 

i.e., facilities will have to enter their 

information from their existing 

vulnerability assessments into the 

format established by the CSAT system. 

While some additional analytical effort 

will be required, even where the facility 

has produced a strong SVA, the effort 

will be considerably less than that at 

facilities that are starting without a preexisting SVA. 

In addition, § 27.235(b) provides that 

the notice requirements for submitting 

ASPs correspond with the notice 

requirements (including the approval 

and disapproval process) for SVAs and 

SSPs. In other words, if a facility is 

submitting an ASP in lieu of an SVA, 

the process in § 27.240 applies, and if a 

facility is submitting an ASP in lieu of 

an SSP, the process in § 27.245 applies. 

Section 27.240 Review and Approval 

of Security Vulnerability Assessment 

and Section 27.245 Review and 

Approval of Site Security Plans 

In this interim final rule, the 

Department has separated the review 

and approval of SVAs and SSPs into 

two separate sections. In the Advance 

Notice, both sets of requirements were 

located in § 27.240. In this interim final 

rule, the provisions related to Security 

Vulnerability Assessments are located 

in § 27.240, and the provisions related 

to Site Security Plans are located in 

§ 27.245. 

In addition, the Department made 

some changes to the corresponding 

provisions in the two separate sections. 

In both sections, the Department has 

removed the language (from proposed 

§ 27.240(a)(1)) about time periods for 

submitting SVAs and SSPs. The 

Department has already addressed this 

issue in §§ 27.215(c)–(d) and 

§§ 27.225(c)–(d) (by providing that a 

facility must provide, update, and revise 

its SVA and SSP consistent with the 

schedule in § 27.210), so it was 

unnecessary to also include this 

language here. Also, in both sections, 

the Department has added new language 

about the disapproval of SVAs or SSPs. 

The Department added a new sentence, 

which provides that ‘‘[i]f the 

resubmitted [SVA or SSP] does not 

satisfy the requirements of [§ 27.215 or 

§ 27.225], the Department will provide 

the facility with written notification 

(including a clear explanation of 

deficiencies in the [SVA or SSP]) of the 

Department’s disapproval of the [SVA or 

SSP].’’ See § 27.240(b) and § 27.245(b). 

Finally, the Department has added a 

provision in § 27.245(a)(1)(iii), 

indicating that the Department issues a 

Letter of Approval if it approves a 

facility’s Site Security Plan in 

accordance with § 27.250. While this 

provision appears elsewhere in the rule 

(see § 27.245(b)), the Department 

thought it was appropriate to include it 

here as well. 

The Department has removed 

27.240(c) as proposed in the Advance 

Notice. Paragraph (c) had contained an 

objections provision. For a discussion of 

the Department’s decision to remove the 

objections provisions from this rule (in 

§§ 27.205(c), 27.220(b), and 27.240(c)), 

see the summary under § 27.205(c). 

Section 27.250 Inspections and Audits 

The Department has added additional 

provisions to the inspection and audit 

section. In § 27.250(c), the Department 

discusses the time and manner 

requirements for inspections. While the 

Department will generally provide 

facilities with 24-hour advance notice of 

inspections, the Department recognizes 

two exceptions where an unannounced 

inspection might occur. The Department 

included the first exception in the 

Advance Notice, and the Department 

has added the second exception in this 

interim final rule. For a further 

discussion, see the Discussion of 

Comments in § III(F) on ‘‘Inspections 

and Audits.’’

In § 27.250(d), the Department 

addresses various details related to the 

inspectors who will conduct inspections 

and audits. This is a new paragraph that 

was not in the Advance Notice. 

Although Congress has not provided the 

Department with administrative 

subpoena authority, this paragraph 

explains that inspectors will have 

credentials and may administer oaths 

and receive affirmations upon consent. 

It also provides details about the means 

by which inspectors may gather 

information and the access that 

inspectors will have to records. The 

Department has also added a paragraph 

(e), which addresses confidentiality. 

Finally, the guidance paragraph, which 

had been located in paragraph (d) has 

been moved to paragraph (f). 

Section 27.255 Recordkeeping 

Requirements 

The Department revised various 

provisions related to recordkeeping. 

With respect to § 27.255(a)(1), the 

Department added a few additional 

record requirements regarding training. 

In addition to keeping records of the 

date and location of each training 

session, time of day and duration of 

each session, the name and 

qualifications of the instructor, and a 

clear, legible list of the attendees 

including attendees’ signatures, the 

facility must also keep at least one other 

unique identifier for each attendee 

receiving training and the results of any 

evaluation or training. The Department 

also added a requirement to § 27.255(b), 

requiring facilities to keep submitted 

Top-Screens in addition to submitted 


rwilkins on PROD1PC63 with RULES_2
17694 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

SVAs and SSPs. In addition, as 

discussed above in the summary for 

§ 27.225(e), the Department revised the 

recordkeeping provision related to 

internal audits. See § 27.255(a)(6). 

The Department also added a new 

paragraph (c), allowing the Department 

to request that covered facilities make 

available records kept pursuant to other 

Federal programs or regulations. The 

Department would make such requests 

for records to the extent that any such 

records were necessary for security 

purposes. As a result of adding new 

paragraph (c), the Department had to redesignate proposed paragraph (c) as 

paragraph (d). 

Subpart C 

The Department has substantially 

revised Subpart C, which contains the 

provisions for Orders, Adjudications, 

and Appeals. 

Section 27.300 Orders 

The Department has restructured the 

Orders provisions. Whereas the 

Advance Notice contained four separate 

sections (see §§ 27.300, 27.305, 27.310, 

and 27.315), the Department has now 

consolidated all of the Order provisions 

into one section, § 27.300. The main 

substance of the Orders provisions, 

however, remains the same. Pursuant to 

§ 27.300(a), the Assistant Secretary can 

issue an Order for any instance of 

noncompliance. For example, the 

Assistant Secretary may issue an Order 

for a facility’s refusal to complete a TopScreen, failure to allow an inspection, or 

failure to update a Site Security Plan. 

Beyond a basic Order, the Assistant 

Secretary may issue an Order Assessing 

Civil Penalty, an Order to Cease 

Operations, or both, where it determines 

that a facility is in violation of any 

Order issued pursuant to paragraph (a). 

See § 27.300(b). Orders Assessing Civil 

Penalty are for a continual 

noncompliance, a repeated pattern of 

noncompliance or egregious instances of 

noncompliance. Orders to Cease 

Operations are the most serious Orders 

that the Assistant Secretary might 

choose to issue under this regulatory 

scheme. The Assistant Secretary will 

use such a measure cautiously and 

judiciously and will balance the 

immediate security needs with the 

possible impact (e.g., economic impact 

or national security effect) of such an 

Order on the chemical industry and the 

Nation as a whole. As the Department 

wrote in the Advance Notice, ‘‘This 

authority would be utilized when no 

other options will achieve the required 

result.’’ See 71 FR 78276, 78287. 

Paragraphs (c) through (f) of § 27.300 

address the process and procedures for 

Orders. Section 27.300(c) lists the 

information, at a minimum, that the 

Assistant Secretary must include in an 

Order and also notes that the Assistant 

Secretary may establish further 

procedures for the issuance of Orders. 

Section 27.300(d) notes that a facility 

must comply with the terms of the 

Order by the date specified in the Order. 

Section 27.300(e) indicates that a 

facility has the right to seek an 

adjudication to review the decision of 

the Assistant Secretary to issue an 

Order, and § 27.300(f) addresses final 

agency action. 

With respect to the staying of Orders, 

the Department addresses this issue in 

the new adjudications sections. 

Specifically, § 27.310(b)(4) provides that 

an Order is stayed from the timely filing 

of a Notice of Application for Review 

until the Presiding Officer issues an 

Initial Decision, unless the Secretary 

lifts the stay due to exigent 

circumstances pursuant to § 27.310(d). 

The new adjudications section is 

discussed in more depth below. 

Section 27.305 through 27.340 

Adjudications 

Most significantly with respect to 

adjudications, the Department has 

provided facilities with the opportunity 

to seek review of specified decisions 

before a neutral adjudications officer. A 

facility or other person may seek review 

of the following Department (i.e., 

Assistant Secretary) determinations: (1) 

A finding, pursuant to 

§ 27.230(a)(12)(iv) that an individual is 

a potential security threat; (2) The 

disapproval of a Site Security Plan 

pursuant to § 27.245(b); or (3) The 

issuance of an Order pursuant to 

§ 27.300(a) or (b). See § 27.310(a). 

The procedures for Applications are 

found in § 27.310(b). To institute 

Adjudication Proceedings, the facility or 

other person (‘‘Applicant’’) must file a 

Notice of Application for Review within 

seven calendar days of notification of 

the Assistant Secretary’s determination. 

See § 27.310(b)(1)–(2). Then, in an 

Application for Review, the Applicant 

must explain his or her position (i.e., 

explain why the Assistant Secretary’s 

determination should be set aside). The 

Applicant has 14 calendar days from the 

date of notification of the Assistant 

Secretary’s determination to file and 

serve an Application for Review. See 

§ 27.310(b)(5). The Assistant Secretary, 

through the Office of the General 

Counsel, shall file and serve a Response 

within 14 calendar days of the filing and 

service of the Application for Review. 

See § 27.310(c). Finally, the Secretary 

may make certain procedural 

modifications in exigent circumstances. 

See § 27.310(d). 

A Presiding Officer is the neutral 

adjudications officer who handles these 

proceedings. The Secretary shall 

appoint a Presiding Officer, consistent 

with the requirements in § 27.315. A 

Presiding Officer shall immediately 

consider whether a summary 

adjudication of an Application for 

Review is appropriate, and if the 

Presiding Officer finds that there is no 

genuine issue of material fact and that 

one party or the other is entitled to 

decision as a matter of law, then the 

record shall be closed and the Presiding 

Officer shall issue an Initial Decision on 

the Application for Review. See 

§ 27.330(b). Such summary decisions 

are governed by the procedures in 

§ 27.330. 

Where there is no summary decision, 

the Presiding Officer may conduct a 

hearing using the procedures specified 

in § 27.335. The Presiding Officer shall 

close and certify the record upon the 

completion of one of the following: a 

summary judgment proceeding, a 

hearing, the submission of post-hearing 

briefs, or the conclusion of oral 

arguments. See § 27.340(a). Based on the 

certified record, the Presiding Officer 

shall issue an Initial Decision, and the 

decision shall be subject to appeal 

pursuant to § 27.345. 

In addition to the sections mentioned 

above, there are a few other sections that 

address provisions related to 

adjudications. Section 27.320 specifies 

the prohibition on ex parte 

communications during Proceedings. 

And § 27.325 provides that the Assistant 

Secretary bears the initial burden of 

proving the facts necessary to support 

the challenged administrative action at 

every proceeding instituted under this 

subpart. 

Finally, as related to the Appeals 

section below, a Presiding Officer’s 

Initial Decision is stayed from the 

timely filing of a Notice of Appeal until 

the Under Secretary issues a Final 

Decision, unless the Under Secretary 

lifts the stay due to exigent 

circumstances. See § 27.345(b)(4). 

Section 27.345 Appeals 

The interim final rule contains a 

revised appeals section. There are 

several differences. First, a facility or 

other person may appeal the Initial 

Decision of the Presiding Officer made 

pursuant to § 27.340(b). This differs 

from the Advance Notice, in which a 

facility could appeal a Departmental 

final determination regarding 

disapproval of a Site Security Plan and 

the Departmental issuance of an Order. 

See § 27.320 in the Advance Notice. 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17695 

Second, the Advance Notice provided 

that the Under Secretary would make 

decisions for most categories of appeals, 

and the Deputy Secretary would make 

decisions for one category of appeal. 

This interim final rule provides that all 

appeals go to the Under Secretary or his 

designee acting as a neutral appeals 

officer. Third, as is discussed in more 

depth below, the procedures for an 

appeal have changed. 

The Assistant Secretary, a facility, or 

other person (‘‘Appellant’’) may 

institute an Appeal by filing a Notice of 

Appeal within seven calendar days of 

notification of the Presiding Officer’s 

Initial Decision. See § 27.345(b)(1)–(3). 

The Appellant shall then file and serve 

a Brief within 28 calendar days of the 

notification of the Presiding Officer’s 

Initial Decision. See § 27.345(b)(5). The 

Appellee shall file and serve its 

Opposition Brief within 28 days of the 

filing of Appellant’s Brief. See 

§ 27.345(b)(6). The Under Secretary 

shall issue a Final Decision and serve it 

on the parties. A Final Decision by the 

Under Secretary constitutes final agency 

action. See § 27.345(f). 

In addition to the provisions 

mentioned above, the Department notes 

the following: Pursuant to § 27.345(b), 

the Under Secretary may provide for an 

expedited appeal; pursuant to 

§ 27.345(c), ex parte communications 

are prohibited; and pursuant to 

§ 27.345(c), a facility or other person 

may elect to have the Under Secretary 

participate in any mediation or other 

resolution process by expressly waiving, 

in writing, any argument that such 

participation has compromised the 

Appeals process. In addition, pursuant 

to § 27.345(g), the Secretary may 

establish procedures for the conduct of 

appeals. 

Subpart D 

Section 27.400 Chemical-Terrorism 

Vulnerability Information 

The Department has made numerous 

clarifying changes to the chemicalterrorism vulnerability information 

(CVI) section. Some of these changes 

corrected typographical errors, while 

several others clarified existing 

provisions. With respect to a minor 

change, note that, in § 27.400 of the 

Advance Notice, the Department 

referred to CVI as ‘‘Chemical-terrorism 

Security and Vulnerability Information’’

and in this interim final rule, the 

Department now refers to CVI as 

‘‘Chemical-terrorism Vulnerability 

Information.’’ The Department intends 

no change in meaning with this 

revision. 

The Department has highlighted 

below the more substantive changes to 

§ 27.400. With respect to paragraph (c), 

the Department has removed paragraph 

(c)(2), because that concept is already 

covered in paragraph (e)(1)(v). In 

paragraph (d)(1), the Department 

provides that covered persons must 

protect all CVI in their possession or 

control, including electronic data. In 

paragraph (e)(1), the Department added 

language providing that a person who 

might have a ‘‘need to know’’ includes 

‘‘state or local officials, law enforcement 

officials, and first responders.’’ In 

paragraph (e)(1)(ii), the Department 

clarified that a person in training will 

only have access to CVI that he needs 

as part of his training, and in paragraph 

(e)(1)(iv), the Department clarified that a 

the person in a fiduciary relationship 

with a covered person who is 

representing or providing advice to that 

covered person will also have a need to 

know CVI. In paragraph (e)(2)(iii), the 

Department provides that it may require 

non-Federal persons seeking access to 

CVI to complete a non-disclosure 

agreement before such access is granted. 

In paragraph (f)(3), the Department 

shortened the distribution limitation 

statement and added a new sentence at 

the end, which provides: ‘‘[i]n any 

administrative or judicial proceedings, 

this information shall be treated as 

classified information in accordance 

with 6 CFR §§ 27.400(h) and (i).’’ And 

in paragraphs (h)(1), (i)(1), and (i)(2), the 

Department made it clear that these 

sections apply to the disclosure of CVI 

in the context of administrative or 

judicial enforcement proceedings of 

section 550 only, not any other kind of 

enforcement proceeding. Similarly, in 

paragraph (i)(7)(iii), the Department 

made it clear that this section applies 

only to judicial enforcement 

proceedings and not any other judicial 

proceeding. 

Section 27.405 Review and Preemption 

of State Laws and Regulations 

The Department has made several 

changes to § 27.405, including various 

regulatory text changes. Among those 

changes, the Department has added 

paragraph (a)(1). The Department 

wishes to avoid any unintended 

consequences in the program’s 

interaction with other Federal 

requirements. For this reason, 

§ 27.405(a)(1) provides that ‘‘[n]othing 

in this regulation is intended to displace 

other federal requirements administered 

by the Environmental Protection 

Agency, U.S. Department of Justice, U.S. 

Department of Labor, U.S. Department 

of Transportation, or other federal 

agencies.’’ For a further discussion of 

these changes and preemption in 

general, see the section below entitled 

‘‘Executive Order: 13132: Federalism.’’

Proposed Appendix A: DHS Chemicals 

of Interest 

In the Advance Notice, the 

Department sought comment on 

appropriate sources of information or 

methodologies for evaluating and 

categorizing chemical facilities.’’ See 71 

FR 78276, 78282. The Department 

responds to those comments below in 

the ‘‘Discussion of Comments.’’ In this 

interim final rule, the Department has 

decided to evaluate chemical facility 

risks by, in part, classifying facilities by 

particular chemicals. In proposed 

Appendix A, the Department has 

included a list of ‘‘DHS Chemicals of 

Interest’’ along with Screening 

Threshold Quantities, or STQs, for each 

chemical. The Department has 

established STQs to trigger preliminary 

screening requirements. The STQ is not 

the threshold quantity for establishing 

whether a given facility is a high-risk 

facility, but only sets a threshold to 

require a facility to complete and submit 

a CSAT Top-Screen. As noted in the 

‘‘Public Participation’’ section above, 

the Department is accepting public 

comment on proposed Appendix A for 

30 days. Following the close of the 

comment period, the Department will 

review the comments and publish a 

final Appendix A. The requirements 

related to Appendix A, which are found 

in §§ 27.200(b)(2) and 27.210, will 

become operative on the date that the 

Department publishes a final Appendix 

A. 

Pursuant to § 27.200(b)(2), if a facility 

possesses any chemicals identified in 

Appendix A at the corresponding 

quantities, the facility must complete 

and submit a Top-Screen. Consistent 

with the submission requirements in 

§ 27.210(a)(1), the facility must 

complete the Top-Screen within 60 

calendar days of the effective date of a 

final Appendix A or within 60 calendar 

days of coming into possession of any 

such chemical at the corresponding 

quantity. (As indicated in the regulatory 

text, this submission requirement is not 

operative until the Department 

publishes a final Appendix A.) Note that 

this provision does not affect the 

Department’s ability to contact facilities 

independently of this list. Pursuant to 

§ 27.200(b)(1), DHS may notify facilities, 

on an individual basis or through an 

additional Federal Register notice, that 

they need to complete and submit the 

Top-Screen. The Department notes that, 

where a facility has a question as to 

whether it should complete a TopScreen, the facility can contact the 


rwilkins on PROD1PC63 with RULES_2
17696 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

Department and seek a consultation 

pursuant to § 27.120. 

The Department reiterates that the 

presence or amount of a particular 

chemical listed in Appendix A is not 

the sole factor in determining whether 

a facility presents a high-level of 

security risk and is not an indicator of 

a facility’s coverage under this rule. The 

DHS Chemicals of Interest list merely 

directs certain facilities to complete and 

submit the Top-Screen. This list serves 

as a tool to aid the Department in 

gathering information needed to 

administer the program under Section 

550. In order for the Department to 

assess compliance by particular 

chemical facilities with the regulation 

(see Section 550(e)), the Department 

must first obtain information to 

determine whether the particular 

chemical facilities qualify for coverage 

under Section 550. The list set out in 

Appendix A serves as a procedural tool 

designed to aid the Department in 

determining which facilities must 

comply with the substantive standards. 

Only after the Department gathers 

additional information through the TopScreen process will the Department 

make a determination as to whether a 

facility presents a high risk and 

therefore must comply with the 

regulatory requirements to ensure 

adequate security. Under Section 550, 

the Department has the authority to use 

its best judgment and all available 

information in determining whether a 

facility presents a high level of security 

risk. 

In developing the ‘‘DHS Chemicals of 

Interest’’ list, the Department has looked 

to existing sources of information and 

has then drawn on many of those 

sources of information, including some 

of the sources that commenters 

suggested. Those sources include the 

following: (1) The chemicals contained 

on the EPA’s RMP list. Pursuant to the 

Clean Air Act (42 U.S.C. 7401, et seq.), 

which provides that the EPA shall 

promulgate a list of substances that ‘‘in 

the case of accidental release, are known 

to cause or may reasonably be 

anticipated to cause death, injury, or 

serious adverse effects to human health 

or the environment (see 42 U.S.C. 

7412(r)(3)), the EPA promulgated two 

lists. Table 1 is titled ‘‘List of Regulated 

Toxic Substances and Threshold 

Quantities for Accidental Release 

Prevention,’’ and Table 3 is titled ‘‘List 

of Regulated Flammable Substances and 

Threshold Quantities for Accidental 

Release Prevention’’ (see 40 CFR 

68.130); (2) The chemicals from the 

Chemical Weapons Convention (CWC). 

Section 6701, et seq. of Title 22 of the 

United States Code implements the 

Convention on the Prohibition of the 

Development, Production, Stockpiling 

and Use of Chemical Weapons and on 

Their Destruction. The CWC covers 

three lists, or ‘‘schedules’’ of chemicals. 

Schedule 1 chemicals are provided in 

Supplement No. 1 to 15 CFR part 712, 

Schedule 2 chemicals are provided in 

Supplement No. 2 to 15 CFR part 713, 

and Schedule 3 chemicals are provided 

in Supplement No. 3 to 15 CFR part 714; 

and (3) Hazardous materials, including 

gases poisonous by inhalation (PIH) and 

explosive materials, which the 

Department of Transportation regulates. 

See 49 CFR 173.115(c), 49 CFR 

173.50(b), and 49 CFR 172.101. The 

Department has also considered other 

categories of chemicals, such as 

chemicals that can be used as precursors 

for Improvised Explosive Devices (IEDs) 

and certain water-reactive materials that 

produce toxic gases. 

The Department makes a few points 

with respect to the list in Appendix A. 

First, DHS is not using any existing list 

(e.g., the EPA RMP list) as its sole 

source, and DHS is not classifying all 

facilities on a list in one particular way 

(i.e., classifying all RMP facilities as 

high-risk). By using multiple sources at 

this initial phase, DHS believes it is 

obtaining a more complete picture of the 

universe of facilities that may qualify as 

high-risk. Second, in identifying the 

types and STQs of chemicals for 

Appendix A, the Department has sought 

to be sufficiently inclusive of chemicals 

and quantities that might present a high 

level of risk under the statute without 

being overly inclusive and therefore 

capturing facilities which are unlikely 

to present a high level of risk. 

In addition to drawing on information 

from existing sources, the Department 

has identified chemicals by considering 

three security issues. These three 

security issues, which are explained 

below, address multiple risk areas. 

1. Release—DHS believes that certain 

quantities of toxic, flammable, or 

explosive chemicals or materials, if 

released from a facility, have the 

potential for significant adverse 

consequences for human life or health. 

2. Theft or Diversion—DHS believes 

that certain chemicals or materials, if 

stolen or diverted, have the potential to 

be used as weapons or easily converted 

into weapons using simple chemistry, 

equipment or techniques in order to 

create significant adverse consequences 

for human life or health. 

3. Sabotage or Contamination—DHS 

believes that certain chemicals or 

materials, if mixed with readilyavailable materials, have the potential to 

create significant adverse consequences 

for human life or health. 

In proposed Appendix A, the 

Department lists the DHS Chemicals of 

Interest and identifies a Standard 

Threshold Quantity (STQ) for each 

chemical. To clearly identify each 

chemical, the Department includes the 

Chemical Abstract Service (CAS) 

number for each chemical. These 

chemicals listed in proposed Appendix 

A fall into the three categories identified 

above: chemicals with a release hazard, 

chemicals with a theft or diversion 

hazard, and chemicals with a sabotage 

or contamination hazard. 

The Department acknowledges that 

there are two additional security issues 

that it is considering at this time, 

although it is not including any such 

chemicals that would trigger a TopScreen submission. They include the 

following two issues: 

1. Critical Relationship to Government 

Mission—DHS believes that the loss of 

certain chemicals, materials, or facilities 

could create significant adverse 

consequences for national security or 

the ability of the government to deliver 

essential services. 

2. Critical Relationship to National 

Economy—DHS believes that the loss of 

certain chemicals, materials or facilities 

could create significant adverse 

consequences for the national or 

regional economy. 

The Department is continuing to 

assess currently-available information 

about these chemicals critical to 

government mission and the national 

economy. The Department will use the 

information it collects through the TopScreen process, as well as currentlyavailable information, as a means of 

identifying facilities responsible for 

economically critical and missioncritical chemicals. 

III. Discussion of Comments 

In the Advance Notice, DHS sought 

comment on proposed text for the 

interim final rule as well as on various 

implementation and policy issues 

concerning the chemical security 

program. DHS received a total of 106 

public comments totaling more than 

1,300 pages, including comments from 

thirty-two trade associations, thirty 

companies, thirteen private citizens, ten 

state agencies and associations, seven 

advocacy and safety groups, eight U.S. 

Representatives, five U.S. Senators, four 

unions, one Local Emergency Planning 

Committee, one professional 

association, one international standards 

committee, and the U.S. Small Business 

Administration. 

Commenters generally applauded this 

effort from the Department and 

commended the general approach that 

the Department is taking. However, 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17697 

commenters also raised some specific 

concerns. In the sections below, DHS 

provides a topical summary of the 

comments and responses to those 

comments. 

A. Applicability of the Rule 

1. Definition of ‘‘Chemical Facility or 

Facility’’

The Advance Notice defined 

‘‘Chemical Facility or facility’’ to mean 

‘‘any facility that possesses or plans to 

possess, at any relevant point in time, a 

quantity of a chemical substance 

determined by the Secretary to be 

potentially dangerous or that meets 

other risk-related criterion identified by 

the Department. * * *’’ See proposed 

§ 27.100. 

Comment: While a few industry and 

State agency commenters supported this 

definition, commenters generally 

thought that the proposed definition 

was broad. In particular, several 

industry commenters, an industry 

association, a labor union, and a State 

agency thought the proposed definition 

was overly broad and consequently did 

not inform facilities about whether they 

would be regulated. They noted that the 

definition did not name the regulated 

chemical substances or the threshold 

quantities. One commenter argued that 

DHS’s failure to release to the public its 

proposed list of ‘‘potentially dangerous 

chemicals’’ and threshold amounts for 

those chemicals denies the public the 

opportunity to comment on key 

provisions of the rule that depend on 

whether the facility possess specified 

quantities of chemicals determined by 

DHS to be potentially dangerous. The 

commenter explained that it is difficult 

to comment on that aspect of the rule 

without knowing what the chemicals 

and thresholds are. An industry group 

cautioned that threshold quantities 

should be set high enough that retail 

establishments are not covered merely 

because they stock commercially 

acceptable quantities of commonly used 

chemicals. A few industry commenters 

and a member of Congress added that 

the definition of chemical facility 

should include the concepts of national 

security and economic criticality. 

Several industry commenters 

supported the use of EPA’s Risk 

Management Plan (RMP) program to 

help identify the initial group of 

regulated facilities. Commenters 

supported use of the RMP list of toxic 

substances as a basis for selecting 

chemical facilities. Likewise, one 

association felt that DHS should link its 

definition of chemical facility to those 

facilities covered by EPA’s RMP, 

because it is a clear and defined list. 

The industry commenters noted, 

however, that not all RMP facilities 

should be considered high-risk. One 

commenter pointed out that RMP does 

not take into account facilities that may 

cause substantial impacts from multiple 

tanks. A few commenters also 

recommended that DHS should consider 

facilities in EPA’s Toxic Release 

Inventory program or facilities that 

handle DOT hazardous materials. 

One commenter emphasized that the 

rule could focus on toxic gases at RMP 

threshold quantities, but warned that 

the RMP program has a different 

purpose. The commenter indicated that 

worst-case scenarios under RMP may be 

based on unrealistic assumptions. 

Another commenter indicated that DHS 

should consider certain substances from 

the Chemical Weapons Convention list 

when assessing overall risk. Finally, 

some industry commenters objected to 

the phrase ‘‘possesses or plans to 

possess,’’ because the term implies legal 

title or ownership rather than simple 

presence at the facility. 

Response: Aside from the minor 

modification noted above, DHS is 

retaining the definition of chemical 

facility that it proposed in the Advance 

Notice. And while DHS is not defining 

‘‘chemical facility’’ by listing specific 

chemicals, DHS is making available, 

with the issuance of this rule, a list of 

those chemicals and Screening 

Threshold Quantities (STQs) that it 

proposes to use to determine whether to 

further assess whether a chemical 

facility presents a high risk. 

Specifically, if a facility possesses any 

of the chemicals, at the corresponding 

quantities, in Appendix A (when 

finalized), the facility must complete 

and submit a Top-Screen within 60 

calendar days. See § 27.200(b)(2) and 

§ 27.210(a). The Department will 

continue to contact facilities 

individually and through additional 

Federal Register notices, as necessary. 

See § 27.200(b)(1). To the extent the 

Department notifies facilities through an 

additional Federal Register notice, the 

Department will engage in outreach 

activities with the chemical sector. 

Finally, in response to specific 

comments above, the Department makes 

two additional points. The Department 

has retained the phrase ‘‘possesses or 

plans to possess.’’ DHS believes that 

phrase adequately captures the 

Department’s intent. The plain meaning 

of those terms is not limited to 

ownership. Also, with respect to the 

commenter who cautioned that any 

types of threshold quantities should be 

high enough so that DHS does not cover 

all retail establishments that stock 

commercially acceptable quantities of 

commonly used chemicals, DHS notes 

that it is aware of that issue. While DHS 

believes these STQs are set at levels that 

normally will not cover such retail 

establishments, DHS believes that, if a 

retail establishment does exceed any of 

these STQs, the retail establishment will 

have to complete the Top-Screen. 

2. Multiple Owners and Operators 

The second half of the definition of 

‘‘Chemical Facility or facility’’ provides 

that the terms ‘‘shall also refer to the 

owner or operator of the chemical 

facility. Where multiple owners and/or 

operators function within a common 

infrastructure or within a single fenced 

area, the Assistant Secretary may 

determine that such owners and 

operators constitute multiple chemical 

facilities depending on the 

circumstances.’’ See § 27.105. 

Comment: Comments were varied on 

the issue of multiple owners and 

operators. One industry commenter 

suggested that DHS should combine 

adjacent facilities under common 

ownership into a single facility, and 

other industry commenters thought that 

DHS should define certain adjacent 

facilities as less than the entire property. 

One industry commenter thought that 

DHS should allow facilities with 

multiple owners or operators to agree 

among themselves how to meet the 

requirements of this rule. A trade 

association noted that some large 

chemical facilities have third-party 

warehouses and leasing agreements and 

that the owners of the chemical facility 

should be responsible for security. 

Response: DHS believes that it will 

generally be fairly straightforward for 

facilities to define their boundaries and 

identify the party (at their facility) that 

is responsible for compliance with the 

regulation. However, DHS 

acknowledges that, in some 

circumstances, the issue might be more 

complex. The Department will address 

these situations on a case-by-case basis. 

Both owners and operators of facilities, 

however, bear responsibility under the 

regulations for implementing measures 

that meet the regulatory standards. 

3. Classifying Facilities Based on Hazard 

Class 

Comment: In the preamble to the 

Advance Notice, DHS requested 

comment on whether it should use an 

approach based on hazard class, rather 

than use an approach where 

classifications are based on particular 

chemicals. Responses were mixed. 

Several commenters favored the 

hazard class approach, noting that 

facilities are familiar with the DOT 

hazard classes, that the hazard classes 


rwilkins on PROD1PC63 with RULES_2
17698 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

may be harmonized with international 

requirements, and that the number of 

chemicals (in a non-hazard class 

approach) might otherwise be very 

large. Some of the commenters who 

favored the hazard class approach also 

noted some caveats to its use. Industry 

commenters and a State agency warned 

that the hazard class approach could 

result in the inclusion of chemicals that 

do not pose a security risk. Conversely, 

others noted that the hazard classes may 

not include chemicals of concern from 

a terrorism perspective. Commenters 

noted that other agencies may regulate 

the hazard classes under other 

programs. Also, one State agency 

association pointed out that a 

combination of chemicals might be 

more dangerous than any one chemical. 

One firm suggested that the DHS 

approach should include both the 

hazard class approach and the 

classification of chemicals approach. 

A few industry commenters indicated 

that basing the applicability of the rule 

on hazard classes would be 

inappropriate and that they favored a 

list of security-sensitive chemicals with 

threshold quantities. One trade 

association supported the use of lists of 

particular chemicals, explaining that 

they thought it would lead to more 

accurate assessments of likelihood and 

consequence and therefore risk. They 

also argued that DHS publish the list in 

the final rule. 

Response: As explained above, DHS is 

publishing a list of ‘‘Chemicals of 

Interest’’ in Appendix A to this interim 

final rule. The list contains specific 

chemicals and STQs. That list is a 

baseline screening threshold against 

which facilities will know whether they 

need to complete and submit a TopScreen. While DHS’s primary approach 

will be through the classification of 

chemicals, DHS will not preclude the 

use of the hazard classes for certain 

purposes in the performance standard 

guidelines. 

4. Applicability to Specific Chemicals or 

Quantities of Chemicals 

Comment: Several commenters 

discussed specific chemicals and 

whether or not the regulation should 

cover facilities that possess those 

chemicals. Several commenters thought 

that DHS should not cover anhydrous 

ammonia or ammonium nitrate, both of 

which are discussed in more depth 

below. A local government agency urged 

DHS to cover facilities that store 

propane, while other commenters 

indicated that DHS should not cover 

flammable fuels such as propane. A few 

commenters noted that some facilities 

may have only small amounts of 

chemicals or may handle them only 

intermittently. A trade association 

suggested that DHS should allow such 

facilities to adjust their level of security 

to the level of risk. Another commenter 

urged DHS to consider the nature of 

batch production facilities, which make 

a continually changing mix of products 

using a continually changing, and often 

unpredictable, mix of ingredients. 

With respect to anhydrous ammonia, 

commenters noted that the chemical is 

in the EPA RMP list but indicated that 

it should not be a chemical that DHS 

regulates. They explained that ammonia 

refrigeration is used for dairy and food 

processing facilities and that those 

facilities do not pose a significant risk 

to human health, national security, or 

the economy, because an attack on such 

a facility would not result in a 

catastrophic release of ammonia. In 

addition, the commenters stated that the 

food industry (which uses anhydrous 

ammonia for refrigeration) should not 

have to spend its resources enhancing 

security for refrigeration systems. 

With respect to ammonium nitrate 

(AN), some industry commenters noted 

that AN is an important part of the 

economy in both the explosives and the 

fertilizer industries. They noted that the 

threat posed by AN is not that of a direct 

attack but of theft or diversion for later 

criminal misuse. While they said that 

DHS should focus not only on the 

possibility of a direct attack at facilities 

with ‘‘weaponizable’’ chemicals, but on 

facilities with risks of theft or diversion, 

they suggested that DHS place those 

facilities (i.e., those with risk of theft or 

diversion) in lower-risk tiers. 

One commenter recommended 

requirements for chain-of-custody 

control and suggested that the ATF 

could assist in enforcement at AN sites 

with commercial explosives; other 

commenters favored regulation by DHS, 

not ATF. Another commenter believed 

that DHS should work with the U.S. 

Department of Agriculture and producer 

groups in deciding whether to regulate 

an agriculture operator or supplier. An 

industry commenter noted that the mere 

presence of AN at a site should not 

trigger application of DHS’s screening 

process. Two members of Congress 

argued that the rule should apply to AN 

manufacturing facilities, but they agreed 

with DHS and other commenters that 

DHS should subject AN facilities to 

regulatory requirements based on the 

nature of the facility and risk 

assessment results. The commenters 

thought that by including AN facilities 

in the regulatory program, DHS would 

make it more difficult for terrorists to 

acquire this product. 

Response: The Department’s 

regulatory scheme will cover chemical 

facilities that present a high risk because 

they possess or plan to possess 

chemicals that terrorists may use or 

target in the furtherance of acts of 

terrorism. Facilities that possess 

chemicals that are hazardous and can be 

used as weapons, such as anhydrous 

ammonia or ammonium nitrate, will be 

regulated if they present a high risk. 

However, a facility that possesses a 

chemical substance that does not cause 

it to present a high risk (taking into 

account all relevant factors), or 

possesses an otherwise hazardous 

chemical in an amount that is below 

what would cause the facility to present 

a high risk (again, taking into 

consideration all relevant factors), will 

not be regulated. 

Accordingly, with this interim final 

rule, DHS plans to regulate high-risk 

facilities with ammonium nitrate and 

anhydrous ammonia using the same 

risk-based approach under which it 

plans to regulate all other high-risk 

facilities. If DHS later decides that any 

individual chemicals warrant 

specialized attention in regulatory 

provisions, DHS will address such 

chemicals through future rulemakings. 

5. Applicability to Types of Facilities 

Comment: A few commenters 

suggested that the rule should not apply 

to railroad facilities, because such 

facilities are covered by current and 

proposed requirements from the 

Department of Transportation’s (DOT) 

Federal Railroad Administration and 

Pipeline and Hazardous Materials Safety 

Administration and DHS’s 

Transportation Security Administration 

(TSA). Those commenters asserted that 

railroads should be treated separately 

from fixed facilities and that the 

proposed requirements are 

inappropriate for railroad facilities. One 

commenter requested exemptions for 

motor vehicles and rail cars that are ‘‘in 

transit.’’ Another commenter asked DHS 

to take a system-wide approach and 

recognize the interdependence of 

chemical facility and rail security. 

Response: Regulating chemicals in the 

railroad system is a complex issue, and 

DHS continues to evaluate it. TSA is the 

lead component within DHS for the 

security of transportation facilities and 

has initiated some recent efforts to 

address rail security, including 

Voluntary Agreements with the rail 

industry and a Notice of Proposed 

Rulemaking on Rail Transportation 

Security. See 71 FR 76852 (December 

21, 2006). With respect to chemical 

security, certain aspects of Section 550 

and TSA’s authorities are concurrent 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17699 

and overlapping. DHS is working, and 

will continue to work, with its 

components, including TSA, to 

determine whether DHS will include 

railroad facilities in its chemical 

security program. DHS presently does 

not plan to screen railroad facilities for 

inclusion in the Section 550 regulatory 

program, and therefore DHS will not 

request that railroads complete the TopScreen risk assessment methodology. 

DHS may in the future, however, reevaluate the coverage of railroads, and 

would issue a rulemaking to consider 

the matter. 

Comment: Commenters asked about 

the applicability of the rule to natural 

gas pipelines and facilities, with some 

noting that DHS should not regulate 

pipelines because DOT/PHMSA and 

DHS/TSA already regulate safety and 

security of pipelines. Other commenters 

asked about DHS’s plans to address 

other large facilities, such as mines. One 

engineer pointed out that mining 

facilities can be very large and can cover 

thousands or tens of thousands acres but 

that the security-sensitive portions of 

those mines may be very small (e.g., a 

single tank). 

Response: Whether a facility is 

covered under this regulation is driven 

by a number of factors, including the 

specific types and quantities of 

chemicals at a given facility. Whether 

the Department will apply the 

requirements of this regulation to a 

facility depends, in part, on the 

chemicals present at that facility. In the 

case of natural gas pipelines, DHS has 

no intention at this time of requiring 

long-haul pipelines to complete the 

Top-Screen (or prepare Security 

Vulnerability Assessments and develop 

Site Security Plans). But chemical 

facilities otherwise covered by this 

regulation and with pipelines within 

their boundaries must treat those 

pipelines like any other asset, i.e., 

include measures in their Site Security 

Plan addressing the security of those 

pipelines. 

Related to this, DHS makes a 

clarifying point about facility assets in 

general. DHS expects that facilities will 

address all facility assets in their 

Security Vulnerability Assessments and 

Site Security Plans, as any given facility 

asset has the potential to have an effect 

on the consequence and/or 

vulnerabilities of the facility. Facility 

assets include any items or structures 

(such as buildings, vehicles, 

laboratories, or test facilities) located on 

an area owned, operated, or used by the 

facility. Such assets may exist inside or 

outside of perimeter structures. 

Similarly, the extent of coverage of 

mines in this regulation will depend in 

part on the type and amount of 

chemicals present at any given mine 

facility. The Department expects that 

mines will comply with the 

requirements of § 27.200(b) and 

complete and submit the Top-Screen as 

required in that section. With respect to 

large mines that may only possess a 

concentrated amount of a given 

chemical in one discrete location, if the 

given chemical (and quantity) is one 

that the Department believes presents a 

security risk, the Department will 

expect that the facility will go through 

the screening process. While the facility 

may have to develop a Site Security 

Plan, the SSP would be tailored to the 

specific circumstances at the mine. The 

SSP for a large mine with a concentrated 

amount of one chemical in one location 

would surely look dramatically different 

than that of mine company with 

different circumstances (e.g., a large 

mine with larger quantities of different 

types of chemicals spread throughout 

the mine or a smaller mine with 

moderate quantities of very hazardous 

chemicals in several different locations). 

6. Statutory Exemptions 

Comment: Some commenters asked 

why § 27.105(b) excluded certain 

facilities from the rule, and another 

commenter suggested that the exempted 

facilities should be reviewed to 

determine if they would be considered 

high-risk but for the exemption. 

Other commenters suggested 

additional exemptions. One commenter 

suggested that the rule should not apply 

to most facilities that manufacture, sell, 

or reclaim lead-acid batteries, and 

another commenter believed DHS 

should exclude pesticide facilities. Yet 

another commenter thought that most 

facilities storing petroleum products, 

some of which are exempted under 

proposed § 27.105(b), are not high-risk 

facilities. 

Response: In the authorizing 

legislation for this regulation, Congress 

exempted various facilities from this 

rule. See Section 550(a). DHS has 

included those exemptions in 

§ 27.110(b) of the rule. The statute 

provides for the following exemptions: 

facilities regulated pursuant to the 

Maritime Transportation Security Act of 

2002, Public Law 107–295, as amended; 

public water systems (as defined by 

Section 1401 of the Safe Drinking Water 

Act); water treatment works facilities (as 

defined by Section 212 of the Federal 

Water Pollution Control Act); any 

facilities owned or operated by the 

Departments of Defense and Energy; and 

any facilities subject to regulation by the 

Nuclear Regulatory Commission. The 

Department has considered the 

exemptions requested by commenters, 

and, at this time, the Department does 

not intend to provide any additional 

regulatory text exemptions. 

Comment: Some industry commenters 

supported the exemptions in § 27.110, 

such as the exemption for facilities 

regulated under the Maritime 

Transportation Security Act (MTSA). In 

addition, one association wanted to 

exclude from the Top-Screen 

requirements any facilities covered 

under MTSA. Other commenters asked 

for clarifying information about the 

exemptions. 

Response: In the Advance Notice, the 

Department discussed the applicability 

of this rule to maritime facilities. See 71 

FR 78276, 78290. In this interim final 

rule, the Department clarifies that it will 

apply the statutory exemption only to 

facilities regulated under 33 CFR part 

105, Maritime Facility Security 

regulations. Part 105 of Title 33 of the 

Code of Federal Regulations is the only 

regulation that imposes the security 

plan requirements of 46 U.S.C. 70103 on 

maritime facilities. 

Comment: A State agency believed 

that the Nuclear Regulatory Commission 

(NRC) exemption should apply only to 

facilities holding an NRC power reactor 

license and disagreed with the 

exemptions for public water systems 

and treatment works. 

Response: The Department agrees 

with the commenter and will apply the 

statutory exemption to facilities where 

NRC already imposes significant 

security requirements and regulates the 

safety and security of most of the 

facility, not just a few radioactive 

sources. For example, a power reactor 

holding a license under 10 CFR part 50, 

a special nuclear material fuel cycle 

holding a license under 10 CFR part 70, 

and facilities licensed under 10 CFR 

parts 30 and 40 that have received 

security orders requiring increased 

protection, will all be exempt from 6 

CFR part 27. A facility that only 

possesses small radioactive sources for 

chemical process control equipment, 

gauges, and dials, will not be exempt. 

B. Determining Which Facilities Present 

a High-Level of Security Risk 

1. Use of the Top-Screen Approach 

Comment: In general, many industry 

associations and chemical companies 

supported the use of a tiered approach 

that narrows DHS’s focus to high-risk 

facilities. Several commenters pointed 

out as a problem the fact that they had 

been unable to review the details of the 

approach and associated criteria; several 

commenters suggested that 

knowledgeable parties should have an 


rwilkins on PROD1PC63 with RULES_2
17700 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

opportunity to review the details. Many 

of the commenters wanted to make sure 

that the final group of high-risk facilities 

was determined based on risk (not just 

on potential consequence or limited 

pieces of threat data) and that the 

number of facilities in this group was 

small. 

Associations differed in their views 

on how inclusive the Top-Screen 

process should be—one association 

wanted DHS to screen out certain lowrisk facilities in the first few questions 

while other associations and a chemical 

company wanted DHS to make sure that 

as many facilities as possible submitted 

Top-Screen data, including some 

facilities that might not traditionally be 

considered chemical facilities. Several 

associations urged DHS not to 

presumptively classify facilities as highrisk without perfect information; they 

felt that doing so would go beyond the 

authority that Congress granted DHS 

and would not match the intended focus 

on high-risk facilities. A local agency 

took the opposite view on that question. 

Several commenters provided input 

on the data that facilities will need to 

enter into the Top-Screen. One 

association suggested that DHS allow 

facilities to enter chemical volumes in 

ranges and asked that DHS provide 

guidance on handling mixtures and 

blends. That association also questioned 

how facilities should address chemicals 

that are stored offsite. Another 

association encouraged DHS to include 

reactive chemicals and propane in the 

Top-Screen. One advocacy group 

encouraged DHS to incorporate 

chemical transportation in the rule and 

the Top-Screen. 

Commenters also provided input on 

how DHS should process the 

information that it receives through the 

Top-Screen. One industry association 

suggested that facilities should be 

allowed to explain ‘‘yes’’ responses 

before DHS drives the facility to a full 

Security Vulnerability Assessment. The 

association suggested that facilities 

should not be the ones to estimate 

consequences, particularly injuries, and 

that DHS should refine the definition of 

injuries. The association stated that DHS 

should have different requirements for 

facilities that only periodically have 

certain materials onsite. One association 

cautioned about using RMP data and 

advocated for DHS to use conversion 

factors to make estimates of casualties. 

Several commenters were concerned 

about the questions in the Top-Screen 

that related to economic impacts. 

Several associations indicated that DHS 

should use a sufficiently high threshold 

for economic impacts that captures the 

full extent of economic impacts. They 

noted that a facility should consider all 

impacts, not just the impacts to one 

facility. One association commented 

that most facilities will not be able to 

provide answers to the questions in the 

Top-Screen that ask about a facility’s 

market share for given chemicals. That 

association suggested that DHS rephrase those questions to support yes/ 

no answers or to allow facilities to use 

broad ranges. 

Several associations commented that 

the submitting company, not DHS, 

should determine the most appropriate 

person to submit data. A number of 

parties commented on DHS’s 

subsequent use of the data that is 

collected through the Top-Screen. One 

association commented that any 

information must have demonstrated 

utility before it is shared with anyone. 

As for timing, commenters, including 

State agencies, requested that DHS 

provide facilities with the specific 

timing requirements for completing the 

Top-Screen. One industry association 

recommended that DHS use phased-in 

timing for having facilities complete the 

Top-Screen. A number of commenters 

from State agencies and industry 

associations suggested the need for DHS 

to provide active, written notification 

that a facility is not high risk—and for 

telling facilities that they need to 

comply with the regulation. One 

association suggested that DHS provide 

this notification immediately upon the 

facility’s submission of data. 

Finally, a number of company and 

industry association commenters 

wanted to make sure that facilities have 

the opportunity to conduct independent 

evaluations (or meet with DHS) to verify 

or deny DHS’s initial classification of a 

facility’s risk. 

Response: In this regulatory program, 

DHS will employ a modified version of 

the Risk Analysis and Management for 

Critical Asset Protection (RAMCAP) risk 

assessment methodology known as the 

Chemical Security Assessment Tool, or 

CSAT. The RAMCAP Sector Specific 

Guidance was developed under contract 

to DHS by the ASME Innovative 

Technologies Institute (ASME–ITI) and 

leveraged the knowledge and insight of 

leading experts from across the industry 

and Federal Government. The DHS Risk 

Assessment Methodology is composed 

of two separate parts. The first part is a 

screening tool known as the Top-Screen, 

which is used to perform a preliminary 

‘‘consequence’’ analysis. The second 

part provides the tools to conduct a 

thorough facility Security Vulnerability 

Assessment. 

DHS is using a standard vulnerability 

tool, the CSAT system, because it is not 

practical for DHS to accept a broad 

spectrum of methodologies. Even where 

certain ‘‘equivalencies’’ exist between 

methodologies, the equivalencies can 

only be extracted and employed in a 

comparative risk analysis at very great 

cost and over a very long period of time. 

In order to effectively manage risk at the 

national level, the Department must be 

able to develop and understand the 

relative risk of different facilities. A 

comparative risk capability is essential 

to regulation and can be achieved only 

through the collection of comparative 

data. Thus, a standard vulnerability tool 

is necessary. 

The Department has vetted the CSAT 

system with the engineering profession, 

the National Laboratories, and 

academia. The Top-Screen component, 

as well as the individual algorithms 

employed in the Top-Screen, have been 

subject to extensive peer review and 

have been found acceptable. While the 

Top-Screen is consequence-specific, 

DHS uses the Top-Screen only to 

determine a preliminary tier ranking. 

DHS bases a facility’s final tier ranking 

upon the complete Security 

Vulnerability Assessment, as well as the 

application of threat information—and 

thus it is risk-based. 

Insofar as the range of facilities 

possessing dangerous or potentially 

dangerous chemicals is large, there is no 

good alternative to a fairly broad range 

of facilities being included in the 

screening process. DHS anticipates that 

the vast majority of screened facilities 

will be found not to have a level of 

potential consequences that would 

result in a ‘‘high risk’’ designation. 

However, the facilities that do achieve 

that level of consequence are expected 

to come from a fairly broad swath of the 

Nation’s economy. DHS has no 

intention of classifying facilities as 

presumptively high risk until and 

unless DHS is unable to acquire 

sufficient data. 

The Top-Screen will enable DHS to 

determine a preliminary tier based on 

consequence. That ranking will 

determine the need for (and timeline 

for) a Security Vulnerability 

Assessment, and where the Top-Screen 

indicates the need for a follow-on 

Security Vulnerability Assessment, DHS 

will expect that the owner-operator will 

comply. The Department will require 

facilities to submit the Top-Screen 

within the timeframes now specified in 

§ 27.210. The Department notes that the 

Top-Screen is designed to preclude a 

large number of ‘‘false negatives.’’

DHS is establishing the entire CSAT 

system as an on-line suite of tools, 

which will allow notification of results 

to the owner or operator. As provided in 

§ 27.205, the Department ‘‘shall notify 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17701 

the facility in writing [of a 

determination that the facility presents 

a high level of security risk].’’ While the 

online feature of the CSAT system will 

allow rapid results, it will not allow the 

Department to respond instantaneously, 

as some commenters requested. Finally, 

the Top-Screen tool does require the 

owner-operator to provide certain data 

similar to an RMP analysis; however, 

casualty estimates and consequence 

ranking are performed by DHS using 

well-vetted formulae. 

Regarding economic criticality, DHS 

recognizes the complexity of estimating 

potential economic or mission impact 

stemming from the loss of certain 

manufacturing (or other) capacity. 

Accordingly, DHS will focus early 

efforts on developing a sufficiently clear 

picture of the chemical industry as a 

system in order to allow a reasonable 

analysis of economic and mission 

criticality, which will be enhanced as 

the Department moves forward. 

2. Assessment Methodologies 

Comment: Many commenters 

provided input on methodologies that 

DHS should use for determining which 

facilities present a high level of risk, and 

several commenters had suggestions as 

to how DHS should determine which 

facilities are high-risk. One association 

asserted that DHS needed to clearly 

define the ‘‘risk of interest’’ before DHS 

could determine which methodology to 

use. One (non-chemical) company 

suggested that DHS use other Federal 

programs such as the EPA’s Toxics 

Release Inventory or the Superfund 

Amendments and Reauthorization Act 

(SARA) Tier II annual reports to 

determine high risk facilities. 

Commenters addressed the suitability of 

both asset- and scenario-based 

approaches, with the majority favoring 

an asset-based approach. Commenters 

suggested that DHS consider specific 

methodologies developed by 

associations, national laboratories, or 

State and Federal agencies. One 

association suggested that DHS use 

other methodologies while RAMCAP 

continues to develop and mature. State 

agency commenters warned that the 

question of which facilities pose a high 

risk is a community-specific issue. 

Many comments were very specific as 

to how DHS should proceed, and what 

tools DHS should employ. For example, 

an engineering firm focused on the need 

for process-based assessments. A 

chemical company noted the need for 

any approved methodology to also 

consider the criticality of surrounding 

and supporting infrastructure in a 

reasonable manner—that is, one that is 

within the expertise of the facility 

personnel. 

Many commenters also focused on 

various aspects related to RAMCAP. 

One commenter asserted that RAMCAP 

might not adequately identify high-risk 

facilities. Another commenter asked 

who owns RAMCAP. Several 

commenters noted that the RAMCAP 

approach was not designed to address 

control system cyber security. Another 

commenter felt that DHS provided 

inadequate detail on the RAMCAP 

methodology and noted that DHS 

should define the method before DHS 

solicits comment. Several commenters 

also pointed out that RAMCAP’s lack of 

details on vulnerability team 

composition and experience could be a 

limitation. Some of RAMCAP’s 

developers took issue with deviations 

from the original RAMCAP design. 

Another commenter pointed out the 

need for DHS to include proper 

references to the RAMCAP and its 

genesis. 

Also related to RAMCAP, some 

commenters expressed concern with the 

details in Appendix B, ‘‘Background: 

Risk Analysis and Management Critical 

Asset Protection (RAMCAP) 

Vulnerability Assessment 

Methodology.’’ In particular, some 

expressed concern about expectations 

that the noted threat scenarios would be 

analyzed as design basis threats. The 

commenters noted that many of the 

scenarios require military support to 

defeat, and that appears to be beyond 

the capability of a chemical facility to 

address. Associations noted that 

scenarios can be useful in a comparative 

top-screen, but that they should not 

guide all facility-specific assessments. 

One company opined that the threats 

needed to be more realistic before they 

were used in any assessments. 

Finally, one chemical company 

commented that DHS needs to list in the 

rule the specific threats that facilities 

need to address in their SSP. Also, the 

company indicated that DHS, not 

individual companies, should 

determine deaths and injuries. 

Response: In the Advance Notice, 

DHS sought to provide an overview of 

RAMCAP and the DHS Methodology 

Assessment in the preamble (see, e.g., 

pp. 78277–78288) and in Appendix B. 

As there seemed to be confusion about 

the nature and purpose of RAMCAP and 

the DHS Assessment Methodology (or 

CSAT) and its purpose, DHS provides 

further explanation here. 

The CSAT vulnerability assessment 

tool, part of the CSAT system owned by 

DHS, is an asset-based vulnerability 

assessment tool very similar to the 

Chemical Sector RAMCAP module. The 

CSAT system employs a set of defined 

attack vectors, used to both ‘‘produce’’

consequences (for the measurement of 

criticality) and to measure vulnerability. 

These are not ‘‘Design Basis’’ threats 

and in no way reflect the type of actual 

threats against which owner-operators 

will be expected to ‘‘defend.’’ They are 

measurement devices, supporting the 

DHS need to conduct comparative risk 

analysis. The CSAT tool does include 

basic assessments of certain types of 

cyber systems, and certain features 

thereof. However, the CSAT tool is not 

intended to be a full-scope, detailed 

analysis of all possible areas of 

vulnerability. It is a measurement tool 

that will allow general categorization of 

a facility as vulnerable or not, critical or 

not, and thus, at risk or not. DHS will 

undertake detailed evaluations of 

specific security issues as part of the 

ongoing relationship between the 

facility owner-operator and DHS. The 

assessment tool that DHS uses to 

conduct comparative risk assessments 

must be uniform and consistent in order 

for DHS to use it, and so a ‘‘menu’’ of 

different methodologies is simply not 

practical. 

Finally, DHS notes that there were 

several comments from companies, 

encouraging the Department to adopt or 

require their own methodology or 

technique. DHS is unaware of the extent 

of peer review or scientific evaluation of 

these other methodologies or 

techniques. In addition, DHS does not 

believe it is appropriate to identify a 

single commercial product or endorse 

particular commercial products for 

purposes of complying with this rule. 

3. Risk-Based Tiers 

In the Advance Notice, the 

Department asked for comment on the 

notion of risk-based tiering of high-risk 

facilities. Specifically, the Department 

asked how many risk-based tiers should 

the Department create, what the criteria 

should be for differentiating among 

tiers, what the types of risk should be 

most critical in the tiering, how should 

performance standards differ among 

risk-based tiers, what additional levels 

of regulatory scrutiny should DHS apply 

to each tier. 71 FR 78276, 78283. 

Comment: Most commenters 

supported the establishment of risk tiers 

and agreed that three or four tiers would 

be sufficient. Several comments, 

including industry commenters, State 

agencies, and a member of Congress 

believed that DHS should base tiering 

on the attractiveness of the facility as a 

target or the consequences of a terrorist 

attack, such as adverse impacts on 

public health and welfare, the potential 

for mass casualties, and disruption of 


rwilkins on PROD1PC63 with RULES_2
17702 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

essential services. The commenter 

indicated that the creation of tiers 

would allow facilities to maintain 

security measures commensurate with 

risk. 

A few commenters suggested that 

DHS did not provide enough 

information in the Advance Notice on 

the number of tiers or on how a tier 

classification would affect a facility’s 

security requirements. Two industry 

commenters were concerned that DHS 

might apply the rule requirements to 

facilities other than those that pose the 

highest security risk. Two other 

commenters believed that the tiering 

approach is not appropriate for cyber 

security of control systems. One 

commenter argued that tiers should 

include consideration of the 

transportation of chemicals outside the 

facility property. Another commenter 

recommended that DHS should modify 

the tiers after it receives data from 

regulated facilities. Another commenter 

thought that DHS should define 

‘‘present high levels of security risk’’

and ‘‘high risk’’ at the end of the 

RAMCAP process and not at the 

discretion of the Secretary. 

Commenters suggested that tiers 

should be objective and transparent and 

should provide flexibility. One industry 

commenter pointed out that tiering 

allows DHS to focus on the most 

important facilities first and believed 

that DHS should establish a de minimis 

tier that sets thresholds below which a 

facility does not have to complete the 

Top-Screen tool. Two commenters 

noted that tiering provides an incentive 

for facilities to eliminate risk. 

Some industry commenters and State 

and local agencies suggested that 

facilities in higher risk tiers should have 

more contact with DHS, and that lowerrisk facilities should have fewer security 

layers implemented over a longer period 

of time, greater discretion, or fewer 

inspections. One commenter, however, 

believed there should be no difference 

in regulatory scrutiny or performance 

standards between tiers. 

Response: The Department agrees 

with many of the commenters that the 

risk-based tiering structure will allow 

DHS to focus its efforts on the highest 

risk facilities first. To that end, the 

Department intends to retain the model 

proposed in the Advance Notice. See, 

e.g., 71 FR 78276, 78283. In sum, the 

Department’s framework for risk-based 

tiering will consist of four risk-based 

tiers of high-risk facilities, ranging from 

high (Tier 1) to low (Tier 4). The 

Department will use a variety of factors 

in determining which tier facilities will 

be placed, including information about 

the public health and safety risk, 

economic impact, and mission critical 

aspects of the given chemicals and 

Threshold Quantities (TQ) of the 

chemicals. The Department considers 

the methods for determining these tiers 

to be sensitive anti-terrorism 

information that may be protected from 

further disclosure. The types and 

intensity of security measures 

(necessary to satisfy the risk-based 

performance standards in the facility’s 

Site Security Plan) will depend on the 

facility’s tier. The Department will 

mandate the most rigorous levels of 

protection and regulatory scrutiny for 

facilities that present the greatest degree 

of risk. Finally, pursuant to Section 

550(a), it is in the discretion of the 

Secretary to apply regulatory 

requirements to those facilities that 

present high levels of security risk; 

accordingly, the Department believes it 

is most appropriate for the Secretary to 

determine which facilities present highrisk (and not, for example, rely solely on 

output from the CSAT process). 

The Department incorporates the 

concept of ‘‘target attractiveness’’ into 

its risk equation. Insofar as it is a fairly 

subjective element, and that it requires 

considerable analysis to develop, DHS 

will not incorporate it into the initial 

tier assignment process. However, 

insofar as ‘‘target attractiveness’’ is 

included in the more detailed Security 

Vulnerability Assessment component of 

the regulatory process, and insofar as 

the final determination of tier placement 

will be based upon the complete 

analysis of risk, ‘‘target attractiveness’’

will, in fact, be an important element in 

tier assignment and subsequent risk 

management efforts. 

C. Security Vulnerability Assessments 

and Site Security Plans 

1. General Comments 

Comment: One association requested 

that DHS encourage, but not require, 

facilities that are not high-risk to 

conduct vulnerability assessments as a 

best practice. 

Response: The Department has always 

encouraged the chemical sector to 

analyze security vulnerabilities and will 

continue to do so through voluntary 

sector efforts even if the site has not 

been designated as high risk under this 

rule. 

Comment: One commenter requested 

that DHS define ‘‘material 

modifications,’’ as used in 

§§ 27.215(c)(3) and 27.225(b)(3), or at 

least provide examples of circumstances 

or events that rise to the level of 

‘‘material modifications.’’

Response: Material modifications can 

include a whole host of changes, and for 

that reason, the Department cannot 

provide an exhaustive list of material 

modifications. In general, though, DHS 

expects that material modifications 

would likely include changes at a 

facility to chemical holdings (including 

the presence of a new chemical, 

increased amount of an existing 

chemical, or the modified use of a given 

chemical) or to site physical 

configuration, which may (1) 

substantially increase the level of 

consequence should a terrorist attack or 

incident occur; (2) substantially increase 

a facility’s vulnerabilities from those 

identified in the facility’s Security 

Vulnerability Assessment; (3) 

substantially effect the information 

already provided in the facility’s TopScreen submission; or (4) substantially 

effect the measures contained in the 

facility’s Site Security Plan. 

2. Submitting a Site Security Plan 

Comment: Several industry 

commenters recommended changes to 

the proposed process for notifying 

facilities to submit SSPs and the timing 

for submitting the SSPs. A number of 

commenters believed that the most 

appropriate person to submit an SSP is 

a corporate representative with firsthand knowledge of security matters at 

the facility, rather than an officer of the 

corporation, as proposed. The 

comments recommended allowing a 

corporate security contact, a security 

manager, or a consultant with delegated 

authority to submit information on 

behalf of the corporation. The 

commenters indicated that, in most 

instances, members of senior 

management teams do not have day-today detailed knowledge on security 

issues and, thus, cannot meet the 

proposed qualifications. One of the 

commenters added that the proposed 

regulations appear to limit an 

organization’s flexibility to assign 

internal responsibilities for various 

aspects of the regulations. Another 

commenter suggested that, in addition 

to notifying a covered facility, the 

Department should notify the facility’s 

corporate ownership (and/or parent 

corporation) allowing a multi-facility 

corporation to prepare and submit a 

response in an efficient and timely 

manner. 

Response: The goal of this rule is to 

increase flexibility while embracing 

security for covered facilities, not to 

unnecessarily decrease flexibility. The 

rule obligates the chemical facility to 

submit the Site Security Plan; however, 

as used herein, the term chemical 

facility or facility shall also refer to the 

owner or operator of the chemical 

facility. While the owner or operator of 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17703 

a chemical facility may designate 

someone to submit the Site Security 

Plan, the owner or operator is 

responsible for satisfying all the 

requirements under this part. Note that 

the Department has added requirements 

for submitters in the rule (see 

§ 27.200(b)(3)) and that the Department 

discusses those new requirements in the 

Rule Provisions discussion of § 27.200. 

See § II(B). Finally, it is presumed that 

the covered facility is the most 

appropriate party to notify its parent 

corporation or other related corporate 

entities as necessary. 

3. Content of Site Security Plans 

Comment: One commenter stated that, 

until some of the initial regulatory 

elements regarding definition of risk 

and the establishment of tiers is in 

place, it would be premature for DHS to 

publish details on Site Security Plans. 

Another commenter stated that, based 

on the consequence assessment, every 

site should be required to have specific 

security elements in place that 

prudently deter, detect, delay, and 

respond based on their assigned tier 

level. The commenter also stated that, 

without some degree of access control 

and physical security specificity based 

on tier levels, there will be considerable 

confusion as to the exact considerations 

needed to meet Department 

requirements. Another commenter 

encouraged DHS to abide by the 

congressional mandate of Public Law 

104–113, as described in OMB Circular 

A119, and ensure that voluntary 

consensus codes and standards are used 

when they are applicable under the rule. 

Response: The Department has 

developed a means of assessing risk and 

a tiering process as described in 

§§ 27.205 and 27.220. These methods 

anticipate, on a risk basis, a certain level 

of vulnerability for a given tier level. A 

facility’s SSP will describe the 

appropriate levels of security measures 

that a facility must implement to 

address the vulnerabilities identified in 

their SVA and the risk-based 

performance standards for their tier. The 

Department has included risk-based 

performance standards in this interim 

final rule and will publish further 

guidance on the risk-based performance 

standards. The risk-based standards 

address, among other things, 

vulnerabilities under the security 

concepts of detection, deterrence, delay, 

and response. Finally, the Department 

notes that covered facilities may use and 

cite voluntary consensus codes and 

standards in their SVAs and SSPs to the 

extent they are appropriate. 

4. Approval of Site Security Plans 

Comment: In general, commenters 

supported the proposed submission and 

approval processes for SSPs. While one 

commenter endorsed proposed 

§ 27.240(a)(3) stating that the 

Department will not disapprove an SSP 

based on the presence or absence of a 

particular security measure, another 

commenter believed that the 

Department should have the authority to 

disapprove an SSP if a facility has 

refused to include a widely-practiced 

and cost-efficient procedure that can 

severely reduce the risk posed by a 

chemical facility. Two commenters 

requested that the Department inform 

local law enforcement and first 

responders when the Department is 

reviewing an SSP in their community 

and then inform them whether that plan 

was accepted or rejected. The 

commenters stated that the health and 

safety of responders may well depend 

upon whether the chemical facility has 

an adequate SSP. 

Response: The Department may not 

disapprove a Site Security Plan 

submitted under this Part based on the 

presence or absence of a particular 

security measure, as provided in Section 

550 of the Homeland Security 

Appropriations Act of 2007. The 

Department may disapprove a Site 

Security Plan that fails to satisfy the 

risk-based performance standards 

established in § 27.230. 

The Department intends to work 

closely with local law enforcement and 

first responders to provide adequate 

homeland security information to them 

under this rule. 

Comment: One commenter 

recommended that the Department first 

complete the SSP review and approval 

process for Tier 1 facilities, then, after 

soliciting feedback from the Tier 1 

facilities on the process, then proceed in 

a step-wise fashion to subsequent tiers. 

Response: The Department will 

implement the rule in a phased 

approach but will not necessarily 

complete all Tier 1 sites prior to 

undertaking plan review and approvals 

with lower-tier chemical facilities as the 

need arises. This is necessary to make 

sufficient progress with higher-tier 

chemical facilities and not only the 

highest tier. 

5. Timing 

Comment: One concern raised by an 

industry association related to DHS’s 

resources for reviewing Security 

Vulnerability Assessments and 

providing responses in 20 days. Changes 

to control systems were suggested for 

reviews and updates within 7 days or 

sooner. One commenter agreed with 

updating SSPs annually, but not 

Security Vulnerability Assessments. 

Several commenters suggested the 

following for updates: every 2–5 years 

for Tier 1 facilities, 3–5 years for Tier 2, 

and 3–7 years for Tier 3 and beyond. 

Numerous reviewers recommended 

that the reviews be limited to 

approximately every three years. Two 

companies and one industry association 

wanted reviews to follow major changes 

and not follow a set schedule. Many 

reviewers wanted periodic replaced 

with a suggested frequency. 

Several commenters stated that the 

requirement to submit SVAs within 60 

calendar days, and SSPs within 120 

calendar days, starting on the date that 

the facility is notified that it is 

considered high-risk, is too short, and 

therefore inadequate. One commenter 

noted that managing change in a safe 

fashion requires significant thought and 

careful planning to ensure that the 

change itself does not create another 

hazard to the community, the 

environment, or employees. The 

commenter also noted that developing 

and implementing an SSP that properly 

mitigates risk requires the security 

manager to make appropriate revisions 

to existing facility procedures and to 

train employees and other affected 

parties on these new procedures. 

Another commenter expressed concern 

that there is no specific date or time by 

which DHS must notify high-risk 

chemical facilities of their status. 

Likewise, there is no firm time by which 

the Secretary will send out a notice 

approving or disapproving an SSP. 

With regard to the time needed to 

review an SSP, one commenter stated 

that DHS should issue a decision 

approving or disapproving them within 

30 days of receipt of a completed plan. 

This timeframe would bring at least 

most priority facilities into compliance 

within seven months of the effective 

date. The commenter also stated that, 

given the urgency, any ‘‘objections’’ or 

‘‘appeals’’ should be processed after the 

seven-month schedule is completed. 

Because of concern that DHS staffing 

levels might delay the processing of 

SSPs, another commenter requested a 

provision be included in the interim 

final rule indicating that facilities are 

deemed in compliance after 30 days of 

submission of SVAs and SSPs until 

such time that the Department reviews 

and responds to the submission. 

A few commenters recommended that 

the deadline for Tier 1 facilities to 

submit SSPs be extended from 120 days 

to 180 days. The commenters believe 

that this extension would assure 

facilities adequate time to assemble the 


rwilkins on PROD1PC63 with RULES_2
17704 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

best teams, prepare thorough SVAs, deal 

with budget planning for potentially 

large capital expenditures, and ensure 

the on-site work is properly conducted. 

Another commenter agreed that the 

proposed submission schedule for 

submitting SSPs was unrealistic in light 

of the tasks involved. The commenter 

also thought that, if DHS found fault 

with a provision of the SVA, it would 

be unreasonable to begin development 

of an SSP based upon a potentially 

flawed assessment. Consequently, the 

commenter argued that the submission 

time of 120 days should be started only 

after the Department’s approval of the 

SVA is formally received. Yet another 

commenter believed that submission of 

SSPs should be timed according to the 

tier assigned to the facility and that the 

time clock should begin when the 

facility receives word back from the 

Department on its preliminary tier 

assignment. 

Response: The Department has 

established a schedule for activities 

under this part that considers the need 

to generally address the risks associated 

with higher tier facilities before that of 

lower tiers, but staggers the submittals 

and review and inspection activities. 

The Department has developed the 

Chemical Security Assessment Tool 

(CSAT) to assist chemical facilities with 

all of the program requirements 

(registration, screening, SVA, and SSP). 

In addition, because information from 

the CSAT applications will be in 

electronic form, DHS will be able to 

expedite its review of the information 

that chemical facilities submit. These 

deadlines are both prudent and 

achievable. DHS expects that it will 

complete its review of the Top-Screen, 

SVA, and SSP within 60 days of the 

facility’s submission of the Top-Screen, 

SVA, or SSP. 

6. Alternate Security Programs 

Comment: The use of alternate 

security programs was supported by 

several chemical companies and 

associations as well as companies and 

associations in related industries. A 

chemical company agreed with the 

concept of initially allowing multiple 

methodologies and then switching to a 

common methodology for at least the 

Tier 1 facilities; they encouraged DHS to 

still allow alternate approaches for other 

tiers. This viewpoint was echoed by at 

least one association. Several companies 

wanted to ensure that existing plans 

could be used and one association noted 

that more methodologies than just those 

approved by the Center for Chemical 

Process Safety (CCPS) would be 

appropriate. Commenters also noted 

that CCPS should not be the sole arbiter 

unless DHS periodically reviews its 

resources and expertise. 

A number of industry associations 

offered their own approaches and a food 

industry association commented on the 

need to keep their current programs in 

place and to not unduly focus on 

ammonia refrigeration risks. MTSA-, 

Sandia-, and NFPA-approved programs 

were among those mentioned by the 

commenters, as were those allowed 

under other regulations. Some 

commenters found the specific process 

for approval of alternative programs to 

be lacking in detail. One association 

requested that submitters just send in a 

form saying they have an alternate 

security plan, and not require any other 

document be submitted for approval. 

An advocacy group commented that 

alternate approaches needed to be 

equivalent to the DHS approach, not just 

sufficiently similar, and that DHS 

should approve equivalent State and 

local programs. Another advocacy group 

suggested that DHS should only 

determine equivalency based on reviews 

of individual SSPs, not in any blanket 

or broad way. A third advocacy group 

supported a single, consistent approach 

set out by DHS with private sector 

programs being modified to conform to 

the DHS approach. One commenter 

noted that the specification of RAMCAP 

may have created an unfair playing field 

for other firms wanting to visit the 

source company for RAMCAP. 

Response: The Assistant Secretary 

will review and may approve an ASP 

upon a determination that it meets the 

requirements of this regulation and 

provides an equivalent level of security 

to the level of security established by 

this part. In its ASP submission, a 

facility will have to provide sufficient 

information about the proposed ASP to 

ensure that the Department can 

adequately perform a review and make 

an equivalency determination. 

As described below, certain facilities 

may submit an ASP in lieu of an SVA, 

an ASP in lieu of a SSP, or both. 

Accordingly, the ASP option will only 

be available following the facility’s 

submission, and Department’s review, 

of the Top-Screen. An ASP for an SVA 

will need to satisfy the requirements 

provided in § 27.215, and an ASP for an 

SSP will need to satisfy the 

requirements provided in § 27.225. The 

ASP for the SSP will need to describe 

specific security measures, or metrics 

for measures, that will allow the ASP to 

be considered equivalent to an 

individually-developed SSP, and 

facilities implementing an ASP will be 

subject to DHS inspection against the 

terms of the ASP. 

At this time, the Department will only 

permit Tier 4 facilities (found to be Tier 

4 facilities following the Department’s 

preliminary tiering decision pursuant to 

§ 27.220(a)) to submit an ASP in lieu of 

an SVA. Tier 4 facilities may submit for 

review and approval the Sandia RAM 

for chemical facilities, the CCPS 

Methodology for fixed chemical 

facilities, or any methodology certified 

by CCPS as equivalent to CCPS and has 

equivalent steps, assumptions, and 

outputs and sufficiently addresses the 

risk-based performance standards and 

CSAT SVA potential terrorist attack 

scenarios. The Department is requiring 

Tier 1, Tier 2, and Tier 3 chemical 

facilities to use the CSAT SVA 

methodology for preliminary and final 

tiering. As discussed above in the 

summary of changes to Rule Provisions, 

this will provide a common platform for 

the analysis of vulnerabilities and will 

ensure that the Department has a 

consistent measure of risk across the 

industry. With respect to SSPs, the 

Department will permit facilities of all 

tiers to submit ASPs to satisfy the 

requirements of this rule. 

The Department modified § 27.235 to 

reflect these requirements. The 

Department also amended the regulation 

to link the review and approval 

procedures for ASPs to the review and 

approval procedures for SVAs and SSPs. 

D. Risk-Based Performance Standards 

In the Advance Notice, DHS sought 

comment on the use of risk-based 

performance standards to address 

facility-identified vulnerabilities. The 

Advance Notice proposed that DHS 

require covered facilities to select, 

develop, and implement security 

measures to satisfy the risk-based 

performance standards in § 27.230. The 

measures sufficient to meet these 

standards would vary depending on the 

covered facility’s risk-based tier. 

Facilities would address the 

performance standards in the facility’s 

Site Security Plan, and DHS would 

verify and validate the facility’s 

implementation of the Site Security 

Plan during an on-site inspection. 

1. General Approach to Performance 

Standards 

Comment: The majority of the 

commenters supported the proposed 

regulatory approach due to the 

flexibility that the risk-based 

performance standards provide to the 

regulated community in choosing 

security measures for their respective 

facilities. The proposed approach 

acknowledges the fact that each of the 

facilities faces different security 

challenges. A few commenters noted 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17705 

that the goal of the performance 

standards should be to reduce 

vulnerabilities identified in the SVA, 

not necessarily reduce all potential 

consequences or mandate the use of 

specific countermeasures. 

By contrast, some other commenters 

opposed the Department’s proposed 

regulatory approach, noting various 

reasons: that the Advance Notice was 

too prescriptive in certain areas; that 

performance standards are open to 

interpretation and thus can become 

discretionary, interpretive, and 

sometimes arbitrary; that chemical 

companies may be allowed under the 

rule to make risk reduction 

determinations based on their available 

risk reduction budget, rather than on the 

actual elimination or reduction of the 

most serious risks; that the rule allows 

enormous flexibility and variability in 

the documents that facilities can submit 

to the Department, which could make 

program review difficult and hinder any 

comparative analysis of risk reduction 

efforts among similar sites. 

Response: The Department’s statutory 

authority mandates the issuance of 

performance standards. Section 550 

requires the Department to issue interim 

final regulations ‘‘establishing riskbased performance standards for 

security chemical facilities.’’ See 

§ 550(a). Also, as noted in the Advance 

Notice, Executive Order 12866 also 

directs federal agencies to use 

performance standards. See 71 FR 

78276, 78283. Performance standards 

avoid prescriptive requirements, and 

although they provide flexibility, they 

still establish and maintain a nonarbitrary threshold standard that 

facilities will have to reach in order to 

gain DHS approval under the regulation. 

The ultimate purpose of the 

performance standards is to reduce 

vulnerabilities, and that is regardless of 

risk reduction budgets. 

With respect to documentation, 

except as provided in § 27.235 for 

Alternative Security Programs, DHS is 

requiring facilities to electronically 

submit all documentation required for 

analysis and approval. Facilities will 

complete the Top-Screen, Security 

Vulnerability Assessment, and Site 

Security Plans through the online, Webbased CSAT system. This electronic 

submission will minimize the 

variability concerns and allow DHS to 

manage and protect information. 

Comment: Regarding the application 

of the performance standards, some 

commenters thought that facilities 

should not have to address all 

performance standards (listed in 

§ 27.230) in their Site Security Plan and 

should only have to address those 

performance standards that directly 

apply to its facility and its risk-based 

tier. One commenter thought that, in 

certain circumstances, a covered facility 

should be able provide adequate 

chemical security without 

implementing every one of the riskbased performance standards. The 

commenter stated that the regulations 

should allow for situations where the 

facility can demonstrate that, under its 

particular circumstances, one or more of 

the risk-based performance standards is 

unnecessary or redundant. 

Response: Congress intended for the 

performance standards to provide 

facilities with a degree of flexibility in 

the selection of security measures, and 

the Department has tried to provide that 

flexibility throughout the rule. DHS 

expects that a facility will need to 

address only those performance 

standards that apply directly to their 

facility. In addition, DHS notes that 

there may be circumstances in which a 

facility needs not implement one or 

more of the risk-based performance 

standards and will still be able to 

provide adequate chemical security; the 

Department will work with these 

facilities on a case-by-case basis in these 

specific situations. 

Comment: Several commenters stated 

that the proposed standards do not 

include clear security goals, outcomes, 

or results to measure increased security. 

They also asserted that DHS should 

develop a measurement of vulnerability 

or risk reduction. One commenter 

suggested that chemical facilities should 

identify operational and protection 

goals and that the protection system 

should be evaluated with respect to 

meeting these goals. Another 

commenter suggested that DHS express 

the performance standards in terms of 

overall vulnerability scores as measures 

via a common Security Vulnerability 

Assessment methodology. This 

alternative would allow facilities to 

devote their security expenses to those 

measures that would produce the 

greatest vulnerability reductions and 

would result, nationally, in the greatest 

amount of overall vulnerability 

reduction per dollar spent. 

Response: DHS intends for the riskbased performance standards to provide 

facility owners with the flexibility to 

choose security measures in their Site 

Security Plan that will reduce the 

facility’s level of risk. The Security 

Vulnerability Assessment process, and 

DHS’s resulting placement of the facility 

within the tier structure, will provide 

facility owner-operators with an 

indication of their level of risk. 

Comment: Many commenters 

supported DHS’s intention to issue 

guidance to assist the regulated 

community in the interpretation and 

application of the proposed 

performance standards. They 

encouraged the Department to work 

with the regulated community on the 

development of such guidance. 

However, some of these same 

commenters also emphasized that, to 

effectuate Congress’ intention that the 

chemical security requirements be riskbased performance standards rather 

than prescriptive requirements, DHS 

must explicitly make the guidance nonbinding. Consistent with the comments 

about CVI, one commenter discussed 

the importance of limiting public access 

to the completed guidance since it could 

serve as a roadmap for terrorists. 

Response: DHS intends to release 

non-binding guidance on the 

application of the performance 

standards in § 27.230 to the risk-based 

tiers of covered facilities. This guidance 

will contain sensitive information 

concerning anti-terrorism measures, and 

DHS will make that guidance available 

to those individuals and entities with an 

appropriate need for the document. DHS 

will provide the guidance to the House 

of Representatives Committee on 

Homeland Security and the Senate 

Committee on Homeland Security and 

Governmental Affairs. 

2. Comments About Specific 

Performance Standards 

Comment: Several commenters 

requested clarification about the 

performance standards in proposed 

§ 27.230(a). A few asked whether 

paragraph (a)(5) is intended to cover all 

Department of Transportation hazardous 

materials and whether it is intended to 

cover transportation and storage of 

hazardous materials. One suggested that 

paragraph (a)(5) should include a 

provision for securing and monitoring 

the storage of hazardous materials, in 

addition to securing and monitoring the 

shipping and receipt of hazardous 

materials. Commenters also requested 

that DHS have facilities report 

significant security incidents to local 

law enforcement in addition to the 

Department. Another commenter 

indicated that the Department should 

require the following additional 

elements in the performance standards: 

written job descriptions for security 

personnel, adequate response teams and 

resources, safe shutdown procedures, 

evacuation procedures, and 

decontamination facilities. In addition, 

another commenter asked that DHS 

define ‘‘dangerous substances and 

devices’’ as used in § 27.230(a)(3)(i), 

‘‘potentially dangerous chemicals’’ as 

used in § 27.230(a)(6), and ‘‘significant 


rwilkins on PROD1PC63 with RULES_2
17706 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

security incidents’’ and ‘‘suspicious 

activities’’ as used in §§ 27.230(a)(15) 

and 27.230(a)(16). Another commenter 

asked to whom facilities should report 

‘‘significant security incidents.’’

Response: These comments relate to 

the measures that facilities must select, 

develop, and implement in their Site 

Security Plans. The Department will 

provide information in guidance to 

facilities on these measures. That might 

include information on the meaning of 

these terms, details on the parties to 

whom facilities should report security 

incidents and suspicious activities, and 

explanations about the role of local law 

enforcement (e.g., the Department’s 

recognition that some investigations of 

potentially illegal conduct may be the 

role of local law enforcement). 

In addition, DHS also notes that it has 

made a few changes to the regulatory 

context based on these comments. As 

discussed in the summary of regulatory 

text changes, the Department has 

revised paragraphs (a)(5), (8), (12), and 

(15). 

Comment: Several comments 

discussed the need for approaches that 

address cyber security risks, with 

several asserting that it is not sufficient 

for DHS to consider security only from 

a physical perspective. Commenters 

opined that there were very few specific 

references to cyber security in the 

Advance Notice, even though it is 

important. Some commenters suggested 

that DHS should address cyber security 

in more detail in its own performance 

standard (i.e., a performance standard 

that only addresses cyber security), 

while others suggested that DHS should 

integrate cyber considerations into other 

performance standards. Other 

commenters asked DHS to identify the 

scope of ‘‘cyber’’ security and ‘‘other 

sensitive computerized systems’’ in 

paragraph (a)(8). 

Commenters also raised other issues 

related to cyber security. One 

commenter mentioned that cyber or 

joint physical/cyber intrusions could 

create dangerous chemicals that did not 

previously exist. Consequently, 

commenters thought that DHS should 

address these contingencies in the 

screening process and/or issue an 

expansive list of chemicals. Other 

commenters noted that the RAMCAP 

approach was not designed to address 

control system cyber security. A few 

other commenters believed that the 

tiering approach is not appropriate for 

cyber security of control systems. 

Additionally, commenters mentioned 

that it is important to consider that 

facilities with interconnecting electronic 

systems could face additional threats as 

one site’s vulnerability poses a risk to 

other connected sites. 

Response: The Department recognizes 

that cyber security is an issue and has 

included cyber security as one of the 

performance standards that facilities 

must address in their Site Security 

Plans. Paragraph (c)(8) requires facilities 

to select, develop, and implement 

measures that ‘‘deter cyber sabotage.’’ In 

addition, the Department notes that it 

has implemented an assessment of cyber 

vulnerabilities for industrial control 

systems within the CSAT Security 

Vulnerability Assessment. The 

Department has accomplished this 

through the assistance of DHS’s 

National Cyber Security Division 

(NCSD). DHS appreciates the 

complexity and uniqueness of 

addressing cyber security with chemical 

facilities and anticipates that the CSAT 

will mature over time, especially with 

the constructive feedback from 

interested and knowledgeable parties. 

Comment: The Department received 

numerous comments on its use of the 

acronym ‘‘SCADA’’ in § 27.230(a)(8). 

Commenters asserted that SCADA refers 

to a central control system that monitors 

and controls a complete site or a system 

spread out over a long distance. They 

noted that using the term SCADA to 

represent cyber systems at chemical 

facilities is too narrow and suggested 

that the Department should replace the 

term SCADA with ‘‘Industrial Control 

Systems.’’

Response: While the Department had 

used the acronym ‘‘SCADA’’

(Supervisory Control and Data 

Acquisition) in the Advance Notice as 

shorthand for instrumented control 

systems in general, the Department 

agrees with the comments and has 

incorporated broader, more descriptive 

terminology into this performance 

standard. The Department has revised 

§ 27.230(a)(8), so that it reads as follows: 

‘‘Each covered facility must select, 

develop, and implement measures 

designed to: * * * [d]eter cyber 

sabotage, including by preventing 

unauthorized onsite or remote access to 

critical process controls, such as 

Supervisory Control and Data 

Acquisition (SCADA) systems, 

Distributed Control Systems (DCS), 

Process Control Systems (PCS), 

Industrial Control Systems (ICS), critical 

business systems, and other sensitive 

computerized systems.’’

3. Variations in Performance Standards 

for Risk Tiers 

Comment: Several commenters 

supported the use of risk-based tiers, 

with several recommending that DHS 

consult with industry in the 

development of specific performance 

standards for each tier. Various 

commenters favored the Department’s 

proposal to place high-risk facilities in 

risk-based tiers and to prioritize the 

implementation phase-in and the level 

of regulatory scrutiny (i.e., frequency of 

regulatory reviews, inspections and 

SVA/SSP updates) based on the 

facility’s risk and associated tier. 

Commenters noted that DHS should 

require facilities in higher risk tiers to 

develop more robust measures to meet 

the performance standards. 

In contrast, a few other commenters 

had differing opinions. A small number 

of comments cautioned that 

performance standards should be 

consistent across all tiers, regardless of 

the level of risk. These commenters 

noted that DHS should adjust the 

specific measures, not the performance 

standards, to match the level of risk. In 

addition, one commenter stated that 

DHS should not establish risk-based 

tiers and should instead identify the 

criteria for those facilities that will be 

regulated and those that will not. If DHS 

were to establish tiers, that commenter 

thought DHS should limit the tiers to 

high or low risk. 

Response: As discussed above in 

Section III(B)(3), DHS is creating four 

risk-based tiers, with the highest risk 

facilities in the top tier (i.e., Tier 1). The 

types and intensity of security measures 

(sufficient to satisfy the risk-based 

performance standards in the facility’s 

Site Security Plan) will depend on the 

facility’s tier. For facilities that present 

the greatest degree of risk, more rigorous 

security measures will be needed to 

satisfy the performance standards. The 

Department will use a higher level of 

regulatory scrutiny for facilities that 

present the highest risk. 

DHS consulted with the chemical 

industry in developing the tier system 

and performance standards. In adopting 

the four tier system and applicable riskbased performance standards, DHS 

intends to employ a scalable 

performance standard across the tiers, 

i.e., within the same performance 

standard, a more robust set of security 

measures will be needed for a Tier 1 

facility than for a Tier 2 facility, for a 

Tier 2 facility than for a Tier 3 facility, 

and so on. DHS will ensure that riskbased performance standards are 

applied consistently across each tier, 

but guidelines for each tier will vary. 

Comment: A few commenters also 

supported the idea that a facility, which 

the Department has previously 

determined is ‘‘high risk,’’ can request 

that the Department move it to a lower 

tier if it has materially altered its 

operations in a way that significantly 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17707 

lowers its potential vulnerabilities and 

consequences. 

Response: Pursuant to § 27.205(b), ‘‘if 

a covered facility previously determined 

to present a high level of security risk 

has materially altered its operations, it 

may seek a redetermination by filing a 

Request for Redetermination with the 

Assistant Secretary, and may request a 

meeting regarding the request.’’ DHS has 

retained that provision in this interim 

final rule. This provision allows DHS to 

re-evaluate risk based upon changes at 

the facility in process, chemistry, or 

other factors. DHS, through the 

Assistant Secretary, intends to evaluate 

such proposed measures on a case-bycase basis. 

In evaluating the redetermination, 

DHS will consider whether the planned 

action actually reduces risk (as opposed 

to simply ‘‘moving’’ the risk into the 

community around the facility) and 

does so without compromising security. 

Where these parameters are met, DHS 

will approve the plan and re-evaluate 

the tier placement for the facility in 

question. Pursuant to § 27.205(b), the 

Assistant Secretary will notify the 

facility of the Department’s decision on 

the Request for Redetermination within 

45 calendar days of receipt of such a 

Request or within 45 calendar days of a 

meeting regarding the Request. 

Comment: One commenter noted that 

how performance standards vary across 

tiers would depend on the criteria used 

to establish the tiers. 

Response: DHS will assess all 

facilities based upon worst plausible 

case scenarios as applicable to each 

facility. 

4. Adoption of MTSA Provisions 

The Advance Notice solicited 

comment on whether DHS should adopt 

various provisions from MTSA as 

elements of the chemical security 

program. In particular, DHS asked 

whether it should adopt the following 

performance standards in addition to 

the standards already listed in 6 CFR 

27.230: 33 CFR 105.250 (Security 

systems and equipment maintenance), 

33 CFR 105.255 (Security measures for 

access control); 33 CFR 105.260 

(Security measures for restricted areas); 

33 CFR 105.275 (Security measures for 

monitoring); 33 CFR 105.280 (Security 

incident procedures). See 71 FR 78276, 

78284. 

Comment: Of the several comments 

received on the request, the majority 

opposed adopting the standards, 

characterizing them as highly detailed 

and prescriptive and, as such, 

incompatible with the risk-based 

performance standards proposed for 

chemical facilities. A chemical industry 

association presented an analysis of the 

four MTSA standards and concluded 

that they were largely duplicative of, or 

potentially inconsistent with, existing 

categories of performance standards 

presented in the Advance Notice. The 

commenter stated that the MTSA 

standards were not performance 

standards, but mandatory particular 

security measures, in direct conflict 

with Section 550. Through a similar 

section-by-section analysis of the MTSA 

provisions, a chemical manufacturer 

found several provisions to be 

compatible with performance standards, 

but others too prescriptive or 

incompatible with activities in chemical 

facilities. 

Another association representing 

chemical distributors stated that only a 

tiny fraction of its members relied on 

waterways to distribute chemicals and, 

accordingly, recommended against 

adoption of the standards. 

Response: The Department agrees 

with the commenters who 

recommended against adopting the 

MTSA provisions referred to in the 

preamble of the Advance Notice. As the 

commenters noted, these provisions 

either duplicate current standards, 

conflict with current standards, or 

mandate particular security measures in 

conflict with the statute. 

Comment: One association noted that, 

because many of its members had 

facilities on waterways, member 

companies often developed MTSA-type 

approaches to Security Vulnerability 

Assessments and Site Security Plans to 

establish some uniformity across 

facilities. Another commenter suggested 

that when an owner of multiple 

facilities has some covered by MTSA 

and others by the chemical security 

rules, MTSA could be an ASP if applied 

to non-MTSA facilities. 

Response: Where the application of 

MTSA practices is sufficient, it may be 

considered a valid ASP. DHS will 

review and consider adoption of MTSA 

plans to non-MTSA facilities on a caseby-case basis. The Department does not 

intend to require duplication of effort 

where responsible facilities have 

implemented adequate security 

measures. 

E. Background Checks 

Under the Advance Notice, covered 

facilities would be required to perform 

appropriate background checks on and 

ensure appropriate credentials for 

facility personnel and, as appropriate, 

for unescorted visitors with access to 

restricted areas or critical assets. 

Comment: Numerous commenters 

stated that chemical facilities already 

screen their employees for their own 

interests and in response to government 

programs. The commenters urged that 

the level of screening for existing 

employees and contractors should be 

commensurate with the access 

provided. While some commenters 

wanted existing employees who had 

undergone employee screening before 

hire to be ‘‘grandfathered’’ from any 

new requirements, other commenters 

thought that existing employees should 

be subject to screening when they are 

assigned to secure areas or have the 

potential to be reassigned. An 

association recommended checking 

current employees with less than five 

years seniority within six months of the 

effective date of the program and more 

senior employees within one year. 

Several commenters argued that, 

extending the proposed requirements to 

contractors, subcontractors, truck 

drivers, and delivery and repair 

personnel, and others who are 

frequently on site, would create serious 

difficulties because of the large numbers 

of individuals in these categories, the 

need to have them available on short 

notice, redundancy of existing 

credentials, cost of new credentialing, 

and delay while screening is completed. 

Chemical companies explained that 

they rely heavily on contractors and 

expect the contracting company to be 

responsible for assuring that their 

employees meet security requirements. 

Commenters suggested that officers 

hired by the facility supervise 

contractors and sub-contractors without 

background checks. 

The commenters also addressed the 

types of background checks that DHS is 

considering, including the personal 

information required, and whether 

name checks against the Terrorist 

Screening Database and fingerprintbased checks for terrorism, criminal 

history, or immigration status would be 

required. A number of commenters 

urged DHS to tailor the degree of 

scrutiny to the degree of employee 

access to sensitive locations. Private 

screening firms described systems that 

collect more detailed information and 

enhanced verification depending on the 

applicant’s access. Operators of private 

screening systems state that they 

typically rely on the database screens 

for candidates with potential terrorist 

connections. A chemical industry 

association supported screening of 

chemical facility employees for 

terrorism, criminal records, and 

immigration status. 

One commenter explained that 

biometric testing in a chemical 

environment can fail because of 

smudging and deterioration of 

fingerprints over time, while another 


rwilkins on PROD1PC63 with RULES_2
17708 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

believed that adequate field testing had 

not been completed. Another 

commenter explained that biometrics 

and other verification techniques will 

not foil a person who has stolen an 

identity to pass the screen. The 

commenter recommended that 

authentication techniques, in addition 

to validation and verification, be 

applied to applicants with access to 

secure locations. In response to the 

proposed use of a list of disqualifying 

crimes to reject applications for 

clearance, a number of commenters 

urged DHS to restrict the crimes to those 

that were most clearly linked to 

potential for terrorism. The commenters, 

both unions and chemical companies, 

argued that loyal employees can lose 

their jobs or fail to qualify for hire 

because of misdemeanors, such as 

missing a few months of child support, 

or crimes that are not good predictors of 

the potential for terrorism. One 

commenter recommended adoption of 

an appeal process that allows a 

disqualified person to explain why he or 

she is no longer at risk, similar to the 

process under MTSA regulations. 

The preamble also requested 

comment on whether the access 

provisions of the Transportation Worker 

Identification Credential (TWIC) 

Program, Hazardous Materials 

Endorsement (HME), ATF requirements, 

or other structured programs should 

apply to chemical facility security 

programs. A few commenters supported 

the concept that the screening required 

for the TWIC program should be 

acceptable for the chemical security 

program. Indeed, many chemical 

facilities are on bodies of water and 

employees were already compliant with 

the TWIC program. Another commenter 

took the opposite position that the 

TWIC program did not provide the 

customization available in existing 

screening systems to grade the level of 

screening based on employment and 

assignment decision. Numerous 

comments maintained that an employee 

or contractor who was credentialed 

under the TWIC, HME, ATF, or similar 

programs should not need additional 

security screening under the chemical 

security program. Related comments 

requested portability of security checks 

for employees or contractors cleared by 

another chemical facility. One 

commenter recommended that DHS 

establish a national repository of cleared 

personnel to minimize redundancy and 

expense. 

With respect to the question of 

whether the government should conduct 

background checks or whether the 

industry could use authorized third 

parties to conduct the checks, three 

commenters stated that third parties 

were already providing background 

checks for thousands of employees of 

chemical facilities. Other commenters, 

including organizations that provided 

screening services, maintained that 

existing programs for screening 

applicants and employees for chemical 

facilities were reliable, effective, and 

inexpensive. Another commenter wrote 

that one program operated through 

safety councils might be eligible as an 

alternate security program, although a 

chemical company suggested not using 

safety councils, because their standards 

were too lax. 

A few commenters favored the 

government’s undertaking background 

checks because, unlike private 

companies, the government has access 

to terrorist databases and FBI databases, 

and because the government, unlike 

employers, would be immune from legal 

challenges from a rejected employee. 

Opposition to government responsibility 

came from several commenters who 

were concerned about slow completion 

of background checks, and that the 

backlog might be exacerbated by a new 

chemical security program. 

A few commenters, including three 

unions, strongly urged that the system 

provide an appeals process for affected 

applicants whose employment 

prospects in the chemical industry and 

elsewhere could be seriously affected by 

an erroneous determination. Private 

services noted that they notified 

applicants of adverse decisions and 

allowed them to contest the decisions. 

Response: DHS believes that 

personnel surety is a key component of 

a successful chemical facility security 

program. This component of the 

performance standards will enhance 

security in what would otherwise be a 

significant potential vulnerability. In the 

Advance Notice, the Department 

requested comment on these 

components of a background check 

program: (1) What individuals should 

have a background check? (2) When 

should the check be required? (3) What 

type of background check should be 

conducted? And (4) Should the federal 

government conduct the check? We 

address each of these four issues below. 

First, DHS agrees that the level of 

screening for employees and contractors 

should be commensurate with the 

access provided. As part of this 

approach, the facility shall identify 

critical assets and restricted areas and 

establish which employees and 

contactors may need unescorted access 

to those areas or assets, and thus must 

undergo a background check. A 

facility’s approach to personnel surety, 

including its defined restricted areas, its 

critical assets, and a list of the 

employees requiring background 

checks, shall be detailed in the Site 

Security Plan that the facility submits to 

the Department for approval. The rule 

does not include a provision that would 

exempt certain employees from the 

personnel surety performance standard 

based on length of employment at the 

facility. Merely because an individual 

has worked in a chemical facility for a 

period of time without incident does not 

automatically mean that they do not 

pose a terrorism risk and should be 

given free access to restricted areas and 

critical assets without a background 

check. Allowing such access without a 

background check presents an 

unacceptable security risk, and is 

contrary to the performance standard on 

personnel surety. This is not to say, 

however, that employers may not 

consider an employee’s prior history of 

employment and service in making 

personnel decisions. It should also be 

noted that nothing in this regulation 

prohibits a person that has been 

convicted of a misdemeanor offense 

from being employed at a high risk 

chemical facility. 

Second, DHS views the background 

check process as one of the many pieces 

of the Site Security Plan, and as such, 

will require that it be completed and 

submitted with the Site Security Plan. 

Once the facility receives the Letter of 

Authorization under § 27.245 denoting 

preliminary approval of the Site 

Security Plan, the facility may then 

proceed with all necessary background 

checks, if it has not done so already. All 

employees required in the SSP to have 

a background check should be included 

in the initial submission and must be 

duly vetted in accordance with the plan. 

This should not cause any interruption 

in work. 

Third, the Department understands 

that many covered facilities already 

perform background checks on 

employees and certain contractor 

employees, and with some 

modifications, will allow that process to 

continue. In order to perform an 

appropriate background check for the 

purpose of protecting critical assets and 

restricted areas of high risk chemical 

facilities from persons who pose a 

terrorist threat, the Department has 

made some modifications to the 

personnel surety performance standard 

in the regulation. The Department will 

consider appropriate open source 

background checks as an acceptable 

response to the background check 

performance standard. Specifically, the 

Department will consider as appropriate 

a background check process that verifies 

and validates identity; includes a 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17709 

1A DHS redress number is issued by DHS to an 

individual who has successfully completed a 

redress inquiry, in which the inquiry resolved a 

previous false-positive match to a watch list record. 

Redress inquiries can be submitted directly to DHS 

as part of the DHS Traveler Redress Inquiry 

Program (DHS–TRIP). 

criminal history check of publicly or 

commercially available databases; 

verifies and validates legal authorization 

to work through the I–9 process; and 

includes measures designed to identify 

people with terrorist ties. This last 

standard can be achieved by checking 

against the consolidated Terrorist 

Screening Database (TSDB). The 

Department modified the performance 

standard at 6 CFR § 27.230(a)(12) to 

reflect these changes. 

Fourth, while much of the 

background check process can be 

accomplished by commercial methods, 

the check of the Terrorist Screening 

Database is an inherently governmental 

function that necessarily includes a 

check of classified databases that are not 

commercially available. The Department 

will augment the background check in 

the SSP with a TSDB check. The 

Department has determined a TSDB 

check is necessary for the purpose of 

protecting critical assets and restricted 

areas of high risk chemical facilities 

from persons who pose a terrorist threat. 

DHS will designate a secure portal or 

other method for the submission of 

application data for each employee or 

contractor for whom a TSDB check is 

required in the SSP. The Application 

data will be the name, date of birth, 

address, and citizenship, and if 

applicable, the passport number, DHS 

redress number,1 and information 

concerning whether the person has a 

DHS credential or has previously 

applied for a DHS credential. 

To minimize redundant background 

checks of workers, DHS agrees that a 

person who has successfully undergone 

a security threat assessment conducted 

by DHS and is in possession of a valid 

DHS credential such as a TWIC, HME, 

NEXUS, or FAST, will not need to 

undergo additional vetting by DHS. 

Even so, the facility shall submit the 

name and credential information for 

these persons along with the application 

data for other employees. Facilities shall 

not allow unescorted access to a critical 

asset or restricted area to a person in 

possession of a DHS credential unless 

information on that person has been 

submitted as discussed above. 

DHS will screen each applicant and 

determine whether the applicant poses 

a security threat. Where appropriate, 

DHS will notify the facility and 

applicant via U.S. mail, with 

information concerning the nature of the 

finding and how the applicant may 

contest the finding. Applicants will 

have the opportunity to seek an 

adjudication proceeding and appeal 

under Subpart C. 

F. Inspections and Audits 

Numerous comments addressed the 

proposed provisions for auditing and 

inspecting chemical facilities to 

determine compliance and allowing 

certified third-party auditors to 

supplement DHS personnel at lower tier 

facilities. While DHS has responded, to 

the extent that it is able, to the 

comments below, DHS also notes that it 

will issue guidance that identifies 

appropriate processes for inspections 

and provides specifics about the records 

that must be made available to DHS 

upon request. See §§ 27.250(d) and 

27.255. That guidance will provide 

further detail. 

1. Inspections 

Comment: Section 27.245(a) in the 

Advance Notice provided that DHS may 

‘‘enter, inspect, and audit the property, 

equipment, operations, and records of 

covered facilities.’’ One commenter 

asserted that DHS should inspect and 

audit using an approved or 

preliminarily approved Site Security 

Plan and not on other criteria outside 

the scope of the Site Security Plan. In 

addition, commenters indicated that 

DHS need not inspect equipment and 

records related to operations outside the 

vulnerabilities identified in the facility’s 

Security Vulnerability Assessment and 

protected in the Site Security Plan; the 

commenter thought that such 

inspections would go beyond what is 

required to ensure that high-risk 

chemical facilities are secure. In 

addition, one commenter requested that 

DHS revise the scope of inspection to 

property, equipment, operation, and 

records covered in a facility’s Site 

Security Plan. 

Response: During inspections, 

authorized DHS officials may inspect 

equipment, view and/or copy records, 

and audit records and/or operations. 

This section imposes an affirmative 

obligation on facilities to cooperate with 

authorized DHS officials, including 

inspectors, and allow inspections and 

audits. DHS will inspect a covered 

facility following DHS’s preliminary 

approval of the facility’s Site Security 

Plan. DHS may also inspect facilities 

outside of the Site Security Plan 

approval cycle if there are exigent 

circumstances or special security 

concerns. During the course of 

inspections, an inspector may ask a 

facility to demonstrate the effectiveness 

of a given security measure found in the 

facility’s Site Security Plan. This will 

help the inspector to determine whether 

the facility has adequately implemented 

the risk-based performance standards in 

its Site Security Plan. With respect to 

requests for records, the Department 

expects that facilities will produce the 

records—whether located onsite at the 

facility, at corporate headquarters, or in 

any other location—that are relevant to 

the security of the facility. The 

Department has added some additional 

language in the rule about the 

production of records. See 

§ 27.250(d)(4). 

With respect to scope of inspections, 

DHS is not narrowing its scope to cover 

only those items covered in the facility’s 

Security Vulnerability Assessment and 

Site Security Plan; DHS needs the 

appropriate discretion to inspect those 

items and areas that are related to the 

security of the facility. However, DHS 

has no intention of inspecting areas that 

are unrelated to security. 

Comment: One industry association 

noted that § 27.245(b)(1) of the Advance 

Notice suggested that security measures 

(which DHS requires for final approval 

of the Site Security Plan) should be in 

place at the time that DHS inspects a 

facility. The commenter stated that, if 

facilities address vulnerabilities through 

capital improvements, facilities are 

unlikely to have these security measures 

in place within the stated time frame. In 

such cases, the commenter 

recommended that DHS use a timeline 

approach, detailing an implementation 

schedule of prioritized security 

measures, and include that timeline in 

a facility’s Site Security Plan. 

Response: The commenter is correct 

in noting that DHS expects that facilities 

will have met the requirements of 

§ 27.225 (i.e., the facility will have 

developed and submitted a Site Security 

Plan, which the Department will have 

preliminarily approved) when the 

Department visits the facility for an 

inspection or audit. See § 27.250(b)(l). 

One of the purposes of the inspection is 

for the Department to determine 

whether facilities have adequately 

implemented their Site Security Plans. 

However, the Department realizes that 

there may be circumstances where 

facilities will have to implement 

security measures through capital 

improvements, and that can take time. 

Based on the Department’s assessment 

of risk at a given facility and the 

realities of getting security measures 

into place, the Department will work 

with facilities on a case-by-case basis. 

Where the Department believes that 

extra time is warranted, the Department 

will work with facilities to incorporate 

that time into the facility’s Site Security 


rwilkins on PROD1PC63 with RULES_2
17710 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

Plan and into the Department’s timeline 

for inspecting the facility. 

Comment: Various commenters 

requested clarification about the time 

and manner provisions found in 

§ 27.245(c) of the Advance Notice. 

Several commenters noted that the 

proposed regulations did not define the 

terms ‘‘reasonable times’’ or ‘‘reasonable 

manner’’ and asked the Department to 

define those terms. In addition, some 

commenters noted that the preamble 

provided a timeframe for inspections 

(‘‘during regular business hours of 9 

a.m. to 5 p.m.’’) but that the Advance 

Notice text did not specify that 

timeframe. Other commenters indicated 

that DHS should clearly outline the 

regularity of audits and inspections that 

the Department will require for each 

tier. 

Several other comments discussed the 

notice provisions in the rule. The 

Advance Notice provided that ‘‘DHS 

will provide covered facility owners and 

operators with 24-hour advance notice 

before inspections, except where the 

Under Secretary or Assistant Secretary 

determines that an inspection without 

such notice is warranted by exigent 

circumstances and approves such 

inspection.’’ See § 27.250(c). Several 

industry associations believe that 24- 

hour advance notice would not be a 

sufficient amount of time for facilities to 

arrange for the appropriate personnel to 

be available for the inspection. 

Commenters suggested that DHS 

provide more notice to facilities; 

requests ranged from three to seven 

days. Other commenters requested that, 

in addition to notifying the facility, DHS 

also provide local emergency 

responders and local agencies tasked 

with regulating hazardous materials 

facilities with a 24-hour advance notice 

as a courtesy. 

Others commented on the concept of 

unannounced inspections. A member of 

Congress objected to the restrictions on 

unannounced inspections, asserting that 

the provision was a near-preclusion of 

random audits, because approval by 

senior officials (i.e., the Under Secretary 

for Preparedness or Assistant Secretary 

for Infrastructure Protection) would 

make unannounced audits exceedingly 

rare. Moreover, focusing such 

unannounced audits exclusively on 

facilities (or geographic regions) where 

agency officials determine that ‘‘exigent 

circumstances preclude notice’’

presupposes that the agency is already 

in a position to know where exigent 

circumstances exist. As a result it would 

be far harder for the Department to 

determine actual rates of compliance 

with regulatory requirements. An 

industry commenter would support 

unannounced inspections for facilities 

that had significant deficiencies in the 

prior inspection or that have had an 

unusual number of breaches. 

Response: DHS has retained the 

language that it used in the Advance 

Notice. Authorized DHS officials will 

conduct audits and inspections during 

reasonable times and in a reasonable 

manner. The nature of any given 

inspection will depend on the specific 

circumstances surrounding a particular 

facility’s operations at a given point in 

time and will be considered in 

conjunction with available threat 

information. 

Commenters asked for clarification on 

the times that DHS plans to conduct 

inspections. While DHS expects that it 

will conduct many of its inspections 

during the regular business hours of 9 

a.m. to 5 p.m., DHS will not limit its 

inspections to regular business hours 

only. DHS must have the flexibility to 

respond to information, operations, and 

circumstances whenever they exist or 

develop, and so DHS may have to 

conduct inspections in the evening, at 

night, or during weekends. Security 

concerns are different at different times 

of the day and on different days of the 

week, and so DHS must be able to assess 

the different security measures that 

facilities put into place, pursuant to 

their Site Security Plans. 

DHS has maintained the Advance 

Notice provision that gives facilities 24- 

hour advance notice before an 

inspection. In some circumstances, DHS 

may provide facilities with additional 

time. As a general matter, DHS believes 

that 24 hours is an appropriate and 

reasonable notice period, striking a 

balance between providing the 

Department with flexibility to determine 

compliance with this regulation and 

providing regulated entities with 

sufficient notice to prepare for an 

inspection. Some commenters suggested 

that DHS also provide advance notice 

about inspections to local emergency 

responders and local agencies. While 

DHS may choose to notify local 

emergency responders or other agencies 

on a case-by-case basis, DHS does not 

believe it is necessary to include a 

mandatory requirement in the rule. 

Many commenters expressed concern 

that DHS is not able to conduct 

unannounced inspections. These 

concerns are unfounded: DHS will be 

able to conduct unannounced 

inspections when it complies with 

internal policy. While DHS has a 

general requirement for advance notice, 

DHS recognizes that there may be 

circumstances where advance notice is 

not possible. 

To accommodate those circumstances, 

DHS has identified two exceptions. See 

§ 27.250(c). DHS had identified one 

exception in the Advance Notice: If the 

Under Secretary determines that an 

inspection without notice is warranted 

by exigent circumstances, the Under 

Secretary or Assistant Secretary may 

approve such an inspection. The exigent 

circumstances may include threat 

information warranting immediate 

action. DHS adds a second exception in 

this interim final rule: If any delay in 

conducting an inspection might be 

seriously detrimental to security, and 

the Director of the Chemical Security 

Division, Office of Infrastructure 

Protection determines that an inspection 

without notice is warranted, the Field 

Operations supervisor may permit an 

inspector to conduct such inspection. 

This additional exception addresses the 

concerns of commenters who claimed 

the exception in the Advance Notice 

was too restrictive. 

Comment: Some commenters noted 

that facilities may choose to validate 

any government-issued credential for 

the purpose of inspectors gaining entry 

onto a chemical facility. One commenter 

requested that, as part of the guidance, 

DHS include information on the 

security measures that will allow a 

facility to determine that the DHS 

officials or third party auditors are 

legitimate. 

Response: DHS will handle this issue 

like other Federal agencies handle their 

respective inspectors and auditors. 

Individuals performing these 

inspections will carry Federal 

government credentials identifying 

themselves as having official authority 

to inspect. In addition, any chemical 

facility wishing to authenticate the 

identity of an individual purporting to 

represent DHS may contact the 

appropriate DHS Chemical Security 

Division official within the Office of 

Infrastructure Protection at DHS 

headquarters. In addition, the 

Department has provided some 

additional regulation text on the issue of 

inspector credentials. See § 27.250(d)(1). 

Comment: Several commenters 

addressed the issue of training for 

inspectors. One commenter stated that it 

is DHS’s role to ensure that inspectors 

and auditors are qualified in both 

physical security and chemical 

processes. Others noted that, if 

inspectors and auditors do not have a 

background in chemical manufacturing, 

then DHS must adequately train 

inspectors. Furthermore, that 

commenter encouraged DHS to utilize a 

cross functional team consisting of 

individuals with chemical process 

knowledge and physical security 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17711 

background and include a local area 

first responder on each inspection team 

for each facility. The commenter noted 

that many facilities maintain a close 

relationship with local emergency 

responders. One commenter indicated 

that DHS inspectors should expect that 

chemical facilities may require them to 

complete a safety overview before being 

granted access to a facility; this is 

regardless of the training that DHS 

provides to its inspectors. 

Response: DHS will use properly 

trained personnel to conduct 

inspections. During inspections, DHS 

intends to use teams consisting of 

Federal inspectors, many with 

backgrounds in law enforcement and 

physical security, and experts in 

chemical manufacturing. DHS will put 

inspectors through a rigorous training 

program, incorporating both classroom 

training and on-site visits, so that 

inspectors are informed on all aspects 

related to this regulatory program as 

well as on safety issues. These 

individuals will receive training on 

specific safety procedures, including 

OSHA’s Hazardous Waste Operations 

and Emergency Response Standard 

(HAZWOPER), that they should use 

while visiting chemical facilities. If 

chemical facilities request that 

inspectors receive facility-specific safety 

briefings or training, the Department 

will work with facilities to 

accommodate those concerns, provided 

that the additional safety training is 

reasonable given the nature of the 

expected inspection. 

2. Third-Party Auditors and Inspectors 

Comment: Numerous chemical 

companies, industry associations, and 

State and local agencies requested 

clarification on the roles and 

responsibilities of third-party auditors. 

Several commenters pointed out that 

there is currently a lack of standards for 

third-party auditors, and some 

commenters noted that if DHS does not 

provide specific criteria for compliance, 

such audits will be very subjective. 

Several commenters asserted that there 

is a need for DHS to develop standards 

and requirements for third-party 

auditors, including requirements for 

certification, qualifications, 

independence, objectivity, training and 

re-training, confidentiality, ethical 

obligations, conflicts of interests, 

discipline procedures, and liability 

insurance. 

Several commenters discussed the 

third-party auditor certification or 

approval process in detail. One 

commenter pointed out that DHS would 

have to develop either a professional 

registration or licensing for third-party 

auditors in order to establish a 

minimum level of competency for thirdparty auditors. Other commenters stated 

that training should include, among 

other things, information on physical 

security, chemical processes, and safety 

operations. One commenter 

recommended Sandia National 

Laboratory’s Risk Assessment 

Methodology for Chemical Facilities 

(RAM–CF) training as an excellent 

review in all aspects of chemical facility 

operation and security. One pointed out 

that there is currently no certification 

for control system cyber security 

auditors. Another commenter added 

that any DHS third-party inspectors 

should have a strong background and 

experience with the agricultural retail/ 

distribution segment of the chemical 

industry. The commenter encouraged 

DHS to work with industry associations 

and industry experts on establishing the 

proper criteria to select certified thirdparty auditors that will be used to 

inspect agricultural retail or distribution 

facilities determined to be covered by 

these regulations. 

One commenter was concerned that 

DHS had not effectively addressed 

auditor independence and objectivity in 

the Advance Notice. To remedy this 

concern, the commenter suggested that 

DHS define third-party auditor and 

address auditor concepts such as due 

diligence, due professional care, auditor 

certification, auditor training, auditor 

indemnification, conformity assessment, 

audit/inspection methodology, etc. 

Other commenters raised questions 

about third-party auditors and 

information protection. One commenter 

stated that all third-party auditors must 

be held to the same requirements and 

standards as applied to DHS officers and 

employees regarding the protection of 

confidential information; this includes 

information protected by law, such as 

PCII, Sensitive Security Information 

(SSI), or other applicable requirements. 

DHS should develop requirements and 

procedures, including the use of nondisclosure agreements, to prohibit 

disclosure or use of confidential 

information developed or obtained 

during the auditing process. One 

association, whose member companies 

already use third party audits, wanted 

confirmation that the use of third-party 

auditors would be in compliance with 

the CVI framework. 

Three State agency commenters urged 

the Department to clarify that the thirdparty auditor provision includes 

qualified state and local assets to 

conduct audit inspections and assist 

with Security Vulnerability 

Assessments and Site Security Plans. 

One commenter would limit third-party 

auditors to appropriate state and local 

government officials with familiarity of 

the chemical process safety and security 

systems currently in place at the 

chemical facility in question to ensure 

the credibility and effectiveness of the 

inspection and auditing program. Some 

other commenters suggested that State 

and local entities could be a resource 

base for audits and site visits, including 

those of higher tier facilities. 

Commenters asked several other 

specific questions about DHS’s use of 

third-party auditors. A chemical 

company requested clarification on how 

DHS could delegate its authorities to 

third-parties. Another commenter 

wanted the ability to seek legal remedies 

against third-party auditors. Other 

commenters raised the question of who 

would pay for third-party auditors, 

suggesting that DHS should. 

Some commenters argued for the use 

of third-party audits at any chemical 

facility regardless of its tier ranking. 

One commenter noted that the eventual 

requirements for certification should be 

stringent, creating confidence that the 

auditor will be just as capable as DHS 

inspectors of auditing or inspecting a 

high-risk facility. The commenter 

suggested that, as a result, a certified 

third-party auditor should also be 

allowed to conduct inspections at 

‘‘high’’ or ‘‘higher’’ risk facilities. Other 

commenters noted that allowing thirdparty auditors to perform work at any 

chemical facility, regardless of its tier, 

will increase the ability of DHS to 

rapidly and effectively review security 

plans at chemical facilities by making 

sure sufficient numbers of inspectors are 

available at any given time. 

Other commenters opposed DHS’s use 

of third-party auditors altogether. A 

chemical industry commenter opposed 

DHS’s use of consultants, contractors, or 

vendors to perform audits and 

inspections of facilities based on 

concerns about confidentiality and 

conflicts of interest. The commenter 

asserted that DHS-trained personnel are 

best suited to understand the 

complexities of security in affected 

facilities and to understand the 

importance of sensitive business 

information provided to DHS. 

Consequently, the commenter urged 

DHS not to initiate the proposed 

program without the appropriate level 

of staff, training, and resources 

necessary to implement enforcement. 

One commenter preferred that DHS 

officials, not officials from other 

government agencies or nongovernmental organizations, conduct 

third-party inspections or audits to 

assess compliance; the commenter 

asserted that consistency of audits can 


rwilkins on PROD1PC63 with RULES_2
17712 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

only be maintained if one agency, using 

the same inspection and/or audit 

procedures, performs the work. Several 

other commenters disagreed with the 

concept of third-party auditors unless 

they were under contract to DHS and 

met DHS hiring standards and training 

certifications. They felt that if such an 

activity is important, then DHS should 

carry out the activity itself. 

Response: The Department recognizes 

that there are many important and 

complex issues surrounding the use of 

third-party auditors. Those issues 

include questions about whether it is 

appropriate for DHS to use third-party 

auditors and if so, for which tiers of 

facilities; what the standards and 

requirements would be for those thirdparty auditors; and who would pay for 

third-party auditors. DHS continues to 

take these issues under advisement. 

DHS intends to issue a future 

rulemaking providing the details about 

its plans to use third-party auditors. In 

developing its proposed rule, DHS will 

consider these comments about thirdparty auditors. Until that time, DHS will 

use its own inspectors for conducting 

inspections and audits. 

G. Recordkeeping 

Comment: One commenter suggested 

that the recordkeeping and reporting 

requirements be strengthened for 

process malfunctions or any attempted 

terrorist attack; the need for emergency 

response, safe shut down, evacuation 

and decontamination procedures in case 

of an attack or malfunction be defined; 

and effective training requirements for 

workers in covered facilities be 

required. 

Response: Recordkeeping 

requirements under this new authority 

focus on security and will capture many 

of the issues identified by the 

commenter. Recordkeeping 

requirements regarding incidents under 

process safety, including shut down/ 

start up, are outside of the scope of this 

regulation. 

Comment: One commenter asked for 

guidance regarding what would 

constitute a reportable ‘‘security 

incident’’ or ‘‘suspicious incident.’’ The 

commenter noted that DOT has 

provided helpful guidance for reporting 

and recordkeeping under HM–232. 

Response: The Department will 

provide facility owners with guidance 

on these and other terms used in the 

recordkeeping section. 

Comment: Another commenter 

suggested that § 27.250(a)(4) include a 

reference to NFPA 731, Standard for the 

Installation of Electronic Premises 

Security Systems (2006 edition), 

Chapter 9, Testing and Inspections. The 

commenter supported the 

recommendation by pointing out that all 

NFPA codes and standards are 

developed through the voluntary 

consensus process and are accredited by 

the American National Standards 

Institute (ANSI); that Congress, in 

several cases has mandated the adoption 

of NFPA codes and standards and that 

Public Law 104–113, as described in 

OMB Circular A119, mandated that 

voluntary consensus codes and 

standards be used when they are 

applicable and to ensure that chemical 

facility safety be the primary concern. 

Response: Voluntary consensus 

approaches to chemical facility security 

will be addressed in guidance. However, 

the Department cannot mandate specific 

security measures under this authority. 

Comment: One chemical association 

found the requirements for 

recordkeeping to be excessive. 

Concerning training, the commenter 

stated that the location of the session 

and the name and qualifications of the 

trainer were not important, and the 

requirement for attendees’ signatures 

would cause headaches if attendees 

leave without signing. Also, many of 

these requirements seem to prevent the 

use of web-based training. With respect 

to the drill and exercise provision, the 

commenter believed that a 

comprehensive list of participants is 

more challenging than it might appear, 

since drills and exercises frequently 

involve persons in multiple locations. 

Finally, recording the name and 

qualifications of every maintenance 

technician is overly burdensome and 

extremely difficult to document. 

According to the commenter, this 

proposed requirement would lead to 

inadvertent non-compliance due to its 

inherent complexity. The commenter 

urged that the recordkeeping 

requirements, at most, track the MTSA 

requirements (33 CFR § 105.225), which 

are less detailed and only require 

records to be maintained for two years. 

Response: Memorializing minimal 

information about training, drills, 

exercise, and maintenance is important 

for a facility to assist in the analysis and 

review of its security efforts, and DHS 

does not agree that these requirements 

are overly burdensome or excessive 

given the potential risks in this sector. 

The recordkeeping requirements 

address specific issues that arise in 

chemical facilities, and a three year 

period is consistent with the anticipated 

audit and review cycle under this rule. 

Comment: An industry association 

argued that, in light of existing DOT 

requirements, no additional training and 

recordkeeping requirements are needed 

for battery transportation. Further, any 

training and recordkeeping 

requirements that are made applicable 

to drivers hauling covered chemicals 

should be the responsibility of the 

transportation firms, not the facilities 

they service. 

Response: There are no specific 

requirements for recordkeeping of 

transportation activities in this rule. 

H. Orders 

Comment: Various commenters 

mentioned the remedies in proposed 

§§ 27.300, 27.305, 27.310, and 27.315. 

An industry group indicated that the 

rule should provide adequate protection 

for recipients of penalty and cessation 

orders, including the opportunity for an 

adjudicatory hearing before a neutral 

hearing officer. The commenter 

suggested that the rule make clear that 

the burden of proof lies with DHS, not 

the facility; that facilities may be 

represented by counsel; that the facility 

is entitled to present evidence on its 

behalf; that there be an orderly process 

for the hearing officer to make a 

decision on the basis of the record 

presented, including a record of 

decision and for intra-agency appeal of 

the hearing officer’s decision before it 

becomes final. Finally, a trade 

association pointed out a typographical 

error in proposed §§ 27.305(b) and 

27.310(a). 

Response: The Department has 

substantially revised the regulatory text 

in Subpart C, which includes Orders, 

adjudications, and appeals. The 

Department directs commenters to the 

revised regulatory text in Subpart C, as 

well as summary of those changes in 

§ II(B) Rule Provisions. In sum, the 

Department has included adjudicatory 

procedures for a proceeding before a 

neutral hearing officer whereby facilities 

and others may be represented by 

counsel and may present evidence. The 

procedures provide that the burden of 

proof rests with the Assistant Secretary 

and that a record will be compiled for 

an appeal within DHS. 

Comment: Several others provided 

input on cessation orders. A local 

government agency indicated that an 

Order to Cease Operations likely would 

be litigated immediately after issuance, 

and questioned how non-compliance 

during the lengthy litigation period 

would be remedied. Another commenter 

recommended that DHS add a provision 

stating that it would not enforce an 

order to cease operations within 30 days 

of a final action, which would allow the 

facility time to seek judicial review. An 

industry commenter stated that DHS’s 

professional assessment that a chemical 

facility was in total violation of the 

security requirements should result in 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17713 

an initial audit of what is required at 

that particular site to be in compliance. 

If, after a reasonable time, the facility 

does not come into compliance, then 

DHS should consider temporary closure 

until compliance is attained. An 

association expressed concern that DHS 

should consider whether a facility’s 

products are critical to the economy, 

chemical industry, or national security 

before imposing fines or issuing a notice 

to cease operations. 

Response: As noted above, the 

Department has substantially revised 

the regulatory text in Subpart C, which 

includes the provisions on Orders, 

adjudications, and appeals. Consistent 

with the statement in the Advance 

Notice, the Department realizes that an 

Order to Cease Operations would likely 

be litigated immediately after issuance. 

See 71 FR 78276, 78287. 

I. Adjudications and Appeals 

Comment: While commenters 

generally supported the processes 

proposed for objections and appeals, 

some thought that DHS should 

strengthen and expand the objections 

and appeals provisions. Several 

commenters suggested that DHS include 

additional provisions to the objections 

and appeals sections. One commenter 

recommended that DHS revise the rule 

to include a full description of the 

administrative review process, 

including the procedures to which all 

parties and the adjudicating official 

must adhere. Another commenter 

recommended that the Under Secretary 

and the Deputy Secretary have the 

authority to delegate their 

responsibilities as adjudicating officials. 

One commenter stated that the burden 

of proof should lie with DHS, not the 

order recipient, that recipients may be 

represented by counsel, that the 

recipient is entitled to present evidence 

on its behalf, that there be an orderly 

process for the hearing officer to make 

a decision on the basis of the record 

presented, including a record of 

decision, and for intra-agency appeal of 

the hearing officer’s decision before it 

becomes final. 

Response: DHS has reorganized the 

adjudications and appeals procedures, 

as discussed in the summary of rule 

provision changes to Subpart C. See 

§ II(B). Given that the rule already 

provides consultation opportunities, 

coupled with the fact that the 

Department has greatly modified its 

adjudications provisions, the 

Department believes it is unnecessary to 

retain the objections provisions from the 

Advance Notice (proposed §§ 27.205(c), 

27.220(b), and 27.240(c) and has thus 

removed them from the interim final 

rule. Of course, consultations are still 

available pursuant to various provisions 

in the rule including § 27.120(b). 

In addition, DHS now expressly spells 

out new procedures for adjudications 

and appeals. In particular, DHS has 

added adjudicatory procedures for a 

proceeding before a neutral hearing 

officer whereby facilities and others 

may be represented by counsel and may 

present evidence. The procedures 

provide that the burden of proof rests 

with the Assistant Secretary and that a 

record will be compiled for an appeal 

within DHS. The Secretary is expressly 

authorized to appoint individuals to 

serve as a neutral hearing officer. The 

Secretary and others retain their existing 

authority to delegate duties and 

responsibilities. 

Comment: Another commenter 

suggested that DHS revise the rule to 

provide some guidance and limitation 

on the number of requests that a facility 

will be permitted to make for additional 

information and on the maximum extent 

to which DHS will toll timeframes. One 

commenter noted that although there is 

authority for the Assistant Secretary to 

ask the facility for more information, 

there is no mechanism for the facility to 

seek further explanation that is needed 

for purposes of arguing its objection. 

Response: The revisions of the 

procedures substantially address these 

comments. The adjudications provisions 

empower a hearing officer to make 

decisions on the information to be 

accepted into each hearing record. 

Comment: Another commenter stated 

that, under the Advance Notice, a 

facility had the option of using the 

appeal procedure (instead of the 

objection procedure) for challenging the 

disapproval of its SSP. The Advance 

Notice stated that orders are stayed until 

the administrative appeal is completed, 

but the Advance Notice did not provide 

specifically for the disapproval of a SSP 

to be stayed pending the administrative 

appeal. The commenter suggested that 

DHS should make such a stay explicit. 

Another commenter argued that, 

because timelines are short, facilities 

will be forced to complete the SVA and 

SSP regardless of the outcome of the 

appeal, thus rendering the appeals 

process moot. If a facility objects to a 

determination, whether it is opposing 

either the overall assessment of ‘‘high 

risk’’ or the specific tier assignment, one 

commenter recommended that DHS 

should issue a decision on objection 

before the facility is required to 

implement any additional measures—

including both the SVA and SSP. 

Response: The addition of the factual 

adjudication procedure, with provisions 

on the effectiveness of administrative 

actions during adjudications and 

appeals, substantially address these 

comments. The adjudications and 

appeals sections provide that, absent 

exigent circumstances, Orders are 

stayed pending the completion of 

proceedings. 

Comment: Another commenter 

indicated that §§ 27.205(c)(1), 

27.220(b)(1), and 27.240(c)(1) (of the 

Advance Notice) cite ‘‘within 20 

calendar days’’ as the deadline for filing 

objections regarding the high risk 

determination, risk-based tiering, and 

disapproval of site security plans. In 

contrast, §§ 27.215(c), 27.305(d), and 

27.320(b)–(d) (of the Advance Notice) 

cite ‘‘within 30 calendar days’’ for 

certain deadlines regarding notification, 

appeals, and payments of civil 

penalties. The commenter believed that 

having two different deadlines for 

various actions under the regulatory 

program is burdensome to both DHS 

and the regulated facilities, and 

requested that all ‘‘within 20 calendar 

days’’ be amended to ‘‘within 30 

calendar days’’ to provide more 

consistency within the Department’s 

regulatory program. Another commenter 

urged that an appeal must be filed 

within 30 calendar days of when the 

order is issued should be changed to 

within 30 calendar days of when the 

order is served. See § 27.320(b) of the 

Advance Notice. 

Response: The Department’s revisions 

to the adjudications and appeals 

provisions substantially address these 

comments. The rule continues to permit 

consultations but does not set hard and 

fast time periods for such consultations. 

See, e.g., § 27.120(b), § 27.240(b), and 

§ 27.245(b). With respect to the time 

periods for adjudications and appeals, 

the revised procedures provide that 

adjudications and appeals must be 

commenced with stated time periods 

after ‘‘notification.’’ See, e.g., 

§ 27.310(b)(2) or § 27.345(b)(2). 

Comment: One commenter 

recommended that the regulations 

provide specifically that DHS would 

make available to the public nonconfidential summaries of 

determinations on appeals. The 

commenter also recommended that the 

regulations contain specific statements 

that objections and appeals may be 

submitted as CVI. 

Response: The adjudication and 

appeal sections contemplate that the 

hearing officer or appeal officer will 

make the necessary decisions 

concerning the handling of CVI. There 

is nothing in the procedure to prevent 

a facility or other person from relying on 

CVI. 


rwilkins on PROD1PC63 with RULES_2
17714 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

J. Information Protection: Chemicalterrorism Vulnerability Information 

(CVI) 

The Advance Notice identified a 

category of Chemical-terrorism 

Vulnerability Information (CVI) and set 

forth rules governing the maintenance, 

safeguarding, and disclosure of 

information and records that constitute 

CVI. 

1. General 

Comment: Several commenters 

maintained that the proposed rule 

undermined enforcement, 

accountability, and the credibility of the 

program through excessive secrecy. One 

of these commenters thought that the 

proposed regulations pose a threat to 

existing right-to-know laws, while 

another stated that people might be well 

aware of security gaps and 

vulnerabilities at specific facilities, and 

yet would have no official channel to 

communicate concerns to DHS. 

Response: As Congress recognized in 

section 550(c), protecting CVI from 

public disclosure is crucial to DHS’s 

ability to ensure that chemical facilities 

are as secure as possible against a 

terrorist attack. CVI information may 

reveal, among other things, current 

vulnerabilities or other details of a 

chemical facility’s security capabilities 

that could be exploited by terrorists. In 

addition, limited and controlled public 

disclosure of CVI is essential to fostering 

the necessary relationship and 

information flow between the 

government and private sector. Indeed, 

because the chemical security regime 

relies to an extent in the first instance 

on the veracity and completeness of the 

information provided by chemical 

facilities, it is of the utmost importance 

that those facilities are comfortable that 

such information—which may include 

proprietary information—will not be 

unduly exposed to public view. 

In crafting the Advance Notice, DHS 

attempted to balance these concerns 

with the desire to enhance information 

sharing, as appropriate. We believe that 

the rule adequately does this by 

ensuring that any entities or individuals 

with a ‘‘need to know,’’ including 

appropriate State and local officials, 

will have access to the necessary CVI, 

while, at the same time, and consistent 

with congressional intent, protecting 

CVI from public disclosure that would 

undermine the government’s ability to 

ensure the security of chemical 

facilities. 

To the extent that this approach 

conflicts with existing state ‘‘right to 

know’’ or ‘‘sunshine’’ laws, we believe 

that such laws are preempted by this 

IFR. At this time, we do not intend to 

displace or otherwise affect any 

provisions of Federal statutes, including 

the Emergency Planning and 

Community Right to Know Act, 42 

U.S.C. 11001 et seq., or section 112(r) 

and 114 of the Clean Air Act of 1990, 

as amended, 42 U.S.C. 7412(r), 7414, 

sections 308 and 402 of the Clean Water 

Act, 33 U.S.C. 1318, 1342, and section 

104(e)(7) of the Comprehensive 

Environmental Response, 

Compensation, and Liability Act, 42 

U.S.C. 9604. 

We also believe that any potential 

gaps in a facility’s security will be 

addressed through the government’s 

close involvement with chemical 

facilities as a result of this rule. 

2. Disclosure of CVI 

Comment: While some of the 

commenters found the provisions to be 

inadequately protective of chemical 

industry information, others found the 

disclosure rules to be too restrictive. A 

few commenters urged the Department 

to include language requiring 

notifications to facilities in cases of CVI 

disclosure to unauthorized parties. The 

commenters noted that a facility has a 

need to know if sensitive information 

pertaining to its site has been or might 

have been disclosed. A commenter, 

concerned over how the CVI rules may 

affect third-party audits of security 

measures and documents that may be 

submitted to the Department as 

Alternative Security Plans, requested an 

interpretation of DHS’s approach. 

Taking the point further, another 

commenter did not believe it was in a 

company’s best interest to provide 

copies of CVI to outside parties, as 

currently allowed under the proposed 

rule. The commenter would prefer the 

proposed rule be amended to require 

CVI be made readily available to 

authorized Department representatives 

only when they conduct on-site visits. 

One commenter encouraged the 

Department to adopt non-disclosure 

protections for verbally transmitted or 

obtained CVI. The commenter noted 

that information sharing among a 

covered facility and authorized 

individuals may require verbal 

communication as much as it will 

require written communication. To 

further protect against disclosure, some 

commenters believed that proposed 

§ 27.400(j) should be enhanced so that it 

has a meaningful deterrent effect and 

establishes consequences that reflect the 

seriousness of the violation. The 

commenter suggested that the 

Department adopt administrative 

penalties similar to those outlined by 6 

CFR 29.9(d). 

In addition, some commenters 

requested provisions to protect 

whistleblowers by stating that no 

criminal charges be associated with 

disclosing information marked as CVI in 

manner complying with whistleblower 

protections. 

Response: Under § 27.400(c)(3) of the 

Advance Notice, ‘‘any person who 

* * * receives or gains access to what 

they know or should reasonably know 

constitutes CVI’’ is a ‘‘covered person’’

and therefore has a duty to protect that 

CVI in the manner provided in 

§ 27.400(d). This includes the duty to 

promptly inform the Assistant Secretary 

‘‘when a covered person becomes aware 

that CVI has been released to persons 

without a need to know * * *.’’ See 

§ 27.400(d)(7). We expect that in the 

event DHS is so notified, it will notify 

the affected chemical facility. 

To the extent DHS determines that it 

is appropriate to use third-party 

auditors in the future for certain 

chemical facilities, the auditors will 

have a ‘‘need to know’’ under 

§ 27.400(e)(1)(i) as persons who 

‘‘require[ ] access to specific CVI to 

carry out chemical security activities 

* * * directed by the Department.’’

Moreover, under § 27.400(e)(3), DHS 

retains the discretion to require that any 

individuals with a need to know, 

including third-party auditors, complete 

appropriate background checks before 

obtaining access to CVI. We believe that 

these safeguards are sufficient to ensure 

that CVI is adequately protected from 

improper disclosure, even if it may be 

handled by third-party auditors. 

Section 27.400(b) of the Advance 

Notice, which defines CVI, currently is 

ambiguous as to whether it includes 

information conveyed verbally as well 

as in written form. DHS believes that 

concerns over public disclosure of CVI 

are the same regardless of the manner in 

which the information is conveyed. 

Accordingly, we have amended this 

section to read as follows: ‘‘In 

accordance with section 550(c) of the 

Department of Homeland Security 

Appropriations Act of 2007, the 

following information, whether 

transmitted verbally, electronically, or 

in written form, shall constitute CVI.’’

We believe that § 27.400(j) gives the 

Department broad latitude to craft a 

civil remedy sufficient to deter the 

unauthorized disclosure of CVI. The IFR 

does not provide for any criminal 

penalties for disclosure of CVI. 

3. Scope of CVI 

Comment: A number of commenters 

expressed concern regarding the scope 

of CVI. The commenters wanted the 

interim final rule to declare that 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17715 

information developed under other 

requirements of law or regulation 

cannot be designated as CVI under this 

program. Similarly, a commenter 

suggested that DHS narrow the scope of 

CVI by removing from the rule 

§ 27.400(b)(9), which defines CVI to 

include ‘‘[a]ny other information that 

the Secretary, in his discretion, 

determines warrants the protections set 

forth in this part.’’

Response: As outlined in the Advance 

Notice, the Department intends CVI to 

include only that information developed 

and/or submitted pursuant to Section 

550(c). Accordingly, any information 

resulting from other statutory regimes is 

not considered CVI. The Department 

believes, however, that the Secretary 

must retain the discretion provided in 

§ 27.400(b)(9). As the Department and 

private sector gain more experience 

with the chemical security regime set 

forth herein, the Department may 

determine that other types of 

information, not covered in the current 

definition of CVI, require similar 

protection. Section 27.400(b)(9) is also 

necessary to cover any unique or novel 

information that the Department may 

deem, on a case-by-case basis, requires 

protection from public disclosure. 

4. Relation of CVI to Other Categories of 

Protected Information and FOIA 

Comment: Some commenters were 

confused by the different categories of 

protected information. One commenter 

stated that the proposed regulations are 

not sufficiently clear on the relationship 

of CVI to SSI and other relevant 

methods of information protection. The 

commenter indicated that the interim 

final rule should clarify how these 

information protection regimes will 

relate to each other. A few commenters 

believed that the creation of the new 

CVI category of information protection 

is redundant and unnecessary given that 

current protections, such as SSI, are 

adequate options for the Department to 

implement the statutory restrictions. 

One commenter noted that the 

‘‘Safeguards’’ classification for the 

Nuclear Sector seems to parallel the 

proposed ‘‘CVI’’ classification for the 

Chemical Sector. The commenter 

questioned whether the Department is 

considering inventing new security 

classifications for each of the 15 Critical 

Infrastructure Protection Sectors. The 

commenter would prefer that the 

Department develop a new Category of 

Information Classification for all 17 

sectors for security-specific or securityrelated information that are, at a 

minimum, the same as those for the 

current ‘‘Safeguards’’ classification 

program. 

Two commenters recommended that 

the interim final rule clarify that CVI 

protections would be in addition to any 

other applicable bases for nondisclosure 

of information under the Freedom of 

Information Act (FOIA), such as the 

Trade Secrets Act and its protections are 

for confidential business information. 

Another commenter noted the provision 

gives the Department discretion to 

refuse release of part of a record under 

FOIA that contains no CVI, when 

another part of the same document 

contains CVI. The commenter suggests 

that this proposal is at odds with 

longstanding FOIA mandates and 

practice. Furthermore, the commenter 

noted that, if a portion of a requested 

record contains no CVI and is 

reasonably segregable from other parts 

of the record that do, there is no 

authority or justification for 

withholding that CVI-free portion unless 

some other FOIA exemption or 

exclusion applies. 

Response: It is the Department’s view 

that the language of Section 550(c) calls 

for a unique information protection 

regime. As stated in the preamble of the 

Advance Notice, in creating CVI, the 

Department looked to and drew on 

various aspects of those information 

protection regimes currently in 

existence, including, SSI, PCII and SGI. 

Moreover, as the Advance notice makes 

clear, the Department intended CVI to 

track the existing SSI regime in certain 

respects and indeed, borrowed 

somewhat from that regime’s structure 

and provisions (e.g., requiring a ‘‘need 

to know,’’ storage in a secure container, 

etc.) None of these regimes, however, is 

sufficient to accommodate the 

protections Congress called for in 

Section 550(c), most notably, that any 

information developed pursuant to 

Section 550(c) be treated as classified 

information in the course of 

enforcement proceedings. For this and 

other reasons, the Department 

developed CVI, which is separate and 

distinct from SSI, PCII, SGI or any other 

pre-existing information protection 

regime. 

Section 550(c) pertains only to 

chemical facilities and thus this rule 

does not speak to the handling of other 

critical infrastructure sectors. That said, 

the Department does not take the 

creation of a new information protection 

regime lightly, especially in light of the 

President’s Memorandum for Heads of 

Executive Departments and Agencies of 

December 16, 2005, entitled ‘‘Guidelines 

and Requirements in Support of the 

Information Sharing Environment.’’

Absent express direction from Congress, 

as in Section 550(c), the Department is 

reluctant to create additional regimes. 

In drafting the rule, the Department 

did not intend for its restrictions on 

public disclosure to displace separate 

and additional statutory restrictions on 

the public disclosure of confidential 

business information. 

The terms and structure of Section 

550 clearly preclude public disclosure 

of CVI. For this reason, it is the 

Department’s view that CVI, like SSI 

and PCII, is exempt from FOIA 

disclosure under Exemption 3 of FOIA. 

See 5 U.S.C. 552(b)(3). Exemption 3 

provides, in part, that information is 

exempt from disclosure by operation of 

another statute, provided that such 

statute either: ‘‘(A) requires that the 

matters be withheld from the public in 

such a manner as to leave no discretion 

on the issue; or (B) * * * provided that 

such statute refers to particular types of 

matters to be withheld.’’ Id. Section 

550(c) provides in relevant part that 

‘‘information developed under this 

section, including vulnerability 

assessments, site security plans, and 

other security related information, 

records, and documents, shall be given 

protections from public disclosure 

consistent with similar information 

developed by chemical facilities subject 

to regulation under section 70103 of 

title 46 [the Maritime Transportation 

Security Act (MTSA)] * * *.’’ MTSA 

states that ‘‘information developed 

under this chapter is not required to be 

disclosed to the public.’’ 46 U.S.C. 

70103. Under this language, it is 

conceivable that the government has 

discretion to release information to the 

public. See Church of Scientology of 

Calif. v. U.S. Postal Serv., 633 F.2d 

1327, 1330 (9th Cir. 1980). As stated in 

the Advance Notice, however, 

‘‘information developed’’ under MTSA 

is treated as SSI and, unlike MTSA, the 

statute governing SSI (49 U.S.C. 114(s)) 

states that the government ‘‘shall 

prescribe regulations prohibiting the 

disclosure of information * * *.’’

(Emphasis added.) This language has 

been interpreted as constituting the 

‘‘absolute’’ prohibition required to 

invoke the exception of Subsection (A). 

See Chowdhury v. Northwest Airlines 

Corp., 226 F.R.D. 608, 611 (N.D. Cal. 

2004). 

To the extent that there is some 

ambiguity as to which statute should 

govern for purposes of an Exemption 3 

analysis, it is our view that the SSI 

statute most accurately reflects 

Congress’s intent in section 550(c) and 

that, therefore, CVI should be exempt 

from FOIA disclosure under subsection 

(A) of Exemption 3. Nevertheless, we 

need not resolve the issue at this time 

because it is also our view that the 

language of section 550(c), which 


rwilkins on PROD1PC63 with RULES_2
17716 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

provides meaningful limits on the 

universe of information subject to 

withholding, is sufficient to justify 

withholding CVI from FOIA disclosure 

under subsection (B) of Exemption 3. Cf. 

Fin. Corp. v. Donovan, 830 F.2d 1132, 

1138 (D.C. Cir. 1989) (holding provision 

of Trade Secrets Act failed to qualify for 

subsection (B) exemption because of 

‘‘exceedingly broad,’’ ‘‘oceanic,’’ and 

‘‘encyclopedic’’ quality of the Act). The 

Department believes that it adequately 

expresses this conclusion in 

§ 27.400(g)(1), which states that: 

‘‘Except as otherwise provided in this 

section, and notwithstanding the 

Freedom of Information Act (5 U.S.C. 

552), the Privacy Act (5 U.S.C. 552a), 

and other laws, records containing CVI 

are not available for public inspection or 

copying, nor does DHS release such 

records without a need to know.’’

(Emphasis added.) Moreover, even if 

FOIA did apply to CVI, we believe that 

it would be exempt from disclosure, 

inter alia, as ‘‘homeland security 

information’’ under FOIA Exemption 2. 

See 5 U.S.C. 552(b)(2). 

The commenters’ concern that, if a 

document is portion marked to signify 

both CVI and non-CVI, the Department 

intends to withhold the entire document 

under FOIA, is not supported by the 

Advance Notice. Section 27.400(g)(2) 

states to the contrary that: ‘‘If a record 

is marked to signify both CVI and 

information that is not CVI, DHS, on a 

proper Freedom of Information Act 

request, may disclose the record with 

the CVI redacted, provided the record is 

not otherwise exempt under the 

Freedom of Information Act or Privacy 

Act.’’ The use of ‘‘may’’ in this context 

was intended as permissive, assuming 

such disclosure is otherwise 

appropriate. 

5. Sharing CVI With State and Local 

Officials, the Public, and Congress 

Comment: Several comments sought 

greater access to CVI. Commenters 

stated that the Department should share 

CVI with State and local officials. 

Others noted that the definitions of 

‘‘covered persons’’ and ‘‘need-to-know’’

were overly narrow and heightened 

their concern that the Department 

would not provide information to State 

and local officials. One commenter 

noted that, to the extent information is 

shared directly with State or local 

officials, DHS should enter into 

agreements with them to ensure that 

CVI is sufficiently protected. Other 

commenters agreed that the Department 

should impose strict controls for the use 

of any facility-specific information by 

States and local governments. A 

commenter stated that information that 

is provided to California local agencies 

may be subject to the California Public 

Records Act, which if true, means that 

CVI in California may not be protected. 

A commenter recommended that the 

Department develop a method to share 

certain information with the public, 

such as whether a facility is in 

compliance with the security program, 

because the people who live in close 

proximity to a chemical facility deserve 

to know. The commenter recommended 

the disclosure of the Letters of Approval 

issued upon completion of a site 

inspection and audit. The Letters of 

Approval could be stripped of any 

sensitive information, but still provide 

some assurance that facilities are 

complying with security requirements. 

Finally, other commenters stated that 

the interim final rule should make clear 

that DHS is not authorized to withhold 

information from either House of 

Congress, or, to the extent of matter 

within its jurisdiction, any committee or 

subcommittee of Congress. 

Response: Congress clearly intended 

that CVI would be shared with State and 

local officials, including law 

enforcement officials and first 

responders, in appropriate cases. 

Section 550(c) states that ‘‘this 

subsection does not prohibit the sharing 

of such information, as the Secretary 

deems appropriate, with State and local 

government officials possessing the 

necessary security clearances, including 

law enforcement officials and first 

responders, for the purpose of carrying 

out this section, provided that such 

information may not be disclosed 

pursuant to any State or local law.’’ And 

the Department made clear in the 

preamble to the Advance Notice that 

‘‘[t]he Secretary shall administer this 

Section consistent with section 550, 

including appropriate sharing with State 

and local officials, law enforcement 

officials, and first responders.’’ See 71 

FR 78276, 78289. Furthermore, the 

importance of sharing CVI with 

appropriate State and local officials is 

reflected in the structure of the rule. For 

example, it is expected that chemical 

facilities will coordinate extensively 

with state and local officials—including 

the sharing of relevant CVI—in the 

course of completing the SSPs required 

under § 27.225. It is the Department’s 

view, therefore, that the language in the 

rule is sufficiently broad to accomplish 

this task. For example, we believe that 

State and local officials, including law 

enforcement officials and emergency 

responders, fall within § 27.400(e)(1)(i)’s 

definition of those with a need to know 

because they will require access to CVI 

to ‘‘carry out chemical facility security 

activities approved, accepted, funded, 

recommended, or directed by the 

Department.’’ Yet because many 

commenters have requested clarification 

on this point, the Department amends 

the § 27.400(e)(1) to read as follows: ‘‘A 

person, including a State or local 

official, has a need to know CVI in each 

of the following circumstances. * * * ’’

As stated above, to the extent any 

state law requires the public disclosure 

of information that is deemed CVI, it is 

the Department’s view that such laws 

are preempted by this rule. 

At this time the Department does not 

intend to provide a means of notifying 

the public about local chemical 

facilities. We will continue to consider 

this issue as the program progresses, 

however, and issue a subsequent notice 

if necessary. 

This rule does not attempt to displace 

or create any new law concerning the 

Department’s ability to withhold 

information from Congress. 

6. Litigation 

Comment: With respect to availability 

of CVI during litigation, some 

commenters supported the preamble 

statement that, in enforcement cases, the 

defendant and its counsel would have 

access to relevant CVI to enable them to 

prepare a full defense. Another 

commenter supported the Department’s 

proposal to prohibit the disclosure of 

CVI in civil litigation unrelated to 

Section 550 enforcement. Yet another 

commenter stated that, according to the 

proposed rule, information on routine 

chemicals used and produced in 

processes would be treated as CVI, and 

thus disclosed in litigation only in 

extraordinary circumstances. The 

commenter noted that, because personal 

injury and workers’ compensation 

claims are the consequences of handling 

many toxic substances, this provision 

would appear to bring these actions to 

an absolute halt, since these cases 

cannot be prosecuted without precise 

knowledge of the toxic substances at 

issue. Finally, a commenter cautioned 

the Department to limit those provisions 

governing disclosure in civil or criminal 

litigation to the authority delegated to 

the Department. The commenter saw 

nothing in the statute delegating the 

authority to issue binding regulations to 

govern a judicial proceeding. The 

commenter did think it helpful for the 

Department to publish regulations that 

express its own policies and 

interpretations, thereby affording others 

guidance as to what the Department’s 

preferred practices will be when 

litigation arises. 

Response: As stated above, Section 

550(c) requires CVI to be treated as 

classified information in the context of 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17717 

any enforcement proceedings. This 

novel mandate reflects the seriousness 

with which Congress viewed the 

protection of CVI from unnecessary 

disclosure in administrative or judicial 

enforcement proceedings and, by 

extension, any civil litigation unrelated 

to Section 550. The Department 

approach balances this concern with the 

need for individuals to have access to 

certain CVI, as appropriate, to defend 

themselves in enforcement proceedings. 

That said, it is not clear that the type 

of information involved in a worker’s 

compensation or tort claim would 

necessarily constitute CVI. The mere 

reference to a type of chemical may not 

readily fit into one of the categories of 

information under §§ 27.400(b)(1)–(9). 

However, even if it did, under 

§ 27.400(i)(6), the Secretary retains the 

discretion to release CVI in such 

proceedings. 

As explained in the preamble to the 

Advance Notice, Section 550(c) states 

generally that CVI shall be treated as 

‘‘classified material’’ in the context of 

any enforcement proceedings. Congress 

did not specify, though, whether the 

Department should look to the rules 

governing classified material in civil 

litigation or criminal litigation. The 

Department chose to mirror in large part 

the handling of classified material in 

civil litigation under 18 U.S.C. 2339B. It 

remains the Department’s view that this 

is a reasoned approach to effectuating 

Congress’s intent. 

7. Protection of CVI 

Comment: Other comments sought 

technical changes to make the rule more 

secure or user-friendly including: 

Prohibiting the transmission of CVI 

using electronic systems unless DHS is 

able to provide Military Grade/Quality 

Encryption Devices/Systems to the 

private sector or provide access to 

government locations where this 

equipment is available for private sector 

use; extending the safeguards that the 

CVI provisions require in proposed 

§ 27.400(d)(1) concerning ‘‘secure 

container[s], such as a safe,’’ to 

establishing secure databases; modifying 

requirements for marking every page of 

a CVI document with the words 

‘‘CHEMICAL-TERRORISM 

VULNERABILITY INFORMATION’’ and 

a lengthy warning statement; allowing 

facilities to mark only those pages of a 

document containing the CVI and the 

warning statement only be provided 

once per record, with per page reference 

to it as needed; indicating DHS’s 

intention to destroy, return, or permit 

reclassification of Top-Screen data 

pursuant to proposed § 27.400(k). 

Response: The Department believes 

that the protective measures required by 

§§ 27.400(d) and (f) are sufficient to 

adequately protect CVI. 

K. Preemption 

Comment: Section 27.405(a) of the 

Advance Notice proposed to preempt 

State and local laws, rules, and court 

decisions that conflict with, hinder, 

pose an obstacle to, or frustrate the 

regulation. Several chemical companies 

and associations endorsed the proposed 

preemption of State and local 

regulations because they believe that 

national risk-based, performance 

standards could be undercut by 

specification standards imposed by the 

States. These commenters expressed the 

concern that companies with multi-state 

operations could be subject to a 

confusing array of State programs. One 

commenter argued that varying State 

regulations also provide varying levels 

of protection, which the commenter did 

not think was Congress’s intent. Other 

commenters noted that Maritime 

Transportation Security Act (MTSA), 

which applies to facilities located on 

waterways, including chemical 

facilities, contains an express 

preemption provision. 

An equal number of comments from 

advocacy groups, State agencies, and 

Members of Congress opposed the 

Department’s position on preemption. 

These commenters cited the lack of 

express language in Section 550 and the 

legislative history to support their 

position that Congress did not intend to 

grant DHS express or implied authority 

to preempt State laws and regulations. 

A few commenters referred to a body of 

case law indicating a ‘‘presumption 

against preemption.’’ Other 

commenters, including Members of 

Congress, suggested Congress intended 

to resolve the issue of preemption in 

future chemical facility security 

legislation. Commenters also urged DHS 

to delete § 27.405 and allow the courts 

to determine the preemptive effect of 

the Department’s chemical facility 

regulations. 

A few commenters were concerned 

that the language in § 27.405 was so 

broad that it might be construed to 

preempt State health, safety, and 

environmental regulations. Similarly, 

one State requested that DHS modify the 

final provision to avoid any inadvertent 

preemption of Federal, State, or local 

health, safety, and environmental 

regulations. 

A few comments were directed at the 

appeals procedures for preemption 

decisions. One commenter disagreed 

with the lack of benchmarks that DHS 

would use to determine if preemption 

was called for and another added that 

the interim final rule should specify a 

reasonable time period for a decision to 

be rendered and for the decision to 

constitute a final administrative 

decision so that judicial relief could be 

sought. One association stated that the 

preemption decision process and 

appeals procedures did not include 

State government, thereby excluding the 

parties whose laws, rules, and public 

interests are most affected. The 

commenter proposed including a 

mandatory consultation process 

between the State and the facility before 

the DHS appeal, a joint hearing 

opportunity with the facility and State 

before DHS, a written decision, and 

State access to a judicial appeal for an 

adverse decision. 

Response: Please see the section 

below entitled ‘‘Executive Order: 13132: 

Federalism’’ for a response to these 

comments and a discussion of 

preemption. 

L. Implementation of the Rule 

Comment: The preamble stated that 

DHS is considering a phased 

implementation of the program. Several 

industry commenters and a State agency 

supported phased implementation 

because they agreed that DHS should 

take action on the most critical facilities 

first. One commenter warned that 

problems and issues should be 

addressed prior to implementation, and 

another commenter requested that DHS 

define what tiers apply to which phases. 

Two members of Congress asked DHS to 

clarify implementation for high-risk 

facilities beyond Phase I. 

Response: The Department will 

immediately and quickly address the 

highest risk facilities. At the same time, 

the Department will reach out to a 

broader class of facilities, (numbering in 

the many thousands), to gather 

information necessary for the 

Department to make risk-based tiering 

decisions. 

M. Other Issues 

1. Whistleblower Protection 

Comment: Many commenters thought 

that this regulation should provide 

‘‘whistleblower protection.’’ They 

explained that the regulation should 

protect employees that provide 

information on a facility’s security and 

safety from employer retaliation. 

Commenters suggested that workers are 

on the front lines, and therefore in the 

best position to participate in the 

development of Security Vulnerability 

Assessments and Site Security Plans. 

Commenters suggested that DHS create 

a system which would allow 


rwilkins on PROD1PC63 with RULES_2
17718 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

individuals to report vulnerabilities, 

shortcomings, and failures without the 

fear of retaliation from the company. 

Commenters requested that DHS change 

regulatory text to provide whistleblower 

protection to employees, with some 

suggesting that DHS should include the 

protections found in H.R. 5695 and S. 

2145. 

Response: Section 550 did not give 

DHS authority to provide whistleblower 

protection, and so DHS has not 

incorporated specific whistleblower 

protections into this regulation. The 

Department does, however, value frank 

information concerning security 

vulnerabilities. Employees with daily 

involvement at high-risk facilities can 

certainly be a valuable source of 

information. In the interest of providing 

some mechanism for employees to alert 

the Department about information at 

their employer’s chemical facility, the 

Department intends to establish a 

telephone line through which 

individuals can submit security 

concerns to the Department. The 

Department will provide callers with 

the option of remaining anonymous. 

2. Inherently Safer Technology 

Comment: The Department received 

numerous comments on the issue of 

inherently safer technologies (IST) 

options. Several commenters, including 

advocacy groups, unions, academics, 

State agencies, and other officials, 

strongly encouraged DHS to consider 

safer technologies as well as physical 

countermeasures. A few commenters, 

including members of Congress, 

suggested that the Department should 

address the use of ISTs, even though 

Section 550 was silent on the issue. 

Many of these commenters urged DHS 

to include provisions in the rule that 

would encourage chemical facilities to 

consider implementing safer processes 

and using safer chemicals as a method 

to improve site security through the 

reduction of risk. They suggested that 

DHS require chemical companies to 

analyze and report on safer technologies 

in their Site Security Plans. These 

commenters asserted that substituting 

safer chemicals, processes, practices, or 

technologies not only contributes to 

severity (i.e., can minimize the 

consequences associated with an 

accident at or attack on a chemical 

facility), but has the potential to greatly 

minimize the physical security costs a 

chemical facility would otherwise have 

to assume. Other commenters pointed 

out that ISTs are the best tools available 

to completely mitigate facility 

vulnerabilities and safeguard 

communities. 

In contrast, other commenters rejected 

the use of any IST requirements. Some 

argued that inherently safer 

technologies are an environmental 

construct and should not be implicitly 

or explicitly required for security. One 

association expressed concern that 

requirements for safer technologies 

could shift rather than reduce risk and/ 

or limit the production of certain 

chemicals. In addition, some 

commenters urged DHS to avoid 

including any ‘‘pseudo-IST mandates’’

in the rule; the commenter thought that 

DHS had inadvertently done so. 

Response: Section 550 prohibits the 

Department from disapproving a site 

security plan ‘‘based on the presence or 

absence of a particular security 

measure,’’ including inherently safer 

technologies. See Section 550(a). Even 

so, covered chemical facilities are 

certainly free to consider IST options, 

and their use may reduce risk and 

regulatory burdens. 

3. Delegation of Responsibility 

Comment: Another commenter 

strongly recommended that DHS 

consider delegating oversight 

responsibility to State governments, 

along with appropriate levels of Federal 

funding to support homeland security 

efforts. Interested states could petition 

DHS, and DHS would grant delegated 

authority on a discretionary basis. The 

commenter suggested that DHS could 

retain oversight authority, but would 

delegate programmatic responsibility 

and commit resources to authorized 

States. The commenter likened the 

arrangement to the one that the EPA 

uses to handle air and water regulations 

and the one that the Nuclear Regulatory 

Commission runs with its ‘‘Agreement 

State’’ program. Another State agency 

commenter noted that California has 

promulgated a successful chemical 

safety program built on partnering State 

and local regulatory interests with 

chemical industry hazard mitigation 

activities. 

Response: The Department has 

contemplated the issue of delegating 

authority to State governments, and has 

decided not to do so. If the Department 

reconsiders the issue in the future, it 

will provide notice of any such 

decision. 

4. Interaction With Other Federal Rules 

and Programs 

Comment: Many commenters pointed 

out potential overlap between this rule 

and other Federal agency rules. As one 

commenter stated, many Federal 

agencies have some involvement in 

chemical facility security, including 

DHS (including the U.S. Coast Guard 

and TSA), the Federal Bureau of 

Investigation (FBI), the Bureau of 

Alcohol, Tobacco, Firearms, & 

Explosives (ATF), the Departments of 

State, Commerce, and Transportation 

(including its modal administrations), 

EPA, and OSHA. Other commenters 

encouraged DHS to build upon the 

existing EPCRA and the Risk 

Management Program (RMP) regulatory 

programs, because of their proven 

records of success and the important 

health, safety, and environmental 

purposes that they serve. 

One commenter noted that DOT has 

security plan requirements in 49 CFR 

Part 172, Subpart I and that several of 

the DHS performance standards overlap 

with the DOT security plan 

requirements. One commenter asserted 

that the proposal in the Advance Notice 

attempted to cover up knowledge of 

toxic dangers by potentially ‘‘gutting the 

worker and public right-to-know 

provisions’’ of existing Federal and 

State laws, including the Occupational 

Safety and Health Act and the 

Emergency Planning and Community 

Right-to-Know Act (EPCRA). In 

addition, some of these commenters 

were concerned that preemption and 

CVI classification will restrict 

information flow and access currently 

available through these Federal 

regulatory programs. 

Several commenters expressed 

concern that, although DHS intends that 

this rule not affect other laws regulating 

manufacture, sale, use, and disposal of 

chemicals, it is unclear how the DHS 

security planning and enforcement can 

avoid impacting the environmental, 

occupational, trade, and other rules 

already regulating the same facilities. 

Potential conflicts also affect first 

responders. Since past conflicts over 

authority have tended to diminish 

program effectiveness, the commenter 

wonders how such conflicts can be 

avoided. Solutions offered by 

commenters include a more explicit 

statement on conflict resolution in the 

final rules, an inter-agency coordination 

process to resolve conflicts, or 

memoranda of agreement with agencies 

having concurrent authority. 

Response: The Department is aware 

that potential overlap exists between 

this rule and existing Federal rules and 

programs. In the Advance Notice, the 

Department acknowledged that overlap 

and included an extensive discussion of 

existing and proposed Federal programs 

that are related to chemical security. See 

§ I of the Advance Notice, ‘‘Brief History 

of Federal Pre-Existing Chemical 

Security Tools and Programs.’’

Section 550 provides that ‘‘[n]othing 

in this section shall be construed to 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17719 

supersede, amend, alter, or affect any 

Federal law that regulates the 

manufacture, distribution in commerce, 

use, sale, other treatment, or disposal of 

chemical substances or mixtures.’’ In 

the Advance Notice, after 

acknowledging that the ATF regulates 

the purchase, possession, storage, and 

transportation of explosives, the 

Department indicated that it did not 

intend for these regulations to interfere 

with ATF’s current authorities. See 71 

FR 78276, 78290. Likewise, the 

Department does not intend for these 

regulations to impede the authorities of 

other Federal agencies. With respect to 

this regulatory program, DHS will work 

closely with the Department of Energy, 

EPA, OSHA, ATF and other federal 

agencies. Where there is concurrent 

jurisdiction, the Department will work 

closely with other Federal agencies to 

ensure that regulated facilities can 

comply with applicable regulations 

while minimizing any duplication. As 

the program develops, the Department 

will consider the necessity of various 

formalized arrangements, such as an 

inter-agency coordination process, to 

resolve jurisdictional questions or 

conflicts. 

5. Third-Party Actions 

Comment: Several commenters 

supported the Advance Notice 

discussion of the statutory prohibition 

against third party actions to enforce 

any provision of the chemical security 

rules. See § 27.410 and Section 550(d). 

A State commenter wrote that the 

prohibition might be construed to 

prevent State actions against the 

Department to enforce the regulations, a 

position that the commenter believed to 

be contrary to congressional intent. The 

commenter agreed that the statutory 

language would bar a State from taking 

enforcement action against an owner or 

operator for violation of these 

regulations, but it saw no support in the 

statute to bar State action against the 

Department (or other non-owners or 

non-operators). According to the 

commenter, this interpretation exceeds 

the scope of Section 550 and is therefore 

an unnecessary limitation on private 

rights of action. Commenters asserted 

that a plain reading of Section 550 

indicates that Congress limited judicial 

review in only two ways: (1) By 

prohibiting Section 550 from being 

asserted as a jurisdictional basis for a 

cause of action; and (2) by providing 

that only the Secretary of Homeland 

Security has the right to bring 

enforcement actions against ‘‘owners 

and operators.’’ The commenters said 

they do not believe that Congress 

intended to prohibit other statutory 

causes of actions (such as review 

pursuant to the Administrative 

Procedure Act). 

Members of Congress also challenged 

the broad scope of DHS’s position on 

third-party suits, because it would block 

basic challenges to DHS under the 

Administrative Procedure Act. The 

commenters believed that § 27.410(a) 

was an unnecessary limitation on 

private rights of action. One Member of 

Congress explained that Congress 

intended to limit the provision to 

citizen suits against chemical facilities 

for failure to comply with the 

Department’s chemical security rules. 

One commenter strongly supported 

the Department’s discussion of the 

prohibition of private rights of action to 

enforce the provisions of Section 550. 

The commenter believed that the 

availability of enforcement actions 

should be limited to avoid unnecessary 

and potentially frivolous lawsuits that 

attempt to enforce chemical facility 

security requirements that are outside 

the reach of the government’s authority. 

Some commenters supported the DHS 

provision because they believed that 

third party actions should be limited 

and that the Department should have 

the sole discretion of when and how to 

enforce these regulations. One 

commenter stated that neither DHS nor 

regulated chemical facilities should be 

distracted from their purpose of 

minimizing the possibility of a 

catastrophic terrorist incident by 

concerns about how their actions 

implementing Section 550 might be 

used in private tort litigation. One 

industry organization supported 

§ 27.410(b), which allows a chemical 

facility to petition DHS to provide ‘‘the 

Department’s view in any litigation 

involving any issues or matters 

regarding this Part.’’ The commenter 

noted that DHS is in a unique position, 

in light of its Section 550 authorities 

and expertise, to provide its views 

regarding a chemical facility’s security 

efforts. 

A labor union expressed concern that 

§ 27.410(a) grants immunity to chemical 

facilities from actions by third parties to 

enforce any provisions of the rule. The 

labor union thought that it may act as 

an open invitation to chemical facilities 

to disregard provisions in the rules or in 

security plans that are meant to protect 

maritime activities from unduly 

burdensome or improper application of 

security procedures. The labor union 

explained that ‘‘[w]here damages are 

incurred by maritime-related businesses 

or mariners as a result of improper 

action of chemical facilities under color 

of enforcing their security plans, the 

injured parties should not be denied the 

normal recourse of the U.S. legal 

system.’’

Response: In § 27.410 of the Advance 

Notice, the Department set out two 

principles: (1) the chemical security 

regulations did not on their own terms 

create any additional rights of action for 

any person other than the Secretary; and 

(2) relevant parties may seek a statement 

from the Department of its views in any 

litigation involving the chemical 

security regulatory program. The 

Department has decided to adopt these 

provisions as proposed in the Advance 

Notice. 

In the preamble to the Advance 

Notice, the Department also stated its 

view that Section 550(d) prohibits any 

party other than the Secretary from 

enforcing the provisions of Section 550. 

The Department also stated its view that 

Section 550(d) prohibits actions brought 

to compel the Department to take a 

specific action to enforce Section 550. 

Although the Department does not find 

it necessary to codify these views in the 

Code of Federal Regulations, they 

remain the views of the Department 

after considering the comments 

received. In Section 550(d), Congress 

provided in clear terms its intent to 

prevent parties other than the Secretary 

from making enforcement decisions 

under Section 550. This intent would be 

thwarted if parties could seek indirectly 

to have particular enforcement measures 

taken by bringing suit against the 

Department. Such suits would also pose 

difficulties involving the information 

protections of Section 550 and its 

implementing regulations. In short, the 

terms and structure of Section 550 

provide the Secretary with critical 

discretion in implementing the 

chemical security program. It would be 

inappropriate to curtail that discretion 

through lawsuits. See generally Norton 

v. Southern Utah Wilderness Alliance, 

542 U.S. 55 (2004). 

6. Judicial Review 

Comment: Several commenters, 

including Members of Congress, urged 

DHS to incorporate the right to judicial 

review in the interim final rule and 

clarify the judicial remedies available. 

One commenter mentioned that the 

right to judicial review was expressly 

stated in prior legislative proposals. 

Another commenter believed that the 

District Courts have jurisdiction to 

consider whether a facility presents a 

‘‘high level of security risk.’’ Other 

commenters discussed judicial review 

in the context of preemption, urging the 

Department to provide facilities with 

the opportunity for judicial review of 

Departmental decisions pursuant to 

§ 27.405. Finally, one commenter 


rwilkins on PROD1PC63 with RULES_2
17720 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

recommended that the rule provide that 

if the adjudicating official fails to reach 

a decision within the timeframes 

provided by the proposed rule, then the 

administrative review process is 

deemed completed and all 

administrative remedies exhausted, so 

as to afford the facility the ability to 

challenge the Department’s decision in 

a District Court. 

Response: The Department does not 

have authority to create jurisdiction in 

the district courts for review of 

Department decisions. Jurisdiction is 

created by provisions of law other than 

these regulations. Nor does the 

Department have authority to create 

specific judicial remedies through 

rulemaking. Decision-making authority 

with respect to preemption is discussed 

below in the portion of this preamble 

related to Federalism. As discussed 

there, courts have the ability in 

appropriate contexts to review the 

Department’s opinions as they relate to 

preemption. This interim final rule does 

not augment the administrative law 

default principles that govern 

appropriate action if the Department 

does not make decisions in the 

timeframes specified in this interim 

final rule. 

7. Guidance and Technical Assistance 

Comment: Some industry commenters 

noted that guidance, information, and 

education were essential for the success 

of the program. A chemical company 

commented that facilities should have 

the opportunity to review and comment 

on any guidance provided to them by 

DHS. Several industry associations 

made the same comment and stated the 

need for guidance to provide direction 

and advice but not to become either 

enforceable or limiting in the security 

measures that a facility may employ. 

One commenter suggested that there 

be sufficient time to respond to the 

guidance prior to developing a security 

plan. Commenters suggested that DHS 

draft guidance on aspects of the 

regulation and that such guidance be as 

detailed and specific as possible. 

One commenter believed that, while 

agency guidance is procedurally easier 

to issue because agencies typically issue 

it without notice and comment, due 

process, or other protections afforded by 

rulemaking under the Administrative 

Procedure Act, this ‘‘pseudorulemaking’’ can be referenced in 

enforcement actions, imposing cost 

burdens, or creating other compliance 

liabilities. Another commenter 

appreciated the fact that the guidance 

would specify the security measures 

that facilities could take to meet the 

proposed standards while not 

mandating any particular measures that 

facilities should use. Commenters 

recommended that DHS follow the OMB 

Bulletin entitled ‘‘Agency Good 

Guidance Practices,’’ which establishes 

policies and procedures for the 

development, issuance, and use of 

significant guidance documents by 

Executive Branch departments and 

agencies. 

Response: DHS believes that guidance 

will play an important role in this 

regulatory program. The Department’s 

guidance will provide examples of 

specific measures that facilities may use 

to address the performance standards in 

the rule. Because this rule is based on 

performance standards and not on 

prescriptive measures, guidance is 

particularly important. The guidance 

will aid in informing the regulated 

community of ways to satisfy the 

performance standards without 

imposing additional requirements not 

found in these regulations. 

The Department will designate the 

guidance document as CVI. The 

guidance document will contain 

specific anti-terrorism measures 

designed to mitigate or prevent terrorist 

attacks, as well as other sensitive 

information. This type of information is 

not appropriate for public disclosure 

under Section 550 and the regulations 

issued hereunder. 

With respect to comments regarding 

OMB’s Bulletin on Agency Good 

Guidance Practices, the Department 

notes that it will apply the Bulletin as 

appropriate. 

Comment: The availability of 

technical assistance to facilities not 

placed in the top tier was requested by 

an industry association. 

Response: Technical assistance will 

be available for all covered facilities as 

resources permit. Section 27.120 

establishes requirements for a 

Coordinating Official who will provide 

guidance to facilities in all tiers, as 

necessary and to the extent that 

resources permit. 

8. Miscellaneous Comments 

Comment: One commenter 

recommended that DHS engage and 

work with Congress to enact a more 

comprehensive and meaningful 

chemical security law as soon as 

possible, and under no circumstances 

beyond the three year expiration of 

interim authority. 

Response: The Department has 

aggressively sought this authority, and 

on October 4, 2006, Congress provided 

that authority. The Department will 

continue to work with Congress on 

chemical security matters. 

Comment: One commenter supported 

the position that continued funding of 

this program would, in effect, 

reauthorize the program beyond the 

three years noted in the statute and that 

DHS may amend the interim final rule 

if necessary. Another commenter did 

not support this position and stated that 

the statute was clear that the regulatory 

authority expires after three years. That 

commenter also urged the Department 

to engage in notice and comment 

rulemaking for any future modifications 

to the interim final rule. 

Response: The Department will, to the 

extent required by law, engage in notice 

and comment rulemaking in the event 

that changes are made to this interim 

final rule. 

Comment: Commenters suggested a 

process by which facilities can exit the 

program if they make sufficient changes 

to their operations. In addition, a 

chemical company and an industry 

association questioned how the results 

from vulnerability assessments could be 

used to allow a facility to exit the 

program. 

Response: To address the issue of 

exiting the program, the Department 

added § 27.120(d). It provides that 

covered facilities may request a 

consultation with the Department if 

their facility, processes, or types or 

quantities of chemicals change in such 

a way that they believe their obligations 

under this part may be impacted. For a 

discussion of this provision, see § II(B) 

above. 

Comment: Various commenters raised 

issues related to data security, 

specifically in the context of the 

Department’s web-based CSAT 

applications. One commenter thought 

that DHS should be able to provide 

Military Grade/Quality Encryption 

Devices/Systems for the private sector to 

use to submit information. Until that 

time, the commenter requested that DHS 

receive information only in paper form 

or discs produced on stand-alone 

computers. 

Response: DHS recognizes the data 

security issues that commenters have 

raised. DHS realizes that there is a risk, 

both on the sending of information and 

the receiving of information, when 

transmitting data over the Internet. DHS 

has weighed the risk to the data 

collection approach against the risk of 

collecting the data through paper 

submissions and concluded that the 

web-based approach was the best. 

DHS is concerned about data security 

and has taken a number of steps to 

protect both the data that will be 

collected through the CSAT program 

and the process of collection. The 

security of the data has been the system 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17721 

designers’ number one priority. The site 

that the Department will use to collect 

submissions is equipped with hardware 

encryption that requires Transport Layer 

Security (TLS), as mandated by the 

latest Federal Information Processing 

Standard (FIPS). The encryption devices 

have full Common Criteria Evaluation 

and Validation Scheme (CCEVS) 

certifications. CCEVS is the 

implementation of the partnership 

between the National Security Agency 

and the National Institute of Standards 

(NIST) to certify security hardware and 

software. 

Upon completing any part of the 

CSAT (whether the Top-Screen, 

Security Vulnerability Assessment, or 

Site Security Plan), the facility will click 

a ‘‘submit’’ button, which calls a routine 

to encrypt the data on the server using 

a one way key. Properly-executed public 

key encrypted data is very secure, and 

the implementation that DHS has used 

complies with the NIST 800–57 

requirements for security. The key to 

decrypt the data does not exist outside 

of facilities that are isolated from the 

public internet. The key is connected 

only through a dedicated, restricted, 

government network that cannot 

connect to the public internet. Once a 

facility submits a Top-Screen (or SVA or 

SSP), the data is no longer available 

unencrypted. 

Comment: A few commenters 

indicated that the Advance Notice 

lacked meaningful worker involvement. 

According to some of the commenters, 

the rule does not ensure meaningful 

front line worker and union 

participation during risk assessments, 

during the development of the Site 

Security Plans, in the inspection 

process, or as part of ongoing 

consideration of safety and security 

concerns. One commenter felt that this 

omission occurred despite the fact that 

it is the front line employee whose life 

is on the line first if there is a 

catastrophic release. 

Response: There is nothing in the rule 

that prohibits chemical facilities from 

involving employees in their security 

efforts. Many facilities may find it 

beneficial to include employees in their 

respective efforts to comply with this 

regulation (e.g., identifying security 

vulnerabilities, developing Site Security 

Plans). However, the Department is not 

mandating participation by any 

particular type of employee, and the 

Department does not think it is wise to 

specify any employees that must be 

involved. The Department will leave 

those decisions to facilities, as they will 

best understand the types and functions 

of employees at their facility and the 

extent to which any given type of 

employee may be able to contribute. 

Comment: A commenter noted that a 

strong enforcement program is essential. 

Response: The Department agrees 

with the commenter and will vigorously 

enforce these regulations. 

Comment: A few commenters sought 

immediate phased-in implementation of 

a national re-routing and a ban on toxic 

by inhalation (TIH) storage wherever 

feasible. Although the commenters 

stated that re-routing is the first and 

fastest step in eliminating catastrophic 

vulnerabilities in the chemical sector, 

the commenters thought it should 

ideally be done in tandem with the use 

of safe technology, which could in turn 

eliminate ultra-hazardous substances in 

our rail system. 

Response: These comments are 

beyond the scope of this rulemaking, 

which addresses chemical facility antiterrorism standards. However, DHS 

points out that there are current DHS 

and other Federal initiatives to address 

materials that are toxic by inhalation. 

On December 21, 2006, TSA issued a 

Notice of Proposed Rulemaking on Rail 

Transportation Security. See 71 FR 

76852. The rule applies, in part, to tank 

cars containing materials that are 

poisonous by inhalation (PIH) as 

defined in 49 CFR § 171.8. (Note that the 

PIH is synonymous with TIH). See 

proposed 49 CFR § 1580.100(b). Also, on 

December 21, 2006, one of the 

Department of Transportation’s modal 

administrations, the Pipelines and 

Hazardous Materials Administration 

(PHMSA), issued a Notice of Proposed 

Rulemaking titled ‘‘Hazardous 

Materials: Enhancing Rail 

Transportation Safety and Security for 

Hazardous Material Shipments.’’ See 71 

FR 76834. PHMSA’s proposed 

regulation would include requirements 

for rail carriers to use data to analyze 

safety and security risks along rail 

transportation routes where certain 

hazardous materials (including PIH 

materials) are used. 

Comment: Some commenters raised 

questions regarding specific funding for 

programs such as the BZPP Webcam 

Pilot Program. 

Response: Those comments are 

beyond of the scope of this rulemaking, 

which addresses chemical facility antiterrorism standards. 

N. Regulatory Evaluation 

Comment: Commenters believe that 

DHS has underestimated this cost to the 

chemical sector and that DHS should 

consider other costs beyond capital 

costs, such as additional physical 

security. 

Response: In the Advance Notice, 

DHS did not attempt to estimate the full 

cost of complying with the regulation. 

Instead, DHS placed in the docket a 

stand-alone document titled ‘‘Capital 

Cost Information for Public Comment,’’

which provides specific cost estimates 

for a potential suite of capital security 

investments, such as fences and 

perimeter lighting. DHS fully 

understands that, in addition to capital 

costs, facilities may also incur noncapital costs, including the costs of 

additional personnel (e.g., security 

guards) and the costs of preparing 

assessments and plans. The costs that 

DHS has estimated for compliance with 

the interim final rule do indeed include 

both the capital costs and non-capital 

costs. 

DHS also notes that while a few 

commenters thought the costs DHS 

presented were too low, commenters 

did not generally provide specific 

information regarding which costs may 

have been too low or additional 

information that would have assisted 

the Department in reconsidering the 

costs presented with the Advance 

Notice. Consequently, while DHS did 

re-evaluate the costs presented with the 

Advance Notice in response to these 

comments, DHS believes that the costs 

presented in the Advance Notice are 

reasonable approximations, and they 

remain unchanged in the interim final 

rule. 

Some commenters indicated that cost 

recovery for implementation can be 

difficult under certain government 

contracts. Such comments are outside of 

the scope of this rulemaking. 

Comment: Commenters also 

expressed concern that the high costs 

will give an unfair advantage to larger 

companies, because these associated 

costs will be harder for smaller 

companies (like local farmers) to absorb. 

Response: The Department notes, in 

general, that it may be more difficult for 

smaller companies to absorb increased 

costs than larger companies. However, 

the security measures required by this 

interim final rule are not ‘‘command 

and control’’ type measures. Instead, 

they are risk-based performance 

measures that will allow a high degree 

of flexibility for small entities that own 

high-risk chemical facilities. These riskbased performance measures will allow 

high-risk chemical facilities to tailor a 

specific regulatory compliance regime 

that could minimize the compliance 

costs to their respective facilities. DHS 

also notes that certain chemical 

facilities have already voluntarily spent 

a significant amount of financial 

resources to increase their security. This 

interim final rule, by establishing a 


rwilkins on PROD1PC63 with RULES_2
17722 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

baseline level of security across tiers, 

will serve to minimize any competitive 

advantage that may be currently enjoyed 

by those companies that are underinvesting in security. 

Comment: One commenter noted that 

in order to quantify the benefits of the 

rule, DHS must make assumptions about 

the threats to the public, which injects 

uncertainty into the calculation of 

actual benefits. 

Response: The Department agrees that 

it is difficult to quantify the ‘‘actual 

benefits’’ of this interim final rule. DHS 

has included a qualitative discussion of 

the benefits of this rule in the regulatory 

analysis of Executive Order 12886, 

which is located in Section IV of the 

preamble to this rule. 

Comment: Commenters noted that the 

idea of a model facility is indeed a good 

proposal but worried that there is 

insufficient time to implement the 

changes this proposal would entail. 

Response: DHS agrees that the idea of 

model facilities is a good proposal. The 

cost estimate of the interim final rule is 

based on the concept of the ‘‘model 

facility’’ as it was used by the Coast 

Guard to estimate the cost of their 

Maritime Transportation Security Act of 

2002 Facility Security final rule. See 68 

FR 60515 (Oct. 22, 2003). 

Comment: The Small Business 

Administration (SBA), Office of 

Advocacy, commented that DHS should 

prepare an Initial Regulatory Flexibility 

Analysis (IRFA) under the Regulatory 

Flexibility Act (RFA), 5 U.S.C. 603, after 

issuing the interim final rule or if DHS 

makes subsequent changes to the rule 

once it is promulgated. SBA explained 

that the RFA process is an extremely 

valuable tool for agencies to use when 

assessing the impact of a rule on small 

businesses and other small entities. 

Response: The RFA mandates that an 

agency conduct an analysis when an 

agency is required to publish a notice of 

proposed rulemaking. See 5 U.S.C. 

603(a). In this case, the Department is 

not required to publish a notice of 

proposed rulemaking: By directing the 

Secretary to issue ‘‘interim final 

regulations’’, Congress authorized the 

Secretary to proceed without the 

traditional notice-and-comment 

required by the Administrative 

Procedure Act. See 71 FR 78276, 78277, 

and 78292 (Dec. 28, 2006). 

DHS did, however, consider the 

impacts of this rule on small entities. 

The Regulatory Assessment, which is 

available in the public docket, contains 

our analysis of the impacts of this rule 

on small entities. After consideration of 

the percentage of small entities that may 

have to comply with the risk-based 

performance standards required by this 

rule and the compliance costs explained 

in the Regulatory Assessment, we have 

determined that this rule may have a 

significant economic impact on a 

substantial number of small entities. See 

‘‘Regulatory Flexibility Act’’ section 

below. 

IV. Regulatory Analyses 

A. Executive Order 12866: Regulatory 

Planning and Review 

This rule is considered to be an 

economically significant regulatory 

action under Executive Order 12866, 

because it will result in the expenditure 

of over $100 million in any one year. 

Accordingly, this rule has been 

reviewed by the Office of Management 

and Budget (OMB). A Regulatory 

Assessment which more thoroughly 

explains the assumptions used to 

generate the cost of this interim final 

rule is available in the docket as 

indicated under ADDRESSES. A summary 

of the Regulatory Assessment follows: 

Cost Assessment Summary 

Section 550 requires the Secretary of 

Homeland Security to promulgate 

‘‘interim final regulations establishing 

risk-based performance standards for 

security of chemical facilities * * *.’’

He must do so ‘‘[n]o later than six 

months’’ from the date of enactment of 

this new authority, i.e. by April 4, 2007. 

Consequently, the methodology chosen 

to analyze the cost of the interim final 

rule was chosen with the six month 

congressional deadline in mind. In 

order to quickly analyze the cost of the 

interim final rule, DHS relied on readily 

available information and drew upon 

the knowledge of professionals 

employed by DHS who have extensive 

knowledge of the chemical industry. In 

addition, on December 28, 2006, DHS 

published an Advance Notice, which 

outlined our costing methodology and 

also placed in the docket our estimates 

of capital costs for potential security 

investments in order to seek meaningful 

public comment. 

We have reviewed the methodology 

used by the U.S. Coast Guard to analyze 

the cost of the MTSA Facility Security 

final rule at 68 FR 60515 (Oct. 22, 2003), 

and, due to the similarities between the 

MTSA Facility final rule and this 

interim final rule, we believe that this 

methodology has merit and should be 

used in this rulemaking. The MTSA 

Facility Security final rule estimated the 

cost of performance standards on 

several thousand unique facilities. 

Similarly, the interim final rule will 

estimate the costs of risk-based 

performance standards to several 

thousand unique facilities. The Coast 

Guard found it impractical to attempt to 

estimate compliance costs for each 

individual facility and instead 

developed costs based on 16 ‘‘model 

facilities.’’ Each of the several thousand 

facilities was placed into one of the 16 

different subgroups for which 

compliance costs were then estimated. 

Once the compliance costs for the 16 

‘‘model facilities’’ were calculated, 

estimating the cost of the regulation was 

relatively straightforward. 

As this regulation is not a ‘‘command 

and control’’ regulation, owners and/or 

operators will have considerable 

flexibility in how they choose to comply 

with its requirements. As owners and/ 

or operators will have discretion on how 

to best meet the risk-based performance 

objectives, the cost assessment makes 

broad assumptions regarding the 

percentage of facilities that will choose 

to implement or continue certain 

security measures and the costs of those 

security measures. For example, many 

facility owners and/or operators will 

choose such measures as building 

fences, enhancing perimeter lighting, 

and hiring additional security guards in 

order to comply with the risk-based 

performance standards. In order to 

estimate the cost of the interim final 

regulation, we made assumptions 

regarding the specific percentage of 

facilities that will choose to implement 

certain security measures, such as 

fences and perimeter lighting. 

We expect that chemical facility 

owners and/or operators will take full 

advantage of the flexibility that these 

risk-based performance standards will 

provide and will conduct facilityspecific and company-specific analyses 

to determine the most cost-effective 

method to comply with the 

requirements of this interim final 

regulation. As a result of these internal 

analyses, facilities are likely to identify 

various means of meeting the risk-based 

performance standards applicable to 

their facility and tier. It is possible that 

some percentage of facilities will find 

the most-cost effective method to 

comply with the requirements will be to 

implement business and related 

production, processing or equipment 

changes such as to no longer make 

certain chemicals or to change their 

process to use a less concentrated or less 

hazardous form of a listed chemical. 

Such process changes, however, are 

very facility-, business- and processspecific. Those that involve changes in 

chemistry or processes may take several 

years of design, testing and repermitting before they can become 

operational. Others may be easily and 

immediately implemented. However, 

because process changes are so facilityVerDate Aug<31>2005 22:10 Apr 06, 2007 Jkt 211001 PO 00000 Frm 00036 Fmt 4701 Sfmt 4700 E:\FR\FM\09APR2.SGM 09APR2

rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17723 

2Section 550(b) of the Act states: ‘‘Interim 

regulations issued under this section shall apply 

until the effective date of interim or final 

regulations promulgated under other laws that 

establish requirements and standards referred to in 

subsection (a) and expressly supersede this section: 

Provided, That the authority provided by this 

section shall terminate three years after the date of 

enactment of this Act.’’

3 GAO, Homeland Security: Federal and Industry 

Efforts Are Addressing Security Issues at Chemical 

Facilities, but Additional Action is Needed, GAO–

05–631T (Washington, DC: April 2005). 

4 Department of Justice Assessment of the 

Increased Risk of Terrorist or Other Criminal 

Activity Associated With Posting Off-Site 

Consequence Analysis Information on the Internet, 

April 18, 2000. 

and business-specific, DHS has no way 

of estimating how many facilities may 

ultimately implement such measures for 

the purpose of estimating compliance 

costs. Consequently, DHS is basing its 

estimate of compliance costs on 

commonly used security measures that 

are broadly applicable to a wide range 

of high risk chemical facilities, such as 

the purchase of fences, the purchase of 

perimeter lighting, and the employment 

of security guards. 

For the purposes of good practices or 

regulations promulgated by other 

Federal or State agencies, many 

chemical facility owners and/or 

operators have already spent a 

substantial amount of money and 

resources to upgrade and improve 

security. The costs shown below do not 

include the costs of security measures 

already implemented to enhance 

security. The costs shown here are 

intended to represent the marginal cost 

incurred by owner and/or operators as 

a result of the interim final rule. 

DHS’s preliminary estimate of the 

number of high risk chemical facilities 

that will be covered by the risk-based 

performance measures required by the 

interim final rule ranges from 1,500 to 

6,500 chemical facilities. It is important 

to stress that this estimate is simply 

DHS’s best guess based on currently 

available information. Within this range 

of 1,500 to 6,500 potentially covered 

chemical facilities, DHS is estimating 

5,000 facilities as its best guess of 

covered facilities for the purpose of 

generating the cost estimate required by 

Executive Order 12866. 

Using the point estimate of 5,000 

facilities, the estimated present value 

cost of this interim final rule is $3.6 

billion dollars over the period 2006–

2009 2 (7 percent discount rate). For the 

purposes of illustration, we also have 

calculated the cost of the interim final 

rule over the ten year period 2006–2015. 

Over the period 2006–2015, DHS 

estimates the present value cost of this 

interim final rule would be $8.5 billion 

assuming 5,000 covered facilities. 

Benefits Assessment 

This interim final rule allows DHS to 

implement Section 550 of the Homeland 

Security Appropriations Act of 2007. 

The first sentence of Section 550 

mandates the Secretary to issue interim 

final regulations establishing risk-based 

performance standards requiring the 

performance of vulnerability 

assessments and the development and 

implementation of site security plans. 

Section 550 establishes the parameters 

of the Federal government’s first 

regulatory program to secure chemical 

facilities against possible terrorist 

attack. 

The threat of a terrorist attack against 

high-risk chemical facilities is real. 

However, due to the economics of 

externalities, the free market may not 

provide adequate incentives for 

chemical facilities to make a socially 

optimal investment in the full range of 

measures that would reduce the 

probability of a successful terrorist 

attack. Externalities are a cost or benefit 

from an economic transaction 

experienced by parties ‘‘external’’ to the 

transaction. In the case of chemical 

facilities, since the consequences of an 

attack or other security incident may be 

significantly larger than what would be 

suffered by the owner of the facility 

itself, the private market may not 

generally provide the incentive for 

profit-maximizing firms to unilaterally 

spend the socially optimal amount of 

resources to prevent or mitigate a 

terrorist attack. Since companies 

nevertheless will likely suffer serious 

consequences in the case of a terrorist 

attack, many certainly have invested 

significant resources in implementing 

security measures, and this analysis 

recognizes those resource expenditures. 

In a competitive marketplace, however, 

a firm will not normally choose to make 

some additional investment in security 

over their privately optimal amount, 

since they would consequently be 

choosing to increase its cost of 

production and would be at a 

disadvantage when competing with 

companies that have chosen not to make 

a similar investment in security. As this 

interim final rule will require high-risk 

chemical facilities to be held to the 

same risk-based performance standards 

according to their risk-based tier, the 

competitive advantage that may be 

currently enjoyed by those companies 

that are under-investing in security 

measures would be expected to 

disappear. 

Need for Increased Security at High-Risk 

Chemical Facilities 

There is much publicly-available 

information that indicates an attack on 

a chemical facility is a credible threat 

with dire consequences: 

• According to the Government 

Accountability Office, experts agree that 

the Nation’s chemical facilities present 

an attractive target for terrorists who are 

intent on causing massive damage. 

Many facilities house toxic chemicals 

that could become airborne and drift to 

surrounding communities if released or 

could be stolen and used to create a 

weapon capable of causing harm. 

Terrorist attacks involving the theft or 

release of certain chemicals could have 

a significant impact on the health and 

safety of millions of Americans. The 

disaster at Bhopal, India in 1984, when 

methyl isocyanate gas—a highly toxic 

chemical—leaked from a tank, 

reportedly killing about 3,800 people 

and injuring anywhere from 150,000 to 

600,000 others, illustrates the potential 

threat to public health from a chemical 

release.3

• The Department of Justice has 

concluded that the risk of terrorists 

attempting in the foreseeable future to 

cause an industrial chemical release is 

both real and credible. Terrorists or 

other criminals are likely to view the 

potential of a chemical release from an 

industrial facility as a relatively 

attractive means to cause mass 

casualties to the populace and/or large 

scale damage to property. DOJ notes that 

there have been successful efforts by 

foreign militaries and certain terrorist 

groups indigenous to other countries to 

cause releases from industrial facilities 

using bombs. Those efforts have in 

effect converted the facilities into 

makeshift WMD. Some of these releases 

have inflicted damage on the 

surrounding communities. Moreover, 

the evacuations that were triggered by 

the attempted and successful releases of 

industrial chemicals produced panic 

and disruption among the targeted 

population. These are precisely the 

goals of a terrorist.4

• In April 27, 2005, testimony before 

the Senate Committee on Homeland 

Security and Governmental Affairs 

regarding the vulnerability of America 

to a chemical attack, a Brookings 

Institution Visiting Fellow testified. The 

testimony stated that ‘‘of all the various 

remaining civilian vulnerabilities in 

America today, one stands alone as 

uniquely deadly, pervasive, and 

susceptible to a terrorist attack: toxicinhalation-hazard (TIH) industrial 

chemicals, such as chlorine, ammonia, 

phosgene, methyl bromide, 

hydrochloric and various other acids.’’

In addition, the testimony indicated, 


rwilkins on PROD1PC63 with RULES_2
17724 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

5Statement of Richard A. Falkenrath, Visiting 

Fellow, The Brookings Institution, before the 

United States Committee on Homeland Security 

and Governmental Affairs (April 27, 2005). 

6Statement of Stephen E. Flynn, PhD, Jeane J. 

Kirkpatrick Senior Fellow for National Security 

Studies, Council on Foreign Relations, before the 

United States Committee on Homeland Security 

and Governmental Affairs (April 27, 2005). 

7CRS Report for Congress, Chemical Facility 

Security, Updated August 2, 2006. 

8Bond, Christopher. Statement on S.2579. 

Congressional Record, Daily Edition, June 5, 2002, 

p. S5044. 

‘‘the casualty potential of a terrorist 

attack against a large TIH chemical 

container near a population center is 

comparable to that of a fully successful 

terrorist employment of an improvised 

nuclear device or effective biological 

weapon. The key difference is that TIH 

chemical containers are substantially 

easier to attack than improvised nuclear 

devices or effective biological weapons 

are to acquire or fabricate.’’ 5

• In April 27, 2005, testimony before 

the Senate Committee on Homeland 

Security and Governmental Affairs 

regarding the vulnerability of America 

to a chemical attack, a Senior Fellow for 

National Security Studies at the Council 

on Foreign Relations testified. The 

testimony stated ‘‘Of the carefully 

selected potential targets that al Qaeda 

or its imitators might seek to attack, the 

chemical industry should be at the top 

of the list. There are hundreds of 

chemical facilities within the United 

States that represent the military 

equivalent of a poorly guarded arsenal 

of weapons of mass destruction.’’ 6

• A recent Congressional Research 

Service Report discussed trends in 

chemical terrorism and discussed 

evidence that U.S. chemical facilities 

may be used by terrorists to gain access 

to chemicals. One of the 1993 World 

Trade Center bombers, Nidal Ayyad, 

became a naturalized U.S. citizen and 

worked as a chemical engineer in the 

chemical industry, from which he used 

company stationery to order chemical 

ingredients to make the bomb.’’ 7

• Information contained in the 

Congressional Record states that U.S. 

chemical trade publications were found 

in one of the caves where Osama bin 

Laden had hidden.8

Qualitative Benefits of the Risk-Based 

Performance Standards 

As explained previously, Section 550 

requires the Secretary of Homeland 

Security to promulgate ‘‘interim final 

regulations establishing risk-based 

performance standards for security of 

chemical facilities * * *.’’ Section 

27.230 establishes these standards. 

Below is a discussion of the qualitative 

benefits of these risk-based performance 

standards: 

• By securing and monitoring the 

perimeter of the facility, site personnel 

are better able to detect, delay, and 

respond to individuals or groups who 

seek unauthorized access to the site or 

its restricted areas. A well-secured 

perimeter deters intruders from seeking 

to gain access. By limiting acce3ss 

through control points, the facility can 

more easily and effectively control who 

enters and leaves the site. Additionally, 

securing and monitoring restricted areas 

or potentially critical targets within the 

facility reduces the likelihood of theft of 

chemicals because adversaries risk 

observation arriving and leaving the 

premises. Control of gates by guards or 

observation of the perimeter allows 

facility personnel to know who is 

entering and leaving the site and in 

what vehicles. Access control points 

permit the facility to check persons and 

vehicles seeking entrance to the site and 

confirm their legitimate business. 

• Controlling access to the site 

including the screening and/or 

inspection of individuals and vehicles 

as they enter and exit the facility serves 

to deter and detect unauthorized 

introduction or removal of substances 

and devices that may cause a dangerous 

chemical reaction, explosion, or other 

release to harm facility personnel or the 

surrounding community. A regular 

system of identification checks will help 

guards and other facility personnel 

recognize those personnel authorized to 

be on the site and identify those 

individuals who should not be granted 

access. 

• Deterring vehicles from entering the 

facility or restricted access areas will 

reduce the likelihood that an adversary 

will detonate a vehicle-borne 

improvised explosive device inside the 

facility. Appropriate methods of 

deterring vehicles form unauthorized 

entry provide additional time for local 

law enforcement response or otherwise 

delay or prevent the vehicle from 

entering the site to cause harm. 

• Securing and monitoring the 

shipping and receiving of hazardous 

chemicals will improve inventory 

control, product stewardship and 

security against theft, diversion and 

tampering. In addition, improved 

inventory control and control of 

transportation containers on site 

decreases the likelihood that a foreign 

substance could be introduced into 

feedstock, incidental chemicals, or 

products leaving the site that could later 

react with the chemical to cause a 

significant on- or off-site reaction to 

damage process equipment or cause a 

release of a hazardous material to harm 

onsite personnel or the community. 

• Deterring the theft or possible 

diversion of potentially hazardous 

chemicals will prevent loss of chemicals 

from the site. Such measures provide 

security benefits as well as improving 

inventory controls especially for 

chemicals that can be used directly as 

a chemical weapon or can be used to 

produce such a weapon. 

• Deterring insider sabotage prevents 

the facility’s own property and activities 

from being used by a potential terrorist 

against the facility. Examining the 

background of employees or contractors 

who may be planning acts of sabotage 

assists in preventing an in situ release 

of hazardous chemicals, damage to 

process units manufacturing chemicals 

or tampering with chemicals that could 

cause an offsite impact. Ascertaining 

that visitors and contractors have 

legitimate business onsite and are 

escorted when necessary increases the 

control of the site in general and 

reduces the likelihood of sabotage or 

theft. 

• The deterrence of cyber sabotage 

will benefit the facility by preventing 

unauthorized onsite or remote access to 

critical process controls, site security, 

business systems, or SCADA systems (if 

significant consequences can be 

generated by the manipulation of the 

process controls/systems). Appropriate 

controls will allow the detection of 

unauthorized access and unauthorized 

modification of information (hacking). 

• Developing and exercising an 

emergency plan to respond to security 

incidents internally and with local law 

enforcement and first responders (i.e., 

emergency medical technicians (EMTs), 

fire, police) benefits the facility by 

preparing it to take quick and decisive 

action in the event of an attack or other 

breach of security. Establishing 

relationships with local law 

enforcement improves responder 

understanding of the layout and of 

hazards associated with the facility and 

strengthens relationships with the 

community. 

• Maintaining effective monitoring, 

communications and warning systems 

allows the facility to notify internal 

personnel and local responders in a 

timely manner about security incidents. 

Regular tests, repairs and improvements 

to the warning and communications 

system increase the reliability of such 

systems and will improve response 

time. 

• When the facility provides proper 

security training, exercises and drills, 

facility personnel are better able to 

respond to suspicious behavior, 

attempts to enter or attack a facility, or 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17725 

other malevolent acts by insiders or 

intruders. Well trained personnel who 

practice how to react can more 

effectively detect and delay intruders 

and provide increased measures of 

deterrence against unauthorized acts. 

Establishing relationships with local 

law enforcement improves responder 

understanding of the layout and hazard 

associated with the facility and 

strengthens relationships with the 

community. 

• The ability to escalate the levels of 

security measures for periods of 

elevated threat will provide the facility 

with the capacity to increase security 

measures to better protect against 

known increased threats or generalized 

increased threat levels declared by the 

federal government. By maintaining the 

ability to increase security measures, the 

facility does not have to expend time 

and resources on more robust security 

measures unless and until warranted. 

• A facility addressing specific 

threats, vulnerabilities or risks 

identified by the Assistant Secretary 

will decrease the likelihood of a 

successful attack on its facility, 

personnel, products or community. Any 

additional performance standards 

specified by the Secretary will increase 

the facilities ability to deter, detect, 

delay and respond to specific and 

general threats against its security. 

B. Regulatory Flexibility Act 

The Regulatory Flexibility Act (RFA) 

mandates that an agency conduct an 

RFA analysis when an agency is 

required to publish a notice of proposed 

rulemaking. See 5 U.S.C. 603(a). An 

RFA analysis, however, is not required 

when an agency is not required to 

publish a notice of proposed 

rulemaking, as is the case here. By 

directing the Secretary to issue ‘‘interim 

final regulations’’ Congress authorized 

the Secretary to proceed without the 

traditional notice-and-comment 

required by the Administrative 

Procedure Act. See 71 FR 78276, 78277, 

and 78292. 

Even though a Regulatory Flexibility 

Analysis is not required for this rule, 

DHS did consider the impacts of this 

rule on small entities. The Regulatory 

Assessment, which is available in the 

public docket, contains this analysis of 

the impacts of this rule on small 

entities. A portion of the analysis is 

summarized below. 

At this time, DHS’s preliminary 

estimate of the number of high risk 

chemical facilities that will be covered 

by the risk-based performance measures 

required by the rule ranges from 1,500 

to 6,500. This estimate is based on 

currently available information. After 

chemical facilities with certain risk 

profiles complete the Top-Screen, DHS 

will have a better understanding of how 

many and which specific chemical 

facilities will be deemed to be ‘‘highrisk’’ for the purposes of the rule. Also, 

in meeting the risk-based performance 

standards required by this rule, facilities 

will have a large degree of flexibility in 

choosing specific security 

enhancements. We expect that chemical 

facility owners and/or operators will use 

this flexibility to minimize the cost of 

this rule to their operations. These 

uncertainties make it very difficult to 

estimate the extent of the economic 

impact of this rule on small entities. 

Even so, strictly for the purposes of 

analyzing the impact of this rule on 

small entities, DHS has selected from 

the EPA RMP database a sample of 350 

facilities that may be required to comply 

with the risk-based performance 

standards required by the rule. We 

researched these 350 facilities using 

Reference USA and LexisNexis and 

found detailed information (i.e., annual 

revenue, number of employees, and 

parent company information) for 326 

(93%) of them. Of the 326 facilities for 

which we were able to find detailed 

information, our analysis of the data 

indicates that 118 (36%) fit the Small 

Business Administration’s definition of 

a small entity. If we assume that the 24 

companies for which we could find no 

information are also small entities, the 

percentage of these facilities which are 

owned by small entities could be 41 

percent. Table 1 below provides revenue 

ranges of the118 small entities. 

TABLE 1.—PERCENTAGE OF SMALL ENTITIES BY REVENUE

Revenue Number of 

small entities 

Percent of 

small entities 

$0–$999,999 ............................................................................................................................................................ 11 9.3 

$1,000,000–$4,999,999 ........................................................................................................................................... 14 11.9 

$5,000,000–$9,999,999 ........................................................................................................................................... 12 10.2 

$10,000,000–$19,999,999 ....................................................................................................................................... 15 12.7 

$20,000,000–$49,999,999 ....................................................................................................................................... 23 19.5 

$50,000,000–$99,999,999 ....................................................................................................................................... 9 7.6 

$100,000,000–$999,999,999 ................................................................................................................................... 31 26.3 

> $1Billion ................................................................................................................................................................ 3 2.5 

Total .................................................................................................................................................................. 118 100.0 

After consideration of the percentage of 

small entities that may have to comply 

with the risk-based performance 

standards required by this rule and the 

compliance costs explained in the 

Regulatory Assessment, we have 

determined that this rule may have a 

significant economic impact on a 

substantial number of small entities. 

C. Executive Order 13132: Federalism 

1. Background 

Executive Order 13132 requires DHS 

to develop a process to ensure 

‘‘meaningful and timely input by State 

and local officials in the development of 

regulatory policies that have federalism 

implications.’’ Between the publication 

of the Advance Notice and this Interim 

Final Rule, the Department has 

complied with this instruction in two 

ways. The Department specifically 

sought public comment on issues 

involving preemption. Additionally, 

after issuing its proposal, the 

Department specifically invited a 

number of groups representing the 

interests of States and their legislators to 

meet with the Department to discuss the 

proposed regulations. These groups 

were: the National League of Cities, the 

National Association of Counties, the 

National Conference of State Legislators, 

the County Executives of America, the 

International City/County Management 

Association, the American Legislative 

Exchange Council, the National 

Emergency Management Association/ 

CSG Council of State Governments, the 

International Association of Emergency 

Managers, the National Governors 


rwilkins on PROD1PC63 with RULES_2
17726 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

Association, and the United States 

Conference of Mayors. 

The Department received numerous 

comments in response to its invitations. 

States, the private sector, academia, 

various interest groups, and individual 

members of Congress submitted 

comments. The commenters were 

divided in their views of the proposed 

approach on preemption. A number of 

commenters favored the Department’s 

proposal, while others opposed it. Some 

commenters misunderstood the 

Department’s position on preemption or 

the current state of the case law on 

preemption. As discussed below, the 

Department is clarifying its approach on 

preemption in certain respects. 

Specifically, we confirm: the propriety 

of discussing the Department’s view on 

preemption, though Congress was silent 

on the question; that the type of 

preemption called for by Section 550 is 

not field preemption, but conflict 

preemption; and that the Department 

will further assist in the process of 

determining whether a non-Federal 

regulation is preempted by providing 

opinions regarding the impact of that 

regulation on the Federal scheme. 

2. Propriety of Department’s Views on 

Preemption 

As an initial matter, some 

commenters, including Members of 

Congress, suggested that, since Congress 

was silent on preemption, the 

Department’s rulemaking should be 

silent as well. The comments on this 

subject touch on two important 

subtopics: who (i.e., which government 

structure) should determine the 

preemptive effect of Section 550 and the 

regulatory program promulgated under 

its authority; and what law, if any, the 

regulatory program under Section 550 

might preempt. 

In Section 550, Congress did not 

expressly speak to the issue of 

preemption. Preemption questions 

following statutory silence on 

preemption are not novel. Courts and 

agencies have previously faced and 

dealt with who decides preemption 

issues in the face of congressional 

silence. It is helpful to recall that, as a 

general matter, Congress often provides 

the Executive Branch with authority to 

administer a regulatory program while 

leaving gaps or ambiguities in the 

authorizing law. When this happens, the 

Supreme Court has long recognized that 

agencies have the responsibility, within 

the general delegation, to formulate 

policy and make rules to fill those gaps 

and interpret the ambiguities. See 

Chevron U.S.A., Inc. v. Natural 

Resources Defense Council, Inc., 467 

U.S. 837, 843 (1984) (‘‘The power of an 

administrative agency to administer a 

congressionally created * * * program 

necessarily requires the formulation of 

policy and the making of rules to fill 

any gap left, implicitly or explicitly by 

Congress.’’) (ellipses in original; citation 

omitted). Agencies, not only the courts, 

exercise their expertise to fill in the gaps 

and interpret the ambiguities. See id. at 

843 & n.11 (‘‘If, however, the court 

determines that Congress has not 

directly addressed the precise question 

at issue, the court does not simply 

impose its own construction on the 

statute * * * Rather, if the statute is 

silent or ambiguous with respect to the 

specific issue, the question for the court 

is whether the agency’s answer is based 

on a permissible construction of the 

statute. The court need not conclude 

that the agency construction was the 

only one it permissibly could have 

adopted to uphold the construction, or 

even the reading the court would have 

reached if the question initially had 

arisen in a judicial proceeding.’’). And 

even if a court interprets an ambiguous 

statute before an agency promulgates 

rules to fill the gaps or interpret the 

ambiguities, the court’s interpretation 

does not necessarily restrict the agency’s 

ability to adopt a different interpretation 

in the future. See National Cable & 

Telecomm. Ass’n v. Brand X Internet 

Servs., 545 U.S. 967, 982 (2005). 

This does not mean to slight the 

courts’ role in the interpretive process. 

As the Supreme Court has stated, ‘‘The 

judiciary is the final authority on issues 

of statutory construction and must reject 

administrative constructions which are 

contrary to clear congressional intent.’’

Chevron, 467 U.S. at 843 n.9. 

With respect to the issue of 

preemption in particular, the Supreme 

Court has applied these same principles 

regarding Congress, the courts and the 

agencies. See, e.g., Fidelity Fed. Sav. 

and Loan Ass’n v. de la Cuesta, 458 U.S. 

141, 151–54 (1982). ‘‘Federal regulations 

have no less pre-emptive effect than 

federal statutes * * * A pre-emptive 

regulation’s force does not depend on 

express congressional authorization to 

displace state law.’’ Id. at 153–54. The 

Supreme Court, and lower courts, have 

given deference to agencies that define, 

through regulation, the scope of 

preemption. See, e.g., id.; Wachovia 

Bank, N.A. v. Burke, 414 F.3d 305 (2d 

Cir. 2005). 

So although some commenters 

claimed that the Department lacks the 

authority to address the issue of 

preemption in its regulations or laterissued opinions, this assertion is simply 

not consistent with current law. Federal 

agencies have historically published 

their views on the preemptive effect of 

federal law in a number of contexts. See, 

e.g., In re Wireless Consumers Alliance, 

Inc., 15 F.C.C.R. 17,021 (Aug. 14, 2000) 

(administrative agency opinion on 

preemptive effect of federal law); 1999 

WL 303948 (April 20, 1999) (U.S. 

Department of Labor Release discussing 

views on preemption of state laws). We 

anticipate that the courts will ultimately 

resolve any preemption question, with 

an appropriate level of deference to the 

position of the agency. 

Some comments urged the 

Department to avoid preemption after 

looking to a canon of interpretation 

involving a presumption against 

preemption. This presumption, 

however, typically exists ‘‘in areas of 

regulation that are traditionally 

allocated to states and are of particular 

local concern.’’ Wachovia Bank, N.A., 

414 F.3d at 314; see also United States 

v. Locke, 529 U.S. 89 (2000). As noted 

in the Advance Notice, measures to 

prevent terrorist attacks against the 

Nation’s critical infrastructure do not 

involve an area traditionally regulated 

by the States. Very few state and local 

jurisdictions currently regulate security 

at chemical facilities. 

The Department recognizes that 

courts sometimes look to legislative 

intent with respect to the issue of 

preemption—decisions in this area are 

replete with such references. See, e.g., 

Medtronic, Inc. v. Lohr, 518 U.S. 470, 

485 (1996). In the context of Section 

550, however, it is very difficult to 

discern that intent. The legislative 

history on the point is mixed, with 

various Members of Congress making 

floor statements that are not consistent 

with each other. See, e.g., Cong. Rec. 

H7967 (daily ed. Sept. 29, 2006) 

(statement of Rep. King) (‘‘the intention 

is not to preempt the ability of the 

States’’) and Cong. Rec. S10619 (daily 

ed. Sept. 29, 2006) (statement of Sen. 

Voinovich) (‘‘I feel strongly that this 

provision sets that uniform set of rules 

and in so doing, impliedly preempts 

further regulation by State rules or 

laws.’’) In addition, it is particularly 

difficult to gauge congressional intent 

on one relatively short, page-and-a half 

authorizing provision in a lengthy 

appropriations act that runs over 100 

pages. To be sure, individual members 

of Congress—including some members 

substantially involved in homeland 

security issues—have expressed strong 

views on preemption. But can it really 

be said that legislative intent may be 

discerned on the silent aspect of one 

authorizing section of a lengthy 

appropriations act? Cf. Chrysler Corp. v. 

Brown, 441 U.S. 281, 311–12 (1979); 

Castaneda-Gonzalez v. INS, 564 F.2d 

417, 424 (D.C. Cir. 1977). 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17727 

As an additional consideration, the 

Department notes that if it were to 

disclaim any preemptive effect of the 

regulatory program under Section 550, it 

would create an inconsistency with the 

Department’s own regime for regulating 

chemical facilities under the MTSA. In 

its regulations under MTSA, the 

Department has stated its view that the 

principles of conflict preemption apply. 

See 68 FR 60468 (Oct. 22, 2003). 

Congress has charged the Department 

with implementing the security 

programs under both MTSA and Section 

550, and the Department seeks to 

implement these programs in a 

consistent and logical manner. 

3. No Field Preemption 

Some commenters feared—and others 

hoped—that the Department’s approach 

to preemption would wholly displace 

state and local laws. This is incorrect. 

The Department does not in this interim 

final rule claim that the ‘‘field 

preemption’’ doctrine applies in this 

regulatory context. The Department 

does not view its regulatory scheme as 

one which so fully occupies the field as 

to pre-empt any state law touching the 

same subject. 

This is clear from the statutory text. 

For example, the authority granted in 

Section 550 calls for the federal 

regulations to apply to facilities that 

present ‘‘high levels of security risk’’ as 

determined by the Secretary. The 

Department does not, therefore, have 

authority under Section 550 to regulate 

facilities that may, in the Secretary’s 

view, present other than high levels of 

security risk. Some facilities may not be 

deemed by the Department as 

presenting a high risk. These facilities 

may be regulated by States provided 

such regulation is not otherwise in 

conflict with the federal program. In 

addition, as mentioned in the 

comments, Section 550 specifically 

allows the Secretary to approve 

alternative security programs that may 

have been submitted in response to 

State or local authorities. 

4. Principles of Conflict Preemption 

Even for high risk facilities, the 

approach outlined in the Advance 

Notice, and further developed here, is 

one of conflict preemption. Conflict 

preemption is established in the 

Constitution and has been developed in 

case law (see, e.g., Geier v. American 

Honda Motor Co., 529 U.S. 861, 873 

(2000); Fidelity Fed. Sav. and Loan 

Ass’n v. de la Cuesta, 458 U.S. 141, 152 

(1982); Surrick v. Killion, 449 F.3d 520, 

530–31 (3d Cir. 2006)), and the wellknown standards of conflict 

preemption—which are captured in the 

regulatory text at § 27.405—apply to 

Section 550 and this regulation. 

After considering comments, 

however, the Department has modified 

certain of its prior statements on 

preemption as potentially too broad. In 

the Advance Notice, the Department 

noted that Section 550 compels the 

Department to preserve chemical 

facilities’ flexibility to choose security 

measures to reach the appropriate 

security outcome. The Department went 

on to say that a State measure frustrating 

this balance ‘‘will be preempted.’’ The 

Department has decided, however, that 

clarification is in order, as this 

regulation is not intended to be the 

equivalent of ‘‘field preemption’’ for 

facilities determined to be high risk. 

Instead, it is only meant to indicate that 

the regulation is not to be conflicted by, 

interfered with, hindered by or 

frustrated by State measures, under 

long-standing legal principles. 

Only a few jurisdictions have 

developed security regulations (rather 

than health, safety, and environmental 

regulations) governing chemical sites. 

While we have not canvassed all 

existing state laws and regulations, 

currently we have no reason to conclude 

that any such non-Federal measure is 

being applied in a way that would 

impede the performance standards or 

other provisions of Section 550 and this 

Interim Final Rule. However, concrete 

conclusions about the effect of state 

laws and the application of preemption 

principles will require an understanding 

of future, factual contexts in which 

those laws are applied. The Department 

will consider any problems that arise in 

this regard in a more particularized 

manner. 

Consistent with the approach outlined 

in the Advance Notice, the Department 

will entertain requests for its views on 

particular state or local laws, which will 

be issued by way of an opinion. In 

addition to the approach described in 

the Advanced Notice, the Department 

will seek the input and views of a State 

before finalizing the Department’s view 

of preemption with respect to such 

State’s laws. See § 27.405(d)(3). It will 

be helpful for the Department to seek 

the views of the relevant States if an 

opinion on preemption is requested 

under these regulations. Additionally, 

the Department would, time permitting, 

seek public notice and comment before 

formulating its views on a particular 

preemption question, consistent, of 

course, with the congressional mandate 

to protect from public disclosure 

information submitted under Section 

550. The Department, however, declines 

to add additional procedural formalities 

to the regulation as it relates to 

preemption. 

Certain commenters asked that the 

Advance Notice be more clear in 

delineating what state laws are not to be 

preempted. The Department does not 

intend to preempt existing health, safety 

and environmental regulations. In the 

future, however, if state or local 

governments enact security laws or 

promulgate security regulations under 

the rubric of health, safety, or 

environmental protections, those laws 

and regulations will be measured 

against the standard described in 

§ 27.405. Of course, non-Federal 

regulations that fall below federal 

performance standards will not 

diminish the federal requirements that 

covered facilities must meet. 

D. Unfunded Mandates Reform Act 

Title II of the Unfunded Mandates 

Reform Act of 1995 (UMRA), enacted as 

Pub. L. 104–4 on March 22, 1995, 

requires each Federal agency, to the 

extent permitted by law, to prepare a 

written assessment of the effects of any 

Federal mandate in a proposed or final 

agency rule that may result in the 

expenditure by State, local, and tribal 

governments, in the aggregate, or by the 

private sector, of $100 million or more 

(adjusted annually for inflation) in any 

one year. Section 204(a) of UMRA, 2 

U.S.C. 1534(a), requires the Federal 

agency to develop an effective process 

to permit timely input by elected 

officers (or their designees) of State, 

local, and tribal governments on a 

proposed ‘‘significant intergovernmental 

mandate.’’ A ‘‘significant 

intergovernmental mandate’’ under the 

UMRA is any provision in a Federal 

agency regulation that will impose an 

enforceable duty upon State, local, and 

tribal governments, in the aggregate, of 

$100 million (adjusted annually for 

inflation) in any one year. Section 203 

of UMRA, 2 U.S.C. 1533, which 

supplements section 204(a), provides 

that before establishing any regulatory 

requirements that might significantly or 

uniquely affect small governments, the 

agency shall have developed a plan that, 

among other things, provides for notice 

to potentially affected small 

governments, if any, and for a 

meaningful and timely opportunity to 

provide input in the development of 

regulatory proposals. The Department 

sought input from state and local 

governments during the comment 

period and hosted a meeting with state 

and local representatives on February 6, 

2007. A list of participants and short 

description of the meeting is in the 

docket. 


rwilkins on PROD1PC63 with RULES_2
17728 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

This interim final rule would result in 

expenditure by the private sector of 

$100 million (adjusted annually for 

inflation) or more in any one year. At 

this time, however, we do not have 

enough information regarding the 

specific facilities that will be required to 

comply with the rule’s risk-based 

performance standards in order to know 

if this interim final rule will impose an 

enforceable duty upon State, local, and 

tribal governments of $100 million 

(adjusted annually for inflation) or more 

in any one year. DHS has conducted a 

‘‘Regulatory Assessment,’’ which 

explains the economic effects of the 

rule. The ‘‘Regulatory Assessment’’ is 

summarized in the section entitled 

‘‘Executive Order 12866,’’ and a copy 

may be found in the public docket for 

this IFR. 

As explained in the ‘‘Regulatory 

Assessment,’’ DHS’s preliminary 

estimate of the total number of high-risk 

chemical facilities that will be covered 

by the risk-based performance measures 

required by this rule ranges from 1,500 

to 6,500 chemical facilities. This 

estimate is based on currently available 

information. After chemical facilities 

fitting certain risk profiles complete the 

Top-Screen risk assessment 

methodology (which will be accessible 

through a secure Department website), 

DHS will better understand how many 

and which specific chemical facilities 

will be deemed to be ‘‘high-risk’’ for the 

purposes of this rule. For the purposes 

of this discussion, we believe this rule 

may require certain municipalities that 

own and/or operate power generating 

facilities to purchase security 

enhancements, but at this time we do 

not know the extent of the financial 

impact. 

E. Paperwork Reduction Act 

This interim final rule contains 

collection of information requirements 

under the Paperwork Reduction Act of 

1995 (44 U.S.C. 3501–3520). ‘‘Collection 

of information,’’ as defined in 5 CFR 

1320.3(c), includes reporting, record 

keeping, monitoring, posting, labeling, 

and other similar actions. 

Under Section 550 of the DHS 

Appropriations Act, the Department 

will use the Chemical Security 

Assessment Tool (CSAT) system to 

collect and analyze key data from 

chemical facilities to: (1) Identify 

facilities that present a high level of 

risk, (2) Support the facility-specific 

judgment for preliminary and final tier 

high risk determinations, (3) Specify the 

facility-specific security concerns that 

facilities must address in their SVAs 

and SSPs, and (4) Collect the facilityspecific security measures, activities, 

and systems for judging compliance 

against the risk based performance 

standards. DHS will submit the 

collections for SVAs and the SSPs 

during the summer months. 

This rule introduces a new collection, 

1670–NEW, with two new forms: User 

Registration (DHS 9002 (1/07)) and Top 

Screen (DHS 9007 (2/07)). As such, DHS 

has submitted the following information 

requirements to OMB for its review: 

Title: Chemical Security Assessment 

Tool (CSAT): User Registration. 

OMB Control Number: 1670_NEW 

Summary of Collection of 

Information: Section 550 provided the 

Department with the authority to 

regulate high risk chemical facilities. 

Further, it requires that the Secretary of 

the Department of Homeland Security 

identify high risk facilities and provide 

for the protection of the information 

regarding and provided by those 

facilities. DHS has identified the CSAT 

system as the Information Technology 

(IT) system it will use to obtain and 

quantify this key risk data from 

facilities. The Department will begin 

collecting information upon the 

effective date of this interim final rule. 

Use of: The Department will use the 

registration information as a basis for 

providing chemical facilities access to 

the CSAT system. 

Need for Information: The 

Department needs the information from 

the User Registration form to identify 

and vet requests to access the CSAT 

system. 

Description of the Respondents: DHS 

anticipates that there will be 40,000 

respondents in the first year. The 

respondents will be the owners and 

operators of the chemical facilities that 

will need to submit information through 

the CSAT system. 

Frequency of Response: On Occasion. 

Annual Burden Estimate: Each facility 

is estimated to have a burden of 44.5 

minutes to complete DHS Form 9002 

(1/07). The annual hour burden is 

estimated to be 22,250. 

Title: Chemical Security Assessment 

Tool (CSAT): Top Screen. 

Summary of Collection of 

Information: Section 550 provided the 

Department with the authority to 

regulate high risk chemical facilities. 

Further, it requires that the Secretary of 

the Department of Homeland Security 

identify high risk facilities and provide 

for the protection of the information 

regarding and provided by those 

facilities. DHS has identified the CSAT 

system as the Information Technology 

(IT) system it will use to obtain and 

quantify this key risk data from 

facilities. The Department will begin 

collecting information upon the 

effective date of this interim final rule. 

Use of: The CSAT is the Department’s 

system for collecting and analyzing key 

data from chemical facilities to: (1) 

Identify facilities that present a high 

level of risk, (2) Support the facilityspecific judgment for preliminary and 

final tier determinations, and (3) Specify 

the facility-specific security concerns 

that facilities must address in their 

SVAs and SSPs. 

Respondents (including number of): 

DHS anticipates there will be 40,000 

respondents in the first year. The 

respondents will be chemical facilities 

that possess, or plan to possess, a 

quantity of a chemical substance 

determined by the Secretary to be 

potentially dangerous or that meets 

other risk-related criteria identified by 

the Department. 

Frequency: Most facilities will 

complete the Top-Screen once. The 

Department will require facilities that 

are determined to be high risk to 

periodically resubmit the Top-Screen. 

Burden of Response: Depending upon 

the size of the facility, the burden rates 

will vary. The estimated burden hours 

for the different facility types are 

detailed in the table below. The 

combined hour burden for all facilities 

completing the Top-Screen is estimated 

to be 1,230,550. The combined annual 

cost burden for the User Registration 

and the Top-Screen is $110,003,900. 

TABLE 2.—SUMMARY OF BURDEN HOURS FOR CONDUCTING USER REGISTRATION (DHS FORM 9002 (1/07)) AND TOP

SCREEN (DHS FORM 9007 (2/07)) 

Type of facility Number of 

facilities 

Hour burden 

per facility 

Total hour 

burden 

Open Large .................................................................................................................................. 9,327 39.5 368,400 

Merchant Wholesalers ................................................................................................................. 432 30 13,000 

Facilities with only 1–2 chemicals ............................................................................................... 7,968 25.5 203,200 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17729 

TABLE 2.—SUMMARY OF BURDEN HOURS FOR CONDUCTING USER REGISTRATION (DHS FORM 9002 (1/07)) AND TOP

SCREEN (DHS FORM 9007 (2/07))—Continued 

Type of facility Number of 

facilities 

Hour burden 

per facility 

Total hour 

burden 

Other ............................................................................................................................................ 22,273 30 668,200 

Total ...................................................................................................................................... ........................ ........................ 1,252,800 

As required by the Paperwork 

Reduction Act of 1995 (44 U.S.C. 3507 

(d)), we have submitted a copy of the 

interim final rule to OMB for its review 

of the collections of information. Due to 

the circumstances surrounding this final 

rule, we ask for emergency processing. 

DHS is soliciting comments to: 

(1) Evaluate whether the proposed 

information requirement is necessary for 

the proper performance of the functions 

of the agency, including whether the 

information will have practical utility; 

(2) Evaluate the accuracy of the 

agency’s estimate of the burden; 

(3) Enhance the quality, utility, and 

clarity of the information to be 

collected; and 

(4) Minimize the burden of the 

collection of information on those who 

are to respond, including using 

appropriate automated, electronic, 

mechanical, or other technological 

collection techniques or other forms of 

information technology. 

Individuals and organizations may 

submit comments on the information 

collection requirements by July 9, 2007. 

Direct the comments to the address 

listed in the ADDRESSES section of this 

document. Also, fax a copy of the 

comments to the Office of Information 

and Regulatory Affairs, Office of 

Management and Budget at 202–395–

6974, Attention: Nathan Lesser, DHS 

Desk Officer; and send via electronic 

mail to oira_submission@omb.eop.gov. 

A comment to OMB is most effective 

if OMB receives it within 30 days of 

publication. DHS will publish the OMB 

control number for this information 

collection in the Federal Register after 

OMB approves it. 

Under the protections provided by the 

PRA, as amended, an agency may not 

conduct or sponsor, and a person is not 

required to respond to, a collection of 

information unless it displays a 

currently valid OMB control number. 

F. National Environmental Policy Act 

In the Advance Notice, the 

Department reviewed the rulemaking 

process with regard to the National 

Environmental Policy Act (NEPA). See 

71 FR 78276, 78294 (Dec. 28, 2006). 

Specifically, the Department considered 

the short timeframe to issue these 

interim final regulations and the 

statutory mandate, which directed that 

each chemical facility develop and 

implement site security plans, with the 

proviso that the facility could select 

layered security measures to 

appropriately address the vulnerability 

assessment and the risk-based 

performance standards for security of 

the facility. Additionally, Congress 

mandated that the Secretary could not 

disapprove a site security plan based on 

the presence or absence of a particular 

security measure, but only on the failure 

to satisfy a risk-based performance 

standard. 

Chemical facilities are of a wide 

variety of designs and sizes, and are 

located in a wide range of geographic 

settings, communities, and natural 

environments. The Department is not 

funding or directing specific measures 

under these regulations, but issuing 

performance standards. Consequently, 

the Department currently has no way to 

determine the action the chemical 

facility will take to meet the standards, 

and what effect any action might have 

on the environment. Even if the 

Department could predict the actions 

the facilities would take in response to 

the standards, it is likely facilities 

would take widely varying actions to 

comply, based upon type of facility, 

geographic location, existing 

infrastructure, etc. 

We received no comments objecting 

to this conclusion during the comment 

period, and further, no comments on 

this matter were raised during the 

Environmental Organizations Forum the 

Department hosted on January 17, 2007. 

Accordingly, the information needed to 

conduct an Environmental Impact 

Statement is not available at this time 

and, in any event, the Department could 

not reasonably conduct an 

Environmental Impact Statement within 

the six months time allotted for issuance 

of the interim final regulations. 

List of Subjects in 6 CFR Part 27 

Chemical security, Facilities, 

Reporting and recordkeeping, Security 

measures. 

The Interim Final Rule 

■ For the reasons set forth in the 

preamble, the Department of Homeland 

Security adds Part 27 to Title 6, Code of 

Federal Regulations, to read as follows: 

Title 6—Department of Homeland 

Security 

Chapter 1—Department of Homeland 

Security, Office of the Secretary 

PART 27—CHEMICAL FACILITY ANTITERRORISM STANDARDS 

Subpart A—General 

Sec. 

27.100 Purpose. 

27.105 Definitions. 

27.110 Applicability. 

27.115 Implementation. 

27.120 Designation of a coordinating 

official; Consultations and technical 

assistance. 

27.125 Severability. 

Subpart B—Chemical Facility Security 

Program 

27.200 Information regarding security risk 

for a chemical facility. 

27.205 Determination that a chemical 

facility ‘‘presents a high level of security 

risk.’’

27.210 Submissions schedule. 

27.215 Security vulnerability assessments. 

27.220 Tiering. 

27.225 Site security plans. 

27.230 Risk-based performance standards. 

27.235 Alternative security program. 

27.240 Review and approval of security 

vulnerability assessments. 

27.245 Review and approval of site security 

plans. 

27.250 Inspections and audits. 

27.255 Recordkeeping requirements. 

Subpart C—Orders and Adjudications 

27.300 Orders. 

27.305 Neutral adjudications. 

27.310 Commencement of adjudication 

proceedings. 

27.315 Presiding officers for proceedings. 

27.320 Prohibition on ex parte 

communications during proceedings. 

27.325 Burden of proof. 

27.330 Summary decision procedures. 

27.335 Hearing procedures. 

27.340 Completion of adjudication 

proceedings. 

27.345 Appeals. 

Subpart D—Other 

27.400 Chemical-terrorism vulnerability 

information. 


rwilkins on PROD1PC63 with RULES_2
17730 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

27.405 Review and preemption of State 

laws and regulations. 

27.410 Third party actions. 

Appendix A to Part 27—DHS Chemicals of 

Interest 

Authority: Pub. L. 109–295, sec. 550. 

Subpart A—General 

§ 27.100 Purpose. 

The purpose of this Part is to enhance 

the security of our Nation by furthering 

the mission of the Department as 

provided in 6 U.S.C. § 111(b)(1) and by 

lowering the risk posed by certain 

chemical facilities. 

§ 27.105 Definitions. 

As used in this part: 

Alternative Security Program or ASP 

shall mean a third-party or industry 

organization program, a local authority, 

state or Federal government program or 

any element or aspect thereof, that the 

Assistant Secretary has determined 

meets the requirements of this Part and 

provides for an equivalent level of 

security to that established by this Part. 

Assistant Secretary shall mean the 

Assistant Secretary for Infrastructure 

Protection, Department of Homeland 

Security or his designee. 

Chemical Facility or facility shall 

mean any establishment that possesses 

or plans to possess, at any relevant point 

in time, a quantity of a chemical 

substance determined by the Secretary 

to be potentially dangerous or that 

meets other risk-related criteria 

identified by the Department. As used 

herein, the term chemical facility or 

facility shall also refer to the owner or 

operator of the chemical facility. Where 

multiple owners and/or operators 

function within a common 

infrastructure or within a single fenced 

area, the Assistant Secretary may 

determine that such owners and/or 

operators constitute a single chemical 

facility or multiple chemical facilities 

depending on the circumstances. 

Chemical Security Assessment Tool or 

CSAT shall mean a suite of four 

applications, including User 

Registration, Top-Screen, Security 

Vulnerability Assessment, and Site 

Security Plan, through which the 

Department will collect and analyze key 

data from chemical facilities. 

Chemical-terrorism Vulnerability 

Information or CVI shall mean the 

information listed in § 27.400(b). 

Coordinating Official shall mean the 

person (or his designee(s)) selected by 

the Assistant Secretary to ensure that 

the regulations are implemented in a 

uniform, impartial, and fair manner. 

Covered Facility or Covered Chemical 

Facility shall mean a chemical facility 

determined by the Assistant Secretary to 

present high levels of security risk, or a 

facility that the Assistant Secretary has 

determined is presumptively high risk 

under § 27.200. 

Department shall mean the 

Department of Homeland Security. 

Deputy Secretary shall mean the 

Deputy Secretary of the Department of 

Homeland Security or his designee. 

Director of the Chemical Security 

Division or Director shall mean the 

Director of the Chemical Security 

Division, Office of Infrastructure 

Protection, Department of Homeland 

Security or any successors to that 

position within the Department or his 

designee. 

General Counsel shall mean the 

General Counsel of the Department of 

Homeland Security or his designee. 

Operator shall mean a person who has 

responsibility for the daily operations of 

a facility or facilities subject to this Part. 

Owner shall mean the person or entity 

that owns any facility subject to this 

Part. 

Present high levels of security risk and 

high risk shall refer to a chemical 

facility that, in the discretion of the 

Secretary of Homeland Security, 

presents a high risk of significant 

adverse consequences for human life or 

health, national security and/or critical 

economic assets if subjected to terrorist 

attack, compromise, infiltration, or 

exploitation. 

Risk profiles shall mean criteria 

identified by the Assistant Secretary for 

determining which chemical facilities 

will complete the Top-Screen or provide 

other risk assessment information. 

Screening Threshold Quantity or STQ 

shall mean the quantity of a chemical of 

interest, upon which the facility’s 

obligation to complete and submit the 

CSAT Top-Screen is based. 

Secretary or Secretary of Homeland 

Security shall mean the Secretary of the 

Department of Homeland Security or 

any person, officer or entity within the 

Department to whom the Secretary’s 

authority under Section 550 is 

delegated. 

Terrorist attack or terrorist incident 

shall mean any incident or attempt that 

constitutes terrorism or terrorist activity 

under 6 U.S.C. 101(15) or 18 U.S.C. 

2331(5) or 8 U.S.C. 1182(a)(3)(B)(iii), 

including any incident or attempt that 

involves or would involve sabotage of 

chemical facilities or theft, 

misappropriation or misuse of a 

dangerous quantity of chemicals. 

Tier shall mean the risk level 

associated with a covered chemical 

facility and which is assigned to a 

facility by the Department. For purposes 

of this part, there are four risk-based 

tiers, ranging from highest risk at Tier 1 

to lowest risk at Tier 4. 

Top-Screen shall mean an initial 

screening process designed by the 

Assistant Secretary through which 

chemical facilities provide information 

to the Department for use pursuant to 

§ 27.200 of these regulations. 

Under Secretary shall mean the Under 

Secretary for National Protection and 

Programs, Department of Homeland 

Security or any successors to that 

position within the Department or his 

designee. 

§ 27.110 Applicability. 

(a) This Part applies to chemical 

facilities and to covered facilities as set 

out herein. 

(b) This Part does not apply to 

facilities regulated pursuant to the 

Maritime Transportation Security Act of 

2002, Pub. L. 107–295, as amended; 

Public Water Systems, as defined by 

Section 1401 of the Safe Drinking Water 

Act, Pub. L. 93–523, as amended; 

Treatment Works as defined in Section 

212 of the Federal Water Pollution 

Control Act, Pub. L. 92–500, as 

amended; any facility owned or 

operated by the Department of Defense 

or the Department of Energy, or any 

facility subject to regulation by the 

Nuclear Regulatory Commission. 

§ 27.115 Implementation. 

The Assistant Secretary may 

implement the Section 550 program in 

a phased manner, selecting certain 

chemical facilities for expedited initial 

processes under these regulations and 

identifying other chemical facilities or 

types or classes of chemical facilities for 

other phases of program 

implementation. The Assistant 

Secretary has flexibility to designate 

particular chemical facilities for specific 

phases of program implementation 

based on potential risk or any other 

factor consistent with this Part. 

§ 27.120 Designation of a coordinating 

official; Consultations and technical 

assistance. 

(a) The Assistant Secretary will 

designate a Coordinating Official who 

will be responsible for ensuring that 

these regulations are implemented in a 

uniform, impartial, and fair manner. 

(b) The Coordinating Official and his 

staff shall provide guidance to covered 

facilities regarding compliance with this 

Part and shall, as necessary and to the 

extent that resources permit, be 

available to consult and to provide 

technical assistance to an owner or 

operator who seeks such consultation or 

assistance. 

(c) In order to initiate consultations or 

seek technical assistance, a covered 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17731 

facility shall submit a written request 

for consultation or technical assistance 

to the Coordinating Official or contact 

the Department in any other manner 

specified in any subsequent guidance. 

Requests for consultation or technical 

guidance do not serve to toll any of the 

applicable timelines set forth in this 

Part. 

(d) If a covered facility modifies its 

facility, processes, or the types or 

quantities of materials that it possesses, 

and believes that such changes may 

impact the covered facility’s obligations 

under this Part, the covered facility may 

request a consultation with the 

Coordinating Official as specified in 

paragraph (c). 

§ 27.125 Severability. 

If a court finds any portion of this Part 

to have been promulgated without 

proper authority, the remainder of this 

Part will remain in full effect. 

Subpart B—Chemical Facility Security 

Program 

§ 27.200 Information regarding security 

risk for a chemical facility. 

(a) Information to determine security 

risk. In order to determine the security 

risk posed by chemical facilities, the 

Secretary may, at any time, request 

information from chemical facilities that 

may reflect potential consequences of or 

vulnerabilities to a terrorist attack or 

incident, including questions 

specifically related to the nature of the 

business and activities conducted at the 

facility; information concerning the 

names, nature, conditions of storage, 

quantities, volumes, properties, 

customers, major uses, and other 

pertinent information about specific 

chemicals or chemicals meeting a 

specific criterion; information 

concerning facilities’ security, safety, 

and emergency response practices, 

operations, and procedures; information 

regarding incidents, history, funding, 

and other matters bearing on the 

effectiveness of the security, safety and 

emergency response programs, and 

other information as necessary. 

(b) Obtaining information from 

facilities. (1) The Assistant Secretary 

may seek the information provided in 

paragraph (a) of this section by 

contacting chemical facilities 

individually or by publishing a notice in 

the Federal Register seeking 

information from chemical facilities that 

meet certain criteria, which the 

Department will use to determine risk 

profiles. Through any such individual 

or Federal Register notification, the 

Assistant Secretary may instruct such 

facilities to complete and submit a TopScreen process, which may be 

completed through a secure Department 

Web site or through other means 

approved by the Assistant Secretary. 

(2) A facility must complete and 

submit a Top-Screen in accordance with 

the schedule provided in § 27.210 if it 

possesses any of the chemicals listed in 

Appendix A to this part at the 

corresponding Screening Threshold 

Quantities. 

(3) Where the Department requests 

that a facility complete and submit a 

Top-Screen, the facility must designate 

a person who is responsible for the 

submission of information through the 

CSAT system and who attests to the 

accuracy of the information contained 

in any CSAT submissions. Such 

submitter must be an officer of the 

corporation or other person designated 

by an officer of the corporation and 

must be domiciled in the United States. 

(c) Presumptively High Risk Facilities. 

(1) If a chemical facility subject to 

paragraph (a) or (b) of this section fails 

to provide information requested or 

complete the Top-Screen within the 

timeframe provided in § 27.210, the 

Assistant Secretary may, after 

attempting to consult with the facility, 

reach a preliminary determination, 

based on the information then available, 

that the facility presumptively presents 

a high level of security risk. The 

Assistant Secretary shall then issue a 

notice to the entity of this determination 

and, if necessary, order the facility to 

provide information or complete the 

Top-Screen pursuant to these rules. If 

the facility then fails to do so, it may be 

subject to civil penalties pursuant to 

§ 27.300, audit and inspection under 

§ 27.250 or, if appropriate, an order to 

cease operations under § 27.300. 

(2) If the facility deemed 

‘‘presumptively high risk’’ pursuant to 

paragraph (c)(1) of this section 

completes the Top-Screen, and the 

Department determines that it does not 

present a high level of security risk 

under § 27.205, its status as 

‘‘presumptively high risk’’ will 

terminate, and the Department will 

issue a notice to the facility to that 

effect. 

§ 27.205 Determination that a chemical 

facility ‘‘presents a high level of security 

risk.’’

(a) Initial Determination. The 

Assistant Secretary may determine at 

any time that a chemical facility 

presents a high level of security risk 

based on any information available 

(including any information submitted to 

the Department under § 27.200) that, in 

the Secretary’s discretion, indicates the 

potential that a terrorist attack involving 

the facility could result in significant 

adverse consequences for human life or 

health, national security or critical 

economic assets. Upon determining that 

a facility presents a high level of 

security risk, the Department shall 

notify the facility in writing of such 

initial determination and may also 

notify the facility of the Department’s 

preliminary determination of the 

facility’s placement in a risk-based tier 

pursuant to § 27.220(a). 

(b) Redetermination. If a covered 

facility previously determined to 

present a high level of security risk has 

materially altered its operations, it may 

seek a redetermination by filing a 

Request for Redetermination with the 

Assistant Secretary, and may request a 

meeting regarding the Request. Within 

45 calendar days of receipt of such a 

Request, or within 45 calendar days of 

a meeting under this paragraph, the 

Assistant Secretary shall notify the 

covered facility in writing of the 

Department’s decision on the Request 

for Redetermination. 

§ 27.210 Submissions schedule. 

(a) Initial Submission. The timeframes 

in paragraphs (a)(2) and (a)(3) of this 

section also apply to covered facilities 

that submit an Alternative Security 

Program pursuant to § 27.235. 

(1) Top-Screen. Facilities shall 

complete and submit a Top-Screen 

within the following time frames: 

(i) This paragraph is operative on the 

date that the Department publishes a 

final Appendix A. Unless otherwise 

notified, within 60 calendar days of the 

effective date of Appendix A for 

facilities that possess any of the 

chemicals listed in Appendix A at the 

corresponding STQs, or within 60 

calendar days for facilities that come 

into possession of any of the chemicals 

listed in Appendix A at the 

corresponding STQs; or 

(ii) Within the time frame provided in 

any written notification from the 

Department or specified in any 

subsequent Federal Register notice. 

(2) Security Vulnerability Assessment. 

Unless otherwise notified, a covered 

facility must complete and submit a 

Security Vulnerability Assessment 

within 90 calendar days of written 

notification from the Department or 

within the time frame specified in any 

subsequent Federal Register notice. 

(3) Site Security Plan. Unless 

otherwise notified, a covered facility 

must complete and submit a Site 

Security Plan within 120 calendar days 

of written notification from the 

Department or within the time frame 

specified in any subsequent Federal 

Register notice. 


rwilkins on PROD1PC63 with RULES_2
17732 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

(b) Resubmission Schedule for 

Covered Facilities. The timeframes in 

this subsection also apply to covered 

facilities who submit an Alternative 

Security Program pursuant to § 27.235. 

(1) Top-Screen. Unless otherwise 

notified, Tier 1 and Tier 2 covered 

facilities must complete and submit a 

new Top-Screen no less than two years, 

and no more than two years and 60 

calendar days, from the date of the 

Department’s approval of the facility’s 

Site Security Plan; and Tier 3 and Tier 

4 covered facilities must complete and 

submit a Top-Screen no less than 3 

years, and no more than 3 years and 60 

calendar days, from the date of the 

Department’s approval of the facility’s 

Site Security Plan. 

(2) Security Vulnerability Assessment. 

Unless otherwise notified and following 

a Top-Screen resubmission pursuant to 

paragraph (b)(1) of this section, a 

covered facility must complete and 

submit a new Security Vulnerability 

Assessment within 90 calendar days of 

written notification from the 

Department or within the time frame 

specified in any subsequent Federal 

Register notice. 

(3) Site Security Plan. Unless 

otherwise notified and following a 

Security Vulnerability Assessment 

resubmission pursuant to paragraph 

(b)(2) of this section , a covered facility 

must complete and submit a new Site 

Security Plan within 120 calendar days 

of written notification from the 

Department or within the time frame 

specified in any subsequent Federal 

Register notice. 

(c) The Assistant Secretary retains the 

authority to modify the schedule in this 

Part as needed. The Assistant Secretary 

may shorten or extend these time 

periods based on the operations at the 

facility, the nature of the covered 

facility’s vulnerabilities, the level and 

immediacy of security risk, or for other 

reasons. If the Department alters the 

time periods for a specific facility, the 

Department will do so in written notice 

to the facility. 

(d) If a covered facility makes material 

modifications to its operations or site, 

the covered facility must complete and 

submit a revised Top-Screen to the 

Department within 60 days of the 

material modification. In accordance 

with the resubmission requirements in 

§ 27.210(b)(2) and (3), the Department 

will notify the covered facility as to 

whether the covered facility must 

submit a revised Security Vulnerability 

Assessment, Site Security Plan, or both. 

§ 27.215 Security vulnerability 

assessments. 

(a) Initial Assessment. If the Assistant 

Secretary determines that a chemical 

facility is high-risk, the facility must 

complete a Security Vulnerability 

Assessment. A Security Vulnerability 

Assessment shall include: 

(1) Asset Characterization, which 

includes the identification and 

characterization of potential critical 

assets; identification of hazards and 

consequences of concern for the facility, 

its surroundings, its identified critical 

asset(s), and its supporting 

infrastructure; and identification of 

existing layers of protection; 

(2) Threat Assessment, which 

includes a description of possible 

internal threats, external threats, and 

internally-assisted threats; 

(3) Security Vulnerability Analysis, 

which includes the identification of 

potential security vulnerabilities and 

the identification of existing 

countermeasures and their level of 

effectiveness in both reducing identified 

vulnerabilities and in meeting the 

applicable Risk-Based Performance 

Standards; 

(4) Risk Assessment, including a 

determination of the relative degree of 

risk to the facility in terms of the 

expected effect on each critical asset 

and the likelihood of a success of an 

attack; and 

(5) Countermeasures Analysis, 

including strategies that reduce the 

probability of a successful attack or 

reduce the probable degree of success, 

strategies that enhance the degree of risk 

reduction, the reliability and 

maintainability of the options, the 

capabilities and effectiveness of 

mitigation options, and the feasibility of 

the options. 

(b) Except as provided in § 27.235, a 

covered facility must complete the 

Security Vulnerability Assessment 

through the CSAT process, or through 

any other methodology or process 

identified or issued by the Assistant 

Secretary. 

(c) Covered facilities must submit a 

Security Vulnerability Assessment to 

the Department in accordance with the 

schedule provided in § 27.210. 

(d) Updates and Revisions. (1) A 

covered facility must update and revise 

its Security Vulnerability Assessment in 

accordance with the schedule provided 

in § 27.210. 

(2) Notwithstanding paragraph (d)(1) 

of this section, a covered facility must 

update, revise or otherwise alter its 

Security Vulnerability Assessment to 

account for new or differing modes of 

potential terrorist attack or for other 

security-related reasons, if requested by 

the Assistant Secretary. 

§ 27.220 Tiering. 

(a) Preliminary Determination of RiskBased Tiering. Based on the information 

the Department receives in accordance 

with §§ 27.200 and 27.205 (including 

information submitted through the TopScreen process) and following its initial 

determination in § 27.205(a) that a 

facility presents a high level of security 

risk, the Department shall notify a 

facility of the Department’s preliminary 

determination of the facility’s placement 

in a risk-based tier. 

(b) Confirmation or Alteration of RiskBased Tiering. Following review of a 

covered facility’s Security Vulnerability 

Assessment, the Assistant Secretary 

shall notify the covered facility of its 

final placement within a risk-based tier, 

or for covered facilities previously 

notified of a preliminary tiering, 

confirm or alter such tiering. 

(c) The Department shall place 

covered facilities in one of four riskbased tiers, ranging from highest risk 

facilities in Tier 1 to lowest risk 

facilities in Tier 4. 

(d) The Assistant Secretary may 

provide the facility with guidance 

regarding the risk-based performance 

standards and any other necessary 

guidance materials applicable to its 

assigned tier. 

§ 27.225 Site security plans. 

(a) The Site Security Plan must meet 

the following standards: 

(1) Address each vulnerability 

identified in the facility’s Security 

Vulnerability Assessment, and identify 

and describe the security measures to 

address each such vulnerability; 

(2) Identify and describe how security 

measures selected by the facility will 

address the applicable risk-based 

performance standards and potential 

modes of terrorist attack including, as 

applicable, vehicle-borne explosive 

devices, water-borne explosive devices, 

ground assault, or other modes or 

potential modes identified by the 

Department; 

(3) Identify and describe how security 

measures selected and utilized by the 

facility will meet or exceed each 

applicable performance standard for the 

appropriate risk-based tier for the 

facility; and 

(4) Specify other information the 

Assistant Secretary deems necessary 

regarding chemical facility security. 

(b) Except as provided in § 27.235, a 

covered facility must complete the Site 

Security Plan through the CSAT 

process, or through any other 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17733 

methodology or process identified or 

issued by the Assistant Secretary. 

(c) Covered facilities must submit a 

Site Security Plan to the Department in 

accordance with the schedule provided 

in § 27.210. 

(d) Updates and Revisions. (1) When 

a covered facility updates, revises or 

otherwise alters its Security 

Vulnerability Assessment pursuant to 

§ 27.215(d), the covered facility shall 

make corresponding changes to its Site 

Security Plan. 

(2) A covered facility must also 

update and revise its Site Security Plan 

in accordance with the schedule in 

§ 27.210. 

(e) A covered facility must conduct an 

annual audit of its compliance with its 

Site Security Plan. 

§ 27.230 Risk-based performance 

standards. 

(a) Covered facilities must satisfy the 

performance standards identified in this 

section. The Assistant Secretary will 

issue guidance on the application of 

these standards to risk-based tiers of 

covered facilities, and the acceptable 

layering of measures used to meet these 

standards will vary by risk-based tier. 

Each covered facility must select, 

develop in their Site Security Plan, and 

implement appropriately risk-based 

measures designed to satisfy the 

following performance standards: 

(1) Restrict Area Perimeter. Secure 

and monitor the perimeter of the 

facility; 

(2) Secure Site Assets. Secure and 

monitor restricted areas or potentially 

critical targets within the facility; 

(3) Screen and Control Access. 

Control access to the facility and to 

restricted areas within the facility by 

screening and/or inspecting individuals 

and vehicles as they enter, including, 

(i) Measures to deter the unauthorized 

introduction of dangerous substances 

and devices that may facilitate an attack 

or actions having serious negative 

consequences for the population 

surrounding the facility; and 

(ii) Measures implementing a 

regularly updated identification system 

that checks the identification of facility 

personnel and other persons seeking 

access to the facility and that 

discourages abuse through established 

disciplinary measures; 

(4) Deter, Detect, and Delay. Deter, 

detect, and delay an attack, creating 

sufficient time between detection of an 

attack and the point at which the attack 

becomes successful, including measures 

to: 

(i) Deter vehicles from penetrating the 

facility perimeter, gaining unauthorized 

access to restricted areas or otherwise 

presenting a hazard to potentially 

critical targets; 

(ii) Deter attacks through visible, 

professional, well maintained security 

measures and systems, including 

security personnel, detection systems, 

barriers and barricades, and hardened or 

reduced value targets; 

(iii) Detect attacks at early stages, 

through countersurveillance, frustration 

of opportunity to observe potential 

targets, surveillance and sensing 

systems, and barriers and barricades; 

and 

(iv) Delay an attack for a sufficient 

period of time so to allow appropriate 

response through on-site security 

response, barriers and barricades, 

hardened targets, and well-coordinated 

response planning; 

(5) Shipping, Receipt, and Storage. 

Secure and monitor the shipping, 

receipt, and storage of hazardous 

materials for the facility; 

(6) Theft and Diversion. Deter theft or 

diversion of potentially dangerous 

chemicals; 

(7) Sabotage. Deter insider sabotage; 

(8) Cyber. Deter cyber sabotage, 

including by preventing unauthorized 

onsite or remote access to critical 

process controls, such as Supervisory 

Control and Data Acquisition (SCADA) 

systems, Distributed Control Systems 

(DCS), Process Control Systems (PCS), 

Industrial Control Systems (ICS), critical 

business system, and other sensitive 

computerized systems; 

(9) Response. Develop and exercise an 

emergency plan to respond to security 

incidents internally and with assistance 

of local law enforcement and first 

responders; 

(10) Monitoring. Maintain effective 

monitoring, communications and 

warning systems, including, 

(i) Measures designed to ensure that 

security systems and equipment are in 

good working order and inspected, 

tested, calibrated, and otherwise 

maintained; 

(ii) Measures designed to regularly 

test security systems, note deficiencies, 

correct for detected deficiencies, and 

record results so that they are available 

for inspection by the Department; and 

(iii) Measures to allow the facility to 

promptly identify and respond to 

security system and equipment failures 

or malfunctions; 

(11) Training. Ensure proper security 

training, exercises, and drills of facility 

personnel; 

(12) Personnel Surety. Perform 

appropriate background checks on and 

ensure appropriate credentials for 

facility personnel, and as appropriate, 

for unescorted visitors with access to 

restricted areas or critical assets, 

including, 

(i) Measures designed to verify and 

validate identity; 

(ii) Measures designed to check 

criminal history; 

(iii) Measures designed to verify and 

validate legal authorization to work; and 

(iv) Measures designed to identify 

people with terrorist ties; 

(13) Elevated Threats. Escalate the 

level of protective measures for periods 

of elevated threat; 

(14) Specific Threats, Vulnerabilities, 

or Risks. Address specific threats, 

vulnerabilities or risks identified by the 

Assistant Secretary for the particular 

facility at issue; 

(15) Reporting of Significant Security 

Incidents. Report significant security 

incidents to the Department and to local 

law enforcement officials; 

(16) Significant Security Incidents 

and Suspicious Activities. Identify, 

investigate, report, and maintain records 

of significant security incidents and 

suspicious activities in or near the site; 

(17) Officials and Organization. 

Establish official(s) and an organization 

responsible for security and for 

compliance with these standards; 

(18) Records. Maintain appropriate 

records; and 

(19) Address any additional 

performance standards the Assistant 

Secretary may specify. 

(b) [Reserved] 

§ 27.235 Alternative security program. 

(a) Covered facilities may submit an 

Alternate Security Program (ASP) 

pursuant to the requirements of this 

section. The Assistant Secretary may 

approve an Alternate Security Program, 

in whole, in part, or subject to revisions 

or supplements, upon a determination 

that the Alternate Security Program 

meets the requirements of this Part and 

provides for an equivalent level of 

security to that established by this Part. 

(1) A Tier 4 facility may submit an 

ASP in lieu of a Security Vulnerability 

Assessment, Site Security Plan, or both. 

(2) Tier 1, Tier 2, or Tier 3 facilities 

may submit an ASP in lieu of a Site 

Security Plan. Tier 1, Tier 2, and Tier 

3 facilities may not submit an ASP in 

lieu of a Security Vulnerability 

Assessment. 

(b) The Department will provide 

notice to a covered facility about the 

approval or disapproval, in whole or in 

part, of an ASP, using the procedure 

specified in § 27.240 if the ASP is 

intended to take the place of a Security 

Vulnerability Assessment or using the 

procedure specified in § 27.245 if the 

ASP is intended to take the place of a 

Site Security Plan. 


rwilkins on PROD1PC63 with RULES_2
17734 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

§ 27.240 Review and approval of security 

vulnerability assessments. 

(a) Review and Approval. The 

Department will review and approve in 

writing all Security Vulnerability 

Assessments that satisfy the 

requirements of § 27.215, including 

Alternative Security Programs 

submitted pursuant to § 27.235. 

(b) If a Security Vulnerability 

Assessment does not satisfy the 

requirements of § 27.215, the 

Department will provide the facility 

with a written notification that includes 

a clear explanation of deficiencies in the 

Security Vulnerability Assessment. The 

facility shall then enter further 

consultations with the Department and 

resubmit a sufficient Security 

Vulnerability Assessment by the time 

specified in the written notification 

provided by the Department under this 

section. If the resubmitted Security 

Vulnerability Assessment does not 

satisfy the requirements of § 27.215, the 

Department will provide the facility 

with written notification (including a 

clear explanation of deficiencies in the 

SVA) of the Department’s disapproval of 

the SVA. 

§ 27.245 Review and approval of site 

security plans. 

(a) Review and Approval. (1) The 

Department will review and approve or 

disapprove all Site Security Plans that 

satisfy the requirements of § 27.225, 

including Alternative Security Programs 

submitted pursuant to § 27.235. 

(i) The Department will review Site 

Security Plans through a two-step 

process. Upon receipt of Site Security 

Plan from the covered facility, the 

Department will review the 

documentation and make a preliminary 

determination as to whether it satisfies 

the requirements of § 27.225. If the 

Department finds that the requirements 

are satisfied, the Department will issue 

a Letter of Authorization to the covered 

facility. 

(ii) Following issuance of the Letter of 

Authorization, the Department will 

inspect the covered facility in 

accordance with § 27.250 for purposes 

of determining compliance with the 

requirements of this Part. 

(iii) If the Department approves the 

Site Security Plan in accordance with 

§ 27.250, the Department will issue a 

Letter of Approval to the facility, and 

the facility shall implement the 

approved Site Security Plan. 

(2) The Department will not 

disapprove a Site Security Plan 

submitted under this Part based on the 

presence or absence of a particular 

security measure. The Department may 

disapprove a Site Security Plan that fails 

to satisfy the risk-based performance 

standards established in § 27.230. 

(b) When the Department disapproves 

a preliminary Site Security Plan issued 

prior to inspection or a Site Security 

Plan following inspection, the 

Department will provide the facility 

with a written notification that includes 

a clear explanation of deficiencies in the 

Site Security Plan. The facility shall 

then enter further consultations with the 

Department and resubmit a sufficient 

Site Security Plan by the time specified 

in the written notification provided by 

the Department under this section. If the 

resubmitted Site Security Plan does not 

satisfy the requirements of § 27.225, the 

Department will provide the facility 

with written notification (including a 

clear explanation of deficiencies in the 

SSP) of the Department’s disapproval of 

the SSP. 

§ 27.250 Inspections and audits. 

(a) Authority. In order to assess 

compliance with the requirements of 

this Part, authorized Department 

officials may enter, inspect, and audit 

the property, equipment, operations, 

and records of covered facilities. 

(b) Following preliminary approval of 

a Site Security Plan in accordance with 

§ 27.245, the Department will inspect 

the covered facility for purposes of 

determining compliance with the 

requirements of this Part. 

(1) If after the inspection, the 

Department determines that the 

requirements of § 27.225 have been met, 

the Department will issue a Letter of 

Approval to the covered facility. 

(2) If after the inspection, the 

Department determines that the 

requirements of § 27.225 have not been 

met, the Department will proceed as 

directed by § 27.245(b) in ‘‘Review and 

Approval of Site Security Plans.’’

(c) Time and Manner. Authorized 

Department officials will conduct audits 

and inspections at reasonable times and 

in a reasonable manner. The Department 

will provide covered facility owners 

and/or operators with 24-hour advance 

notice before inspections, except 

(1) If the Under Secretary or Assistant 

Secretary determines that an inspection 

without such notice is warranted by 

exigent circumstances and approves 

such inspection; or 

(2) If any delay in conducting an 

inspection might be seriously 

detrimental to security, and the Director 

of the Chemical Security Division 

determines that an inspection without 

notice is warranted, and approves an 

inspector to conduct such inspection. 

(d) Inspectors. Inspections and audits 

are conducted by personnel duly 

authorized and designated for that 

purpose as ‘‘inspectors’’ by the 

Secretary or the Secretary’s designee. 

(1) An inspector will, on request, 

present his or her credentials for 

examination, but the credentials may 

not be reproduced by the facility. 

(2) An inspector may administer oaths 

and receive affirmations, with the 

consent of any witness, in any matter. 

(3) An inspector may gather 

information by reasonable means 

including, but not limited to, 

interviews, statements, photocopying, 

photography, and video- and audiorecording. All documents, objects and 

electronically stored information 

collected by each inspector during the 

performance of that inspector’s duties 

shall be maintained for a reasonable 

period of time in the files of the 

Department of Homeland Security 

maintained for that facility or matter. 

(4) An inspector may request 

forthwith access to all records required 

to be kept pursuant to § 27.255. An 

inspector shall be provided with the 

immediate use of any photocopier or 

other equipment necessary to copy any 

such record. If copies can not be 

provided immediately upon request, the 

inspector shall be permitted 

immediately to take the original records 

for duplication and prompt return. 

(e) Confidentiality. In addition to the 

protections provided under CVI in 

§ 27.400, information received in an 

audit or inspection under this section, 

including the identity of the persons 

involved in the inspection or who 

provide information during the 

inspection, shall remain confidential 

under the investigatory file exception, 

or other appropriate exception, to the 

public disclosure requirements of 5 

U.S.C. 552. 

(f) Guidance. The Assistant Secretary 

shall issue guidance identifying 

appropriate processes for such 

inspections, and specifying the type and 

nature of documentation that must be 

made available for review during 

inspections and audits. 

§ 27.255 Recordkeeping requirements. 

(a) Except as provided in § 27.255(b), 

the covered facility must keep records of 

the activities as set out below for at least 

three years and make them available to 

the Department upon request. A covered 

facility must keep the following records: 

(1) Training. For training, the date and 

location of each session, time of day and 

duration of session, a description of the 

training, the name and qualifications of 

the instructor, a clear, legible list of 

attendees to include the attendee 

signature, at least one other unique 

identifier of each attendee receiving the 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17735 

training, and the results of any 

evaluation or testing. 

(2) Drills and exercises. For each drill 

or exercise, the date held, a description 

of the drill or exercise, a list of 

participants, a list of equipment (other 

than personal equipment) tested or 

employed in the exercise, the name(s) 

and qualifications of the exercise 

director, and any best practices or 

lessons learned which may improve the 

Site Security Plan; 

(3) Incidents and breaches of security. 

Date and time of occurrence, location 

within the facility, a description of the 

incident or breach, the identity of the 

individual to whom it was reported, and 

a description of the response; 

(4) Maintenance, calibration, and 

testing of security equipment. The date 

and time, name and qualifications of the 

technician(s) doing the work, and the 

specific security equipment involved for 

each occurrence of maintenance, 

calibration, and testing; 

(5) Security threats. Date and time of 

occurrence, how the threat was 

communicated, who received or 

identified the threat, a description of the 

threat, to whom it was reported, and a 

description of the response; 

(6) Audits. For each audit of a covered 

facility’s Site Security Plan (including 

each audit required under § 27.225(e)) 

or Security Vulnerability Assessment, a 

record of the audit, including the date 

of the audit, results of the audit, name(s) 

of the person(s) who conducted the 

audit, and a letter certified by the 

covered facility stating the date the 

audit was conducted. 

(7) Letters of Authorization and 

Approval. All Letters of Authorization 

and Approval from the Department, and 

documentation identifying the results of 

audits and inspections conducted 

pursuant to § 27.250. 

(b) A covered facility must retain 

records of submitted Top-Screens, 

Security Vulnerability Assessments, Site 

Security Plans, and all related 

correspondence with the Department for 

at least six years and make them 

available to the Department upon 

request. 

(c) To the extent necessary for 

security purposes, the Department may 

request that a covered facility make 

available records kept pursuant to other 

Federal programs or regulations. 

(d) Records required by this section 

may be kept in electronic format. If kept 

in an electronic format, they must be 

protected against unauthorized access, 

deletion, destruction, amendment, and 

disclosure. 

Subpart C—Orders and Adjudications 

§ 27.300 Orders. 

(a) Orders Generally. When the 

Assistant Secretary determines that a 

facility is in violation of any of the 

requirements of this Part, the Assistant 

Secretary may take appropriate action 

including the issuance of an appropriate 

Order. 

(b) Orders Assessing Civil Penalty and 

Orders to Cease Operations. (1) Where 

the Assistant Secretary determines that 

a facility is in violation of an Order 

issued pursuant to paragraph (a) of this 

section, the Assistant may enter an 

Order Assessing Civil Penalty, Order to 

Cease Operations, or both. 

(2) Following the issuance of an Order 

by the Assistant Secretary pursuant to 

paragraph (b)(1) of this section, the 

facility may enter further consultations 

with Department. 

(3) Where the Assistant Secretary 

determines that a facility is in violation 

of an Order issued pursuant to 

paragraph (a) of this section and issues 

an Order Assessing Civil Penalty 

pursuant to paragraph (b)(1) of this 

section, a chemical facility is liable to 

the United States for a civil penalty of 

not more than $25,000 for each day 

during which the violation continues. 

(c) Procedures for Orders. (1) At a 

minimum, an Order shall be signed by 

the Assistant Secretary, shall be dated, 

and shall include: 

(i) The name and address of the 

facility in question; 

(ii) A listing of the provision(s) that 

the facility is alleged to have violated; 

(iii) A statement of facts upon which 

the alleged instances of noncompliance 

are based; 

(iv) A clear explanation of 

deficiencies in the facility’s chemical 

security program, including, if 

applicable, any deficiencies in the 

facility’s Security Vulnerability 

Assessment, Site Security Plan, or both; 

and 

(v) A statement, indicating what 

action(s) the chemical must take to 

remedy the instance(s) of 

noncompliance; and 

(vi) The date by which the facility 

must comply with the terms of the 

Order. 

(2) The Assistant Secretary may 

establish procedures for the issuance of 

Orders. 

(d) A facility must comply with the 

terms of the Order by the date specified 

in the Order unless the facility has filed 

a timely Notice for Application for 

Review under § 27.310. 

(e) Where a facility or other person 

contests the determination of the 

Assistant Secretary to issue an Order, a 

chemical facility may seek an 

adjudication pursuant to § 27.310. 

(f) An Order issued under this section 

becomes final agency action when the 

time to file a Notice of Application of 

Review under § 27.310 has passed 

without such a filing or upon the 

conclusion of adjudication or appeal 

proceedings under this subpart. 

§ 27.305 Neutral adjudications. 

(a) Any facility or other person who 

has received a Finding pursuant to 

§ 27.230(a)(12)(iv), a Determination 

pursuant to § 27.245(b), or an Order 

pursuant to § 27.300 is entitled to an 

adjudication, by a neutral adjudications 

officer, of any issue of material fact 

relevant to any administrative action 

which deprives that person of a 

cognizable interest in liberty or 

property. 

(b) A neutral adjudications officer 

appointed pursuant to § 27.315 shall 

issue an Initial Decision on any material 

factual issue related to a Finding 

pursuant to § 27.230(a)(12)(iv), a 

Determination pursuant to § 27.245, or 

an Order pursuant to § 27.300 before 

any such administrative action is 

reviewed on appeal pursuant to 

§ 27.345. 

§ 27.310 Commencement of adjudication 

proceedings. 

(a) Proceedings Instituted by Facilities 

or other Persons. A facility or other 

person may institute proceedings to 

review a determination by the Assistant 

Secretary: 

(1) Finding, pursuant to the 

§ 27.230(a)(12)(iv), that an individual is 

a potential security threat; 

(2) Disapproving a Site Security Plan 

pursuant to § 27.245(b); or 

(3) Issuing an Order pursuant to 

§ 27.300(a) or (b). 

(b) Procedure for Applications by 

Facilities or other Persons. A facility or 

other person may institute Proceedings 

by filing a Notice of Application for 

Review specifying that the facility or 

other person requests a Proceeding to 

review a determination specified in 

paragraph (a) of this section. 

(1) An Applicant institutes a 

Proceeding by filing a Notice of 

Application for Review with the office 

of the Department hereinafter 

designated by the Secretary. 

(2) An Applicant must file a Notice of 

Application for Review within seven 

calendar days of notification to the 

facility or other person of the Assistant 

Secretary’s Finding, Determination, or 

Order. 

(3) The Applicant shall file and 

simultaneously serve each Notice of 

Application for Review and all 


rwilkins on PROD1PC63 with RULES_2
17736 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

subsequent filings on the Assistant 

Secretary and the General Counsel. 

(4) An Order is stayed from the timely 

filing of a Notice of Application for 

Review until the Presiding Officer 

issues an Initial Decision, unless the 

Secretary has lifted the stay due to 

exigent circumstances pursuant to 

paragraph (d) of this section. 

(5) The Applicant shall file and serve 

an Application for Review within 

fourteen calendar days of the 

notification to the facility or other 

person of the Assistant Secretary’s 

Finding, Determination, or Order. 

(6) Each Application for Review shall 

be accompanied by all legal 

memoranda, other documents, 

declarations, affidavits, and other 

evidence supporting the position 

asserted by the Applicant. 

(c) Response. The Assistant Secretary, 

through the Office of General Counsel, 

shall file and serve a Response, 

accompanied by all legal memoranda, 

other documents, declarations, 

affidavits and other evidence supporting 

the position asserted by the Assistant 

Secretary within fourteen calendar days 

of the filing and service of the 

Application for Review and all 

supporting papers. 

(d) Procedural Modifications. The 

Secretary may, in exigent circumstances 

(as determined in his sole discretion): 

(1) Lift any stay applicable to any 

Order under § 27.300; 

(2) Modify the time for a response; 

(3) Rule on the sufficiency of 

Applications for Review; or 

(4) Otherwise modify these 

procedures with respect to particular 

matters. 

§ 27.315 Presiding officers for 

proceedings. 

(a) Immediately upon the filing of any 

Application for Review, the Secretary 

shall appoint an attorney, who is 

employed by the Department and who 

has not performed any investigative or 

prosecutorial function with respect to 

the matter, to act as a neutral 

adjudications officer or Presiding 

Officer for the compilation of a factual 

record and the recommendation of an 

Initial Decision for each Proceeding. 

(b) Notwithstanding paragraph (a) of 

this section, the Secretary may appoint 

one or more attorneys who are 

employed by the Department and who 

do not perform any investigative or 

prosecutorial function with respect to 

this subpart, to serve generally in the 

capacity as Presiding Officer(s) for such 

matters pursuant to such procedures as 

the Secretary may hereafter establish. 

§ 27.320 Prohibition on ex parte 

communications during proceedings. 

(a) At no time after the designation of 

a Presiding Officer for a Proceeding and 

prior to the issuance of a Final Decision 

pursuant to § 27.345 with respect to a 

facility or other person, shall the 

appointed Presiding Officer, or any 

person who will advise that official in 

the decision on the matter, discuss ex 

parte the merits of the proceeding with 

any interested person outside the 

Department, with any Department 

official who performs a prosecutorial or 

investigative function in such 

proceeding or a factually related 

proceeding, or with any representative 

of such person. 

(b) If, after appointment of a Presiding 

Officer and prior to the issuance of a 

Final Decision pursuant to § 27.345 with 

respect to a facility or other person, the 

appointed Presiding Officer, or any 

person who will advise that official in 

the decision on the matter, receives 

from or on behalf of any party, by means 

of an ex parte communication, 

information which is relevant to the 

decision of the matter and to which 

other parties have not had an 

opportunity to respond, a summary of 

such information shall be served on all 

other parties, who shall have an 

opportunity to reply to the ex parte 

communication within a time set by the 

Presiding Officer. 

(c) The consideration of classified 

information or CVI pursuant to an in 

camera procedure does not constitute a 

prohibited ex parte communication for 

purposes of this subpart. 

§ 27.325 Burden of proof. 

The Assistant Secretary bears the 

initial burden of proving the facts 

necessary to support the challenged 

administrative action at every 

proceeding instituted under this 

subpart. 

§ 27.330 Summary decision procedures. 

(a) The Presiding Officer appointed 

for each Proceeding shall immediately 

consider whether the summary 

adjudication of the Application for 

Review is appropriate based on the 

Application for Review, the Response, 

and all the supporting filings of the 

parties pursuant to §§ 27.310(b)(5) and 

27.310(c). 

(1) The Presiding Officer shall 

promptly issue any necessary 

scheduling order for any additional 

briefing of the issue of summary 

adjudication on the Application for 

Review and Response. 

(2) The Presiding Officer may conduct 

scheduling conferences and other 

proceedings that the Presiding Officer 

determines to be appropriate. 

(b) If the Presiding Officer determines 

that there is no genuine issue of material 

fact and that one party or the other is 

entitled to decision as a matter of law, 

then the record shall be closed and the 

Presiding Officer shall issue an Initial 

Decision on the Application for Review 

pursuant to § 27.340. 

(c) If a Presiding Officer determines 

that any factual issues require the crossexamination of one or more witnesses or 

other proceedings at a hearing, the 

Presiding Officer, in consultation with 

the parties, shall promptly schedule a 

hearing to be conducted pursuant to 

§ 27.335. 

§ 27.335 Hearing procedures. 

(a) Any hearing shall be held as 

expeditiously as possible at the location 

most conducive to a prompt 

presentation of any necessary testimony 

or other proceedings. 

(1) Videoconferencing and 

teleconferencing may be used where 

appropriate at the discretion of the 

Presiding Officer. 

(2) Each party offering the affirmative 

testimony of a witness shall present that 

testimony by declaration, affidavit, or 

other sworn statement submitted in 

advance as ordered by the Presiding 

Officer. 

(3) Any witness presented for further 

examination shall be asked to testify 

under an oath or affirmation. 

(4) The hearing shall be recorded 

verbatim. 

(b)(1) A facility or other person may 

appear and be heard on his own behalf 

or through any counsel of his choice 

who is qualified to possess CVI. 

(2) A facility of other person 

individually, or through counsel, may 

offer relevant and material information 

including written direct testimony 

which he believes should be considered 

in opposition to the administrative 

action or which may bear on the 

sanction being sought. 

(3) The facility or other person 

individually, or through counsel, may 

conduct such cross-examination as may 

be specifically allowed by the Presiding 

Officer for a full determination of the 

facts. 

§ 27.340 Completion of adjudication 

proceedings. 

(a) The Presiding Officer shall close 

and certify the record of the 

adjudication promptly upon the 

completion of: 

(1) Summary judgment proceedings, 

(2) A hearing, if necessary, 

(3) The submission of post hearing 

briefs, if any are ordered by the 

Presiding Officer, and 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17737 

(4) The conclusion of oral arguments, 

if any are permitted by the Presiding 

Officer. 

(b) The Presiding Officer shall issue 

an Initial Decision based on the certified 

record, and the decision shall be subject 

to appeal pursuant to § 27.345. 

(c) An Initial Decision shall become a 

final agency action on the expiration of 

the time for an Appeal pursuant to 

§ 27.345. 

§ 27.345 Appeals. 

(a) Right to Appeal. A facility or any 

person who has received an Initial 

Decision under § 27.340(b) has the right 

to appeal to the Under Secretary acting 

as a neutral appeals officer. 

(b) Procedure for Appeals. (1) The 

Assistant Secretary, a facility or other 

person, or a representative on behalf of 

a facility or person, may institute an 

Appeal by filing a Notice of Appeal with 

the office of the Department hereinafter 

designated by the Secretary. 

(2) The Assistant Secretary, a facility, 

or other person must file a Notice of 

Appeal within seven calendar days of 

the service of the Presiding Officer’s 

Initial Decision. 

(3) The Appellant shall file with the 

designated office and simultaneously 

serve each Notice of Appeal and all 

subsequent filings on the General 

Counsel. 

(4) An Initial Decision is stayed from 

the timely filing of a Notice of Appeal 

until the Under Secretary issues a Final 

Decision, unless the Secretary lifts the 

stay due to exigent circumstances 

pursuant to § 27.310(d). 

(5) The Appellant shall file and serve 

a Brief within 28 calendar days of the 

notification of the service of the 

Presiding Officer’s Initial Decision. 

(6) The Appellee shall file and serve 

its Opposition Brief within 28 calendar 

days of the service of the Appellant’s 

Brief. 

(c) The Under Secretary may provide 

for an expedited appeal for appropriate 

matters. 

(d) Ex Parte Communications. (1) At 

no time after the filing of a Notice of 

Appeal pursuant to paragraph (b)(1) of 

this section and prior to the issuance of 

a Final Decision on an Appeal pursuant 

to paragraph (f) of this section with 

respect to a facility or other person shall 

the Under Secretary, his designee, or 

any person who will advise that official 

in the decision on the matter, discuss ex 

parte the merits of the proceeding with 

any interested person outside the 

Department, with any Department 

official who performs a prosecutorial or 

investigative function in such 

proceeding or a factually related 

proceeding, or with any representative 

of such person. 

(2) If, after the filing of a Notice of 

Appeal pursuant to paragraph (b)(1) of 

this section and prior to the issuance of 

a Final Decision on an Appeal pursuant 

to paragraph (f) of this section with 

respect to a facility or other person, the 

Under Secretary, his designee, or any 

person who will advise that official in 

the decision on the matter, receives 

from or on behalf of any party, by means 

of an ex parte communication, 

information which is relevant to the 

decision of the matter and to which 

other parties have not had an 

opportunity to respond, a summary of 

such information shall be served on all 

other parties, who shall have an 

opportunity to reply to the ex parte 

communication within a time set by the 

Under Secretary or his designee. 

(3) The consideration of classified 

information or CVI pursuant to an in 

camera procedure does not constitute a 

prohibited ex parte communication for 

purposes of this subpart. 

(e) A facility or other person may elect 

to have the Under Secretary participate 

in any mediation or other resolution 

process by expressly waiving, in 

writing, any argument that such 

participation has compromised the 

Appeal process. 

(f) The Under Secretary shall issue a 

Final Decision and serve it upon the 

parties. A Final Decision made by the 

Under Secretary constitutes final agency 

action. 

(g) The Secretary may establish 

procedures for the conduct of Appeals 

pursuant to this section. 

Subpart D—Other 

§ 27.400 Chemical-terrorism vulnerability 

information. 

(a) Applicability. This section governs 

the maintenance, safeguarding, and 

disclosure of information and records 

that constitute Chemical-terrorism 

Vulnerability Information (CVI), as 

defined in § 27.400(b). The Secretary 

shall administer this section consistent 

with Section 550(c) of the Homeland 

Security Appropriations Act of 2007, 

including appropriate sharing with 

Federal, State and local officials. 

(b) Chemical-terrorism Vulnerability 

Information. In accordance with Section 

550(c) of the Department of Homeland 

Security Appropriations Act of 2007, 

the following information, whether 

transmitted verbally, electronically, or 

in written form, shall constitute CVI: 

(1) Security Vulnerability 

Assessments under § 27.215; 

(2) Site Security Plans under § 27.225; 

(3) Documents relating to the 

Department’s review and approval of 

Security Vulnerability Assessments and 

Site Security Plans, including Letters of 

Authorization, Letters of Approval and 

responses thereto; written notices; and 

other documents developed pursuant to 

§§ 27.240 or 27.245; 

(4) Alternate Security Programs under 

§ 27.235; 

(5) Documents relating to inspection 

or audits under § 27.250; 

(6) Any records required to be created 

or retained under § 27.255; 

(7) Sensitive portions of orders, 

notices or letters under § 27.300; 

(8) Information developed pursuant to 

§§ 27.200 and 27.205; and 

(9) Other information developed for 

chemical facility security purposes that 

the Secretary, in his discretion, 

determines is similar to the information 

protected in § 27.400(b)(1) through (8) 

and thus warrants protection as CVI. 

(c) Covered Persons. Persons subject 

to the requirements of this section are: 

(1) Each person who has a need to 

know CVI, as specified in § 27.400(e); 

(2) Each person who otherwise 

receives or gains access to what they 

know or should reasonably know 

constitutes CVI. 

(d) Duty to protect information. A 

covered person must—

(1) Take reasonable steps to safeguard 

CVI in that person’s possession or 

control, including electronic data, from 

unauthorized disclosure. When a person 

is not in physical possession of CVI, the 

person must store it in a secure 

container, such as a safe, that limits 

access only to covered persons with a 

need to know; 

(2) Disclose, or otherwise provide 

access to, CVI only to persons who have 

a need to know; 

(3) Refer requests for CVI by persons 

without a need to know to the Assistant 

Secretary; 

(4) Mark CVI as specified in 

§ 27.400(f); 

(5) Dispose of CVI as specified in 

§ 27.400(k); 

(6) If a covered person receives a 

record or verbal transmission containing 

CVI that is not marked as specified in 

§ 27.400(f), the covered person must—

(i) Mark the record as specified in 

§ 27.400(f) of this section; and 

(ii) Inform the sender of the record 

that the record must be marked as 

specified in § 27.400(f); or 

(iii) If received verbally, make 

reasonable efforts to memorialize such 

information and mark the memorialized 

record as specified in § 27.400(f) of this 

section, and inform the speaker of any 

determination that such information 

warrants CVI protection. 

(7) When a covered person becomes 

aware that CVI has been released to 


rwilkins on PROD1PC63 with RULES_2
17738 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

persons without a need to know 

(including a covered person under 

§ 27.400(c)(2)), the covered person must 

promptly inform the Assistant 

Secretary. 

(8) In the case of information that is 

CVI and also has been designated as 

critical infrastructure information under 

Section 214 of the Homeland Security 

Act, any covered person in possession 

of such information must comply with 

the disclosure restrictions and other 

requirements applicable to such 

information under Section 214 and any 

implementing regulations. 

(e) Need to know. (1) A person, 

including a State or local official, has a 

need to know CVI in each of the 

following circumstances: 

(i) When the person requires access to 

specific CVI to carry out chemical 

facility security activities approved, 

accepted, funded, recommended, or 

directed by the Department. 

(ii) When the person needs the 

information to receive training to carry 

out chemical facility security activities 

approved, accepted, funded, 

recommended, or directed by the 

Department. 

(iii) When the information is 

necessary for the person to supervise or 

otherwise manage individuals carrying 

out chemical facility security activities 

approved, accepted, funded, 

recommended, or directed by the 

Department. 

(iv) When the person needs the 

information to provide technical or legal 

advice to a covered person, who has a 

need to know the information, regarding 

chemical facility security requirements 

of Federal law. 

(v) When the Department determines 

that access is required under 

§§ 27.400(h) or 27.400(i) in the course of 

a judicial or administrative proceeding. 

(2) Federal employees, contractors, 

and grantees. (i) A Federal employee 

has a need to know CVI if access to the 

information is necessary for 

performance of the employee’s official 

duties. 

(ii) A person acting in the 

performance of a contract with or grant 

from the Department has a need to know 

CVI if access to the information is 

necessary to performance of the contract 

or grant. Contractors or grantees may not 

further disclose CVI without the consent 

of the Assistant Secretary. 

(iii) The Department may require that 

non-Federal persons seeking access to 

CVI complete a non-disclosure 

agreement before such access is granted. 

(3) Background check. The 

Department may make an individual’s 

access to the CVI contingent upon 

satisfactory completion of a security 

background check or other procedures 

and requirements for safeguarding CVI 

that are satisfactory to the Department. 

(4) Need to know further limited by 

the Department. For some specific CVI, 

the Department may make a finding that 

only specific persons or classes of 

persons have a need to know. 

(5) Nothing in § 27.400(e) shall 

prevent the Department from 

determining, in its discretion, that a 

person not otherwise listed in 

§ 27.400(e) has a need to know CVI in 

a particular circumstance. 

(f) Marking of paper records. (1) In the 

case of paper records containing CVI, a 

covered person must mark the record by 

placing the protective marking 

conspicuously on the top, and the 

distribution limitation statement on the 

bottom, of—

(i) The outside of any front and back 

cover, including a binder cover or 

folder, if the document has a front and 

back cover; 

(ii) Any title page; and 

(iii) Each page of the document. 

(2) Protective marking. The protective 

marking is: CHEMICAL-TERRORISM 

VULNERABILITY INFORMATION. 

(3) Distribution limitation statement. 

The distribution limitation statement is: 

WARNING: This record contains 

Chemical-terrorism Vulnerability 

Information controlled by 6 CFR 27.400. 

Do not disclose to persons without a 

‘‘need to know’’ in accordance with 6 

CFR 27.400(e). Unauthorized release 

may result in civil penalties or other 

action. In any administrative or judicial 

proceeding, this information shall be 

treated as classified information in 

accordance with 6 CFR 27.400(h) and 

(i). 

(4) Other types of records. In the case 

of non-paper records that contain CVI, 

including motion picture films, 

videotape recordings, audio recording, 

and electronic and magnetic records, a 

covered person must clearly and 

conspicuously mark the records with 

the protective marking and the 

distribution limitation statement such 

that the viewer or listener is reasonably 

likely to see or hear them when 

obtaining access to the contents of the 

record. 

(g) Disclosure by the Department—In 

general. (1) Except as otherwise 

provided in this section, and 

notwithstanding the Freedom of 

Information Act (5 U.S.C. 552), the 

Privacy Act (5 U.S.C. 552a), and other 

laws, records containing CVI are not 

available for public inspection or 

copying, nor does the Department 

release such records to persons without 

a need to know. 

(2) Disclosure of Segregatable 

Information under the Freedom of 

Information Act and the Privacy Act. If 

a record is marked to signify both CVI 

and information that is not CVI, the 

Department, on a proper Freedom of 

Information Act or Privacy Act request, 

may disclose the record with the CVI 

redacted, provided the record is not 

otherwise exempt from disclosure under 

the Freedom of Information Act or 

Privacy Act. 

(h) Disclosure in administrative 

enforcement proceedings. (1) The 

Department may provide CVI to a 

person governed by Section 550, and his 

counsel, in the context of an 

administrative enforcement proceeding 

of Section 550 when, in the sole 

discretion of the Department, as 

appropriate, access to the CVI is 

necessary for the person to prepare a 

response to allegations contained in a 

legal enforcement action document 

issued by the Department. 

(2) Security background check. Prior 

to providing CVI to a person under 

§ 27.400(h)(1), the Department may 

require the individual or, in the case of 

an entity, the individuals representing 

the entity, and their counsel, to undergo 

and satisfy, in the judgment of the 

Department, a security background 

check. 

(i) Disclosure in judicial proceedings. 

(1) In any judicial enforcement 

proceeding of Section 550, the 

Secretary, in his sole discretion, may, 

subject to § 27.400(i)(1)(i), authorize 

access to CVI for persons necessary for 

the conduct of such proceedings, 

including such persons’ counsel, 

provided that no other persons not so 

authorized shall have access to or be 

present for the disclosure of such 

information. 

(i) Security background check. Prior 

to providing CVI to a person under 

§ 27.400(i)(1), the Department may 

require the individual to undergo and 

satisfy, in the judgment of the 

Department, a security background 

check. 

(ii) [Reserved] 

(2) In any judicial enforcement 

proceeding of Section 550 where a 

person seeks to disclose CVI to a person 

not authorized to receive it under 

paragraph (i)(1) of this section, or where 

a person not authorized to receive CVI 

under paragraph (i)(1) of this section 

seeks to compel its disclosure through 

discovery, the United States may make 

an ex parte application in writing to the 

court seeking authorization to—

(i) Redact specified items of CVI from 

documents to be introduced into 

evidence or made available to the 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17739 

defendant through discovery under the 

Federal Rules of Civil Procedure; 

(ii) Substitute a summary of the 

information for such CVI; or 

(iii) Substitute a statement admitting 

relevant facts that the CVI would tend 

to prove. 

(3) The court shall grant a request 

under paragraph (i)(2) of this section if, 

after in camera review, the court finds 

that the redacted item, stipulation, or 

summary is sufficient to allow the 

defendant to prepare a defense. 

(4) If the court enters an order 

granting a request under paragraph (i)(2) 

of this section, the entire text of the 

documents to which the request relates 

shall be sealed and preserved in the 

records of the court to be made available 

to the appellate court in the event of an 

appeal. 

(5) If the court enters an order 

denying a request of the United States 

under paragraph (i)(2) of this section, 

the United States may take an 

immediate, interlocutory appeal of the 

court’s order in accordance with 18 

U.S.C. 2339B(f)(4), (5). For purposes of 

such an appeal, the entire text of the 

documents to which the request relates, 

together with any transcripts of 

arguments made ex parte to the court in 

connection therewith, shall be 

maintained under seal and delivered to 

the appellate court. 

(6) Except as provided otherwise at 

the sole discretion of the Secretary, 

access to CVI shall not be available in 

any civil or criminal litigation unrelated 

to the enforcement of Section 550. 

(7) Taking of trial testimony—

(i) Objection—During the examination 

of a witness in any judicial proceeding, 

the United States may object to any 

question or line of inquiry that may 

require the witness to disclose CVI not 

previously found to be admissible. 

(ii) Action by court—In determining 

whether a response is admissible, the 

court shall take precautions to guard 

against the compromise of any CVI, 

including—

(A) Permitting the United States to 

provide the court, ex parte, with a 

proffer of the witness’s response to the 

question or line of inquiry; and 

(B) Requiring the defendant to 

provide the court with a proffer of the 

nature of the information that the 

defendant seeks to elicit. 

(iii) Obligation of defendant—In any 

judicial enforcement proceeding, it shall 

be the defendant’s obligation to 

establish the relevance and materiality 

of any CVI sought to be introduced. 

(8) Construction. Nothing in this 

subsection shall prevent the United 

States from seeking protective orders or 

asserting privileges ordinarily available 

to the United States to protect against 

the disclosure of classified information, 

including the invocation of the military 

and State secrets privilege. 

(j) Consequences of Violation. 

Violation of this section is grounds for 

a civil penalty and other enforcement or 

corrective action by the Department, 

and appropriate personnel actions for 

Federal employees. Corrective action 

may include issuance of an order 

requiring retrieval of CVI to remedy 

unauthorized disclosure or an order to 

cease future unauthorized disclosure. 

(k) Destruction of CVI. (1) The 

Department of Homeland Security. 

Subject to the requirements of the 

Federal Records Act (5 U.S.C. 105), 

including the duty to preserve records 

containing documentation of a Federal 

agency’s policies, decisions, and 

essential transactions, the Department 

destroys CVI when no longer needed to 

carry out the agency’s function. 

(2) Other covered persons—(i) In 

general. A covered person must destroy 

CVI completely to preclude recognition 

or reconstruction of the information 

when the covered person no longer 

needs the CVI to carry out security 

measures under paragraph (e) of this 

section. 

(ii) Exception. Section 27.400(k)(2) 

does not require a State or local 

government agency to destroy 

information that the agency is required 

to preserve under State or local law. 

§ 27.405 Review and preemption of State 

laws and regulations. 

(a) As per current law, no law, 

regulation, or administrative action of a 

State or political subdivision thereof, or 

any decision or order rendered by a 

court under state law, shall have any 

effect if such law, regulation, or 

decision conflicts with, hinders, poses 

an obstacle to or frustrates the purposes 

of this regulation or of any approval, 

disapproval or order issued there under. 

(1) Nothing in this part is intended to 

displace other federal requirements 

administered by the Environmental 

Protection Agency, U.S. Department of 

Justice, U.S. Department of Labor, U.S. 

Department of Transportation, or other 

federal agencies. 

(2) [Reserved] 

(b) State law, regulation or 

administrative action defined. For 

purposes of this section, the phrase 

‘‘State law, regulation or administrative 

action’’ means any enacted law, 

promulgated regulation, ordinance, 

administrative action, order or decision, 

or common law standard of a State or 

any of its political subdivisions. 

(c) Submission for review. Any 

chemical facility covered by these 

regulations and any State may petition 

the Department by submitting a copy of 

a State law, regulation, or administrative 

action, or decision or order of a court for 

review under this section. 

(d) Review and opinion—(1) Review. 

The Department may review State laws, 

administrative actions, or opinions or 

orders of a court under State law and 

regulations submitted under this 

section, and may offer an opinion 

whether the application or enforcement 

of the State law or regulation would 

conflict with, hinder, pose an obstacle 

to or frustrate the purposes of this Part. 

(2) Opinion. The Department may 

issue a written opinion on any question 

regarding preemption. If the question 

was submitted under subsection (c) of 

this part, the Assistant Secretary will 

notify the affected chemical facility and 

the Attorney General of the subject State 

of any opinion under this section. 

(3) Consultation with States. In 

conducting a review under this section, 

the Department will seek the views of 

the State or local jurisdiction whose 

laws may be affected by the 

Department’s review. 

§ 27.410 Third party actions. 

(a) Nothing in this Part shall confer 

upon any person except the Secretary a 

right of action, in law or equity, for any 

remedy including, but not limited to, 

injunctions or damages to enforce any 

provision of this Part. 

(b) An owner or operator of a 

chemical facility may petition the 

Assistant Secretary to provide the 

Department’s view in any litigation 

involving any issues or matters 

regarding this Part. 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

1,1,3,3,3-pentafluoro-2-(trifluoromethyl)-1-propene ..................................................................... 382–21–8 Any Amount. 

1,1-Dimethylhydrazine ................................................................................................................. 57–14–7 11,250. 


rwilkins on PROD1PC63 with RULES_2
17740 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST—Continued 

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

1,2-bis(2-chloroethylthio)ethane .................................................................................................. 3563–36–8 Any Amount. 

1,3-bis(2-chloroethylthio)-n-propane ............................................................................................ 63905–10–2 Any Amount. 

1,3-Butadiene ............................................................................................................................... 106–99–0 7,500. 

1,3-Pentadiene ............................................................................................................................. 504–60–9 7,500. 

1,4-bis(2-chloroethylthio)-n-butane .............................................................................................. 142868–93–7 Any Amount. 

1,5-bis(2-chloroethylthio)-n-pentane ............................................................................................ 142868–94–8 Any Amount. 

1-Butene ...................................................................................................................................... 106–98–9 7,500. 

1-Chloropropylene ....................................................................................................................... 590–21–6 7,500. 

1H-Tetrazole ................................................................................................................................ 16681–77–9 2,000. 

1-Pentane .................................................................................................................................... 109–67–1 7,500. 

2,2-Dimethylpropane .................................................................................................................... 463–82–1 7,500. 

2-Butene ...................................................................................................................................... 107–01–7 7,500. 

2-Butene-cis ................................................................................................................................. 590–18–1 7,500. 

2-Butene-trans ............................................................................................................................. 624–64–6 7,500. 

2-chloroethylchloromethylsulfide .................................................................................................. 2625–76–5 Any Amount. 

2-Chloropropylene ....................................................................................................................... 557–98–2 7,500. 

2-Chlorovinyldichloroarsine .......................................................................................................... 541–25–3 Any Amount. 

2-Methyl-1-butene ........................................................................................................................ 563–46–2 7,500. 

2-Methylpropene .......................................................................................................................... 115–11–7 7,500. 

2-Pentene, (Z)- ............................................................................................................................ 627–20–3 7,500. 

2-Pentene,(E)- ............................................................................................................................. 646–04–8 7,500. 

3,3-dimethyl-2-butanol ................................................................................................................. 464–07–3 Any Amount. 

3-Methyl-1-butene ........................................................................................................................ 563–45–1 7,500. 

3-Quinuclidinyl benzilate (BZ) ...................................................................................................... 62869–69–6 Any Amount. 

5-Nitrobenzotriazol ....................................................................................................................... 2338–12–7 2,000. 

Acetaldehyde ............................................................................................................................... 75–07–0 7,500. 

Acetone ........................................................................................................................................ 67–64–1 2,000. 

Acetone cyanohydrin, stabilized .................................................................................................. 75–86–5 2,000. 

Acetyl bromide ............................................................................................................................. 506–96–7 2,000. 

Acetyl chloride ............................................................................................................................. 75–36–5 2,000. 

Acetyl iodide ................................................................................................................................ 507–02–8 2,000. 

Acetylene ..................................................................................................................................... 74–86–2 7,500. 

Acrolein ........................................................................................................................................ 107–02–8 3,750. 

Acrylonitrile .................................................................................................................................. 107–13–1 15,000. 

Acrylyl chloride ............................................................................................................................. 814–68–6 3,750. 

Allyl alcohol .................................................................................................................................. 107–18–6 11,250. 

Allylamine ..................................................................................................................................... 107–11–9 7,500. 

Allyltrichlorosilane, stabilized ....................................................................................................... 107–37–9 2,000. 

Aluminum bromide, anhydrous .................................................................................................... 7727–15–3 2,000. 

Aluminum chloride, anhydrous .................................................................................................... 7446–70–0 2,000. 

Aluminum phosphide ................................................................................................................... 20859–73–8 2,000. 

Ammonia (anhydrous) ................................................................................................................. 7664–41–7 7,500. 

Ammonia (conc. 20% or greater) ................................................................................................ 7664–41–7 15,000. 

Ammonium nitrate (nitrogen concentration of 28%–34%) .......................................................... 6484–52–2 2,000. 

Ammonium perchlorate ................................................................................................................ 7790–98–9 2,000. 

Ammonium picrate ....................................................................................................................... 131–74–8 2,000. 

Amyltrichlorosilane ....................................................................................................................... 107–72–2 2,000. 

Antimony pentafluoride ................................................................................................................ 7783–70–2 2,000. 

Arsenous trichloride ..................................................................................................................... 7784–34–1 Any Amount. 

Arsine ........................................................................................................................................... 7784–42–1 Any Amount. 

Barium azide ................................................................................................................................ 18810–58–7 2,000. 

bis(2-chloroethyl)ethylamine ........................................................................................................ 538–07–8 Any Amount. 

bis(2-chloroethyl)methylamine ..................................................................................................... 51–75–2 Any Amount. 

bis(2-chloroethyl)sulfide ............................................................................................................... 505–60–2 Any Amount. 

bis(2-chloroethylthio)methane ...................................................................................................... 63869–13–6 Any Amount. 

bis(2-chloroethylthioethyl)ether .................................................................................................... 63918–89–8 Any Amount. 

bis(2-chloroethylthiomethyl)ether ................................................................................................. 63918–90–1 Any Amount. 

bis(2-chlorovinyl)chloroarsine ...................................................................................................... 40334–69–8 Any Amount. 

Boron tribromide .......................................................................................................................... 10294–33–4 2,000. 

Boron trichloride ........................................................................................................................... 10294–34–5 Any Amount. 

Boron triflouride ........................................................................................................................... 7637–07–2 Any Amount. 

Boron triflouride compound with methyl ether (1:1) .................................................................... 353–42–4 11,250. 

Bromine ........................................................................................................................................ 7726–95–6 7,500. 

Bromine chloride .......................................................................................................................... 13863–41–7 Any Amount. 

Bromine pentafluoride .................................................................................................................. 7789–30–2 2,000. 

Bromine trifluoride ........................................................................................................................ 7787–71–5 2,000. 

Bromotrifluorethylene ................................................................................................................... 598–73–2 7,500. 

Butane .......................................................................................................................................... 106–97–8 7,500. 

Butene .......................................................................................................................................... 25167–67–3 7,500. 

Butyltrichlorosilane ....................................................................................................................... 7521–80–4 2,000. 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17741 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST—Continued 

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

Calcium dithionite ........................................................................................................................ 15512–36–4 2,000. 

Calcium hydrosulfite .................................................................................................................... 15512–36–4 2,000. 

Calcium phosphide ...................................................................................................................... 1305–99–3 2,000. 

Carbon disulfide ........................................................................................................................... 75–15–0 15,000. 

Carbon monoxide ........................................................................................................................ 630–08–0 Any Amount. 

Carbon oxysulfide ........................................................................................................................ 463–58–1 7,500. 

Carbonyl fluoride .......................................................................................................................... 353–50–4 Any Amount. 

Carbonyl sulfide ........................................................................................................................... 463–58–1 Any Amount. 

Chlorine ........................................................................................................................................ 7782–50–5 1,875. 

Chlorine dioxide ........................................................................................................................... 10049–04–4 2,000. 

Chlorine monoxide ....................................................................................................................... 7791–21–1 7,500. 

Chlorine pentafluoride .................................................................................................................. 13637–63–3 Any Amount. 

Chlorine trifluoride ........................................................................................................................ 7790–91–2 Any Amount. 

Chloroacetyl chloride ................................................................................................................... 79–04–9 2,000. 

Chloroform ................................................................................................................................... 67–66–3 15,000. 

Chloromethyl ether ...................................................................................................................... 542–88–1 750. 

Chloromethyl methyl ether ........................................................................................................... 107–30–2 3,750. 

Chloropicrin .................................................................................................................................. 76–06–2 Any Amount. 

Chlorosulfonic acid ...................................................................................................................... 7790–94–5 2,000. 

Chromium oxychloride ................................................................................................................. 7803–51–2 2,000. 

Crotonaldehyde ............................................................................................................................ 4170–30–3 15,000. 

Crotonaldehyde, (E)- ................................................................................................................... 123–73–9 15,000. 

Cyanogen ..................................................................................................................................... 460–19–5 Any Amount. 

Cyanogen chloride ....................................................................................................................... 506–77–4 Any Amount. 

Cyclohexylamine .......................................................................................................................... 108–91–8 11,250. 

Cyclohexyltrichlorosilane ............................................................................................................. 98–12–4 2,000. 

Cyclopropane ............................................................................................................................... 75–19–4 7,500. 

Cyclotetramethylenetetranitramine .............................................................................................. 2691–41–0 2,000. 

Diazodinitrophenol ....................................................................................................................... 87–31–0 2,000. 

Diborane ...................................................................................................................................... 19287–45–7 Any Amount. 

Dichlorosilane .............................................................................................................................. 4109–96–0 Any Amount. 

Diethyl ethylphosphonate ............................................................................................................ 78–38–6 Any Amount. 

Diethyl N,N-dimethylphosphoramidate ........................................................................................ 2404–03–7 Any Amount. 

Diethyl phosphate ........................................................................................................................ 762–04–9 Any Amount. 

Diethyldichlorosilane .................................................................................................................... 1719–53–5 2,000. 

Diethyleneglycol dinitrate ............................................................................................................. 693–21–0 2,000. 

Difluoroethane .............................................................................................................................. 75–37–6 7,500. 

Dimethyl ethylphosphonate ......................................................................................................... 6163–75–3 Any Amount. 

Dimethyl methylphosphonate ...................................................................................................... 756–79–6 Any Amount. 

Dimethyl phosphate ..................................................................................................................... 868–85–9 Any Amount. 

Dimethylamine ............................................................................................................................. 124–40–3 7,500. 

Dimethyldichlorosilane ................................................................................................................. 75–78–5 2,000. 

Dimethylphosphoramidodichloridate ............................................................................................ 677–43–0 Any Amount. 

Dinitrogen tetroxide ...................................................................................................................... 10544–72–6 Any Amount. 

Dinitroglycoluril ............................................................................................................................. 55510–04–8 2,000. 

Dinitrophenol ................................................................................................................................ 25550–58–7 2,000. 

Dinitroresorcinol ........................................................................................................................... 35860–51–6 2,000. 

Dinitrosobenzene ......................................................................................................................... 25550–55–4 2,000. 

Diphenyl-2-hydroxyacetic acid (aka benzilic acid) ....................................................................... 76–93–7 Any Amount. 

Diphenyldichlorosilane ................................................................................................................. 80–10–4 2,000. 

Dipicryl sulfide .............................................................................................................................. 2217–06–3 2,000. 

Dodecyltrichlorosilane .................................................................................................................. 4484–72–4 2,000. 

Epichlorohydrin ............................................................................................................................ 106–89–8 15,000. 

Ethane .......................................................................................................................................... 74–84–0 7,500. 

Ethyl acetylene ............................................................................................................................ 107–00–6 7,500. 

Ethyl chloride ............................................................................................................................... 75–00–3 7,500. 

Ethyl ether .................................................................................................................................... 60–29–7 7,500. 

Ethyl mercaptan ........................................................................................................................... 75–08–1 7,500. 

Ethyl nitrite ................................................................................................................................... 109–95–5 7,500. 

Ethyl phosphonyl dichloride ......................................................................................................... 1066–50–8 Any Amount. 

Ethyl phosphonyl difluoride .......................................................................................................... 753–98–0 Any Amount. 

Ethylamine ................................................................................................................................... 75–04–7 7,500. 

Ethyldiethanolamine ..................................................................................................................... 139–87–7 Any Amount. 

Ethylene ....................................................................................................................................... 74–85–1 7,500. 

Ethylene oxide ............................................................................................................................. 75–21–8 Any Amount. 

Ethylenediamine .......................................................................................................................... 107–15–3 15,000. 

Ethyleneimine .............................................................................................................................. 151–56–4 7,500. 

Ethyltrichlorosilane ....................................................................................................................... 115–21–9 2,000. 

Fluorine ........................................................................................................................................ 7782–41–4 Any Amount. 

Fluorosulfonic acid ....................................................................................................................... 7789–21–1 2,000. 


rwilkins on PROD1PC63 with RULES_2
17742 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST—Continued 

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

Formaldehyde (solution) .............................................................................................................. 50–00–0 11,250. 

Furan ............................................................................................................................................ 110–00–9 3,750. 

Germane ...................................................................................................................................... 7782–65–2 Any Amount. 

Germanium tetrafluoride .............................................................................................................. 7783–58–6 Any Amount. 

Guanyl nitrosaminoguanylidene hydrazine .................................................................................. .......................... 2,000. 

Guanyl nitrosaminoguanyltetrazene ............................................................................................ 109–27–3 2,000. 

Hexaethyl tetraphosphate and compressed gas mixtures .......................................................... 757–58–4 Any Amount. 

Hexafluoroacetone ....................................................................................................................... 684–16–2 Any Amount. 

Hexanitrodiphenylamine .............................................................................................................. 35860–31–2 2,000. 

Hexanitrostilbene ......................................................................................................................... 20062–22–0 2,000. 

Hexolite ........................................................................................................................................ 121–82–4 2,000. 

Hexotonal ..................................................................................................................................... 107–15–3 2,000. 

Hexyltrichlorosilane ...................................................................................................................... 928–89–2 6 2,000. 

Hydrazine ..................................................................................................................................... 302–01–2 11,250. 

Hydrochloric acid (conc. 37% or greater) .................................................................................... 7647–01–0 11,250. 

Hydrocyanic acid ......................................................................................................................... 74–90–8 1,875. 

Hydrogen ..................................................................................................................................... 1333–74–0 7,500. 

Hydrogen bromide, anhydrous .................................................................................................... 10035–10–6 Any Amount. 

Hydrogen chloride (anhydrous) ................................................................................................... 7647–01–0 Any Amount. 

Hydrogen cyanide ........................................................................................................................ 74–90–8 Any Amount. 

Hydrogen fluoride/Hydrofluoric acid (conc. 50% or greater) ....................................................... 7664–39–3 750. 

Hydrogen iodide, anhydrous ........................................................................................................ 10034–85–2 Any Amount. 

Hydrogen peroxide (concentration of at least 30%) .................................................................... 7722–84–1 2,000. 

Hydrogen selenide ....................................................................................................................... 7783–07–5 Any Amount. 

Hydrogen sulfide .......................................................................................................................... 7783–06–4 Any Amount. 

Iodine pentafluoride ..................................................................................................................... 7783–66–6 2,000. 

Iron, pentacarbonyl- ..................................................................................................................... 13463–40–6 1,875. 

Isobutane ..................................................................................................................................... 75–28–5 7,500. 

Isobutyronitrile .............................................................................................................................. 78–82–0 15,000. 

Isopentane ................................................................................................................................... 78–78–4 7,500. 

Isoprene ....................................................................................................................................... 78–79–5 7,500. 

Isopropyl chloride ......................................................................................................................... 75–29–6 7,500. 

Isopropyl chloroformate ............................................................................................................... 108–23–6 11,250. 

Isopropylamine ............................................................................................................................. 75–31–0 7,500. 

Lead azide ................................................................................................................................... 13424–46–9 2,000. 

Lead styphnate ............................................................................................................................ 15245–44–0 2,000. 

Lithium amide .............................................................................................................................. 7782–89–0 2,000. 

Lithium nitride .............................................................................................................................. 26134–62–3 2,000. 

Magnesium aluminum phosphide ................................................................................................ .......................... 2,000. 

Magnesium diamide ..................................................................................................................... 7803–54–5 2,000. 

Magnesium phosphide ................................................................................................................. 12057–74–8 2,000. 

Mannitol hexanitrate, wetted ........................................................................................................ 15825–70–4 2,000. 

Mercury fulminate ........................................................................................................................ 628–86–4 2,000. 

Methacrylonitrile ........................................................................................................................... 126–98–7 7,500. 

Methane ....................................................................................................................................... 74–82–8 7,500. 

Methyl bromide ............................................................................................................................ 74–83–9 Any Amount. 

Methyl chloride ............................................................................................................................. 74–87–3 7,500. 

Methyl chloroformate ................................................................................................................... 79–22–1 3,750. 

Methyl ether ................................................................................................................................. 115–10–6 7,500. 

Methyl formate ............................................................................................................................. 107–31–3 7,500. 

Methyl hydrazine .......................................................................................................................... 60–34–4 11,250. 

Methyl isocyanate ........................................................................................................................ 624–83–9 11,250. 

Methyl mercaptan ........................................................................................................................ 74–93–1 Any Amount. 

Methyl phosphonyl dichloride ...................................................................................................... 676–97–1 Any Amount. 

Methyl phosphonyl difluoride ....................................................................................................... 676–99–3 Any Amount. 

Methyl thiocyanate ....................................................................................................................... 556–64–9 15,000. 

Methylamine ................................................................................................................................. 74–89–5 7,500. 

Methylchlorosilane ....................................................................................................................... 993–00–0 Any Amount. 

Methyldichlorosilane .................................................................................................................... 75–54–7 2,000. 

Methyldiethanolamine .................................................................................................................. 105–59–9 Any Amount. 

Methylphenyldichlorosilane .......................................................................................................... 149–74–6 2,000. 

Methyltrichlorosilane .................................................................................................................... 75–79–6 2,000. 

N,N-diisopropyl-2-aminoethyl chloride hydrochloride .................................................................. 4261–68–1 Any Amount. 

N,N-diisopropyl-b-aminoethanol ................................................................................................... 96–80–0 Any Amount. 

N,N-diisopropyl-b-aminoethyl chloride ......................................................................................... 96–79–7 Any Amount. 

Nickel Carbonyl ............................................................................................................................ 13463–39–3 750. 

Nitric acid ..................................................................................................................................... 7697–37–2 2,000. 

Nitric oxide ................................................................................................................................... 10102–43–9 Any Amount. 

Nitro urea ..................................................................................................................................... 556–89–8 2,000. 

Nitrocellulose ............................................................................................................................... 9004–70–0 2,000. 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17743 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST—Continued 

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

Nitrogen trioxide ........................................................................................................................... 10544–73–7 Any Amount. 

Nitroglycerine ............................................................................................................................... 55–63–0 2,000. 

Nitroguanidine .............................................................................................................................. 556–88–7 2,000. 

Nitromethane ............................................................................................................................... 75–52–5 2,000. 

Nitrostarch .................................................................................................................................... 9056–38–6 2,000. 

Nitrosyl chloride ........................................................................................................................... 2696–92–6 Any Amount. 

Nitrotriazolone .............................................................................................................................. 932–64–9 2,000. 

Nonyltrichlorosilane ...................................................................................................................... 5283–67–0 2,000. 

o,o-diethyl S-[2-(diethylamino)ethyl] phosphorothiolate .............................................................. 78–53–5 Any Amount. 

Octadecyltrichlorosilane ............................................................................................................... 112–04–9 2,000. 

Octolite ......................................................................................................................................... 68610–51–5 2,000. 

Octonal ......................................................................................................................................... 124–13–0 2,000. 

Octyltrichlorosilane ....................................................................................................................... 5283–66–9 2,000. 

o-ethyl-N,N-dimethylphosphoramido-cyanidate ........................................................................... 77–81–6 Any Amount. 

o-ethyl-o-2-diisopropylaminoethyl methylphosphonite ................................................................. 57856–11–8 Any Amount. 

o-ethyl-S-2-diisopropylaminoethyl methyl phosphonothiolate ..................................................... 50782–69–9 Any Amount. 

o-isopropyl methylphosphonochloridate ...................................................................................... 1445–76–7 Any Amount. 

o-isopropyl methylphosphonofluoridate ....................................................................................... 107–44–8 Any Amount. 

Oleum (Fuming Sulfuric acid) ...................................................................................................... 8014–95–7 7,500. 

o-pinacolyl methylphosphonochloridate ....................................................................................... 7040–57–5 Any Amount. 

o-pinacolyl methylphosphonofluoridate ....................................................................................... 96–64–0 Any Amount. 

Oxygen difluoride ......................................................................................................................... 7783–41–7 Any Amount. 

Pentaerythrite tetranitrate or PETN ............................................................................................. 78–11–5 2,000. 

Pentane ........................................................................................................................................ 109–66–0 7,500. 

Pentolite ....................................................................................................................................... 8066–33–9 2,000. 

Peracetic acid .............................................................................................................................. 79–21–0 7,500. 

Perchloromethylmercaptan .......................................................................................................... 594–42–3 7,500. 

Perchloryl fluoride ........................................................................................................................ 7616–94–6 Any Amount. 

Phenyltrichlorosilane .................................................................................................................... 98–13–5 2,000. 

Phosgene ..................................................................................................................................... 75–44–5 Any Amount. 

Phosphine .................................................................................................................................... 7803–51–2 Any Amount. 

Phosphorus .................................................................................................................................. 7723–14–0 Any Amount. 

Phosphorus oxychloride .............................................................................................................. 10025–87–3 Any Amount. 

Phosphorus oxychloride .............................................................................................................. 10025–87–3 2,000. 

Phosphorus pentachloride ........................................................................................................... 10026–13–8 Any Amount. 

Phosphorus pentachloride ........................................................................................................... 10026–13–8 2,000. 

Phosphorus pentasulfide ............................................................................................................. 1314–80–3 2,000. 

Phosphorus trichloride ................................................................................................................. 7719–12–2 Any Amount. 

Phosphorus trichloride ................................................................................................................. 7719–12–2 2,000. 

Piperidine ..................................................................................................................................... 110–89–4 11,250. 

Potassium chlorate ...................................................................................................................... 3811–04–9 2,000. 

Potassium cyanide ....................................................................................................................... 151–50–8 2,000. 

Potassium nitrate ......................................................................................................................... 7757–79–1 2,000. 

Potassium perchlorate ................................................................................................................. 7778–74–7 2,000. 

Potassium phosphide .................................................................................................................. 20770–41–6 2,000. 

Propadiene ................................................................................................................................... 463–49–0 7,500. 

Propane ....................................................................................................................................... 74–98–6 7,500. 

Propionitrile .................................................................................................................................. 107–12–0 7,500. 

Propyl chlorofromate .................................................................................................................... 109–61–5 11,250. 

Propylene ..................................................................................................................................... 115–07–1 7,500. 

Propylene oxide ........................................................................................................................... 75–56–9 7,500. 

Propyleneimine ............................................................................................................................ 75–55–8 7,500. 

Propyltrichlorosilane ..................................................................................................................... 141–57–1 2,000. 

Propyne ........................................................................................................................................ 74–99–7 7,500. 

Quinuclidine-3-ol .......................................................................................................................... 1619–34–7 Any Amount. 

RDX and HMX mixtures .............................................................................................................. 121–82–4 2,000. 

Selenium hexafluoride ................................................................................................................. 7783–79–1 Any Amount. 

Silane ........................................................................................................................................... 7803–62–5 7,500. 

Silicon tetrachloride ..................................................................................................................... 10026–04–7 2,000. 

Silicon tetrafluoride ...................................................................................................................... 7783–61–1 Any Amount. 

Sodium chlorate ........................................................................................................................... 7775–09–9 2,000. 

Sodium cyanide ........................................................................................................................... 143–33–9 2,000. 

Sodium dinitro-o-cresolate ........................................................................................................... 25641–53–6 2,000. 

Sodium dithionite ......................................................................................................................... 7775–14–6 2,000. 

Sodium hydrosulfite ..................................................................................................................... 7775–14–6 2,000. 

Sodium nitrate .............................................................................................................................. 7631–99–4 2,000. 

Sodium phosphide ....................................................................................................................... 7558–80–7 2,000. 

Sodium picramate ........................................................................................................................ 831–52–7 2,000. 

Stibine .......................................................................................................................................... 7803–52–3 Any Amount. 

Strontium phosphide .................................................................................................................... 13450–99–2 2,000. 


rwilkins on PROD1PC63 with RULES_2
17744 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

APPENDIX A TO PART 27.—DHS CHEMICALS OF INTEREST—Continued 

Chemical of interest 

Chemical Abstract Service 

(CAS) number 

Screening threshold quantity 

(STQ) 

(lbs) 

Sulfur dichloride ........................................................................................................................... 10545–99–0 Any Amount. 

Sulfur dioxide (anhydrous) ........................................................................................................... 7446–09–5 Any Amount. 

Sulfur monochloride ..................................................................................................................... 10025–67–9 Any Amount. 

Sulfur tetraflouride ....................................................................................................................... 7783–60–0 Any Amount. 

Sulfur trioxide ............................................................................................................................... 7446–11–9 7,500. 

Sulfuryl chloride ........................................................................................................................... 7791–25–5 2,000. 

Sulfuryl fluoride ............................................................................................................................ 2699–79–8 Any Amount. 

Tellurium hexafluoride ................................................................................................................. 7783–80–4 Any Amount. 

Tetrafluoroethylene ...................................................................................................................... 116–14–3 7,500. 

Tetramethyllead ........................................................................................................................... 75–74–1 7,500. 

Tetramethylsilane ......................................................................................................................... 75–76–3 7,500. 

Tetranitroaniline ........................................................................................................................... 53014–37–2 2,000. 

Tetranitromethane ........................................................................................................................ 509–14–8 7,500. 

Tetrazol-1-acetic acid .................................................................................................................. 21732–17–2 2,000. 

Thiodiglycol .................................................................................................................................. 111–48–8 Any Amount. 

Thionyl chloride ............................................................................................................................ 7719–09–7 Any Amount. 

Thionyl chloride ............................................................................................................................ 7719–09–7 2,000. 

Titanium tetrachloride .................................................................................................................. 7550–45–0 2,000. 

Toluene 2,4-diisocyanate ............................................................................................................. 584–84–9 7,500. 

Toluene 2,6-diisocyanate ............................................................................................................. 91–08–7 7,500. 

Toluene diisocyanate (unspecified isomer) ................................................................................. 26471–62–5 7,500. 

Trichlorosilane .............................................................................................................................. 10025–78–2 2,000. 

Triethanolamine ........................................................................................................................... 102–71–6 Any Amount. 

Triethanolamine hydrochloride .................................................................................................... 637–39–8 Any Amount. 

Triethyl phosphite ........................................................................................................................ 122–52–1 Any Amount. 

Trifluoroacetyl chloride ................................................................................................................. 354–32–5 Any Amount. 

Trifluorochloroethylene ................................................................................................................ 79–38–9 Any Amount. 

Trimethyl phosphite ..................................................................................................................... 121–45–9 Any Amount. 

Trimethylamine ............................................................................................................................ 75–50–3 Any Amount. 

Trimethylchlorosilane ................................................................................................................... 75–77–4 2,000. 

Trinitroaniline ............................................................................................................................... 26952–42–1 2,000. 

Trinitroanisole .............................................................................................................................. 606–35–9 2,000. 

Trinitrobenzene ............................................................................................................................ 99–35–4 2,000. 

Trinitrobenzenesulfonic acid ........................................................................................................ 2508–19–2 2,000. 

Trinitrobenzoic acid ...................................................................................................................... 129–66–8 2,000. 

Trinitrochlorobenzene .................................................................................................................. 88–88–0 2,000. 

Trinitrofluorenone ......................................................................................................................... 129–79–3 2,000. 

Trinitro-meta-cresol ...................................................................................................................... 602–99–3 2,000. 

Trinitronaphthalene ...................................................................................................................... 558101–17–8 2,000. 

Trinitrophenetole .......................................................................................................................... 4732–14–3 2,000. 

Trinitrophenol ............................................................................................................................... 88–89–1 2,000. 

Trinitroresorcinol .......................................................................................................................... 82–71–3 2,000. 

Trinitrotoluene .............................................................................................................................. 118–96–7 2,000. 

Tris(2-chloroethyl)amine .............................................................................................................. 555–77–1 Any Amount. 

Tris(2-chlorovinyl)arsine ............................................................................................................... 40334–70–1 Any Amount. 

Tritonal ......................................................................................................................................... 54413–15–9 2,000. 

Tungsten hexafluoride ................................................................................................................. 7783–82–6 Any Amount. 

Uranium hexafluoride ................................................................................................................... 7783–81–5 2,000. 

Urea ............................................................................................................................................. 57–13–6 2,000. 

Urea nitrate .................................................................................................................................. 124–47–0 2,000. 

Vinyl acetate monomer ................................................................................................................ 108–05–4 11,250. 

Vinyl actylene ............................................................................................................................... 689–97–4 7,500. 

Vinyl chloride ............................................................................................................................... 75–01–4 7,500. 

Vinyl ethyl ether ........................................................................................................................... 109–92–2 7,500. 

Vinyl fluoride ................................................................................................................................ 75–02–5 7,500. 

Vinyl methyl ether ........................................................................................................................ 107–25–5 7,500. 

Vinylidene chloride ....................................................................................................................... 75–35–4 7,500. 

Vinylidene fluoride ....................................................................................................................... 75–38–7 7,500. 

Vinyltrichlorosilane ....................................................................................................................... 75–94–5 2,000. 

Zinc dithionite ............................................................................................................................... 7779–86–4 2,000. 

Zinc hydrosulfite ........................................................................................................................... 7779–86–4 2,000. 

Zirconium picramate .................................................................................................................... 63868–82–6 2,000. 


rwilkins on PROD1PC63 with RULES_2
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17745 

Dated: April 2, 2007. 

Michael Chertoff, 

Secretary of Homeland Security, Department 

of Homeland Security. 

[FR Doc. E7–6363 Filed 4–6–07; 8:45 am] 

BILLING CODE 4410–10–P 


rwilkins on PROD1PC63 with RULES_2