Critical Infrastructure Protection: DHS Has Fully Implemented Its Chemical Security Expedited Approval Program, and Participation to Date Has Been Limited
Published: 2017-06-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Facilities that produce, use, or store hazardous chemicals could be of interest to terrorists intent on using them to inflict mass casualties in the United States. DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. DHS places high-risk facilities into one of four risk-based tiers and inspects them to ensure compliance with DHS standards. The CFATS Act of 2014 created the Expedited Approval Program as an option for the two lower-risk tier facilities (tiers 3 and 4) to reduce the burden and expedite the processing of security plans. The act further required that DHS report on its evaluation of the expedited program to Congress.
The CFATS Act of 2014 also included a provision for GAO to assess the expedited program. This report discusses (1) DHS's implementation of the expedited program and its report to Congress and (2) the number of facilities that have used the program and factors affecting participation in it. GAO reviewed laws and DHS guidance, analyzed DHS's report to Congress, and interviewed DHS officials. GAO also received input from officials with three industry groups that represented the most likely candidates to use the program, and officials representing eight of their member organizations. The results of this input are not generalizable, but provide insights about the expedited program.
GAO is not making recommendations in this report.
For more information, contact Chris Currie at (404) 679-1875 or CurrieC@gao.gov .
[ This page was updated to delete a typo .]
section_title: What GAO Found
paragraphs: The Department of Homeland Security (DHS) fully implemented the Chemical Facility Anti-Terrorism Standards (CFATS) Expedited Approval Program in June 2015 and reported to Congress on the program in August 2016, as required by the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). DHS's expedited program guidance identifies specific security measures that eligible (i.e., tiers 3 and 4) high-risk facilities can use to develop expedited security plans, rather than developing standard (non-expedited) security plans. Standard plans provide more flexibility in securing a facility, but are also more time-consuming to process. DHS's report to Congress on the expedited program discussed all required elements. For example, DHS was required to assess the impact of the expedited program on facility security. DHS reported that it was difficult to assess the impact of the program on security because only one facility had used it at the time of the report. DHS officials stated that they would further evaluate the impact of the program on security if enough additional facilities use it in the future.
As of April 2017, only 2 of the 2,496 eligible facilities opted to use the Expedited Approval Program; various factors affected participation. Officials from the two facilities told GAO they used the program because its prescriptive nature helped them quickly determine what they needed to do to implement required security measures and reduced the time and cost to prepare and submit their security plans to DHS. According to DHS and industry officials GAO interviewed, low participation to date could be due to several factors:
DHS implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS;
the expedited program's security measures may be too strict and prescriptive, not providing facilities the flexibility of the standard process; and
DHS conducts in-person authorization inspections to confirm that security plans address risks under the standard process, but does not conduct them under the expedited program. DHS officials noted that some facilities may prefer having this inspection because it provides them useful information.
Recent changes in the CFATS program could also affect future use of the expedited program. In fall 2016, DHS updated its online tool for gathering data from facilities. Officials at DHS and 5 of the 11 industry organizations GAO contacted stated that the revised tool is more user-friendly and less burdensome than the previous one; however, it is unclear how the new tool might affect future use of the expedited program. Also, in fall 2016, DHS revised its methodology for determining the level of facility risk, and one of the two facilities that participated in the expedited program is no longer

section_title: Letter
paragraphs: The United States has hundreds of thousands of facilities that produce,  use, or store hazardous chemicals that could be used by terrorists to  inflict mass casualties and damage. These chemicals could be released  from a facility to cause harm to surrounding populations, stolen and used  as chemical weapons, or stolen and used to build an improvised  explosive device.
The Chemical Facility Anti-Terrorism Standards (CFATS) program— initially established pursuant to the Department of Homeland Security  (DHS) Appropriations Act, 2007—enables DHS to, among other things,  identify chemical facilities and assess the security risk posed by each,  categorize the facilities into risk-based tiers, and inspect the high-risk  facilities to ensure compliance with regulatory requirements. The  Protecting and Securing Chemical Facilities from Terrorist Attacks Act of  2014 (CFATS Act of 2014), enacted in December 2014, in effect,  reauthorized the CFATS program for an additional 4 years while also  imposing additional implementation requirements on DHS for the  program. We previously reported on various aspects of the CFATS  program and made a number of recommendations in recent years to  strengthen the program. DHS agreed with all of these recommendations  and has either fully implemented or taken action to address them.
DHS’s National Protection and Programs Directorate’s Infrastructure  Security Compliance Division (ISCD) manages the CFATS program. DHS  assigns high-risk facilities to one of four risk tiers, where tier 1 represents  facilities with the highest risk and tier 4 represents facilities with the  lowest risk. As of September 2016, DHS had designated 2,947 facilities in  the United States as high risk and assigned to a tier. Once a facility is  assigned to a tier, it is required to develop a site security plan and submit  it to DHS. The security plan describes how a facility’s existing and  planned security measures address applicable Risk-Based Performance  Standards —18 standards that identify areas of a facility’s security  posture that are to be examined, such as perimeter security, access  control, and cybersecurity. The CFATS program also provides high-risk  facilities the option of submitting an Alternative Security Program in place  of the site security plan.
Members of Congress and the chemical sector have expressed concern  about the administrative burden associated with the development of  facility security plans and the pace of DHS efforts to process and approve  them. In response to this concern, the CFATS Act of 2014 created an  Expedited Approval Program (EAP) as another option that tier 3 and tier 4  facilities may use to develop and submit security plans to DHS. Unlike  the standard CFATS process in which facilities decide how to meet Risk-Based Performance Standards, the EAP prescribes specific security  measures that facilities must have in order to meet the standards.  According to committee report language, the EAP is expected to reduce  the time and burden on smaller chemical companies, which may lack the  compliance infrastructure and resources of large chemical facilities. The  act also required DHS to assess the expedited program and report to  Congress.
The CFATS Act of 2014 also included a provision for GAO to examine  DHS’s implementation of the EAP and DHS’s report on the program.  This report discusses: (1) DHS’s implementation of the EAP and  assessment of the program in its report to Congress and (2) the number  of facilities that have used the EAP and factors affecting participation in  the program.
To address our first objective, we reviewed the DHS Guidance for the  Expedited Approval Program (EAP guidance) and documentation about  the process ISCD uses to vet site security plans under the EAP, security  plans under the standard (i.e., non-expedited) CFATS process, and  Alternative Security Programs. We also interviewed senior ISCD officials  about their process for developing the EAP guidance and reviewing  submissions. To obtain insight into how ISCD developed the guidance,  we selected 10 of the 157 security measures from the EAP guidance to  reflect variation in the types of security measures and asked ISCD  officials to explain how they developed each measure and why they  required each measure. In addition, we reviewed the CFATS Act of  2014 to identify the EAP elements that the act requires DHS to assess  and report to Congress. We compared the DHS report with the required  elements in the CFATS Act of 2014 to determine the extent to which  DHS’s report discussed each element listed in the statute.
To address our second objective, we reviewed ISCD data on EAP-eligible  (i.e., all tier 3 and tier 4) facilities before and after ISCD implemented the  EAP in June 2015, and calculated the number and percentage of EAP- eligible facilities that already had approved security plans and Alternative  Security Programs under the standard CFATS process before and after  ISCD implemented the EAP. To assess the reliability of ISCD data, we  reviewed interviews and documentation that we previously collected for  our 2015 report on the CFATS program and questioned ISCD officials  about the extent that ISCD’s processes and procedures for tracking the  number of tier 3 and tier 4 facilities have changed since 2015. We  determined the data to be sufficiently reliable for our purposes. We also  reviewed the site security plans submitted by the two facilities that used  the EAP as of April 2017, in order to identify characteristics about the  facilities and their security measures. In addition, we reviewed ISCD  documentation, such as e-mails between the facilities that used the EAP  and ISCD, and interviewed officials from the two facilities that participated  in the EAP to obtain their perspectives, including why they chose to use  the EAP.
Furthermore, we interviewed ISCD officials who review expedited security  plans to identify and examine factors that affected the use of the EAP. In  addition, we selected industry officials and obtained their perspectives,  including ISCD’s communication with them about the EAP and factors  that affect facility officials’ use of it. In so doing, we interviewed officials in  11 industry organizations. Specifically, we interviewed the Chairs and  Vice Chairs of the Chemical Sector Coordinating Council, Food and  Agriculture Sector Coordinating Council, and the Oil and Natural Gas  Subsector Coordinating Council of the Energy Sector Coordinating  Council, that ISCD officials told us they informed about the EAP and its  availability for use. According to ISCD officials, facilities in these sectors  and subsectors would be the most likely candidates to use the EAP. We  also selected eight member organizations (for example, trade  associations or companies)—four member organizations for the Chemical  Sector Coordinating Council, three member organizations for the Oil and  Natural Gas Subsector Coordinating Council, and one member  organization for the Food and Agriculture Sector Coordinating Council— and interviewed key officials in those organizations about the EAP. The  results of these interviews are not generalizable, but they provide insights  about the EAP.
We conducted this performance audit from August 2016 to June 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DHS’s National Protection and Programs Directorate leads the country’s  effort to protect and enhance the resilience of the nation’s physical and  cyber infrastructure. The directorate includes the Office of Infrastructure  Protection, which leads the coordinated national effort to reduce risk to  U.S. critical infrastructure posed by acts of terrorism. Within the Office of  Infrastructure Protection, ISCD leads the nation’s effort to secure high-risk  chemical facilities and prevent the use of certain chemicals in a terrorist  act on the homeland; ISCD also is responsible for implementing and  managing the CFATS program, including its EAP.
The CFATS program is intended to ensure the security of the nation’s  chemical infrastructure by identifying, assessing the risk posed by, and  requiring the implementation of measures to protect high-risk chemical  facilities. Section 550 of the DHS Appropriations Act, 2007, required DHS  to issue regulations establishing Risk-Based Performance Standards for  chemical facilities that, as determined by DHS, present high levels of risk;  the act also required vulnerability assessments and development and  implementation of site security plans for such facilities. DHS published  the CFATS interim final rule in April 2007 and appendix A to the rule,  published in November 2007, lists 322 chemicals of interest and the  screening threshold quantities for each. According to DHS, subject to  certain statutory exclusions, all facilities that manufacture chemicals of  interest, as well as facilities that store or use such chemicals as part of  their daily operations, may be subject to CFATS. However, only  chemical facilities determined to possess a requisite quantity of chemicals  of interest (i.e., the screening threshold quantity) and subsequently  determined to present high levels of security risk are subject to the more  substantive requirements of the CFATS regulation.
The CFATS regulation outlines a specific process for how ISCD is to  administer the CFATS program. A chemical facility that possesses any of  the 322 chemicals of interest in the quantities that meet or exceed a  threshold quantity is required to use ISCD’s Chemical Security  Assessment Tool, a web-based application through which owners and  operators of chemical facilities provide information about the facility to  ISCD. If ISCD determines that a facility is high risk, the facility must  complete and submit to ISCD a standard security plan, expedited security  plan, or Alternative Security Program. Tier 1 and tier 2 facilities must use  the standard security plan or Alternative Security Program, while tier 3  and tier 4 facilities also have the option to use the expedited security plan.  For a facility that submits a standard security plan or Alternative Security  Program, ISCD reviews it for compliance with CFATS. If compliant, ISCD  issues a letter of authorization and conducts an authorization inspection.  If the facility passes the authorization inspection, ISCD issues a letter of  approval and the facility implements the approved security plan or  program. Subsequently, ISCD conducts compliance inspections to confirm that the facility has implemented its approved security plan or  program.
For tier 3 or tier 4 facilities that choose to submit the expedited security  plan, ISCD reviews the expedited plan to determine if it is sufficient and, if  so, issues a letter of acceptance. If the expedited plan is determined to be  facially deficient, the facility is no longer eligible to participate in the EAP  and must submit a standard security plan or Alternative Security  Program. For expedited facilities that receive a letter of acceptance,  ISCD does not conduct an authorization inspection because the CFATS  Act of 2014 does not provide for this inspection at expedited facilities.  However, ISCD intends to subsequently conduct compliance inspections  to confirm that the expedited facility has implemented its approved  security plan.
Regarding the EAP, the CFATS Act of 2014 states that, among other  things, DHS is to  issue guidance for EAP facilities not later than 180 days after  enactment of the act that identifies specific security measures  sufficient to meet Risk-Based Performance Standards; approve a facility’s expedited security plan if it is not facially deficient  based upon a review of the expedited plan;  verify a facility’s compliance with its expedited security plan through a  compliance inspection;  require the facility to implement additional security measures or  suspend the facility’s certification if, during or after a compliance  inspection, security measures are insufficient to meet Risk-Based  Performance Standards based on misrepresentation, omission, or an  inadequate description of the site; and  conduct a full evaluation of the EAP and submit a report on the EAP  not later than 18 months after the date of enactment of the act to  Congress.
section_title: DHS Has Fully Implemented the EAP and Reported to Congress on Its Assessment of the Program
subsections: section_title: DHS Has Issued Guidance for the EAP and Fully Implemented the Program
paragraphs: On May 12, 2015, DHS issued EAP guidance for eligible facilities to use  to prepare their expedited plans. DHS fully implemented the EAP about a  month later when facilities could submit expedited security plans and  certification forms to ISCD. Consistent with the act, DHS developed the  guidance within 180 days after the date the act was enacted and  identified specific security measures that are sufficient to meet Risk- Based Performance Standards applicable to facilities under DHS’s  standard security plan process. The guidance is intended to help  facilities prepare and submit their expedited security plans and  certifications to ISCD, and includes an example that identifies specific  (i.e., prescriptive) security measures that facilities are to have in place.  Appendix I provides an example of the EAP’s prescriptive security  measures and shows the measures that an EAP facility is to have in  place to respond to a threat or actual theft or release of a chemical of  interest.
ISCD officials told us that, in developing prescriptive security measures  for the EAP, they considered various sources, including:  lessons learned from approving prior standard security plans and  Alternative Security Programs for tier 3 and tier 4 facilities and  conducting inspections at these facilities;
Risk-Based Performance Standards used to develop a standard  security plan or Alternative Security Program; and  relevant academic literature, and security directives, guidelines,  standards, and regulations issued by other federal agencies, such as  the U.S. Army and the Department of Labor.
ISCD officials told us that they developed the EAP security measures with  clear, specific guidance, so that facility officials would have the  information needed to successfully obtain approval of their expedited  security plan upon submission. The CFATS Act of 2014 allows facilities to  submit only one expedited plan to DHS. Specifically, if ISCD determines  that an expedited plan is facially deficient due to an error, the act does not  allow facility officials to correct the error and resubmit the plan. In  addition, ISCD officials said that prescriptive, clear, and easily understood  EAP security measures are needed because the act requires DHS to  approve an expedited plan that has all applicable prescribed security  measures and does not provide for an authorization inspection under the  EAP. Therefore, ISCD’s goal in developing required security measures for  an expedited security plan was to ensure that a facility had adequate  security in place until inspectors could conduct a compliance inspection at  the facility approximately 1 year after approving the plan.
ISCD officials also stated that, before and after implementing the EAP,  they reached out to industry representatives to ensure that eligible  facilities were aware of the EAP and its availability as an option to the  standard security plan and Alternative Security Program. Specifically,  ISCD held meetings with officials representing the Chemical Sector  Coordinating Council, the Food and Agriculture Sector Coordinating  Council, and the Oil and Natural Gas Subsector Coordinating Council  before issuing the EAP guidance and also contacted them after doing so.
ISCD also made presentations about the EAP at the Chemical Sector  Security Summit in July 2015, and to other groups, including three labor  unions prior to implementing the EAP. In addition, ISCD chemical  security inspectors and other staff routinely discuss the EAP when  conducting CFATS-related outreach.
Officials we interviewed at the three coordinating councils confirmed that  DHS had contacted them about the EAP. Also, officials from 8 of the 11  industry organizations we interviewed said they have been generally  pleased with DHS’s efforts to communicate with them about the CFATS  program in recent years. However, officials from a Sector Coordinating  Council stated that ISCD did not accept the council’s offers to assist in  developing the EAP guidance and were concerned that ISCD may not  accept future offers to work on CFATS issues. A senior ISCD official  stated that ISCD did not accept the council’s offers to assist in developing  the EAP guidance because the CFATS Act of 2014 required DHS to  develop the guidance within 6 months of enactment, which did not allow  time to involve all interested stakeholders in developing it. The ISCD  official stated that ISCD continues to value stakeholder input, appreciates  the desire of Sector Coordinating Council members and other  stakeholders to provide input on CFATS materials, and plans to seek  input from Sector Coordinating Councils and other stakeholders, as  appropriate, on future relevant issues.
ISCD officials also told us that they developed draft, standard operating  procedures to evaluate expedited security plans and conduct compliance  inspections, and that officials used the draft procedures to evaluate  expedited plans since the EAP’s implementation. ISCD staff who review  expedited security plans have received training on how to do this and  vetting an expedited plan is relatively simple and straightforward because  it does not require extensive analysis, according to ISCD officials.  Specifically, ISCD staff review an expedited security plan to determine if  facility officials have checked all required boxes for applicable security  measures, adequately explained any planned security measures or  material deviations, and signed the required certification. If ISCD staff  concludes that all of these things have been done, they recommend that  the ISCD Director approve the expedited security plan. ISCD staff  prepares a summary of the review, including the recommendation, and  provides it to the Director. These standard operating procedures were  approved on May 25, 2017.
section_title: DHS’s Report on the EAP Discussed All Statutory Elements
paragraphs: DHS’s report to Congress on the EAP, issued on August 2, 2016,  discussed all elements listed in the CFATS Act of 2014, but did not  quantify costs associated with the EAP because most of DHS’s initial  costs were for salary and benefits and DHS did not require its employees  to track the hours they worked on the EAP. DHS also did not quantify  associated costs to the regulated community, but stated that it expects  that these costs were very low. In addition, DHS’s report did not include a  recommended frequency of compliance inspections at facilities that use  the program because, currently, there is no mandated frequency for any  facility regardless of the type of security plan submitted. DHS noted that it  would prioritize conducting an initial compliance inspection at an  expedited facility over inspection of a similar facility that received approval  of a traditional (i.e., standard) security plan or Alternative Security  Program, in part, because that would be the first inspection conducted at  the expedited facility. In addition, the report stated that, among other  things, it was difficult to assess the effect of the EAP on DHS operations  and the operations of facilities because only a single facility had  participated in the EAP at the time the report was issued. Our analysis of  the DHS report and follow-up discussions with ISCD officials is discussed  below.
Assess the number of eligible facilities that used the EAP versus  the standard process to develop and submit a site security plan.  DHS reported that, as of June 2, 2016, it assigned a final tier of 3 or 4  to 2,244 facilities (806 tier 3 facilities and 1,438 tier 4 facilities). Of  these facilities, only one facility (a tier 4 facility) submitted an  expedited security plan, while 2,194 facilities had submitted a security  plan or Alternative Security Program using the standard process, and  49 facilities had yet to submit a security plan or Alternative Security  Program.
Assess the EAP’s impact on the backlog for site security plan  approvals and authorization inspections. DHS reported that, with  only a single facility electing to submit an expedited security plan, the  EAP had no noticeable impact on DHS’s projected completion date for  all authorization inspections and site security plan approvals. ISCD  officials told us that if enough facilities use the EAP in the future, DHS  would evaluate the EAP’s effect on its CFATS operations.
Assess the ability of EAP facilities to submit sufficient site  security plans. DHS reported that the only facility to submit an  expedited security plan was able to submit a sufficient plan.
Assess any impact of the EAP on the security of chemical  facilities. DHS reported that it is difficult to assess the impact of the  EAP on the security of chemical facilities because only one facility  submitted an expedited security plan. DHS noted that the public  availability of the EAP guidance would likely have a positive impact on  chemical facility security because the guidance can serve as  reference material for any facility looking to develop a security plan,  regardless of whether that facility is regulated under CFATS. ISCD  officials told us that if enough facilities use the EAP in the future, DHS  would evaluate the EAP’s effect on the security of chemical facilities.
Identify any costs and efficiencies associated with the EAP. DHS  reported that it expended significant internal resources to comply with  the statutory requirement to develop an EAP, but DHS did not quantify  the cost associated with the EAP. According to DHS, the resources  expended included costs to develop EAP processes and procedures,  and develop the associated guidance and outreach materials. ISCD  officials told us that most of DHS’s initial costs were for salary and  benefits for federal employees working on the EAP, including policy,  compliance, and legal staff who developed the EAP guidance, and  information technology staff who updated the Chemical Security  Assessment Tool. However, ISCD officials also told us that they were  unable to quantify these costs because headquarters employees are  only required to track overall hours worked each day versus time  spent on individual tasks. ISCD officials stated that they have  expended, and expect to continue to expend, minor funding amounts  to keep the EAP operational. DHS also reported that it was unable to  discern how much time and resources members of the regulated  community or other stakeholders expended on activities, such as  reviewing EAP proposals or considering whether to use the EAP.  However, DHS stated that it expects that EAP costs to the regulated  community were very low.
Recommend the frequency of compliance inspections that may  be required for EAP facilities. DHS discussed factors that can  influence the frequency of compliance inspections, but did not quantify  a recommended frequency for facilities in the EAP because, currently,  there is no mandated frequency for any facility regardless of the type  of security plan submitted. According to DHS, a variety of factors can  influence the frequency of compliance inspections regardless of the  type of site security plan the facility submits, including the facility’s  risk-based tier and previous compliance history, the corporate owner’s  compliance history, and the number and type of planned measures in  the facility’s approved security plan. The report also stated that DHS  would consider if a facility elected to submit an expedited security plan  when determining the timing of the facility’s initial compliance  inspection and frequency of subsequent inspections. Although DHS  did not quantify a recommended frequency of compliance inspections,  it noted that the election to use an expedited security plan would have  the most impact on scheduling the initial compliance inspection  because that would be the first inspection DHS would conduct at the  facility. In addition, DHS would prioritize conducting an initial  compliance inspection at an expedited facility over inspection of a  similar facility that received approval of a traditional (i.e., standard)  security plan or Alternative Security Program.
section_title: Low EAP Participation May Be Due to Various Factors
subsections: section_title: Two Chemical Facilities Have Used the EAP since Its Inception
paragraphs: According to DHS, as of April 2017, 2 of the 2,496 eligible facilities had  used the EAP since ISCD implemented it; however, one of the two  facilities was no longer in the EAP because ISCD no longer considers the  facility to be high risk. ISCD had approved both facilities’ expedited  security plans—one before DHS issued the aforementioned report to  Congress and one after the report. ISCD officials stated that they have  not assessed why only two facilities have used the EAP and do not intend  to do so because they did not have a preconceived number of facilities  that they expected to use it. They also said that the EAP is one of three  options—the expedited security plan, the standard security plan, and the  Alternative Security Program—that tier 3 and tier 4 facilities can use.  ISCD does not encourage facilities to use the EAP or discourage facilities  from using it because facility officials are in the best position to decide  which approach is the best option for their facility.
Officials representing the two EAP chemical facilities told us that their  companies involve small operations that store a single chemical of  interest on site and do not have staff with extensive experience or  expertise in chemical security. Officials from both facilities said they used  the EAP instead of a standard site security plan or Alternative Security  Program because the EAP would reduce the time and cost to prepare  and submit their security plans. Officials from both facilities also stated  that the EAP’s prescriptive nature helped them to quickly determine the  security measures required to be in their site security plans. For example,  the contractor who prepared the site security plan for one of the two EAP  facilities said that the facility probably saved $2,500 to $3,500 in  consulting fees by using the EAP instead of a standard security plan.  According to ISCD, the first compliance inspection at the one remaining  EAP facility is scheduled to start later in calendar year 2017.
section_title: ISCD and Stakeholders Identified Several Factors That May Explain Why the EAP Has Not Been More Widely Used
paragraphs: ISCD and industry stakeholders we interviewed identified several factors  that may explain why the EAP has not been more widely used, as  discussed below.
Timing of the EAP’s Implementation. ISCD officials stated that the  timing of the EAP’s implementation may be the primary reason that only  two facilities have used it. The officials explained that, by the time ISCD  had implemented the EAP, the majority of eligible facilities had already  submitted standard site security plans or Alternative Security Programs to  ISCD, so it was not worthwhile for the facilities to start over again to use  the EAP. For example, ISCD officials told us that they had already  approved standard security plans and Alternative Security Programs from  about 61 percent (1,463 of approximately 2,400) of facilities that had been  assigned to tier 3 or tier 4 prior to the EAP’s implementation. Also,  officials from 5 of the 11 industry organizations we interviewed stated that  the timing of the EAP’s implementation resulted in limited interest in using  the EAP.
Prescriptive Nature of the EAP. As previously discussed, the CFATS  Act of 2014 required DHS to develop specific security measures for the  EAP that are sufficient to meet Risk-Based Performance Standards. ISCD  officials and officials from 6 of the 11 industry organizations we  interviewed stated that the prescriptive security measures required in the  expedited security plan likely deterred some facilities from using the EAP.  According to ISCD officials, some industry officials think that certain EAP-  required security measures are too strict for tier 3 and tier 4 facilities.  Officials we interviewed from 5 of the 11 industry organizations said that  some, if not most, EAP-required security measures are more robust or  strict than they should be for tier 3 and tier 4 facilities; however, officials  from a Sector Coordinating Council and a member organization said that  the EAP’s required security measures are fair or appropriate for tier 3 and  tier 4 facilities. ISCD officials agreed that some EAP required security  measures are strict because the CFATS Act of 2014 requires that DHS  develop specific security measures and approve expedited security plans  that are determined to not be facially deficient based only on a review of  the plan. For example, an industry official told us that a security measure  pertaining to screening and inspection of vehicles is too strict.  Specifically, the EAP guidance states that a facility must screen and  inspect all vehicles for firearms, explosives, or certain materials prior to  allowing vehicles access to the facility’s perimeter by visually inspecting  the vehicle, using a trained explosive detection dog team, under/over  vehicle inspection systems, or cargo inspection systems. ISCD officials  told us that this security measure is required because ISCD would not be  able to evaluate the capability of a facility’s random or percentage-based  screening and inspection program by doing a review of the facility’s  expedited security plan; therefore, ISCD requires that EAP facilities apply  this requirement to all vehicles prior to accessing a facility’s perimeter.
However, ISCD officials and officials from 4 of 11 industry organizations  also stated that the EAP’s prescriptive measures actually could  encourage some facilities to use the EAP. For example, officials from an  industry organization stated that smaller facilities often lack staff with the  expertise needed to prepare a standard site security plan or Alternative  Security Program and may prefer the EAP because it clearly states what  a facility is required to do to meet security measures. This was consistent  with the views of the officials representing the two facilities that submitted  EAPs, as discussed earlier.
Lack of an Authorization Inspection under the EAP. As previously  discussed, ISCD conducts an authorization inspection at facilities using  the standard process, but does not conduct this inspection at facilities  using the EAP. ISCD officials stated that the lack of an authorization  inspection under the EAP may discourage some facilities from using it  because some facility officials have told ISCD that this inspection  provides useful information about their facility’s security. However, ISCD  officials also said that some facilities may prefer the lack of an  authorization inspection under the EAP because this expedites the  approval process for a site security plan compared to the process for a  standard security plan or Alternative Security Program.
Certification Form Required for the EAP. An ISCD official and an  industry official we interviewed told us that the certification form that a  facility official must sign under penalty of perjury and submit to ISCD with  the expedited security plan, may deter some facilities from using the EAP.  For example, the DHS official stated that the form contains strict  requirements and could result in the signing official being legally liable  and subject to penalties in certain circumstances. However, officials for  the two facilities that submitted expedited security plans and certification  forms to ISCD told us that they were not concerned about signing the  form.
section_title: The Effect of Recent Changes to the CFATS Program on Future Use of the EAP Is Uncertain
paragraphs: Two other factors that could influence facilities’ participation in the EAP  are the introduction of revised processes for (1) facilities to provide  information to ISCD and (2) ISCD to determine the risk tier for each  facility. ISCD officials stated that, in fall 2016, they implemented a revised  Chemical Security Assessment Tool for facilities to provide information to  ISCD in response to industry concerns, such as asking facilities to answer  duplicate questions. In the same time frame, ISCD implemented a revised  risk-tiering methodology in response to our prior reports and stakeholder  concerns about not addressing all elements of risk (threat, vulnerability,  and consequence). ISCD officials said they revised the risk-tiering  methodology to enhance its ability to consider the elements of risk  associated with a terrorist attack.
The revised Chemical Security Assessment Tool, called the Chemical  Security Assessment Tool 2.0, includes a revised Top-Screen and a  streamlined version of the standard site security plan. ISCD officials  said that a primary reason they revised the assessment tool was to  eliminate duplication and confusion associated with the original standard  security plan. The streamlined security plan, in ISCD officials’ view, flows  more logically, is more user-friendly, requires facility officials to write less  narrative, does not have ambiguous questions, and pre-populates data  from one part to another, so users do not have to re-type the same  information multiple times. According to ISCD officials, industry feedback  about Chemical Security Assessment Tool 2.0 has been very positive.  Officials in 9 of the 11 industry organizations we interviewed told us that  they have positive views about the revised assessment tool and that it is  better than the original assessment tool. For example, officials from 5 of  the 11 industry organizations stated that ISCD had improved the  assessment tool by streamlining or eliminating duplicative questions. If  the updated tool proves easier to use, it could affect future interest in  using the expedited program.
Regarding the revised tiering methodology, ISCD initiated a phased  approach to re-tier about 27,000 facilities. ISCD officials said these  facilities must re-submit Top-Screens using Chemical Security  Assessment Tool 2.0 and the revised tiering methodology will be used to  determine if each facility is high risk and, if so, assign the appropriate risk  tier to the facility. According to a senior ISCD official, the re-tiering efforts  are resulting in shifts in the risk assessments for some facilities due to the  revised tiering methodology and because many facilities have not  submitted new information in 7 or 8 years; however, dramatic shifts in the  risk tiers of a large number of facilities are not expected. Nevertheless,  ISCD is uncertain about the effect that Chemical Security Assessment  Tool 2.0 and the revised tiering methodology will have on the future use  of the EAP because ISCD cannot predict the extent to which facilities may  be  re-assigned from tier 1 or tier 2 to tier 3 or tier 4, or vice versa; assigned to tier 3 or tier 4 and submit an expedited security plan  instead of a streamlined standard plan or Alternative Security  Program, or vice versa; new to CFATS and assigned to tier 3 or tier 4; or no longer considered to be high risk.
Given that only one facility is currently covered by the EAP, and about  27,000 facilities are to ultimately re-submit Top-Screens using Chemical  Security Assessment Tool 2.0 and be tiered using the revised tiering  methodology, it is too early to tell what impact, if any, the revised CFATS  process will have on the future use of the EAP.
section_title: Agency Comments
paragraphs: We provided a draft of this report to DHS for review and comment. DHS  did not provide formal comments, but did provide a technical comment,  which we incorporated, as appropriate.
We are sending copies of this report to interested congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix II.
section_title: Appendix I: Example of a Section in an Expedited Approval Program Site Security Plan
paragraphs: The following security measures are from Section D of the site security  plan example for the Expedited Approval Program. For facilities that  prepare an expedited security plan and submit it to the Department of  Homeland Security (DHS), facility officials are to put a checkmark next to  each applicable security measure that the facility has in place. For each  applicable security measure that the facility does not have in place, facility  officials are to explain the security measure planned to be implemented in  the next 12 months. If the facility has a material deviation from a security  measure, facility officials are to explain compensatory measures that  provide comparable security.
Section D: Response Measures (Risk-Based Performance Standards 9,  11, 13, and 14)
subsections: section_title: D.1 Response Planning
paragraphs: D.1.1 ___ The facility has a defined emergency and security response  organization in order to respond to site emergencies and security  incidents.
D.1.2 ___ The facility has a crisis management plan which includes  emergency response procedures, security response plans, and post- incident security plans (post-terrorist attack, security incident, natural  disaster, etc.).
For Release facilities only:  D.1.2.1 ___ The facility has additional portions to their crisis  management plan, which include emergency shutdown plans,  evacuation plans, re-entry/recovery plans, and community notification  plans to account for response to Release chemicals of interest.  ___ The facility is not regulated for Release chemicals of interest.
D.1.3 ___ The facility has designated individual(s) responsible for  executing each portion of the crisis management plan and individual(s)  have been trained to execute all duties.
D.1.4 ___ The facility has the appropriate resources (staff,  emergency/response equipment, building space, communications  equipment, process controls/safeguards, etc.) to execute all response  plans. Emergency equipment includes at least one of the following:
A radio system that is redundant and interoperable with law  enforcement and emergency response agencies.
At least one backup communications system, such as cell  phones/desk phones.
An emergency notification system (e.g., a siren or other facility-wide  alarm system).
Automated control systems or other process safeguards for all  process units to rapidly place critical asset(s) in a safe and stable  condition and procedures for their use in an emergency.
Emergency safe-shutdown procedures for all process units.
D.1.5 ___ All facility personnel have been trained on all response plans  and response plans are exercised on a regular basis and at a minimum of  biennially.
D.1.6 ___ The facility has an active outreach program with local first  responders (Police Department and Fire Department) which includes  providing response documentation to agencies, providing facility layout  information to agencies, inviting agencies to facility orientation tours,  notifying agencies of the facility’s chemicals of interest (regulated  chemicals of interest and other chemical holdings identified on Appendix  A) and security concern, and maintaining regular communication with  agencies.
section_title: D.2 Elevated and Specific Threats (Risk-Based Performance Standards 13 and 14):
paragraphs: D.2.1 ___ The facility has a documented process for increasing security  measures commensurate to the designated threat level during periods of  elevated threats tied to the National Terrorism Advisory System and when  notified by DHS of a specific threat.
D.2.2 ___ The facility will begin to execute security measures for elevated  and specific threats within 8 hours of notification.
D.2.3 ___ The facility will execute the following measures as a result of  an elevated or specific threat:
Coordinate with Federal, state, and local law enforcement agencies.
Increase detection efforts through either dedicated monitoring of  security systems (Intrusion Detection System (IDS) or Closed Circuit  Television (CCTV)), increased patrols of the perimeter and/or asset  area(s), or stationing of personnel at access points and/or asset  area(s).
For Theft/Diversion and Sabotage facilities only, increase frequency of  outbound screening and inspections.
For Sabotage facilities only, increase monitoring of outbound  shipments.
For Release facilities only, increase frequency of inbound screening  and inspections.
section_title: Response Planned Measures
section_title: Material Deviation
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, John Mortin, Assistant Director,  and Joseph E. Dewechter, Analyst-in-Charge, managed this audit  engagement. Chuck Bausell, Michele Fejfar, Tracey King, Michael  Lenington, and Claire Peachey made significant contributions to this  report.