Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical Security Program, but It Is Too Early to Assess Results
Published: 2012-09-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The events of September 11, 2001, triggered a national re-examination of the security of facilities that use or store hazardous chemicals in quantities that, in the event of a terrorist attack, could put large numbers of Americans at risk of serious injury or death. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, a division of IP, manages the program. A November 2011 internal ISCD memorandum, prepared by ISCD senior managers, expressed concerns about the management of the program. This statement addresses (1) how the memorandum was developed and any challenges identified, (2) what actions are being taken in response to any challenges identified, and (3) the extent to which ISCDs proposed solutions require collaboration with NPPD or IP. GAOs comments are based on recently completed work analyzing the memorandum and related actions. GAO reviewed laws, regulations, DHSs internal memorandum and action plans, and related documents, and interviewed DHS officials.
In a July 2012 report, GAO recommended that ISCD explore opportunities to develop measures, where practical, to determine where actual performance deviates from expected results. ISCD concurred and has taken action to address the recommendation.
section_title: What GAO Found
paragraphs: The November 2011 memorandum that discussed the management of the Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared based primarily on the observations of the former Director of the Department of Homeland Securitys (DHS) Infrastructure Security Compliance Division (ISCD), a division of the Office of Infrastructure Protection (IP) within the National Protection and Programs Directorate (NPPD). The memorandum was intended to highlight various challenges that have hindered ISCD efforts to implement the CFATS program. According to the former Director, the challenges facing ISCD included not having a fully developed direction and plan for implementing the program, hiring staff without establishing need, and inconsistent ISCD leadershipfactors that the Director believed place the CFATS program at risk. These challenges centered on three main areas: (1) human capital issues, including problems hiring, training, and managing ISCD staff; (2) mission issues, including problems reviewing facility plans to mitigate security vulnerabilities; and (3) administrative issues, including concerns about NPPD and IP not supporting ISCDs management and administrative functions.
ISCD has begun to take various actions intended to address the issues identified in the ISCD memorandum and has developed a 94-item action plan to track its progress. According to ISCD managers, the plan appears to be a catalyst for addressing some of the long-standing issues the memorandum identified. As of June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had been completed. These include directing ISCD managers to meet with staff to involve them in addressing challenges, clarifying priorities, and changing ISCDs culture; and developing a proposal to establish a quality control function over compliance activities. The remaining 60 percent (56 of 94) that were in progress include those requiring longer-term effortsi.e., streamlining the process for reviewing facility security plans and developing facility inspection processes; those requiring completion of other items in the plan; or those awaiting action by others, such as approvals by ISCD leadership. ISCD appears to be heading in the right direction, but it is too early to tell if corrective actions are having their desired effect because ISCD is in the early stages of implementing them and has not yet established performance measures to assess results.
According to ISCD officials, almost half of the action items included in the June 2012 action plan require ISCD collaboration with or action by NPPD and IP. The ISCD memorandum stated that IP and NPPD did not provide the support needed to manage the CFATS program when the program was first under development. ISCD, IP, and NPPD officials confirmed that IP and NPPD are now providing needed support and stated that the action plan prompted them to work together to address the various human capital and administrative issues identified.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Department of Homeland  Security’s (DHS) efforts to address the various challenges in  implementing and managing the Chemical Facility Anti-Terrorism  Standards (CFATS) program. My statement today summarizes the  testimony we delivered on July 26, 2012 before the House Committee on  Appropriations, Subcommittee on Homeland Security. The events of  September 11, 2001, triggered a national re-examination of the security of  facilities that use or store hazardous chemicals in quantities that, in the  event of a terrorist attack, could put large numbers of Americans at risk of  serious injury or death. Chemicals held at these facilities can be used to  cause harm to surrounding populations during terrorist attacks; can be  stolen and used as chemical weapons or as precursors (the ingredients  for making chemical weapons); or stolen and used to build an improvised  explosive device. To mitigate this risk, the DHS appropriations act for  fiscal year 2007 required DHS to issue regulations to establish risk- based performance standards for securing high-risk chemical facilities,  among other things. DHS established the CFATS program to assess the  risk, if any, posed by chemical facilities; place high-risk facilities in one of  four risk-based tiers; require high-risk facilities to develop security plans;  review these plans; and inspect the facilities to ensure compliance with  the regulatory requirements. DHS’s National Protection and Programs  Directorate (NPPD) is responsible for the CFATS program. Within NPPD,  the Infrastructure Security Compliance Division (ISCD), a division of the  Office of Infrastructure Protection (IP), manages the program.
A November 2011, internal ISCD memorandum, prepared by ISCD’s  former Director in consultation with the former Deputy Director and designated by DHS as “for official use only” (FOUO), expressed concerns  about the management of the CFATS program. The ISCD memorandum,  which was leaked to the media in December 2011, cited an array of  challenges that, according to these officials, hindered ISCD’s ability to  implement and manage the CFATS program. My statement today  discusses: (1) how the memorandum was developed and what  challenges were identified; (2) what actions are being taken to address  the challenges identified; and (3) the extent to which ISCD’s planned  actions and proposed solutions require action to be taken by or in  collaboration with NPPD or IP.
This statement is based on work we recently completed for this  subcommittee on the ISCD memorandum and related actions. To conduct  this work, we reviewed applicable laws and regulations, as well as NPPD,  IP, and ISCD policies and procedures for administering the CFATS  program, analyzed the ISCD memorandum prepared by the former ISCD  Director in consultation with the former Deputy Director, compared it with  the proposed action plan ISCD officials prepared to address the  challenges identified, and compared subsequent action plans to monitor  ISCD’s progress.  Our results are based on the ISCD’s action plan as of  June 2012 so these results reflect the status of ISCD’s progress up to that  point in time. The details of our scope and methodology can be found in  our July 2012 statement. In August 2012, ISCD provided us with an  updated action plan which we used to document the additional action  items completed between June 2012 and August 2012. We did not verify  the status of these action items.
We conducted this performance audit from February 2012 to July 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our analysis based  on our audit objectives.
We initially reviewed an ISCD action plan developed in January 2012.  ISCD periodically  updated the plan to monitor progress on the action items and we reviewed 8 versions of  the action plan up to and including one developed in June 2012.
subsections: section_title: Background
paragraphs: Section 550 of the DHS appropriations act for fiscal year 2007 requires  DHS to issue regulations establishing risk-based performance standards  for the security of facilities that the Secretary determines to present high  levels of security risk, among other things. The CFATS rule was  published in April 2007 and Appendix A to the rule, published in  November 2007, listed 322 chemicals of interest and the screening  threshold quantities for each.implementing DHS’s CFATS rule, including assessing potential risks and  identifying high-risk chemical facilities, promoting effective security  planning, and ensuring that final high-risk facilities meet the applicable  risk-based performance standards though site security plans approved by  DHS. ISCD is managed by a Director and a Deputy Director and operates  five branches that are, among other things, responsible for information  technology operations, policy and planning, and providing compliance  and technical support. From fiscal years 2007 through 2012, DHS  dedicated about $442 million to the CFATS program. During fiscal year  2012, ISCD was authorized 242 full-time-equivalent positions. For fiscal  year 2013, DHS’s budget request for the CFATS program was $75 million  and 242 positions.
section_title: Senior ISCD Leaders Developed the ISCD Memorandum to Highlight Various Challenges Hindering CFATS Implementation
subsections: section_title: ISCD’s Memorandum Based Largely on Observations of Senior ISCD Managers
paragraphs: Our review of the ISCD memorandum and discussions with ISCD officials  showed that the memorandum was developed during the latter part of  2011 and was developed primarily based on discussions with ISCD staff  and the observations of the ISCD former Director in consultation with the  former Deputy Director. In November 2011, the former Director and  Deputy Director provided the Under Secretary with the ISCD  memorandum entitled “Challenges Facing ISCD, and the Path Forward.”  These officials stated that the memorandum was developed to inform  leadership about the status of ISCD, the challenges it was facing, and the  proposed solutions identified to date. In transmitting a copy of the  memorandum to congressional stakeholders following the leak in  December 2011, the NPPD Under Secretary discussed caveats about the  memorandum, including that it had not undergone the normal review  process by DHS’s Executive Secretariat and contained opinions and  conclusions that did not reflect the position of DHS.
The former ISCD Director stated that the memo was intended to begin a  dialog about the program and challenges it faced. The former Director  confirmed that she developed the memorandum by (1) surveying division  staff to obtain their opinions on program strengths, challenges, and  recommendations for improvement; (2) observing CFATS program  operations, including the security plan review process; and (3) analyzing  an internal DHS report on CFATS operations, which, according to the  former Director served as a basis for identifying some administrative  challenges and corrective action. The senior ISCD and NPPD officials we  contacted said that they generally agreed with the material that they saw,  but noted that they believed the memorandum was missing context and  balance. For example, one NPPD official stated that that the tone of the  memorandum was too negative and the problems it discussed were not  supported by sound evaluation. However, the official expressed the view  that the CFATS program is now on the right track.
section_title: ISCD Management Was Concerned That Challenges Place the CFATS Program at Risk
paragraphs: The ISCD memorandum discussed numerous challenges that, according  to the former Director, pose a risk to the program. The former Director  pointed out that, among other things, ISCD had not approved any site  security plans or carried out any compliance inspections on regulated  facilities. The former Director attributed this to various management  challenges, including a lack of planning, poor internal controls, and a  workforce whose skills were inadequate to fulfill the program’s mission,  and highlighted several challenges that have had an impact on the  progress of the program. In addition, the memorandum provided a  detailed discussion of the issues or problems facing ISCD, grouped into  three categories: (1) human capital management, such as poor staffing  decisions; (2) mission issues, such as the lack of an established  inspection process; and (3) administrative issues, such as a lack of  infrastructure and support, both within ISCD and on the part of NPPD and  IP.
section_title: ISCD Has Begun to Take Various Actions Intended to Address Challenges Identified
subsections: section_title: ISCD’s Action Plan Included Time Frames and Appears to be Helping Address Some Legacy Issues
paragraphs: ISCD is using an action plan to track its progress addressing the  challenges identified in the memorandum, and, according to senior  division officials, the plan may be helping them address some legacy  issues that staff were attempting to deal with before the memorandum  was developed. The January 2012 version of the proposed action plan  listed 91 actions to be taken categorized by issue—human capital  management issues, mission issues, or administrative issues—that,  according to the former ISCD Director, were developed to be consistent  with the ISCD memorandum. However, the January 2012 version of the  action plan did not provide information on when the action was started or  to be finished. Eleven of the 12 ISCD managers (other than the former  Director and Deputy Director) assigned to work as the coordinators of the  individual action items told us that even though they were not given the  opportunity to view the final version of the ISCD memorandum, the former  Director provided them the sections of the action plan for which they were  responsible to help them develop and implement any corrective actions.  They said that they agreed that actions being taken in the plan were  needed to resolve challenges facing ISCD. Our discussions with these  officials also showed that about 39 percent (37 of 94) of the items in the  March and June 2012 action plans addressed some legacy issues that  were previously identified and, according to these officials, corrective  actions were already underway for all 37 of these items.
section_title: ISCD’s June 2012 Plan Update Showed 38 Action Items Completed
paragraphs: Our analysis of the June 2012 version of the ISCD action plan showed  that 40 percent of the items in the plan (38 of 94) had been completed.  The remaining 60 percent (56 of 94) were in progress. Of the 38  completed items, we determined that 32 were associated with human  capital management and administrative issues, including those involving  culture and human resources, contracting, and documentation. The  remaining 6 of 38 action items categorized by ISCD as completed were  associated with mission issues. Figure 1 shows the status of action items  by each of the three categories as of June 2012.
For the remaining 56 items that were in progress as of June 2012, 40  involved human capital management and administrative issues.  According to ISCD officials, these 40 issues generally involved longer- term efforts—such as organizational realignment—or those that require  approval or additional action on the part of IP or NPPD. Sixteen of 56  remaining actions items in progress covered mission issues that will likely  also require long-term efforts to address.
As of August 2012, ISCD reported that it had completed another 21 action  items, of which 8 were to address mission-related issues. We did not  verify ISCD’s efforts to complete actions since June 2012. However, we  have recently begun a follow-up review of CFATS at the request of this  and other committees, which will focus on DHS’s efforts to address  mission-related issues. We expect to report the results of these efforts  early in 2013.
section_title: Almost Half of ISCD’s Action Item Completion Dates Had Been Extended since April 2012
paragraphs: Our analysis of the April and June versions of the plan shows that the  division had extended the estimated completion dates for nearly half of  the action items. Estimated completion dates for 52 percent (48 of 93  items) either did not change (37 items) or the date displayed in the June  2012 plan was earlier than the date in the April 2012 version of the plan  (11 items). Conversely, 48 percent (45 of 93) of the items in the June  2012 version of the plan had estimated completion dates that had been  extended beyond the date in the April 2012 plan. Figure 2 shows the  extent to which action plan items were completed earlier than planned,  did not change, or were extended, from April 2012 through June 2012, for  the human capital management, mission, and administrative issues  identified in the plan.
ISCD officials told us that estimated completion dates had been extended  for various reasons. For example, one reason for moving these dates was  that the work required to address some items was not fully defined when  the plan was first developed and as the requirements were better defined,  the estimated completion dates were revised and updated. In addition,  ISCD officials also stated that timelines had been adversely affected for  some action items because staff had been reassigned to work on higher  priority responsibilities, such as reducing the backlog of security plans  under review.
section_title: Action Plan Performance Measures Could Help Gauge Progress
paragraphs: ISCD, through its action plan, appears to be heading in the right direction  towards addressing the challenges identified, but it is too early to tell if the  action plan is having the desired effect because (1) the division had only  recently completed some action items and continues to work on  completing more than half of the others, some of which entail long-term  changes, and (2) ISCD had not yet developed an approach for measuring  the results of its efforts. ISCD officials told us that they had not yet begun  to plan or develop any measures, metrics, or other documentation  focused on measuring the impact of the action plan on overall CFATS  implementation because they plan to wait until corrective action on all  items has been completed before they can determine the impact of the  plan on the CFATS program. For the near term, ISCD officials stated that  they plan to assess at a high level the impact of the action plan on  CFATS program implementation by comparing ISCD’s performance rates  and metrics pre-action plan implementation and post-action plan  implementation. However, because ISCD will not be completing some  action items until 2014, it will be difficult for ISCD officials to obtain a  complete understanding of the impact of the plan on the program using  this comparison only.
In our July 2012 statement, we recommended that ISCD look for  opportunities, where practical, to measure results of their efforts to  implement particular action items, and where performance measures can  be developed, periodically monitor these measures and indicators to  identify where corrective actions, if any, are needed. The agency  concurred with our recommendation and developed a new action item  (number 95) intended to develop metrics for measuring, where practical,  results of efforts to implement action plan items, including processes for  periodic monitoring and indicators for corrective actions. This action item  is in progress.
section_title: ISCD Officials Stated That Almost Half of the Action Items Required Collaboration with or Action by NPPD or IP
paragraphs: According to ISCD officials, almost half of the action items included in the  June 2012 action plan either require ISCD to collaborate with NPPD and  IP or require NPPD and IP to take action to address the challenges  identified in the ISCD memorandum. NPPD, IP, and ISCD officials have  been working together to identify solutions to the challenges the  memorandum identified and to close pertinent action items. According to  division officials, 46 of the 94 action items included in the June 2012  action plan required action either by NPPD and IP or collaboration with  NPPD and IP. This includes collaborating with NPPD officials  representing the NPPD human capital, facilities, and employee and labor  relations offices, among others, and with IP’s Directorate of Management  Office. As of June 2012, 13 of the 46 items that require action by or  collaboration with NPPD or IP were complete; 33 of 46 were in progress.  As of August 2012, ISCD reported that it had completed 8 more of these  action items, such that 21 of the 46 were complete and 25 were in  progress. We did not verify ISCD’s efforts to close these additional action  items.
Chairman Shimkus, Ranking Member Green, and members of the  subcommittee, this completes my prepared statement. I would be happy  to respond to any questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgements
paragraphs: For information about this statement please contact Cathleen A. Berrick,  Managing Director, Homeland Security and Justice, at (202) 512-8777 or  BerrickC@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. Other individuals making key contributions include Stephen L.  Caldwell, Director; John F. Mortin, Assistant Director; Ellen Wolfe,  Analyst-in-Charge; Charles Bausell; Jose Cardenas; Andrew M. Curry;  Michele Fejfar; Tracey King; Marvin McGill; Mona E. Nichols-Blake; and  Jessica Orr.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.