Critical Infrastructure Protection: Progress and Challenges in DHS's Management of Its Chemical Facility Security Program
Released: 2019-02-27T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Thousands of facilities across the United States contain hazardous chemicals that could be used by terrorists to inflict mass casualties or harm surrounding populations. In accordance with the DHS Appropriations Act, 2007, DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. DHS inspects high-risk facilities after it approves facility security plans to ensure that the facilities are implementing required security measures and procedures.

This statement summarizes progress and challenges related to DHS's CFATS program management. This statement is based on prior products GAO issued from July 2012 through August 2018, along with updates as of September 2018 on actions DHS has taken to address GAO's prior recommendations. To conduct the prior work, GAO reviewed relevant laws, regulations, and DHS policies for administering the CFATS program; how DHS assesses risk; and data on high-risk chemical facilities. GAO also interviewed DHS officials and relevant stakeholders.

section_title: What GAO Found
paragraphs: The Department of Homeland Security (DHS) has made progress addressing challenges that GAO's past work identified to managing the Chemical Facility Anti-Terrorism Standards (CFATS) program. The following summarizes progress made and challenges remaining in key aspects of the program.

Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS used self-reported and unverified data to determine the risk of facilities holding toxic chemicals that could threaten surrounding communities if released. GAO recommended that DHS should better verify the accuracy of facility-reported data. DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so.

Assessing risk and prioritizing facilities. In April 2013, GAO reported weaknesses in multiple aspects of DHS's risk assessment and prioritization approach. To improve this process, GAO recommended that DHS enhance its risk assessment approach to incorporate all elements of risk and conduct a peer review after doing so. DHS implemented both recommendations by revising the CFATS risk assessment methodology to include threat, vulnerability, and consequence to better cover the range of security issues, and conducting peer reviews and technical reviews to verify and validate the CFATS program's new risk assessment approach.

Reviewing and approving facility site security plans . DHS is to review facility security plans to ensure their security measures meet DHS standards. In April 2013, GAO reported a 7- to 9-year backlog for these reviews. In July 2015, GAO reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS has since taken additional action to expedite these activities and has eliminated this backlog.

Inspecting facilities and ensuring compliance. In July 2015, GAO found that nearly half of the facilities DHS had inspected were not fully compliant with their approved security plans and that DHS did not have documented procedures for managing facilities' compliance. GAO recommended that DHS document procedures for managing compliance. DHS revised CFATS procedures that, as of February 2019, GAO is reviewing to determine if they sufficiently address the recommendation.

Conducting stakeholder and first responder outreach. In August 2018, GAO reported that DHS shares some CFATS information with first responders and emergency planners but these stakeholders may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. GAO recommended that DHS should, among other things, take actions to explore opportunities to improve information-sharing with first responders and emergency planners. DHS concurred with this recommendation and reported in September 2018 that it is conducting additional outreach and taking other actions to implement it.

section_title: What GAO Recommends
paragraphs: GAO has made various recommendations to strengthen DHS's management of the CFATS program, with which DHS has generally agreed. DHS has implemented or described planned actions to address these recommendations.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our past work on the Department  of Homeland Security’s (DHS) efforts to manage its Chemical Facility  Anti-Terrorism Standards (CFATS) program. Thousands of facilities that  produce, use, or store hazardous chemicals could be of particular interest  to terrorists who might seek to use toxic chemicals to inflict mass  casualties in the United States. These chemicals could be released from  a facility to cause harm to surrounding populations; they could be stolen  and used as chemical weapons or as their precursors (the ingredients for  making chemical weapons); or they could be stolen and used to build an  improvised explosive device. Past incidents remind us of the danger that  these chemicals pose, including the 2013 ammonium nitrate explosion at  a fertilizer storage and distribution facility in West, Texas, which killed at  least 14 people and damaged or destroyed at least 200 homes, and the  1995 domestic terrorist attack on the federal building in Oklahoma City,  Oklahoma, where 168 people were killed using ammonium nitrate  fertilizer mixed with fuel oil.

The Department of Homeland Security Appropriations Act, 2007, required  DHS to issue regulations to establish risk-based performance standards  (performance standards) for securing high-risk chemical facilities. DHS  subsequently established the CFATS program in 2007 to, among other  things, identify high-risk chemical facilities and assess the risk posed by  them; place facilities considered to be high-risk into one of four risk-based  tiers (with tier 1 being the highest risk tier and 4 being the lowest); assess  facility security; approve security plans prepared by facilities; and inspect  facilities to ensure compliance with regulatory requirements. DHS’s  CFATS rule established 18 performance standards that identify the areas  for which a facility’s security posture are to be examined, such as  perimeter security, access control, and cyber security. To meet these  standards, facilities are free to choose whatever security programs or  processes they deem appropriate so long as DHS determines that the  facilities achieve the requisite level of performance in each of the  applicable areas. The Protecting and Securing Chemical Facilities from  Terrorist Attacks Act of 2014 (CFATS Act of 2014), enacted in December  2014, in effect, reauthorized the CFATS program for an additional 4  years, while also imposing additional implementation requirements on  DHS for the program. In January 2019, the Chemical Facility Anti- Terrorism Standards Program Extension Act, was enacted and extended  the authorization by 15 months.

DHS’s Cybersecurity and Infrastructure Security Agency’s Infrastructure  Security Compliance Division (ISCD) manages the CFATS program.  According to DHS, the department received approximately $911 million  for the CFATS program for the period beginning fiscal year 2007 through  fiscal year 2018.

My testimony today summarizes our past work examining DHS’s  management of the CFATS program, and provides updates on actions  DHS has taken to address our prior recommendations. This testimony is  based on our reports issued from July 2012 through August 2018. For these reports, we reviewed applicable laws and regulations, DHS policies  and procedures, DHS data on tiered facilities, information on the  approach DHS used to determine a facility’s risk, and process for  reviewing security plans. We also interviewed DHS officials about how  facilities are placed in risk-based tiers, how DHS assesses risk, and how  it reviews and approves facility security plans. Additional details on the  scope and methodology are available in our published reports. In  addition, this statement contains updates as of September 2018 from  DHS on actions it has taken to address the recommendations made in  our prior reports.

The work upon which this statement is based was conducted in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: DHS Has Made Progress Addressing Past Challenges, But Some Actions are Still Under Way
paragraphs: Our past work has identified progress and challenges in a number of  areas related to DHS’s management of the CFATS program, including (1)  the process for identifying high-risk chemical facilities; (2) how it assesses  risk and prioritizes facilities; (3) reviewing and approving facility site  security plans; (4) inspecting facilities and ensuring compliance; and (5)  efforts to conduct outreach with stakeholders and first responders.
subsections: section_title: Identifying High-Risk Chemical Facilities
paragraphs: In May 2014, we found that more than 1,300 facilities had reported having  ammonium nitrate to DHS. However, based on our review of state data  and records, there were more facilities with ammonium nitrate holdings  than those that had reported to DHS under the CFATS program. Thus,  we concluded that some facilities weren’t required to report to DHS and  some that were required may have failed to do so. We recommended  that DHS work with other agencies, including the Environmental  Protection Agency (EPA), to develop and implement methods of  improving data sharing among agencies and with states as members of a  Chemical Facility Safety and Security Working Group. DHS agreed with  our recommendation and has since addressed it. Specifically, DHS  compared DHS data with data from other federal agencies, such as EPA,  as well as member states from the Chemical Facility Safety and Security  Working Group to identify potentially noncompliant facilities. As a result of  this effort, in July 2015, DHS officials reported that they had identified  about 1,000 additional facilities that should have reported information to  comply with CFATS and subsequently contacted these facilities to ensure  compliance. DHS officials told us that they continue to engage with states  to identify potentially non-compliant facilities. For example, as of June  2018, DHS officials stated that they have received 43 lists of potentially  noncompliant facilities from 34 state governments, which are in various  stages of review by DHS. DHS officials also told us that they hired an  individual to serve as the lead staff member responsible for overseeing  this effort.

DHS has also taken action to strengthen the accuracy of data it uses to  identify high-risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for  facilities that held toxic chemicals that could threaten surrounding  communities if released. At the time, DHS required that facilities self- report the Distance of Concern—an area in which exposure to a toxic  chemical cloud could cause serious injury or fatalities from short-term  exposure—as part of its Top-Screen. We estimated that more than  2,700 facilities with a toxic release threat had misreported the Distance of  Concern and therefore recommended that DHS (1) develop a plan to  implement a new Top-Screen to address errors in the Distance of  Concern submitted by facilities, and (2) identify potentially miscategorized  facilities that could cause the greatest harm and verify that the Distance  of Concern of these facilities report is accurate. DHS has fully  addressed both of these recommendations. Specifically, in response to  the first recommendation, DHS implemented an updated Top-Screen  survey in October 2016 and now collects data from facilities and conducts  more accurate modeling to determine the actual area of impact (formerly  called the Distance of Concern), rather than relying on the facilities’  calculation. In response to the second recommendation, DHS officials  reported in November 2016 that they reassessed all facility Top-Screens  that reported threshold quantities of chemicals posing a toxic release  threat, and identified 158 facilities with the potential to cause the greatest  harm. In April 2018, DHS officials reported that all of these facilities have  since been reassessed using updated Top-Screen information and,  where appropriate, assigned a risk tier.

section_title: Assessing Risk and Prioritizing Facilities
paragraphs: DHS has also taken actions to better assess regulated facilities’ risks in  order to place the facilities into the appropriate risk tier. In April 2013, we  reported that DHS’s risk assessment approach did not consider all of the  elements of threat, vulnerability, and consequence associated with a  terrorist attack involving certain chemicals. Our work showed that DHS’s  CFATS risk assessment methodology was based primarily on  consequences from human casualties, but did not consider economic  consequences, as called for by the National Infrastructure Protection Plan  (NIPP) and the CFATS regulation. We also found that (1) DHS’s  approach was not consistent with the NIPP because it treated every  facility as equally vulnerable to a terrorist attack regardless of location or  on-site security and (2) DHS was not using threat data for 90 percent of  the tiered facilities—those tiered for the risk of theft or diversion—and  using 5-year-old threat data for the remaining 10 percent of those facilities  that were tiered for the risks of toxic chemical release or sabotage. We  recommended that DHS enhance its risk assessment approach to  incorporate all elements of risk and conduct an independent peer review  after doing so. DHS agreed with our recommendations and has  implemented actions to address both of them.

Specifically, with regard to our recommendation that DHS enhance its risk  assessment approach to incorporate all elements of risk, DHS worked  with Sandia National Laboratories to develop a model to estimate the  economic consequences of a chemical attack. In addition, DHS worked  with Oak Ridge National Laboratory to devise a new tiering methodology,  called the Second Generation Risk Engine. In so doing, DHS revised the  CFATS threat, vulnerability, and consequence scoring methods to better  cover the range of CFATS security issues. Additionally, with regard to our  recommendation that DHS conduct a peer review after enhancing its risk  assessment approach, DHS conducted peer reviews and technical  reviews with government organizations and facility owners and operators,  and worked with Sandia National Laboratories to verify and validate the  CFATS program’s revised risk assessment methodology.

To further enhance its risk assessment approach, in the fall of 2016, DHS  also revised its Chemical Security Assessment Tool (CSAT), which  supports DHS efforts to gather information from facilities to assess their  risk. According to DHS officials, the new tool—called CSAT 2.0—is  intended to eliminate duplication and confusion associated with DHS’s  original CSAT. DHS officials told us that they have improved the tool by  revising some questions in the original CSAT to make them easier to  understand; eliminating some questions; and pre-populating data from  one part of the tool to another so that users do not have to retype the  same information multiple times. DHS officials also told us that the  facilities that have used the CSAT 2.0 have provided favorable feedback  that the new tool is more efficient and less burdensome than the original  CSAT. Finally, DHS officials told us that, as of June 2018, DHS  completed all notifications and processed tiering results for all but 226  facilities. DHS officials did not provide an estimated target completion  date for these pending risk assessments, noting that completing the  assessments is highly dependent on the facilities providing the necessary  Top-Screen information.

section_title: Reviewing and Approving Facility Site Security Plans
paragraphs: DHS has also made progress reviewing and approving facility site  security plans by reducing the time it takes to review these plans and  eliminating the backlog of plans awaiting review. In April 2013, we  reported that DHS revised its procedures for reviewing facilities’ security  plans to address DHS managers’ concerns that the original process was  slow, overly complicated, and caused bottlenecks in approving plans.  We estimated that it could take DHS another 7 to 9 years to review the  approximately 3,120 plans in its queue at that time. We also estimated  that, given the additional time needed to do compliance inspections, the  CFATS program would likely be implemented in 8 to 10 years. We did not  make any recommendations for DHS to improve its procedures for  reviewing facilities’ security plans because DHS officials reported that  they were exploring ways to expedite the process, such as reprioritizing  resources and streamlining inspection requirements. In July 2015, we  reported that DHS had made substantial progress in addressing the  backlog—estimating that it could take between 9 and 12 months for DHS  to review and approve security plans for the approximately 900 remaining  facilities. DHS officials attributed the increased approval rate to  efficiencies in DHS’s review process, updated guidance, and a new case  management system. Subsequently, DHS reported in its December 2016  semi-annual report to Congress that it had eliminated its approval  backlog.

Finally, we found in our 2017 review that DHS took action to implement  an Expedited Approval Program (EAP). The CFATS Act of 2014  required that DHS create the EAP as another option that tier 3 and tier 4  chemical facilities may use to develop and submit security plans to  DHS. Under the program, these tier 3 and 4 facilities may develop a  security plan based on specific standards published by DHS (as opposed  to the more flexible performance standards using the standard, non- expedited process). DHS issued guidance intended to help facilities  prepare and submit their EAP security plans to DHS, which includes an  example that identifies prescriptive security measures that facilities are to  have in place. According to committee report language, the EAP was  expected to reduce the regulatory burden on smaller chemical  companies, which may lack the compliance infrastructure and the  resources of large chemical facilities, and help DHS to process security  plans more quickly. If a tier 3 or 4 facility chooses to use the expedited  option, DHS is to review the plan to determine if it is facially deficient,  pursuant to the reporting requirements of the CFATS Act of 2014. If  DHS approves the EAP site security plan, it is to subsequently conduct a  compliance inspection.

In 2017, we found that DHS had implemented the EAP and had reported  to Congress on the program, as required by the CFATS Act of 2014. In addition, as of June 2018, according to DHS officials, only 18 of the 3,152  facilities eligible to use the EAP had opted to use it. DHS officials  attributed the low participation to several possible factors including:

DHS had implemented the expedited program after most eligible  facilities already submitted standard (non-expedited) security plans to  DHS;  facilities may consider the expedited program’s security measures to  be too strict and prescriptive, not providing facilities the flexibility of  the standard process; and  the lack of an authorization inspection may discourage some facilities  from using the expedited program because this inspection provides  useful information about a facility’s security.

We also found in 2017 that recent changes made to the CFATS program  could affect the future use of the expedited program. As discussed  previously, DHS has revised its methodology for determining the level of  each facility’s security risk, which could affect a facility’s eligibility to  participate in the EAP.

section_title: Inspecting Facilities and Ensuring Compliance
paragraphs: In our July 2015 report, we found that DHS began conducting compliance  inspections in September 2013, and by April 2015, had conducted  inspections of 83 of the inspected 1,727 facilities that had approved  security plans. Our analysis showed that nearly half of the facilities were  not fully compliant with their approved site security plans and that DHS  had not used its authority to issue penalties because DHS officials found  it more productive to work with facilities to bring them into compliance.  We also found that DHS did not have documented processes and  procedures for managing the compliance of facilities that had not  implemented planned measures by the deadlines outlined in their plans.  We recommended that DHS document processes and procedures for  managing compliance to provide more reasonable assurance that  facilities implement planned measures and address security gaps. DHS  agreed and has since taken steps toward implementing this  recommendation. Specifically, DHS revised CFATS Standard Operating  Procedures that, as of February 2019, we are reviewing to determine if  they sufficiently document the processes and procedures currently being  used to track noncompliant facilities and ensure facilities implement  planned measures as outlined in their approved site security plans.

In August 2018, we reported that our analysis of DHS data since our 2015  report showed that DHS has made substantial progress in conducting and  completing compliance inspections. Specifically, our analysis showed  that DHS increased the number of compliance inspections completed per  year since DHS began conducting compliance inspections in 2013 and  that, for the 2,466 high-risk facilities with an approved site security plan as  of May 2018, DHS had conducted 3,553 compliance inspections. Of  these, DHS issued corrective actions to two facilities that were not in  compliance with their approved site security plan.

In our August 2018 report, we also found that DHS developed a new  methodology and performance measure for the CFATS program in order  to evaluate security changes made by high-risk chemical facilities, but  that the methodology does not measure the program’s impact on  reducing a facility’s vulnerability to an attack. We found that DHS could  take steps to evaluate vulnerability reduction resulting from the CFATS  compliance inspection process. We recommended that DHS incorporate  vulnerability into the new methodology to help measure the reduction in  the vulnerability of high-risk facilities to a terrorist attack, and use that  data in assessing the CFATS program’s performance in lowering risk and  enhancing national security. DHS agreed and is taking steps to  implement this recommendation. Specifically, in September 2018, DHS  reported making progress towards the implementation of two new  performance metrics by the end of the first quarter of fiscal year 2019.  DHS officials stated that these metrics should, among other things,  evaluate the progress of individual facilities in enhancing their security  while part of the CFATS program and be used to demonstrate an  increase in the security posture across the population of CFATS facilities.

section_title: Conducting Stakeholder and First Responder Outreach
paragraphs: In April 2013, we reported that DHS took various actions to work with  facility owners and operators, including increasing the number of visits to  facilities to discuss enhancing security plans, but that some trade  associations had mixed views on the effectiveness of DHS’s outreach.  We found that DHS solicited informal feedback from facility owners and  operators in its efforts to communicate and work with them, but did not  have an approach for obtaining systematic feedback on its outreach  activities. We recommended that DHS take action to solicit and document  feedback on facility outreach consistent with DHS efforts to develop a  strategic communication plan. DHS agreed and has implemented this  recommendation by developing a questionnaire to solicit feedback on  outreach with industry stakeholders and began using the questionnaire in  October 2016.

In August 2018, we reported that DHS shares some CFATS information  with first responders and emergency planners, but these stakeholders  may not have all of the information they need to minimize the risk of injury  or death when responding to incidents at high-risk facilities. While  certain facilities are required under the Emergency Planning and  Community Right-to-Know Act of 1986 to report some chemical inventory  information, which local officials told us they rely on to prepare for and  respond to incidents at chemical facilities, we found over 200 chemicals  covered by CFATS that may not be covered by these reporting  requirements. We also reported that DHS developed a secure interface  called the Infrastructure Protection (IP) Gateway that provides access to  CFATS facility-specific information that may be missing from required reporting. However, we found that the IP Gateway is not widely used at  the local level and officials from 13 of 15 selected Local Emergency  Planning Committees we contacted—consisting of first responders and  covering 373 CFATS high-risk facilities—said they did not have access to  CFATS data in the IP Gateway. We recommended that DHS should take  actions to encourage access to and wider use of the IP Gateway and  explore other opportunities to improve information-sharing with first  responders and emergency planners. DHS concurred with this  recommendation and reported in September 2018 that they are taking  actions to implement it. Specifically, DHS has revised three fact sheets  and an outreach presentation to include information on the IP Gateway  and how to request access to it. In addition, DHS plans to ensure contact  is made with first responders representing the top 25 percent of CFATS  high-risk chemical facilities by no later than March 2019 so that they are  properly prepared to respond to incidents at these facilities.

Chairman Thompson, Ranking Member Rogers, and Members of the  Committee, this completes my prepared statement. I would be pleased to  respond to any questions that you may have at this time.

section_title: GAO Contact and Staff Acknowledgements
paragraphs: If you or your staff members have any questions about this testimony,  please contact me at (202) 512-3841 or andersonn@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Other individuals making key  contributions to this work include Ben Atwater, Assistant Director; Hugh  Paquette, Analyst-in-Charge; Chuck Bausell, Michele Fejfar, Tracey King,  and Tom Lombardi.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Fast facts: Thousands of U.S. facilities handle hazardous chemicals and could be targets for terrorists—e.g., the chemicals could be stolen and used to build explosive devices.

The Department of Homeland Security identifies and assesses the security risk of these facilities. We've made a number of recommendations in the past to help DHS address challenges it faces in doing so.

We testified that DHS has made progress on our recommendations. For example, DHS began to calculate the risk of toxic chemical release rather than relying on individual facilities to do it. Additionally, DHS eliminated its backlog of facility security plan reviews.

Question-summary annotations: questions: question: What issues arose with the reporting of data regarding the risk of toxic chemicals and DHS?
answer: Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS used self-reported and unverified data to determine the risk of facilities holding toxic chemicals that could threaten surrounding communities if released.
child_questions: question: What was recommended to fix the issue of possibly unreliable data regarding the toxic chemicals?
answer: GAO recommended that DHS should better verify the accuracy of facility-reported data.
child_questions: question: How did DHS use the recommendation given to them by the GAO?
answer: DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so.

questions: question: What did GAO report as weaknesses of DHS's risk assessment and prioritization approach?
answer: Assessing risk and prioritizing facilities. In April 2013, GAO reported weaknesses in multiple aspects of DHS's risk assessment and prioritization approach.
child_questions: question: How did the GAO recommend the DHS fix its weaknesses?
answer: To improve this process, GAO recommended that DHS enhance its risk assessment approach to incorporate all elements of risk and conduct a peer review after doing so.

question: How did the DHS use the recommendations of GAO to improve their risk assessment and prioritization approach?
answer: DHS implemented both recommendations by revising the CFATS risk assessment methodology to include threat, vulnerability, and consequence to better cover the range of security issues, and conducting peer reviews and technical reviews to verify and validate the CFATS program's new risk assessment approach.

questions: question: Why are DHS reviewing facility security plans?
answer: DHS is to review facility security plans to ensure their security measures meet DHS standards. In April 2013, GAO reported a 7- to 9-year backlog for these reviews.
child_questions: question: What did GAO report regarding the backlog GAO was facing?
answer: In July 2015, GAO reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities.

question: What has DHS done to address the backlog?
answer: DHS has since taken additional action to expedite these activities and has eliminated this backlog.

questions: question: What was discovered by GAO when it inspected DHS facilities?
answer: Inspecting facilities and ensuring compliance. In July 2015, GAO found that nearly half of the facilities DHS had inspected were not fully compliant with their approved security plans and that DHS did not have documented procedures for managing facilities' compliance.
child_questions: question: What did GAO recommend DHS do to manage the compliance of their facilities?
answer: GAO recommended that DHS document procedures for managing compliance.
child_questions: question: What steps did DHS take after receiving the GAO recommendations?
answer: DHS revised CFATS procedures that, as of February 2019, GAO is reviewing to determine if they sufficiently address the recommendation.

questions: question: What issues did GAO report with the information DHS shares with first responders and emergency planners?
answer: Conducting stakeholder and first responder outreach. In August 2018, GAO reported that DHS shares some CFATS information with first responders and emergency planners but these stakeholders may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities.
child_questions: question: What actions did GAO recommend DHS take to improve their information-sharing?
answer: GAO recommended that DHS should, among other things, take actions to explore opportunities to improve information-sharing with first responders and emergency planners.

question: How did DHS concur with the recommendations of the GAO?
answer: DHS concurred with this recommendation and reported in September 2018 that it is conducting additional outreach and taking other actions to implement it.

questions: question: What describes the facilities of the US?
answer: Thousands of facilities across the United States contain hazardous chemicals that could be used by terrorists to inflict mass casualties or harm surrounding populations.

question: Why did the DHS establish the CFATS program?
answer: In accordance with the DHS Appropriations Act, 2007, DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities.
child_questions: question: What does DHS do under the CFATS?
answer: DHS inspects high-risk facilities after it approves facility security plans to ensure that the facilities are implementing required security measures and procedures.

questions: question: What does the statement relate to?
answer: This statement summarizes progress and challenges related to DHS's CFATS program management.
child_questions: question: What information forms the basis of the statement?
answer: This statement is based on prior products GAO issued from July 2012 through August 2018, along with updates as of September 2018 on actions DHS has taken to address GAO's prior recommendations.

question: How did the GAO conduct its prior work?
answer: To conduct the prior work, GAO reviewed relevant laws, regulations, and DHS policies for administering the CFATS program; how DHS assesses risk; and data on high-risk chemical facilities. GAO also interviewed DHS officials and relevant stakeholders.