Critical Infrastructure Protection: DHS Should Take Actions to Measure Reduction in Chemical Facility Vulnerability and Share Information with First Responders
Released: 2018-08-08T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Facilities that produce, use, or store hazardous chemicals could be targeted or used by terrorists to inflict mass casualties, damage, and fear. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. DHS places high-risk facilities in risk-based tiers and is to conduct inspections after it approves their security plans. Under the CFATS Act of 2014, authorization for the CFATS program expires in January 2019.

GAO assessed the extent to which DHS has (1) enhanced the process for identifying high-risk facilities and assigning them to tiers, (2) conducted facility inspections and measured facility security, and (3) ensured that information is shared with emergency responders to prepare them for incidents at high-risk facilities. GAO reviewed DHS reports and data on compliance inspections and interviewed DHS officials. GAO also obtained non-generalizable information from 11 trade associations representing chemical facilities regarding DHS outreach and from 15 emergency planning committees about their awareness of CFATS and the chemicals it covers.

section_title: What GAO Found
paragraphs: Since 2013, the Department of Homeland Security (DHS) has strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program. Among other things, DHS implemented a quality assurance review process to verify the accuracy of facility self-reported information used to identify high-risk facilities. DHS also revised its risk assessment methodology—used to assess whether chemical facilities are high-risk and, if so, assign them to a risk-based tier—by incorporating changes to address prior GAO recommendations and most of the findings of a DHS-commissioned peer review. For example, the updated methodology incorporates revisions to the threat, vulnerability, and consequence scoring methods to better cover the full range of security issues regulated by CFATS. As of February 2018, a total of 29,195 facilities—including all 26,828 facilities previously assessed and 2,367 facilities new to the program—were assessed using DHS's revised methodology. DHS designated 3,500 of these facilities as high-risk and subject to further requirements.

DHS has also made substantial progress conducting and completing compliance inspections and has begun to take action to measure facility security but does not evaluate vulnerability reduction resulting from the CFATS compliance inspection process. In 2013, GAO found that the backlog of chemical facility security plans awaiting review affected DHS's ability to conduct compliance inspections, which are performed after security plans are approved. Since then DHS has made progress and increased the number of completed compliance inspections. As of May 2018, DHS had conducted 3,553 compliance inspections. DHS has also begun to update its performance measure for the CFATS program to evaluate security measures implemented both when a facility submits its initial security plan and again when DHS approves its final security plan. However, GAO found that DHS's new performance measure methodology does not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process. Doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the CFATS program as a whole.

DHS shares some CFATS information, but first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. Facilities are currently required to report some chemical inventory information, but GAO found that over 200 CFATS chemicals may not be covered by these requirements. To improve access to information, DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting. However, GAO found that the IP Gateway is not widely used at the local level. In addition, officials from 13 of the 15 Local Emergency Planning Committees—consisting of first responders and covering 373 CFATS high-risk facilities—told GAO they did not have access to CFATS data in the IP Gateway. By encouraging wider use of the IP Gateway, DHS would have greater assurance that first responders have information about high-risk facilities and the specific chemicals they possess.

section_title: What GAO Recommends
paragraphs: GAO recommends that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance; and (2) encourage access to and wider use of the IP Gateway among first responders and emergency planners. DHS concurred with both recommendations and outlined efforts underway or planned.

section_title: Letter
paragraphs: Thousands of facilities that produce, use, or store hazardous chemicals  could be targeted or used by terrorists to inflict mass casualties, damage,  and fear. These chemicals could be released from a facility to cause harm  to surrounding populations; they could be stolen and used as chemical  weapons or as their precursors (the ingredients for making chemical  weapons); or they could be stolen and used to build an improvised  explosive device. Past incidents demonstrate the danger these chemicals  pose, including the 2013 ammonium nitrate explosion at a fertilizer  storage and distribution facility in West, Texas, which killed 15 people and  caused major damage to or destroyed 193 homes, and more recent high- profile international incidents such as attacks using chlorine in Syria.

Pursuant to the Department of Homeland Security (DHS) Appropriations  Act, 2007, DHS established the Chemical Facility Anti-Terrorism  Standards (CFATS) program to, among other things, identify high-risk  chemical facilities and assess the risk posed by each; place facilities  identified as high-risk into one of four risk-based tiers; and assess,  approve, and inspect facility security measures to ensure compliance with  regulatory requirements. The Protecting and Securing Chemical  Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014),  enacted in December 2014, in effect, reauthorized the CFATS program  for an additional 4 years while also imposing additional implementation  requirements on DHS for the program. DHS’s National Protection and  Programs Directorate’s Infrastructure Security Compliance Division  (ISCD) is responsible for managing the CFATS program.

We previously reported on various aspects of the CFATS program and  identified challenges DHS was experiencing in implementing and  managing the program. We made a number of recommendations to  strengthen the program to include, among other things, that DHS verify  that certain data reported by facilities are accurate, enhance its risk  assessment approach to incorporate all elements of risk, conduct a peer  review of the program to validate and verify DHS’s risk assessment  approach, document processes and procedures for managing compliance  with site security plans, and update the performance measure for the  program. DHS agreed with our recommendations and has either fully  implemented them or taken action to begin addressing them.

Although there have been program improvements in recent years,  questions remain about the progress DHS has made implementing  changes to the program and the extent to which CFATS is ensuring that  the highest-risk chemical facilities are more secure as a result. Given that  the authorization for the CFATS program expires in January 2019, you  requested that we assess the progress DHS has made implementing and  managing the CFATS program—both within the context of our prior work  and with regard to other areas—to inform legislative efforts related to  reauthorization of the program. This report discusses the extent to which  the CFATS program has taken action to (1) enhance the process for  identifying high-risk chemical facilities and assigning them to risk-based  tiers, (2) conduct chemical facility inspections and implement an approach  to measure facility security, and (3) ensure that information is shared with  first responders and emergency planners to prepare them for incidents at  high-risk chemical facilities.

To address our first objective, we reviewed our prior work and analyzed  documentation and data describing ISCD’s efforts to assess, update, and  implement the program’s risk assessment methodology since we first  evaluated it in fiscal year 2013. Specifically, we analyzed ISCD  documents describing the web-based tools used to collect security  information from facilities, and policies and procedures for reviewing and  validating the accuracy of this information. We also reviewed relevant  technical reports, plans, and assessments—including the findings and  recommendations of an ISCD-commissioned peer review and DHS  actions taken in response—describing changes made to ISCD’s risk  assessment methodology. In addition, we obtained data describing the  status of ISCD’s efforts to reassess chemical facilities identified as high- risk and assign them a risk-based tier using the revised risk assessment  methodology. We assessed the reliability of ISCD data by reviewing  relevant documentation and interviewing knowledgeable officials about  system controls. We concluded that these data were sufficiently reliable  for the purposes of this report. We also interviewed ISCD officials to  confirm our understanding of the documents and data provided, and  actions ISCD has taken to enhance the process for identifying high-risk  chemical facilities and assigning them risk-based tiers.

To address our second objective, we focused on actions DHS has taken  to ensure compliance with the CFATS regulation since we first examined  this area in 2015. We reviewed laws and regulations applicable to how  DHS is to ensure compliance with the CFATS regulation and analyzed  ISCD documents and data on the implementation status of the program’s  compliance inspection process. To examine the program’s compliance  inspection process, we analyzed procedures and guidance—such as  ISCD’s Standard Operating Procedure and Inspection Handbook for  CFATS facility inspections, compliance inspection training documents,  and CFATS Risk-Based Performance Standards Guidance. We also  obtained data on the numbers of completed compliance inspections per  year and the extent to which these inspections resulted in a corrective  action. We assessed the reliability of ISCD compliance inspection data by  reviewing relevant documentation and interviewing knowledgeable  officials and concluded that these data were sufficiently reliable for the  purposes of this report. We also interviewed ISCD officials to confirm our  understanding of the changes made to the inspection process since fiscal  year 2015. In addition, we conducted two site visits to observe scheduled  compliance inspections at facility locations in Delaware and Maryland.  While information obtained from these inspections cannot be generalized  to all inspections, it provides insight and context on how ISCD officials  implement compliance inspection procedures and guidance. Lastly, we  contacted officials representing 15 trade associations with members that  include a wide range of CFATS-regulated chemical facilities and who  participated in the Chemical Sector Coordinating Council. For the 11  trade associations that responded, we conducted semistructured  interviews to obtain their perspectives on DHS’s actions to communicate  lessons learned to CFATS facilities on methods to reduce risk and the  compliance inspection process. The information obtained from these 11  trade associations is not generalizable to the universe of chemical  facilities covered by CFATS; however, it does provide insights into DHS’s  efforts to perform outreach and seek feedback on implementation of the  CFATS program.

To determine actions taken to measure chemical facility security, we  reviewed the CFATS regulation and analyzed ISCD reports and  information describing efforts to update the performance measure for the  CFATS program since we first evaluated it in fiscal year 2015. We  interviewed ISCD officials to confirm our understanding of the changes  made to revise the methodology of the performance measure and  compared this new approach with criteria in the National Infrastructure  Protection Plan (NIPP) for evaluating the effectiveness of risk  management efforts by, among other things, collecting performance data  to assess progress in achieving identified outputs and outcomes.

To address our third objective, we reviewed laws, regulations, and other  authorities applicable to how and to what extent DHS is to share CFATS  data with first responders and emergency planners. We reviewed DHS  documentation and interviewed officials to confirm our understanding of  the types of information, methods used, and extent to which the program  shares CFATS-specific information with first responders and emergency  planners and compared DHS’s approach with criteria in the NIPP on how  agencies should share actionable and relevant information across the  critical infrastructure community to build awareness and enable risk- informed decision making. To determine what information first responders  and emergency planners may use to prepare for and respond to  emergencies at chemical facilities and the extent to which they are aware  of CFATS facilities in their jurisdictions, we conducted semistructured  interviews with officials representing a nonrandom sample of 15 Local  Emergency Planning Committees (LEPCs). We selected our sample of  LEPCs—whose jurisdictions include 373 high-risk chemical facilities  regulated by the CFATS program—to represent a range in the geographic  location and numbers of CFATS facilities covered by each. The  information obtained from these interviews is not generalizable nor  reflects the opinions of all first responders and emergency planners; however, it does provide insights into common themes and illustrative  examples across our sample on the topics and issues discussed.

We also analyzed the list of chemicals, quantities, and concentrations  regulated by the CFATS program and the chemical inventory reporting  requirements outlined in the Emergency Planning and Community Right- to-Know Act of 1986 (EPCRA) to determine the extent to which there may  be differences in the chemicals covered and reported by facilities subject  to CFATS and EPCRA requirements. Using the results of this analysis,  we selected a generalizable random sample of 347 high-risk CFATS  facilities and analyzed ISCD data on their chemical holdings to determine  the extent to which there may be differences in the chemicals and  quantities covered by CFATS and EPCRA and what facilities may be  required to report. We assessed the reliability of ISCD data by reviewing  relevant documentation and interviewing knowledgeable officials and  concluded that these data were sufficiently reliable for the purposes of  this report.

We conducted this performance audit from July 2017 to August 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DHS’s National Protection and Programs Directorate leads the country’s  effort to protect and enhance the resilience of the nation’s physical and  cyber infrastructure. The directorate includes the Office of Infrastructure  Protection, which leads the coordinated national effort to reduce risk to  U.S. critical infrastructure posed by acts of terrorism. Within the Office of  Infrastructure Protection, ISCD leads the nation’s effort to secure high-risk  chemical facilities and prevent the use of certain chemicals in a terrorist  act on the homeland; ISCD also is responsible for implementing and  managing the CFATS program.

The CFATS program is intended to ensure the security of the nation’s  chemical infrastructure by identifying high-risk chemical facilities,  assessing the risk posed by them, and requiring the implementation of  measures to protect them. Section 550 of the DHS Appropriations Act,  2007, required DHS to issue regulations establishing risk-based  performance standards for chemical facilities that, as determined by DHS,  present high levels of risk, to include vulnerability assessments and the  development and implementation of site security plans for such  facilities. DHS published the CFATS interim final rule in April 2007 and  Appendix A to the rule, published in November 2007, lists 322 chemicals  of interest and the screening threshold quantities for each. According to  DHS, subject to certain statutory exclusions, all facilities that  manufacture, store, ship, or otherwise use chemicals of interest above  certain threshold quantities and concentrations are subject to CFATS  reporting requirements. However, only those facilities subsequently  determined to present a high level of security risk are subject to the more  substantive requirements of the CFATS regulation as described below.
subsections: section_title: The CFATS Regulation and Process
paragraphs: The CFATS regulation outlines a specific process for how ISCD is to  administer the CFATS program. A chemical facility that possesses any of  322 chemicals of interest in quantities that meet or exceed a threshold  quantity and concentration is required to complete what is called a Top- Screen survey using ISCD’s Chemical Security Assessment Tool (CSAT)  system. CSAT is a web-based application through which owners and  operators of chemical facilities provide self-reported information about the  facility. The Top-Screen is an on-line survey whereby the facility is to  provide DHS various data, including the name and location of the facility  and the chemicals, quantities, and storage conditions at the site.

ISCD uses a risk-based approach to evaluate chemical facilities of  interest that are required to report under CFATS and determine whether  these facilities are high-risk and therefore subject to further requirements  under the regulation. More specifically, ISCD’s risk assessment  methodology calculates risk scores—based on facility-supplied  information in the Top-Screen survey, among other sources, and taking  into account vulnerability, potential consequences, and threat of a terrorist  attack—and uses these scores to determine which facilities are high-risk.  Those facilities deemed high-risk are then placed into one of four risk- based tiers (Tier 1 through Tier 4). Tier 1 represents the highest risk. A  facility not designated as high-risk is not subject to additional  requirements under the CFATS regulation.

If ISCD determines that a facility is high-risk (Tier 1–4), the facility must  then complete and submit to ISCD a Security Vulnerability Assessment  and one of two types of security plans—a Site Security Plan or an  Alternative Security Program—which describes the existing and planned  security measures to be implemented in order to be in compliance with the applicable risk-based performance standards. Facilities determined  to be Tier 3 or 4 also have an option to submit an expedited security plan  under the CFATS Expedited Approval Program. To meet risk-based  performance standards, covered facilities may choose the security  programs or processes they deem appropriate so long as ISCD  determines that the facilities achieve the requisite level of performance on  each of the applicable areas in their existing and agreed-upon planned  measures. Prior to approving a facility’s security plan, ISCD inspectors  conduct an authorization inspection at the facility to verify and validate  that the content listed in their plan is accurate and complete; that existing  and planned equipment, processes, and procedures are appropriate and  sufficient to meet the established requirements of the risk-based  performance standards; and to assist the facility in resolving any potential  gaps identified. After the facility’s security plan is approved, the facility  enters into the CFATS compliance cycle, which includes regular and  recurring compliance inspections.

ISCD inspectors conduct compliance inspections to ensure the existing  and planned security measures identified in a facility’s approved security  plan continue to be implemented fully; the equipment, processes, and  procedures described in the security plan are appropriate and sufficient to  meet the established performance standards; and the required corrective  actions have been implemented and are sustainable. This compliance  inspection includes a verification of other data provided to ISCD, including  the Top-Screen. If, through a compliance inspection, ISCD determines a  facility has not fully implemented security measures as outlined in its  approved security plan, ISCD is to provide the facility with written  notification that clearly identifies the deficiencies in the plan and will work  with the facility toward achieving full compliance or, if warranted, take  enforcement action. Figure 1 illustrates the CFATS regulatory process.

section_title: ISCD Has Strengthened Its Processes for Identifying High-Risk Chemical Facilities
subsections: section_title: ISCD Implemented Processes to Verify Self- Reported Information from Chemical Facilities
paragraphs: In response to our prior recommendations, ISCD has taken action to  strengthen its processes for verifying the accuracy of data it uses to  identify high-risk chemical facilities. In July 2015, we found that ISCD  used self-reported and unverified data to determine the risk categorization  for facilities that held toxic chemicals that could threaten surrounding  communities if released. At the time, ISCD required that facilities self- report the Distance of Concern—an area in which exposure to a toxic  chemical cloud could cause serious injury or fatalities from short-term  exposure—as part of its Top-Screen methodology. In our report, we  estimated that more than 2,700 facilities with a toxic release threat  misreported the Distance of Concern and recommended that ISCD (1)  develop a plan to implement a new Top-Screen to address errors in the  Distance of Concern submitted by facilities, and (2) identify potentially  miscategorized facilities that could cause the greatest harm and verify  that the Distance of Concern these facilities reported is accurate.

ISCD has addressed both of these recommendations. In response to the  first recommendation, ISCD implemented an updated Top-Screen survey  in October 2016 and now collects data from facilities and conducts more  accurate modeling to determine the actual area of impact (formerly called  the Distance of Concern), rather than relying on the facilities’ calculation.  In response to the second recommendation, ISCD officials reported in  November 2016 that they reassessed all facility Top-Screens that  reported threshold quantities of chemicals posing a toxic release threat,  and identified 158 facilities with the potential to cause the greatest harm.  In April 2018, ISCD officials reported that all of these facilities have since  been reassessed using updated Top-Screen information and, where  appropriate, assigned a risk tier.

In addition, in October 2016, ISCD implemented a quality assurance  review process whereby ISCD officials manually check and verify the  accuracy of facility self-reported Top-Screen information used in  identifying potential high-risk facilities. The objective of ISCD’s review  process is to evaluate the information provided by a chemical facility in  order to recommend approval or rejection of a submitted Top-Screen for  accuracy prior to issuing a letter notifying the facility of its risk tier  designation. According to ISCD, all Top-Screens undergo a quality  assurance review with two exceptions: (1) a facility that registers through  CSAT for the first time and submits a Top-Screen identifying zero  chemicals of interest on site and which does not identify an exclusion; or  (2) a facility that possessed a chemical of interest in the past but  subsequently submits a follow-up Top-Screen for redetermination  identifying they no longer possess the chemical of interest and after ISCD  validates the removal of the chemical of interest. When a Top-Screen  submission is rejected, ISCD sends a letter notifying the facility of the  rejection and requesting that a revised Top-Screen be submitted. In  addition, according to ISCD, they contact facilities prior to a Top-Screen  rejection to ensure the facility understands the required updates and to discuss the potential reporting error. As of February 2018, a total of 1,956  Top-Screen submissions (across 1,799 unique facilities) were rejected as  part of this quality assurance review process since implementing the  updated Top-Screen survey in October 2016, according to ISCD data.  According to ISCD, the majority of these Top-Screens were rejected due  to common reporting errors, such as misreporting the flammability hazard  rating for a chemical of interest subject to a release security issue or not  reporting transportation packaging when a chemical of interest is  identified as being subject to a theft or diversion security issue.

section_title: ISCD Has Nearly Completed Applying Its Revised Risk Assessment Methodology for Designating High-Risk Chemical Facilities
paragraphs: ISCD Revised Its Risk Assessment Methodology to More Accurately  Identify and Assign Tiers to High-Risk Chemical Facilities  Since we last evaluated it in 2013, ISCD took action to enhance the  CFATS program’s risk assessment methodology—used to determine  whether covered chemical facilities are high-risk and, if so, assign them a  risk-based tier—by incorporating changes to address prior GAO  recommendations, as well as the findings of an ISCD-commissioned peer  review conducted in 2013, among other efforts. In April 2013, we found  that DHS’s risk assessment approach did not consider all of the elements  of threat, vulnerability, and consequence associated with a terrorist attack  involving certain chemicals. Our work showed that DHS’s CFATS risk  assessment methodology was based primarily on consequences from  human casualties, but did not consider economic consequences, as  called for by the NIPP and the CFATS regulation. We also found that  DHS’s approach was not consistent with the NIPP because it treated  every facility as equally vulnerable to a terrorist attack regardless of  location or on-site security. In addition, DHS was not using threat data for  90 percent of the tiered facilities—those tiered for the risk of theft or  diversion—and using 5-year-old threat data for the remaining 10 percent  of those facilities that were tiered for the risks of release or sabotage.  We recommended that ISCD (1) review and improve its risk assessment  approach to fully address each of the elements of threat, vulnerability,  and consequence, and (2) conduct an independent peer review after  enhancements to the risk assessment approach were complete.

Partly in response to our findings and recommendations, from 2013  through 2016, ISCD conducted a multiyear effort to review and improve  the CFATS program’s risk assessment approach and tiering methodology  with the primary goal of improving the identification and appropriate  tiering of high-risk chemical facilities. Among these efforts was an ISCD- commissioned peer review of the CFATS tiering methodology conducted  in 2013 by the Homeland Security Studies and Analysis Institute  (HSSAI). HSSAI’s final report summarized the findings of the peer  review and included a list of 44 recommendations for ISCD to implement  in its efforts to improve and revise the CFATS risk assessment and tiering  methodology. ISCD undertook a risk assessment improvement project  to implement most of the recommendations described in the 2013 HSSAI  final report; these efforts included, for example, convening advisory board  meetings with experts drawn from across industry, academia, and  government to review and make additional recommendations on the  proposed improvements to the CFATS risk assessment methodology and  associated tools and processes.

The result of these efforts is an updated, “second generation” risk  assessment approach and tiering methodology that addresses both of our  prior recommendations and almost all of the recommendations described  in the 2013 HSSAI final report. Specifically, with regard to our  recommendation that DHS enhance its risk assessment approach to  incorporate all elements of risk, ISCD worked with Sandia National  Laboratories to develop and evaluate a model to estimate the economic  consequences of a chemical attack. In addition, among other  enhancements, the updated risk assessment methodology incorporates  revisions to the threat, vulnerability, and consequence scoring methods to  better cover the full range of chemical security issues regulated by the  CFATS program. Additionally, with regard to our recommendation that  DHS conduct a peer review after enhancing its risk assessment  approach, DHS conducted peer reviews and technical reviews with  government organizations and facility owners and operators, and worked  with Sandia National Laboratories to verify and validate the CFATS  program’s revised risk assessment methodology which was completed in  January 2017. In addition, as of May 2018, ISCD has considered,  implemented, or is in the process of implementing updates that address  39 of the 44 recommendations in the HSSAI peer review of the original  CFATS risk assessment methodology. According to ISCD, DHS must  undertake a rulemaking to update the CFATS regulation and to obtain  public comment on any proposed changes to implement the remaining  recommendations. These relate to possible changes in how or to what  extent the CFATS program regulates the treatment of certain chemicals  of interest, chemical weapons and their precursors, and other fuels or fuel  mixtures.

Implementation of the Revised Risk Assessment Methodology Is  Nearly Complete  Beginning in October 2016, ISCD notified chemical facilities that were not  new to the CFATS program—that is, all facilities that had previously  submitted a Top-Screen and had reported chemicals of interest above the  threshold quantity and concentration on their most recent Top-Screen—to  submit a revised Top-Screen in CSAT 2.0 so that they may be re- assessed using ISCD’s revised risk assessment methodology. As of  February 2018, a total of 29,195 chemical facilities were assessed using  ISCD’s revised risk assessment methodology, with 3,500 (or 12 percent)  of these facilities designated as high-risk (i.e., assigned to tiers 1 through  4). The total of 29,195 chemical facilities includes 26,828 facilities that  were previously assessed using the original risk assessment  methodology and an additional 2,367 facilities new to the CFATS  program, as shown in figure 2.

Of the 3,500 tiered facilities, 265 were new to the CFATS program; 889  were not new to the program, but were previously not tiered and were  reassessed as high-risk and assigned a tier; and 1,345 were previously  tiered but were reassigned to a different tier. Also, 430 facilities that were  previously tiered were no longer tiered. As of May 2018, ISCD had  pending risk assessments for an additional 241 chemical facilities that  were not new to the CFATS program but were not previously tiered. ISCD  officials did not provide an estimated target completion date for these  pending risk assessments, noting that completing the assessments is  highly dependent on the facilities providing the necessary Top-Screen  information.

According to ISCD, there are four main drivers of the changes in facility  tiering that resulted from implementing the second-generation risk  assessment methodology:  facilities placed in a lower tier due to implementation of revised  consequence scoring methods that more accurately account for the  impact of quantities of the chemicals subject to theft/diversion security  issues;  facilities placed in a higher or lower tier for chemicals of interest due  to improvements to the distribution of population in consequence  modeling for chemicals subject to release-toxic and release- flammable security issues;  increases in the number of facilities tiered for select chemical weapon  precursors due to the implementation of revised consequence scoring  methods that more accurately account for the impact of certain  chemicals of interest; and  changes in tiering due to newly reported increases, decreases, and  modifications of chemical holdings.

section_title: ISCD Has Made Progress Conducting Compliance Inspections but Does Not Measure Reduction in Facility Vulnerability ISCD Has Increased the Number of Completed Compliance Inspections and Issued Two Corrective Actions for Noncompliance with Security Plans
paragraphs: Since 2013, ISCD has reduced its backlog of unapproved site security  plans and increased the number of conducted compliance inspections. As  discussed earlier, in order to approve a facility’s site security plan, ISCD  inspectors conduct an authorization inspection at the facility to verify and  validate that the content listed in their plan is accurate and complete; that  existing and planned equipment, processes, and procedures are  appropriate and sufficient to meet the established requirements of the  risk-based performance standards; and to assist the facility in resolving  any potential gaps identified. After the facility’s security plan is approved,  the facility enters into the CFATS compliance cycle and is subject to a  compliance inspection. In 2013, we calculated that it could take from 7 to  9 years to review and approve the approximately 3,120 site security plans  submitted by facilities that had been designated as high-risk but that  ISCD had not yet begun to review. In 2015, we found that ISCD had  made improvements to its processes for reviewing and approving site  security plans and substantially reduced the time needed to approve  remaining site plans to between 9 and 12 months.

Our analysis of ISCD data since our 2015 report showed that ISCD has  made substantial progress conducting and completing compliance  inspections. Specifically, our analysis showed that ISCD has increased  the number of compliance inspections completed per year since ISCD  began conducting compliance inspections in 2013. For the 2,466 high-risk  facilities with an approved site security plan as of May 2018, ISCD had  conducted 3,553 compliance inspections. Table 1 shows the number of  conducted compliance inspections from fiscal year 2014 to May 2018.

ISCD officials project they will conduct fewer compliance inspections in  fiscal year 2018 than in fiscal year 2017 due to two reasons. First, ISCD  officials stated the program made progress resolving the backlog of  facilities that required compliance inspections in fiscal years 2016 and  2017 when it conducted over 2,600 compliance inspections. Second,  ISCD officials stated that the program’s revised risk assessment  approach and continued outreach efforts have resulted in an increase in  the number of identified facilities with chemicals of interest. As a result,  ISCD officials stated they project an increased number of authorization  inspections and fewer compliance inspections in fiscal year 2018 and  2019 as new facilities enter the program.

ISCD increased the number of compliance inspections conducted from  fiscal years 2014 to 2017 and less than 1 percent of compliance  inspections during this period resulted in a determination that a facility was not in compliance. During a compliance inspection, if an inspector  finds that a facility is noncompliant with its security plan, the CFATS  regulation authorizes ISCD to take enforcement action, such as issuing  an order for corrective action to the facility. Of the 3,553 compliance  inspections ISCD conducted between fiscal year 2014 and May 2018,  ISCD issued two corrective actions—both to Tier 4 facilities—because  these facilities were not in compliance with their approved site security  plan.

Specifically, during the compliance inspection of one facility, which was  determined to be high-risk based on both the release and theft/diversion  security issues, ISCD found that the facility’s site security plan did not  identify several existing or planned measures to secure the facility’s  chemicals of interest. For example, the facility’s site security plan did not  identify measures to monitor restricted areas or potentially critical targets  within the facility against a theft or release attack. In addition, while the  facility’s site security plan identified a chain link fence and an alarm on a  gate to a secure cage that houses the chemicals of interest, ISCD  inspectors found no evidence of either. During the compliance inspection  of the second facility, which was determined to be high-risk based on the  theft and diversion security issue, ISCD inspectors were unable to verify if  the facility’s intrusion detection system was properly functioning and that  an individual not employed by the facility may have had access to the  facility’s chemicals of interest without a proper background check. Both of  these facilities took actions to implement the measures identified in their  site security plan and were later found to be in compliance with their site  security plans. ISCD officials attribute the low number of corrective  actions the program has issued to the program’s collaborative approach  of working with facilities to ensure compliance. For example, of the two  facilities ISCD found to be in noncompliance, ISCD conducted a  compliance assistance visit with both facilities to provide assistance. In  addition to compliance assistance visits, ISCD officials stated that the  program has other collaborative tools, such as the CFATS Help Desk, to  help ensure facility compliance.

section_title: ISCD Continues to Implement Changes to Compliance Inspections and Improve Efficiency
paragraphs: ISCD continues to implement changes that are intended to enhance  compliance inspections. For example, ISCD officials stated the program  continues to conduct preinspection phone calls with facilities to help them  prepare for compliance inspections. In addition, ISCD officials stated they  developed and provided supplemental guidance in fiscal year 2017 on  steps ISCD inspectors need to take during a compliance inspection.  ISCD’s supplemental guidance includes, among other things, best  practices and lessons learned for conducting inspections and reporting  items identified by the inspections. ISCD officials stated they plan to  incorporate this supplemental guidance into their compliance inspection  standard operating procedures in the third quarter of fiscal year 2018 and  to update their compliance inspection handbook in the fourth quarter of  2018.

In addition to updating its guidance for inspectors, ISCD has taken steps  to improve the efficiency of compliance inspections. For example, ISCD  continues its outreach efforts to chemical facilities on the inspection  process. As part of these efforts, ISCD published guidance for facilities on  steps to take to prepare for the compliance inspection, including  information on the appropriate personnel and documentation that should  be made available during the inspection. Finally, ISCD increased the  number of compliance assistance visits with facilities to better prepare  them for inspections. Representatives from 9 of the 11 industry  associations we spoke with told us that ISCD’s communication with  facilities had improved the efficiency of compliance inspections and  increased the ability of facilities to comply with the risk-based  performance standards.

We accompanied inspectors on two separate compliance inspections to  observe how the inspections were carried out and how inspectors used  the risk-based performance standards to determine compliance. For  example, during the compliance inspection of a facility identified as high- risk based on the theft and diversion security issue, we observed facility  personnel and ISCD inspectors discussing the preinspection phone call  ISCD had conducted to assist the facility in preparation for their  compliance inspection. This discussion included confirmation that the  facility communicated with the local fire and police departments and had  requested their presence at the inspection. In addition, we observed the  inspectors analyzing the facility’s emergency response plan to determine  whether the facility’s plans were consistent with the applicable risk-based  performance standards. We also observed the inspectors subsequently  interviewing local fire and police department officials that were present  during the inspection to validate statements made by the facility and to  confirm that both entities received the facility’s emergency plan. We  accompanied the inspectors and facility personnel on a tour of the facility  where inspectors observed existing measures the facility used to protect  the chemicals of interest, including the facility’s fencing barrier. We also  observed inspectors testing security measures, including the facility’s  access controls put in place to prevent unauthorized personnel gaining  access to the chemicals of interest.

At the other compliance inspection we observed, the facility personnel  and ISCD inspectors confirmed a preinspection phone call to prepare the  facility for the inspection. This phone call included a discussion of the  appropriate training records and contract documentation that inspectors  needed to confirm compliance with the applicable risk-based performance  standard. During the inspection, we observed that the facility made this  documentation and the appropriate personnel available to answer ISCD  inspector questions on the security training the facility held during the  prior year. We also observed inspectors verifying that existing measures,  such as the facility’s fence barrier, were still present and not  compromised with breaches. In addition, we observed the inspectors  testing key cards to the building that housed the chemicals of interest to  ensure the cards prevented unauthorized access. Finally, we observed  inspectors requesting a demonstration of how the facility’s chemicals of  interest are delivered to the facility and what controls were in place to  monitor third-party contractors during delivery of chemicals of interest.

We also discussed the compliance inspection process with  representatives from trade associations that represent facilities covered  by CFATS and considered high-risk. Representatives from 7 of the 11  trade associations that we spoke with stated that ISCD’s implemented  changes have improved the compliance inspection process since the  program’s inception. Specifically, representatives from three trade  associations stated that ISCD inspectors’ efforts to increase  communication with facilities, including preinspection phone calls and  compliance assistance visits, have increased the ability of facilities to  ensure they are compliant with their approved site security plan.  However, representatives from 3 of the 11 trade associations we spoke  with also noted some issues with the compliance inspection process.  Specifically, officials from these 3 associations stated that ISCD  inspectors inconsistently apply the risk-based performance standards  relative to the measures the facilities implemented. Some of this  inconsistency may be due, in part, to the flexibility inherent in the risk- based performance standards which give facilities the discretion or  latitude to tailor security based on conditions and circumstances. For  example, the amount and type of chemicals of interest may vary by  facility, so some facilities may require additional security measures be put  in place to ensure protection of these chemicals. In addition, facilities vary  by geographic location, which may affect the measures the facility needs  to implement to protect the chemicals of interest from potential theft or  diversion.

DHS officials stated that they believe any perceived inconsistency is due  to the flexibility in application of the risk-based performance standards  and the variety of facility conditions that contribute to the appropriateness  of different security measures. Officials explained that, for example,  inspectors would likely recommend that a large campus-type facility not  invest in a perimeter fence line but instead utilize asset-based barriers to  satisfy the performance standards. Officials noted that facilities can  choose to employ security measures which best fit their specific situation  and can request that inspectors provide multiple options for their  consideration.

section_title: DHS’s Methodology for Measuring Changes in Facility Site Security Does Not Reflect Reduction in Vulnerability
paragraphs: ISCD developed its performance measure methodology for the CFATS  program in order to evaluate security changes made by high-risk  chemical facilities, but the methodology does not measure the program’s  impact on reducing a facility’s vulnerability to an attack. In 2015 we found  that while ISCD’s performance measure for the CFATS program was  intended to reflect security measures implemented by facilities and the  overall impact of the CFATS regulation on facility security, the metric did  not solely capture security measures that are implemented by facilities  and verified by ISCD. We recommended that DHS develop a  performance measure that includes only planned security measures that  have been implemented and verified. In response to our finding and  recommendation, ISCD’s performance measure requires that ISCD  officials verify that planned measures have been implemented in  accordance with the approved site security plan (or alternative security  program) by compliance inspection or other means before inclusion in the  performance measure calculation.

ISCD has since decided to develop a new methodology and performance  measure for the CFATS program. In 2016, ISCD began development of  an approach called the guidepost-based site security plan scoring  methodology. ISCD officials stated they plan to use the methodology to  evaluate the security measures a facility implemented from initial state— when a facility submits its initial site security plan—to the facility’s  approved security plan, according to ISCD officials. Officials stated that  once implemented, the methodology’s resulting performance measure will  be maintained internally and, if approved, may be used to satisfy the  program’s reporting requirements consistent with the Government  Performance and Results Act (GPRA) and included in DHS’s Annual  Performance Report.

The methodology organizes a facility’s security measures based on five  guideposts. Using the five guideposts as a framework, the security  measures a facility reports in its site security plan are evaluated by ISCD  under the applicable guidepost to determine the level of security  performance. For example, the plan contains a question on whether a  facility has a perimeter fence barrier and if so, what type, such as a chain  link fence, metal fence, or vinyl fence. ISCD uses the facility’s responses  to assign a numerical value that indicates the level of security  performance for the type of fence a facility uses as a perimeter barrier.  The scores of the five guideposts are then aggregated and the resulting  score represents the site security plan score for a facility. Officials stated  that a facility’s site security plan score is developed when the facility  submits its initial site security plan and again when ISCD approves its site  security plan and the facility has completed the CFATS inspection  process.

ISCD officials stated the purpose of the methodology is to measure the  increase in security attributed to the CFATS program and stated that the  methodology is not intended to measure risk reduction. As a result, the  methodology and resulting performance metric do not reflect the  program’s impact on reducing a facility’s vulnerability to an attack. While  ISCD officials stated the program is exploring how to use the site security  plan scores of a facility, this methodological approach may provide ISCD  an opportunity to begin assessing how vulnerability is reduced and, by  extension, risk is lowered, not only for individual facilities but for the  program as a whole. The NIPP calls for evaluating the effectiveness of  risk management efforts by collecting performance data to assess  progress in achieving identified outputs and outcomes. The purpose of  the CFATS program is to ensure facilities have security measures in  place to reduce the risks associated with certain hazardous chemicals  and to prevent these chemicals from being exploited in a terrorist attack.  A measure that reflects risk reduction may include how the CFATS  inspection process measures the reduction of one element of risk— vulnerability—of high-risk facilities to a terrorist attack. ISCD officials  stated that challenges exist with incorporating vulnerability into the  measure’s methodology, such as how to accurately measure a facility’s  vulnerability to an attack before the facility started the CFATS inspection  process.

We recognize challenges ISCD might face in incorporating vulnerability  into its scoring methodology. In our prior work, we acknowledged that  assessing the benefits of a program—such as reducing a high-risk  facility’s vulnerability to an attack—is inherently challenging because it is  often difficult to isolate the impact of an individual program on behavior  that may be affected by multiple other factors. However, ISCD could  take steps to evaluate vulnerability reduction resulting from the CFATS  compliance inspection process. For example, because facilities conduct  their own vulnerability assessments when developing their site security  plan for submission to ISCD, ISCD could establish a vulnerability baseline  score when it evaluates a facility’s security measures during its initial  review of the facility’s plan. ISCD could then use this baseline score as  the starting point for assessing any reduction in vulnerability that ISCD  can document that has occurred as a result of security measures  implemented by the facility during the compliance inspection process.  As the CFATS program continues to mature and ISCD begins its efforts  to assign scores to facility site security plans, incorporating assessments  of reductions in vulnerability at individual facilities and across the  spectrum of CFATS facilities as a whole would enable ISCD to better  measure the impact of the CFATS compliance inspection process on  reducing risk and increasing security nationwide.

section_title: First Responders and Emergency Planners May Not Have Information Needed to Respond to Incidents at High-Risk Chemical Facilities
paragraphs: We found over 200 chemicals covered by CFATS that may not be  included in the chemical inventory information that officials told us they  rely on to prepare for and respond to incidents at chemical facilities. ISCD  shares some CFATS information with state and local officials, including  access to CFATS facility-specific data via a secure portal; however, this  portal is not widely used at the local level by first responders and  emergency planners.
subsections: section_title: First Responders and Emergency Planners May Not Have Sufficient Information to Prepare for and Respond to Incidents at High-Risk Chemical Facilities
paragraphs: First responders and emergency planners may not have the necessary  information to prepare for and respond to incidents at high-risk chemical  facilities regulated by the CFATS program. As mentioned earlier, on April  17, 2013, about 30 tons of ammonium nitrate fertilizer—containing a  CFATS chemical of interest—detonated during a fire at a fertilizer storage  and distribution facility in West, Texas killing 15 people, including 12 first  responders, and injuring more than 260 others. This event, among others,  prompted the President to issue Executive Order 13650 to improve  chemical facility safety and security in coordination with owners and  operators. The Executive Order established a Chemical Facility Safety  and Security Working Group and included directives for the working group  to, among other things, improve operational coordination with state, local,  and tribal partners. The working group created a federal plan of action  consisting of actions to improve the safety and security of chemical  facilities.

One key element of this plan focused on the Emergency Planning and  Community Right-to-Know Act of 1986 (EPCRA), which was intended to  encourage and support emergency planning efforts at the state and local  levels. In accordance with EPCRA, state and local entities, such as  Local Emergency Planning Committees (LEPCs)—consisting of  representatives including local officials and planners, facility owners and  operators, first responders, and health and hospital personnel, among  others—were created. These LEPCs were designed to (1) prepare for  and mitigate the effects of a chemical incident and (2) ensure that  information on chemical risks in the community is provided to first  responders and the public. The working group acknowledged there was a  need to share data with representatives of these state and local entities to  enable them to identify gaps and inconsistencies in their existing  information that could reveal previously unknown risks in their  communities. For facilities subject to EPCRA requirements, this data is to  include, among other things, information about chemicals stored or used  at the facility for which facilities are required to submit an emergency and  hazardous chemical inventory form to these state and local entities. The  working group’s federal plan also included a DHS commitment to share  certain CFATS data elements with first responders, state agencies and  LEPCs to help communities identify and prioritize risks and develop a  contingency plan to address those risks while acknowledging that access  to certain sensitive portions of CFATS data will remain restricted to  officials with a “need-to-know” so as to appropriately balance security  risks.

In our interviews with 15 LEPCs—whose jurisdictions include 373 high- risk chemical facilities regulated by the CFATS program—we found that  officials rely on information reported on EPCRA chemical inventory forms  to prepare for and respond to incidents at CFATS facilities. These  officials may not have sufficient information to respond to emergencies at  CFATS facilities because EPCRA reporting requirements may not cover  some of the chemicals covered under the CFATS program. Specifically,  we analyzed the chemicals covered by both CFATS and EPCRA’s  reporting requirements and found there are over 200 CFATS chemicals of  interest that, depending upon state reporting guidelines, may not be  covered by EPCRA reporting requirements. Several of these chemicals  may require specific response techniques to minimize the risk of injury or  death to first responders and the surrounding community. For example, in  the event of fire, aluminum powder, a chemical not subject to EPCRA  reporting requirements but regulated under CFATS, produces flammable  gases when in contact with water and requires responders to instead use  a dry chemical or sand to extinguish the fire. Based on our analysis of  tiered CFATS facilities, we estimate that about 32 percent of these high- risk facilities possess at least one chemical that may not be covered by  EPCRA reporting requirements.

In addition, we found these LEPCs may lack information on the CFATS  facilities in their jurisdictions. Specifically, officials representing 11 of the  15 LEPCS we interviewed said they were not aware of which facilities in  their jurisdiction were regulated by the CFATS program. Of these 11  LEPCs, officials from 8 LEPCs stated it would be very helpful or critical to  know this information and officials from 2 LEPCs stated it would be  somewhat helpful. According to these officials, this information would  assist LEPCs, some of which have hundreds of facilities in their  jurisdiction, to prioritize the most significant facilities for additional  planning or scheduling of drills and exercises. Additionally, officials  representing 5 LEPCs stated they were not aware of the differences  between CFATS chemicals of interest and those chemicals subject to  EPCRA reporting requirements. These LEPC officials stated that, among  other things, it is critical to have a comprehensive understanding of all  chemicals at a facility and that this information is very important for  emergency responders to be aware of when responding to an incident.

section_title: ISCD Could Take Additional Action to Share Information about High- Risk Facilities with First Responders and Emergency Planners
paragraphs: Consistent with the CFATS Act of 2014, ISCD is to play a role in ensuring  that first responders and emergency planners are properly prepared for  and provided with the situational awareness needed to respond to  security incidents at high-risk chemical facilities. While the CFATS Act  of 2014 does not specifically require that information be shared directly  with first responders, ISCD has taken steps to share CFATS information  with state and local officials to help ensure that first responders are  prepared to respond to such security incidents. These steps include,  among other things, ensuring that facilities are developing and exercising  an emergency plan to respond to security incidents internally and with  assistance of local law enforcement and first responders. Planning and  training are important to ensure that facility personnel, onsite security, law  enforcement, and first responders are ready to respond to external and  internal security incidents. Additionally, these planning activities and  relationships with first responders can assist in reducing the impact of  these incidents. According to ISCD officials, to verify compliance with this  requirement, ISCD inspectors validate facility outreach to first responders,  such as local law enforcement and fire departments, through review of  facility documentation, including emails with first responders, records of  drills, and logs of meetings and tours, or through direct contact with the  local first responders by the inspection team.

In addition, the Executive Order 13650 working group sought to, among  other things, strengthen community planning and preparedness and  ensure that first responders and emergency planners are aware of the  risks associated with hazardous chemicals in their communities. Included  was a goal to increase information-sharing with communities that are near  chemical facilities. In a May 2014 report, this working group identified  certain information, including the name and quantity of chemicals at a  facility, as the most helpful to first responders and emergency planners.  This information is intended to enable emergency planners to conduct an  analysis to identify gaps and inconsistencies in their existing information  that could reveal previously unknown risks in their communities.

ISCD has taken action to ensure first responders and emergency  planners have access to CFATS data. For example, in response to  Executive Order 13650, ISCD shares CFATS data through the  Infrastructure Protection (IP) Gateway. This online portal contains  critical infrastructure data and analytic tools, including data on covered  CFATS facilities, for use by federal officials, state, local, tribal, and  territorial officials, and emergency response personnel. CFATS data  available in the IP Gateway includes, among other things, facility name,  location, risk tier, and chemicals on-site and is accessible to authorized  federal and other state, local, tribal, and territorial officials and responders  with an established need-to-know. The IP Gateway provides these  officials and responders access to CFATS facility-specific information that  may be unreported on EPCRA chemical inventory forms. This CFATS  facility-specific information can help ensure these groups are properly  prepared to respond to incidents at high-risk chemical facilities in their  jurisdictions.

While the IP Gateway is a mechanism for sharing names and quantities  of chemicals at CFATS high-risk facilities with first responders and  emergency planners, we found it is not widely used by officials at the local  level. ISCD told us that in May 2018 they published three revised fact  sheets and included information on the IP Gateway in presentation  materials that officials told us was intended to increase promotion and  use of the IP Gateway. However, according to DHS, there are 14  accounts categorized at the local level whose access to the IP Gateway  layer includes the names and quantities of chemicals at CFATS facilities.  A local account indicates the individual with access is a county- or city- level employee or contractor. Additionally, while not generalizable to all  LEPCs, officials representing 7 of the 15 LEPCs we interviewed were not  aware of the IP Gateway and officials representing 13 of the 15 LEPCs  stated that they do not have access to CFATS information within the IP  Gateway. Of the 13 officials that reported they did not have access, 11  said that it would be helpful or critical to have access for several reasons.  Specifically, officials representing these LEPCs stated that this  information would assist them to better prepare and respond to incidents  and help emergency planners prioritize the most critical sites among the  thousands of facilities that they oversee.

According to DHS officials, their outreach plan, developed in March 2015,  specifically addresses regular engagement with LEPCs, among other  groups. However, these officials acknowledged that information may not  be reaching some state and local officials due to a number of factors,  including the large number of LEPCs and first responders across the  country, and changes in the level of LEPC activity and personnel over  time. While we recognize these challenges, providing first responders and  emergency planners access to CFATS facility-specific information,  including the name and quantity of chemicals at a facility, can help ensure  these groups are properly prepared to respond to incidents at high-risk  chemical facilities in their jurisdictions. The NIPP states that agencies  should share actionable and relevant information across the critical  infrastructure community—including first responders and emergency  planners—to build awareness and enable risk-informed decision making  as these stakeholders are crucial consumers of risk information.  Additionally, the 2015 Emergency Services Sector-Specific Plan, an  Annex to the 2013 NIPP, further calls for engaging with local emergency  planning organizations, such as LEPCs, to enhance information-sharing  and analytical capabilities for incident planning, management, and  mitigation between stakeholders. The IP Gateway is one way through  which ISCD can share CFATS facility-specific information, including the  name and quantity of chemicals at high-risk facilities with first responders  and emergency planners. As discussed earlier, although ISCD is not  required to share CFATS facility-specific information directly with first  responders, this information is critical to prepare for and respond to  incidents at high-risk chemical facilities and to protect them and their  communities from injury or death. By exploring ways to improve  information-sharing of CFATS facility-specific data, such as promoting  wider use of the IP Gateway among first responders and emergency  planners, DHS will have greater assurances that the emergency response  community has access to timely information about high-risk chemical  facilities.

section_title: Conclusions
paragraphs: DHS, through ISCD, has made improvements to the CFATS program.  ISCD has taken action to strengthen its processes for verifying the  accuracy of data it uses to identify high-risk chemical facilities, revised its  risk assessment methodology to more accurately identify and assign  high-risk chemical facilities to tiers, and has nearly completed its efforts to  apply this new methodology to facilities covered by CFATS. Furthermore,  ISCD has conducted an increased number of compliance inspections and  continues to make changes to improve the efficiency of the inspection  process. While ISCD has developed a new methodology and  performance measure for the CFATS program in order to evaluate  security changes made by high-risk chemical facilities, we found that the  methodology and metric do not reflect the program’s impact on reducing a  facility’s vulnerability to an attack. ISCD may have an opportunity to  explore how reductions in vulnerability at individual facilities resulting from  the CFATS compliance inspection process could be used to develop an  overall measure of the performance of the CFATS program in reducing  risk and increasing security nationwide. Such a measure would be  consistent with the NIPP, which calls for evaluating the effectiveness of  risk management efforts by collecting performance data to assess  progress in achieving identified outputs and outcomes. Moving forward,  ISCD could also take additional actions to ensure information about high- risk chemical facilities is shared with first responders and emergency  planners. During our review, we found that local emergency responders  may not have the information they need to adequately respond to  incidents at CFATS facilities; a situation that could expose them and their  communities to potentially life-threatening situations. While the IP  Gateway is a mechanism for sharing names and quantities of chemicals  at high-risk facilities with first responders and emergency planners, we  found it is not widely used by officials at the local level. The NIPP states  that agencies should share actionable and relevant information across the  critical infrastructure community—including first responders and  emergency planners—to build awareness and enable risk-informed  decision making, as these stakeholders are crucial consumers of risk  information. By improving information-sharing with first responders and  emergency planners, such as promoting access to and wider use of the  IP Gateway, DHS will have greater assurances that the emergency  response community has access to timely information about high-risk  chemical facilities that could help protect them from serious injury or  death.

section_title: Recommendations for Executive Action
paragraphs: We are making the following two recommendations to DHS:  The Director of ISCD should incorporate vulnerability into the CFATS site  security scoring methodology to help measure the reduction in the  vulnerability of high-risk facilities to a terrorist attack, and use that data in  assessing the CFATS program’s performance in lowering risk and  enhancing national security. (Recommendation 1)

The Assistant Secretary for Infrastructure Protection, in coordination with  the Director of ISCD, should take actions to encourage access to and  wider use of the IP Gateway and explore other opportunities to improve  information-sharing with first responders and emergency planners.  (Recommendation 2)

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for review and comment. DHS  provided written comments, which are reproduced in full in appendix I,  and technical comments, which we incorporated as appropriate. In its  comments, DHS concurred with both recommendations and outlined  efforts underway or planned to address them.

Regarding the first recommendation that ISCD should incorporate  vulnerability into the CFATS site security scoring methodology to help  measure the reduction in the vulnerability of high-risk facilities and use  that data to further assess the CFATS program’s performance in lowering  risk and enhancing national security, DHS concurred but noted that  developing a system that could numerically evaluate vulnerabilities will be  challenging. DHS stated that implementing the recommendation would  likely require, among other things, revising the regulatory language  describing CFATS vulnerability assessments and updating tools used to  gather them, potentially creating a significant burden on both industry and  government. DHS added that its new proposed performance metric,  described earlier in this report, demonstrates the enhancement to national  security resulting from the CFATS program and, by extension, the  program’s impact on vulnerability and overall risk.

As stated earlier, we recognize challenges ISCD might face in  incorporating vulnerability into its scoring methodology. In our prior work,  we acknowledged that assessing the benefits of a program—such as  reducing a high-risk facility’s vulnerability to an attack—is inherently  challenging because it is often difficult to isolate the impact of an  individual program on behavior that may be affected by multiple other  factors. However, in order to fully implement this recommendation, ISCD  needs to consider steps it can take to evaluate vulnerability reduction  resulting from the CFATS compliance inspection process without  revisions to the regulation or by creating a significant burden on both  industry and government. We noted, for example, that ISCD could  establish a vulnerability baseline score when it evaluates a facility’s  security measures during its initial review of the facility’s site security  plan. ISCD could then use this baseline score as the starting point for  assessing any reduction in vulnerability that ISCD can document that has  occurred as a result of security measures implemented by the facility  during the compliance inspection process. As the CFATS program  continues to mature and ISCD begins its efforts to assign scores to facility  site security plans, incorporating assessments of reductions in  vulnerability at individual facilities and across the spectrum of CFATS  facilities as a whole would enable ISCD to better measure the impact of  the CFATS compliance inspection process on reducing risk and  increasing security nationwide.

Regarding the second recommendation that the Office of Infrastructure  Protection and ISCD take actions to encourage access to and wider use  of the IP Gateway and explore other opportunities to improve information- sharing with first responders and emergency planners, DHS stated that it  has various outreach activities underway, among other information- sharing efforts, to either directly share or ensure that high-risk chemical  facilities are sharing CFATS information with first responders and  emergency planners. DHS added that, to continue these efforts and to  encourage better utilization of the IP Gateway, it will ensure contact is  made with LEPCs representing the top 25 percent of CFATS high-risk  chemical facilities no later than the end of the second quarter of fiscal  year 2019. While the outreach and information-sharing efforts DHS  described are a step in the right direction, in order to fully implement this  recommendation it is critical that the intent of any actions taken is to  ensure that all first responders and emergency planners with a need-to- know are provided with timely access to CFATS facility-specific  information in their jurisdictions. This information should include the name  and quantity of chemicals at a facility so as to help these groups be  properly prepared to respond to incidents at high-risk chemical facilities  and to minimize the risk of injury or death to first responders and the  surrounding community. Furthermore, it is important that these actions  are focused on ensuring that this CFATS facility-specific information is  shared with first responders and emergency planners representing the  entirety of CFATS facilities determined to be high-risk, not just those that  represent the top 25 percent of CFATS high-risk facilities.

We are sending copies of this report to the Secretary of Homeland  Security, the Under Secretary for the National Protection Programs  Directorate, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have questions about this report, please contact me at  (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix II.

section_title: Appendix I: Comments from the Department of Homeland Security

section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, John Mortin (Assistant Director),  Hugh Paquette (Analyst in Charge), Chuck Bausell, Kristen Farole,  Michele Fejfar, Brandon Jones, Tom Lombardi, Mike Moran, Rebecca  Parkhurst, and Claire Peachey made significant contributions to this  report.

Fast facts: Facilities that handle hazardous chemicals could be targets for terrorists—e.g., these chemicals could be stolen and used to build explosive devices. The Department of Homeland Security inspects such facilities to ensure they comply with security standards. DHS also shares information about these facilities with local officials so that first responders are prepared for potential security incidents.

However, we found that first responders may not have all the information they need to safely respond to incidents at these facilities. We recommended, among other things, that DHS provide first responders with better access to this information.

Question-summary annotations: questions: question: How has DHS addressed chemical facilities since 2013?
answer: Since 2013, the Department of Homeland Security (DHS) has strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program.

question: How did DHS improve verification of chemical facilities?
answer: Among other things, DHS implemented a quality assurance review process to verify the accuracy of facility self-reported information used to identify high-risk facilities.

question: How did DHS improve it's risk assessments?
answer: DHS also revised its risk assessment methodology—used to assess whether chemical facilities are high-risk and, if so, assign them to a risk-based tier—by incorporating changes to address prior GAO recommendations and most of the findings of a DHS-commissioned peer review.
child_questions: question: What revisions were incorporated?
answer: For example, the updated methodology incorporates revisions to the threat, vulnerability, and consequence scoring methods to better cover the full range of security issues regulated by CFATS.

question: How has this mew assessment been used?
answer: As of February 2018, a total of 29,195 facilities—including all 26,828 facilities previously assessed and 2,367 facilities new to the program—were assessed using DHS's revised methodology.
child_questions: question: What was the result of this assessment?
answer: DHS designated 3,500 of these facilities as high-risk and subject to further requirements.

questions: question: How do DHS inspections still lack some assessments?
answer: DHS has also made substantial progress conducting and completing compliance inspections and has begun to take action to measure facility security but does not evaluate vulnerability reduction resulting from the CFATS compliance inspection process.

question: What was the state of DHS reviewing in 2013?
answer: In 2013, GAO found that the backlog of chemical facility security plans awaiting review affected DHS's ability to conduct compliance inspections, which are performed after security plans are approved.
child_questions: question: How has the DHS progressed since?
answer: Since then DHS has made progress and increased the number of completed compliance inspections. As of May 2018, DHS had conducted 3,553 compliance inspections.

question: How has the DHS improved their measurement of security?
answer: DHS has also begun to update its performance measure for the CFATS program to evaluate security measures implemented both when a facility submits its initial security plan and again when DHS approves its final security plan.
child_questions: question: What issues did the GAO find with their new measures?
answer: However, GAO found that DHS's new performance measure methodology does not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process.
child_questions: question: What would these additional checks improve?
answer: Doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the CFATS program as a whole.

questions: question: How are first responders to CFATS limited by their knowledge?
answer: DHS shares some CFATS information, but first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities.
child_questions: question: What potential information is missing?
answer: Facilities are currently required to report some chemical inventory information, but GAO found that over 200 CFATS chemicals may not be covered by these requirements.

question: How has DHS improved access to information?
answer: To improve access to information, DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting.
child_questions: question: What issues did the GAO find with this solution?
answer: However, GAO found that the IP Gateway is not widely used at the local level. In addition, officials from 13 of the 15 Local Emergency Planning Committees—consisting of first responders and covering 373 CFATS high-risk facilities—told GAO they did not have access to CFATS data in the IP Gateway.
child_questions: question: How might the DHS fix the IP Gateway?
answer: By encouraging wider use of the IP Gateway, DHS would have greater assurance that first responders have information about high-risk facilities and the specific chemicals they possess.

questions: question: What is the security risk for chemical facilities with hazardous chemicals?
answer: Facilities that produce, use, or store hazardous chemicals could be targeted or used by terrorists to inflict mass casualties, damage, and fear.

question: How does the DHS address potentially at-risk chemical facilities?
answer: DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards.
child_questions: question: How does the DHS use their CFATS?
answer: DHS places high-risk facilities in risk-based tiers and is to conduct inspections after it approves their security plans.
child_questions: question: How will the CFATS Act continue?
answer: Under the CFATS Act of 2014, authorization for the CFATS program expires in January 2019.

questions: question: How did the GAO asses the DHS?
answer: GAO assessed the extent to which DHS has (1) enhanced the process for identifying high-risk facilities and assigning them to tiers, (2) conducted facility inspections and measured facility security, and (3) ensured that information is shared with emergency responders to prepare them for incidents at high-risk facilities.

question: What information did the GAO use in their report?
answer: GAO reviewed DHS reports and data on compliance inspections and interviewed DHS officials.
child_questions: question: What additional information did they collect?
answer: GAO also obtained non-generalizable information from 11 trade associations representing chemical facilities regarding DHS outreach and from 15 emergency planning committees about their awareness of CFATS and the chemicals it covers.