DHS’s National Protection and Programs Directorate leads the country’s effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. The directorate includes the Office of Infrastructure Protection, which leads the coordinated national effort to reduce risk to U.S. critical infrastructure posed by acts of terrorism. Within the Office of Infrastructure Protection, ISCD leads the nation’s effort to secure high-risk chemical facilities and prevent the use of certain chemicals in a terrorist act on the homeland; ISCD also is responsible for implementing and managing the CFATS program. The CFATS program is intended to ensure the security of the nation’s chemical infrastructure by identifying high-risk chemical facilities, assessing the risk posed by them, and requiring the implementation of measures to protect them. Section 550 of the DHS Appropriations Act, 2007, required DHS to issue regulations establishing risk-based performance standards for chemical facilities that, as determined by DHS, present high levels of risk, to include vulnerability assessments and the development and implementation of site security plans for such facilities. DHS published the CFATS interim final rule in April 2007 and Appendix A to the rule, published in November 2007, lists 322 chemicals of interest and the screening threshold quantities for each. According to DHS, subject to certain statutory exclusions, all facilities that manufacture, store, ship, or otherwise use chemicals of interest above certain threshold quantities and concentrations are subject to CFATS reporting requirements. However, only those facilities subsequently determined to present a high level of security risk are subject to the more substantive requirements of the CFATS regulation as described below. The CFATS regulation outlines a specific process for how ISCD is to administer the CFATS program. A chemical facility that possesses any of 322 chemicals of interest in quantities that meet or exceed a threshold quantity and concentration is required to complete what is called a Top- Screen survey using ISCD’s Chemical Security Assessment Tool (CSAT) system. CSAT is a web-based application through which owners and operators of chemical facilities provide self-reported information about the facility. The Top-Screen is an on-line survey whereby the facility is to provide DHS various data, including the name and location of the facility and the chemicals, quantities, and storage conditions at the site. ISCD uses a risk-based approach to evaluate chemical facilities of interest that are required to report under CFATS and determine whether these facilities are high-risk and therefore subject to further requirements under the regulation. More specifically, ISCD’s risk assessment methodology calculates risk scores—based on facility-supplied information in the Top-Screen survey, among other sources, and taking into account vulnerability, potential consequences, and threat of a terrorist attack—and uses these scores to determine which facilities are high-risk. Those facilities deemed high-risk are then placed into one of four risk- based tiers (Tier 1 through Tier 4). Tier 1 represents the highest risk. A facility not designated as high-risk is not subject to additional requirements under the CFATS regulation. If ISCD determines that a facility is high-risk (Tier 1–4), the facility must then complete and submit to ISCD a Security Vulnerability Assessment and one of two types of security plans—a Site Security Plan or an Alternative Security Program—which describes the existing and planned security measures to be implemented in order to be in compliance with the applicable risk-based performance standards. Facilities determined to be Tier 3 or 4 also have an option to submit an expedited security plan under the CFATS Expedited Approval Program. To meet risk-based performance standards, covered facilities may choose the security programs or processes they deem appropriate so long as ISCD determines that the facilities achieve the requisite level of performance on each of the applicable areas in their existing and agreed-upon planned measures. Prior to approving a facility’s security plan, ISCD inspectors conduct an authorization inspection at the facility to verify and validate that the content listed in their plan is accurate and complete; that existing and planned equipment, processes, and procedures are appropriate and sufficient to meet the established requirements of the risk-based performance standards; and to assist the facility in resolving any potential gaps identified. After the facility’s security plan is approved, the facility enters into the CFATS compliance cycle, which includes regular and recurring compliance inspections. ISCD inspectors conduct compliance inspections to ensure the existing and planned security measures identified in a facility’s approved security plan continue to be implemented fully; the equipment, processes, and procedures described in the security plan are appropriate and sufficient to meet the established performance standards; and the required corrective actions have been implemented and are sustainable. This compliance inspection includes a verification of other data provided to ISCD, including the Top-Screen. If, through a compliance inspection, ISCD determines a facility has not fully implemented security measures as outlined in its approved security plan, ISCD is to provide the facility with written notification that clearly identifies the deficiencies in the plan and will work with the facility toward achieving full compliance or, if warranted, take enforcement action. Figure 1 illustrates the CFATS regulatory process. In response to our prior recommendations, ISCD has taken action to strengthen its processes for verifying the accuracy of data it uses to identify high-risk chemical facilities. In July 2015, we found that ISCD used self-reported and unverified data to determine the risk categorization for facilities that held toxic chemicals that could threaten surrounding communities if released. At the time, ISCD required that facilities self- report the Distance of Concern—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure—as part of its Top-Screen methodology. In our report, we estimated that more than 2,700 facilities with a toxic release threat misreported the Distance of Concern and recommended that ISCD (1) develop a plan to implement a new Top-Screen to address errors in the Distance of Concern submitted by facilities, and (2) identify potentially miscategorized facilities that could cause the greatest harm and verify that the Distance of Concern these facilities reported is accurate. ISCD has addressed both of these recommendations. In response to the first recommendation, ISCD implemented an updated Top-Screen survey in October 2016 and now collects data from facilities and conducts more accurate modeling to determine the actual area of impact (formerly called the Distance of Concern), rather than relying on the facilities’ calculation. In response to the second recommendation, ISCD officials reported in November 2016 that they reassessed all facility Top-Screens that reported threshold quantities of chemicals posing a toxic release threat, and identified 158 facilities with the potential to cause the greatest harm. In April 2018, ISCD officials reported that all of these facilities have since been reassessed using updated Top-Screen information and, where appropriate, assigned a risk tier. In addition, in October 2016, ISCD implemented a quality assurance review process whereby ISCD officials manually check and verify the accuracy of facility self-reported Top-Screen information used in identifying potential high-risk facilities. The objective of ISCD’s review process is to evaluate the information provided by a chemical facility in order to recommend approval or rejection of a submitted Top-Screen for accuracy prior to issuing a letter notifying the facility of its risk tier designation. According to ISCD, all Top-Screens undergo a quality assurance review with two exceptions: (1) a facility that registers through CSAT for the first time and submits a Top-Screen identifying zero chemicals of interest on site and which does not identify an exclusion; or (2) a facility that possessed a chemical of interest in the past but subsequently submits a follow-up Top-Screen for redetermination identifying they no longer possess the chemical of interest and after ISCD validates the removal of the chemical of interest. When a Top-Screen submission is rejected, ISCD sends a letter notifying the facility of the rejection and requesting that a revised Top-Screen be submitted. In addition, according to ISCD, they contact facilities prior to a Top-Screen rejection to ensure the facility understands the required updates and to discuss the potential reporting error. As of February 2018, a total of 1,956 Top-Screen submissions (across 1,799 unique facilities) were rejected as part of this quality assurance review process since implementing the updated Top-Screen survey in October 2016, according to ISCD data. According to ISCD, the majority of these Top-Screens were rejected due to common reporting errors, such as misreporting the flammability hazard rating for a chemical of interest subject to a release security issue or not reporting transportation packaging when a chemical of interest is identified as being subject to a theft or diversion security issue. ISCD Revised Its Risk Assessment Methodology to More Accurately Identify and Assign Tiers to High-Risk Chemical Facilities Since we last evaluated it in 2013, ISCD took action to enhance the CFATS program’s risk assessment methodology—used to determine whether covered chemical facilities are high-risk and, if so, assign them a risk-based tier—by incorporating changes to address prior GAO recommendations, as well as the findings of an ISCD-commissioned peer review conducted in 2013, among other efforts. In April 2013, we found that DHS’s risk assessment approach did not consider all of the elements of threat, vulnerability, and consequence associated with a terrorist attack involving certain chemicals. Our work showed that DHS’s CFATS risk assessment methodology was based primarily on consequences from human casualties, but did not consider economic consequences, as called for by the NIPP and the CFATS regulation. We also found that DHS’s approach was not consistent with the NIPP because it treated every facility as equally vulnerable to a terrorist attack regardless of location or on-site security. In addition, DHS was not using threat data for 90 percent of the tiered facilities—those tiered for the risk of theft or diversion—and using 5-year-old threat data for the remaining 10 percent of those facilities that were tiered for the risks of release or sabotage. We recommended that ISCD (1) review and improve its risk assessment approach to fully address each of the elements of threat, vulnerability, and consequence, and (2) conduct an independent peer review after enhancements to the risk assessment approach were complete. Partly in response to our findings and recommendations, from 2013 through 2016, ISCD conducted a multiyear effort to review and improve the CFATS program’s risk assessment approach and tiering methodology with the primary goal of improving the identification and appropriate tiering of high-risk chemical facilities. Among these efforts was an ISCD- commissioned peer review of the CFATS tiering methodology conducted in 2013 by the Homeland Security Studies and Analysis Institute (HSSAI). HSSAI’s final report summarized the findings of the peer review and included a list of 44 recommendations for ISCD to implement in its efforts to improve and revise the CFATS risk assessment and tiering methodology. ISCD undertook a risk assessment improvement project to implement most of the recommendations described in the 2013 HSSAI final report; these efforts included, for example, convening advisory board meetings with experts drawn from across industry, academia, and government to review and make additional recommendations on the proposed improvements to the CFATS risk assessment methodology and associated tools and processes. The result of these efforts is an updated, “second generation” risk assessment approach and tiering methodology that addresses both of our prior recommendations and almost all of the recommendations described in the 2013 HSSAI final report. Specifically, with regard to our recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, ISCD worked with Sandia National Laboratories to develop and evaluate a model to estimate the economic consequences of a chemical attack. In addition, among other enhancements, the updated risk assessment methodology incorporates revisions to the threat, vulnerability, and consequence scoring methods to better cover the full range of chemical security issues regulated by the CFATS program. Additionally, with regard to our recommendation that DHS conduct a peer review after enhancing its risk assessment approach, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology which was completed in January 2017. In addition, as of May 2018, ISCD has considered, implemented, or is in the process of implementing updates that address 39 of the 44 recommendations in the HSSAI peer review of the original CFATS risk assessment methodology. According to ISCD, DHS must undertake a rulemaking to update the CFATS regulation and to obtain public comment on any proposed changes to implement the remaining recommendations. These relate to possible changes in how or to what extent the CFATS program regulates the treatment of certain chemicals of interest, chemical weapons and their precursors, and other fuels or fuel mixtures. Implementation of the Revised Risk Assessment Methodology Is Nearly Complete Beginning in October 2016, ISCD notified chemical facilities that were not new to the CFATS program—that is, all facilities that had previously submitted a Top-Screen and had reported chemicals of interest above the threshold quantity and concentration on their most recent Top-Screen—to submit a revised Top-Screen in CSAT 2.0 so that they may be re- assessed using ISCD’s revised risk assessment methodology. As of February 2018, a total of 29,195 chemical facilities were assessed using ISCD’s revised risk assessment methodology, with 3,500 (or 12 percent) of these facilities designated as high-risk (i.e., assigned to tiers 1 through 4). The total of 29,195 chemical facilities includes 26,828 facilities that were previously assessed using the original risk assessment methodology and an additional 2,367 facilities new to the CFATS program, as shown in figure 2. Of the 3,500 tiered facilities, 265 were new to the CFATS program; 889 were not new to the program, but were previously not tiered and were reassessed as high-risk and assigned a tier; and 1,345 were previously tiered but were reassigned to a different tier. Also, 430 facilities that were previously tiered were no longer tiered. As of May 2018, ISCD had pending risk assessments for an additional 241 chemical facilities that were not new to the CFATS program but were not previously tiered. ISCD officials did not provide an estimated target completion date for these pending risk assessments, noting that completing the assessments is highly dependent on the facilities providing the necessary Top-Screen information. According to ISCD, there are four main drivers of the changes in facility tiering that resulted from implementing the second-generation risk assessment methodology: facilities placed in a lower tier due to implementation of revised consequence scoring methods that more accurately account for the impact of quantities of the chemicals subject to theft/diversion security issues; facilities placed in a higher or lower tier for chemicals of interest due to improvements to the distribution of population in consequence modeling for chemicals subject to release-toxic and release- flammable security issues; increases in the number of facilities tiered for select chemical weapon precursors due to the implementation of revised consequence scoring methods that more accurately account for the impact of certain chemicals of interest; and changes in tiering due to newly reported increases, decreases, and modifications of chemical holdings. Since 2013, ISCD has reduced its backlog of unapproved site security plans and increased the number of conducted compliance inspections. As discussed earlier, in order to approve a facility’s site security plan, ISCD inspectors conduct an authorization inspection at the facility to verify and validate that the content listed in their plan is accurate and complete; that existing and planned equipment, processes, and procedures are appropriate and sufficient to meet the established requirements of the risk-based performance standards; and to assist the facility in resolving any potential gaps identified. After the facility’s security plan is approved, the facility enters into the CFATS compliance cycle and is subject to a compliance inspection. In 2013, we calculated that it could take from 7 to 9 years to review and approve the approximately 3,120 site security plans submitted by facilities that had been designated as high-risk but that ISCD had not yet begun to review. In 2015, we found that ISCD had made improvements to its processes for reviewing and approving site security plans and substantially reduced the time needed to approve remaining site plans to between 9 and 12 months. Our analysis of ISCD data since our 2015 report showed that ISCD has made substantial progress conducting and completing compliance inspections. Specifically, our analysis showed that ISCD has increased the number of compliance inspections completed per year since ISCD began conducting compliance inspections in 2013. For the 2,466 high-risk facilities with an approved site security plan as of May 2018, ISCD had conducted 3,553 compliance inspections. Table 1 shows the number of conducted compliance inspections from fiscal year 2014 to May 2018. ISCD officials project they will conduct fewer compliance inspections in fiscal year 2018 than in fiscal year 2017 due to two reasons. First, ISCD officials stated the program made progress resolving the backlog of facilities that required compliance inspections in fiscal years 2016 and 2017 when it conducted over 2,600 compliance inspections. Second, ISCD officials stated that the program’s revised risk assessment approach and continued outreach efforts have resulted in an increase in the number of identified facilities with chemicals of interest. As a result, ISCD officials stated they project an increased number of authorization inspections and fewer compliance inspections in fiscal year 2018 and 2019 as new facilities enter the program. ISCD increased the number of compliance inspections conducted from fiscal years 2014 to 2017 and less than 1 percent of compliance inspections during this period resulted in a determination that a facility was not in compliance. During a compliance inspection, if an inspector finds that a facility is noncompliant with its security plan, the CFATS regulation authorizes ISCD to take enforcement action, such as issuing an order for corrective action to the facility. Of the 3,553 compliance inspections ISCD conducted between fiscal year 2014 and May 2018, ISCD issued two corrective actions—both to Tier 4 facilities—because these facilities were not in compliance with their approved site security plan. Specifically, during the compliance inspection of one facility, which was determined to be high-risk based on both the release and theft/diversion security issues, ISCD found that the facility’s site security plan did not identify several existing or planned measures to secure the facility’s chemicals of interest. For example, the facility’s site security plan did not identify measures to monitor restricted areas or potentially critical targets within the facility against a theft or release attack. In addition, while the facility’s site security plan identified a chain link fence and an alarm on a gate to a secure cage that houses the chemicals of interest, ISCD inspectors found no evidence of either. During the compliance inspection of the second facility, which was determined to be high-risk based on the theft and diversion security issue, ISCD inspectors were unable to verify if the facility’s intrusion detection system was properly functioning and that an individual not employed by the facility may have had access to the facility’s chemicals of interest without a proper background check. Both of these facilities took actions to implement the measures identified in their site security plan and were later found to be in compliance with their site security plans. ISCD officials attribute the low number of corrective actions the program has issued to the program’s collaborative approach of working with facilities to ensure compliance. For example, of the two facilities ISCD found to be in noncompliance, ISCD conducted a compliance assistance visit with both facilities to provide assistance. In addition to compliance assistance visits, ISCD officials stated that the program has other collaborative tools, such as the CFATS Help Desk, to help ensure facility compliance. ISCD continues to implement changes that are intended to enhance compliance inspections. For example, ISCD officials stated the program continues to conduct preinspection phone calls with facilities to help them prepare for compliance inspections. In addition, ISCD officials stated they developed and provided supplemental guidance in fiscal year 2017 on steps ISCD inspectors need to take during a compliance inspection. ISCD’s supplemental guidance includes, among other things, best practices and lessons learned for conducting inspections and reporting items identified by the inspections. ISCD officials stated they plan to incorporate this supplemental guidance into their compliance inspection standard operating procedures in the third quarter of fiscal year 2018 and to update their compliance inspection handbook in the fourth quarter of 2018. In addition to updating its guidance for inspectors, ISCD has taken steps to improve the efficiency of compliance inspections. For example, ISCD continues its outreach efforts to chemical facilities on the inspection process. As part of these efforts, ISCD published guidance for facilities on steps to take to prepare for the compliance inspection, including information on the appropriate personnel and documentation that should be made available during the inspection. Finally, ISCD increased the number of compliance assistance visits with facilities to better prepare them for inspections. Representatives from 9 of the 11 industry associations we spoke with told us that ISCD’s communication with facilities had improved the efficiency of compliance inspections and increased the ability of facilities to comply with the risk-based performance standards. We accompanied inspectors on two separate compliance inspections to observe how the inspections were carried out and how inspectors used the risk-based performance standards to determine compliance. For example, during the compliance inspection of a facility identified as high- risk based on the theft and diversion security issue, we observed facility personnel and ISCD inspectors discussing the preinspection phone call ISCD had conducted to assist the facility in preparation for their compliance inspection. This discussion included confirmation that the facility communicated with the local fire and police departments and had requested their presence at the inspection. In addition, we observed the inspectors analyzing the facility’s emergency response plan to determine whether the facility’s plans were consistent with the applicable risk-based performance standards. We also observed the inspectors subsequently interviewing local fire and police department officials that were present during the inspection to validate statements made by the facility and to confirm that both entities received the facility’s emergency plan. We accompanied the inspectors and facility personnel on a tour of the facility where inspectors observed existing measures the facility used to protect the chemicals of interest, including the facility’s fencing barrier. We also observed inspectors testing security measures, including the facility’s access controls put in place to prevent unauthorized personnel gaining access to the chemicals of interest. At the other compliance inspection we observed, the facility personnel and ISCD inspectors confirmed a preinspection phone call to prepare the facility for the inspection. This phone call included a discussion of the appropriate training records and contract documentation that inspectors needed to confirm compliance with the applicable risk-based performance standard. During the inspection, we observed that the facility made this documentation and the appropriate personnel available to answer ISCD inspector questions on the security training the facility held during the prior year. We also observed inspectors verifying that existing measures, such as the facility’s fence barrier, were still present and not compromised with breaches. In addition, we observed the inspectors testing key cards to the building that housed the chemicals of interest to ensure the cards prevented unauthorized access. Finally, we observed inspectors requesting a demonstration of how the facility’s chemicals of interest are delivered to the facility and what controls were in place to monitor third-party contractors during delivery of chemicals of interest. We also discussed the compliance inspection process with representatives from trade associations that represent facilities covered by CFATS and considered high-risk. Representatives from 7 of the 11 trade associations that we spoke with stated that ISCD’s implemented changes have improved the compliance inspection process since the program’s inception. Specifically, representatives from three trade associations stated that ISCD inspectors’ efforts to increase communication with facilities, including preinspection phone calls and compliance assistance visits, have increased the ability of facilities to ensure they are compliant with their approved site security plan. However, representatives from 3 of the 11 trade associations we spoke with also noted some issues with the compliance inspection process. Specifically, officials from these 3 associations stated that ISCD inspectors inconsistently apply the risk-based performance standards relative to the measures the facilities implemented. Some of this inconsistency may be due, in part, to the flexibility inherent in the risk- based performance standards which give facilities the discretion or latitude to tailor security based on conditions and circumstances. For example, the amount and type of chemicals of interest may vary by facility, so some facilities may require additional security measures be put in place to ensure protection of these chemicals. In addition, facilities vary by geographic location, which may affect the measures the facility needs to implement to protect the chemicals of interest from potential theft or diversion. DHS officials stated that they believe any perceived inconsistency is due to the flexibility in application of the risk-based performance standards and the variety of facility conditions that contribute to the appropriateness of different security measures. Officials explained that, for example, inspectors would likely recommend that a large campus-type facility not invest in a perimeter fence line but instead utilize asset-based barriers to satisfy the performance standards. Officials noted that facilities can choose to employ security measures which best fit their specific situation and can request that inspectors provide multiple options for their consideration. ISCD developed its performance measure methodology for the CFATS program in order to evaluate security changes made by high-risk chemical facilities, but the methodology does not measure the program’s impact on reducing a facility’s vulnerability to an attack. In 2015 we found that while ISCD’s performance measure for the CFATS program was intended to reflect security measures implemented by facilities and the overall impact of the CFATS regulation on facility security, the metric did not solely capture security measures that are implemented by facilities and verified by ISCD. We recommended that DHS develop a performance measure that includes only planned security measures that have been implemented and verified. In response to our finding and recommendation, ISCD’s performance measure requires that ISCD officials verify that planned measures have been implemented in accordance with the approved site security plan (or alternative security program) by compliance inspection or other means before inclusion in the performance measure calculation. ISCD has since decided to develop a new methodology and performance measure for the CFATS program. In 2016, ISCD began development of an approach called the guidepost-based site security plan scoring methodology. ISCD officials stated they plan to use the methodology to evaluate the security measures a facility implemented from initial state— when a facility submits its initial site security plan—to the facility’s approved security plan, according to ISCD officials. Officials stated that once implemented, the methodology’s resulting performance measure will be maintained internally and, if approved, may be used to satisfy the program’s reporting requirements consistent with the Government Performance and Results Act (GPRA) and included in DHS’s Annual Performance Report. The methodology organizes a facility’s security measures based on five guideposts. Using the five guideposts as a framework, the security measures a facility reports in its site security plan are evaluated by ISCD under the applicable guidepost to determine the level of security performance. For example, the plan contains a question on whether a facility has a perimeter fence barrier and if so, what type, such as a chain link fence, metal fence, or vinyl fence. ISCD uses the facility’s responses to assign a numerical value that indicates the level of security performance for the type of fence a facility uses as a perimeter barrier. The scores of the five guideposts are then aggregated and the resulting score represents the site security plan score for a facility. Officials stated that a facility’s site security plan score is developed when the facility submits its initial site security plan and again when ISCD approves its site security plan and the facility has completed the CFATS inspection process. ISCD officials stated the purpose of the methodology is to measure the increase in security attributed to the CFATS program and stated that the methodology is not intended to measure risk reduction. As a result, the methodology and resulting performance metric do not reflect the program’s impact on reducing a facility’s vulnerability to an attack. While ISCD officials stated the program is exploring how to use the site security plan scores of a facility, this methodological approach may provide ISCD an opportunity to begin assessing how vulnerability is reduced and, by extension, risk is lowered, not only for individual facilities but for the program as a whole. The NIPP calls for evaluating the effectiveness of risk management efforts by collecting performance data to assess progress in achieving identified outputs and outcomes. The purpose of the CFATS program is to ensure facilities have security measures in place to reduce the risks associated with certain hazardous chemicals and to prevent these chemicals from being exploited in a terrorist attack. A measure that reflects risk reduction may include how the CFATS inspection process measures the reduction of one element of risk— vulnerability—of high-risk facilities to a terrorist attack. ISCD officials stated that challenges exist with incorporating vulnerability into the measure’s methodology, such as how to accurately measure a facility’s vulnerability to an attack before the facility started the CFATS inspection process. We recognize challenges ISCD might face in incorporating vulnerability into its scoring methodology. In our prior work, we acknowledged that assessing the benefits of a program—such as reducing a high-risk facility’s vulnerability to an attack—is inherently challenging because it is often difficult to isolate the impact of an individual program on behavior that may be affected by multiple other factors. However, ISCD could take steps to evaluate vulnerability reduction resulting from the CFATS compliance inspection process. For example, because facilities conduct their own vulnerability assessments when developing their site security plan for submission to ISCD, ISCD could establish a vulnerability baseline score when it evaluates a facility’s security measures during its initial review of the facility’s plan. ISCD could then use this baseline score as the starting point for assessing any reduction in vulnerability that ISCD can document that has occurred as a result of security measures implemented by the facility during the compliance inspection process. As the CFATS program continues to mature and ISCD begins its efforts to assign scores to facility site security plans, incorporating assessments of reductions in vulnerability at individual facilities and across the spectrum of CFATS facilities as a whole would enable ISCD to better measure the impact of the CFATS compliance inspection process on reducing risk and increasing security nationwide. We found over 200 chemicals covered by CFATS that may not be included in the chemical inventory information that officials told us they rely on to prepare for and respond to incidents at chemical facilities. ISCD shares some CFATS information with state and local officials, including access to CFATS facility-specific data via a secure portal; however, this portal is not widely used at the local level by first responders and emergency planners. First responders and emergency planners may not have the necessary information to prepare for and respond to incidents at high-risk chemical facilities regulated by the CFATS program. As mentioned earlier, on April 17, 2013, about 30 tons of ammonium nitrate fertilizer—containing a CFATS chemical of interest—detonated during a fire at a fertilizer storage and distribution facility in West, Texas killing 15 people, including 12 first responders, and injuring more than 260 others. This event, among others, prompted the President to issue Executive Order 13650 to improve chemical facility safety and security in coordination with owners and operators. The Executive Order established a Chemical Facility Safety and Security Working Group and included directives for the working group to, among other things, improve operational coordination with state, local, and tribal partners. The working group created a federal plan of action consisting of actions to improve the safety and security of chemical facilities. One key element of this plan focused on the Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA), which was intended to encourage and support emergency planning efforts at the state and local levels. In accordance with EPCRA, state and local entities, such as Local Emergency Planning Committees (LEPCs)—consisting of representatives including local officials and planners, facility owners and operators, first responders, and health and hospital personnel, among others—were created. These LEPCs were designed to (1) prepare for and mitigate the effects of a chemical incident and (2) ensure that information on chemical risks in the community is provided to first responders and the public. The working group acknowledged there was a need to share data with representatives of these state and local entities to enable them to identify gaps and inconsistencies in their existing information that could reveal previously unknown risks in their communities. For facilities subject to EPCRA requirements, this data is to include, among other things, information about chemicals stored or used at the facility for which facilities are required to submit an emergency and hazardous chemical inventory form to these state and local entities. The working group’s federal plan also included a DHS commitment to share certain CFATS data elements with first responders, state agencies and LEPCs to help communities identify and prioritize risks and develop a contingency plan to address those risks while acknowledging that access to certain sensitive portions of CFATS data will remain restricted to officials with a “need-to-know” so as to appropriately balance security risks. In our interviews with 15 LEPCs—whose jurisdictions include 373 high- risk chemical facilities regulated by the CFATS program—we found that officials rely on information reported on EPCRA chemical inventory forms to prepare for and respond to incidents at CFATS facilities. These officials may not have sufficient information to respond to emergencies at CFATS facilities because EPCRA reporting requirements may not cover some of the chemicals covered under the CFATS program. Specifically, we analyzed the chemicals covered by both CFATS and EPCRA’s reporting requirements and found there are over 200 CFATS chemicals of interest that, depending upon state reporting guidelines, may not be covered by EPCRA reporting requirements. Several of these chemicals may require specific response techniques to minimize the risk of injury or death to first responders and the surrounding community. For example, in the event of fire, aluminum powder, a chemical not subject to EPCRA reporting requirements but regulated under CFATS, produces flammable gases when in contact with water and requires responders to instead use a dry chemical or sand to extinguish the fire. Based on our analysis of tiered CFATS facilities, we estimate that about 32 percent of these high- risk facilities possess at least one chemical that may not be covered by EPCRA reporting requirements. In addition, we found these LEPCs may lack information on the CFATS facilities in their jurisdictions. Specifically, officials representing 11 of the 15 LEPCS we interviewed said they were not aware of which facilities in their jurisdiction were regulated by the CFATS program. Of these 11 LEPCs, officials from 8 LEPCs stated it would be very helpful or critical to know this information and officials from 2 LEPCs stated it would be somewhat helpful. According to these officials, this information would assist LEPCs, some of which have hundreds of facilities in their jurisdiction, to prioritize the most significant facilities for additional planning or scheduling of drills and exercises. Additionally, officials representing 5 LEPCs stated they were not aware of the differences between CFATS chemicals of interest and those chemicals subject to EPCRA reporting requirements. These LEPC officials stated that, among other things, it is critical to have a comprehensive understanding of all chemicals at a facility and that this information is very important for emergency responders to be aware of when responding to an incident. Consistent with the CFATS Act of 2014, ISCD is to play a role in ensuring that first responders and emergency planners are properly prepared for and provided with the situational awareness needed to respond to security incidents at high-risk chemical facilities. While the CFATS Act of 2014 does not specifically require that information be shared directly with first responders, ISCD has taken steps to share CFATS information with state and local officials to help ensure that first responders are prepared to respond to such security incidents. These steps include, among other things, ensuring that facilities are developing and exercising an emergency plan to respond to security incidents internally and with assistance of local law enforcement and first responders. Planning and training are important to ensure that facility personnel, onsite security, law enforcement, and first responders are ready to respond to external and internal security incidents. Additionally, these planning activities and relationships with first responders can assist in reducing the impact of these incidents. According to ISCD officials, to verify compliance with this requirement, ISCD inspectors validate facility outreach to first responders, such as local law enforcement and fire departments, through review of facility documentation, including emails with first responders, records of drills, and logs of meetings and tours, or through direct contact with the local first responders by the inspection team. In addition, the Executive Order 13650 working group sought to, among other things, strengthen community planning and preparedness and ensure that first responders and emergency planners are aware of the risks associated with hazardous chemicals in their communities. Included was a goal to increase information-sharing with communities that are near chemical facilities. In a May 2014 report, this working group identified certain information, including the name and quantity of chemicals at a facility, as the most helpful to first responders and emergency planners. This information is intended to enable emergency planners to conduct an analysis to identify gaps and inconsistencies in their existing information that could reveal previously unknown risks in their communities. ISCD has taken action to ensure first responders and emergency planners have access to CFATS data. For example, in response to Executive Order 13650, ISCD shares CFATS data through the Infrastructure Protection (IP) Gateway. This online portal contains critical infrastructure data and analytic tools, including data on covered CFATS facilities, for use by federal officials, state, local, tribal, and territorial officials, and emergency response personnel. CFATS data available in the IP Gateway includes, among other things, facility name, location, risk tier, and chemicals on-site and is accessible to authorized federal and other state, local, tribal, and territorial officials and responders with an established need-to-know. The IP Gateway provides these officials and responders access to CFATS facility-specific information that may be unreported on EPCRA chemical inventory forms. This CFATS facility-specific information can help ensure these groups are properly prepared to respond to incidents at high-risk chemical facilities in their jurisdictions. While the IP Gateway is a mechanism for sharing names and quantities of chemicals at CFATS high-risk facilities with first responders and emergency planners, we found it is not widely used by officials at the local level. ISCD told us that in May 2018 they published three revised fact sheets and included information on the IP Gateway in presentation materials that officials told us was intended to increase promotion and use of the IP Gateway. However, according to DHS, there are 14 accounts categorized at the local level whose access to the IP Gateway layer includes the names and quantities of chemicals at CFATS facilities. A local account indicates the individual with access is a county- or city- level employee or contractor. Additionally, while not generalizable to all LEPCs, officials representing 7 of the 15 LEPCs we interviewed were not aware of the IP Gateway and officials representing 13 of the 15 LEPCs stated that they do not have access to CFATS information within the IP Gateway. Of the 13 officials that reported they did not have access, 11 said that it would be helpful or critical to have access for several reasons. Specifically, officials representing these LEPCs stated that this information would assist them to better prepare and respond to incidents and help emergency planners prioritize the most critical sites among the thousands of facilities that they oversee. According to DHS officials, their outreach plan, developed in March 2015, specifically addresses regular engagement with LEPCs, among other groups. However, these officials acknowledged that information may not be reaching some state and local officials due to a number of factors, including the large number of LEPCs and first responders across the country, and changes in the level of LEPC activity and personnel over time. While we recognize these challenges, providing first responders and emergency planners access to CFATS facility-specific information, including the name and quantity of chemicals at a facility, can help ensure these groups are properly prepared to respond to incidents at high-risk chemical facilities in their jurisdictions. The NIPP states that agencies should share actionable and relevant information across the critical infrastructure community—including first responders and emergency planners—to build awareness and enable risk-informed decision making as these stakeholders are crucial consumers of risk information. Additionally, the 2015 Emergency Services Sector-Specific Plan, an Annex to the 2013 NIPP, further calls for engaging with local emergency planning organizations, such as LEPCs, to enhance information-sharing and analytical capabilities for incident planning, management, and mitigation between stakeholders. The IP Gateway is one way through which ISCD can share CFATS facility-specific information, including the name and quantity of chemicals at high-risk facilities with first responders and emergency planners. As discussed earlier, although ISCD is not required to share CFATS facility-specific information directly with first responders, this information is critical to prepare for and respond to incidents at high-risk chemical facilities and to protect them and their communities from injury or death. By exploring ways to improve information-sharing of CFATS facility-specific data, such as promoting wider use of the IP Gateway among first responders and emergency planners, DHS will have greater assurances that the emergency response community has access to timely information about high-risk chemical facilities. DHS, through ISCD, has made improvements to the CFATS program. ISCD has taken action to strengthen its processes for verifying the accuracy of data it uses to identify high-risk chemical facilities, revised its risk assessment methodology to more accurately identify and assign high-risk chemical facilities to tiers, and has nearly completed its efforts to apply this new methodology to facilities covered by CFATS. Furthermore, ISCD has conducted an increased number of compliance inspections and continues to make changes to improve the efficiency of the inspection process. While ISCD has developed a new methodology and performance measure for the CFATS program in order to evaluate security changes made by high-risk chemical facilities, we found that the methodology and metric do not reflect the program’s impact on reducing a facility’s vulnerability to an attack. ISCD may have an opportunity to explore how reductions in vulnerability at individual facilities resulting from the CFATS compliance inspection process could be used to develop an overall measure of the performance of the CFATS program in reducing risk and increasing security nationwide. Such a measure would be consistent with the NIPP, which calls for evaluating the effectiveness of risk management efforts by collecting performance data to assess progress in achieving identified outputs and outcomes. Moving forward, ISCD could also take additional actions to ensure information about high- risk chemical facilities is shared with first responders and emergency planners. During our review, we found that local emergency responders may not have the information they need to adequately respond to incidents at CFATS facilities; a situation that could expose them and their communities to potentially life-threatening situations. While the IP Gateway is a mechanism for sharing names and quantities of chemicals at high-risk facilities with first responders and emergency planners, we found it is not widely used by officials at the local level. The NIPP states that agencies should share actionable and relevant information across the critical infrastructure community—including first responders and emergency planners—to build awareness and enable risk-informed decision making, as these stakeholders are crucial consumers of risk information. By improving information-sharing with first responders and emergency planners, such as promoting access to and wider use of the IP Gateway, DHS will have greater assurances that the emergency response community has access to timely information about high-risk chemical facilities that could help protect them from serious injury or death. We are making the following two recommendations to DHS: The Director of ISCD should incorporate vulnerability into the CFATS site security scoring methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program’s performance in lowering risk and enhancing national security. (Recommendation 1) The Assistant Secretary for Infrastructure Protection, in coordination with the Director of ISCD, should take actions to encourage access to and wider use of the IP Gateway and explore other opportunities to improve information-sharing with first responders and emergency planners. (Recommendation 2) We provided a draft of this report to DHS for review and comment. DHS provided written comments, which are reproduced in full in appendix I, and technical comments, which we incorporated as appropriate. In its comments, DHS concurred with both recommendations and outlined efforts underway or planned to address them. Regarding the first recommendation that ISCD should incorporate vulnerability into the CFATS site security scoring methodology to help measure the reduction in the vulnerability of high-risk facilities and use that data to further assess the CFATS program’s performance in lowering risk and enhancing national security, DHS concurred but noted that developing a system that could numerically evaluate vulnerabilities will be challenging. DHS stated that implementing the recommendation would likely require, among other things, revising the regulatory language describing CFATS vulnerability assessments and updating tools used to gather them, potentially creating a significant burden on both industry and government. DHS added that its new proposed performance metric, described earlier in this report, demonstrates the enhancement to national security resulting from the CFATS program and, by extension, the program’s impact on vulnerability and overall risk. As stated earlier, we recognize challenges ISCD might face in incorporating vulnerability into its scoring methodology. In our prior work, we acknowledged that assessing the benefits of a program—such as reducing a high-risk facility’s vulnerability to an attack—is inherently challenging because it is often difficult to isolate the impact of an individual program on behavior that may be affected by multiple other factors. However, in order to fully implement this recommendation, ISCD needs to consider steps it can take to evaluate vulnerability reduction resulting from the CFATS compliance inspection process without revisions to the regulation or by creating a significant burden on both industry and government. We noted, for example, that ISCD could establish a vulnerability baseline score when it evaluates a facility’s security measures during its initial review of the facility’s site security plan. ISCD could then use this baseline score as the starting point for assessing any reduction in vulnerability that ISCD can document that has occurred as a result of security measures implemented by the facility during the compliance inspection process. As the CFATS program continues to mature and ISCD begins its efforts to assign scores to facility site security plans, incorporating assessments of reductions in vulnerability at individual facilities and across the spectrum of CFATS facilities as a whole would enable ISCD to better measure the impact of the CFATS compliance inspection process on reducing risk and increasing security nationwide. Regarding the second recommendation that the Office of Infrastructure Protection and ISCD take actions to encourage access to and wider use of the IP Gateway and explore other opportunities to improve information- sharing with first responders and emergency planners, DHS stated that it has various outreach activities underway, among other information- sharing efforts, to either directly share or ensure that high-risk chemical facilities are sharing CFATS information with first responders and emergency planners. DHS added that, to continue these efforts and to encourage better utilization of the IP Gateway, it will ensure contact is made with LEPCs representing the top 25 percent of CFATS high-risk chemical facilities no later than the end of the second quarter of fiscal year 2019. While the outreach and information-sharing efforts DHS described are a step in the right direction, in order to fully implement this recommendation it is critical that the intent of any actions taken is to ensure that all first responders and emergency planners with a need-to- know are provided with timely access to CFATS facility-specific information in their jurisdictions. This information should include the name and quantity of chemicals at a facility so as to help these groups be properly prepared to respond to incidents at high-risk chemical facilities and to minimize the risk of injury or death to first responders and the surrounding community. Furthermore, it is important that these actions are focused on ensuring that this CFATS facility-specific information is shared with first responders and emergency planners representing the entirety of CFATS facilities determined to be high-risk, not just those that represent the top 25 percent of CFATS high-risk facilities. We are sending copies of this report to the Secretary of Homeland Security, the Under Secretary for the National Protection Programs Directorate, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have questions about this report, please contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. In addition to the contact named above, John Mortin (Assistant Director), Hugh Paquette (Analyst in Charge), Chuck Bausell, Kristen Farole, Michele Fejfar, Brandon Jones, Tom Lombardi, Mike Moran, Rebecca Parkhurst, and Claire Peachey made significant contributions to this report.

Summary: Facilities that produce, use, or store hazardous chemicals could be targeted or used by terrorists to inflict mass casualties, damage, and fear. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. DHS places high-risk facilities in risk-based tiers and is to conduct inspections after it approves their security plans. Under the CFATS Act of 2014, authorization for the CFATS program expires in January 2019. GAO assessed the extent to which DHS has (1) enhanced the process for identifying high-risk facilities and assigning them to tiers, (2) conducted facility inspections and measured facility security, and (3) ensured that information is shared with emergency responders to prepare them for incidents at high-risk facilities. GAO reviewed DHS reports and data on compliance inspections and interviewed DHS officials. GAO also obtained non-generalizable information from 11 trade associations representing chemical facilities regarding DHS outreach and from 15 emergency planning committees about their awareness of CFATS and the chemicals it covers. Since 2013, the Department of Homeland Security (DHS) has strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program. Among other things, DHS implemented a quality assurance review process to verify the accuracy of facility self-reported information used to identify high-risk facilities. DHS also revised its risk assessment methodology—used to assess whether chemical facilities are high-risk and, if so, assign them to a risk-based tier—by incorporating changes to address prior GAO recommendations and most of the findings of a DHS-commissioned peer review. For example, the updated methodology incorporates revisions to the threat, vulnerability, and consequence scoring methods to better cover the full range of security issues regulated by CFATS. As of February 2018, a total of 29,195 facilities—including all 26,828 facilities previously assessed and 2,367 facilities new to the program—were assessed using DHS's revised methodology. DHS designated 3,500 of these facilities as high-risk and subject to further requirements. DHS has also made substantial progress conducting and completing compliance inspections and has begun to take action to measure facility security but does not evaluate vulnerability reduction resulting from the CFATS compliance inspection process. In 2013, GAO found that the backlog of chemical facility security plans awaiting review affected DHS's ability to conduct compliance inspections, which are performed after security plans are approved. Since then DHS has made progress and increased the number of completed compliance inspections. As of May 2018, DHS had conducted 3,553 compliance inspections. DHS has also begun to update its performance measure for the CFATS program to evaluate security measures implemented both when a facility submits its initial security plan and again when DHS approves its final security plan. However, GAO found that DHS's new performance measure methodology does not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process. Doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the CFATS program as a whole. DHS shares some CFATS information, but first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. Facilities are currently required to report some chemical inventory information, but GAO found that over 200 CFATS chemicals may not be covered by these requirements. To improve access to information, DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting. However, GAO found that the IP Gateway is not widely used at the local level. In addition, officials from 13 of the 15 Local Emergency Planning Committees—consisting of first responders and covering 373 CFATS high-risk facilities—told GAO they did not have access to CFATS data in the IP Gateway. By encouraging wider use of the IP Gateway, DHS would have greater assurance that first responders have information about high-risk facilities and the specific chemicals they possess. GAO recommends that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance; and (2) encourage access to and wider use of the IP Gateway among first responders and emergency planners. DHS concurred with both recommendations and outlined efforts underway or planned.