Section 550 of the DHS appropriations act for fiscal year 2007 requires DHS to issue regulations establishing risk-based performance standards for the security of facilities that the Secretary determines to present high levels of security risk, among other things. The CFATS rule was published in April 2007, and appendix A to the rule, published in November 2007, listed 322 chemicals of interest and the screening threshold quantities for each. ISCD has direct responsibility for implementing DHS’s CFATS rule, including assessing potential risks and identifying high-risk chemical facilities, promoting effective security planning, and ensuring that final high-risk facilities meet applicable standards through site security plans approved by DHS. From fiscal years 2007 through 2012, DHS dedicated about $442 million to the CFATS program. During fiscal year 2012, ISCD was authorized 242 full-time- equivalent positions. ISCD uses a risk assessment approach to develop risk scores to assign chemical facilities to one of four final tiers. Facilities placed in one of these tiers (tier 1, 2, 3, or 4) are considered to be high risk, with tier 1 facilities considered to be the highest risk. According to an ISCD document that describes how ISCD develops its CFATS risk score, the risk score is intended to be derived from estimates of consequence (the adverse effects of a successful attack), threat (the likelihood of an attack), and vulnerability (the likelihood of a successful attack, given an attempt). ISCD’s risk assessment approach is composed of three models, each based on a particular security issue: (1) release, (2) theft or diversion, and (3) sabotage, depending on the type of risk associated with the 322 chemicals. Once ISCD estimates a risk score based on these models, it assigns the facility to a final tier. In July 2007, ISCD began reviewing information submitted by the owners and operators of approximately 40,000 facilities. By January 2013, ISCD had designated about 4,400 of the 40,000 facilities as high risk and thereby covered by the CFATS rule. ISCD had assigned about 3,500 of those facilities to a final tier, of which about 90 percent were tiered because of the risk of theft or diversion. The remaining 10 percent were tiered because of the risk of release or the risk of sabotage. Over the last 2 years, ISCD has identified problems with the way the release chemicals model assigns chemical facilities to tiers and has taken or begun to take action to address those problems. In February 2011, ISCD found that some chemical facilities had been placed in an incorrect final tier because this model included incorrect data about the release of high-risk chemicals of interest. In June 2011, ISCD officials adjusted the model, which resulted in lowering the tier for about 250 facilities, about 100 of which were subsequently removed from the CFATS program. In October 2012, ISCD officials stated that they had uncovered another defect that led the model to exclude population density calculations for about 150 facilities in states or U.S. territories outside the continental United States, including Alaska, Hawaii, Puerto Rico, and Guam. In February 2013, ISCD officials said that they had made adjustments to the model to resolve this issue and do not expect any facilities’ tier will change due to this issue. Our preliminary analyses indicates that the tiering approach ISCD uses to assess risk and assign facilities to final tiers does not consider all of the elements of risk associated with a terrorist attack involving certain chemicals. According to the NIPP, which, among other things, establishes the framework for managing risk among the nation’s critical infrastructure, risk is a function of three components—consequence, threat, and vulnerability—and a risk assessment approach must assess each component for every defined risk scenario. Furthermore, the CFATS rule calls for ISCD to review consequence, threat, and vulnerability information in determining a facility’s final tier. However, ISCD’s risk assessment approach does not fully consider all of the core criteria or components of a risk assessment, as specified by the NIPP, nor does it comport with parts of the CFATS rule.  Consequence. The NIPP states that at a minimum, consequences should focus on the two most fundamental components—human consequences and the most relevant direct economic consequences. The CFATS rule states that chemical facilities covered by the rule are those that present a high risk of significant adverse consequences for human life or health, or critical economic assets, among other things, if subjected to terrorist attack, compromise, infiltration, or exploitation. Our review of ISCD’s risk assessment approach and discussions with ISCD officials shows that the approach is currently limited to focusing on one component of consequences—human casualties associated with a terrorist attack involving a chemical of interest—and does not consider consequences associated with economic criticality. ISCD officials said that the economic consequences part of their risk-tiering approach will require additional work before it is ready to be introduced. In September 2012, ISCD officials stated that they had engaged Sandia National Laboratories to examine how ISCD could gather needed information and determine the risk associated with economic impact, but this effort is in the initial stages, with an expected completion date of June 2014. ISCD officials added they are uncertain about how Sandia’s efforts will affect their risk assessment approach.  Threat. ISCD’s risk assessment approach is also not consistent with the NIPP because it does not consider threat for the majority of regulated facilities. According to the NIPP, risk assessments should estimate threat as the likelihood that the adversary would attempt a given attack method against the target. The CFATS rule requires that, as part of assessing site vulnerability, facilities conduct a threat assessment, which is to include a description of the internal, external, and internally assisted threats facing the facility and that ISCD review site vulnerability as part of the final determination of a facility’s tier. Our review of the models and discussions with ISCD officials shows that (1) ISCD is inconsistent in how it assesses threat using the different models because while it considers threat for the 10 percent of facilities tiered because of the risk of release or sabotage, it does not consider threat for the approximately 90 percent of facilities that are tiered because of the risk of theft or diversion; and (2) ISCD does not use current threat data for the 10 percent of facilities tiered because of the risk of release or sabotage. ISCD did not have documentation to show why threat had not been factored into the formula for approximately 90 percent of facilities tiered because of the risk of theft or diversion. However, ISCD officials pointed out that the cost of adding a threat analysis for these facilities might outweigh the benefits of doing so. ISCD officials said that given the complexity of assessing threat for theft or diversion, they are considering reexamining their approach. ISCD officials also said that they are exploring how they can use more current threat data for the 10 percent of facilities tiered because of the risk of release or sabotage.  Vulnerability. ISCD’s risk assessment approach is also not consistent with the NIPP because it does not consider vulnerability when developing risk scores. According to the NIPP, risk assessments should identify vulnerabilities, describe all protective measures, and estimate the likelihood of an adversary’s success for each attack scenario. Similar to the NIPP, the CFATS rule calls for ISCD to review facilities’ security vulnerability assessments as part of its risk-based tiering process. This assessment is to include the identification of potential security vulnerabilities and the identification of existing countermeasures and their level of effectiveness in both reducing identified vulnerabilities and meeting the aforementioned risk-based performance standards. Our review of the risk assessment approach and discussions with ISCD officials shows that the security vulnerability assessment contains numerous questions aimed at assessing vulnerability and security measures in place but the information is not used to assign facilities to risk-based tiers. ISCD officials said they do not use the information because it is “self- reported” by facilities and they have observed that it tends to overstate or understate vulnerability. As a result, ISCD’s risk assessment approach treats every facility as equally vulnerable to a terrorist attack regardless of location and on-site security. ISCD officials told us that they consider facility vulnerability, but at the latter stages of the CFATS regulatory process particularly with regard to the development and approval of the facility site security plan. Our preliminary work indicates that ISCD has begun to take some actions to examine how its risk assessment approach can be enhanced. For example, in addition to engaging Sandia National Laboratories to develop the framework for assessing economic consequences previously discussed, ISCD has commissioned a panel of subject matter experts to examine the strengths and weaknesses of its current risk assessment approach. ISCD officials stated that the panel’s work is intended to focus on whether ISCD is heading in the right direction, and they view it as a preliminary assessment. According to ISCD’s task execution plan, the panel is to provide actionable recommendations on potential improvements to the CFATS models, but the panel is not to develop alternative CFATS models or formally validate or verify the current CFATS risk assessment approach—steps that would analyze the structure of the models and determine whether they calculate values correctly. In February 2013, after the panel was convened, ISCD officials stated that they provided information to the panel about various issues that they might want to consider, among them, (1) how to address vulnerability in the models given ISCD concerns about data quality, and (2) what the appropriate variables to use, if any, are for threats associated with theft or diversion, as discussed earlier. We believe that ISCD is moving in the right direction by commissioning the panel to identify the strengths and weaknesses of its risk assessment approach, and the results of the panel’s work could help ISCD identify issues for further review and recommendations for improvement.