The CFATS program is intended to secure the nation’s chemical infrastructure by identifying and protecting high-risk chemical facilities. Section 550 of the DHS appropriations act for fiscal year 2007 requires DHS to issue regulations establishing risk-based performance standards for the security of facilities that the Secretary determines to present high levels of security risk. The CFATS rule was published in April 2007 and Appendix A to the rule, published in November 2007, listed 322 chemicals of interest and the screening threshold quantities amount for each. ISCD has direct responsibility for implementing DHS’s CFATS rule, including assessing risks and identifying high-risk chemical facilities, promoting effective security planning, and ensuring that high-risk facilities meet the applicable risk-based performance standards through site security plans approved by DHS. ISCD is managed by a Director and operates five branches that are, among other things, responsible for (1) information technology operations; (2) policy and planning; (3) providing compliance and technical support; (4) inspecting facilities and enforcing CFATS regulatory standards; and (5) managing logistics, administration, and chemical security training. From fiscal years 2007 through 2012, DHS dedicated about $442 million to the CFATS program. In fiscal year 2012, DHS was authorized 242 full-time equivalent positions. DHS’s CFATS rule outlines a specific process for administering the program. Any chemical facility that possesses any of the 322 chemicals in the quantities that meet or exceed the threshold quantity outlined in Appendix A of the rule is required to use DHS’s Chemical Security Assessment Tool (CSAT)—a web-based application through which owners and operators of chemical facilities provide information about the facility. Once a facility is registered in CSAT, owners and operators are to complete the CSAT Top Screen—which is the initial screening tool or document whereby the facility is to provide DHS various data, including the name and location of the facility and the chemicals and their quantities at the site. DHS is to analyze this information using its risk assessment approach, which is discussed in more detail below, to initially determine whether the facility is high risk. If so, DHS is to notify the facility of its preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4. Facilities preliminarily placed in any one of these tiers are considered to be high risk, with tier 1 facilities considered to be the highest risk. Facilities that DHS initially determines to be high risk are required to then complete the CSAT security vulnerability assessment, which includes the identification of potential critical assets at the facility and a related vulnerability analysis. DHS is to review the security vulnerability assessment and notify the facility of DHS’s final determination as to whether or not the facility is considered high risk, and if the facility is determined to be a high-risk facility, about its final placement in one of the four tiers. Once assigned a final tier, the facility is required to use CSAT to submit a site security plan or participate in an alternative security program in lieu of a site security plan. The security plan is to describe the security measures to be taken to address the vulnerabilities identified in the vulnerability assessment, and identify and describe how security measures selected by the facility are to address the applicable risk-based performance standards. DHS then is to conduct a preliminary review of the security plan to determine whether it meets the regulatory requirements. If these requirements appear to be satisfied, DHS is to issue a letter of authorization for the facility’s plan. DHS then is to conduct an authorization inspection of the facility and subsequently determine whether to approve the security plan. If DHS determines that the plan does not satisfy CFATS requirements, DHS then notifies the facility of any deficiencies and the facility must submit a revised plan correcting them. If the facility fails to correct the deficiencies, DHS may disapprove the plan. Following approval, DHS may conduct further inspections to determine if the facility is in compliance with its approved security plan.Figure 1 illustrates the CFATS regulatory process. ISCD uses a risk assessment approach during the early stages of the regulatory process to develop risk scores to assign chemical facilities to a final tier. According to an ISCD document that describes how ISCD develops its CFATS risk score, the risk score is intended to be derived from estimates of consequence (the adverse effects of a successful attack), threat (the likelihood of an attack), and vulnerability (the likelihood of a successful attack, given an attempt). The ISCD risk assessment approach is composed of three models, each based on a particular security issue: (1) release, (2) theft or diversion, and (3) sabotage, depending on the type of risk associated with the 322 chemicals of interest listed in Appendix A of the CFATS rule. For release, the model assumes that a terrorist will release the chemical of interest at the facility and then estimates the risk to the surrounding population. For theft or diversion, the model assumes that a terrorist will steal or have the chemical of interest diverted to him or herself and then estimates the risk of a terrorist attack using the chemical of interest in a way that causes the most harm at an unspecified off-site location. For sabotage, the model assumes that a terrorist will remove the chemical of interest from the facility and mix it with water, creating a toxic release at an unspecified off- site location, and then estimates the risk to a medium-sized U.S. city. Once ISCD estimates a risk score based on these models, it assigns the facility to a final tier. Since 2007, ISCD has assigned about 3,500 high-risk chemical facilities to final tiers and has taken action to identify and address problems with its risk-tiering approach. However, ISCD’s risk-tiering approach does not reflect all elements of risk. Specifically, ISCD is to assess risk using estimates of the consequences, threat, and vulnerability associated with a terrorist attack, but ISCD does not consider key elements of risk, such as economic consequences or facility vulnerability consistent with the NIPP and the CFATS rule. ISCD recognizes that its tiering approach is not complete and continues to mature and has begun to take actions to assess its approach, including commissioning an expert panel. In July 2007, ISCD began reviewing information submitted by the owners and operators of approximately 40,000 facilities. By January 2013, ISCD had designated about 4,400 of the 40,000 facilities as high risk and thereby covered by the CFATS rule. ISCD had assigned about 3,500 of those facilities to a final tier, of which about 90 percent were tiered because of the risk of theft or diversion. The remaining 10 percent were tiered because of the risk of release or the risk of sabotage. In addition, about 900 of the 4,400 facilities had been assigned to preliminary tiers and were to be assigned a final tier once ISCD processed data from the facility using ISCD’s risk assessment approach. ISCD officials noted that the number of tiered facilities and their individual tiers is likely to be fluid over time as changes in chemical holdings, production, processes, storage methods, or use occur. Table 1 shows the number and percentage of facilities assigned a final tier as of January 2013. Over the last 2 years, ISCD has identified problems with the way the release chemicals model assigns chemical facilities to tiers and has taken or begun to take action to address those problems. In February 2011, ISCD managers were notified by contracting officials responsible for running the model that some chemical facilities had been placed in an incorrect final tier because this model included incorrect data about the release of high-risk chemicals of interest. In June 2011, ISCD officials adjusted the model, lowering the tier for about 250 facilities, about 100 of which were subsequently removed from the CFATS program. In September 2012, ISCD officials stated that they were confident that the adjustment helped make this model more accurate. However, in October 2012, ISCD officials stated that they had discovered another anomaly that they were working to correct. Specifically, ISCD officials said that they had uncovered a defect that led the model to exclude population density calculations for about 150 facilities in states or U.S. territories outside the continental United States, including Alaska, Hawaii, Puerto Rico, and Guam. In December 2012, ISCD officials said that they had made adjustments to the model to resolve this issue. They added that they expected that once data from the approximately 150 facilities were assessed, no more than 11 of the approximately 150 facilities would be affected by a change to their tier. ISCD officials said that as of February 2013, upon further examination, they expect that about 2 facilities will be affected. However, those two facilities were already tiered for other chemicals covered by CFATS, and ISCD officials did not expect those facilities’ respective tiers to change. ISCD has tiered thousands of facilities using its current risk assessment approach, but ISCD’s risk assessment approach is not mature because it does not consider key elements of risk from the NIPP and the CFATS rule. According to the NIPP, which, among other things, establishes the framework for managing risk among the nation’s critical infrastructure, risk is a function of three components—consequence, threat, and vulnerability—and a risk assessment approach must assess each component for every defined risk scenario. Furthermore, the CFATS rule calls for ISCD to review consequence, threat, and vulnerability information in determining a facility’s final tier. However, ISCD’s risk assessment approach does not fully consider all of the core criteria or components of a risk assessment, as specified by the NIPP, nor does it comport with parts of the CFATS rule. ISCD’s risk assessment approach does not currently conform to the NIPP and is not consistent with the CFATS rule because it does not yet fully consider consequence criteria when assessing risk associated with a terrorist attack. The NIPP states that at a minimum, consequences should focus on the two most fundamental components—human consequences and the most relevant direct economic consequences.