Recognizing the potential harm that a large, sudden release of hazardous chemicals poses to nearby people, state and federal governments have long regulated safety practices at chemical facilities. Historically, chemical facilities have engaged in security activities on a voluntary basis. Even before the terrorist attacks of 2001, congressional policy makers expressed concern over the security vulnerabilities of these facilities. After the 2001 attacks and the decision by several states to begin regulating security at chemical facilities, Congress again considered requiring federal security regulations to mitigate these risks. In 2006, the 109 th Congress passed legislation providing the Department of Homeland Security (DHS) with statutory authority to regulate chemical facilities for security purposes. Subsequent Congresses have extended this authority, which currently expires on December 13, 2014. Advocacy groups, stakeholders, and policy makers have called for Congress to reauthorize this authority, though they disagree about the preferred approach. The 113 th Congress has passed H.R. 4007 , which provides new statutory authority through the Homeland Security Act and extends the termination date of this authority for four years. The explosion on April 17, 2013, at the West Fertilizer Company fertilizer distribution facility in West, TX, has led to additional focus on DHS's ability to identify noncompliant facilities. The West Fertilizer Company had not reported to DHS under the CFATS program, though it appeared to have possessed more than screening threshold quantities of chemicals of interest. While DHS had engaged in previous activity to identify facilities that had not complied with CFATS reporting requirements, DHS did not identify the West Fertilizer Company. Congressional policy makers have questioned the sufficiency of DHS efforts to identify these noncompliant "outlier" facilities. This report provides a brief overview of the existing statutory authority and implementing regulation. It describes several policy issues raised in previous debates regarding chemical facility security and identifies policy options for congressional consideration. For additional analysis of CFATS implementation, see CRS Report R43346, Implementation of Chemical Facility Anti-Terrorism Standards (CFATS): Issues for Congress . The 109 th Congress provided DHS with statutory authority to regulate chemical facilities for security purposes. The statute explicitly identified some DHS authorities and left other aspects to the discretion of the Secretary of Homeland Security. The statute contains a "sunset provision" that causes the statutory authority to expire on December 13, 2014. This section reviews the chemical facility security statute and regulation, focusing on the regulatory compliance process. The 113 th Congress has passed H.R. 4007 , which will provide new statutory authority through the Homeland Security Act to regulate chemical facilities for security purposes. The regulations issued by DHS under the authority of previous statutory authority may be used to implement the new authority, and DHS may issue additional regulation to implement the new authorities. On April 9, 2007, DHS issued an interim final rule regarding the chemical facility anti-terrorism standards (CFATS). This interim final rule entered into force on June 8, 2007. The interim final rule implements statutory authority explicit in P.L. 109-295 , Section 550, and authorities DHS found that Congress implicitly granted. In promulgating the interim final rule, DHS interpreted the language of the statute to determine what DHS asserts was the intent of Congress. Consequently, much of the rule arises from the Secretary's discretion and interpretation of legislative intent rather than explicit statutory language. Under the interim final rule, the Secretary of Homeland Security determines which chemical facilities must meet regulatory security requirements, based on the degree of risk posed by each facility. The DHS lists 322 "chemicals of interest" for the purposes of compliance with CFATS. The DHS considers each chemical in the context of three threats: release; theft or diversion; and sabotage and contamination. Chemical facilities with greater than specified quantities, called screening threshold quantities, of chemicals of interest must submit information to DHS to determine the facility's risk status. See Figure 1 . The statute exempts several types of facilities from this requirement: facilities defined as a water system or wastewater treatment works; facilities owned or operated by the Department of Defense or Department of Energy; facilities regulated by the Nuclear Regulatory Commission (NRC); and those facilities regulated under the Maritime Transportation Security Act of 2002 ( P.L. 107-295 ). Based on the information received from the facility, DHS determines whether a facility is or is not high-risk. Facilities that DHS deems high risk must meet CFATS requirements. The DHS assigns high-risk facilities into one of four tiers based on the magnitude of the facility's risk. Facilities in higher risk tiers must meet more stringent requirements. The statute mandated the use of performance-based security requirements. The DHS created graduated performance-based requirements for facilities assigned to each risk-based tier. All high-risk facilities must perform a security vulnerability assessment, develop an effective site security plan, submit these documents to DHS, and implement their security plan. The security vulnerability assessment serves two purposes under the interim final rule. One is to determine or confirm the placement of the facility in a risk-based tier. The other is to provide a baseline against which to evaluate the site security plan activities. The site security plans must address the security vulnerability assessment by describing how activities in the plan correspond to securing facility vulnerabilities. Additionally, the site security plan must address preparations for and deterrents against specific modes of potential terrorist attack, as applicable and identified by DHS. The site security plans must also describe how the activities taken by the facility meet the risk-based performance standards provided by DHS. The DHS must review and approve the submitted documents, audit and inspect chemical facilities, and determine regulatory compliance. The DHS may disapprove submitted security vulnerability assessments or site security plans that fail to meet DHS performance-based standards, but not because of the presence or absence of a specific security measure. In the case of disapproval, DHS must identify in writing those areas of the assessment and/or plan that need improvement. Owners or operators of chemical facilities may appeal disapproval of site security plans to DHS. Similarly, if, after inspecting a chemical facility, DHS finds the facility not in compliance, the Secretary must write to the facility explaining the deficiencies found, provide an opportunity for the facility to consult with DHS, and issue an order to the facility to comply by a specified date. If the facility continues to be out of compliance, DHS may fine and, eventually, order the facility to cease operation. The interim final rule establishes the process by which chemical facilities can appeal such DHS decisions and rulings, but the statute prohibits third-party suits for enforcement purposes. The statute requires certain protections for information developed in compliance with this act. The interim final rule creates a category of information exempted from disclosure under the Freedom of Information Act (FOIA) and comparable state and local laws. The DHS named this category of information "Chemical-terrorism Vulnerability Information" (CVI). Information generated under the interim final rule, as well as any information developed for chemical facility security purposes identified by the Secretary, comprise this category. Judicial and administrative proceedings shall treat CVI as classified information. The DHS asserts sole discretion regarding who will be eligible to receive CVI. Disclosure of CVI may be punishable by fine. The interim final rule states it preempts state and local regulation that "conflicts with, hinders, poses an obstacle to, or frustrates the purposes of" the federal regulation. States, localities, or affected companies may request a decision from DHS regarding potential conflict between the regulations. Since DHS promulgated the interim final rule, Congress amended P.L. 109-295 , Section 550, to state that such preemption will occur only in the case of an "actual conflict." The DHS has not issued revised regulations addressing this change in statute. The National Protection and Programs Directorate (NPPD) within DHS is responsible for chemical facility security regulations. In turn, the Office of Infrastructure Protection, through its Infrastructure Security Compliance Division (ISCD), oversees the CFATS program within NPPD. This section reviews implementation of the chemical facility security regulations, focusing on funding, the number of regulated facilities, rate of facility inspection, and reviews of DHS implementation efforts. The availability of staff, infrastructure, and funds is a key factor in implementing the CFATS program. Congress has not authorized specific appropriations for the CFATS program. As seen in Table 1 , the staffing and funding for this program generally increased since its creation, but decreased since FY2011. The full-time-equivalent (FTE) staffing peaked in FY2011 at 257 FTE. Appropriations for this program peaked in FY2010 at $103 million. When DHS received statutory authority to regulate chemical facilities in 2006, it did not possess a chemical facility security office or inspector cadre. The general increase in FTE over time reflects the creation and staffing of the office and the development of an inspector cadre. In February 2012, DHS testified that it had hired most of the inspector cadre. In March 2013, the DHS Inspector General reported that a working group within ISCD requested an additional 64 inspectors for FY2014 and FY2015 to increase the rate of facility inspection. According to the DHS Inspector General, this request was not approved. For FY2014, Congress appropriated $81 million for ISCD, an increase in funding from FY2013. The joint explanatory statement accompanying FY2014 appropriations also directed DHS to provide reports to Congress on CFATS implementation, coordination of chemical security responsibilities, how ISCD will improve its review process, and how NPPD is avoiding program duplication and is ensuring facility security in its personnel surety efforts. It also requires DHS provide a comprehensive update on efforts to address facilities not reporting under CFATS. The DHS has received more than 48,000 Top-Screen submissions from over 36,000 chemical facilities (step 4 in Figure 1 ). Of these facilities, DHS required more than 7,800 to submit a security vulnerability assessment to determine whether they were high-risk. From the submitted security vulnerability assessments, DHS currently identifies approximately 3,700 facilities as high-risk.