The CFATS program is intended to ensure the security of the nation’s chemical infrastructure by identifying, assessing the risk posed by, and requiring the implementation of measures to protect high-risk chemical facilities. Section 550 of the DHS Appropriations Act, 2007, required DHS to issue regulations establishing risk-based performance standards for chemical facilities that, as determined by DHS, present high levels of risk, and required vulnerability assessments and the development and implementation of site security plans for such facilities.the CFATS interim final rule in April 2007 and appendix A to the rule, DHS published published in November 2007, lists 322 chemicals of interest (COI) and the screening threshold quantities amount for each. According to DHS and subject to certain statutory exclusions, all facilities that manufacture chemicals of interest as well as facilities that store or use such chemicals as part of their daily operations may be subject to CFATS. In general, however, only chemical facilities determined to possess a requisite quantity of COI (that is, the screening threshold quantity) and that are subsequently determined to present high levels of security risk—that is, covered facilities—are subject to the more substantive requirements of the CFATS regulation. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, enacted in December 2014, amended the Homeland Security Act of 2002 by adding the Chemical Facility Anti- Terrorism Standards as Title XXI and, in effect, authorizing the program for an additional 4 years. Among other things, the Act expressly repeals DHS’s authority to implement the program under section 550 of the DHS Appropriations Act, 2007, but also expressly provides that the CFATS regulation promulgated under that authority shall remain in effect unless otherwise amended, consolidated, or repealed. Consequently, while the Act imposes new and additional responsibilities on DHS to implement the CFATS program, the program continues to be implemented by ISCD under the existing regulatory framework. In addition to implementing the CFATS program, ISCD is also to manage the Ammonium Nitrate Security Program—a program DHS is to establish pursuant to section 563 of the DHS Appropriations Act, 2008. While the CFATS program covers facilities with certain thresholds of ammonium nitrate, the Ammonium Nitrate Security Program is to regulate the sale and transfer of ammonium nitrate by an ammonium nitrate facility for the purpose of preventing the misappropriation or use of ammonium nitrate in an act of terrorism. Among other things, the statute authorizing the ammonium nitrate program authorizes DHS to require individuals who purchase, sell, or transfer ammonium nitrate to register with DHS and submit to vetting against the Terrorist Screening Database, and requires the owners of ammonium nitrate facilities to maintain records on each sale or transfer of ammonium nitrate and to report any identified theft or loss of ammonium nitrate to appropriate federal authorities. DHS issued a proposed rule for the Ammonium Nitrate Security Program in August 2011 and, as of July 2015, has yet to establish the program. The CFATS regulation outlines how ISCD is to administer the CFATS program. Specifically, any facility that possess any of the 322 chemicals of interest (COI) in quantities that meet or exceed the screening threshold quantities established by DHS for those COI are required to use ISCD’s Chemical Security Assessment Tool (CSAT)—a web-based application through which owners and operators of facilities with COI are to provide information about the facility—to complete a Top-Screen. The Top- Screen is the initial screening tool whereby a chemical facility in possession of a COI at the requisite thresholds is to provide ISCD data, including the name and location of the facility and the chemicals and their quantities at the site. ISCD’s risk assessment approach, which relies on data from the Top- Screen, among other sources, is based on three security issues: (1) release (toxic, flammable, and explosive) chemicals with the potential for impacts within and beyond a facility; (2) theft or diversion; and (3) sabotage, depending on the type of risk associated with the COI. Release: For the release threat, ISCD’s approach assumes that a terrorist will release the COI at the facility and then estimates the risk to the facility and surrounding population. Facilities with toxic release chemicals are to calculate and report in their Top-Screen submission the Distance of Concern—which represents the radius of an area in which exposure to a toxic chemical cloud from a release event could cause serious injury or fatalities from short-term exposure. ISCD uses the Distance of Concern to estimate the number of fatalities from an intentional toxic release and to categorize the risk posed by this facility. The Top-Screen directs respondents to use an online tool called RMP*Comp to calculate the Distance of Concern.RMP*Comp takes inputs such as the quantity of chemical that could be released and the surrounding terrain type to determine the Distance of Concern. Theft or diversion: For theft or diversion, the approach assumes that a terrorist will steal or have the COI diverted to him or herself and then estimates the risk of a terrorist attack using the COI to cause the most harm at an unspecified off-site location. Sabotage: For sabotage, the approach assumes that a terrorist will cause water to be mixed with a COI that is shipped from the facility, creating a toxic release at an unspecified location, and then estimates the risk to a medium-sized U.S. city. If, according to ISCD’s automated assessment of information provided via the Top-Screen, the facility is preliminarily categorized to be high-risk it becomes a “covered chemical facility,” and ISCD is to notify the facility of its preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4. If ISCD does not categorize the chemical facility as high-risk, ISCD does not assign the facility to one of these four risk-based tiers and the facility is not subject to additional requirements under the CFATS regulation.Facilities that ISCD preliminarily categorizes to be high-risk—covered chemical facilities—are required to then complete the CSAT security vulnerability assessment, which includes the identification of potential critical assets at the facility, and a related vulnerability analysis.to review the security vulnerability assessment to confirm and notify the facility as to whether the facility remains categorized as high-risk and, if so, about its final placement in one of the four tiers. Once a covered chemical facility is assigned a final tier, the facility may use CSAT to submit a site security plan (SSP) or submit an Alternative Security Program in lieu of the CSAT SSP. The security plan is to describe the existing and planned security measures to be implemented to address the vulnerabilities identified in the security vulnerability assessment, and identify and describe how existing and planned security measures selected by the facility are to address the applicable risk-based performance standards. To meet risk-based performance standards, covered facilities may choose the security programs or processes they deem appropriate to address the performance standards so long as ISCD determines that the facilities achieve the requisite level of performance on each of the applicable areas in their existing and agreed-upon planned measures. To determine whether facilities achieve the requisite level of performance for each of the applicable areas, ISCD is to conduct a preliminary review of the facility’s security plan to determine whether it meets the risk-based regulatory requirements. If these requirements appear to be satisfied, ISCD is to issue a letter of authorization for the plan, and conduct an authorization inspection of the facility to determine whether to approve the plan. Upon inspection of the facility, if ISCD determines that the plan satisfies the CFATS requirements, it will issue a letter of approval to the facility, which is to then implement the approved SSP. If ISCD determines that the plan does not satisfy CFATS requirements, ISCD then notifies the facility of any deficiencies and the facility must submit a revised plan for correcting them. See 6 C.F.R. § 27.250. in compliance with their approved SSP or whether to take enforcement actions. Figure 1 illustrates the CFATS regulatory process. Since 2007, when ISCD began identifying chemical facilities to determine which facilities present a high risk and therefore should be subject to further regulation under CFATS, about 37,000 facilities have submitted a Top-Screen but ISCD officials acknowledged some facilities may have failed to do so. According to these officials, as of April 2015, ISCD had received most Top-Screens within the first 3 years of the program; specifically, ISCD received about 88 percent of Top-Screens from 2007 through 2009. ISCD officials told us they believe the 37,000 facilities that have submitted Top-Screens represent most facilities subject to CFATS. However, as we previously reported, ISCD officials have acknowledged some facilities may not comply with the requirement to submit a Top-Screen and therefore some facilities may not be included in ISCD’s data, but the magnitude of potential Top-Screen noncompliance is not known. In response to Executive Order 13650, in May 2014, ISCD outlined a number of efforts it had taken and planned to take to identify potentially noncompliant chemical facilities. These efforts included comparing facilities data from relevant federal partners and from state entities against ISCD’s current database of chemical facilities to identify potentially noncompliant chemical facilities, among others. ISCD officials told us ISCD consulted with the Occupational Safety and Health Administration; the Department of Transportation; the Department of Agriculture; the Bureau of Alcohol, Tobacco, Firearms and Explosives; and the Environmental Protection Agency (EPA) to determine the extent to which ISCD could identify all chemical facilities using data held by those agencies. According to ISCD officials, ISCD also reached out to all 50 states’ Homeland Security Advisors to request lists of chemical facilities maintained by the states.