link to page 1 link to page 1 link to page 1 
Updated January 28, 2019
Chemical Facility Anti-Terrorism Standards
State and federal governments have long regulated safety
Transportation Security Act of 2002 (P.L. 107-295). Any
practices at facilities that store large amounts of hazardous
non-excluded facility that possesses more than a defined
chemicals to reduce the risk of harm from an accidental
threshold of any of the 322 “chemicals of interest” (6
release. In 2006, the Department of Homeland Security
C.F.R. Part 27, Appendix A) must submit information to
Appropriations Act, 2007 (P.L. 109-295) authorized the
DHS through an online survey known as Top-Screen. DHS
Department of Homeland Security (DHS) to regulate
uses Top-Screen data to determine each facility’s risk level.
security practices at chemical facilities to reduce the risk of
Only facilities DHS deems high risk must meet the risk-
terrorists triggering an intentional release or stealing
based performance standards. As of December 2018,
chemicals for use in attacks elsewhere. Subsequently,
approximately 40,000 unique facilities had submitted Top-
Congress extended and modified this authority through the
Screen data. DHS has determined that 3,355 (~8%) of these
Protecting and Securing Chemical Facilities from Terrorist
are high-risk facilities.
Attacks Act of 2014 (P.L. 113-254). This authority is
currently set to expire in April 2020.
DHS assigns each high-risk facility to one of four graduated
risk tiers (Figure 1). About 5% of the high risk facilities are
Chemical Facility Anti-Terrorism
in the highest tier, Tier 1.
Standards
In 2007, DHS promulgated the Chemical Facilities Anti-
Figure 1. CFATS Facility Risk Tier Distribution
Terrorism Standards (CFATS, 6 C.F.R. Part 27). These
regulations require certain “high-risk” chemical facilities to
meet risk-based performance standards in 18 areas (Table
1). The statute does not permit DHS to require any
particular security measure. Facilities may implement any
security program or process that adequately meets the
requisite performance level for its risk level.
Each covered facility must meet standards based on its
specific risk, i.e., higher risk facilities must meet more
stringent standards than lower risk facilities.
Table 1. CFATS Risk-Based Performance Standards
Restrict Area
Monitoring
Perimeter
Training
Secure Site Assets
Personnel Surety
Screen and Control
Elevated Threats
Access
Specific Threats,
Deter, Detect, and
Vulnerabilities, or Risks
Delay
Reporting of Significant
Source: CRS. Adapted from U.S. Government Accountability Office,
Shipping, Receipt, and
Security Incidents
Critical Infrastructure Protection: DHS Should Take Actions to Measure
Storage
Reduction in Chemical Facility Vulnerability and Share Information with First
Significant Security
Theft and Diversion
Incidents and Suspicious
Responders, GAO-18-538, August 2018.
Each covered facility must prepare and submit a Security
Sabotage
Activities
Vulnerability Assessment that describes its vulnerability to
Cyber
Officials and Organization
DHS-defined attack scenarios and a Site Security Plan that
Response
Records
details how the facility will meet each of the 18 risk-based
Source: 6 C.F.R. §27.230
performance standards appropriate for its risk tier.
Following evaluation of the Site Security Plan and an on-
Covered Facilities
site authorization inspection, DHS may issue a letter of
Most chemical facilities do not have to meet these
approval. The approved facilities must implement the Site
standards. The statute specifically excludes all facilities
Security Plan and conduct annual implementation audits.
defined as a water system or waste water treatment works,
DHS inspects each covered site every two years.
owned or operated by the Department of Defense or
Department of Energy, regulated by the Nuclear Regulatory
Commission, or regulated under the Maritime
https://crsreports.congress.gov
Chemical Facility Anti-Terrorism Standards
Potential Reauthorization Issues
Inherently Safer Technologies
The 116th Congress will consider whether the CFATS
The term inherently safer technologies refers to the concept
authority should be reauthorized, modified, or allowed to
of chemical facilities lowering risk by making changes such
expire.
as switching to non-CFATS regulated chemicals, or using
lower concentrations or amounts of regulated chemicals.
Congress may consider whether the CFATS and associated
Proposals that would have required chemical facilities to
regulations appropriately balance homeland security and
adopt inherently safer technologies were debated during
stakeholder needs. Congress may also consider how well
previous congressional CFATS consideration, but were not
DHS has implemented the program and whether the
included in the statute. Similar proposals are likely to be
implementation is aligned with current congressional intent.
considered during any reauthorization debate. Some of the
past criticism of a proposed statutory requirement to adopt
If Congress decides to reauthorize, it may also consider
inherently safer technology focused on the difficulty the
modifying aspects of the program.
government would have determining useful requirements
that could feasibly be applied given the complicated context
Reauthorization
of each facility and process.
Complying with this program imposes significant costs on
regulated facilities. Additionally, DHS spends
Even without a legal requirement, hundreds of facilities
approximately $70 million annually implementing CFATS.
have adopted changes to move from regulated to non-
Congress might decide that these costs outweigh the
regulated status or to lower their high-risk tier. DHS has
benefits and allow the CFATS program to end. Although
identified some common approaches that these facilities
this would lower the recurring costs of compliance for the
have adopted and has disseminated information about these
currently regulated facilities, it would not affect the sunk
practices to the regulated community. Regulated and
costs for changes to processes and security infrastructure
potentially regulated facilities can factor in this information
that facilities have already spent to come into initial
when determining the potential costs and benefits of such
compliance. Those costs and process changes might place
practices in the context of their individual security, safety,
formerly regulated facilities at a competitive disadvantage
efficiency, and other business needs.
to facilities entering the market after the CFATS program
ends.
Options for congressional consideration include requiring
DHS to establish inherently safer technology standards;
Make Authority Permanent?
codifying DHS’s current practice of disseminating lessons
Congress specifically established a termination date for this
learned; or continuing to allow DHS the discretion to
program when it codified the previously existing DHS
continue or change its programs as it sees fit.
CFATS program through the Protecting and Securing
Chemical Facilities from Terrorist Attacks Act of 2014
New Risk Assessment Implementation
(P.L. 113-254). Additionally, the 116th Congress decided to
In 2013, the Government Accountability Office (GAO) and
maintain a termination date when it enacted the Chemical
the DHS-funded Homeland Security Studies and Analysis
Facility Anti-Terrorism Standards Program Extension Act
Institute (HSSAI) published reports recommending changes
(H.R. 251) to extend the program to April 2020. Including a
to the DHS chemical facility risk assessment methodology.
termination date in a reauthorization of the program would
DHS implemented changes to its risk assessment engine
require a future Congress to make an affirmative decision
and the web portal for collecting Top-Screen information
that the program is worthy of continuance. However,
from facilities in 2017. GAO asserts that this new
retaining a termination date might also increase uncertainty
methodology addresses both sets of recommendations.
for the regulated community.
DHS predicted that changing the risk assessment
Modify Exclusions?
methodology would cause some high-risk facilities to
The current statute exempts some public water systems and
change tiers and some facilities to become newly
waste water treatment works from CFATS regulations. In
designated as high risk. According to data DHS provided to
2011, DHS estimated that this exempted 6,000 high-risk
GAO, the new risk methodology changed the tier
facilities and represented a critical gap in CFATS coverage.
assignment of 48% of facilities. An additional 1,154
Lifting this exclusion could nearly triple the number of
facilities became newly designated as high risk while 430
regulated facilities.
facilities were removed from the high-risk category.
Representatives of the water sector have previously asserted
These changes represent additional costs for both the
that their role in public health and safety could make
regulated community and DHS.
sanctions under CFATS counterproductive. They cite, for
example, loss of public sanitation, potable water, and fire
Frank Gottron, Specialist in Science and Technology
protection if DHS ordered a water or waste water utility to
Policy
cease operations for security reasons or failure to comply
with the CFATS regulations.
IF10853
https://crsreports.congress.gov
Chemical Facility Anti-Terrorism Standards
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF10853 · VERSION 5 · UPDATED