Critical Infrastructure Protection: Preliminary Observations on DHS Efforts to Assess Chemical Security Risk and Gather Feedback on Facility Outreach

What GAO Found

Since 2007, the Department of Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD) has assigned about 3,500 high-risk chemical facilities to risk-based tiers under its Chemical Facilities Anti-Terrorism Standards (CFATS) program, but it has not fully assessed its approach for doing so. The approach ISCD used to assess risk and make decisions to place facilities in final tiers does not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. For example, the risk assessment approach is based primarily on consequences arising from human casualties, but does not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation, nor does it include vulnerability, consistent with the NIPP. ISCD has begun to take some actions to examine how its risk assessment approach can be enhanced. Specifically, ISCD has, among other things, engaged Sandia National Laboratories to examine how economic consequences can be incorporated into ISCD's risk assessment approach and commissioned a panel of experts to assess the current approach, identify strengths and weaknesses, and recommend improvements. Given the critical nature of ISCD's risk assessment approach in laying the foundation for further regulatory steps in improving facility security, it is important that its approach for assigning facilities to tiers is complete within the NIPP risk management framework and the CFATS regulation.

DHS's ISCD has revised its process for reviewing facilities' site security plans-- which are to be approved by ISCD before it performs compliance inspections-- but it did not track data on the prior process so is unable to measure any improvements. The past process was considered by ISCD to be difficult to implement and caused bottlenecks in approving plans. ISCD views its revised process to be a significant improvement because, among other things, teams of experts review parts of the plans simultaneously rather than sequentially, as occurred in the past. Moving forward, ISCD intends to measure the time it takes to complete reviews, but will not be able to do so until the process matures. Using ISCD's expected plan approval rate of 30 to 40 plans a month, GAO estimated that it could take another 7 to 9 years before ISCD is able to complete reviews on the approximately 3,120 plans in its queue. ISCD officials said that they are exploring ways to expedite the process, such as reprioritizing resources.

DHS's ISCD has also taken various actions to work with facility owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but trade associations that responded to GAO's query had mixed views on the effectiveness of ISCD's outreach. ISCD solicits informal feedback from facility owners and operators on its efforts to communicate and work with them, but it does not have an approach for obtaining systematic feedback on its outreach activities. Prior GAO work on customer service efforts in the government indicates that systematic feedback from those receiving services can provide helpful information as to the kind and quality of services they want and their level of satisfaction with existing services. GAO will continue to assess ISCD's efforts in these areas and consider any recommendations needed to address these issues. GAO expects to issue a report on its results in April 2013.

Why GAO Did This Study

Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program in 2007 to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, which manages the program, places high-risk facilities in risk-based tiers and is to conduct inspections after it approves facility security plans. A November 2011 ISCD internal memorandum raised concerns about ISCD's ability to fulfill its mission.

This statement is based on GAO's ongoing work conducted for several congressional committees and subcommittees and provides preliminary observations regarding the extent to which DHS has (1) assigned chemical facilities to tiers and assessed its approach for doing so, (2) revised its process to review facility security plans, and (3) communicated and worked with owners and operators to improve security. To conduct this ongoing work, GAO reviewed DHS reports and plans on risk assessments, security plan reviews, and facility outreach and interviewed DHS officials. GAO received input from 11 trade associations representing chemical facilities about ISCD outreach. The results of this input are not generalizable but provide insights about DHS outreach efforts.

For more information, contact Stephen L. Caldwell at (202) 512-9610 or CaldwellS@gao.gov.