Critical Infrastructure Protection: Progress and Challenges in DHS's Management of Its Chemical Facility Security Program

What GAO Found

The Department of Homeland Security (DHS) has made progress addressing challenges that GAO's past work identified to managing the Chemical Facility Anti-Terrorism Standards (CFATS) program. The following summarizes progress made and challenges remaining in key aspects of the program.

Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS used self-reported and unverified data to determine the risk of facilities holding toxic chemicals that could threaten surrounding communities if released. GAO recommended that DHS should better verify the accuracy of facility-reported data. DHS implemented this recommendation by revising its methodology so it now calculates the risk of toxic release, rather than relying on facilities to do so.

Assessing risk and prioritizing facilities. In April 2013, GAO reported weaknesses in multiple aspects of DHS's risk assessment and prioritization approach. GAO made two recommendations for DHS to review and improve this process, including that DHS enhance its risk assessment approach to incorporate all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. DHS launched a new risk assessment methodology in October 2016 and is currently gathering new or updated data from about 27,000 facilities to (1) determine which facilities should be categorized as high-risk because of the threat of sabotage, theft or diversion, or a toxic release and (2) assign those facilities deemed high risk to one of four risk-based tiers. GAO has ongoing work assessing these efforts and will report later this summer on the extent to which they fully address prior recommendations.

Reviewing and approving facilities' site security plans. DHS is to review security plans and visit facilities to ensure their security measures meet DHS standards. In April 2013, GAO reported a 7 to 9 year backlog for these reviews and visits. In July 2015, GAO reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS has since taken additional action to expedite these activities and has eliminated this backlog.

Inspecting facilities and ensuring compliance. In July 2015, GAO reported that DHS conducted compliance inspections at 83 of the 1,727 facilities with approved security plans. GAO found that nearly half of the inspected facilities were not fully compliant with their approved security plans and that DHS did not have documented procedures for managing facilities' compliance. GAO recommended that DHS document procedures for managing compliance. As a result, DHS has developed an enforcement procedure and a draft compliance inspection procedure and expects to finalize the compliance inspection procedure by the end of fiscal year 2018.

Why GAO Did This Study

Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. In accordance with the DHS Appropriations Act, 2007, DHS established the CFATS program in 2007 to, among other things, identify and assess the security risk posed by chemical facilities. DHS inspects high-risk facilities after it approves facility security plans to ensure that the facilities are implementing required security measures and procedures.

This statement summarizes progress and challenges related to DHS's CFATS program management. This statement is based on prior products GAO issued from July 2012 through June 2017, along with updates conducted in June 2018 on DHS actions to address prior GAO recommendations. To conduct the prior work, GAO reviewed relevant laws, regulations, and DHS policies for administering the CFATS program, how DHS assesses risk, and data on high-risk chemical facilities. GAO also interviewed DHS officials and reviewed information on DHS actions to implement its prior recommendations.