1. Chemical Facility Anti-Terrorism Standards (CFATS)
College and University Hazardous Materials Management Conference
August 2017

2. Why Chemical Facility Security?
DHS recognizes this Persistent and Evolving Threat
“Compelling Confirmation” that Chlorine Gas Used as Weapon in Syria
OPCW, September 10, 2014
A successful attack on some chemical facilities could potentially cause a significant number of deaths and injuries
Certain chemical facilities possess materials that could be stolen or diverted and used as or converted into weapons for use offsite
Death Toll in West, Texas, Fertilizer Explosion Rises to 15
NPR, April 23, 2013
French Authorities Hold Suspect in Beheading and Explosion at Chemical Plant
NYTimes, June 26, 2015
West, Texas, in Image courtesy of the Chemical Safety Board.

3. Why Chemical Facility Security?
Statutory Authority
In December 2006, Congress authorized the Department to regulate security at “high-risk” chemical facilities through the Appropriations Act of 2007
The Department developed the Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27, to implement this authority
In December 2014, Congress passed the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014
Extended the Department’s authority over security at high-risk chemical facilities
- To read the Act in its entirety, please visit
- Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014
Reauthorizes the CFATS Program for an additional four years
The act eliminates uncertainty and provides stability for industry to plan and invest in CFATS-related security measures
- The CFATS Act of 2014 preserves most of the existing regulations and provides additional provisions and changes to existing authorities to include:
Expedited Approval Program for facilities in Tier 3 and Tier 4
Changes to the Personnel Surety Program
Emergency Enforcement

4. The CFATS Regulation
CFATS follows a risk-based approach, allowing DHS to focus on high-risk chemical facilities in accordance with their specific level of risk
To determine if a facility is subject to CFATS, DHS looks at the unique circumstances faced by the facility
If the facility is in possession of threshold quantities of Appendix A Chemicals of Interest (COI), the facility must provide information to the Department to support risk assessment
This applies even if the facility does not consider itself a “chemical facility”—CFATS applies to hospitals, mines, universities, etc.

5. Am I Exempt? Facilities regulated by the Nuclear Regulatory Commission
Facilities owned by the Departments of Defense or Energy
Public water systems and water treatment works regulated under certain Federal water quality laws
Facilities regulated under the Maritime Transportation Security Act
Statutory Exemptions
In January 2008, DHS indefinitely extended the Top-Screen due date for agricultural production facilities
Agricultural Production Facilities
Agricultural Production Facilities: Published on January 9, The Department of Homeland Security published a letter that it issued on December 21, Through this letter, the Department granted a time extension for farmers and other agricultural users who would otherwise have been required to submit a Top-Screen consequence assessment through the secure online Chemical Security Assessment Tool Top-Screen. For more information, please see Agricultural Facilities Time Extension(need hyperlink)

6. Essentials of the CFATS Program
DHS uses information submitted through assessments to determine if a facility is high risk
High risk (i.e., covered) facilities are placed in 1 of 4 high-risk tiers
Facilities determined by DHS to be
high-risk are required to develop and
implement security plans that meet
applicable risk-based performance
standards (RBPS)
More than 3,000 facilities have
eliminated, reduced, or modified
their holdings and/or processes
and are no longer considered high-risk
Tier 2 12%
Tier 3
30%
Tier 4
54%

7. The CFATS Process From the facility perspective
Submit Top-Screen
Receive a Tier (1-4)
or be deemed not high-risk
Provide a Security Vulnerability Assessment (SVA) and Complete Site Security Plan (SSP) or Alternative Security Program (ASP)
Receive Authorization and an Authorization Inspection
Receive Approval of the SSP/ASP
Implement Planned Measures and Undergo Regular Compliance Inspections
All facilities with COI
High-risk facilities
DHS provides compliance assistance upon request at any stage of this process

8. CFATS Universe Identifying high-risk chemical facilities
Correctional
Facilities
Hospitals and Clinics
Wineries
CFATS Universe
Identifying high-risk chemical facilities
“Appendix A” – a list of 300+ chemicals of interest (COI) at specific threshold quantities and concentrations that require reporting to the Department
Chemical Manufacturing
Food Processing
Farm Cooperatives
Oil Refineries
Colleges and Universities

9. Industries with Facilities Regulated by CFATS
CFATS regulates facilities in various industries, including:
Academia (College & Universities)
Aerial Sprayers (Non-Fertilizer)
Breweries
Cold Chain/Refrigeration
Energy Utilities
Fisheries and Hatcheries
Food Processors and Co-Ops
Healthcare (Hospitals & Providers)
Industrial Equipment Manufacturing
Laboratories
Metal Service and Metal Merchants
Mining
Motor Vehicle Parts Manufacturing
Paints/Coatings
Parks and Pools
Petrochemical Manufacturing
Petroleum Refining/Oil Drilling
Plastics
Pulp and Paper
Race Tracks
Retail Storage and Distribution
Semiconductors
Water Filtration
Wineries AN
H202 CI
NH3

10. Risk-Based Performance Standards
1) Restrict Area Perimeter
2) Secure Site Assets
3) Screen and Control Access
4) Deter, Detect, Delay
5) Shipping, Receipt, and Storage
6) Theft and Diversion
7) Sabotage
8) Cyber
9) Response
RBPS-8 Cyber
RBPS-10 Monitoring
10) Monitoring
11) Training
12) Personnel Surety
13) Elevated Threats
14) Specific Threats,
Vulnerabilities, or Risks 15) Reporting of Significant Security Incidents
16) Significant Security Incidents and Suspicious Activities
17) Officials and Organization
18) Records
RBPS-18 Records
RBPS-1 Restrict Area Perimeter
- Under the CFATS Act of 2014, a CFATS-covered facility must submit for DHS approval an SSP or, if the facility chooses, an ASP that contains security measures that meet all applicable RBPS developed by DHS.
RBPS are non-prescriptive, and thus provide facilities with substantial flexibility, including the ability to leverage existing measures where appropriate.
CFATS currently has 18 RBPS, addressing areas such as perimeter security; shipping, receipt, and storage; cybersecurity; personnel surety; training; and recordkeeping.
- Compliance with the RBPS will be tailored to fit each facility’s circumstances, including tier level, security issues, and physical and operating environments.
- Consequently, measures appropriate to meet an RBPS for one type of facility will not necessarily be appropriate for anther type of facility (e.g., DHS would not expect a covered university to necessarily employ the same type of measures as a large chemical manufacturer).
Rather than define specific security measures, DHS developed 18 Risk- Based Performance Standards (RBPS)
Compliance with the RBPS will be tailored to fit each facility’s circumstances, including tier level, security issues, and physical and operating environments

11. Chemical Security Inspectors
Chemical Security Inspectors are located in all 50 States
More than 130 Chemical Security Inspectors
Organized into teams in each of the 10 Federal regions
Conduct:
Authorization Inspections
Compliance Assistant Visits
Compliance Inspections
Stakeholder Outreach
Chemical Security Inspectors also attend meetings with Federal, State, local, and private industry members

12. CFATS National Footprint
- Puerto Rico (Region 2)
- Hawaii
(Region 9)
Number of Approvals, by State
- Guam (Region 9)
Number of Facilities, by Region
Region 5
Region 10
Region 10
Region 1
Region 8
Region 2
Region 5
Region 9
Region 8
Region 9
Region 7
Region 7
Region 3
Region 4
Region 4
Region 6
Region 6

13. CFATS Activities at Regulated Facilities
Since Inception of the Program
CFATS covers 3,381 facilities *
Covered under CSAT - 64
Covered under CSAT 2.0 – 3,317
3,506 Authorizations *
2,932 Authorization * Inspections
2,750 Approvals *
2,544 Compliance * Inspections
*Since Inception of Program” statistics include facilities that were tiered when the activity occurred but subsequently determined to no longer be high-risk. Typical reasons for a change in high-risk status include removal of a COI, reduction of the quantity of COI onsite, replacement of the COI with a lower concentration COI, and/or facility sale or closure.
All statistics are current as of July 31, 2017

14. Submitting and Protecting Information
Chemical Security Assessment Tool (CSAT)
CSAT is a set of online applications.
These include:
User Registration
Top-Screen
Security Vulnerability Assessment/Site Security Plan
Personnel Surety Program
Chemical-terrorism Vulnerability Information (CVI)
CVI is the information protection category used to ensure secure handling of certain sensitive CFATS-related information.
To access CVI, an individual must have passed CVI training and have a need-to-know.
CVI:
-Except in emergency or exigent circumstances, only CVI authorized users with a “need-to-know” are permitted to access the CSAT Top-Screen, SVA, and SSP, certain correspondence, and other types CVI as specified in CFATS.
-Persons potentially eligible to access CVI include facility employees; federal employees, contractors, and grantees; and state/local government employees
-DHS provides online CVI training and authorization

15. Improved Tiering Methodology and CSAT 2.0
The enhanced tiering methodology accounts for the relevant elements of risk: threat, vulnerability, and consequence
CSAT 2.0 will consist of a revised Top-Screen, Security Vulnerability Assessment, and SSP
Collects data needed for the improved CFATS risk-tiering methodology
All facilities with chemicals of interest (COI) at or above screening threshold quantity (STQ) will be required to resubmit a new Top-Screen
New tools were released in fall 2016; facilities began receiving new tiers in April 2017
DHS expects retiering to be completed in fall 2018
Current As Of July 8th, 2014

16. 2017 Priorities: Personnel Surety Program
Personnel Surety Background Checks
Verify and Validate Identity
Check Criminal History
Validate Legal Authorization to Work in the U.S.
Identify People with Terrorist Ties
Personnel Surety includes vetting individuals with access to COI and other sensitive parts of high-risk chemical facilities
Risk-Based Performance Standard (RBPS)12 requires certain types of background checks, including recurrent vetting against the Terrorist Screening Database
DHS began implementation of the CFATS Personnel Surety Program in December Tier 1 and Tier 2 facilities have four ways to implement terrorist screening provisions:
Direct vetting through DHS’s online tool
Verifying credentials through DHS’s online tool
Using an electronic credential reader, like a TWIC reader
Visual verification of a credential
More than 7,000 names are currently being vetted

17. Available Resources
Outreach: DHS outreach for CFATS is a continuous effort to educate stakeholders on the program.
To request a CFATS presentation or a CAV, individuals may submit a request through the program Web site, located at or by ing DHS at
CFATS Help Desk: DHS has developed a CFATS Help Desk that individuals can call or with questions on the CFATS program.
Hours of Operation are 8:30 AM – 5:00 PM (ET), Monday through Friday
The CFATS Help Desk toll-free number is
The CFATS Help Desk address is
CFATS Web Site: For CFATS Frequently Asked Questions (FAQs), CVI training, and other useful CFATS-related information, please go to

18. Protective Security Advisors proactively engage with government partners and the private sector to protect critical infrastructure. For more information or to contact your local PSA,
The Ready Campaign provides help with planning for businesses at
DHS Active Shooter resources are available at
“If You See Something, Say Something™”
Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) information is available at SAR training for private sector partners is located at
Counter-Improvised Explosive Device information and resources are available at
InfraGard is a public-private partnership between the FBI and the private sector that represents individuals from businesses, academic institutions, State and local law enforcement, fire and EMS agencies, as well as other participants dedicated to sharing information, education, and intelligence. Please go to and
Information on DHS cybersecurity programs is available at To find out more about the Cybersecurity Awareness Campaign, go to For tips from the U.S. Computer Emergency Response Team, go to

19. Donald Keen Infrastructure Security Compliance Division
Office of Infrastructure Protection

20. Topics for Discussion CFATS Facilities Statistics
CFATS Progress Updates
Transition to Compliance Inspection
Agricultural Production Facilities
This slide contains hyperlinks to the “back pocket” slides contained at the end of the standard presentation. These links can be used by the presenter to pull up slides if a question is asked on the topic. They remain active even if the slide being linked to is moved to a different part of the presentation.

21. Program Status: Covered Facilities
Tier
Final Tiered
Facilities 1
165 2 88 3
1,388 4
1,740
Total
3,381
DHS continues to issue new high-risk tiering determinations as Top-Screens are submitted
CFATS covers 3,381 facilities
Covered under CSAT – 64
Covered under CSAT 2.0 – 3,317
All statistics are current as of July 31, 2017.

22. CFATS Progress Update
The dynamic nature of the CFATS population means some facilities will always be in the approval process.

23. Transition: Authorization to Compliance Inspections
Authorization Inspections
Compliance Inspections

24. Agricultural Production Facilities (APFs)
DHS is considering whether a modification to the Top-Screen requirement for agricultural production facilities might be warranted
In December 2007, DHS indefinitely extended the Top-Screen for farmers and other agricultural facilities that use chemicals of interest (COI) for certain agricultural purposes

25. Agricultural Production Facilities (APFs) (cont.)
The extension applies to:
Farms (e.g., crop, fruit, nut, and vegetable)
Ranches and rangeland
Poultry, dairy, and equine facilities
Turfgrass growers
Golf courses
Nurseries
Floricultural operations
Public and private parks
The extension does not apply to chemical distribution facilities or commercial chemical application services.

26. Agricultural Production Facilities (APFs) (cont.)
Only applies to APFs that use COI in preparation for the treatment of crops, feed, land, livestock (including poultry) or other areas of an agricultural production facility or during application to or treatment of crops, feed, land, livestock (including poultry) or other areas of the facility.
Therefore, if your facility possesses COI at or above the screening threshold quantity (STQ) for any other purpose, your facility is not eligible to claim the CFATS APF Top-Screen extension and you must comply with the CFATS regulation by submitting a Top-Screen.