Written testimony of NPPD Office of Infrastructure Protection Assistant Secretary Caitlin Durkovich for a House Committee on Homeland Security, Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies hearing titled “H.R. 4007, the Chemical Facility Anti-Terrorism Standards (CFATS) Authorization and Accountability Act of 2014”

311 Cannon House Office Building

Thank you, Chairman Meehan, Ranking Member Clarke, and distinguished Members of the Subcommittee. I appreciate the opportunity to appear before you today to discuss the Department of Homeland Security’s (DHS) regulation of high-risk chemical facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) and the need for action to authorize the program. Over the past year, the CFATS program has made significant progress, advancing programmatically while simultaneously addressing internal management concerns. We are pleased the Subcommittee has acknowledged this progress by introducing a bill that would provide longer-term authorization and the authority to carry out the program in a manner that will foster the security of America’s highest-risk chemical infrastructure.

As you are aware, the Department's current authority under Section 550 of the Fiscal Year 2007 Department of Homeland Security Appropriations Act, as amended, is set to expire in October 2014. DHS is eager to work with this Subcommittee, our other authorization committees, and our stakeholders both in government and the private sector to achieve passage of legislation that provides long-term authorization and appropriately matures the CFATS program. In support of this collaboration, our testimony focuses on the progress made over the last two years, our efforts to continue strengthening the program, and the need for permanent authorization in order to fully stabilize the program.

CFATS Has Made the Nation More Secure

The CFATS program is an important part of our Nation’s counterterrorism efforts as we work with our industry stakeholders to keep dangerous chemicals out of the hands of those who wish to do us harm. Since the CFATS program was created, we have engaged with industry to identify and regulate high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with the possession of chemicals of interest. CFATS has also played a significant role in reducing the number of high-risk chemical facilities that are susceptible to attack or exploitation. To date, more than 3,000 facilities have eliminated, reduced or modified their holdings of chemicals of interest. The significant reduction in the number of chemical facilities that represent the highest risk is an important success of the CFATS program and is attributable both to the design of the program as enacted by Congress and to the work of CFATS personnel and industry at thousands of chemical facilities.

The progress made in the CFATS program over the last two years has helped to put the program on a path to success; however, there is still work to be done. The Department continues to engage with stakeholders and focus on three core areas: reducing the backlog of site security plan approvals, improving the risk assessment process, and ensuring that all potentially high-risk facilities are identified and are meeting their regulatory obligations as required by CFATS. Along with long-term authorization, our continued focus on these areas will ensure our stakeholders have the stability they need to comply with their regulatory obligations. We welcome the opportunity to work with you and our stakeholders on these important issues to further improve this vital national security program.

CFATS Implementation Progress

The cornerstone of the CFATS program is the development, submission, and implementation of Site Security Plans (SSPs), or Alternative Security Programs (ASPs) in lieu of SSPs, which document the security measures that high-risk chemical facilities utilize to satisfy the applicable Risk-Based Performance Standards (RBPS) under CFATS. It is important to note that these plans are not “one-size-fits-all,” but are in-depth, highly customized, and account for each facility’s unique circumstances.

In order to determine whether a facility is regulated under CFATS, the facility submits a Top-Screen to the Department’s Infrastructure Security Compliance Division (ISCD). Since we began collecting this information in 2007, ISCD has data from more than 46,000 Top-Screens submitted by chemical facilities, providing important information about their chemical holdings. Based on the information received in the Top-Screens, ISCD makes an initial determination that certain facilities are considered high-risk and assigns each of these to a preliminary tier¹. These facilities then compile and submit Security Vulnerability Assessments (SVAs), which are used by ISCD to identify which facilities present a terrorism risk that is sufficiently high to warrant the assignment of a final high-risk tier under CFATS. As of February 20, 2013, CFATS covers over 4,200 high-risk facilities nationwide; of these, over 3,300 have received final high-risk determinations and are required to develop SSPs (or ASPs) for ISCD review. The remaining facilities are awaiting final tier determinations based on their SVA submissions. The tiered population is dynamic and subject to change, depending on the chemical holdings and other conditions at facilities.

Over the past year, the CFATS program has authorized, inspected, and approved hundreds of security plans. The program has also improved the pace of inspections and SSP approvals, developing new processes and distributing guidance materials. The majority of Tier 1 and Tier 2 facilities (the highest of the high risk), as well as many Tier 3 facilities, now have an approved security plan. In September, ISCD marked yet another milestone when we began conducting compliance inspections for facilities with approved SSPs. During compliance inspections, the Department verifies that the facility is implementing the measures contained in its approved SSP. Initially, these inspections will be conducted approximately one year after a facility’s SSP is approved, but the Department is developing a process whereby the timing for compliance inspections will be based on a variety of factors, such as the facility’s risk tier, the facility and/or parent company’s past CFATS compliance history, and the number of planned measures contained in the approved SSP.

The improvements that have been made have accelerated the pace of approvals and we are continuing to explore areas to enhance the program. We recognize the projected timeframe for all approvals must be reduced and we are exploring a variety of ways to increase the pace at which approvals are granted while maintaining the quality and thoroughness of the security plan approval process and the level of security required at chemical facilities. These include encouraging increased use of ASPs and supporting stakeholders’ development of new ASP templates, focusing inspections on key RBPS at lower tier facilities, exploring ways to streamline the security plan review and inspection process for facilities owned by corporations with multiple CFATS-regulated facilities, and identifying efficiencies in the inspection and compliance assistance visit scheduling process to reduce travel time per inspector activity. The Department is engaging with CFATS stakeholders on efforts to expedite security plan reviews and is committed to identifying and implementing appropriate enhancements to streamline the CFATS process. ASPs are an important option for facilities that desire flexibility in their site security plan, and we appreciate the Subcommittee’s effort to ensure this option remains available for the CFATS program moving forward.

CFATS Risk Assessment

As a part of our commitment to continue moving the CFATS program forward, NPPD has conducted a thorough review of our risk assessment process. In support of this review, NPPD implemented a phased approach, which included documenting all processes and procedures relating to the risk assessment methodology; conducting an internal NPPD review of the risk assessment process; and initiating an external peer review of the risk assessment methodology.

All three of these phases are now complete, with the Department receiving the CFATS Tiering Methodology Peer Review Final Report from the expert peer review panel in October 2013. Although many of the peer review panel’s recommendations pertain to areas the Department had previously identified for improvement, we felt it was essential to engage external stakeholders through an external peer review. As a result of continued stakeholder engagement, the Report provides valuable perspectives that will inform our efforts to enhance the CFATS risk-tiering methodology. We have analyzed the peer review recommendations and developed an implementation plan to enable us to address the recommendations in a timely and thoughtful manner. We also recognize that it is essential to continue to engage our stakeholders in implementing changes to risk assessment process.

As recommended by the Peer Review Final Report, the Department intends to adopt appropriate changes to the tiering methodology in an integrated fashion, addressing as many issues concurrently as feasible. The implementation plan also addresses modifications to the tiering methodology stemming from efforts beyond the peer review, such as the economic and mission criticality studies being conducted on behalf of the Department by Sandia National Laboratories. Additionally, consistent with both recommendations within the Peer Review Final Report and our response to the Government Accountability Office’s report on the CFATS tiering methodology, ISCD intends to have a third-party verify and validate the revised tiering methodology. As we move forward with implementing recommendations to the tiering methodology, we are committed to ensuring these improvements are balanced with our stakeholders need for continued stability in tiering.

Chemical Facility Safety and Security Improvement: A Shared Responsibility

Since the inception of the CFATS program, the Department has worked to ensure that potentially regulated facilities are aware of their reporting obligation under the CFATS regulations and that they comply with these existing regulations. Following the explosion in West, Texas, this past April, ISCD has taken a number of steps to reinvigorate this effort, including supporting the implementation of Executive Order 13650, Improving Chemical Facility Safety and Security. Under Executive Order 13650, Federal agencies are exploring options for improving chemical facility safety and security to reduce the likelihood of incidents occurring in the future. The Working Group is developing recommendations to see if there is a need to improve information collection, more effectively share information between agencies, improve operational and federal coordination efforts, and the Working Group is analyzing the effectiveness of existing regulations and policies governing chemicals and chemical facilities. These coordinated efforts will help ensure that the Federal government most effectively uses the collective resources available for managing chemical risk.

Promoting Compliance

The activities taking place in support of Executive Order 13650 complement many of the individual efforts being undertaken within the Department, and other Federal departments and agencies, following the tragic events in West, Texas. Since the April explosion, DHS has engaged with numerous members of industry and all have agreed that we must work together to prevent future incidents. Industry has offered to share information about the CFATS regulatory requirements with other members of industry and do their part to promote safety and security at chemical facilities. The Department appreciates this support and looks forward to working with industry and our government partners to carry out these activities. In pursuit of this shared responsibility, the Department has undertaken significant outreach efforts throughout the years, to inform potentially high-risk chemical facilities of their obligations under CFATS. These outreach efforts have been a major contributor to the submission of over 46,000 Top-Screens from potentially high-risk chemical facilities to date.

As the tragic incident in West, Texas, demonstrated, however, not all facilities with threshold quantities of CFATS chemicals of interest have met their obligation to submit Top-Screens. DHS is committed to pursuing all reasonable measures to identify potential high-risk chemical facilities that are not among those that have already complied with initial Top-Screen submission requirements, and we will continue to work to get those facilities into compliance. When appropriate, the Department can utilize available enforcement mechanisms to bring non-compliant facilities into compliance. Both increased outreach and, where appropriate, the use of compliance enforcement mechanisms are part of the Department’s overall strategy to reduce the likelihood of potentially high-risk chemical facilities intentionally or unintentionally evading identification under the CFATS program.

State and Local Partnerships

The Department’s strategy for identifying potentially non-compliant facilities also includes enhanced coordination with Federal, State, and local partners. One such activity has been reinvigorating efforts with the EPA and other Federal partners with regulatory authority over the chemical industry to compare lists of regulated facilities to identify facilities which may have complied with another regulatory program and are potentially regulated under CFATS but have yet to comply with CFATS. Initial results from these efforts have been promising, with the Department seeing a substantial increase in the monthly rate of new Top-Screen submissions having begun in August 2013.

The Department is also undertaking similar efforts with States and localities. Since April, ISCD has reached out to officials in all 50 States, including State Homeland Security Advisors (HSAs) and the Governors Homeland Security Advisory Council, about CFATS requirements. These efforts are in addition to continuing to provide State HSAs and their designees with access to information on CFATS-regulated facilities in their jurisdictions via CFATS Share, a Web-based information-sharing portal that provides on an as needed basis to certain Federal, State, and local agencies access to key information on CFATS facility information.

Outreach to Non-Compliant Facilities

The Department is expanding outreach efforts to identify potentially non-compliant facilities and has developed an Outreach and Engagement Strategy as well as an Outreach and Engagement Implementation Plan to raise awareness of CFATS, the measures of success, roles and responsibilities, and resource implications. DHS will continue to operate its CFATS Tip Line and will follow up on any information of potentially non-compliant facilities.

All of the aforementioned efforts are being undertaken in addition to the larger-scale efforts being coordinated under EO 13650. Of particular relevance is the effort being led by DHS under Section 5 of the EO, which addresses Enhanced Information Collection and Sharing. This section requires the development of recommendations on possible changes to improve and streamline information collection from regulated industries and recommendations to enhance data sharing between agencies, states, localities, and tribal entities to better identify facilities which may not have provided all required information or may be non-compliant with requirements.

We feel strongly that our private sector stakeholders are key to our efforts to enhance data sharing, increase cross-training, and identify areas for possible regulatory changes as well as identifying possible gaps in existing statutory authorities. Enhancing security and building resilience across the chemical sector is not something a single company, industry or even government can do by itself. This has to be a collaborative effort. It also has to be a comprehensive effort, because of the sheer complexity of affected facilities, the linkages to other sectors, and the potential cascading effects and consequences of a significant attack or disruption.

Industry Engagement

Industry engagement has always been an important aspect of CFATS, but will be more important than ever as we move forward with program improvements. Chemical Security Inspectors play an important role, serving as our boots on the ground and the face of CFATS in the field. Inspectors provide assistance and outreach directly to facilities and play an important role in helping to identify appropriate security measures during the authorization inspection process. For example, one facility had numerous positive aspects to their security program, but failed to address any security measures for small containers, which could easily be concealed within a handbag or backpack. After the inspection, the facility understood the potential vulnerability and developed planned measures to prohibit bags within the restricted area and to inspect hand-carried items when exiting the restricted area. Another example is a different regulated facility that had effective security for the chemicals of interest located within the building, but failed to address the chemicals of interest located in the open storage yard. As a result of the inspection, the facility identified a new restricted area to store the chemicals of interest within the main building and added procedures to ensure that upon receipt, the appropriate facility personnel immediately moved the chemicals of interest into the new restricted area. In addition to conducting inspections and providing compliance assistance to facilities, NPPD’s chemical inspectors actively work with local stakeholders and governmental agencies across the country.

The Need for Program Authorization

DHS recognizes the significant work that the Committee and others have undertaken to reauthorize the CFATS program. The progress we have made over the last two years demonstrates the Department’s commitment to ensuring this program is a success; now we ask Congress to demonstrate your commitment to this program in providing a long-term authorization.

The federal funding hiatus last October illustrates the complications in the current authorization structure. The funding hiatus directly impacted the CFATS program because the program is authorized through appropriations bills. The shutdown resulted in all ISCD staff being furloughed, which resulted in cancellation of numerous inspections and immobilized security plan approvals. In addition to the shutdown of programmatic activities, the authorization of the CFATS program expired on October 5, 2013. The gap in program authorization caused concern among regulated facilities, with many facilities questioning whether the regulations were still in effect. This confusion and uncertainty demonstrated the need for long-term authorization outside of the appropriations process. Moreover, it is unclear if the Department would have had the authority to act had there been an exigent need during the shutdown to take enforcement action under CFATS in furtherance of national security interests.

The Department strongly believes that an authorization period longer than the two years currently stipulated in the bill would be beneficial to your oversight activities by ensuring the full maturation of the program and the review and approval of all backlogged Site Security Plans. Perhaps most importantly, long term authorization will provide industry stakeholders with the stability needed to plan for and invest in CFATS-related security measures to harden their critical sites against terrorist attack or exploitation. Companies have regularly communicated to us that their capital-planning/budgeting processes for security improvements frequently run on a three-to-five-year cycle and they deserve to know that the program will not be allowed to lapse as they invest in major CFATS-related security improvements.

Uncertainty about the future of CFATS also has provided an incentive for potentially regulated facilities storing large quantities of dangerous chemicals to ignore their obligations under CFATS in hopes that the program will be allowed to sunset. An authorization period of five years or longer would enable Congress to send an important message to such facilities that may willfully be seeking to avoid compliance.

As we approach the one year anniversary of the explosion at the West Fertilizer plant in Texas, the Department remains committed to ensuring that facilities across the Nation are both aware of the requirements to report under CFATS and complete their obligations. The committee’s efforts to codify the Department’s authority to seek out non-compliant facilities will greatly support our ongoing actions to bring these facilities into compliance. The Department has worked closely with our interagency partners to implement Executive Order 13650, but we feel strongly that multi-year CFATS authorization is vital now and will harmonize with the outcomes of the Executive Order.

With the progress made over the last two years, the CFATS program is ready for program stabilization through permanent or long-term authorization. The Department has taken important steps to build a strong CFATS program and has a seasoned leadership team committed to the success of the program. With support from industry and action by Congress to authorize the program, the CFATS program’s mission to protect Americans will be strengthened.

Conclusion

The Department has made significant improvements to the CFATS program and is moving forward strategically to address the challenges that remain. With your support, we can ensure our Nation is more secure by continuing implementation of the CFATS program, and we are committed to working with you to pass legislation to establish permanent or long-term authorization for the program. As we implement CFATS, we will continue to work with stakeholders to keep our Nation secure by preventing terrorists from exploiting chemicals or chemical facilities. We firmly believe that CFATS is making the Nation more secure by reducing the risks associated with our Nation’s chemical infrastructure and we are—along with our stakeholders and partners—committed to its continued success.