Written testimony of NPPD Under Secretary Suzanne Spaulding and NPPD Office of Infrastructure Protection, Infrastructure Security Compliance Division Director David Wulf for a Senate Committee on Homeland Security and Governmental Affairs hearing titled “Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards (CFATS) Program”

342 Dirksen Senate Office Building

Thank you, Chairman Carper, Ranking Member Coburn, and distinguished Members of the Committee. I appreciate the opportunity to appear before you today to discuss the Department of Homeland Security’s (DHS) regulation of high-risk chemical facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) and the importance of authorizing the program. Over the past two years, the CFATS program has made significant progress, advancing programmatically while simultaneously addressing internal management concerns. We are pleased to appear before you today to discuss authorizing the program and ensuring that DHS has the authority to carry out the program in a manner that will foster the security of America’s highest-risk chemical infrastructure.

As you are aware, the Department's current authority under Section 550 of the Fiscal Year 2007 Department of Homeland Security Appropriations Act, as amended, is set to expire in October 2014. DHS is eager to work with the Committee and our stakeholders both in government and the private sector to achieve passage of legislation that provides long-term authorization and appropriately matures the CFATS program. In support of this collaboration, our testimony focuses on the progress made over the last two years, our efforts to continue strengthening the program, and the need for permanent authorization in order to fully stabilize the program.

CFATS Has Made the Nation More Secure

The CFATS program is an important part of our Nation’s counterterrorism efforts as we work with our industry stakeholders to keep dangerous chemicals out of the hands of those who wish to do us harm. Since the CFATS program was created, we have engaged with industry to identify and regulate high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with the possession of chemicals of interest. Interagency partners have benefited from this information as it has enhanced law enforcement cooperation with high-risk chemical facilities. CFATS has also played a significant role in reducing the number of high-risk chemical facilities that are susceptible to attack or exploitation. To date, more than 3,000 facilities have eliminated, reduced or modified their holdings of chemicals of interest. The significant reduction in the number of chemical facilities that represent the highest risk is an important success of the CFATS program and is attributable both to the design of the program as enacted by Congress and to the work of CFATS personnel and industry at thousands of chemical facilities.

The progress made in the CFATS program over the last two years has helped to put the program on a path to success; however, there is still work to be done. The Department continues to engage with stakeholders and focus on three core areas: reducing the backlog of site security plan approvals, improving the risk assessment process, and ensuring that all potentially high-risk facilities are identified and are meeting their existing regulatory obligations as required by the CFATS regulations.¹ Along with long-term authorization, our continued focus on these areas will ensure our stakeholders have the stability they need to comply with their regulatory obligations. We welcome the opportunity to work with you and our stakeholders on these important issues to further improve this vital national security program.

CFATS Implementation Progress

The cornerstone of the CFATS program is the development, submission, and implementation of Site Security Plans (SSPs), or Alternative Security Programs (ASPs) in lieu of SSPs, which document the security measures that high-risk chemical facilities utilize to satisfy the applicable Risk-Based Performance Standards (RBPS) under CFATS. It is important to note that these plans are not “one-size-fits-all,” but are in-depth, highly customized, and account for each facility’s unique circumstances.

In order to determine whether a facility is regulated under CFATS, the facility submits a Top-Screen to the Department’s National Protection and Programs Directorate (NPPD) Infrastructure Security Compliance Division (ISCD) within the Office of Infrastructure Protection. Since we began collecting this information in 2007, ISCD has data from more than 46,000 Top-Screens submitted by chemical facilities, providing important information about their chemical holdings. Based on the information received in the Top-Screens, ISCD makes an initial determination that certain facilities are considered high-risk and assigns each of these to a preliminary tier² These facilities then compile and submit Security Vulnerability Assessments (SVAs), which are used by ISCD to identify which facilities present a terrorism risk that is sufficiently high to warrant the assignment of a final high-risk tier under CFATS. As of April 21, 2014, CFATS covers over 4,100 high-risk facilities nationwide; of these, over 3,250 have received final high-risk determinations and are required to develop SSPs (or ASPs) for ISCD review. The remaining facilities are awaiting final tier determinations based on their SVA submissions. The tiered population is dynamic and subject to change, depending on the chemical holdings and other conditions at facilities.

Over the past year, the CFATS program has authorized, inspected, and approved hundreds of security plans. The program has also improved the pace of inspections and SSP approvals, developing new processes and distributing guidance materials. The majority of Tier 1 and Tier 2 facilities (the highest of the high risk), as well as a number of Tier 3 and Tier 4 facilities, now have an approved security plan. In September 2013, ISCD marked yet another milestone when we began conducting compliance inspections for facilities with approved SSPs. During compliance inspections, the Department verifies that the facility is implementing the measures contained in its approved SSP. The Department has developed a process whereby the timing for compliance inspections is based on a variety of factors, such as the facility’s risk tier, the facility and/or parent company’s past CFATS compliance history, date since last inspection, and the number of planned measures contained in the approved SSP.

The improvements that have been made have accelerated the pace of approvals and we are continuing to identify and explore options to enhance the program. We recognize the projected timeframe for all approvals must be reduced and we are exploring a variety of ways to increase the pace at which approvals are granted while maintaining the quality and thoroughness of the security plan approval process and the level of security required at chemical facilities. These include encouraging increased use of ASPs and supporting stakeholders’ development of new ASP templates, focusing inspections on key RBPS at lower tier facilities, working with corporations to develop authorization inspection schedules that allow for multiple inspections by one inspection team per week, and inspecting measures at a corporate level for corporations that have similar measures implemented at multiple facilities. The Department continues to engage with CFATS stakeholders on efforts to expedite security plan reviews and is committed to identifying and implementing appropriate enhancements to streamline the CFATS process. ASPs are an important option for facilities that desire flexibility in their site security plan, and we appreciate the Subcommittee’s effort to ensure this option remains available for the CFATS program moving forward.

CFATS Risk Assessment

As a part of our commitment to continue moving the CFATS program forward, NPPD has conducted a thorough review of our risk assessment process. In support of this review, NPPD implemented a phased approach, which included documenting all processes and procedures relating to the risk assessment methodology; conducting an internal NPPD review of the risk assessment process; and initiating an external peer review of the risk assessment methodology.

All three of these phases are now complete, with the Department receiving the CFATS Tiering Methodology Peer Review Final Report from the expert peer review panel in October 2013. Although many of the peer review panel’s recommendations pertain to areas the Department had previously identified for improvement, we felt it was essential to engage external stakeholders through an external peer review to ensure the fullest expertise was engaged in risk assessment improvements. As a result of continued stakeholder engagement, the Report provides valuable perspectives that will inform our efforts to enhance the CFATS risk-tiering methodology. We have analyzed the peer review recommendations and developed an implementation plan to enable us to address the recommendations in a timely and thoughtful manner. We also recognize that it is essential to continue to engage our stakeholders in implementing changes to the risk assessment process.

As recommended by the Peer Review Final Report, the Department intends to adopt appropriate changes to the tiering methodology in an integrated fashion, addressing as many issues concurrently as feasible. The implementation plan also addresses modifications to the tiering methodology stemming from efforts beyond the peer review, such as the economic and mission criticality studies being conducted on behalf of the Department by Sandia National Laboratories. Additionally, consistent with both recommendations within the Peer Review Final Report and our response to the Government Accountability Office’s report on the CFATS tiering methodology, ISCD intends to have a third-party verify and validate the revised tiering methodology. As we move forward with implementing recommendations, we are committed to ensuring these improvements are balanced with our stakeholders need for continued stability in tiering.

Chemical Facility Safety and Security Improvement: A Shared Responsibility

Since the inception of the CFATS program, the Department has worked to ensure that potentially regulated facilities are aware of their reporting obligation under the CFATS regulations and that they comply with these existing regulations. Following the explosion in West, Texas, in April 2013, DHS has taken a number of steps to reinvigorate this effort, including supporting the implementation of Executive Order (EO) 13650, Improving Chemical Facility Safety and Security. Under EO 13650, Federal agencies established a working group co-chaired by DHS, the Department of Labor, and the Environmental Protection Agency, with participation from the Department of Justice, Department of Transportation, and U.S. Department of Agriculture, to explore options for improving chemical facility safety and security to reduce the likelihood of incidents occurring in the future. The members of the Working Group have worked closely together over the past year to analyze and develop recommendations on improving information collection, more effectively sharing information between agencies, improving operational and federal coordination efforts, and improving the effectiveness of existing regulations and policies governing chemicals and chemical facilities. These coordinated efforts will help ensure that the Federal government most effectively uses the collective resources available for managing chemical risk.

Promoting Compliance

The activities taking place in support of EO 13650 complement many of the individual efforts being undertaken within the Department, and other Federal departments and agencies, following the tragic events in West, Texas. Since the April 2013 explosion, DHS has engaged with numerous members of industry and all have agreed that we must work together to prevent future incidents. Industry has offered to share information about the CFATS regulatory requirements with other members of industry that may not currently be aware of CFATS and do their part to promote safety and security at chemical facilities. The Department appreciates this support and looks forward to working with industry and our government partners to carry out these activities. In pursuit of this shared responsibility, the Department has undertaken significant outreach efforts throughout the years, to inform potentially high-risk chemical facilities of their obligations under CFATS. These outreach efforts have been a major contributor to the submission of over 46,000 Top-Screens from potentially high-risk chemical facilities to date.

As the tragic incident in West, Texas, demonstrated, not all facilities with threshold quantities of CFATS chemicals of interest have met their obligation to submit Top-Screens. DHS is committed to pursuing all reasonable measures to identify potential high-risk chemical facilities that are not among those that have already complied with initial Top-Screen submission requirements, and we will continue to work to get those facilities into compliance. When appropriate, the Department can utilize available enforcement mechanisms to bring non-compliant facilities into compliance. Both increased outreach and, where appropriate, the use of compliance enforcement mechanisms are part of the Department’s overall strategy to reduce the likelihood of potentially high-risk chemical facilities intentionally or unintentionally evading identification under the CFATS program.

State and Local Partnerships

The Department’s strategy for identifying potentially non-compliant facilities also includes enhanced coordination with Federal, State, and local partners. One such activity has focused on reinvigorating efforts with the EPA and other Federal partners with regulatory authority over the chemical industry to compare lists of regulated facilities to identify facilities which may have complied with another regulatory program and are potentially regulated under CFATS but have yet to comply with CFATS. Initial results from these efforts have been promising, with the Department seeing a substantial increase in the monthly rate of new Top-Screen submissions since August 2013.

The Department is also undertaking similar efforts with States and localities. Since April 2013, ISCD has reached out to officials in all 50 States, including State Homeland Security Advisors (HSAs) and the Governors Homeland Security Advisory Council, about CFATS requirements. These efforts are in addition to continuing to provide State HSAs and their designees with access to information on CFATS-regulated facilities in their jurisdictions via CFATS Share, a Web-based information-sharing portal that provides access to key information on CFATS facility information to certain Federal, State, and local agencies on an as needed basis.

Outreach to Non-Compliant Facilities

The Department is expanding outreach efforts to identify potentially non-compliant facilities and has developed an Outreach and Engagement Strategy and Implementation Plan to raise awareness of CFATS DHS will continue to operate its CFATS Tip Line and will follow up on any information of potentially non-compliant facilities.

All of the aforementioned efforts are being undertaken in addition to the larger-scale efforts being coordinated under EO 13650. Of particular relevance is the effort being led by DHS under Section 5 of the EO, which addresses Enhanced Information Collection and Sharing. This section requires the development of recommendations on possible changes to improve and streamline information collection from regulated industries and recommendations to enhance data sharing between agencies, states, localities, and tribal entities to better identify facilities which may not have provided all required information or may be non-compliant with requirements.

We feel strongly that our private sector stakeholders are key to our efforts to enhance data sharing, increase cross-training, and identify areas for possible regulatory changes as well as identifying possible gaps in existing statutory authorities. Enhancing security and building resilience across the chemical sector is not something a single company, industry or even government can do by itself. This has to be a collaborative effort. It also has to be a comprehensive effort, because of the sheer complexity of affected facilities, the linkages to other sectors, and the potential cascading effects and consequences of a significant attack or disruption.

Industry Engagement

Industry engagement has always been an important aspect of CFATS, but will be more important than ever as we move forward with program improvements. Chemical Security Inspectors play an important role, serving as our boots on the ground and the face of CFATS in the field. Inspectors and interagency partners from the Federal Bureau of Investigation provide assistance and outreach directly to facilities and play an important role in helping facilities identify appropriate security measures. For example, one facility had numerous positive aspects to their security program, but failed to address any security measures for small containers, which could easily be concealed within a handbag or backpack. Through the inspection, the facility understood the potential vulnerability and developed planned measures to prohibit bags within the restricted area and to inspect hand-carried items when exiting the restricted area to ensure nothing sensitive is being removed. Another example is a different regulated facility that had effective security for the chemicals of interest located within the building, but failed to address the chemicals of interest located in the open storage yard. As a result of the inspection, the facility identified a new restricted area to store the chemicals of interest within the main building and added procedures to ensure that upon receipt, the appropriate facility personnel immediately moved the chemicals of interest into the new restricted area. In addition to conducting inspections and providing compliance assistance to facilities, NPPD’s chemical inspectors actively work with local stakeholders and governmental agencies across the country.

The Need for Program Authorization

DHS recognizes the significant work that the Committee and others have undertaken to reauthorize the CFATS program. The progress we have made over the last two years demonstrates the Department’s commitment to ensuring this program is a success.

However, the federal funding hiatus last October illustrates the complications in the current authorization structure. The funding hiatus directly impacted the CFATS program because the program is authorized through annual appropriations bills. The hiatus resulted in all ISCD staff being furloughed, which resulted in cancellation of numerous inspections and immobilized security plan approvals. In addition to the shutdown of programmatic activities, the authorization of the CFATS program expired on October 5, 2013. The gap in program authorization caused concern among regulated facilities, with many facilities questioning whether the regulations were still in effect. This confusion and uncertainty demonstrated the need for long-term authorization outside of the appropriations process. Moreover, it is unclear if the Department would have had the authority to act had there been an exigent need during the shutdown to take enforcement action under CFATS in furtherance of national security interests. Long-term authorization would address this as well.

The Department strongly believes that an authorization would be beneficial to your oversight activities by ensuring the full maturation of the program and the review and approval of all backlogged Site Security Plans. Perhaps most importantly, long term authorization will provide industry stakeholders with the stability needed to plan for and invest in CFATS-related security measures to harden their critical sites against terrorist attack or exploitation. Companies have regularly communicated to us that their capital-planning/budgeting processes for security improvements frequently run on a three-to-five-year cycle and they deserve to know that the program will not be allowed to lapse as they invest in major CFATS-related security improvements.

Uncertainty about the future of CFATS also has provided an incentive for potentially regulated facilities storing large quantities of dangerous chemicals to ignore their obligations under CFATS in hopes that the program will be allowed to sunset. An authorization period of five years or longer would enable Congress to send an important message to such facilities that may willfully be seeking to avoid compliance.

In addition, the committee’s efforts to codify and enhance the Department’s authority to seek out non-compliant facilities will greatly support our ongoing actions to bring such facilities into compliance. In the year following the explosion at the West Fertilizer plant in Texas, the Department has been committed to ensuring that facilities across the Nation are both aware of the requirements to report under CFATS and meet their obligations. The Department has worked closely with our interagency partners to implement EO 13650; equally important is providing specific statutory authority for engaging these non-compliant facilities. Finally, the Department believes Congress should take action to address the gap in the framework for regulating the security of chemicals at water and wastewater treatment facilities in the United States, and believes the options provided in the recent Information Collection Request for facility compliance with RBPS-12, personnel surety, are the most appropriate for identifying personnel with terrorist ties that may have access to the high-risk chemicals at a facility.

Conclusion

The Department has made significant improvements to the CFATS program and is moving forward strategically to address the challenges that remain. The Department has taken important steps to build a strong CFATS program and has a seasoned leadership team committed to the success of the program. With your support, we can ensure our Nation is more secure by continuing implementation of the CFATS program, and we are committed to working with you to pass legislation to authorize the program. With support from industry and action by Congress to authorize the program, the CFATS program’s mission to protect Americans will be strengthened.

As we implement CFATS, we will continue to work with stakeholders to keep our Nation secure by preventing terrorists from exploiting chemicals or chemical facilities. We firmly believe that CFATS is making the Nation more secure by reducing the risks associated with our Nation’s chemical infrastructure and we are—along with our stakeholders and partners—committed to its continued success.