Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown

DHS identified high risk chemical facilities using EPA's Risk Management Plan database. It also developed a Risk Analysis Management for Critical Asset Protection (RAMCAP) for collecting information on critical infrastructure assets. With this tool, DHS would be able to compare risks across assets. Under the new regulatory environment, owners of facilities housing certain quantities of specified chemicals must complete a preliminary screening assessment to determine the level of risk associated with the facility. If the facility preliminarily qualifies as high risk its owners will be required to prepare and submit a Security Vulnerability Assessment (SVA), which identifies facility security vulnerabilities, and to develop and implement a Site Security Plan, which includes measures to address vulnerabilities identified in the SVA, and satisfy risk-based performance standards established in the regulations. The regulations use a risk-based performance standards approach. Facilities have flexibility in designing their Site Security Plans and in choosing what security measures to use to meet the security standards required of their facility. Facilities will, however, be required to achieve specific security outcomes, such as securing the perimeter and critical targets, controlling facility access, and preventing internal sabotage. The security standards a facility must meet will be commensurate to their risk i.e., higher risk facilities will be required to meet more robust security standards. Security Vulnerability Assessments, Site Security Plans, and the implementation of security measures will be validated through audits and site inspections.

At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.

A 2003 Presidential directive designated DHS the lead agency in December 2003. And, in fall 2006, Congress granted DHS overarching regulatory authority over chemical facility security. The National Infrastructure Protection Plan (NIPP) provides the unifying structure for the integration of critical infrastructure and key resources protection efforts into a single national program. The NIPP provides an overall framework for integrating programs and activities that are underway in the various sectors, as well as new and developing sector protection efforts. The NIPP includes 17 sector-specific plans that detail the application of the overall risk management framework to each specific sector. In May 2007, DHS released the Chemical Sector Specific Plan. The plan describes how the NIPP risk management framework-the six-step process for managing the risks associated with the Nation's critical infrastructure from terrorist attack-is being implemented in and integrated with both the voluntary programs already underway in the Chemical Sector and the recently enacted chemical facility security regulatory standards. DHS notes in the Chemical Sector Specific Plan that numerous other federal departments and agencies have responsibilities that are integral to the overall security of the section. The numerous federal agencies involved in chemical security has a formal entity for coordinating government led protection activities called the Chemical Government Coordinating Council (CGCC), which is chaired by DHS.

At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.

Currently, DHS has numerous methods through which it disseminates information to, and receives information from, private sector members of the Chemical Sector, the most substantial of which is the Chemical ISAC. The DHS also has developed a secure, online information-sharing network for the Chemical Sector called HSIN-Chemical. Currently, representatives from Chemical ISAC and HSIN-Chemical are working together to determine how these two systems can be integrated to best serve the interests of the Chemical Sector.

At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.

In fall 2006, Congress granted DHS overarching authority to regulate chemical facility security. Specifically, in Section 550 of the Department of Homeland Security Appropriations Act of 2007, Congress gave DHS the authority to require high risk chemical facilities to complete vulnerability assessments, develop site security plans, and implement protective measures necessary to meet DHS-defined performance standards. In accordance with this authority, on April 2, 2007, DHS released the Chemical Facility Anti-Terrorism Standards (CFATS) as an interim final rule.

At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.