Reader Comment – Decline in Covered Facilities: Good or Bad?

There was an interesting comment left on TWITTER yesterday about my post on latest CFATS update. Marc Ayala wrote: “Your right Pat, a decline in the number of covered facilities is actually a good thing. It looks good on paper that is.” This was in response to my reporting on the decline in the number of facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program. While there have only been two straight months of decline in the number of facilities regulated under the CFATS program, the number of facilities covered is at its lowest number since June 2020 when 3,341 facilities were covered.

I posited that: “Significant reduction or elimination of those risks at a facility (necessary for exit from the program) reduces the risk for the communities around those facilities and the country as a whole.” Marc’s comment raises the specter that this apparent reduction in risk is more about regulation avoidance than risk reduction. That is certainly an idea that should be addressed.

How Do Facilities Leave CFATS

Typically, a facility initiates the process of leaving the Program by submitting a Top Screen update showing a change in the inventory quantities of any of 300+ DHS chemicals of interest (COI). The folks at CISA’s Office of Chemical Security take the new inventory numbers and run them through the same risk assessment process that landed the facility in the program in the first place. As I understand it, if the assessment indicates that the risk is reduced below the threshold that would land a facility in the program, then a chemical security inspector (CSI) is dispatched to the facility to physically verify that the risk has been reduced.

Once the final determination is made about the change in status, the facility is notified that it is no longer covered by the program. Presumably, the facility then reduces its emphasis facility security in order to reduce the costs associated with its site security plan. That reduction would appear to be reasonable; with a reduced risk, the level of security does not need to be as high.

Incentives to Leave the Program

Facilities have a number of reasons to want to leave the program. Security measures are expensive to install and maintain. They also frequently lead to inefficiencies in internal processes and controls. Finally, any regulatory program has administrative compliance costs. Furthermore, the advantages of an effective security program are hard to quantify, especially since there have been no documented terrorist attacks (or attempted attacks) on chemical facilities in the US since the CFATS program was stood up in 2007.

To justify a removal from CFATS, a facility must reduce its inventory below the reporting levels set in Appendix A, 6 CFR Part 27. Facilities that manufacture or distribute COI, can get out of that business. Facilities that use COI as raw materials can either find replacement chemicals (not always possible), reduce the maximum amount of material that is held on hand, or get out of the business that utilizes the COI. Each of these options carries its own business costs and consequences. Or, of course, a facility could just lie. That is why OCS sends inspectors to verify the process changes.

Moving Forward

As long a CISA’s OCS adequately vets facilities leaving the program, the risk of facilities cheating to avoid regulatory oversight remains relatively low. And OCS has a bureaucratic incentive to keep the covered facility number high; if the number drops too low, Congress will reduce funding and headcount for the Office.

It would be nice if OCS were able to share more details about how and why facilities continue to leave the CFATS program, but there are legitimate security and business confidentiality reasons that limit the information that CISA can share with the public. I suspect, however, that with the program facing renewal next year (after the Democrats potentially loose “control” of Congress) that we are going to start to see Committee interest in all sorts of issues within CFATS. I would not be surprised to see one or more Committee Chairs asking the GAO to report on the number and process of facilities dropping out of the CFATS program.