CISA Sends CFATS NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from CISA on Chemical Facility Anti-Terrorism Standards (CFATS). This update of the CFATS regulations has been in the works since 2014 when an advanced notice of proposed rulemaking (ANPRM) was first published for the program. A separate ANPRM was subsequently published on January 6^th, 2021 and a regulatory retrospective was published on June 22^nd, 2020. CISA apparently used all three of those publications (and their respective public comments) in formulating the regulatory update embodied in this NPRM.

The Fall 2022 Unified Agenda listing for this rulemaking notes in the Statement of Need:

“The Chemical Facility Anti-Terrorism Standards (CFATS) program regulates facilities possessing large quantities of dangerous chemicals. The particular chemicals listed and threshold quantities were established in 2007, and were based on EPA’s threshold quantities for Hazardous Substances published under its Release Management Program. In the 15 years since implementation of the program, CISA has gained extensive experience in analyzing chemical holdings and determining which facilities should be classified as high-risk and subject to further regulation. Given its experience, CISA has determined that it should adjust its list of regulated chemicals, threshold quantities, and counting methods to better reflect the security issues implicated by these chemicals. Additionally, CISA believes that the CFATS security performance guidelines, first issued in 2009, should be updated to better reflect lessons learned over the past decade, including substantially updating the guidelines for cybersecurity performance metrics.”

I discussed possible changes to Appendix A earlier this year when the Fall 2022 UA was published.

That UA listing also provides this tantalizing comment under the heading of ‘Alternatives’:

“CISA considered an alternative version of this NPRM where we updated only the performance guidance but not the chemical listings. Additionally, we considered an alternative version where changes to certain toxic chemical listings were omitted.”

It looks like this rulemaking is going to be interesting, but of course, only if Congress reauthorizes the program before July 27^th, 2023 since we will probably not see the NPRM before that date.