OMB Announces Withdrawal of CFATS NPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the withdrawal of a notice of proposed rulemaking (NPRM) from CISA on “Chemical Facility Anti-Terrorism Standards (CFATS)”. This NPRM was submitted to OIRA on April 11^th, 2023.

According to the Fall 2024 Unified Agenda Entry for this rulemaking:

“The Cybersecurity and Infrastructure Security Agency (CISA) previously invited public comment on an Advance Notice of Proposed Rulemaking (ANPRM) during August 2014 for potential revisions to the Chemical Facility Anti-Terrorism Standards (CFATS) regulations. The ANPRM provided an opportunity for the public to provide recommendations for possible program changes. In June 2020, CISA published for public comment a retrospective analysis of the CFATS program. And in January 2021, CISA invited additional public comment through an ANPRM concerning the removal of certain explosive chemicals from CFATS. CISA intends to address many of the subjects raised in both ANPRMs and the retrospective analysis in this regulatory action, including potential updates to CFATS cybersecurity requirements and Appendix A to the CFATS regulations.”

In writing about this NPRM being submitted to OIRA, I wrote:

“It looks like this rulemaking is going to be interesting, but of course, only if Congress reauthorizes the program before July 27th, 2023 since we will probably not see the NPRM before that date.”

I have said on a couple of occasions that when this rulemaking is withdrawn it will be an admission by the Administration that the CFATS program is dead. Today, I have to temporize a little on that. Over the last two weeks 15 separate documents under OIRA review have been withdrawn (EO Review Search Criteria: Agencies=All;   Review Status=Concluded;   Concluded Action= Withdrawn;   Concluded from 01/07/2025;   Concluded to 01/16/2025). It has looked like the Biden Administration has been removing rulemakings and guidance documents that it is relatively sure will be blocked by the incoming Trump Administration. Since there is no ‘withdrawal’ statement put into the record on the Reginfo.gov website, it could reasonably be argued that yesterdays CFATS NPRM withdrawal was the same thing. Okay, even accepting that, it still means that the program is dead, because the Trump Administration is unlikely to try to resurrect the program.