DHS Publishes Civil Penalty Adjustment for 2025 Final Rule

Today, DHS published a final rule in the Federal Register (90 FR 1-14) on “Civil Monetary Penalty Adjustments for Inflation”. This is the congressionally mandated annual ‘cost of living’ adjustment of civil penalties that can be assessed by components of DHS. Lists of individual civil penalty adjustments for agencies of interest here are listed below.

• US Coast Guard, and

• Transportation Security Administration

CISA is listed in this final rule, but currently the only regulatory program (the CFATS program) that CISA had operated which allowed for civil penalties has been shutdown by inaction in Congress. DHS explains the issue this way:

“The Cybersecurity and Infrastructure Security Agency (CISA) administers the Chemical Facility Anti-Terrorism Standards (CFATS). CFATS is a program that regulates the security of chemical facilities that, in the discretion of the Secretary, present high levels of security risk. DHS established the CFATS program in 2007 pursuant to section 550 of the Department of Homeland Security Appropriations Act of 2007 (Pub. L. 109-295) [Link added]. Pursuant to section 5 of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (Pub. L. 113-254, as amended by Pub. L. 116-150; 6 U.S.C. 621 note) [Links added], authorization had been granted for CFATS until July 27, 2023. Congress did not act to reauthorize the program in time and, as such, the authorization expired on July 28, 2023. Therefore, regulations written pursuant to CFATS authority are not currently active. While regulatory text for the CFATS regulation, including a civil penalty, is located in part 27 of title 6 of the Code of Federal Regulations (CFR), the text is inactive due to the lapse in authority. For that reason, we are not adjusting the maximum civil penalty amount that CISA may assess at this time.”

Identical language was included in last year's adjustment final rule, so this is not any special sign of movement in the Department about the finality of the end of the CFATS program. Still whistling past the graveyard.

The effective date of this final rule is January 2^nd, 2025, for penalties assessed after January 2, 2025, whose associated violations occurred after November 2, 2015.

OCS Updates CFATS FAQ – 1-13-22

Today, CISA’s Office of Chemical Security (OCS) updated the responses to one of the Frequently Asked Questions (FAQ) on the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The revision updates the civil penalty that may be assessed under the CFATS program.

The FAQ is # 1554 - Does the Cybersecurity and Infrastructure Security Agency (CISA) have enforcement authority to fine noncompliant facilities, to include shutting down a facility?

NOTE: The link provided for the FAQ in this post was copied from the CFATS Knowledge Center but may not work when followed from your machine. This is an artifact of that web site. If the links do not take you to the referenced FAQ, you will have to use the ‘Advanced Search’ function on the page to link to the FAQ or download the ‘All FAQs’ document at the bottom of the ‘Advanced Search’ page.

The new version of the FAQ response lists the maximum fine that the Department may assess as $38,139 for each day the violation continues. This is an increase from the $35,486 quoted in the previous version of the FAQ response. This was increased by a DHS final rule published on January 11^th, 2022. The CISA portion of that rule set the new maximum level for the CFATS program.