Chemical facilities, even with very low volumes, are under particular scrutiny, as their operations are considered especially vulnerable to threats.

Because of the increased threat, chemical facilities need to focus on preventing terrorist, criminal, and cyberattacks. Such attacks could have significant national impact (e.g., through the loss of chemicals vital to the national defense or economy). They also could cause releases of hazardous chemicals that might compromise the facility’s integrity, cause serious injuries or fatalities among employees, contaminate adjoining areas, or cause injuries or fatalities among adjoining populations.

For many facilities, compliance with existing regulations led to changes in operations that reduced risk and increased security. Facilities have been able to identify and reduce the chemicals of greatest concern at their facilities. For companies not previously affected by security-related regulations, existing regulations and guidance provide a solid starting point for evaluating processes and implementing changes to improve security.

As of July 28, 2023, Congress allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards (CFATS) program (6 CFR 27) to expire. Therefore, the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) cannot enforce compliance with the CFATS regulations at this time. Put another way, 6 CFR 27 is not currently active.

It is noteworthy that CFATS was the nation's first regulatory program focused specifically on security at high-risk chemical facilities. The program ran from October 4, 2006, to July 23, 2023. Under CFATS, a chemical facility that possessed or planned to possess any of the more than 300 “chemicals of interest” listed in 6 CFR 27 at or above a screening threshold quantity and concentration were required to report to CISA. The agency used the information a facility submitted to determine if the facility was considered high-risk and had to develop a security plan.

Only Congress can reauthorize CFATS. Until that happens, CISA encourages facilities to maintain security measures. Watch for news, developments, and resources on the CISA CFATS webpage.