CISA near ready to propose changes to chemical security regulation
The feds are almost ready to issue, not a final rule, but a proposed rule, to update 6 CFR 27, the Chemical Facility Anti-Terrorism Standards (CFATS). The Cybersecurity and Infrastructure Security Agency (CISA), an arm of the Department of Homeland Security, sent the CFATS proposal to the Office of Management and Budget (OMB) for review on April 11.
Facilities with chemicals will want to review the proposal, once it is issued, to determine any possible impacts a future final rule may have. They may also wish to comment on the proposal to help CISA shape the final rule.
What is CFATS?
The CFATS program, which took effect on June 8, 2007, at 6 CFR 27, identifies chemical facilities of interest and regulates the security of high-risk chemical facilities through risk-based performance standards. The chemicals of interest (COI) are listed in Appendix A to the regulation. If chemical facilities of interest possess COI in the amounts and concentrations listed in Appendix A, they must complete and submit a Top-Screen survey to CISA.
CISA evaluates the information submitted in the Top-Screen and performs a risk assessment. Based upon this assessment, the agency determines which chemical facilities of interest qualify as high risk and are then subject to full coverage under CFATS. Each of these high-risk, covered chemical facilities is assigned a tier that ranges from Tier 1 (highest risk) to Tier 4 (lowest risk).
The regulation requires high-risk facilities to develop and submit a Site Security Plan that addresses 18 risk-based performance standards for physical security, cybersecurity, and various other security-focused measures and procedures.
To date, CISA has received more than 107,000 Top-Screen submissions from more than 44,000 unique facilities. Of these, CFATS currently covers 3,241 facilities.
Why is the agency going to propose a rule?
The regulated chemicals and threshold quantities established at Appendix A were originally based on EPA’s threshold quantities for hazardous substances published under its Risk Management Program.
However, CISA says it has gained experience in chemical holdings and determining which facilities it should classify as high-risk. The agency wants to amend the list of regulated chemicals, their threshold quantities, and counting methods. CISA may include other changes too. The amendments would better reflect the security issues with these chemicals, says CISA.
What will the rule propose?
The agency is tight-lipped about the actual content of the upcoming proposed rule but explains that the changes will address the subjects raised in:
- An August 18, 2014, pre-proposal that provided the public an opportunity to provide recommendations for program changes. The pre-proposal asked questions about data submission processes, exemptions, scope and applicability, non-traditional chemical facilities, small businesses, definitions, risk-based performance standards, adding or deleting covered chemicals, threshold quantities, concentration/mixture rules, and duplication/overlap with other regulations.
- A June 22, 2020, analysis of the data, assumptions, and methods used to support the 2007 rulemaking. This included the costs and burdens of the rule. Interestingly, the analysis resulted in a decrease in the estimated 10-year cost of the rule because the agency originally overestimated the number of covered facilities and the cost of required security measures. CISA collected public comments on the analysis, which will feed the upcoming proposed rule.
- A January 6, 2021, pre-proposal that invited public comment over the possible removal of certain explosive chemicals from Appendix A. CISA explained that the regulations may be unnecessarily burdensome for facilities that are already subject to Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) security regulations for the same chemicals.
When will the proposal appear in the Federal Register?
The semi-annual agenda slated the proposed rulemaking for May 2023. However, to meet that projected date, OMB would have to scramble to review and approve the rule. Therefore, we are looking at a July 2023 or later time slot for Federal Register publication if OMB takes its usual 90 to 120 days to complete its review.
Key to remember
CISA sent a CFATS proposal to the OMB for review on April 11. The proposed rule may be issued in the coming months. Based on agency experience, CISA wants to amend the list of regulated chemicals, their threshold quantities, and counting methods. Facilities with chemicals will want to review the proposal, once it is issued, to determine any possible impacts a future final rule may have.