Update on Chemical Facility Anti-Terrorism Requirements

CFATS Overview

Originally implemented on April 9, 2007, the Chemical Facility Anti-Terrorism Standards (CFATS) program is the first regulatory program from the Department of Homeland Security (DHS) addressing security at high-risk chemical facilities. DHS evaluates security risk based on three main functions:

  • Consequence – anticipated result of a successful attack on a facility
  • Vulnerability – likelihood that an attack would be successful
  • Threat – intent and capability of an adversary attacking the facility

CFATS_Homeland Security graphic

DHS implements the CFATS program through a risk-tiering methodology for subject facilities. The CFATS program consists of first requiring the facility to determine if it has chemicals of interest (COIs) at or above the regulatory thresholds (applicability determination). If subject, the facility is then required to prepare a Top-Screen Analysis (TSA) and potentially a Security Vulnerability Assessment (SVA) and Site Security Plan (SSP). DHS has an Expedited Approval Program to streamline SVAs and SSPs for lower-risk Tier 3 and 4 facilities and allows facilities to develop Alternative Security Programs (ASP) as long as they meet all the SSP requirements. Figure 1 depicts the steps in this process.

 CFATS_Figure 1 original

Chemicals of Interest

DHS maintains a list of COIs in Appendix A of 6 CFR 27 (Appendix A) (see Table 1 for common COIs). In developing this list, DHS's goal was to identify chemicals that present one or more of the following security issues at chemical facilities:

 CFATS_Table 1 original

  • Release categories
    • Toxics:  Chemicals with the potential to create a toxic cloud that would affect populations within and beyond the facility, if intentionally released
    • Flammables:  Chemicals with the potential to create a vapor cloud explosion that would affect populations within and beyond the facility, if intentionally released
    • Explosives:  Chemicals with the potential to affect populations within and beyond the facility if intentionally detonated
  • Theft or Diversion categories
    • Chemical Weapons & Precursors:  Chemicals that could be stolen or diverted and used as chemical weapons or easily converted into chemical weapons
    • Weapons of Mass Effect:  Chemicals that could be stolen or diverted and used directly as weapons of mass effect
    • Explosives/Improvised Explosive Device Precursors: Chemicals that could be stolen or diverted and used in explosives or improvised explosive devices
  • Sabotage/Contamination:  Chemicals that, if mixed with other readily available materials, have the potential to create significant adverse consequences for human life or health

DHS developed the list of COIs by reviewing other federal regulations, soliciting advice from other regulatory agencies and industry groups, and incorporating feedback from the public. Specifically, DHS used information from the resources below to prepare the COI list, including development of the "Screening Threshold Quantities" (STQs). The STQs define the facility-wide COI poundage amount that a facility can possess before becoming subject to CFATS (i.e., if a facility possess a COI at or above its STQ, then the facility must proceed with submitting a TSA to DHS, so that DHS can formally evaluate the facility's security risk).

  • Release categories
    • Toxics:  EPA's Risk Management Plan (RMP) rule (40 CFR 68.130, Tables 1 & 2)
    • Flammables:  EPA's RMP rule (40 CFR 68.130 – Tables 3 & 4)
    • Explosives:
      • DOT's hazardous material regulations – Division 1.1 explosives
      • EPA's original listing rule for RMP
  • Theft or Diversion categories
    • Chemical Weapons & Precursors:  Department of Commerce's Chemical Weapons Convention
    • Weapons of Mass Effect:  DOT's hazardous material regulations – poisonous by inhalation gases
    • Explosives/Improvised Explosive Device Precursors:
      • DOT's hazardous material regulations – Division 1.1 explosives
      • National Research Council's recommendations for IEDs
      • FBI Explosive Unit's recommendations for IEDs
  • Sabotage/Contamination:  DOT's 2004 Emergency Response Guidebook – Water-Reactive Materials Which Produce Toxic Gases

The COI list and associated STQs are similar, but not identical, to the above-referenced regulations. For example, the Release-Toxics category includes all of EPA's toxic substances identified under Tables 1 and 2 of the RMP rule (40 CFR 68.130), except for three chemicals.1 DHS also adopted the RMP rule's Threshold Quantities for the Release-Toxics and Release-Flammables STQs with some exceptions (particularly for flammable substances).

Applicability Determinations

Completing the CFATS applicability determination is a critical first step for CFATS compliance. The applicability determination can be summarized in six steps.

  1. Determine if the facility has any Appendix A COIs onsite.
  2. Determine if any exemptions in 6 CFR 27.110(b) or 27.203 apply.
  3. Determine if the COIs exceed the minimum concentrations specified in Appendix A.
  4. Calculate the maximum amount of COIs that the facility possesses.
  5. Compare the maximum amount of COIs that the facility possesses to Appendix A STQs.
  6. If at or above the STQ, complete a TSA using DHS's CSAT reporting tool (proceed to Step 2 in the CFATS Applicability and Compliance Process flowchart).

Understanding the origin of the COI list can be critical for making an accurate applicability determination. The COI list in Appendix A includes associated Chemical Abstract Service (CAS) numbers and common synonyms to help facilities identify whether they possess COIs at their site. Note that some COI names were replicated from the associated regulation that DHS reviewed to develop the COI list. For example, ammonium nitrate, [with more than 0.2 percent combustible substances, including any organic substance calculated as carbon, to the exclusion of any other added substance] was adopted from the Department of Transportation's (DOT's) hazardous material regulations and is intended to cover ammonium nitrate (AN) as a Division 1.1 explosive as defined by DOT. An initial review of the explosive Ammonium Nitrate Fuel Oil (ANFO) would suggest that this chemical meets the AN description specified in Appendix A. However, because ANFO is not a DOT Division 1.1 explosive, it is therefore not subject to the CFATS program.2

DHS exempts certain facility types [6 CFR 27.110(b)] and COI uses [6 CFR 27.203(a), 203(b)(2), and 203(b)(3)] from CFATS applicability. The most common exemptions include the following:

  • Chemicals in naturally occurring hydrocarbon mixtures prior to entry of the mixture into a natural gas processing plant or a petroleum refining process unit (naturally occurring hydrocarbon mixtures include condensate, crude oil, field gas, and produced water as defined in 40 CFR 68.3).
  • Chemicals in solid waste (including hazardous waste)regulated under the Resource Conservation and Recovery Act (RCRA), except for the waste described in 40 CFR 261.33 (P- & U-listed wastes)
  • Release chemicals stored in transportation containers that are incident to transportation (i.e., containers connected to the motive power)
  • Laboratories under the supervision of a technically qualified individual per 40 CFR 720.3
  • Propane tanks that hold 10,000 lbs or less (~2,350 gallons)

CFATS blue boxFurther, DHS defines minimum concentrations for each COI based on the chemical's security issue(s) [40 CFR 27.204]. If a facility possesses a COI below the minimum concentration, it is not required to count that COI towards the STQ thresholds. For COIs at or above the minimum concentration, the CFATS regulation includes explicit requirements on how to count the amount of a COI in a mixture towards the STQ based on the associated security issue. For example, if a Release-Flammable COI is present in a mixture above the minimum concentration (1%) and the mixture has a National Fire Protection Association (NFPA) flammability hazard rating of 4, then the entire amount of the mixture must be counted toward the STQ. This is based on the view that the entire mixture is a flammability concern (EPA uses a similar approach and reasoning under the RMP rule). This approach inherently created an inconsistency in the regulation with respect to propane, which had been given special consideration in the CFATS regulation in an effort to exclude non-industrial users of propane (particularly farmers and restaurants). For propane, the rule established a 60,000-lb STQ, rather than the 10,000-lb STQ baseline for flammable substances. Under the original version of the rule, a TSA could have been required for mixtures that were primarily propane, due to the lower STQ for other components of the mixture. Because this was not the intent of the rule, DHS later issued a clarification3 specifying that the Release Flammables mixture rule applies only to mixtures containing less than 87.5% propane and that mixtures with 87.5% or more propane are subject only to the 60,000-lb STQ threshold.4

After determining that a facility possesses a COI at or above its STQ, the facility must submit a TSA to DHS using the Chemical Security Assessment Tool (CSAT). Note that the facility must aggregate the total amount of COI that it possesses at its facility, including COI that may exist in separate processes (unlike EPA's RMP Rule, which requires facilities to consider the total quantity ''contained in a process'').

CSAT 2.0 – TSA, SVA, and SSP Submittals

As previously discussed, after a TSA has been submitted, DHS evaluates if the facility would be considered high risk based on a tier rating system (e.g., Tier 1, 2, 3, or 4). Facilities determined to be high risk are assigned a tier and required to submit an SVA and SSP (or follow an Expedited Approval Program for lower-risk Tier 3 and 4 facilities). TSAs as well as SVAs and SSPs are submitted to DHS using the agency's CSAT, version 2.0. DHS released CSAT 2.0 and a new tiering methodology on September 30, 2016, after re-evaluating the risk-tiering methodology; updating the TSA, SVA, and SSP questionnaires accordingly; and changing the CSAT user interface to accommodate the program changes. Along with CSAT 2.0, DHS also changed the SVA and SSP submittal requirements (now to be submitted jointly within 120 days of tier notification).DHS recently updated the tiering methodology in coordination with industry and government partners via the Critical Infrastructure Partnership Advisory Council. The enhanced methodology was reviewed by the Homeland Security Studies and Analysis Institute and independently verified and validated by Sandia National Laboratories. Although most of the tiering methodology is sensitive and/or classified, DHS shared several factors it considers when evaluating a facility's vulnerability, consequence, and threat based on information submitted in the facility's TSA.5 The relevant factors in each area of consideration are outlined below.

  • Vulnerability factors
    • Pressure rating of a storage container
    • Storage location
    • Underground earth location
    • COI container size and portability
    • Facility shipment of COI
  • Consequence factors
    • Topography surrounding facility (urban or rural terrain)
    • Potentially exposed population surrounding facility
    • COI information
      • Toxicity
      • Flammability
      • Explosive energy
      • Quantity and concentration
      • Storage: container location, temperature and pressure rating, types of packaging
      • Secondary containment area
      • Precursor characteristics: toxicity / explosive energy
    • Mode of shipping
  • Threat factors
    • Topography surrounding facility (urban or rural terrain)
    • Specific chemical of interest
    • Quantity stolen or diverted (non-bulk only)
    • Mode of shipment

On October 4, 2016, DHS began sending notices to approximately 27,000 facilities to submit a new TSA using CSAT 2.0. As of May 2017, DHS had received approximately 12,000 updated TSAs from the 27,000 facilities that previously held COIs at or above their respective STQs. Based on an initial analysis of the 12,000 TSAs submitted, DHS anticipates 39% of the tiered population to remain within the same risk tier, and 51% of the tiered population to change risk tier.6 The remaining 10% of the population is expected to either become untiered (i.e., not regulated) or become newly tiered (i.e., regulated for the first time). On April 4, 2017, DHS began issuing tiering letters to facilities based on the enhanced methodology and plans to continue to notify facilities of the requirement to submit new TSAs and issue tiering decisions on a rolling basis.

Changing risk tier may trigger new security requirements and potentially DHS Authorization and Compliance Inspections.

For guidance or questions regarding CFATS, please contact Jose Orsini at (407) 982-2891, or Taylor Wilson at (913) 894-4500.

1  The three excluded chemicals are toluene 2,4-diisocyanate, toluene 2,6-diisocyanate, and toluene diisocyanate (unspecified isomer).
2  CFATS Knowledge Center, Frequently Asked Question No. 1383 (May 22, 2009).
3  73 FR 15051 (March 21, 2008).
4  The 87.5% concentration was determined by reviewing typical Safety Data Sheets (SDS) for propane products, including the model SDS from the National Propane Gas Association (NPGA).
5  Chemical Facility Anti-Terrorism Standards: Tiering Methodology, Department of Homeland Security (April 2017).
6  Chemical Facility Anti-Terrorism Standards (CFATS) Tiering Results Update, Department of Homeland Security (April 24, 2017).