Critical Infrastructure Protection: Preliminary Observations on DHS Efforts to Assess Chemical Security Risk and Gather Feedback on Facility Outreach

Testimony issued by the Government Accountability Office with an abstract that begins "Since 2007, the Department of Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD) has assigned about 3,500 high-risk chemical facilities to risk-based tiers under its Chemical Facilities Anti-Terrorism Standards (CFATS) program, but it has not fully assessed its approach for doing so. The approach ISCD used to assess risk and make decisions to place facilities in final tiers does not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. For example, the risk assessment approach is based primarily on consequences arising from human casualties, but does not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation, nor does it include vulnerability, consistent with the NIPP. ISCD has begun to take some actions to examine how its risk assessment approach can be enhanced. Specifically, ISCD has, among other things, engaged Sandia National Laboratories to examine how economic consequences can be incorporated into ISCD's risk assessment approach and commissioned a panel of experts to assess the current approach, identify strengths and weaknesses, and recommend improvements. Given the critical nature of ISCD's risk assessment approach in laying the foundation for further regulatory steps in improving facility security, it is important that its approach for assigning facilities to tiers is complete within the NIPP risk management framework and the CFATS regulation.