Responders Need More Data on CFATS Facilities' Inventories: GAO
Thirteen of the 15 Local Emergency Planning Committees, consisting of first responders and covering 373 CFATS high-risk facilities, told GAO they did not have access to CFATS data in the secure IP Gateway. By encouraging wider use of the gateway, DHS would have greater assurance that responders have information about high-risk facilities and the chemicals they have on site, the audit report says.
A new Government Accountability Office report finds the first responders are not able to access important information that the U.S. Department of Homeland Security develops from its inspections of facilities that handle hazardous chemicals — facilities that are assessed under the DHS Chemical Facility Anti-Terrorism Standards (CFATS) program. Some of the chemicals at these facilities could be stolen and used to build explosive devices; DHS inspects them to ensure they comply with security standards and shares information about the facilities with local officials so that first responders are prepared for potential security incidents.
GAO, however, found that first responders may not have all the information they need to safely respond to incidents at these facilities. Its audit recommended, among other things, that DHS provide first responders with better access to the information.
There were 29,195 facilities assessed for security risks as of February 2018, and DHS has designated 3,500 of those as high risk and subject to further requirements, according to the audit report. It says as of May 2018, DHS had conducted 3,553 compliance inspections and had begun to update its performance measure for the CFATS program to evaluate security measures implemented both when a facility submitted its initial security plan and again when DHS approves its final security plan. GAO found that DHS' methodology does not measure how facilities' vulnerability is reduced by the implementation and verification of planned security measures during the compliance inspection process.
DHS developed a secure interface called the Infrastructure Protection Gateway that provides access to CFATS facility-specific data on chemical inventories, but GAO found that IP Gateway "is not widely used at the local level." Thirteen of the 15 Local Emergency Planning Committees, consisting of first responders and covering 373 CFATS high-risk facilities, told GAO they did not have access to CFATS data in the IP Gateway.
By encouraging wider use of the gateway, DHS would have greater assurance that responders have information about high-risk facilities and the chemicals they have on site, the audit report says.