Chemical Facility Anti-Terrorism Standards: Building a Foundation – Appendix A

This is the second post in a series about the origins of the Chemical Facility Anti-Terrorism Standards (CFATS) program. We encourage you to start with How It All Began: The History and Making of the CFATS Program.

In our previous post, we highlighted the unique threat environment in which preventing the weaponization of chemicals became a priority for the Department of Homeland Security. On November 20, 2007, the Department issued the CFATS Final Rule and Appendix A, a list of more than 300 chemicals of interest (COI) that, if possessed at or above certain quantities and concentrations, triggered preliminary reporting requirements for a chemical facility.

This second post in our celebration of the CFATS 15th anniversary will focus on Appendix A, a document that has been instrumental to the implementation of the CFATS program and has helped facility owners and operators understand their chemical holdings and the security issues that may come with those chemicals.

The Homeland Security Appropriations Act of 2007 gave the Department of Homeland Security (DHS) regulatory authority over security at high-risk chemical facilities. The Interim Final Rule published in April of 2007, established DHS's authority to use "its best judgment and all available information" in determining whether a chemical facility presents a high level of security risk. The chemical security team charged with standing up the CFATS program -- at the time, a small, committed group of security experts that had only the language of the Act as direction -- had to determine how these regulations would translate into practical guidance. One of the first things the team had to determine was what qualified as "high risk" when evaluating a facility that possessed dangerous chemicals.

"Of the millions of chemicals that existed, the task of identifying those that warranted security was challenging, given the time and resource constraints. Leveraging information from various trusted resources -- such as other federal agencies' covered chemicals -- resulted in Appendix A."

- Cynthia Blair-McManus, Chemical Section Chief, CISA Chemical Security

Using multiple sources, the team drafted the proposed Appendix A, which included a list of more than 300 chemicals and their corresponding quantities and concentrations. The list included chemicals that might present a security risk if held in high enough concentration and what the division referred to as a "screening threshold quantity" (STQ). Facilities that held any of the chemicals of interest (COI) at or above the STQ and concentration identified in Appendix A would be required to report those chemical holdings to DHS.

The DHS team that developed Appendix A knew it needed to walk a fine line in developing its requirements on threshold quantities. On the one hand, DHS needed to set thresholds low enough to ensure that facilities whose chemicals could cause significant consequences would report their holdings. On the other hand, DHS wanted to avoid setting thresholds so low that the regulations would unnecessarily cover facilities that were very unlikely to be considered high-risk.

The draft Appendix A was published alongside the Interim Final Rule in April 2007 with the Department requesting comments from the public by the end of May. While the Department awaited comments on the Interim Final Rule and the draft Appendix A, the team was writing the code for the Chemical Security Assessment Tool (CSAT), building out the Top-Screen (the survey facilities would electronically submit to the Agency to evaluate their chemical holdings), determining and testing a risk-tiering algorithm, and all the while continuing to enhance Appendix A for its final publication.

As comments rolled in from industry associations, facilities, other agencies, and Congress, the rulemaking behind the scenes continued. Initially, Appendix A listed only a chemical and a corresponding Chemical Abstract Service (CAS) number. The final appendix added several columns, including synonyms for certain chemicals, updated STQ and concentrations (initially for several COI "any amount" would trigger reporting requirements), and security issues that would be associated with each COI: release, theft/diversion, and sabotage/contamination.

On November 20, 2007, the Final Rule: Appendix A was published. Thanks to feedback from the public and hard work from the team, the final list was more robust and better defined for facilities to use. With the publication of the Final Rule and Appendix A, the CFATS reporting requirements were in place: facilities that possessed any of the chemicals listed in Appendix A at the corresponding STQs and concentrations were officially required to complete and submit a Top-Screen within 60 calendar days.

Appendix A became a cornerstone of CFATS and remains an important first step in identifying the nation's highest-risk chemical facilities. The publication of Appendix A was just one of the building blocks that laid the foundation for the CFATS program and protecting dangerous chemicals at our highest-risk chemical facilities. The regulations had been written, facilities were being notified, and now the Department needed people to operate the program. In our next blog post, we will look at the implementation of the program: a cadre of Chemical Security Inspectors, establishing relationships with facilities, and bringing CFATS to life.

Want to learn more about the security issues or how to interpret Appendix A? Visit the Appendix A: Chemicals of Interest webpage or email CFATS@hq.dhs.gov to meet with a member of the Compliance team.

From now through the end of the year, CISA will be highlighting important milestones in the history of the CFATS program. We'll cover not only the impact these milestones had on the evolution of chemical security in the United States, but also the broader security landscape. We look forward to sharing more about the development of the CFATS program, covering topics such as:

• From Policy to Program: Implementing CFATS
• A Shared Responsibility and a Team Effort: Building and Sustaining Chemical Security with our Partners
• Broadening the Nation's Chemical Security Aperture: ChemLock
• CSAT 2.0: Engineering the Backbone of the CFATS Program
• Connected and Protected: Integrating critical cyber-physical systems for enhanced chemical security
• Looking Back, Looking Forward: The Future of CFATS
• An Inside Job: Stopping Terrorists from Gaining Insider Access to Dangerous Chemicals
• Leading the World: CFATS on the Global Stage