Chemical Facility Anti-Terrorism Standards (CFATS) Tiering Methodology
CFATS Announcement
As of July 28, 2023, Congress has allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards (CFATS) program (6 CFR Part 27) to expire.
Therefore, CISA cannot enforce compliance with the CFATS regulations at this time. This means that CISA will not require facilities to report their chemicals of interest or submit any information in CSAT, perform inspections, or provide CFATS compliance assistance, amongst other activities. CISA can no longer require facilities to implement their CFATS Site Security Plan or CFATS Alternative Security Program.
CISA encourages facilities to maintain security measures. CISA’s voluntary ChemLock resources are available on the ChemLock webpages.
If CFATS is reauthorized, CISA will follow up with facilities in the future. To reach us, please contact CFATS@hq.dhs.gov.
Under the Chemical Facility Anti-Terrorism Standards (CFATS) program, the Cybersecurity and Infrastructure Security Agency (CISA) uses a dynamic risk assessment and tiering methodology to determine which chemical facilities with holdings of regulated chemicals of interest (COI) represent a high risk in the case of a successful terrorist attack. Chemical facilities determined to be "high-risk" are assigned to one of four risk-based tiers.
The CFATS tiering methodology takes into account three elements of risk in a facility's high-risk determination and tier assignment:
- Vulnerability to a terrorist attack
- Potential consequences of an attack
- Level of threat of a terrorist attack
High-risk chemical facilities are subject to CFATS regulation and must develop and implement a security plan with measures that are tailored to the tier level and unique considerations of the facility.
Determining High-Risk Chemical Facilities
To determine a facility's risk level, CISA uses information that facilities submit through the Top-Screen survey, which is then assessed based on vulnerability, potential consequences, and threat of a terrorist attack. After analyzing the Top-Screen data, CISA determines which facilities are high risk and assigns those facilities a Tier of 1, 2, 3, or 4, with Tier 1 representing the highest risk.
Read the CFATS Tiering Methodology fact sheet to better understand the considerations that may impact a facility's high-risk status and, as applicable, assignment of its tier.
2016 Enhanced Tiering Methodology
Chemical security is not a temporary issue. As threats evolve, CISA is committed to using the best tiering methodology to identify high-risk chemical facilities.
In 2013, the CFATS risk-tiering methodology underwent a thorough review by external experts from industry and government. The results led to the 2016 implementation of the enhanced tiering methodology, which more accurately determines and appropriately tiers high-risk chemical facilities.
While much of the risk tiering methodology is sensitive and/or classified, the enhanced methodology includes several new components within each element of risks—the facility's vulnerability, potential consequence, and threat factors—such as improved physics-based models for impacts of COI that could be exploited onsite and offsite; updates to the threat model to be informed by intelligence, and better population modeling for release facilities.
Rollout of the Enhanced Tiering Methodology
In 2016, CISA began notifying chemical facilities of interest about the requirement to submit a new Top-Screen using Chemical Security Assessment Tool (CSAT) 2.0. The new submission was then analyzed using the enhanced risk-assessment methodology.
Facilities had the option to proactively resubmit a Top-Screen prior to receiving the individual notification from CISA. Chemical facilities that have never submitted a Top-Screen, but have come into possession of COI, must submit a Top-Screen in CSAT 2.0 within 60 days of coming into possession of a COI.
In April 2017, CISA began issuing tiering determination letters to facilities that were assessed using the enhanced methodology. Letters continue to be issued as facilities submit Top-Screens.
Results of the Enhanced Tiering Methodology
Based on CISA's analysis of a representative sample of tiering results, some facilities have seen a change in their tier. Some facilities that were previously not covered under CFATS found themselves covered, and some previously covered facilities are no longer considered high-risk. Some of these tier changes are a result of the enhanced tiering methodology, while others are the result of changes facilities have made to their business, such as adding and removing COI, or modifying storage methods.
Additional Resources
CISA is committed to sharing information and providing assistance throughout the CFATS process to ensure facilities have the necessary information.
Visit the CFATS Knowledge Center for an online repository of frequently asked questions, articles, and more information.
Contact Information
If you have additional questions, please call the CSAT Help Desk at 866-323-2957 Monday through Friday (except federal holidays) from 8:30 a.m. to 5 p.m. (ET) or email CSAT@hq.dhs.gov.