As facilities continue to increase their reliance on computer-controlled systems, protecting against cyber sabotage is an increasingly essential component in managing overall risk for a chemical facility
By Department of Homeland Security
Chemicals are an essential part of improving our everyday lives within our communities. Swimming pools use chlorine to fight waterborne bacteria and viruses to keep patrons healthy. Propane is often used to heat schools, helping to create a comfortable learning environment for students. Farmers apply fertilizers that deliver essential nutrients to the soil, resulting in an abundant food supply. However, these same chemicals that give us a higher quality of life can also be dangerous in the hands of those that intend to do harm.
To better protect chemical facilities from the threat of terrorist attack or exploitation, the Department of Homeland Security (DHS) implements the Chemical Facility Anti-Terrorism Standards (CFATS) program, which identifies and regulates high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with specific chemicals of interest (COI). Any entity that has a COI at certain quantities and concentrations, be it a university, hospital, community swimming pool, or even a brewery, is a chemical facility that is subject to CFATS and must submit a Top-Screen survey to give the Department basic information about the facility and the COI it possesses.
Facilities determined by DHS to be high-risk must submit a security plan to DHS and implement a variety of security measures—both physical and cyber in nature—to meet applicable risk-based performance standards (RBPS). CFATS is a non-prescriptive program, meaning that facilities are able to choose different security measures to meet the corresponding RBPS, which also best fit their individual facility concerns.
Under CFATS, chemical facilities must select physical security measures and activities that both meet the RBPS and are tailored to the unique considerations associated with the facilities, including risks posed by release, theft/diversion and/or sabotage. Facilities consider a variety of measures, including perimeter barriers, security lighting, security forces, and monitoring and intrusion detection systems when developing a security plan. Physical security is also critical to creating sufficient time between detection of an attack and the point at which the attack becomes successful. Physical security is essential to safeguarding high-risk chemicals, as it often provides the first-line of defense against potential incidents.
As facilities continue to increase their reliance on computer-controlled systems, protecting against cyber sabotage—such as cyber intrusions, malware attacks, and viruses—is an increasingly essential component in managing overall risk for a chemical facility. The goal of cybersecurity in the CFATS program is to reduce the risk of bad actors conducting malicious attacks on critical systems, which could result in theft, diversion, release, or sabotage of high-risk chemicals. When a facility’s cyber system(s) interfaces with COI, the CFATS program requires protection of the cyber systems to the degree necessary to satisfy the RBPS. DHS is also responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure. For more information on national security/emergency preparedness communications and cybersecurity initiatives for both government and industry partners, please visit www.dhs.gov/stakeholder-engagement-and-cyber-infrastructure-resilience.
While cyber and physical security are important facets of the CFATS program, these security concerns go beyond the Chemical Sector into all areas of critical infrastructure. Many of the security measures that chemical facilities put into place can be useful for businesses and facilities across the country. DHS recognizes that communities are the first-line defense in keeping the public safe and secure. Because homeland security starts with hometown security, DHS provides free tools, training, and resources and encourages businesses, organizations, and communities to Connect, Plan, Train, and Report. Applying these steps before an incident occurs can help better prepare businesses, organizations, and their employees to proactively think about the role they play in the safety and security of their communities. For more information, visit www.dhs.gov/hometown-security.
DHS provides resources for businesses, communities, and local governments across the United States to enhance the security and resilience of the Nation’s critical infrastructure and to prepare for and recover from any hazard facing us. For the Chemical Sector, Chemical Security Inspectors are located in communities across the country and are available to engage with municipalities and organizations regarding the CFATS process for better community preparedness. For all questions or to contact an inspector, email CFATS@hq.dhs.gov or visit www.dhs.gov/chemicalsecurity for more information about the CFATS program and chemical security.
Department of Homeland Security’s founding principle and highest priority is to protect the American people from terrorist threats. For more information visit www.dhs.gov.