Under the Chemical Facility Anti-Terrorism Standards (CFATS) program, the Cybersecurity and Infrastructure Security Agency (CISA) uses a dynamic risk assessment and tiering methodology to determine which chemical facilities with holdings of regulated chemicals of interest (COI) represent a high-risk in case of a successful terrorist attack. Chemical facilities determined to be “high-risk” are assigned to one of four risk-based tiers.
The CFATS tiering methodology takes into account three elements of risk in a facility’s high-risk determination and tier assignment:
- Vulnerability to a terrorist attack.
- Potential consequences of an attack.
- Level of threat of a terrorist attack.
High-risk chemical facilities are subject to CFATS regulation and must develop and implement a security plan with measures that are tailored to the tier level and unique considerations of the facility.
Determining High-Risk Chemical Facilities
To determine a facility’s risk level, CISA uses information facilities submit through the Top-Screen survey, which is then assessed based on vulnerability, potential consequences, and threat of a terrorist attack. After analyzing the Top-Screen data, CISA determines which facilities are high-risk, and assigns those facilities a Tier of 1, 2, 3, or 4, with Tier 1 representing the highest risk.
- Read the CFATS Tiering Methodology fact sheet to better understand the types of items that may impact a facility’s high-risk status and, as applicable, assignment of their risk tier.
2016 Enhanced Tiering Methodology
Chemical security is not a temporary issue. As threats evolve, the Agency is committed to using the best tiering methodology to identify high-risk chemical facilities.
In 2013, the CFATS risk-tiering methodology underwent a thorough review by external experts from industry and government. The results led to the 2016 implementation of the enhanced tiering methodology, which more accurately determines and appropriately tiers high-risk chemical facilities.
While much of the risk tiering methodology is sensitive and/or classified, the enhanced methodology includes several new components within each element of risks—facility's vulnerability, potential consequence, and threat factors—such as improved physics-based models for impacts of COI that could be exploited on-site and off-site; updates to the threat model to be informed by intelligence, and better population modeling for release facilities.
Rollout of the Enhanced Tiering Methodology
In 2016, CISA began notifying chemical facilities of interest about the requirement to submit a new Top-Screen using Chemical Security Assessment Tool (CSAT) 2.0. The new submission was then analyzed using the enhanced risk-assessment methodology.
Facilities had the option to proactively resubmit a Top-Screen prior to receiving the individual notification from CISA. Chemical facilities that have never submitted a Top-Screen, but have come into possession of COI, must submit a Top-Screen in CSAT 2.0 within 60 days of coming into possession of a COI.
In April 2017, CISA began issuing tiering determination letters to facilities that were assessed using the enhanced methodology. Letters continue to be issued as facilities submit Top-Screens.
Results of the Enhanced Tiering Methodology
Based on the Agency's analysis of a representative sample of tiering results, some facilities have seen a change in their tier. Some facilities that were previously not covered under CFATS found themselves covered, and some previously-covered facilities are no longer considered high-risk. Some of these tier changes are a result of the enhanced tiering methodology, while others are the result of changes facilities have made to their business, such as adding and removing COI, or modifying storage methods.
CISA is committed to sharing information and providing assistance throughout the CFATS process to ensure facilities have the necessary information.
Visit the CFATS Knowledge Center for an online repository of frequently asked questions, articles, and more information.
If you have additional questions, please call the CSAT Help Desk at 866-323-2957 Monday through Friday (except federal holidays) from 8:30 a.m. to 5 p.m. (ET) or email CSAT@hq.dhs.gov.