Disclosure of CVI

Access to or disclosure of Chemical-terrorism Vulnerability Information (CVI) requires that an individual (1) has a need to know the information and (2) is a CVI Authorized User.

Under the Chemical Facility Anti-Terrorism Standards (CFATS) (6 CFR § 27.400), a covered person is an individual who has a need to know CVI or someone who gains access to what they know to be or reasonably know to constitute CVI.

All covered persons must comply with the handling and safeguarding requirements for CVI outlined in 6 CFR § 27.400, be familiar with the CVI Procedural Manual and any other guidance the Cybersecurity and Infrastructure Security Agency (CISA) may provide in the future, and be aware that divulging information without proper authority could result in an administrative compliance order, civil penalties, or other enforcement or corrective actions by the Agency (e.g., revocation of CVI Authorized User status). See 6 CFR §§ 27.300(b)(3), 27.400(j).

Disclosing CVI within a Facility and Among Private Sector Entities

A facility may disclose CVI to any of the facility's board members, officers, employees, and any private sector third parties who are affiliated with the facility (e.g., outside attorneys, accountants, consultants, trade association employees) who are CVI Authorized Users with a need to know.

Notification and tracking of disclosures: Facilities do not need to notify the Agency of proper disclosures of CVI (i.e., disclosures to Authorized Users with a need to know). Nonetheless, the Agency encourages facilities to maintain a Tracking Log of the receipt and disclosure of all CVI.

Chemical facilities should also consider:

  1. Appointing a CVI Point of Contact (POC) to provide oversight and assistance to individuals within the facility.
  2. Implementing procedures to ensure that CVI is used, handled, safeguarded, and disclosed appropriately.
  3. Establishing a self-inspection program to include periodic review and assessment of the handling, use, and storage of CVI.

Disclosing CVI by Facilities to State, Local, and Tribal Agencies

Facilities may disclose CVI to officials in state, local, and tribal agencies (e.g., local county emergency managers and local police officials) who are CVI Authorized Users and have a need to know.

The determination that a state, local, or tribal official is a CVI Authorized User and has a need to know will be made by the CISA chemical security inspector assigned to the region in which the facility is located. The inspector will provide the public official with documentation of that determination.

After being allowed access to CVI, the facility and public official should discuss (1) which CVI documents, or portions of CVI documents, the official needs to execute his responsibilities, and (2) how the facility should disclose those documents (e.g., providing the official a copy of the document or arranging an onsite review).

Notification and tracking of disclosures: When a facility properly discloses CVI to a public official, the facility does not need to notify CISA of the disclosure. CISA encourages both the public official and agency to maintain a CVI Tracking Log. See Appendix D of the CVI Procedural Manual.

All government agencies should also consider:

  1. Appointing a CVI Point of Contact (POC) to provide oversight and assistance to individuals within the agency.
  2. Implementing procedures to ensure that CVI is used, handled, safeguarded, and disclosed appropriately.
  3. Establishing a self-inspection program to include periodic review and assessment of the handling, use, and storage of CVI.

Reporting CVI Incidents

Under 6 CFR § 27.400(d), covered persons must notify the Agency of any unauthorized releases of CVI and refer to the Agency any requests for access to CVI by persons without a need to know.

Chemical facilities and other entities or persons are encouraged to contact the Agency about any actual or suspected misuse of or unauthorized access to CVI. Information about such actual or suspected incidents may be reported to the CISA chemical security inspector assigned to the area in which the incident occurred. See Chapter 10.0 of the CVI Procedural Manual.

In the event of any disagreement between the facility and the public official regarding the precise CVI to be disclosed or the method of disclosure, CISA encourages the parties to refer the matter to the CISA chemical facility inspector for resolution.

Contact Information

If you have questions or need to contact the CISA chemical facility security inspector assigned to your region, call the CSAT Help Desk at 866-323-2957 Monday through Friday (except federal holidays) from 8:30 a.m. to 5 p.m. (ET), or email CSAT@hq.dhs.gov.

Was this document helpful?  Yes  |  Somewhat  |  No