About | HeinOnline Law Journal Library | HeinOnline Law Journal Library | HeinOnline

1 1 (July 14, 2023)

handle is hein.crs/govemfj0001 and id is 1 raw text is: 







              Congressional                                                     ____
          R *fesearch Service






Chemical Security: Regulatory Implications of

Terrorism Risk Assessment Methodology



July  14, 2023


The Chemical Facility Anti-Terrorism Standards (CFATS) program imposes security requirements on
certain facilities that manufacture, process, or store chemicals of interest-i.e., chemicals that bad actors
might steal, divert, or exploit for nefarious purposes, including terrorism. Some Members have introduced
legislation in the House and Senate that would provide a long-term extension of existing authorities.
Several major industry groups have signaled support for CFATS extension. However, other Members, as
well as some researchers and industry stakeholders, have raised concerns about the program, including
questions about the risk assessment methodology used to inform CFATS regulatory activities and cost-
benefit analyses. Sub-optimal risk methodologies may impose needless regulatory burdens on some
stakeholders or fail to protect the public as well as intended.
The Department of Homeland Security (DHS), which administers CFATS through the Cybersecurity and
Infrastructure Security Agency (CISA), designed program rules and security requirements in reference to
a basic risk model, which defines risk as a function of threat, vulnerability, and potential consequence
(TVC). This model has been widely used within DHS and the broader homeland security enterprise for
decades, but has also been criticized on conceptual and methodological grounds. Some industry
stakeholders and members of the scientific research community have proposed modifications and
alternatives, or called for greater oversight of the risk methodology development process. As Congress
considers reauthorization of CFATS, it may consider risk methodology issues, available oversight options,
and whether current program authorities should be extended, modified, or allowed to expire. Current
program authorization will expire on July 27, 2023, absent congressional action.


Current DHS Risk Assessment Concepts and Methods

DHS  defines risk as the potential for an unwanted outcome resulting from an incident, event, or
occurrence, as determined by its likelihood and the associated consequences, which has the three TVC
components noted above. DHS has long used this model-originally developed to inform homeland
security grant award allocations-to inform various other planning, programs, and budget activities. A
variety of formal and informal methods may be used when applying this model to specific analytical
tasks. Depending on the method or approach, the TVC terms may be either multiplied together (as they
                                                               Congressional Research Service
                                                               https://crsreports.congress.gov
                                                                                    IN12199

CRS INSIGHT
Prepared for Members and
Committees of Congress

What Is HeinOnline?

HeinOnline is a subscription-based resource containing thousands of academic and legal journals from inception; complete coverage of government documents such as U.S. Statutes at Large, U.S. Code, Federal Register, Code of Federal Regulations, U.S. Reports, and much more. Documents are image-based, fully searchable PDFs with the authority of print combined with the accessibility of a user-friendly and powerful database. For more information, request a quote or trial for your organization below.



Short-term subscription options include 24 hours, 48 hours, or 1 week to HeinOnline.

Already a HeinOnline Subscriber?

profiles profiles most