As of July 28, 2023, Congress allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards (CFATS) program (6 CFR Part 27) to expire. Therefore, CISA cannot enforce compliance with the Cybersecurity and Infrastructure Security Agency (CFATS) regulations at this time.

Department of Homeland Security Issues
Chemical Facility Anti-Terrorism Standards

On November 20, 2007 the Department of Homeland Security (DHS) published the "final" Chemical Facility Anti-Terrorism Standards (CFATS). Affected facilities have until January 22, 2008 to register and submit a "Top-Screen" questionnaire through the secure DHS Chemical Security Assessment Tool (CSAT) web site. DHS will evaluate Top-Screen submissions. Based on their review some facilities that will be required to:

• prepare Security Vulnerability Assessments (SVAs), which identify facility security vulnerabilities, and to
• develop and implement Site Security Plans (SSPs), which include measures that satisfy the identified risk-based performance standards

In general, CFATS will not apply to most metal finishers because the minimum concentrations and/or threshold quantities of applicable chemicals are beyond those of chemicals present at most metal finishing shops. Here are some common metal finishing chemicals that are on the DHS list, along with minimum concentrations and threshold quantities:

Chemical	Min. conc.	Threshold quantity (lb)
Chlorine	1%	2,500
Chlorine	9.77%	500
Hydrochloric acid	37%	15,000
Hydrofluoric acid	50%	1,000
Nitric acid	80%	15,000
Nitric acid	68%	400
Sulfur Dioxide	1%	5,000
Sulfur Dioxide (anhydrous)	84%	500

This table combines information for the three types of risks, defined below. In some cases, the same chemical can have more than one set of minimum concentration/quantity thresholds, depending on how it is stored. Identifying Chemicals and Calculating Quantities The first step in determining if this regulation applies to your facility is to compare the chemicals you have on-site with the list published by the Department of Homeland Security (DHS). The DHS list is referred to as "Appendix A" of the regulation (see pages 65421 - 65435 of the November 20, 2007 Federal Register notice) and the chemicals listed are referred to as "chemicals of interest" (COI). For each COI, the Department of Homeland Security (DHS) evaluated the potential security risk, considering three major categories and six subcategories:

• Release Chemical Category - The release threshold is focused on preventing someone from intentionally releasing a chemical that could affect the population within and beyond a facility. This includes chemicals that are in metal finishing tanks and those in inventory/storage. There are three subcategories:
• Toxic Subcategory
• Flammables Subcategory
• Explosives Subcategory:
• Theft and Diversion Chemical Category - The theft threshold is focused on preventing someone from stealing a chemical and weaponizing it. This category includes chemicals that are in transportable containers (e.g., carboys, drums, rail tank cars). There are three subcategories:
• Chemical Weapons/Chemical Weapon Precursors Subcategory
• Weapons of Mass Effect Subcategory
• Explosives/Improvised Explosive Device (IED) Precursors Subcategory
• Sabotage/Contamination Chemical Category - The sabotage threshold is focused on preventing someone from obtaining a chemical and mixing it with other readily-available materials to create significant adverse consequences for human life or health. The sabotage thresholds only apply when the chemical is being shipped, and therefore would not typically apply to a metal finisher.

Where a potential risk was identified for particular chemicals, DHS published a minimum concentration, measured in percent and screening threshold quantity (STQ), measured in pounds. In some cases, for a given chemical, the minimum concentration and/or the STQ are different depending on the security risk category. Therefore, it is important to understand what each security risk category encompasses and to sort your chemicals by category. In some cases, a chemical can be counted in more than one category. Example: A metal finishing facility surveys their facility and finds the following concentrations and quantities of nitric acid:

• In use:
• Stainless steel passivation tank: 600 gal. 42% nitric acid
• Zincate strip tank: 300 gal. 50% nitric acid
• Cadmium strip for aluminum alloys tank: 200 gal. 68% nitric acid
• Inventory:
• 20 carboys (300 gal.) of 68% nitric acid

The screening threshold quantities for nitric acid are as follows (from Appendix A):

• Release: nitric acid (minimum 80%): 15,000 lbs.
• Theft: nitric acid (minimum 68%): 400 lbs.
• Sabotage: not listed

Release Category Evaluation: All of the nitric acid at this facility is below the minimum 80% concentration and therefore is not counted toward the release calculation.

Theft Category Evaluation: The quantity of nitric acid "in use" is not counted in the theft category evaluation because it is not in transportable containers. The 300 gal. in inventory must be counted since it is in transportable containers and it meets the minimum concentration for this category (68%). Therefore the total quantity is 300 gal., which has a weight of 3,524 lbs. This is above the screening threshold quantity of 400 lbs. Therefore, this facility must register and submit a "Top-Screen" questionnaire through the secure DHS Chemical Security Assessment Tool (CSAT) web site.

Sabotage Category Evaluation: This facility does not ship nitric acid and therefore the sabotage category is not applicable.

Miscellaneous Issues
The following are topics that may assist you in complying with the Chemical Facility Anti-Terrorism Standards (CFATS).

Below the Thresholds now - but above in the future
If your facility is currently below screening threshold quantities, but in the future it meets or exceeds a threshold, you must notify DHS within 60 calendar days from the time you come into possession of the chemical(s).

Potassium and sodium cyanide
Potassium and sodium cyanide are both on the Appendix A list of chemicals of interest (COI). However, in both cases, they are listed only for the sabotage category. This category only applies if you ship the chemical and are required under law to placard the shipment. Therefore, in most cases, metal finishers would not report these chemicals.

Hazardous wastes
Solid waste, including hazardous waste, regulated under the Resource Conservation and Recovery Act (RCRA) is excluded from the calculations required under the Chemical Facility Anti-Terrorism Standards (CFATS)

Propane
In calculating whether a facility posses an amount that meets the STQ for propane, a facility need not include propane in tanks of 10,000 pounds or less.

Chemical mixtures
If a release-toxic chemical of interest is present in a mixture, and the concentration of the chemical is equal to or greater than one percent (1%) by weight, the facility must count the amount of the chemical of interest in the mixture toward the STQ. If a release-toxic chemical of interest is present in a mixture, and the concentration of the chemical is less than one percent (1%) by weight of the mixture, the facility need not count the amount of that chemical in the mixture in determining whether the facility possesses the STQ.

More Resources

• Chemical Facility Anti-Terrorism Standards (CFATS), Federal Register November 20, 2008 (includes Appendix A).
• "Top-Screen" questionnaire through the secure DHS Chemical Security Assessment Tool (CSAT) web site.
• Fact Sheet: Chemical Facility Anti-Terrorism Standards: Appendix A.