What Was the DHS CFATS Program and Does It Still Matter After Its Expiration? | Blog No. 116

For more than a decade, the Department of Homeland Security’s Chemical Facility Anti-Terrorism Standards (CFATS) program served as the United States’ primary regulatory framework for protecting high-risk chemical facilities from terrorist threats. But on July 28, 2023, Congress allowed CFATS’s statutory authority to expire, effectively shutting down the program overnight.

If you work in ammonia refrigeration, chemical manufacturing, energy, distribution, or any sector handling hazardous chemicals, you may be wondering: What exactly was CFATS? Who did it apply to? And does it still matter now that the program is no longer enforceable?

Let’s break it down.

What Was CFATS?

CFATS was a federal security program established under 6 CFR Part 27 to identify and regulate high-risk chemical facilities. Its purpose was straightforward but critical: to prevent terrorists from acquiring or exploiting dangerous chemicals.

To do this, DHS required facilities to:

• Submit a Top-Screen describing their Chemicals of Interest (COI)

• Complete a Security Vulnerability Assessment (SVA) if deemed high-risk

• Develop a Site Security Plan (SSP) or Alternative Security Program

• Implement security measures aligned with 18 Risk-Based Performance Standards (RBPS)

• Participate in DHS inspections and ongoing compliance

  
  

CFATS was not a safety program like OSHA PSM or EPA RMP. It was a security program focused on intentional, malicious threats rather than accidental releases.

Who Did CFATS Apply To?

CFATS applied to any facility that possessed DHS Chemicals of Interest (COI) at or above the Screening Threshold Quantity (STQ) listed in Appendix A.

This included facilities in:

• Ammonia refrigeration (anhydrous ammonia is a COI)

• Chemical manufacturing and blending

• Oil & gas and energy infrastructure

• Agriculture and fertilizer production

• Food and beverage processing

• Warehousing and distribution

• Universities and research labs

• Pharmaceutical and healthcare sectors

  
  

If a facility met or exceeded a COI threshold, it was required to submit a Top-Screen even if it ultimately was not deemed “high-risk.”

What Did the 2023 Expiration Mean?

When Congress failed to renew CFATS on July 28, 2023, DHS immediately lost:

• Authority to require Top-Screens

• Authority to enforce security plans

• Authority to conduct inspections

• Authority to issue penalties

• Authority to maintain the Personnel Surety Program (TSDB vetting)

  
  

In short, CFATS stopped being a mandatory regulatory program.

DHS shuttered its compliance operations, paused inspections, and suspended all enforcement.

However, and this is important, the underlying security risks did not disappear.

Does CFATS Still Serve Any Value Today?

Yes, a lot of value, even without enforcement.

1. A proven, risk-based security model

The 18 RBPS standards are still widely viewed as a gold standard for chemical security. They cover:

• Physical security

• Cybersecurity

• Access control

• Personnel surety

• Monitoring and detection

• Incident response

• Training and drills

  
  

Even without DHS oversight, these remain best practices for high-risk chemical operations.

2. A defense-in-depth mindset

CFATS pushed facilities to think like adversaries, not just operators. That mindset is still crucial for facilities with high-consequence chemicals like ammonia, chlorine, or flammables.

3. A competitive and risk-management advantage

Maintaining CFATS-level security can:

• Strengthen insurance and risk profiles

• Support corporate ESG and governance expectations

• Impress customers, auditors, and boards

• Reduce liability exposure after an incident

  
  

4. A likely foundation for future regulation

There is ongoing interest in reviving CFATS or replacing it with a similar program. Facilities that keep CFATS-aligned controls in place will be better positioned if Congress restores or reimagines the program.

5. A practical tool alongside PSM and RMP

CFATS fills a gap that OSHA PSM and EPA RMP do not: It focuses on intentional security threats, not accidental releases.

For ammonia refrigeration and other covered processes, CFATS concepts integrate naturally with PSM and RMP to create a more complete risk picture.

Side-by-Side Comparison: CFATS vs. PSM vs. RMP

Here’s a concise comparison you can drop straight into training, leadership briefings, or program documentation.

Feature / Focus on the	CFATS (DHS)	PSM – 29 CFR 1910.119 (OSHA)	RMP – 40 CFR Part 68 (EPA)
Primary purpose	Security: prevent terrorist misuse of chemicals	Process safety: protect workers from catastrophic releases	Risk management: protect the public and the environment from accidental releases
Core risk focus	Intentional acts (theft, sabotage, terrorism)	Process hazards, mechanical integrity, human factors	Off-site consequences, worst-case and alternative releases
Lead agency	DHS	OSHA	EPA
Status as of now	Authority expired July 28, 2023 (no enforcement)	Fully in force	Fully in force
Trigger for applicability	DHS Chemicals of Interest at or above STQ	Listed highly hazardous chemicals above threshold quantities	Regulated substances above threshold quantities
Key required documents	Top-Screen, SVA, Site Security Plan	Process Safety Information, PHA, Operating Procedures, MOC, etc.	Hazard Assessment, Prevention Program, Emergency Response Program
Main audience	Security, management, and facility leadership	Operations, maintenance, engineering, EHS	EHS, emergency planners, community stakeholders
Inspection/enforcement style	Security inspections, plan authorization (historically)	Workplace safety inspections, citations, and penalties	Environmental inspections, RMP audits, penalties
Inside vs. outside the fence line	Both, but focused on protecting chemicals from misuse	Primarily inside the fence line protecting workers	Strong emphasis outside the fence line on the community and environment

A simple way to explain this to leadership:

• PSM – Protects people inside the facility from catastrophic process incidents.

• RMP – Protects the community and environment outside the facility from accidental releases.

• CFATS – Protects chemicals themselves from being used as weapons or targets.

  
  

So… Should Facilities Still Care About CFATS?

If your facility handles chemicals that could be weaponized or misused, the answer is yes.

CFATS may no longer be enforceable, but its principles remain:

• Operationally valuable

• Industry-recognized

• Risk-reducing

• Strategically important

• Likely to return in some form

  
  

In other words, CFATS is gone, but chemical security is not.

Facilities that continue to apply CFATS-style security measures are not just checking a regulatory box; they’re protecting their people, their communities, and their business.

Previous Blog: EPA Proposes Major Changes to the RMP Rule | Blog No. 115

---

For a comprehensive training on Anhydrous Ammonia, click here for our PSM Academy Ammonia Awareness training, to learn and earn a certificate of completion. Training is in English and Spanish. Use code SDS20 for a 20% discount on the entire purchase. For more information, email us at academy@machapsm.com.For a comprehensive training on Anhydrous Ammonia, click here for our PSM Academy Ammonia Awareness training, to learn and earn a certificate of completion. Training is in English and Spanish. Use code SDS20 for a 20% discount on the entire purchase. For more information, email us at academy@machapsm.com.