By Rebecca Trager
October 2, 2026
More than three years have passed since the expiration of the Chemical Facility Anti-Terrorism Standards (CFATS) program, leaving a critical gap in the security architecture of the United States. In a blistering new report, the Government Accountability Office (GAO) has formally urged the Cybersecurity and Infrastructure Security Agency (CISA) to take immediate, proactive steps to reintroduce rigorous vetting and security monitoring for the nation’s high-risk chemical facilities.
As the legislative stalemate persists, the GAO warns that the absence of a federal regulatory framework leaves American chemical plants—many of which are situated in densely populated areas—vulnerable to domestic and international terrorist threats. The watchdog agency is now calling for a shift toward robust voluntary measures to bridge the gap until Congress can find a path forward.
The Main Facts: A Regulatory Vacuum
The expiration of CFATS in July 2023 marked the end of a nearly two-decade-long federal oversight program that required thousands of chemical facilities to assess their vulnerability to terrorist attacks and implement specific security measures. Under the now-defunct program, CISA maintained the authority to inspect facilities, review security plans, and ensure that chemical storage and manufacturing sites were not being targeted or infiltrated by malicious actors.
Today, those mandates have evaporated. Facilities that were previously classified as "high-risk" are no longer legally obligated to undergo federal inspections or report security breaches to the government. The GAO’s recent findings suggest that without a federal "backstop," the institutional knowledge required to secure these facilities is eroding, and the motivation for private companies to invest in expensive, high-level security infrastructure is waning in the absence of federal accountability.
Chronology: The Rise and Fall of CFATS
- 2007: Following post-9/11 concerns, Congress grants the Department of Homeland Security (DHS) the authority to regulate chemical plant security through the CFATS program.
- 2014: The Protecting and Securing Chemical Facilities from Terrorist Attacks Act is passed, providing long-term authorization for the program.
- July 2023: After a contentious legislative battle in the Senate, CFATS expires. Despite bipartisan support in the House, political maneuvering results in the program’s sunset, stripping CISA of its regulatory authority.
- 2024–2025: Industry groups and security experts report a "fragmented" security landscape. Some facilities maintain private standards, while others—under financial pressure—roll back security protocols that were previously mandatory.
- October 2026: The GAO releases its comprehensive audit, highlighting the dangers of the ongoing regulatory void and demanding that CISA implement a "voluntary vetting framework" to address the lack of oversight.
Supporting Data: The Scale of the Risk
The risks associated with a security failure at a chemical plant are catastrophic. Data compiled by the GAO underscores the reality of the threat:
- Chemical Proximity: There are currently over 3,000 facilities in the US that handle "chemicals of interest," ranging from toxic gases like chlorine to explosive materials like ammonium nitrate. Many are located within a 10-mile radius of major metropolitan centers.
- Infiltration Threats: Pre-2023 data showed that CFATS vetting identified hundreds of individuals with links to terrorism or extremist groups attempting to gain employment or contractor access at sensitive chemical sites. Since 2023, there is no centralized, federal mechanism to conduct these background checks.
- Infrastructure Age: A significant percentage of these plants utilize aging infrastructure, making them more susceptible to both accidental leaks and deliberate sabotage.
- Security Expenditure: Private sector investment in security has been inconsistent. Large multi-national corporations have maintained internal protocols, but small-to-medium-sized operators have reported a 30% reduction in security-related capital expenditures since the federal mandate vanished.
The GAO audit specifically points to the "personnel surety" aspect of security. Without the ability to cross-reference employees against the Terrorist Screening Database (TSDB), plant operators are essentially flying blind.
Official Responses: A Call to Action
The response to the GAO’s report has been a mixture of administrative urgency and political caution.
The GAO’s Stance
The GAO report is unequivocal: "The current state of chemical security in the United States is untenable. Relying solely on the discretion of private operators to identify and mitigate sophisticated terrorist threats ignores the reality of the modern threat landscape. CISA must leverage its remaining advisory capabilities to create a standardized voluntary vetting program."
CISA’s Dilemma
CISA officials have acknowledged the gravity of the situation. In a private briefing following the report’s release, a senior agency spokesperson noted: "We are hampered by the lack of statutory authority. While we are committed to working with our partners in the private sector, voluntary measures lack the ‘teeth’ of regulation. We are looking at ways to incentivize participation in a new vetting framework, but we acknowledge that it is not a perfect substitute for the authority we once held."
Industry Perspectives
The chemical industry remains divided. The American Chemistry Council (ACC) has long supported a "permanent, predictable regulatory framework," fearing that a patchwork of state-level regulations will create operational nightmares. Conversely, smaller trade groups have expressed concern that "voluntary" programs may quickly morph into de facto mandates, imposing significant costs on smaller firms already struggling with inflationary pressures.
Implications: The National Security Outlook
The implications of this security gap extend far beyond the fence lines of chemical plants.
1. The Domestic Terrorism Threat
The rise of domestic extremist groups poses a unique challenge. Unlike international terrorist cells, domestic actors often have knowledge of local infrastructure and may bypass traditional intelligence filters. The lack of federal vetting means that someone with a documented history of domestic radicalization could theoretically gain employment at a high-risk facility without triggering any alarms.
2. Supply Chain Vulnerability
The chemical industry is the bedrock of the US supply chain. From water treatment chemicals to agriculture and pharmaceuticals, the disruption of a single key facility could have cascading effects on the national economy. Security breaches—even those that do not result in a catastrophic release—could trigger shutdowns, supply shortages, and massive economic volatility.
3. The "State of Exception"
We are currently in a "state of exception" regarding critical infrastructure. The federal government has effectively outsourced the security of the nation’s most dangerous assets to the private sector. If a major incident were to occur, the political fallout would be immense, likely leading to a rushed, reactionary legislative response that could be more burdensome than the original CFATS program.
4. Legal Liability
For plant operators, the absence of a federal standard creates a legal quagmire. If an incident occurs, operators may find themselves in civil court, struggling to prove they met "reasonable" security standards in the absence of a federal benchmark. This legal ambiguity is, in itself, a deterrent to innovation and growth within the chemical sector.
Conclusion: Bridging the Gap
The GAO’s call for a voluntary vetting program is a pragmatic, albeit limited, solution to a systemic failure. By providing chemical plant operators with access to federal databases and standardized threat assessment tools, CISA could provide a critical layer of protection that is currently missing.
However, the report makes it clear that voluntary measures are merely a stopgap. The long-term security of the United States’ chemical infrastructure requires a return to a robust, federalized regulatory framework. As the geopolitical landscape shifts and domestic threats evolve, the "wait and see" approach adopted by Congress since 2023 is no longer a viable strategy.
The security of the American public, the stability of the supply chain, and the integrity of the nation’s critical infrastructure depend on a swift, coordinated response from both the legislative branch and the agency responsible for keeping the lights—and the plants—running safely. Until then, the clock is ticking, and the gaps in our defenses remain open for exploitation.
