iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, chemical facilities can face serious cyber risks, but the “decade out of date” finding is a specific historical one—not a description of every resource available today. In May 2020, the U.S. Government Accountability Office (GAO) reported that Department of Homeland Security guidance for an estimated 3,300 facilities covered by the Chemical Facility Anti-Terrorism Standards (CFATS) had not been updated in more than 10 years. CFATS authority later expired, on July 28, 2023, changing what federal regulators can require. Facilities now need to distinguish that expired regulatory program from voluntary security assistance and guidance.
What did GAO say was out of date?
GAO’s May 14, 2020 audit examined DHS oversight of cybersecurity at high-risk chemical facilities subject to CFATS. It found that the guidance intended to help those facilities comply with cybersecurity and other standards had not been updated in more than 10 years. GAO also found that CFATS officials lacked a routine process for reviewing cybersecurity guidance against changing threats and technology. The estimated 3,300 facilities refers to GAO’s 2020 report, not a current facility count. GAO-20-453
The age finding applies to the CFATS guidance GAO reviewed. It does not establish that all U.S. chemical-sector cybersecurity guidance is outdated, nor does it mean that the same CFATS requirements remain enforceable today.
Why could a cyberattack at a chemical facility have serious consequences?
Chemical facilities may depend on information systems and industrial control systems to manage operations. GAO warned that adversaries could manipulate facility information or control systems to release or steal hazardous chemicals, potentially causing mass casualties among nearby populations. This describes a possible consequence, not a prediction that an attack is imminent.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
The available sources do not establish a current probability or annual frequency for a disastrous cyberattack on U.S. chemical plants. Risk varies by facility and depends on the threat, the facility’s vulnerabilities, and the consequences of a successful incident. CISA uses those factors in its chemical-security risk framing. CISA: Chemical Threat and Risk
What changed when CFATS authority expired?
CFATS statutory authority expired on July 28, 2023. CISA says it cannot enforce the CFATS regulations while that authority is expired. In practical terms, the agency says it cannot require facilities to report chemicals of interest, submit Chemical Security Assessment Tool (CSAT) information, undergo CFATS inspections, or implement CFATS site security plans. The legal provisions are in 6 U.S.C. Chapter 1, Subchapter XVI; CISA’s CFATS notice describes the agency’s current position.
CISA encourages facilities to maintain security measures despite the lapse. Its notice identifies ChemLock as voluntary assistance rather than an enforceable replacement for CFATS. This distinction matters: a facility may still need to address cyber and physical risks, but the cited notice does not authorize CISA to impose the expired CFATS obligations.
What guidance and assistance can facilities use now?
These resources differ in legal status, audience, and the kind of support they provide; none should be described as a currently enforceable CFATS requirement.
| Resource | Status and audience | What it offers—and what to keep in mind |
|---|---|---|
| CISA ChemLock | Voluntary chemical-security assistance for facilities. | CISA describes tailored options including on-site consultations and training. Facilities can use it to seek support suited to their circumstances; it is not a substitute for expired CFATS authority. |
| CISA Cross-Sector Cybersecurity Performance Goals | Voluntary practices for organizations across critical-infrastructure sectors. | Offers a cross-sector set of cybersecurity practices. CISA also identifies Chemical Sector-specific goals as voluntary practices that go beyond the cross-sector goals; neither set is a binding CFATS baseline. |
| CISA Chemical Sector Cybersecurity Framework Implementation Guidance | Sector-focused reference guidance. | Can be consulted as a framework implementation resource. The cited material does not establish that it is the latest guidance or a mandatory current baseline. |
Did DHS act on GAO’s recommendations?
GAO’s follow-up records that CISA approved an Information Guidance Directive, establishing a review process for guidance. The directive called for immediate notifications about vulnerabilities and threats, quarterly guidance updates, and longer-term review of significant guidance. GAO marked its recommendation on the review process closed as implemented. Other recommendations were marked no longer valid after CFATS authority expired; GAO’s status page gives January 2025 for that disposition. These actions address the audit record, but they do not restore CFATS authority. GAO-20-453 and recommendation status
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a chemical facility do with this information?
Facilities should treat the 2020 audit as a warning about the risks of relying on static guidance, not as proof that every plant is currently exposed or that a major attack is forecast. A practical next step is to assess the facility’s own systems, hazards, and consequences, then select current assistance that fits its operations.
Rank #4
- Confirm which requirements are legally in force for the facility; do not assume expired CFATS reporting, inspection, or site-plan obligations remain enforceable.
- Review how information and control systems relate to hazardous chemical handling and facility operations, and identify where a compromise could affect safety or security.
- Use CISA’s voluntary ChemLock consultations or training if tailored chemical-security assistance would help.
- Use CISA’s voluntary cybersecurity goals and sector guidance as references, checking their current status and applicability rather than treating them as binding rules.
- Set a process to revisit security measures as threats, technology, and facility conditions change; GAO’s findings show why a one-time guidance review is not enough.
For current program status, consult CISA’s CFATS notice directly: the page is marked archived in some search results, and program authority can change. The cited notice states that CFATS authority expired and describes voluntary assistance while the authority is lapsed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
