Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties

What GAO Found

The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is the sector risk management agency (SRMA) for the U.S. chemical sector, responsible for implementing programs to assist facility owners and operators in identifying and mitigating security risks. In 2007, DHS established a regulatory program to mitigate security risks for high-risk chemical facilities. As part of this program, CISA required facilities to vet their personnel and certain unescorted visitors for terrorist ties against the U.S. government’s terrorist watchlist. Vetting against the U.S. terrorist watchlist is an inherently governmental function that the private sector cannot perform on its own; therefore, CISA set up a process with options facilities could use for such vetting. Authorization for the regulatory program lapsed in July 2023. The program, including personnel vetting, was discontinued. High-risk chemical facilities are now responsible for identifying and mitigating their own security risks.

According to CISA officials and selected private sector stakeholders GAO interviewed, losing access to the terrorist vetting process is the most significant challenge high-risk facility owners and operators have faced since the discontinuation of CISA’s regulatory program and it has left a gap in chemical facility security that poses substantial risks. The statutory authority that establishes SRMA responsibilities specifies that SRMAs are to implement security programs to assist stakeholders in identifying and mitigating risks to their assets and systems. As of May 2026, CISA said it was exploring whether the agency’s SRMA authority could be used to set up a vetting process. Without federal options for the terrorist vetting of personnel, facility owners and operators lack a critical tool to protect their facilities from an insider terrorist attack and from potential disruptions to critical national supply chains.

From fiscal years 2024 to 2025, the number of CISA active personnel dedicated to chemical sector activities declined from 214 (96 percent of authorized positions) to 52 (25 percent of authorized positions). The active personnel did not include full-time personnel scheduled to separate from CISA by the end of calendar year 2025 through deferred resignations programs. CISA said the reductions have necessitated reducing or eliminating services, such as most on-site facility assessments, but also said the agency continues to offer other services, such as security training and cybersecurity guidance. Selected private sector stakeholders told GAO that CISA’s personnel reductions and the loss of experienced staff have reduced their contact with CISA regarding facility security vulnerabilities.

Chemical Facility Warehouse and Operations

Why GAO Did This Study

According to DHS, as of 2025, more than 89 million people lived or worked within 2 miles of a U.S. facility using high-risk chemicals. DHS estimates that should high-risk chemicals be weaponized, it could cause significant harm to surrounding populations, from fatalities within the facility to the equivalent impact of a nuclear explosion.

GAO was asked to examine DHS’s efforts to mitigate security risks to the U.S. chemical sector. This report addresses, among other issues, CISA and sector stakeholder assessments of sector security following the discontinuation of a facility regulatory program, effects of the lack of a federal terrorist vetting process for chemical facility personnel, and effects of fiscal year 2025 reductions in CISA personnel on sector support services.

GAO reviewed relevant statutes, CISA guidelines and procedures, and CISA data on full-time authorized positions and active agency personnel for fiscal years 2024 and 2025. GAO interviewed CISA officials; conducted site visits to five chemical facilities; and interviewed private sector stakeholders, including representatives from the private sector coordinating council, three industry associations, and six chemical companies.