Beveridge & Diamond
Related Practices
Related Practices
Related Industries
Related Industries

Department of Homeland Security Releases New Chemical Plant Security Rule

Beveridge & Diamond, P.C., April 10, 2007

The Department of Homeland Security (DHS) has released an Interim Final Rule establishing antiterrorism requirements to protect certain chemical facilities which DHS determines are high risk (the Chemical Security Rule).  The rule was published in the Federal Register on April 9, 2007 as 6 CFR Part 27 and will become effective June 8, 2007, except for Appendix A.  As described below, Appendix A contains a list of chemicals and their corresponding thresholds for triggering portions of the Rule, and DHS is accepting comment on Appendix A for thirty days following the publication date.

The Chemical Security Rule emerges from a series of security evaluations following the September 11, 2001 attacks.  On December 17, 2003, President Bush issued the Homeland Security Presidential Directive 7, which required DHS to “identify, prioritize, and coordinate the protection of critical infrastructure and key resources with an emphasis on critical infrastructure and key resources that could be exploited to cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction.”  The directive also required DHS to conduct or facilitate vulnerability assessments of the chemical sector and encourage risk management strategies.

In 2004, DHS conducted an analysis of data from the U.S. Environmental Protection Agency which assumed that all stored chemicals at certain facilities were released simultaneously, thereby simulating catastrophic releases from those facilities.  This analysis was used to develop a list of 360 priority facilities for DHS inspections, two of which were found to threaten at least 1 million people downwind.  See Congressional Research Service Report, RL 31530, August 2, 2006, page 11.

In 2005 and 2006, the Secretary of DHS requested that Congress provide DHS with regulatory authority to establish and require implementation of risk-based performance standards for high-risk chemical facilities.  This led to the promulgation and enactment of the Department of Homeland Security Appropriations Act of 2007, Pub. L. 109-295, sec. 550 (the Act), which mandates that DHS develop risk based performance standards for chemical plants, to be promulgated in an interim final rule no later than April 4, 2007.   Although not required by the Act, DHS published an advance notice of rulemaking seeking comments on proposed language and concepts for the rule in December, see Advance Notice of Rulemaking, 71 Fed. Reg. 78276 (Dec. 28, 2006), and issued the interim final rule on April 9, 2007.

The Act requires that the DHS regulations apply to chemical plants which, in the discretion of the Secretary of DHS, create high levels of security risk. The Act further requires that the DHS regulations impose on these plants risk based performance standards, security vulnerability assessments and site security plans, and mandatory audits and inspections to assess compliance.  The Act also provides for civil penalties for violations of orders issued by DHS under the Chemical Security Rule, and allows the Secretary of DHS to issue orders to close chemical facilities if they do not comply with the rule.  As discussed below, DHS has opted to implement the Chemical Security Rule in phases, beginning with those facilities that present the most significant risk profiles. 

Facilities Covered by the Rule.  The Chemical Security Rule has a broad reach and applies to “any establishment that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Secretary to be potentially dangerous or that meets other risk-related criteria identified by the Department (of Homeland Security).”  6 CFR § 27.105.  The provisions of the rule apply to the owner or the operator of such a facility, and where multiple owners or operators “function within a common infrastructure or within a single fenced area” DHS may, in its discretion choose to treat such owners and operators as either a single chemical facility or as multiple facilities.  Id.

DHS declined to identify facilities subject to the rule solely on the basis of the chemicals that may be present.  Instead, the rule will contain a list of certain “chemicals of interest” and corresponding Screening Threshold Quantities (STQs), to be attached as Appendix A to the rule.  This list is to be used as a baseline screening threshold to identify facilities that are subject to initial submittal requirements, as described below.  DHS indicates in the preamble to the final rule that the list of chemicals and the assigned STQs in the published interim final rule are currently proposed and the agency is accepting comments on the proposal for thirty days. DHS indicates that its proposed STQs were established at levels that normally will not cover retail establishments, but that such locations must comply with the requirements of the rule if they possess any listed chemical at the STQ quantity. See 72 Fed. Reg. at 17697.

Certain facilities are not covered by the rule, even if they possess listed chemicals in STQ quantities.  The Act contains a number of specific exemptions, including for public water systems and water treatment works, facilities owned or operated by the Departments of Defense or Energy, and facilities subject to regulation by the Nuclear Regulatory Commission.  See Section 550(a) of the Act, 6 CFR § 27.110(b).  In addition, DHS has indicated that as a matter of policy it does not intend to include railroad facilities or long-haul pipelines in its implementation of the rule. See 72 Fed. Reg. at 17699.

Initial Screening Requirements for Chemical Facilities.  As noted above, DHS has elected to implement the Chemical Security Rule in phases, and has focused the earliest phase on those facilities it has deemed to present a higher risk based on the quantity of certain chemicals that may be present.  In the initial phase, those facilities that possess or plan to possess any of the chemicals listed in Appendix A to the rule, at quantities that correspond to the STQs, must submit a “Top-Screen” to DHS within 60 days of the date the rule is published in the Federal Register, or within sixty (60) days after coming into possession of such chemicals at STQ quantities. See 6 CFR § 27.200(b)(2).  DHS has clarified that the rule is not limited to those who own such chemicals, but instead applies to all of those who possess or intend to possess.  See 72 Fed. Reg. at 17697.

The Top-Screen analysis that is required to be submitted is used as an initial screening process designed by DHS.  See 6 CFR 27.105.  The Top-Screen process is available to covered facilities as a web based secure access tool.  See; DHS Privacy Impact Assessment for the Chemical Security Assessment Tool, March 27, 2007, pages 2-3; Advance Notice at page 78276.  The Top-Screen process uses a methodology contained in the DHS Chemical Security Assessment Tool, which includes a preliminary consequence analysis. See 72 Fed. Reg. at 17700.

DHS will use the Top-Screen information, along with intelligence information and information from other sources, to determine whether chemical facilities present a high level of security risk and to place such facilities into one of four different risk tiers.  See 6 CFR § 27.220; 71 Fed. Reg. at 78283.  Each facility that has been determined by DHS to present a high level of security risk is deemed a “covered facility” and such facilities will be assigned risk tiers.  Any facility failing to provide Top-Screen information within the required time frame may be determined by DHS, after consultation with the facility, to be presumptively high risk.  Upon making such a determination, DHS must notify a facility in writing.  If a selected facility disagrees with this decision, it may submit a request for redetermination.  6 CFR § 27.205.

Vulnerability Assessments and Site Security Plans.  The most critical component of the new rule is the establishment of risk based performance standards for chemical facilities, a component that was mandated by Congress in the Act.  The rule indicates that DHS will issue guidance for the different risk based tiers into which it will assign facilities, and that the layering of measures used to meet the performance standards will vary by the risk presented.  Each covered facility must comply with the requirements of the rule in a manner that is appropriate to its assigned risk tier. 

Following receipt of a DHS determination that a facility is a covered facility, the facility owner or operator must complete and submit to DHS two important documents on a specific time schedule, unless otherwise specified by DHS: (i) a security vulnerability assessment must be submitted within 90 days of the determination, and (ii) a site security plan must be submitted within 120 days of the determination. 

A security vulnerability assessment is an examination of how a facility would address specific types of possible terrorist threats, including an asset characterization, threat assessment, vulnerability analysis, risk assessment and countermeasures analysis. 6 CFR § 27.215.  These assessments are to be completed through the DHS Chemical Security Assessment Tool. A detailed methodology was published in the Advance Notice as Appendix B.  See 71 Fed. Reg. at 78303.

A site security plan must address each vulnerability identified in the vulnerability assessment, describe the security measures to address each vulnerability, identify and describe how security measures will address risk-based performance standards adopted in the rule at 6 CFR § 27.230, and include other information that may be required by DHS.  6 CFR § 27.225. 

DHS will review each security vulnerability assessment and issue either a written approval or a notification of deficiencies, which will provide the submitter with guidance on what changes must be made to the assessment.  6 CFR § 27.240.  DHS will also review each site security plan and will make a preliminary determination of compliance with 6 CFR § 27.225.  If DHS determines that a plan meets the requirements of the rule, DHS will issue a letter of authorization.  If DHS determines that a plan does not meet the requirements of the rule, it will issue written notification containing an explanation of deficiencies and require re-submittal of the plan.  6 CFR § 27.245.

Facility Inspections.  Following each preliminary determination of compliance with the site security requirements, DHS will conduct a facility inspection to assess compliance with the rule.  The rule requires DHS to provide 24-hour advance notice of an inspection except where notice waiver is warranted by exigent circumstances or might be “seriously detrimental to security.” 6 CFR § 27.250(c).  DHS inspectors are authorized to administer oaths and receive affirmations, with witness consent, and must be provided immediate access to certain records and immediate use of photocopiers or other copying equipment upon request.  6 CFR § 27.250.  If DHS determines through an inspection that a facility is in compliance with the rule, it will issue the facility a letter of approval.  If DHS determines a facility is not in compliance with the rule, it will issue written notification containing an explanation of deficiencies.

Recordkeeping.  The Chemical Security Rule contains substantial recordkeeping requirements, located at 6 CFR § 27.255.  Certain records must be preserved for six years, while other records must be preserved for three years.

Records with a six year maintenance requirement include: submitted Top-Screens, Security Vulnerability Assessments, Site Security Plans, and all related correspondence.  Records with a three year maintenance requirement include: training records, drill and exercise records, records of incidents and breaches of security, records of maintenance, calibration and testing of security equipment, records of security threats, and records of Site Security Plan and Security Vulnerability Assessment audits.  6 CFR § 27.255.

Orders and Adjudications.   The Chemical Security Rule authorizes the DHS to issue orders and assess civil penalties when it determines that a facility is in violation of any of the requirements of the rule.  6 CFR § 27.300.  DHS penalty authority authorizes civil penalties of up to $25,000 per day for each day during which a violation continues.  Orders may contain requirements to remedy deficiencies, up to and including a requirement to cease operations.

Orders and penalties assessed by DHS may be contested by filing a timely notice of application for review.  Disputes will be reviewed by an adjudications officer appointed by DHS.  6 CFR § 27.300 – 27.340.  Orders will generally be stayed upon the filing of a timely notice until an initial decision is issued by the adjudications officer.  Initial decisions may be appealed to the Undersecretary of DHS, and an appeal will generally continue the stay of the effectiveness of an order until the issuance of a final decision.  6 CFR § 27.345.  Issuance of a final decision will constitute final agency action. 

Confidentiality of Information.   The Act provides that DHS shall afford security information developed under the Act protections from public disclosure consistent with similar information developed by chemical facilities relating to Port Security.  Such information is currently protected as sensitive security information under 49 CFR § 1520.  The Act further provides that in any enforcement proceeding, information on vulnerability and security shall be treated as if it were classified material. 

In response to these requirements, the Chemical Security Rule contains procedures to protect the disclosure of information and records that constitute Chemical-terrorism Vulnerability Information (CVI).  CVI is defined to include a broad list of information, and any person who receives or gains access to CVI becomes subject to the confidentiality requirements.  See 6 CFR § 27.400.  Special restrictions and limitations also apply to the use of CVI in adjudicatory and court proceedings.

Comments received on the draft rule indicated there was significant concern at the state and local levels that information received by DHS should be shared to ensure that all levels of government could provide effective response in a security emergency.  DHS  therefore indicated in the final interim rule that it intends to share information with state and local governments, including first responders. DHS also stated its belief that the sensitivity of the information it might share should be protected from state public records disclosure requirements on the grounds that these requirements should be deemed to be preempted by the Act.  See 72 Fed. Reg. at 17714-17717.  

Preemption.   The Act does not directly address whether the Act and the Chemical Security Rule should preempt state and local security requirements.  The scope and extent of preemption remained a significant political issue as of the date the final interim rule was released. 

In comments submitted on the Advance Notice of Rulemaking, several members of the chemical industry supported preemption on the grounds that it was important to have a unified national security standard, while comments from advocacy groups, states and some members of Congress opposed preemption, seeking to allow states the flexibility to develop their own security programs.  See 72 Fed. Reg. 17725-17727.  In March, 2007, both the U.S. House of Representatives and the U.S. Senate approved language in a supplemental appropriations bill which would amend the Act to prohibit the DHS from using any funds to approve a site security plan unless the plan complies with state and local security requirements.  See H.R. 1591, Chapter 5, pages 49-51.

In issuing the final interim rule, DHS explained that it does not view the rule to wholly displace state and local law, thus clarifying that it does not claim “field preemption” – the concept that it has so fully occupied the field as to leave no room for state or local requirements.  72 Fed. Reg. at 17727.  Consequently, DHS offered that states may regulate those facilities that are not deemed to be a high risk by DHS, provided that those state regulations do not conflict with the federal program. DHS also conceded that states may regulate high risk facilities, provided that the federal rule is not to be “conflicted with, interfered with, hindered by, or frustrated by, State measures…” Id. at 161. 

The rule contains a procedure which allows covered facilities to request issuance of a DHS opinion on whether particular state or local laws are preempted.  Similarly, DHS may act on its own initiative to review state or local laws, or court decisions, and to issue opinions on preemptive effect.  6 CFR § 27.405(d).

For more information about the Chemical Security Rule, please contact Stephen Richmond at

To view a copy of the published Chemical Security Rule, click here.

For a printable PDF of this article, please click here.