GAO says DHS lacks voluntary vetting option for chemical facilities
The Department of Homeland Security lacks a voluntary federal process for chemical facilities to screen workers and certain unescorted visitors for possible terrorist ties, according to a Government Accountability Office report published September 8, 2026.
GAO said the gap emerged after the Chemical Facility Anti-Terrorism Standards program expired on July 28, 2023. The lapse ended the regulatory program and its Personnel Surety Program, which had allowed covered high-risk facilities to vet personnel and certain unescorted visitors with access to restricted areas or critical assets against the federal terrorist watchlist.
The report does not identify an attack or a specific unsafe facility. It says chemical-facility owners and operators lost a federal tool for addressing insider terrorist risks, while the agency responsible for supporting the sector has also reduced staffing and some services.
What ended when CFATS expired
CFATS was the federal chemical-security program administered by the Cybersecurity and Infrastructure Security Agency, or CISA. The agency says Congress allowed the program’s statutory authority to expire on July 28, 2023. As a result, CISA can no longer enforce CFATS regulations, require covered facilities to report information, conduct CFATS inspections or require site-security plans.
The Personnel Surety Program handled one part of that system: vetting personnel and certain visitors who could enter restricted areas or critical assets without an escort. GAO said CISA officials and selected private-sector stakeholders identified the loss of federal terrorist-watchlist vetting as the most significant security challenge after CFATS ended.
GAO’s report says terrorist-watchlist vetting is an inherently governmental function because the relevant information is held in government databases that private companies cannot access on their own. Before CFATS authority lapsed, CISA offered facilities several federal pathways for completing that screening.
DHS estimated that about 45,000 U.S. facilities produced, used or stored hazardous chemicals in 2023. DHS also estimated that more than 89 million people lived or worked within two miles of facilities using high-risk chemicals in 2025. Those are DHS estimates cited by GAO, not independent GAO projections. They do not mean all 45,000 facilities were covered by CFATS: GAO said about 3,200 facilities were designated high-risk in 2023.
GAO recommends a voluntary federal option
GAO recommends that CISA identify, evaluate and implement voluntary options for facilities to vet personnel and certain unescorted visitors. If CISA determines it lacks the authority to do so, GAO recommends that the agency seek legislative authority.
The recommendation would not automatically restore CFATS or impose a new mandatory screening requirement. It calls for a voluntary federal pathway for facilities seeking to address possible terrorist ties among people with specified access.
DHS did not concur with the recommendation. GAO continues to recommend the action, and the recommendation remains open. The report says CISA was exploring as of May 2026 whether its broader sector-risk-management authority could support a vetting process, but CISA had not formally assessed whether that authority was sufficient and had not announced a final program.
Staffing and services also declined
GAO found that CISA’s active personnel dedicated to chemical-sector activities fell from 214 in fiscal year 2024 to 52 in fiscal year 2025. The comparison excludes some full-time personnel scheduled to separate from CISA by the end of calendar year 2025 through deferred-resignation programs.
CISA told GAO that the reductions required it to reduce or eliminate some services, including most on-site facility assessments. The agency said it continued to offer other assistance, such as security training and cybersecurity guidance, but private-sector representatives reported less contact with CISA and the loss of experienced points of contact.
The report also describes CISA’s voluntary ChemLock program, which provides some physical- and cybersecurity tools and services. GAO said many services requiring direct support, including some assessments and other ChemLock functions, were limited in 2025 because of resource constraints.
What the report means for the public
Chemicals are used across manufacturing, energy, agriculture, health care and other industries. The report therefore raises questions not only about facility security but also about the federal government’s ability to support operators that are part of national supply chains.
It does not establish that a particular facility is unsafe, that workers are terrorists or that an attack is imminent. Its finding is narrower: after CFATS expired, facilities lost access to the former federal terrorist-vetting process, and GAO says CISA should consider creating a voluntary replacement.
What to watch next
The next accountability questions are whether CISA creates a voluntary screening process, asks Congress for explicit authority, restores chemical-sector staffing or leaves the recommendation unresolved.
For now, the former federal process remains discontinued. CISA’s possible use of its sector-risk-management authority is still under review, and GAO’s recommendation has not been adopted or implemented.
Sources
Look for updates to this story
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.