A facility may disclose Chemical-terrorism Vulnerability Information (CVI) to any of the facility's board members, officers, and employees who are CVI Authorized Users and have a need to know. Likewise, a facility may disclose CVI to any private sector third parties who are affiliated with the facility - e.g., outside attorneys, accountants, consultants, trade association employees - so long as they are CVI Authorized Users with a need to know.
All covered persons must comply with the handling and safeguarding requirements for CVI outlined in 6 CFR § 27.400. They should be familiar with the guidance provided by this Manual and any other guidance the Department of Homeland Security may provide in the future. And they should be aware that divulging information without proper authority could result in an administrative compliance order or civil penalties or other enforcement or corrective actions by the Department (e.g., revocation of CVI Authorized User status). See 6 CFR §§ 27.300(b)(3), 27.400(j).
Under 6 CFR § 27.400(d), covered persons must notify the Department of any unauthorized releases of CVI and refer to the Department any requests for access to CVI by persons without a need to know. In addition, chemical facilities and other entities or persons are encouraged to contact the Department about any actual or suspected misuse of or unauthorized access to CVI. Information about such actual or suspected incidents may be reported to the Department chemical facility security inspector assigned to the area in which the incident occurred or to the CSAT Helpdesk at 866-323-2957 or firstname.lastname@example.org. See Chapter 10.0 of the CVI Procedural Manual (PDF, 29 pages - 219 KB).
Notification and tracking of disclosures: Facilities do not need to notify the Department of proper disclosures of CVI (i.e., disclosures to Authorized Users with a need to know). Nonetheless, the Department encourages facilities to maintain a Tracking Log of the receipt and disclosure of all CVI.
Chemical facilities should also consider the following:
- Appointing a CVI Point of Contact (POC) to provide oversight and assistance to individuals within the facility;
- Implementing procedures to ensure that CVI is used, handled, safeguarded and disclosed appropriately; and
- Establishing a self-inspection program to include periodic review and assessment of the handling, use, and storage of CVI