Access to or disclosure of Chemical-terrorism Vulnerability Information (CVI) requires that an individual: (1) has a need to know the information; and (2) is a CVI Authorized User. Under 6 CFR § 27.400(e), a person (including a state, local, or tribal official) has a need to know when:

• that person requires access to specific CVI to carry out chemical facility security activities approved, accepted, funded, recommended, or directed by the Department.
• that person needs the CVI to receive training to carry out chemical facility security activities approved, accepted, funded, recommended, or directed by the Department,
• that person needs the CVI to supervise or otherwise manage individuals carrying out chemical facility security activities approved, accepted, funded, recommended, or directed by the the Department,
• that person needs the CVI to provide technical or legal advice to a covered person, who has a need to know that CVI, regarding chemical facility security requirements of federal law,
• when DHS determines that access by that person to specific information is required under 6 CFR §§ 27.400(h) or (i) in the course of judicial or administrative proceedings.

In addition, as provided by 6 CFR §§ 27.400(e)(2), (4) and (5):

• A federal employee has a need to know if access to the information is necessary for performance of the employee’s official duties.
• A contractor acting in the performance of a contract with or grant from the Department of Homeland Security has a need to know if access to the information is necessary to performance of the contract or grant.
• Notwithstanding the other provisions of the rules, the Department may determine that only specific persons or classes of persons have a need to know specific CVI.
• Nothing shall prevent the Department from determining, in its discretion, that a person or class of persons not otherwise listed above has a need to know CVI in a particular circumstance.

Any disputes between persons and facilities about whether an individual seeking access to the CVI has a need to know should be referred to the Department of Homeland Security for resolution. In particular, any dispute between facilities and state, local or tribal officials about whether a given official has a need to know specific CVI should be referred to the the Department of Homeland Security chemical facility security inspector responsible for working with the facility in question.