What is VCAT?

The Voluntary Chemical Assessment Tool (VCAT) is a secure, Web-based application designed for use by all chemical facilities. It allows owners and operators to identify their facilities’ current risk level using an all-hazards approach.

VCAT also facilitates cost-benefit analysis by allowing owners and operators to select the best combination of physical security countermeasures and mitigation strategies to reduce overall risk.

The VCAT application is managed by the Office of Infrastructure Protection’s Chemical Sector-Specific Agency (SSA) and was developed in partnership with the Infrastructure Information Collection Division (IICD).

VCAT gives chemical sector owners and operators and homeland security professionals the ability to:

• Conduct aggregated cross-sector analysis to identify security best practices.
• Identify and implement solutions that improve the sector’s overall security posture.

How VCAT Works

The VCAT application features geospatial and visualization capabilities to assist in the collection and analysis of each assessment. VCAT has four data collection and management components:

• Assessment Module - collects relevant information necessary for analysis.
• Vulnerability Analysis Module - displays vulnerability level and prioritizes security measures.
• Risk Analysis Module - displays the current and projected risk score for the overall assessment, as well as for each threat and critical asset.
• Risk Management Module - provides the ability to assign and track the progress of proposed security measures.

VCAT helps owners and operators identify security gaps at their facilities and:

• Provides a prioritized list of proposed security countermeasures to help close those gaps.
• Allows users to perform “What If” scenarios by proposing new security measures while simultaneously visualizing the relative reduction of risk.
• Assigns a cost to each proposed security countermeasure to assist in cost-benefit analysis.

Proprietary Information Is Protected

VCAT also incorporates Protected Critical Infrastructure Information (PCII) protections into the self-assessment process. This ensures that qualified information entered into VCAT will be protected from public disclosure under the Freedom of Information Act and similar state and local disclosure laws, as well as from use in civil litigation or as the basis for regulatory action.