Chemical Facility Anti-Terrorism Standards Fact Sheet

Protecting Chemical-terrorism Vulnerability Information

On April 9, 2007, the U.S. Department of Homeland Security (DHS) issued the Chemical Facility Anti-Terrorism Standards (CFATS). Congress authoried these interim final regulations (IFR) under Section 550 of the Department of Homeland Security Appropriations Act of 2007, directing the Department to identify, assess, and ensure effective security at high risk chemical facilities. The IFR also creates and explains Chemical-terrorism Vulnerability Information (CVI), a new category of protected information. CVI was adopted and designed to protect information about facility security operations that could be exploited by terrorists.

In Section 550, Congress acknowledged DHS’s need to both protect and share chemical facility security information. In this IFR, DHS has included provisions so that it can protect from public disclosure extremely sensitive information that facilities develop for purposes of complying with the CFATS while at the same time sharing relevant CVI with state and local government officials who have a "need to know" CVI to carry out chemical facility security activities.

In the IFR, DHS identifies information that constitutes CVI to include the following:

• Security Vulnerability Assessments (SVA);
• Site Security Plans (SSP);
• Documents relating to the Department's review and approval of SVAs and SSPs, including Letters of Authorization, Letters of Approval, and responses to them;
• Written notices; and other documents developed to comply with the IFR;
• Alternative Security Programs;
• Documents related to inspections and audits;
• Records required to be created and maintained by regulated facilities;
• Sensitive portions of orders, notices, or letters;
• Information developed pursuant to the Top-Screen process; and
• Other information designated as CVI by the Secretary.

Any person with a "need to know," as defined in the IFR, will be granted access to CVI. Before being authorized to access CVI, individuals will have to complete training to ensure that the individuals understand and comply with the various safeguarding and handling requirements for CVI. For example, CVI must be protected and stored in a secure location, whether it is in paper form or in an electronic form, and may only be disclosed to other individuals with a "need to know." For further information on the marking and disclosure of CVI, and the use of CVI information in enforcement or judicial proceedings, see 6 CFR § 27.400. To the extent State "right to know" or "sunshine" laws purport to require the public release of CVI, the Department believes that such laws are preempted by the IFR.

For more information on CFATS, please refer to www.dhs.gov/chemicalsecurity.

This page was last modified on April 19, 2007