Disclosure of CVI

Access to or disclosure of CVI requires that an individual (1) has a need to know the information and (2) is a CVI Authorized User.

Under the Chemical Facility Anti-Terrorism Standards (CFATS) (6 CFR § 27.400), a covered person is an individual who has a need to know CVI or someone who gains access to what they know to be or reasonably know to constitute CVI .

All covered persons must comply with the handling and safeguarding requirements for CVI outlined in 6 CFR § 27.400, be familiar with the CVI Procedures Manual and any other guidance the Department may provide in the future, and be aware that divulging information without proper authority could result in an administrative compliance order, civil penalties or other enforcement or corrective actions by the Department (e.g., revocation of CVI Authorized User status). See 6 CFR §§ 27.300(b)(3), 27.400(j).

Disclosing CVI within a Facility and Among Private Sector Entities

A facility may disclose CVI to any of the facility's board members, officers, employees, and any private sector third parties who are affiliated with the facility (e.g., outside attorneys, accountants, consultants, trade association employees) who are CVI Authorized Users with a need to know.

Notification and tracking of disclosures: Facilities do not need to notify the Department of proper disclosures of CVI (i.e., disclosures to Authorized Users with a need to know). Nonetheless, the Department encourages facilities to maintain a Tracking Log of the receipt and disclosure of all CVI.

Chemical facilities should also consider:

  1. Appointing a CVI Point of Contact (POC) to provide oversight and assistance to individuals within the facility.
  2. Implementing procedures to ensure that CVI is used, handled, safeguarded and disclosed appropriately.
  3. Establishing a self-inspection program to include periodic review and assessment of the handling, use, and storage of CVI.

Disclosing CVI by Facilities to State, Local, and Tribal Agencies

Facilities may disclose CVI to officials in state, local, and tribal agencies (e.g., local county emergency managers and local police officials) who are CVI Authorized Users and have a need to know.

The determination that a state, local, or tribal official is a CVI Authorized User and has a need to know will be made by the DHS chemical security inspector assigned to the region in which the facility is located. The inspector will provide the public official with documentation of that determination.

After being allowed access to CVI, the facility and public official should discuss (1) which CVI documents, or portions of CVI documents, the official needs to execute his responsibilities, and (2) how the facility should disclose those documents (e.g., providing the official a copy of the document or arranging an onsite review).

Notification and tracking of disclosures: When a facility properly discloses CVI to a public official, the facility does not need to notify DHS of the disclosure. DHS encourages both the public official and agency to maintain a CVI Tracking Log. See Appendix D.

All government agencies should also consider:

  1. Appointing a CVI Point of Contact (POC) to provide oversight and assistance to individuals within the agency;
  2. Implementing procedures to ensure that CVI is used, handled, safeguarded and disclosed appropriately; and
  3. Establishing a self-inspection program to include periodic review and assessment of the handling, use, and storage of CVI.

Reporting CVI Incidents

Under 6 CFR § 27.400(d), covered persons must notify the Department of any unauthorized releases of CVI and refer to the Department any requests for access to CVI by persons without a need to know.

Chemical facilities and other entities or persons are encouraged to contact the Department about any actual or suspected misuse of or unauthorized access to CVI. Information about such actual or suspected incidents may be reported to the Department chemical security inspector assigned to the area in which the incident occurred. See Chapter 10.0 of the CVI Procedural Manual.

In the event of any disagreement between the facility and the public official regarding the precise CVI to be disclosed or the method of disclosure, DHS encourages the parties to refer the matter to the DHS chemical facility inspector for resolution.

Contact Information

If you have questions or need to contact the DHS chemical facility security inspector assigned to your region, call the CSAT Help Desk at 866-323-2957 Monday through Friday (except federal holidays) from 8:30 a.m. to 5 p.m. (ET), or email CSAT@hq.dhs.gov.

Last Published Date: August 22, 2018

Was this page helpful?

This page was not helpful because the content:
Back to Top