CFATS Security Assessment

The Chemical Facility Anti-Terrorism Standards (CFATS) program, administered by CISA (Cybersecurity and Infrastructure Security Agency), has undergone significant changes. While the statutory authority for mandatory CFATS compliance lapsed in July 2023, the underlying security threats to chemical facilities have not diminished. Whether or not mandatory CFATS enforcement returns — and there is ongoing congressional discussion about reauthorization — voluntary chemical facility security remains an operational imperative and an industry best practice. Our assessments are based on the proven CFATS framework enhanced with military security methodology.

This is where Compliance Fortress stands alone. Our lead security auditor's 12 years of U.S. military service in security operations provides a perspective that no other EHS consulting firm can match. This military-honed expertise includes: • Threat Assessment: Military-grade methodology for identifying and evaluating potential threats to your facility, including terrorism, sabotage, theft of hazardous materials, and insider threats. • Defense-in-Depth Strategy: Applying the military principle of layered security — multiple barriers that an adversary must overcome, ensuring no single point of failure in your security program. • Vulnerability Assessment: Systematic identification of weaknesses in your physical security, cyber security, and personnel security programs. • Security Plan Development: Creating comprehensive Site Security Plans (SSPs) that address Risk-Based Performance Standards (RBPS) with practical, implementable measures.

Our security assessments follow a disciplined methodology: 1. Chemicals of Interest (COI) Inventory: We determine which of your chemicals appear on the DHS Chemicals of Interest list and whether quantities exceed Screening Threshold Quantities (STQs). 2. Security Vulnerability Assessment (SVA): A comprehensive evaluation of your facility's security posture, including perimeter security, access controls, personnel surety, cyber security of industrial control systems, and shipping/receiving security. 3. Gap Analysis: We identify where your current security measures fall short of CFATS Risk-Based Performance Standards and industry best practices. 4. Site Security Plan Development: We develop or review your SSP, ensuring it addresses all applicable RBPS with practical, cost-effective security measures. 5. Implementation Guidance: We don't just hand you a report — we provide a prioritized roadmap for implementing improvements based on risk level and operational feasibility.