CISA Launches ChemLock Program to Share Security Expertise

Anniversaries are important. They’re a time for celebration and reflection on progress made, lessons learned, and the goals for the future.

On the cusp of its 15th anniversary, the team at the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) was looking at its chemical security field work and how it could improve security not just for its regulated facilities, but across the board.

Now under the CISA umbrella, the Chemical Facilities Anti-Terrorism Standards (CFATS) program was created in 2007 and is used to regulate high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with these chemicals. Facilities are divided into tiers (1 through 4) and are required to prepare security vulnerability assessments—which identify security vulnerabilities—and implement site security plans that include measures that satisfy 18 identified risk-based performance standards.

About 3,300 U.S. facilities fall under CFATS regulatory requirements. But approximately 35,000 have submitted assessments to CFATS that do not fall into the high-risk threshold for regulation.

Everyone who interacts with dangerous #chemicals has a role to play in understanding the risk and taking collective action to prevent chemicals being weaponized by terrorists. Learn more about our new #ChemLock voluntary program: https://t.co/v1lhMn29tq #InfrastructureMonth pic.twitter.com/13ir6iNG2f

— Cybersecurity and Infrastructure Security Agency (@CISAgov) November 18, 2021

“Chemicals are everywhere. They are literally in everything—more than 96 percent of all manufactured goods depend on chemicals in some way,” says Kelly Murray, associate director for the Office of Chemical Security at CISA who oversees the CFATS program.

So, after some reflection on its 15 years of field experience in helping facility owners and operators improve their security posture, CISA launched the voluntary ChemLock program on Thursday to provide resources, tools, and onsite services to chemical facilities that pose a risk but are not subject to regulation. The program is not a pathway to regulation but an evolution of CISA’s partnership with stakeholders to increase security on a voluntary basis, Murray adds.

CISA created a dedicated Web Page for ChemLock, which includes fact sheets and larger guidance documents to help owners and operators look at their security posture, see what they should be doing, and consider steps to implement safer policies and procedures.

“We have a document on the website called ‘Secure Your Chems,’ which is a comprehensive security planning guide,” Murray adds. “It even includes a template security plan that sites can grab off the shelf and start to think about how they could increase their security posture.”

In addition to resource documents, ChemLock also provides virtual and in-person assessments for site operators who may want to consult with a CISA representative about security steps to take.

“They might need someone onsite with them to help analyze what their inventory is, understand what dangers their chemicals possess, and the options on how to secure them—physical security measures as well as cybersecurity measures,” Murray adds. “That is a service that folks can go and register for and get that onsite assistance.”

ChemLock is also offering free tabletop exercises and training as part of its program line-up. Some of these exercises were based on requests from the chemical security community itself and include plans for how to respond to an active shooter, a drone attack on a site, or a vehicle ramming attack, among numerous other scenarios.

Another exercise is focused on chemical security during civil unrest—which was a request from domestic and international chemical security community stakeholders. Owners and operators asked CISA for guidance on what to do in a civil unrest situation where staff onsite has a finite amount of time to abandon a facility, losing physical control of their chemical supply.

Some of this feedback was garnered through the Global Congress on Chemical Security and Emerging Threats, which the U.S. Department of Homeland Security is a co-implementor of. Through this effort, it works with INTERPOL, the FBI, and the U.S. Defense Threat Reduction Agency to share best practices and innovative ways to counter threats to the chemical security community.

With the rise of civil unrest in 2020 and into 2021 around the world and in the United States, stakeholders increasingly wanted guidance on how to handle situations where a facility or chemical site might be forced to evacuate. CISA worked with its partners to put together guidance for facilities, and have now made it available for free through the ChemLock program.

“We’re doing so much on the international front—we are truly as the U.S. leading the world in chemical security—and now we’re able to bring that to U.S. folks on a voluntary basis,” Murray says.

While ChemLock was created with the goal to reach all facilities that store and handle chemicals deemed a security risk, Murray adds that CISA is especially focused on reaching small businesses in the initial rollout.

“There are a lot of small businesses that fall into not the highest risk, but certainly not no-risk category,” Murray says. “They may not have the time or funding, or maybe are intimidated by the security elements. Those are the folks we are targeting the most.”