CISA Announces ChemLock

Voluntary Chemical Facility Security

Today CISA announced the launch of their new voluntary chemical facility security program for chemical facilities that are not part of the Chemical Facility Anti-Terrorism Standards (CFATS) program. The new ChemLock program is an outgrowth of the CFATS program and the realization that facilities that are not considered at ‘high-risk’ for terrorist attack are at some risk of physical or cyber attack because of the chemicals stored, used or produced at the facility. The ChemLock program allows CISA to provide assistance to those facilities, based upon the long experience that the Office of Chemical Security has in overseeing the CFATS program.

ChemLock Web Site

The ChemLock program starts with an extensive and well-developed web site. The main pages include:

• ChemLock landing page

• ChemLock On-Site Chemical Security Assessments and Assistance

• ChemLock Resources and Tools

• ChemLock: Secure Your Chemicals

• ChemLock Exercises and Drills

• ChemLock Training

• Other CISA Services For Facilities with Dangerous Chemicals

There are a number of links provided on each page of the web site.

ChemLock vs CFATS

This voluntary program has been in the works for a couple of years now. Annie Hunziker Boyer had a presentation about the ongoing development of the program last December at the 2020 Chemical Security Seminar. I know that the original intent of the program was to provide security assistance to facilities that had inventory of DHS Chemicals of Interest, but after submitting a Top Screen, had been judged by the CFATS risk assessment process not to be at high risk of terrorist attack, but still had some level of risk associated with those chemicals.

The ChemLock program is not intended to be a replacement for the CFATS program, but there are a number of pages on the ChemLock web site that may be of interest to CFATS program. I will be discussing those pages in more detail in subsequent posts. Since there is some overlap, CISA has been careful to include the following caveat to most of their ChemLock pages:

“Participation in any portion of CISA’s ChemLock program does not replace any reporting or compliance requirements under CISA’s Chemical Facility Anti-Terrorism Standards (CFATS) regulation (6 CFR part 27). Some ChemLock activities may fulfill CFATS requirements, depending on your specific security plan. Contact local CISA Chemical Security personnel or visit the CFATS webpage to learn more about CFATS regulatory requirements.”

Take the Assistance You Need

Since this is a purely voluntary program, facilities have a range of options for participating in the program. Facilities can request assistance for any of the portions of the ChemLock program:

• On-Site Chemical Security Assessments and Assistance,

• Chemical Security Training,

• Chemical Security Tabletop Exercise or Drill,

• Cyber Security Evaluation Tool (CSET) Demonstration and Support, and

• Active Shooter Preparedness Training

Information Sharing

The way that ChemLock is currently set up, there are no provisions for submitting data to CISA as part of this program. Thus, thus there is no need for the use of the CFATS programs Chemical-Terrorism Vulnerability Information (CVI). There is nothing in any of the documentation provided today that would indicate that CISA will be sharing any classified or restricted information with participating facilities.

Commentary

This is a voluntary chemical facility security program run out of the same office as the CFATS program. While this is not a program for facilities covered under that program, there are information sources available through this program that could be of use to CFATS facilities. Chemical facilities that are not covered by the CFATS program will find information and assistance here to determine what security measures may be applicable to their facility and how to implement those security measures.

The web site for this new program is hitting as a nearly fully formed information source for chemical facility security. The fold from OCS have used their long CFATS experience to address the basics of chemical facility security in an easy to access format. Assistance from experienced chemical facility inspectors is going to be a major selling point for this program.

Facilities that hold inventories of DHS chemicals of interest but are not currently covered by the program should certainly take a look at this program if there is any chance that there may be inventory or process changes in their future that may push them into the CFATS program. The resources available here could give facilities a head start on setting up a security program that could be readily morphed into a CFATS program site security plan.

I will be taking a closer look at this new program in future articles.