The Catholic University of America



Department of Homeland Security Chemical Facility Anti-Terrorism Standards (CFATS): College and University Initial Compliance Obligations


On November 20, 2007, the Department of Homeland Security ("DHS" or "Department") issued the final list of Chemicals of Interest that may trigger application of the DHS Chemical Facility Anti-Terrorism Standards ("CFATS" or "Final Rule") [1]. The CFATS were promulgated by DHS pursuant to federal legislation [2] authorizing and requiring DHS to regulate the security of high-risk chemical facilities by establishing risk-based performance standards for the security of such facilities.

Under the Final Rule, if a college or university (or any other "chemical facility" or "facility") possesses--or plans to possess--any of 325 Chemicals of Interest identified in Appendix A to the Final Rule at or above the specified DHS Screening Threshold Quantity ("STQ") for that chemical, it must, on or before January 22, 2008, complete and submit electronically a consequence assessment questionnaire known as a "Top-Screen." Institutions may request a one-time 60 day extension for meeting this deadline [3]. Based on information in the Top-Screen, the Department will then decide whether the submitting facility presents a high level of security risk. A determination that it does present such a risk will trigger application of the substantive provisions of the Final Rule, including requirements to prepare a Security Vulnerability Assessment (SVA) and to develop and implement a Site Security Plan (SSP).

In order to determine whether they are obligated to complete and submit a Top Screen, institutions will necessarily need to conduct an inventory to determine the quantity, if any, they possess of each of the chemicals listed in Appendix A. An institution that does not possess any Chemical of Interest at or above the screening quantity for that chemical is not subject to the Rule. However, if an institution later comes into possession of any Chemical of Interest at or above the STQ for that chemical, it must complete and submit a Top-Screen within 60 days after coming into possession. As a result, all must develop methods of continuing to monitor the Chemicals of Interest they currently possess and those they may subsequently acquire. Sanctions for noncompliance include imposition of a civil penalty of up to $25,000 per day of non-compliance, or issuance of an order to cease operations, or both [4].

This NACUANOTE provides an overview of the new regulatory requirements and relevant deadlines.


On April 9, 2007, the DHS promulgated an Interim Final Rule ("IFR") establishing risk-based performance standards for the security of high-risk chemical facilities [5]. Along with the IFR, the DHS published a proposed Appendix A that included a proposed list of Chemicals of Interest and STQs. The IFR went into effect on June 8, 2007, except for Appendix A. The proposed Appendix A potentially burdened virtually every college and university with reporting requirements, because the initial list of Chemicals of Interest included common chemicals, such as acetone and urea, and many of the proposed Chemicals of Interest were to be reported if a facility had "any amount." In the Preamble to the Final Rule, DHS notes that it has taken into consideration a number of the concerns voiced by colleges, universities and medical research facilities. DHS did not, however, craft a blanket exemption from the Final Rule for such institutions as had been requested by a number of the commenters.


Under the IFR, a "chemical facility" or "facility" is defined as any establishment that possesses or plans to possess, at any time, a Screening Threshold Quantity (or more) of any of 325 Chemicals of Interest. The Department reserves the right to update or modify the DHS Chemicals of Interest list as needed, subject to comment. Many colleges and universities commented on Appendix A as initially proposed and urged DHS to make an exemption for such entities because they generally hold small quantities of chemicals dispersed throughout their campuses and would therefore not present a high security risk. DHS declined, emphasizing in the Final Rule that the need to submit a Top-Screen is driven by the possession of certain chemicals at specified quantities. DHS thus found it inappropriate to exempt an entire category of facilities based upon the nature of a facility's operations. DHS noted in the Preamble to the Final Rule that "security varies dramatically across academic institutions;" thus, DHS concluded, exclusion of colleges and universities from the Rule was not warranted.

How did DHS revise Appendix A to meet the concerns of colleges and universities?

Changes to the Chemicals of Interest List
In the final Appendix A, however, DHS revised the Chemicals of Interest list, eliminating some of the common chemicals that had been on the initial list, increasing STQs in many instances, establishing minimum concentrations below which reporting is not required, and designating the security issues that trigger the reporting requirement for each chemical of interest. Moreover, in the Preamble to the Final Rule, DHS noted that it eliminated "any amount" as an applicable STQ [6]. These actions will reduce the number of chemicals many universities and colleges will need to report in the Top Screen (but not the number of chemicals they will need to inventory in order to determine their reporting obligations).

DHS has identified three main categories of security issues: release, theft/diversion, and sabotage/contamination. Some chemicals present multiple security issues. In calculating chemical amounts, institutions must consider the chemicals in their possession within the framework for each of the three separate and distinct security issue categories, using the relevant calculation provisions for each of the categories. If an institution possesses an amount that meets or exceeds the STQ for any of the applicable security issues associated with a particular chemical, it must complete and submit a Top-Screen [7].

Colleges and Universities Can Define Facility Boundaries for Themselves
The requirements of the Final Rule are facility specific, and it allows all facilities, including colleges and universities, flexibility in defining their facility boundaries and identifying the party at their institution that is responsible for compliance. DHS noted in the Preamble to the Final Rule that an institution of higher learning can, if appropriate, submit a Top-Screen on a building-by-building basis or a campus-wide basis. The Assistant Secretary has the authority, where necessary, to make a determination that a facility is a single chemical facility or multiple chemical facilities, and thus can override the institution's decision in this regard.

A building-by-building inventory of Chemicals of Interest may result in bringing some chemicals below their applicable STQs. Such an approach may also cause a college or university to fall outside the scope of the Rule, a possibility recognized by DHS. Accordingly, it may be useful to break down the inventory on a building-by-building basis as a first step in the regulatory analysis. If an institution finds it meets or exceeds the STQ for any Chemical of Interest in one or in only a few buildings on campus, it might be more efficacious to report on a building-by-building basis. Then, if DHS later determines the institution is high risk, the institution would not have to conduct an SVA for the whole campus [8], and could instead develop building-specific SSPs.

Laboratory Quantities Exclusion for Release Chemicals
In response to numerous comments, including those from colleges, universities and industrial laboratories, DHS adopted an exclusion, applicable to the "release" security category, derived from EPA's Risk Management Program ("RMP") [9] for facilities that possess laboratory quantities of release-toxic, release-flammable, and release-explosive Chemicals of Interest [10]. The exclusion was adopted because DHS concluded that lab quantities of release chemicals would not contribute significantly to any terrorist attack and that appropriate controls are typically in place in a laboratory, by virtue of the fact that where lab quantities are used, such use is under the supervision of a technically qualified individual. Note, however, that a facility must still count laboratory quantities of theft/diversion and sabotage/contamination Chemicals of Interest toward the facility's STQs.

The laboratory quantity provision does not apply to activities, including research and development, involving release Chemicals of Interest conducted outside the laboratory. See 6 C.F.R. § 27.203(b)(2)(i).

Option to Request Extension of Time
The Preamble to the Final Rule expressly provides colleges and universities with the option to request an extension of time within which to conduct an inventory and, if necessary, to complete and submit their Top-Screens. The president, provost, dean, or other senior official at a college or university may request an extension of up to 60 additional calendar days from the DHS Assistant Secretary for Infrastructure Protection. DHS expects to grant these requests as a matter of course.

Are there other exemptions or exclusions in the Rule that might apply to colleges and universities?

Section 27.203(c) provides that, for those Chemicals of Interest identified in Appendix A as presenting a potential security risk due only to theft/diversion, facilities need count only such chemicals that are in "transportation packaging," as per the definition of "packaging" in Department of Transportation ("DOT") regulations [11]. As DHS stated in the Preamble to the Final Rule, "transportation packaging" includes, but is not limited to, cylinders, bulk bags, bottles inside or outside of a box, cargo tanks, and tank cars. DHS believes the theft/diversion security issues for these chemicals are raised only by portable and transportable amounts of certain chemicals; it is concerned with the theft of portable amounts of these chemicals and the diversion of shipments of these chemicals. Many of the stocks of theft/diversion Chemicals of Interest at colleges and universities will not be stored in "transportation packaging" and thus will be exempt from the reporting requirements [12].

What are the initial compliance procedures and deadlines?

Taking an Inventory of Chemical Stocks
Because the Final Rule applies to any establishment that possesses or intends to possess a STQ of any Chemical of Interest, a college or university must conduct an inventory of its chemical stocks and determine whether it possesses (or plans to possess) any of the 325 Chemicals of Interest in a quantity that meets or exceeds the STQ for that chemical [13]. If so, the institution is deemed a "chemical facility" under the IFR. While campuses with centralized purchasing may be able to use procurement records to assist in this task, those records will generally not provide the ultimate answer: whether the amount of any given Chemical of Interest currently on-hand in the facility is above its STQ. There is probably no alternative to a thorough canvass of every campus unit that might possess or use any of the Chemicals of Interest, including laboratories, stock rooms, medical facilities, physical plants, and similar campus facilities.

If a college or university has no Chemical of Interest at or above its STQ at this time, the institution does not need to complete and submit a Top-Screen [14]. However, if the institution later comes into possession of any Chemical of Interest at or above the STQ for that chemical, it must complete and submit a Top-Screen within 60 calendar days after coming into possession. Similarly, if an institution submits a Top-Screen for some Chemical(s) of Interest, and later comes into possession of another Chemical of Interest at the corresponding STQ, it must update its Top-Screen within 60 days [15]. Thus, colleges and universities must develop systems to stay current with all chemical purchases by their departments and monitor use and storage [16]. This is a major new compliance requirement.

Completion and Submission of a Top-Screen
A facility that possesses any Chemical of Interest at or above the STQ for that chemical has 60 days from the date of publication of the Final Rule in the Federal Register within which to complete and submit a Top-Screen. As the Final Rule was published on November 20, 2007, facilities must complete and submit their Top-Screen on or before January 22, 2008, unless they have been granted an extension by the Assistant Secretary for Infrastructure Protection.

The contact information for the current Assistant Secretary for Infrastructure Protection is as follows:

Robert B. Stephan
Assistant Secretary for Infrastructure Protection
U.S. Department of Homeland Security
Washington, D.C. 20528

Two sample letters requesting the 60 day extension are included in the Resources section at the end of this NACUANOTE.

The Chemical Security Assessment Tool, which is comprised of the Facility Registration Questionnaire, the Consequence screening questionnaire (Top-Screen), the Security Vulnerability Assessment tool and the Site Security Plan template, is available at:

Specific guidance should be sought from DHS. The DHS CSAT Helpline can be reached at 866-323-2957 from 7:00 a.m. - 7:00 p.m., Eastern Time, Monday-Friday.

What information is sought in the Top-Screen?

In addition to predictable questions about the facility and total on-site quantity information for each chemical, the Top-Screen asks for some additional analytic information. For example, it requires that a chemical facility identify the Area of Highest Quantity ("AHQ") for many chemicals (defined as an on-site area, with a radius of 170 feet, where the greatest amount of the COI is currently present or has been present at any one time within the past 60 days), and calculate the Distance of Concern for the AHQ (the downwind distance calculated using EPA's RMP*Comp [17] for total onsite quantity of the regulated chemical). For theft/diversion chemicals, the facility must identify whether they are stored in man-portable, mechanically portable or bulk storage containers.

What happens after colleges and universities complete and submit the Top-Screen?

Once a chemical facility has completed and submitted a Top-Screen, DHS will make a preliminary assessment as to whether the facility presents a high level of security risk. Risk is measured in four tiers, with Tier 1 being the highest security risk. Once DHS has made this determination, it will contact those chemical facilities determined to present a high security risk about how to proceed. DHS anticipates that many academic institutions will likely be found not to present a high level of security risk.

If a college or university is classified as a high-risk facility, it will have to comply with the substantive provisions of the Rule, which require preparation of a Security Vulnerability Assessment ("SVA") and the development and implementation of a Site Security Plan ("SSP") that identifies measures to satisfy the applicable risk-based "performance standards" listed in Section 27.230. Such performance standards include the following: securing and monitoring the facility perimeter; access control; identification and background checks of employees and other persons; measures to deter, detect and delay any attack; cyber security; deterrence of sabotage, theft and diversion; and emergency response planning. A Tier 4 facility may submit an Alternate Security Program ("ASP") in lieu of a Security Vulnerability Assessment, Site Security Plan, or both. Tier 1, Tier 2 and Tier 3 facilities may submit an ASP in lieu of a Site Security Plan only.

In the Preamble to the Final Rule, DHS notes that many academic institutions may already have security measures in place that will help them meet the applicable risk-based performance standards, and, if so, the only additional burden of complying with the regulations would consist of either creating an SSP or referencing measures in an existing security plan by way of an ASP.

DHS will review and approve all SSPs and/or ASPs and, in order to assess compliance, will conduct site inspections. During such an inspection, DHS has the right to enter, inspect and audit the property, equipment, operations and records of the chemical facility. If, after preliminary approval of the SSP and/or ASP and an initial inspection, the Department determines that the requirements of Section 27.225 have been met, DHS will issue a Letter of Approval to the chemical facility. Generally, any inspection will be preceded by 24-hour advance notice unless DHS determines that exigent circumstances warrant an inspection without such notice or that a delay in conducting an inspection might be seriously detrimental to security.

Security of Chemical Vulnerability Information (CVI)

The Top-Screen, SVA, SSP and/or ASP, and communications from DHS, among other things, must be safeguarded as Chemical-Terrorism Vulnerability Information ("CVI") pursuant to 6 C.F.R. § 27.400. Arguably the underlying data used to prepare the Top-Screen must also be protected as CVI [18]. Information designated as CVI may only be disclosed to persons who have completed the authorization requirements and demonstrate a "need to know."


The CFATS rule represents a significant new compliance obligation for colleges and universities. Institutions should move expeditiously to request an extension for compliance from DHS if needed, and then to define the boundaries of their chemical facility(ies), complete an inventory of each facility for the 325 Chemicals of Interest identified by DHS, and if necessary based on the amounts in their possession, complete and submit the "Top Screen" questionnaire.

Although the CFATS Rule appears onerous, as many colleges and universities may not have centralized storage or recordkeeping, the laboratory quantities exclusion and the reformatting of the Screening Threshold Quantities for the Chemicals of Interest should lessen the burden.



David J. Monz

Eileen P. Conneely


Federal Regulations:

Department of Homeland Security:
Sample Request for Extension Letters:
Institutional CFATS Compliance Sites:

Permitted Uses of NACUANOTES Copyright and Disclaimer Notice

View this document in PDF or Word

Contact Us | NACUA Home Page

"To advance the effective practice of higher education attorneys for the benefit of the colleges and universities they serve."