U.S. Chemical Facility Vetting Gap Exposes 89 Million
A lapse in federal authority has left high-risk chemical plants without a mechanism to screen staff for terrorist ties, creating a significant security vacuum.
More than 89 million Americans live or work within two miles of high-risk chemical facilities, yet the federal system designed to screen personnel at these sites for terrorist connections has effectively ceased to function. According to a new report from the Government Accountability Office (GAO), the Chemical Facility Anti-Terrorism Standards (CFATS) program, which included mandatory personnel vetting, expired in 2023 and has not been replaced. This leaves critical infrastructure exposed to potential insider threats at a time when security resources are under strain.
The GAO report, published on September 8, 2026, details how the lapse in statutory authority removed the federal government’s primary tool for assessing risk in the chemical sector. The agency reviewed statutes, analyzed data from the Cybersecurity and Infrastructure Security Agency (CISA), and conducted site visits to five facilities. The findings indicate that while facilities must now manage their own security risks, they lack access to the specific federal watchlist data required to verify the backgrounds of employees and visitors.
Regulatory Authority Has Expired
From 2007 to 2023, CISA operated the CFATS program, which identified approximately 3,200 high-risk facilities out of the nation’s 45,000 chemical plants. These sites were required to meet 18 security standards, including the Personnel Surety Program, which mandated checking staff against the FBI’s terrorist watchlist. Because this screening is considered an inherently governmental function, private companies cannot access the necessary data independently. When Congress allowed the program’s authority to lapse in July 2023, this vetting process ended immediately.
Prior to the expiration, the program was continuously vetting roughly 500,000 individuals. Now, facilities are responsible for their own security but have no federal mechanism to verify that those granted access to critical assets do not have terrorist ties. According to GAO, both CISA officials and private-sector stakeholders identify this loss as the most significant challenge facing the sector. CISA has stated that the gap exposes the industry to insider attacks and potential disruptions to national supply chains, though the agency is still exploring potential solutions without a clear timeline.
Staffing Reductions Deepen Security Concerns
The absence of a vetting program coincides with a sharp decline in federal resources dedicated to chemical sector security. Active CISA personnel focused on this area dropped from 214 in fiscal year 2024 to just 52 in fiscal year 2025. This reduction means only a quarter of authorized positions are filled, down from 96 percent the previous year. These figures do not even account for staff on administrative leave awaiting separation, highlighting a severe contraction in oversight capacity.
CISA officials told the GAO that these cuts forced the agency to scale back services that had continued even after CFATS lapsed. These include on-site security assessments under the voluntary ChemLock program, cybersecurity incident response support, and direct outreach to facilities. Private-sector representatives noted that the loss of experienced points of contact has eroded trust, making companies less willing to candidly report security vulnerabilities. The relationship between the agency and the industry, built over years, has weakened significantly due to these resource constraints.
Future Oversight Remains Uncertain
The situation raises serious questions about the resilience of critical infrastructure in the face of evolving threats. As the federal government grapples with budgetary and statutory limitations, the burden of security falls increasingly on private entities that lack the tools for comprehensive background checks. The next few months will be critical as Congress considers whether to restore statutory authority or if CISA can leverage its general coordination powers to re-establish a vetting framework. For now, the 89 million Americans near these facilities remain reliant on a system that is currently fragmented and under-resourced.
