GAO: End of CFATS Left Thousands of High‑Risk Chemical Sites Without Terrorist‑Watchlist Vetting

A new Government Accountability Office report says the end of a federal chemical-facility security program left thousands of high-risk sites without access to terrorist-watchlist vetting for workers and certain visitors, creating a gap that private companies cannot close on their own. The watchdog urged the Cybersecurity and Infrastructure Security Agency, the Department of Homeland Security unit responsible for helping secure the chemical sector, to create voluntary alternatives. DHS did not agree with that recommendation.

The report, released Tuesday, centers on a problem with broad public-safety implications. GAO said screening people against the federal government’s terrorist watchlist is an “inherently governmental function” because private companies do not have access to those systems. Without a federal option, chemical site owners lose a tool for identifying insider threats at facilities handling hazardous substances. DHS has estimated that, as of 2025, more than 89 million people lived or worked within 2 miles of a U.S. facility using high-risk chemicals.

The issue stems from the lapse of the Chemical Facility Anti-Terrorism Standards program, known as CFATS, in July 2023. CFATS, created in 2007 to address terrorism risks at high-risk chemical facilities, was discontinued after its authorization expired. Under the program, about 3,200 facilities were designated high-risk as of 2023, representing roughly 7% of about 45,000 U.S. facilities that use hazardous chemicals. When CFATS ended, its Personnel Surety Program was vetting about 500,000 individuals on a continuous basis, according to GAO.

GAO said CISA officials and private-sector stakeholders described the loss of that vetting capability as the biggest security challenge facing high-risk chemical facilities since CFATS ended. The report warned that facility owners and operators now lack a key safeguard against insider threats and possible disruptions to critical national supply chains. CISA still offers some voluntary chemical-security assistance, including ChemLock-related services, but GAO said those programs do not replace terrorist-watchlist vetting.

The report also found that CISA’s own capacity to support the sector fell sharply after CFATS ended. The number of active personnel dedicated to chemical-sector activities dropped from 214 at the end of fiscal 2024 to 52 at the end of fiscal 2025. CISA told GAO those cuts forced it to reduce or eliminate some services, including most on-site facility assessments. Some support continued, including security training and cybersecurity guidance.

Private-sector stakeholders told GAO that the staffing losses, along with the departure of experienced personnel, reduced their contact with CISA on facility security vulnerabilities. That compounded the effect of losing the federal vetting process, leaving high-risk facilities with fewer touch points with the agency that serves as the federal government’s sector risk management agency for chemical security.

GAO recommended that CISA “identify, evaluate, and implement voluntary options for chemical facility owners and operators to address insider terrorist security risks by vetting their personnel and unescorted visitors … and, if necessary, seek the legislative authority to do so.” GAO lists the recommendation as open.

DHS and CISA did not concur in written comments to the report. Still, GAO said CISA told auditors that, as of May 2026, it was exploring whether its existing authority as the sector risk management agency for chemicals could support a voluntary vetting process, though it had not settled on an approach.

GAO framed the stakes plainly: “Without federal options for the terrorist vetting of personnel, facility owners and operators lack a critical tool to protect their facilities from an insider terrorist attack and from potential disruptions to critical national supply chains.”