More than 89 million people lived or worked within two miles of a high-risk chemical facility in the U.S. as of 2025, and according to Department of Homeland Security estimates, a successful weaponization of those chemicals could produce consequences ranging from on-site fatalities to an impact comparable to a nuclear explosion. A new Government Accountability Office report finds that the federal program responsible for screening facility personnel and visitors for ties to terrorism lapsed more than two years ago, and nothing has replaced it.
The report, published Sep. 8, 2026, was requested by the House Committee on Homeland Security. GAO reviewed relevant statutes and agency guidance, analyzed CISA personnel data for fiscal years 2024 and 2025, conducted site visits to five chemical facilities, and interviewed CISA officials along with private-sector representatives from an industry coordinating council, three trade associations, and six chemical companies.
A regulatory program that expired, and took vetting with it
From 2007 until 2023, DHS’s Cybersecurity and Infrastructure Security Agency (CISA), the component agency responsible for coordinating chemical sector security, ran the Chemical Facility Anti-Terrorism Standards (CFATS) program. It identified roughly 3,200 high-risk facilities, about 7 percent of the nation’s 45,000 chemical facilities, based largely on the quantities and concentrations of dangerous chemicals they held. Covered facilities had to meet 18 security performance standards and submit to inspections every two years. One of those standards, run through what was called the Personnel Surety Program, required facilities to check personnel and unescorted visitors against the FBI’s terrorist watchlist, a dataset the private sector cannot access on its own since screening against it is considered an inherently governmental function.
When Congress let CFATS’s statutory authority expire in July 2023, the entire program, including personnel vetting, ended with it. At the time, the Personnel Surety Program was continuously vetting roughly 500,000 individuals. High-risk facilities are now responsible for identifying and managing their own security risks, but they have no federal mechanism left for checking whether the people they’re granting access to restricted areas or critical assets have terrorist connections.
According to CISA officials and every private-sector stakeholder GAO interviewed, that loss is the single most significant challenge high-risk facilities have faced since CFATS ended. CISA itself has said the gap leaves the sector exposed to insider terrorist attacks and to potential disruptions of critical national supply chains. As of May 2026, the agency was still only exploring whether its general authority as the chemical sector’s risk management coordinator could be used to stand up some kind of replacement vetting process, without a clear timeline for doing so.
A shrinking workforce compounds the problem
The vetting gap isn’t the only resource CISA has lost. Active agency personnel dedicated to chemical sector security dropped from 214 in fiscal year 2024 to just 52 in fiscal year 2025, leaving only a quarter of authorized positions filled, down from 96 percent the year before, and those numbers don’t even include staff already on administrative leave awaiting separation. “Do more with less” doesn’t quite cut it anymore in the face of those types of personnel deficits.
CISA officials told GAO the cuts forced the agency to scale back or eliminate services that had continued even after CFATS itself lapsed, including most on-site facility security assessments under its voluntary ChemLock program, cybersecurity incident response support, and outreach to individual facilities. Private-sector representatives told GAO that losing experienced points-of-contact at CISA has measurably eroded trust and made facilities less willing to candidly flag security vulnerabilities, since long-standing relationships that once allowed frank conversation without fear of enforcement consequences have largely disappeared. One company representative described how an experienced CISA contact had previously coordinated a rapid, multi-agency response when a fire spread toward a facility’s perimeter fence, the kind of support the company said it would no longer know how to arrange.
An agency without a permanent leader
The chemical sector’s staffing losses reflect a broader instability at CISA as a whole. The agency has operated without a Senate-confirmed permanent director since January 2025, cycling through three successive acting directors. Agency-wide, CISA’s total workforce has fallen by more than a third since early 2025, from roughly 3,292 employees to a projected 2,324, and a proposed fiscal year 2027 budget would cut an additional $707 million from agency programs. That broader instability provides useful context for why a narrower initiative, like standing up a voluntary replacement for chemical facility personnel vetting, has continued to move slowly even after CISA identified it as a significant security gap.
GAO’s recommendation, and DHS’s refusal
GAO’s recommendation is narrow and specific: that CISA identify, evaluate, and implement voluntary options allowing chemical facilities to vet their own personnel and unescorted visitors for terrorist ties, seeking new legislative authority if necessary to do so. The report notes CISA could design such a voluntary system with whatever scope, participation requirements, and size limitations work best for the agency and industry alike, rather than reviving CFATS’s mandatory structure wholesale.
DHS did not concur with the recommendation. GAO, in response, noted that instituting voluntary vetting without an underlying regulatory framework does raise legitimate legal and practical complications, but maintained that the security gap CISA’s own officials have identified as significant cannot be closed any other way, since the private sector remains structurally unable to access the terrorist watchlist on its own. The recommendation remains open.
The report lands as DHS itself is operating under new leadership this year. Markwayne Mullin, a former Republican congressman and senator from Oklahoma, was confirmed as Secretary of Homeland Security on March 23, 2026, replacing Kristi Noem. Neither Noem nor Mullin had any prior professional background leading a large intelligence, military, or law enforcement agency. Before entering politics in Oklahoma, Mullin ran his family’s plumbing business. He holds an associate degree in construction technology.
Sources and further reading:
Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties — U.S. Government Accountability Office
CISA Leadership Vacuum: US Cyber Governance at a Breaking Point — Cloud Security Alliance
DHS Rejects Plan to Restore Chemical Facility Vetting — Legis1
GAO Report Highlights Importance of Restoring Chemical Facility Personnel Vetting in the Shadow of the 9/11 Anniversary — American Chemistry Council
This article was researched and sourced by Global Biodefense editors and reported with Claude AI assistance for drafting and editing.