CISA ends mandatory terrorist vetting for high-risk chemical plants

The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) discontinued the mandatory personnel-vetting program for high-risk chemical facilities in July 2023, ending the agency's process for checking staff and unescorted visitors against the U.S. terrorist watchlist. The change applies to all owners and operators of facilities that store or use high-risk chemicals.

GAO found that, according to CISA officials and private-sector stakeholders interviewed, the loss of access to the watchlist is the most significant challenge the sector now faces. Without a federal mechanism, facilities must rely on their own resources to address insider terrorist threats, creating a security gap that GAO describes as posing "substantial risks" to both the plants and the surrounding communities.

During fiscal years 2024 and 2025, CISA's active personnel dedicated to chemical-sector activities fell from 214 (96 percent of authorized positions) to 52 (25 percent of authorized positions). The agency said the reductions have forced cuts to services such as on-site assessments, although it continues to provide security training and cybersecurity guidance.

GAO recommends that the CISA director identify, evaluate, and implement voluntary options for chemical facilities to vet personnel and unescorted visitors for terrorist ties, and, if necessary, seek legislative authority to do so. DHS has not concurred with the recommendation, and CISA indicated it is still exploring whether its sector-risk-management authority can support a new vetting process.

As of 2025, more than 89 million people lived or worked within two miles of a U.S. high-risk chemical facility, underscoring the broader public-safety implications of the current vetting gap.