Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties

Overview

The GAO found that DHS (Department of Homeland Security)’s Cybersecurity and Infrastructure Security Agency (CISA) previously ran a regulatory program that included vetting facility personnel and certain visitors against the U.S. terrorist watchlist. Authorization for that regulatory program lapsed in July 2023 and the program — including the federal personnel vetting option — was discontinued, leaving high‑risk chemical facilities to identify and mitigate security risks on their own. Stakeholders and CISA officials told GAO that losing access to the federal terrorist‑vetting process is the most significant gap created by the program’s discontinuation and poses substantial insider and supply‑chain risks. CISA has reduced chemical sector staffing between fiscal years 2024 and 2025, which stakeholders said has also reduced available on‑site services. As of May 2026, CISA said it was exploring whether SRMA authority could be used to reestablish a vetting option. Contractors supporting chemical facility security should treat this as a critical market shift and prioritize rapid client outreach, contingency planning, and capability positioning while monitoring for formal federal guidance or voluntary vetting options.

Immediate Actions (This Week)

• [ ] Inventory clients and contracts that previously relied on the federal vetting option; flag any service gaps created by that discontinuation.
• [ ] Conduct a rapid risk assessment for each affected client facility identifying reliance on insider‑vetting controls and potential operational impacts.
• [ ] Start outreach to principal contacts at affected facilities to confirm current personnel‑screening practices and offer interim mitigation options (training, physical access controls, supervisory protocols).

Short-Term Actions (30 Days)

• [ ] Develop and document interim personnel‑security playbooks that facilities can adopt until federal vetting options are clarified (access controls, enhanced badging, supervisor escort policies, increased observation and reporting).
• [ ] Prepare capture materials and an offering brief for a potential voluntary vetting services program or federal pilot (technical approach, staffing plan, risk mitigation narrative, relevant past performance).

Long-Term Actions (90+ Days)

• [ ] Maintain a program to monitor CISA SRMA notices and to be ready to respond to a voluntary vetting solicitation or pilot; refine your service offering based on official guidance when published.
• [ ] Invest in training, audit trails, and documentation standards so your personnel‑vetting support can be rapidly proofed against any forthcoming federal requirements or voluntary program criteria.

Compliance Checklist

• [ ] Chemical Facility Anti‑Terrorism Standards (CFATS) — applicability and facility obligations: review and align any offerings to CFATS‑related expectations where relevant.
• [ ] Personnel Vetting Requirements / Terrorist Watchlist Screening — maintain documented procedures for screening alternatives and for integrating federal options if/when they reappear.
• [ ] Maintain auditable records of vetting steps, supervisory authorizations, and exceptions for each facility subject to enhanced security controls.
• [ ] Compliance scope TBD — re‑evaluate when official guidance or a federal voluntary vetting option is published.

Resources

• CFATS (Chemical Facility Anti‑Terrorism Standards) — regulation text (#)
• DHS / CISA guidance on chemical facility security and SRMA responsibilities (#)

Related reading:

• Winning Federal Contracts Guide (/insights/winning-federal-contracts)
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

• Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. For subscribers, War Room continuously monitors federal regulatory changes, policy shifts, and sector announcements so you receive immediate alerts when DHS/CISA makes statements about SRMA authority, voluntary vetting pilots, or other program changes. Use War Room alerts to trigger client outreach and capture tasks the moment CISA updates its posture.
• Cabrillo Signals Match Engine — When events like this shift the competitive landscape, Match Engine automatically rescoring your opportunity pipeline and updates relevance for affected NAICS codes and market segments (Chemical Manufacturing, Critical Infrastructure Protection, Personnel Security and Vetting). Match Engine reprioritizes opportunities and surfaces gaps in existing pursuits so capture teams can reallocate resources toward solicitations or pilots tied to vetting services.
• Cabrillo Signals Intelligence Hub — Tracks affected agencies, NAICS codes, and contract vehicles. Configure saved searches and alerts in the Intelligence Hub to notify you the instant a follow‑on solicitation, pilot notice, or SRMA guidance appears matching this event profile. Use the Hub’s tracking to maintain an audit trail of notices and to assemble targeted lists of facilities and solicitations for pursuit.
• Proposal Studio (Proposal OS) — Generates compliance matrices, first‑draft technical approaches, and win themes tailored to opportunities created by this event using your past performance data. Proposal Studio can rapidly produce a draft approach for voluntary vetting services, including staffing, control descriptions, and mitigation narratives, so capture teams can move from concept to bid quickly.
• Proposal Studio Workflow Tracker — Triggers a 9‑gate capture workflow specific to personnel‑vetting pursuits: routes compliance reviews to contracts and legal, tracks required staff certifications and training, and produces an audit‑ready documentation package for proposals or pilots. Workflow Tracker helps ensure your capture process includes regulatory checks and client‑facing artifacts required when federal vetting options reappear.

Call to action: log into Cabrillo Signals to activate the saved search for this event, run an updated Match Engine rescore on your pipeline, and generate a Proposal Studio brief to start outreach and capture work immediately.