Yes, chemical plants can face cyber risks with potentially severe consequences, but the evidence does not establish that a disastrous attack is imminent or how likely one is. The “decade out of date” finding refers to a specific set of Department of Homeland Security guidance for high-risk facilities covered by the Chemical Facility Anti-Terrorism Standards (CFATS): in 2020, the U.S. Government Accountability Office (GAO) found that it had not been updated in more than 10 years. CFATS authority has since expired, changing what federal oversight can require.
What did GAO find was out of date?
In a report published May 14, 2020, GAO said DHS guidance intended to help an estimated 3,300 CFATS-covered facilities meet cybersecurity and other standards had not been updated in more than 10 years. That figure is GAO’s estimate for the facilities covered in its report, not a current count of U.S. chemical plants. The age finding applies to the guidance GAO reviewed; it does not establish that every cybersecurity resource available to the chemical sector is outdated.
As an Amazon Associate I earn from qualifying purchases.
GAO also found that CFATS officials lacked a routine process for reviewing the cybersecurity guidance against changing threats and technology. The report said that without such a process, facilities could be more vulnerable to cyber-related threats. Read GAO-20-453.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How could a cyberattack put people at risk?
GAO described a serious potential consequence: an adversary could manipulate a facility’s information or control systems to release or steal hazardous chemicals, potentially causing mass casualties among nearby populations. This is a risk scenario, not a prediction that a specific attack will occur.
#1 Best Overall
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
The report does not provide a current probability, annual incident count, or forecast for a disastrous cyberattack on U.S. chemical plants. It therefore supports concern about the consequences of compromised systems, but not a numeric estimate of how often such an event may happen.
What changed after GAO’s report?
There are two important developments: CISA introduced a process for reviewing guidance, and CFATS’s statutory authority later expired.
Rank #2
- SECURE UPGRADE PLUS PROGRAM (2-Yr, Advanced Edition): SonicWall upgrade path that bundles a new TZ280 appliance with the Advanced Protection Suite (APSS). REQUIREMENTS: for customers upgrading from an existing SonicWall firewall; a qualifying prior unit may be required at registration.
- SERVICE BUNDLE – ADVANCED PROTECTION SUITE (APSS): all Essential services plus Capture ATP cloud sandboxing with patented RTDMI, advanced DNS security, cloud Network Security Manager (NSM) management, reporting & analytics, and 24/7 support — SonicWall's recommended all-in security suite.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
CISA addressed the guidance-review process
GAO’s report included recommendations related to DHS oversight, inspector cyber training, and workforce planning. GAO’s status page says the recommendation to establish a process for reviewing cybersecurity guidance was closed as implemented after CISA approved an Information Guidance Directive. The directive included immediate notifications about vulnerabilities and threats, quarterly guidance updates, and longer-term review of significant guidance. GAO lists several other recommendations as no longer valid after CFATS authority expired; its status page gives January 2025 for those dispositions. GAO’s report page lists the findings and recommendation statuses.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CFATS authority expired
CISA says CFATS statutory authority expired on July 28, 2023, and the agency cannot enforce the program’s regulations while that authority is expired. According to CISA’s published notice, it cannot require facilities to report chemicals of interest, submit information through the Chemical Security Assessment Tool, undergo CFATS inspections, or implement CFATS site security plans under the expired authority. The law’s provisions are set out in 6 U.S.C. Chapter 1, Subchapter XVI; CISA’s program notice is on its CFATS page.
This means the 2020 finding should not be read as a description of a currently enforceable CFATS cybersecurity requirement. It also does not mean chemical facilities have no available security guidance or assistance.
What guidance and support are available to facilities?
CISA encourages facilities to maintain security measures and points to ChemLock, its voluntary chemical-security program. CISA describes ChemLock as offering options tailored to a facility’s needs, including on-site consultations and training. The agency’s Chemical Threat and Risk page explains the program and its voluntary approach.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Facilities can also consult CISA’s voluntary Cross-Sector Cybersecurity Performance Goals and Chemical Sector goals. CISA presents these as practices, not as binding CFATS requirements. Its Cross-Sector Cybersecurity Performance Goals page describes the goals and their scope.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →CISA’s Chemical Sector Cybersecurity Framework Implementation Guidance is another reference for applying cybersecurity practices. The source does not establish that this document is the latest available baseline or a mandatory standard, so facilities should check publication and revision information rather than assume it has been kept current.
Best Value
- SonicWall TZ370 High Availability Unit (02-SSC-6443) - Seamless Failover Protection: Designed to pair with a primary SonicWall firewall for automatic failover and continuous network uptime. Not a Standalone unit - requires an identical primary SonicWall appliance; cannot function independently.
- Protects against encrypted malware and intrusions using DPI-SSL inspection, IPS, anti-malware, and Capture ATP sandboxing with RTDMI detection.
- Secure SD-WAN intelligently steers traffic across links to reduce MPLS costs and improve cloud application performance for branch users.
- Zero-Touch deployment, SonicExpress onboarding, and centralized management via Network Security Manager simplify rollout and ongoing operations.
- Scales up to 900,000 to 1,000,000 concurrent connections depending on policy mix, supporting secure growth across users and devices.
| Resource | Status | Best understood as |
|---|---|---|
| CFATS requirements | CISA says the statutory authority expired July 28, 2023; it cannot enforce the regulations while authority is expired. | A former regulatory framework, not a currently enforceable requirement under the expired authority. CISA CFATS notice |
| ChemLock | Voluntary CISA assistance. | Potentially tailored support, including consultations and training. CISA Chemical Threat and Risk |
| Cross-Sector and Chemical Sector Cybersecurity Performance Goals | Voluntary practices. | Self-guided cybersecurity goals, not a substitute for an enforceable CFATS obligation. CISA performance goals |
| Chemical Sector Cybersecurity Framework Implementation Guidance | The cited source does not establish its latest revision status or make it mandatory. | A reference document to evaluate for relevance and currency. CISA guidance PDF |
What should a facility take from this?
For a facility operator, the practical question is not simply whether an old document exists. It is whether the facility’s safeguards reflect its current equipment, hazards, threat information, and incident-response needs. A useful review can include:
- Identify which information and control systems could affect chemical handling, process safety, or facility security.
- Check whether the guidance being used has a stated publication or revision date, and whether newer threat or vulnerability information changes its relevance.
- Clarify which practices are voluntary and which obligations apply under other laws, permits, contracts, or sector-specific rules; expired CFATS authority does not settle those separate questions.
- Consider whether CISA’s voluntary ChemLock consultation or training could help assess site-specific risks.
- Ensure the facility has a way to respond to cyber incidents and communicate with relevant authorities and partners.
The GAO finding remains a warning about the consequences of stale guidance and weak review processes. It should be read alongside the later CISA review directive and the post-2023 loss of CFATS enforcement authority—not as proof that every chemical plant relies on decade-old advice today.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
