Chemicals
CFATS, EPA, and process safety management
40 CFR part 705 requires reporting from any person who manufactured, including imported, PFAS or PFAS-containing articles in any year since 1 January 2011.
Chemical facilities operate under CFATS, EPA regulations, and process safety requirements that increasingly incorporate cybersecurity. Thalorin supports chemical companies with compliance infrastructure addressing chemical facility security, process control system protection, and environmental compliance.
The Chemical Facility Anti-Terrorism Standards are not being enforced. The statutory authority at 6 U.S.C. 621 to 629 terminated on 27 July 2023 under the sunset in Public Law 113-254, and CISA states on its chemical security pages that it cannot enforce compliance with the CFATS regulations at 6 CFR Part 27. What CISA still offers is ChemLock, which is voluntary. The obligations did not move to another agency; they stopped, while every other regulator of a chemical plant stayed where it was.
Two regulators govern the same process from different statutes. EPA's Risk Management Program sits at 40 CFR Part 68 under Clean Air Act section 112(r); OSHA's Process Safety Management standard sits at 29 CFR 1910.119 under the OSH Act. The 2024 Safer Communities rule set a compliance date of 10 May 2027 at 40 CFR 68.10(g) for third-party audits, root cause analysis and safer technology and alternatives analysis. EPA's proposal of 24 February 2026, at 91 FR 8970, would revise those same provisions to realign them with PSM; it is not final.
The obligation most often missed is retrospective. The TSCA section 8(a)(7) rule at 40 CFR Part 705 reaches any person who manufactured, including imported, PFAS or PFAS-containing articles in any year since 1 January 2011, and requires reporting of use, volume, disposal, exposure and hazard data. The window has been postponed three times: a final rule of 13 April 2026 now opens the submission period 60 days after EPA finalises its pending revisions, or on 31 January 2027, whichever is earlier. Reconstructing fifteen years of purchasing and formulation records is a data-retention problem, not a filing exercise.
What survives a lapsed programme is the evidence, not the submission. Holding chemical inventories, process boundaries and safeguard state as one record means an RMP resubmission, a compliance audit under 1910.119(o) and a customer security questionnaire draw on the same artifacts instead of three reconstructions. Thalorin keeps that state bound to the process and the unit that produced it, so a reauthorised CFATS or a finalised RMP amendment becomes another projection of what is already held.
Manufacturing faces evolving cyber risks
CFATS lapsed on 27 July 2023
CISA states it cannot enforce 6 CFR Part 27 and no successor programme was created. Customers, insurers and lenders kept asking for chemical security evidence, so the demand moved from a regulator with an inspection schedule to counterparties with contract renewals.
A 10 May 2027 date under revision
40 CFR 68.10(g) still requires third-party audits, root cause analysis and safer technology analysis by that date, while EPA's February 2026 proposal would change what is owed. Waiting for the proposal to settle leaves too little of the three years.
Trade secrets do not withhold process safety information
29 CFR 1910.119(p)(1) requires the information to reach hazard analysis teams, incident investigators, emergency planners and compliance auditors without regard to trade secret status. Paragraph (p)(2) allows a confidentiality agreement; it does not allow redaction.
A 16 July 2027 Coast Guard plan deadline
Facilities regulated under the Maritime Transportation Security Act must submit a Cybersecurity Plan for Coast Guard approval by that date under 33 CFR 101.655. Many chemical terminals sat outside CFATS precisely because MTSA already covered them.
How Thalorin helps
CFATS compliance automation
Keep chemical-of-interest holdings and screening threshold quantities as maintained state rather than as a lodged filing, so a reauthorisation of 6 CFR Part 27 becomes a resubmission instead of a rebuilt inventory.
Process control security
Evidence the standby or backup power that 40 CFR 68.50(a)(3) and 68.67(c)(3) require for monitoring equipment used to prevent and detect accidental releases, and the control-system assets it depends on.
EPA reporting compliance
Drive the five-yearly RMP resubmission, the EPCRA section 312 Tier II inventory and the section 313 Toxics Release Inventory from one chemical register instead of three parallel data pulls with three reconciliation arguments.
Safety system cybersecurity
Hold the safety instrumented system apart from the basic process control system, the independence IEC 61511-1 edition 2.0 assumes, and evidence every connection between them rather than trusting a network diagram nobody has revalidated.
Chemical supply chain
Resolve supplier declarations to the substances they actually cover, so a TSCA Part 705 submission rests on records rather than on an assumption that a supplier would have volunteered a PFAS constituent.
Emergency response integration
Carry the coordination record 40 CFR 68.93(c) requires, the emergency response provisions at 68.90(b) and 68.95(a), and the exercise clocks at 68.96 — tabletop before 21 December 2026, field before 15 March 2027 — as dated obligations.
Chemicals: common questions
Is CFATS still in effect in 2026?
No. The statutory authority at 6 U.S.C. 621 to 629 terminated on 27 July 2023 under the sunset in section 5 of Public Law 113-254, and CISA states that the authority for the CFATS programme at 6 CFR Part 27 expired and that it cannot enforce compliance with the regulations at this time. Congress has not reauthorised it as of August 2026. CISA's ChemLock programme continues on a voluntary basis, offering no-cost security assessments, planning assistance and tabletop exercise packages.
What exactly has to be in place by 10 May 2027 under the RMP rule?
40 CFR 68.10(g) lists it: standby or backup power for release prevention and detection monitoring, third-party compliance audits, root cause analysis in incident investigations, safer technology and alternatives analysis, the expanded employee participation provisions, the emergency response provisions at 68.90(b) and 68.95(a), and the information availability provisions at 68.210(d) through (h). A separate date of 15 March 2027 applies to emergency response field exercises under 68.96(b)(1)(ii), and the subpart G plan provisions run to 10 May 2028.
Do RMP and PSM cover the same processes?
They overlap without matching. EPA's Risk Management Program at 40 CFR Part 68 addresses accidental releases affecting the public and the environment; OSHA's Process Safety Management standard at 29 CFR 1910.119 addresses catastrophic release hazards to workers. The regulated substance lists and threshold quantities differ, so a process can be covered by one and not the other. EPA's February 2026 proposal at 91 FR 8970 aims to realign RMP with PSM, but until it is finalised both stand as written.
Can we withhold a formulation from a contract hazard analysis team as a trade secret?
No. 29 CFR 1910.119(p)(1) requires employers to make all information necessary to comply with the standard available to those compiling process safety information, developing the process hazard analysis, writing operating procedures, investigating incidents, planning emergency response and conducting compliance audits, without regard to possible trade secret status. Paragraph (p)(2) permits the employer to require those people to enter into confidentiality agreements. The protection available is a contract with the recipient, not a redaction.
Do we have to report PFAS we imported in 2012 and stopped buying years ago?
As the rule stands, yes. 40 CFR Part 705 reaches any person who manufactured, including imported, PFAS or PFAS-containing articles in any year since 1 January 2011, and the duty does not lapse because the substance left the bill of materials. What moved is the clock: the final rule of 13 April 2026 opens the submission period 60 days after EPA finalises its pending revisions, or on 31 January 2027, whichever is earlier, and it then runs six months, twelve for small manufacturers reporting solely on imported articles. EPA's November 2025 proposal would exempt imported articles, impurities and byproducts; it is not final.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
Talk to us about Chemicals.
See how one evidence artifact satisfies Chemicals requirements alongside every other framework you carry.