For high-risk chemical facilities today, no one runs the terrorist-watchlist check, because only the government can and the program that did it lapsed in 2023. Owners cannot replace that check, but they can tighten everything around it: screening matched to access, escort rules, revocation, and physical controls that limit what any one person can reach.
On September 8, 2026, the Government Accountability Office published Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties (GAO-26-108127). Its subject is narrow and its implication is broad. A safeguard that covered facilities relied on as a matter of routine has been gone for three years, and the report finds no replacement in place.
What the report found
In 2007, DHS created a regulatory program for high-risk chemical facilities, known as the Chemical Facility Anti-Terrorism Standards. Under it, CISA required covered facilities to vet personnel and certain unescorted visitors against the U.S. government's terrorist watchlist, using options CISA set up. The program's statutory authorization lapsed in July 2023, and the program, including personnel vetting, was discontinued. Facilities now identify and mitigate their own security risks.
GAO reports that CISA officials and private-sector stakeholders described the loss of terrorist vetting as the most significant challenge facility owners have faced since the program ended, and as a gap that poses substantial risk. Vetting against the watchlist is an inherently governmental function. A private owner cannot run it, however willing.
The exposure is not abstract. DHS reported that as of 2025, more than 89 million people lived or worked within two miles of a U.S. facility using high-risk chemicals. At the same time, CISA's active chemical-sector staff fell from 214, or 96 percent of authorized positions, in fiscal year 2024 to 52, or 25 percent, in fiscal year 2025. CISA told GAO it had to reduce or eliminate services, including most on-site facility assessments.
As of May 2026, CISA said it was exploring whether its sector risk management authority could support a vetting process. GAO recommended that CISA identify, evaluate and implement voluntary vetting options for personnel and unescorted visitors, and seek legislative authority if needed. DHS did not concur. GAO has kept the recommendation open, noting that CISA itself identified the missing vetting as a significant security gap.
An institutional-layer failure
Anthromekagogy models human-system co-evolution across five layers: cognitive, interface, algorithmic, institutional and ecological. Its vertical propagation principle holds that incentives and decisions at higher layers reshape what happens below. The chemical vetting gap is a clean example. Nothing changed at the gate. The badge reader, the guard, the hiring process and the visitor log all look the same. What changed was a decision at the institutional layer, and it removed information that used to reach the person deciding whether to let someone in.
The framework's reversibility constraint says people must be able to function without the system they rely on. It is written for operators and their tools, but the same test applies to a facility and the institutions it leans on. For watchlist vetting, the honest answer is that facilities cannot function without the federal system, because they cannot replicate it. That makes the dependency structural. The useful response is not to pretend otherwise, but to strengthen the controls an owner does govern so that the missing check matters less.
The framework also warns about metric corruption. A screening program can keep producing the same paperwork after its most important input has disappeared. Completed background checks and issued badges still look like a working program. Owners should ask what their checks can actually detect now, not only whether they were completed.
What owners can still control
CISA defines an insider as anyone who has or had authorized access to or knowledge of an organization's resources, and its definition of insider threat includes harm caused wittingly or unwittingly. Watchlist vetting addressed one narrow slice of that risk. The rest was always the owner's job, and it still is.
- Screen to the access, not the job title. Lawful criminal history and identity screening, run under the Fair Credit Reporting Act's disclosure and adverse-action steps and the EEOC's individualized-assessment guidance, remains available. The electric sector's CIP-004 shows how to tie depth of screening to the access a role holds. Our earlier article on personnel screening sets out that model.
- Treat unescorted visitors as insiders. The lapsed program covered certain unescorted visitors for a reason. Contractors, delivery drivers and vendor technicians who move without an escort now pass with less scrutiny than before. Reducing unescorted access is within the owner's control.
- Shorten the revocation clock. Past access is still access under CISA's definition. Credentials, keys and remote accounts should be removed on a timeline measured in hours after a departure.
- Limit what one person can reach. Zoned access, two-person rules for the most consequential areas, and physical delay around the materials that matter all reduce the harm any single insider can do, whoever failed to catch them.
- Keep the record. Access logs and camera coverage that survive an incident let an owner reconstruct who was where. That is how unwitting insiders and slow-developing concerns surface.
Beyond the chemical sector
The specific gap belongs to chemical facilities, but the pattern does not. Data centers, water systems and energy sites also rely on capabilities supplied from outside the fence: federal threat sharing, state inspections, insurer requirements, vendor attestations. Each is an institutional input to the operator's decision. When one is withdrawn or thinned, as CISA's chemical staffing was, the operator may not notice for years. GAO's report is a reminder to list those inputs explicitly and to know which ones the facility could do without.
List every external check your access decisions depend on, and ask what happens if it disappears. Where the answer is that nothing replaces it, strengthen the controls you own: screening matched to access, fewer unescorted visitors, faster revocation and physical limits on what any one person can reach.
Sources
- GAO, Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties, GAO-26-108127 (Sept. 8, 2026)
- CISA, Defining Insider Threats
- NERC, CIP-004-7 Cyber Security: Personnel & Training
- FTC, Using Consumer Reports: What Employers Need to Know
- EEOC, Enforcement Guidance on the Consideration of Arrest and Conviction Records (2012)
- Kristof, R. (2026). Anthromekagogy: A Research Framework for Human-System Co-Evolution. Working paper.
Cite this article: Authentic Intelligence Research, “Who Vets the Insiders When the Federal Check Goes Away?” Authentic Intelligence, October 12, 2026, https://authenticint.com/articles/insider-vetting-after-the-federal-check-lapsed.html.