Does a facility have to go through the CSAT process if it has already implemented security measures?
If a facility possesses a COI listed in Appendix A at or above the applicable STQ or is requested by the Assistant Secretary for Infrastructure Protection to complete a CSAT Top-Screen, the facility must begin the CSAT process regardless of whether or not it has already implemented security measures. DHS recognizes that many facilities have invested time, resources, and capital to identify vulnerabilities and improve overall security, and the CFATS program has been designed to allow those facilities to leverage their existing security measures in working toward compliance with CFATS and applicable risk-based performance standards where appropriate.
