```

[113th Congress Public Law 254]
[From the U.S. Government Publishing Office]

[[Page 2897]]

 PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT 
                                 OF 2014

[[Page 128 STAT. 2898]]

Public Law 113-254
113th Congress

                                 An Act

 
    To recodify and reauthorize the Chemical Facility Anti-Terrorism 
       Standards Program. <<NOTE: Dec. 18, 2014 -  [H.R. 4007]>> 

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled, <<NOTE: Protecting and 
Securing Chemical Facilities from Terrorist Attacks Act of 2014. 6 USC 
101 note.>> 
SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Protecting and Securing Chemical 
Facilities from Terrorist Attacks Act of 2014''.
SEC. 2. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM.

    (a) In General.--The Homeland Security Act of 2002 (6 U.S.C. 101 et 
seq.) is amended by adding at the end the following:

    ``TITLE <<NOTE: 6 USC prec. 621.>>  XXI--CHEMICAL FACILITY ANTI-
TERRORISM STANDARDS
``SEC. 2101. <<NOTE: 6 USC 621.>>  DEFINITIONS.

    ``In this title--
            ``(1) the term `CFATS regulation' means--
                    ``(A) an existing CFATS regulation; and
                    ``(B) any regulation or amendment to an existing 
                CFATS regulation issued pursuant to the authority under 
                section 2107;
            ``(2) the term `chemical facility of interest' means a 
        facility that--
                    ``(A) holds, or that the Secretary has a reasonable 
                basis to believe holds, a chemical of interest, as 
                designated under Appendix A to part 27 of title 6, Code 
                of Federal Regulations, or any successor thereto, at a 
                threshold quantity set pursuant to relevant risk-related 
                security principles; and
                    ``(B) is not an excluded facility;
            ``(3) the term `covered chemical facility' means a facility 
        that--
                    ``(A) the Secretary--
                          ``(i) identifies as a chemical facility of 
                      interest; and
                          ``(ii) based upon review of the facility's 
                      Top-Screen, determines meets the risk criteria 
                      developed under section 2102(e)(2)(B); and
                    ``(B) is not an excluded facility;
            ``(4) the term `excluded facility' means--

[[Page 128 STAT. 2899]]

                    ``(A) a facility regulated under the Maritime 
                Transportation Security Act of 2002 (Public Law 107-295; 
                116 Stat. 2064);
                    ``(B) a public water system, as that term is defined 
                in section 1401 of the Safe Drinking Water Act (42 
                U.S.C. 300f);
                    ``(C) a Treatment Works, as that term is defined in 
                section 212 of the Federal Water Pollution Control Act 
                (33 U.S.C. 1292);
                    ``(D) a facility owned or operated by the Department 
                of Defense or the Department of Energy; or
                    ``(E) a facility subject to regulation by the 
                Nuclear Regulatory Commission, or by a State that has 
                entered into an agreement with the Nuclear Regulatory 
                Commission under section 274 b. of the Atomic Energy Act 
                of 1954 (42 U.S.C. 2021(b)) to protect against 
                unauthorized access of any material, activity, or 
                structure licensed by the Nuclear Regulatory Commission;
            ``(5) the term `existing CFATS regulation' means--
                    ``(A) a regulation promulgated under section 550 of 
                the Department of Homeland Security Appropriations Act, 
                2007 (Public Law 109-295; 6 U.S.C. 121 note) that is in 
                effect on the day before the date of enactment of the 
                Protecting and Securing Chemical Facilities from 
                Terrorist Attacks Act of 2014; and
                    ``(B) a Federal Register notice or other published 
                guidance relating to section 550 of the Department of 
                Homeland Security Appropriations Act, 2007 that is in 
                effect on the day before the date of enactment of the 
                Protecting and Securing Chemical Facilities from 
                Terrorist Attacks Act of 2014;
            ``(6) the term `expedited approval facility' means a covered 
        chemical facility for which the owner or operator elects to 
        submit a site security plan in accordance with section 
        2102(c)(4);
            ``(7) the term `facially deficient', relating to a site 
        security plan, means a site security plan that does not support 
        a certification that the security measures in the plan address 
        the security vulnerability assessment and the risk-based 
        performance standards for security for the facility, based on a 
        review of--
                    ``(A) the facility's site security plan;
                    ``(B) the facility's Top-Screen;
                    ``(C) the facility's security vulnerability 
                assessment; or
                    ``(D) any other information that--
                          ``(i) the facility submits to the Department; 
                      or
                          ``(ii) the Department obtains from a public 
                      source or other source;
            ``(8) the term `guidance for expedited approval facilities' 
        means the guidance issued under section 2102(c)(4)(B)(i);
            ``(9) the term `risk assessment' means the Secretary's 
        application of relevant risk criteria identified in section 
        2102(e)(2)(B);
            ``(10) the term `terrorist screening database' means the 
        terrorist screening database maintained by the Federal 
        Government Terrorist Screening Center or its successor;

[[Page 128 STAT. 2900]]

            ``(11) the term `tier' has the meaning given the term in 
        section 27.105 of title 6, Code of Federal Regulations, or any 
        successor thereto;
            ``(12) the terms `tiering' and `tiering methodology' mean 
        the procedure by which the Secretary assigns a tier to each 
        covered chemical facility based on the risk assessment for that 
        covered chemical facility;
            ``(13) the term `Top-Screen' has the meaning given the term 
        in section 27.105 of title 6, Code of Federal Regulations, or 
        any successor thereto; and
            ``(14) the term `vulnerability assessment' means the 
        identification of weaknesses in the security of a chemical 
        facility of interest.
``SEC. 2102. <<NOTE: 6 USC 22.>>  CHEMICAL FACILITY ANTI-TERRORISM 
                          STANDARDS PROGRAM.

    ``(a) Program Established.--
            ``(1) In general.--There is in the Department a Chemical 
        Facility Anti-Terrorism Standards Program.
            ``(2) Requirements.--In carrying out the Chemical Facility 
        Anti-Terrorism Standards Program, the Secretary shall--
                    ``(A) identify--
                          ``(i) chemical facilities of interest; and
                          ``(ii) covered chemical facilities;
                    ``(B) <<NOTE: Assessment.>>  require each chemical 
                facility of interest to submit a Top-Screen and any 
                other information the Secretary determines necessary to 
                enable the Department to assess the security risks 
                associated with the facility;
                    ``(C) establish risk-based performance standards 
                designed to address high levels of security risk at 
                covered chemical facilities; and
                    ``(D) require each covered chemical facility to--
                          ``(i) <<NOTE: Assessment.>>  submit a security 
                      vulnerability assessment; and
                          ``(ii) <<NOTE: Security plan.>>  develop, 
                      submit, and implement a site security plan.

    ``(b) Security Measures.--
            ``(1) In general.--A facility, in developing a site security 
        plan as required under subsection (a), shall include security 
        measures that, in combination, appropriately address the 
        security vulnerability assessment and the risk-based performance 
        standards for security for the facility.
            ``(2) Employee input.--To the greatest extent practicable, a 
        facility's security vulnerability assessment and site security 
        plan shall include input from at least 1 facility employee and, 
        where applicable, 1 employee representative from the bargaining 
        agent at that facility, each of whom possesses, in the 
        determination of the facility's security officer, relevant 
        knowledge, experience, training, or education as pertains to 
        matters of site security.

    ``(c) Approval or Disapproval of Site Security Plans.--
            ``(1) In general.--
                    ``(A) Review.--Except as provided in paragraph (4), 
                the Secretary shall review and approve or disapprove 
                each site security plan submitted pursuant to subsection 
                (a).
                    ``(B) Bases for disapproval.--The Secretary--

[[Page 128 STAT. 2901]]

                          ``(i) may not disapprove a site security plan 
                      based on the presence or absence of a particular 
                      security measure; and
                          ``(ii) shall disapprove a site security plan 
                      if the plan fails to satisfy the risk-based 
                      performance standards established pursuant to 
                      subsection (a)(2)(C).
            ``(2) Alternative security programs.--
                    ``(A) Authority to approve.--
                          ``(i) <<NOTE: Determination.>>  In general.--
                      The Secretary may approve an alternative security 
                      program established by a private sector entity or 
                      a Federal, State, or local authority or under 
                      other applicable laws, if the Secretary determines 
                      that the requirements of the program meet the 
                      requirements under this section.
                          ``(ii) Additional security measures.--If the 
                      requirements of an alternative security program do 
                      not meet the requirements under this section, the 
                      Secretary may recommend additional security 
                      measures to the program that will enable the 
                      Secretary to approve the program.
                    ``(B) Satisfaction of site security plan 
                requirement.--A covered chemical facility may satisfy 
                the site security plan requirement under subsection (a) 
                by adopting an alternative security program that the 
                Secretary has--
                          ``(i) reviewed and approved under subparagraph 
                      (A); and
                          ``(ii) determined to be appropriate for the 
                      operations and security concerns of the covered 
                      chemical facility.
            ``(3) Site security plan assessments.--
                    ``(A) Risk assessment policies and procedures.--In 
                approving or disapproving a site security plan under 
                this subsection, the Secretary shall employ the risk 
                assessment policies and procedures developed under this 
                title.
                    ``(B) Previously approved plans.--In the case of a 
                covered chemical facility for which the Secretary 
                approved a site security plan before the date of 
                enactment of the Protecting and Securing Chemical 
                Facilities from Terrorist Attacks Act of 2014, the 
                Secretary may not require the facility to resubmit the 
                site security plan solely by reason of the enactment of 
                this title.
            ``(4) Expedited approval program.--
                    ``(A) In general.--A covered chemical facility 
                assigned to tier 3 or 4 may meet the requirement to 
                develop and submit a site security plan under subsection 
                (a)(2)(D) by developing and submitting to the 
                Secretary--
                          ``(i) a site security plan and the 
                      certification described in subparagraph (C); or
                          ``(ii) a site security plan in conformance 
                      with a template authorized under subparagraph (H).
                    ``(B) Guidance for expedited approval facilities.--
                          ``(i) <<NOTE: Deadline.>>  In general.--Not 
                      later than 180 days after the date of enactment of 
                      the Protecting and Securing Chemical Facilities 
                      from Terrorist Attacks Act of 2014, the Secretary 
                      shall issue guidance for expedited

[[Page 128 STAT. 2902]]

                      approval facilities that identifies specific 
                      security measures that are sufficient to meet the 
                      risk-based performance standards.
                          ``(ii) Material deviation from guidance.--If a 
                      security measure in the site security plan of an 
                      expedited approval facility materially deviates 
                      from a security measure in the guidance for 
                      expedited approval facilities, the site security 
                      plan shall include an explanation of how such 
                      security measure meets the risk-based performance 
                      standards.
                          ``(iii) Applicability of other laws to 
                      development and issuance of initial guidance.--
                      During the period before the Secretary has met the 
                      deadline under clause (i), in developing and 
                      issuing, or amending, the guidance for expedited 
                      approval facilities under this subparagraph and in 
                      collecting information from expedited approval 
                      facilities, the Secretary shall not be subject 
                      to--
                                    ``(I) section 553 of title 5, United 
                                States Code;
                                    ``(II) subchapter I of chapter 35 of 
                                title 44, United States Code; or
                                    ``(III) section 2107(b) of this 
                                title.
                    ``(C) Certification.--The owner or operator of an 
                expedited approval facility shall submit to the 
                Secretary a certification, signed under penalty of 
                perjury, that--
                          ``(i) the owner or operator is familiar with 
                      the requirements of this title and part 27 of 
                      title 6, Code of Federal Regulations, or any 
                      successor thereto, and the site security plan 
                      being submitted;
                          ``(ii) the site security plan includes the 
                      security measures required by subsection (b);
                          ``(iii)(I) the security measures in the site 
                      security plan do not materially deviate from the 
                      guidance for expedited approval facilities except 
                      where indicated in the site security plan;
                          ``(II) any deviations from the guidance for 
                      expedited approval facilities in the site security 
                      plan meet the risk-based performance standards for 
                      the tier to which the facility is assigned; and
                          ``(III) the owner or operator has provided an 
                      explanation of how the site security plan meets 
                      the risk-based performance standards for any 
                      material deviation;
                          ``(iv) the owner or operator has visited, 
                      examined, documented, and verified that the 
                      expedited approval facility meets the criteria set 
                      forth in the site security plan;
                          ``(v) the expedited approval facility has 
                      implemented all of the required performance 
                      measures outlined in the site security plan or set 
                      out planned measures that will be implemented 
                      within a reasonable time period stated in the site 
                      security plan;
                          ``(vi) each individual responsible for 
                      implementing the site security plan has been made 
                      aware of the requirements relevant to the 
                      individual's responsibility contained in the site 
                      security plan and has demonstrated competency to 
                      carry out those requirements;

[[Page 128 STAT. 2903]]

                          ``(vii) the owner or operator has committed, 
                      or, in the case of planned measures will commit, 
                      the necessary resources to fully implement the 
                      site security plan; and
                          ``(viii) the planned measures include an 
                      adequate procedure for addressing events beyond 
                      the control of the owner or operator in 
                      implementing any planned measures.
                    ``(D) Deadline.--
                          ``(i) In general.--Not later than 120 days 
                      after the date described in clause (ii), the owner 
                      or operator of an expedited approval facility 
                      shall submit to the Secretary the site security 
                      plan and the certification described in 
                      subparagraph (C).
                          ``(ii) Date.--The date described in this 
                      clause is--
                                    ``(I) for an expedited approval 
                                facility that was assigned to tier 3 or 
                                4 under existing CFATS regulations 
                                before the date of enactment of the 
                                Protecting and Securing Chemical 
                                Facilities from Terrorist Attacks Act of 
                                2014, the date that is 210 days after 
                                the date of enactment of that Act; and
                                    ``(II) for any expedited approval 
                                facility not described in subclause (I), 
                                the later of--
                                            ``(aa) the date on which the 
                                        expedited approval facility is 
                                        assigned to tier 3 or 4 under 
                                        subsection (e)(2)(A); or
                                            ``(bb) the date that is 210 
                                        days after the date of enactment 
                                        of the Protecting and Securing 
                                        Chemical Facilities from 
                                        Terrorist Attacks Act of 2014.
                          ``(iii) <<NOTE: Deadline.>>  Notice.--An owner 
                      or operator of an expedited approval facility 
                      shall notify the Secretary of the intent of the 
                      owner or operator to certify the site security 
                      plan for the expedited approval facility not later 
                      than 30 days before the date on which the owner or 
                      operator submits the site security plan and 
                      certification described in subparagraph (C).
                    ``(E) Compliance.--
                          ``(i) In general.--For an expedited approval 
                      facility submitting a site security plan and 
                      certification in accordance with subparagraphs 
                      (A), (B), (C), and (D)--
                                    ``(I) the expedited approval 
                                facility shall comply with all of the 
                                requirements of its site security plan; 
                                and
                                    ``(II) the Secretary--
                                            ``(aa) except as provided in 
                                        subparagraph (G), may not 
                                        disapprove the site security 
                                        plan; and
                                            ``(bb) may audit and inspect 
                                        the expedited approval facility 
                                        under subsection (d) to verify 
                                        compliance with its site 
                                        security plan.
                          ``(ii) Noncompliance.--If the Secretary 
                      determines an expedited approval facility is not 
                      in compliance with the requirements of the site 
                      security plan or is otherwise in violation of this 
                      title, the Secretary may enforce compliance in 
                      accordance with section 2104.

[[Page 128 STAT. 2904]]

                    ``(F) Amendments to site security plan.--
                          ``(i) Requirement.--
                                    ``(I) <<NOTE: Certification.>>  In 
                                general.--If the owner or operator of an 
                                expedited approval facility amends a 
                                site security plan submitted under 
                                subparagraph (A), the owner or operator 
                                shall submit the amended site security 
                                plan and a certification relating to the 
                                amended site security plan that contains 
                                the information described in 
                                subparagraph (C).
                                    ``(II) Technical amendments.--For 
                                purposes of this clause, an amendment to 
                                a site security plan includes any 
                                technical amendment to the site security 
                                plan.
                          ``(ii) Amendment required.--The owner or 
                      operator of an expedited approval facility shall 
                      amend the site security plan if--
                                    ``(I) there is a change in the 
                                design, construction, operation, or 
                                maintenance of the expedited approval 
                                facility that affects the site security 
                                plan;
                                    ``(II) the Secretary requires 
                                additional security measures or suspends 
                                a certification and recommends 
                                additional security measures under 
                                subparagraph (G); or
                                    ``(III) <<NOTE: Notification.>>  the 
                                owner or operator receives notice from 
                                the Secretary of a change in tiering 
                                under subsection (e)(3).
                          ``(iii) Deadline.--An amended site security 
                      plan and certification shall be submitted under 
                      clause (i)--
                                    ``(I) in the case of a change in 
                                design, construction, operation, or 
                                maintenance of the expedited approval 
                                facility that affects the security plan, 
                                not later than 120 days after the date 
                                on which the change in design, 
                                construction, operation, or maintenance 
                                occurred;
                                    ``(II) in the case of the Secretary 
                                requiring additional security measures 
                                or suspending a certification and 
                                recommending additional security 
                                measures under subparagraph (G), not 
                                later than 120 days after the date on 
                                which the owner or operator receives 
                                notice of the requirement for additional 
                                security measures or suspension of the 
                                certification and recommendation of 
                                additional security measures; and
                                    ``(III) in the case of a change in 
                                tiering, not later than 120 days after 
                                the date on which the owner or operator 
                                receives notice under subsection (e)(3).
                    ``(G) Facially deficient site security plans.--
                          ``(i) Prohibition.--Notwithstanding 
                      subparagraph (A) or (E), the Secretary may suspend 
                      the authority of a covered chemical facility to 
                      certify a site security plan if the Secretary--
                                    ``(I) <<NOTE: Determination.>>  
                                determines the certified site security 
                                plan or an amended site security plan is 
                                facially deficient; and
                                    ``(II) <<NOTE: Deadline.>>  not 
                                later than 100 days after the date on 
                                which the Secretary receives the site 
                                security

[[Page 128 STAT. 2905]]

                                plan and certification, provides the 
                                covered chemical facility with written 
                                notification that the site security plan 
                                is facially deficient, including a clear 
                                explanation of each deficiency in the 
                                site security plan.
                          ``(ii) Additional security measures.--
                                    ``(I) <<NOTE: Determination.>>  In 
                                general.--If, during or after a 
                                compliance inspection of an expedited 
                                approval facility, the Secretary 
                                determines that planned or implemented 
                                security measures in the site security 
                                plan of the facility are insufficient to 
                                meet the risk-based performance 
                                standards based on misrepresentation, 
                                omission, or an inadequate description 
                                of the site, the Secretary may--
                                            ``(aa) require additional 
                                        security measures; or
                                            ``(bb) suspend the 
                                        certification of the facility.
                                    ``(II) Recommendation of additional 
                                security measures.--If the Secretary 
                                suspends the certification of an 
                                expedited approval facility under 
                                subclause (I), the Secretary shall--
                                            ``(aa) recommend specific 
                                        additional security measures 
                                        that, if made part of the site 
                                        security plan by the facility, 
                                        would enable the Secretary to 
                                        approve the site security plan; 
                                        and
                                            ``(bb) provide the facility 
                                        an opportunity to submit a new 
                                        or modified site security plan 
                                        and certification under 
                                        subparagraph (A).
                                    ``(III) <<NOTE: Deadlines.>>  
                                Submission; review.--If an expedited 
                                approval facility determines to submit a 
                                new or modified site security plan and 
                                certification as authorized under 
                                subclause (II)(bb)--
                                            ``(aa) not later than 90 
                                        days after the date on which the 
                                        facility receives 
                                        recommendations under subclause 
                                        (II)(aa), the facility shall 
                                        submit the new or modified plan 
                                        and certification; and
                                            ``(bb) not later than 45 
                                        days after the date on which the 
                                        Secretary receives the new or 
                                        modified plan under item (aa), 
                                        the Secretary shall review the 
                                        plan and determine whether the 
                                        plan is facially deficient.
                                    ``(IV) Determination not to include 
                                additional security measures.--
                                            ``(aa) Revocation of 
                                        certification.--If an expedited 
                                        approval facility does not agree 
                                        to include in its site security 
                                        plan specific additional 
                                        security measures recommended by 
                                        the Secretary under subclause 
                                        (II)(aa), or does not submit a 
                                        new or modified site security 
                                        plan in accordance with 
                                        subclause (III), the Secretary 
                                        may revoke the certification of 
                                        the facility by issuing an order 
                                        under section 2104(a)(1)(B).

[[Page 128 STAT. 2906]]

                                            ``(bb) Effect of 
                                        revocation.--If the Secretary 
                                        revokes the certification of an 
                                        expedited approval facility 
                                        under item (aa) by issuing an 
                                        order under section 
                                        2104(a)(1)(B)--
                                                ``(AA) the order shall 
                                            require the owner or 
                                            operator of the facility to 
                                            submit a site security plan 
                                            or alternative security 
                                            program for review by the 
                                            Secretary review under 
                                            subsection (c)(1); and
                                                ``(BB) the facility 
                                            shall no longer be eligible 
                                            to certify a site security 
                                            plan under this paragraph.
                                    ``(V) <<NOTE: Determination.>>  
                                Facial deficiency.--If the Secretary 
                                determines that a new or modified site 
                                security plan submitted by an expedited 
                                approval facility under subclause (III) 
                                is facially deficient--
                                            ``(aa) <<NOTE: Deadline.>>  
                                        not later than 120 days after 
                                        the date of the determination, 
                                        the owner or operator of the 
                                        facility shall submit a site 
                                        security plan or alternative 
                                        security program for review by 
                                        the Secretary under subsection 
                                        (c)(1); and
                                            
                                        ``(bb) <<NOTE: Certification.>>  
                                        the facility shall no longer be 
                                        eligible to certify a site 
                                        security plan under this 
                                        paragraph.
                    ``(H) Templates.--
                          ``(i) In general.--The Secretary may develop 
                      prescriptive site security plan templates with 
                      specific security measures to meet the risk-based 
                      performance standards under subsection (a)(2)(C) 
                      for adoption and certification by a covered 
                      chemical facility assigned to tier 3 or 4 in lieu 
                      of developing and certifying its own plan.
                          ``(ii) Applicability of other laws to 
                      development and issuance of initial site security 
                      plan templates and related guidance.--During the 
                      period before the Secretary has met the deadline 
                      under subparagraph (B)(i), in developing and 
                      issuing, or amending, the site security plan 
                      templates under this subparagraph, in issuing 
                      guidance for implementation of the templates, and 
                      in collecting information from expedited approval 
                      facilities, the Secretary shall not be subject 
                      to--
                                    ``(I) section 553 of title 5, United 
                                States Code;
                                    ``(II) subchapter I of chapter 35 of 
                                title 44, United States Code; or
                                    ``(III) section 2107(b) of this 
                                title.
                          ``(iii) Rule of construction.--Nothing in this 
                      subparagraph shall be construed to prevent a 
                      covered chemical facility from developing and 
                      certifying its own security plan in accordance 
                      with subparagraph (A).
                    ``(I) Evaluation.--
                          ``(i) <<NOTE: Deadline.>>  In general.--Not 
                      later than 18 months after the date of enactment 
                      of the Protecting and Securing Chemical Facilities 
                      from Terrorist Attacks Act of 2014, the Secretary 
                      shall take any appropriate action necessary for a 
                      full evaluation of the expedited approval program 
                      authorized under this paragraph, including

[[Page 128 STAT. 2907]]

                      conducting an appropriate number of inspections, 
                      as authorized under subsection (d), of expedited 
                      approval facilities.
                          ``(ii) Report.--Not later than 18 months after 
                      the date of enactment of the Protecting and 
                      Securing Chemical Facilities from Terrorist 
                      Attacks Act of 2014, the Secretary shall submit to 
                      the Committee on Homeland Security and 
                      Governmental Affairs of the Senate and the 
                      Committee on Homeland Security and the Committee 
                      on Energy and Commerce of the House of 
                      Representatives a report that contains--
                                    ``(I)(aa) the number of eligible 
                                facilities using the expedited approval 
                                program authorized under this paragraph; 
                                and
                                    ``(bb) the number of facilities that 
                                are eligible for the expedited approval 
                                program but are using the standard 
                                process for developing and submitting a 
                                site security plan under subsection 
                                (a)(2)(D);
                                    ``(II) any costs and efficiencies 
                                associated with the expedited approval 
                                program;
                                    ``(III) the impact of the expedited 
                                approval program on the backlog for site 
                                security plan approval and authorization 
                                inspections;
                                    ``(IV) <<NOTE: Assessment.>>  an 
                                assessment of the ability of expedited 
                                approval facilities to submit facially 
                                sufficient site security plans;
                                    ``(V) <<NOTE: Assessment.>>  an 
                                assessment of any impact of the 
                                expedited approval program on the 
                                security of chemical facilities; and
                                    ``(VI) <<NOTE: Recommenda- tion.>>  
                                a recommendation by the Secretary on the 
                                frequency of compliance inspections that 
                                may be required for expedited approval 
                                facilities.

    ``(d) Compliance.--
            ``(1) Audits and inspections.--
                    ``(A) Definitions.--In this paragraph--
                          ``(i) the term `nondepartmental'--
                                    ``(I) with respect to personnel, 
                                means personnel that is not employed by 
                                the Department; and
                                    ``(II) with respect to an entity, 
                                means an entity that is not a component 
                                or other authority of the Department; 
                                and
                          ``(ii) the term `nongovernmental'--
                                    ``(I) with respect to personnel, 
                                means personnel that is not employed by 
                                the Federal Government; and
                                    ``(II) with respect to an entity, 
                                means an entity that is not an agency, 
                                department, or other authority of the 
                                Federal Government.
                    ``(B) Authority to conduct audits and inspections.--
                The Secretary shall conduct audits or inspections under 
                this title using--
                          ``(i) employees of the Department;
                          ``(ii) nondepartmental or nongovernmental 
                      personnel approved by the Secretary; or
                          ``(iii) a combination of individuals described 
                      in clauses (i) and (ii).

[[Page 128 STAT. 2908]]

                    ``(C) Support personnel.--The Secretary may use 
                nongovernmental personnel to provide administrative and 
                logistical services in support of audits and inspections 
                under this title.
                    ``(D) Reporting structure.--
                          ``(i) Nondepartmental and nongovernmental 
                      audits and inspections.--Any audit or inspection 
                      conducted by an individual employed by a 
                      nondepartmental or nongovernmental entity shall be 
                      assigned in coordination with a regional 
                      supervisor with responsibility for supervising 
                      inspectors within the Infrastructure Security 
                      Compliance Division of the Department for the 
                      region in which the audit or inspection is to be 
                      conducted.
                          ``(ii) Requirement to report.--While an 
                      individual employed by a nondepartmental or 
                      nongovernmental entity is in the field conducting 
                      an audit or inspection under this subsection, the 
                      individual shall report to the regional supervisor 
                      with responsibility for supervising inspectors 
                      within the Infrastructure Security Compliance 
                      Division of the Department for the region in which 
                      the individual is operating.
                          ``(iii) Approval.--The authority to approve a 
                      site security plan under subsection (c) or 
                      determine if a covered chemical facility is in 
                      compliance with an approved site security plan 
                      shall be exercised solely by the Secretary or a 
                      designee of the Secretary within the Department.
                    ``(E) Standards for auditors and inspectors.--The 
                Secretary shall prescribe standards for the training and 
                retraining of each individual used by the Department as 
                an auditor or inspector, including each individual 
                employed by the Department and all nondepartmental or 
                nongovernmental personnel, including--
                          ``(i) minimum training requirements for new 
                      auditors and inspectors;
                          ``(ii) retraining requirements;
                          ``(iii) minimum education and experience 
                      levels;
                          ``(iv) the submission of information as 
                      required by the Secretary to enable determination 
                      of whether the auditor or inspector has a conflict 
                      of interest;
                          ``(v) the proper certification or 
                      certifications necessary to handle chemical-
                      terrorism vulnerability information (as defined in 
                      section 27.105 of title 6, Code of Federal 
                      Regulations, or any successor thereto);
                          ``(vi) <<NOTE: Deadline.>>  the reporting of 
                      any issue of non-compliance with this section to 
                      the Secretary within 24 hours; and
                          ``(vii) any additional qualifications for 
                      fitness of duty as the Secretary may require.
                    ``(F) Conditions for nongovernmental auditors and 
                inspectors.--If the Secretary arranges for an audit or 
                inspection under subparagraph (B) to be carried out by a 
                nongovernmental entity, the Secretary shall--
                          ``(i) <<NOTE: Standards.>>  prescribe 
                      standards for the qualification of the individuals 
                      who carry out such audits and inspections

[[Page 128 STAT. 2909]]

                      that are commensurate with the standards for 
                      similar Government auditors or inspectors; and
                          ``(ii) ensure that any duties carried out by a 
                      nongovernmental entity are not inherently 
                      governmental functions.
            ``(2) Personnel surety.--
                    ``(A) Personnel surety program.--For purposes of 
                this title, the Secretary shall establish and carry out 
                a Personnel Surety Program that--
                          ``(i) does not require an owner or operator of 
                      a covered chemical facility that voluntarily 
                      participates in the program to submit information 
                      about an individual more than 1 time;
                          ``(ii) provides a participating owner or 
                      operator of a covered chemical facility with 
                      relevant information about an individual based on 
                      vetting the individual against the terrorist 
                      screening database, to the extent that such 
                      feedback is necessary for the facility to be in 
                      compliance with regulations promulgated under this 
                      title; and
                          ``(iii) provides redress to an individual--
                                    ``(I) whose information was vetted 
                                against the terrorist screening database 
                                under the program; and
                                    ``(II) who believes that the 
                                personally identifiable information 
                                submitted to the Department for such 
                                vetting by a covered chemical facility, 
                                or its designated representative, was 
                                inaccurate.
                    ``(B) Personnel surety program implementation.--To 
                the extent that a risk-based performance standard 
                established under subsection (a) requires identifying 
                individuals with ties to terrorism--
                          ``(i) a covered chemical facility--
                                    ``(I) may satisfy its obligation 
                                under the standard by using any Federal 
                                screening program that periodically vets 
                                individuals against the terrorist 
                                screening database, or any successor 
                                program, including the Personnel Surety 
                                Program established under subparagraph 
                                (A); and
                                    ``(II) shall--
                                            ``(aa) accept a credential 
                                        from a Federal screening program 
                                        described in subclause (I) if an 
                                        individual who is required to be 
                                        screened presents such a 
                                        credential; and
                                            ``(bb) address in its site 
                                        security plan or alternative 
                                        security program the measures it 
                                        will take to verify that a 
                                        credential or documentation from 
                                        a Federal screening program 
                                        described in subclause (I) is 
                                        current;
                          ``(ii) visual inspection shall be sufficient 
                      to meet the requirement under clause (i)(II)(bb), 
                      but the facility should consider other means of 
                      verification, consistent with the facility's 
                      assessment of the threat posed by acceptance of 
                      such credentials; and
                          ``(iii) the Secretary may not require a 
                      covered chemical facility to submit any 
                      information about an individual unless the 
                      individual--

[[Page 128 STAT. 2910]]

                                    ``(I) is to be vetted under the 
                                Personnel Surety Program; or
                                    ``(II) has been identified as 
                                presenting a terrorism security risk.
                    ``(C) Rights unaffected.--Nothing in this section 
                shall supersede the ability--
                          ``(i) of a facility to maintain its own 
                      policies regarding the access of individuals to 
                      restricted areas or critical assets; or
                          ``(ii) of an employing facility and a 
                      bargaining agent, where applicable, to negotiate 
                      as to how the results of a background check may be 
                      used by the facility with respect to employment 
                      status.
            ``(3) Availability of information.--The Secretary shall 
        share with the owner or operator of a covered chemical facility 
        any information that the owner or operator needs to comply with 
        this section.

    ``(e) Responsibilities of the Secretary.--
            ``(1) Identification of chemical facilities of interest.--In 
        carrying <<NOTE: Consultation.>>  out this title, the Secretary 
        shall consult with the heads of other Federal agencies, States 
        and political subdivisions thereof, relevant business 
        associations, and public and private labor organizations to 
        identify all chemical facilities of interest.
            ``(2) Risk assessment.--
                    ``(A) In general.--For purposes of this title, the 
                Secretary shall develop a security risk assessment 
                approach and corresponding tiering methodology for 
                covered chemical facilities that incorporates the 
                relevant elements of risk, including threat, 
                vulnerability, and consequence.
                    ``(B) Criteria for determining security risk.--The 
                criteria for determining the security risk of terrorism 
                associated with a covered chemical facility shall take 
                into account--
                          ``(i) relevant threat information;
                          ``(ii) potential severe economic consequences 
                      and the potential loss of human life in the event 
                      of the facility being subject to attack, 
                      compromise, infiltration, or exploitation by 
                      terrorists; and
                          ``(iii) vulnerability of the facility to 
                      attack, compromise, infiltration, or exploitation 
                      by terrorists.
            ``(3) Changes in tiering.--
                    ``(A) Maintenance of records.--The Secretary shall 
                document the basis for each instance in which--
                          ``(i) tiering for a covered chemical facility 
                      is changed; or
                          ``(ii) a covered chemical facility is 
                      determined to no longer be subject to the 
                      requirements under this title.
                    ``(B) Required information.--The records maintained 
                under subparagraph (A) shall include information on 
                whether and how the Secretary confirmed the information 
                that was the basis for the change or determination 
                described in subparagraph (A).
            ``(4) Semiannual performance reporting.--Not later than 6 
        months after the date of enactment of the Protecting and 
        Securing Chemical Facilities from Terrorist Attacks Act

[[Page 128 STAT. 2911]]

        of 2014, and not less frequently than once every 6 months 
        thereafter, the Secretary shall submit to the Committee on 
        Homeland Security and Governmental Affairs of the Senate and the 
        Committee on Homeland Security and the Committee on Energy and 
        Commerce of the House of Representatives a report that includes, 
        for the period covered by the report--
                    ``(A) the number of covered chemical facilities in 
                the United States;
                    ``(B) information--
                          ``(i) describing--
                                    ``(I) the number of instances in 
                                which the Secretary--
                                            ``(aa) placed a covered 
                                        chemical facility in a lower 
                                        risk tier; or
                                            
                                        ``(bb) <<NOTE: Determination.>>  
                                        determined that a facility that 
                                        had previously met the criteria 
                                        for a covered chemical facility 
                                        under section 2101(3) no longer 
                                        met the criteria; and
                                    ``(II) the basis, in summary form, 
                                for each action or determination under 
                                subclause (I); and
                          ``(ii) that is provided in a sufficiently 
                      anonymized form to ensure that the information 
                      does not identify any specific facility or company 
                      as the source of the information when viewed alone 
                      or in combination with other public information;
                    ``(C) the average number of days spent reviewing 
                site security or an alternative security program for a 
                covered chemical facility prior to approval;
                    ``(D) the number of covered chemical facilities 
                inspected;
                    ``(E) the average number of covered chemical 
                facilities inspected per inspector; and
                    ``(F) any other information that the Secretary 
                determines will be helpful to Congress in evaluating the 
                performance of the Chemical Facility Anti-Terrorism 
                Standards Program.
``SEC. 2103. <<NOTE: 6 USC 623.>>  PROTECTION AND SHARING OF 
                          INFORMATION.

    ``(a) In General.--Notwithstanding any other provision of law, 
information developed under this title, including vulnerability 
assessments, site security plans, and other security related 
information, records, and documents shall be given protections from 
public disclosure consistent with the protection of similar information 
under section 70103(d) of title 46, United States Code.
    ``(b) Sharing of Information With States and Local Governments.--
Nothing in this section shall be construed to prohibit the sharing of 
information developed under this title, as the Secretary determines 
appropriate, with State and local government officials possessing a need 
to know and the necessary security clearances, including law enforcement 
officials and first responders, for the purpose of carrying out this 
title, provided that such information may not be disclosed pursuant to 
any State or local law.
    ``(c) Sharing of Information With First Responders.--
            ``(1) Requirement.--The Secretary shall provide to State, 
        local, and regional fusion centers (as that term is defined in 
        section 210A(j)(1)) and State and local government officials, as 
        the Secretary determines appropriate, such information as

[[Page 128 STAT. 2912]]

        is necessary to help ensure that first responders are properly 
        prepared and provided with the situational awareness needed to 
        respond to security incidents at covered chemical facilities.
            ``(2) Dissemination.--The Secretary shall disseminate 
        information under paragraph (1) through a medium or system 
        determined by the Secretary to be appropriate to ensure the 
        secure and expeditious dissemination of such information to 
        necessary selected individuals.

    ``(d) Enforcement Proceedings.--In any proceeding to enforce this 
section, vulnerability assessments, site security plans, and other 
information submitted to or obtained by the Secretary under this title, 
and related vulnerability or security information, shall be treated as 
if the information were classified information.
    ``(e) Availability of Information.--Notwithstanding any other 
provision of law (including section 552(b)(3) of title 5, United States 
Code), section 552 of title 5, United States Code (commonly known as the 
`Freedom of Information Act') shall not apply to information protected 
from public disclosure pursuant to subsection (a) of this section.
    ``(f) Sharing of Information With Members of Congress.--Nothing in 
this section shall prohibit the Secretary from disclosing information 
developed under this title to a Member of Congress in response to a 
request by a Member of Congress.
``SEC. 2104. <<NOTE: 6 USC 624.>>  CIVIL ENFORCEMENT.

    ``(a) Notice of Noncompliance.--
            ``(1) <<NOTE: Determination. Deadlines.>>  Notice.--If the 
        Secretary determines that a covered chemical facility is not in 
        compliance with this title, the Secretary shall--
                    ``(A) provide the owner or operator of the facility 
                with--
                          ``(i) not later than 14 days after date on 
                      which the Secretary makes the determination, a 
                      written notification of noncompliance that 
                      includes a clear explanation of any deficiency in 
                      the security vulnerability assessment or site 
                      security plan; and
                          ``(ii) <<NOTE: Consultation.>>  an opportunity 
                      for consultation with the Secretary or the 
                      Secretary's designee; and
                    ``(B) issue to the owner or operator of the facility 
                an order to comply with this title by a date specified 
                by the Secretary in the order, which date shall be not 
                later than 180 days after the date on which the 
                Secretary issues the order.
            ``(2) Continued noncompliance.--If an owner or operator 
        remains noncompliant after the procedures outlined in paragraph 
        (1) have been executed, or demonstrates repeated violations of 
        this title, the Secretary may enter an order in accordance with 
        this section assessing a civil penalty, an order to cease 
        operations, or both.

    ``(b) Civil Penalties.--
            ``(1) Violations of orders.--Any person who violates an 
        order issued under this title shall be liable for a civil 
        penalty under section 70119(a) of title 46, United States Code.
            ``(2) Non-reporting chemical facilities of interest.--Any 
        owner of a chemical facility of interest who fails to comply 
        with, or knowingly submits false information under, this title 
        or the CFATS regulations shall be liable for a civil penalty 
        under section 70119(a) of title 46, United States Code.

[[Page 128 STAT. 2913]]

    ``(c) Emergency Orders.--
            ``(1) <<NOTE: Determination.>>  In general.--Notwithstanding 
        subsection (a) or any site security plan or alternative security 
        program approved under this title, if the Secretary determines 
        that there is an imminent threat of death, serious illness, or 
        severe personal injury, due to a violation of this title or the 
        risk of a terrorist incident that may affect a chemical facility 
        of interest, the Secretary--
                    ``(A) <<NOTE: Consultation.>>  shall consult with 
                the facility, if practicable, on steps to mitigate the 
                risk; and
                    ``(B) <<NOTE: Effective date.>>  may order the 
                facility, without notice or opportunity for a hearing, 
                effective immediately or as soon as practicable, to--
                          ``(i) implement appropriate emergency security 
                      measures; or
                          ``(ii) cease or reduce some or all operations, 
                      in accordance with safe shutdown procedures, if 
                      the Secretary determines that such a cessation or 
                      reduction of operations is the most appropriate 
                      means to address the risk.
            ``(2) Limitation on delegation.--The Secretary may not 
        delegate the authority under paragraph (1) to any official other 
        than the Under Secretary responsible for overseeing critical 
        infrastructure protection, cybersecurity, and other related 
        programs of the Department appointed under section 103(a)(1)(H).
            ``(3) Limitation on authority.--The Secretary may exercise 
        the authority under this subsection only to the extent necessary 
        to abate the imminent threat determination under paragraph (1).
            ``(4) Due process for facility owner or operator.--
                    ``(A) Written orders.--An order issued by the 
                Secretary under paragraph (1) shall be in the form of a 
                written emergency order that--
                          ``(i) describes the violation or risk that 
                      creates the imminent threat;
                          ``(ii) states the security measures or order 
                      issued or imposed; and
                          ``(iii) describes the standards and procedures 
                      for obtaining relief from the order.
                    ``(B) <<NOTE: Deadline.>>  Opportunity for review.--
                After issuing an order under paragraph (1) with respect 
                to a chemical facility of interest, the Secretary shall 
                provide for review of the order under section 554 of 
                title 5 if a petition for review is filed not later than 
                20 days after the date on which the Secretary issues the 
                order.
                    ``(C) <<NOTE: Time period. Effective 
                date. Determination.>>  Expiration of effectiveness of 
                order.--If a petition for review of an order is filed 
                under subparagraph (B) and the review under that 
                paragraph is not completed by the last day of the 30-day 
                period beginning on the date on which the petition is 
                filed, the order shall vacate automatically at the end 
                of that period unless the Secretary determines, in 
                writing, that the imminent threat providing a basis for 
                the order continues to exist.

    ``(d) Right of Action.--Nothing in this title confers upon any 
person except the Secretary or his or her designee a right of action 
against an owner or operator of a covered chemical facility to enforce 
any provision of this title.

[[Page 128 STAT. 2914]]

``SEC. 2105. <<NOTE: 6 USC 625.>>  WHISTLEBLOWER PROTECTIONS.

    ``(a) Procedure for Reporting Problems.--
            ``(1) <<NOTE: Public information.>>  Establishment of a 
        reporting procedure.--Not later than 180 days after the date of 
        enactment of the Protecting and Securing Chemical Facilities 
        from Terrorist Attacks Act of 2014, the Secretary shall 
        establish, and provide information to the public regarding, a 
        procedure under which any employee or contractor of a chemical 
        facility of interest may submit a report to the Secretary 
        regarding a violation of a requirement under this title.
            ``(2) Confidentiality.--The Secretary shall keep 
        confidential the identity of an individual who submits a report 
        under paragraph (1) and any such report shall be treated as a 
        record containing protected information to the extent that the 
        report does not consist of publicly available information.
            ``(3) Acknowledgment of receipt.--If a report submitted 
        under paragraph (1) identifies the individual making the report, 
        the Secretary shall promptly respond to the individual directly 
        and shall promptly acknowledge receipt of the report.
            ``(4) Steps to address problems.--The Secretary--
                    ``(A) <<NOTE: Review.>>  shall review and consider 
                the information provided in any report submitted under 
                paragraph (1); and
                    ``(B) may take action under section 2104 of this 
                title if necessary to address any substantiated 
                violation of a requirement under this title identified 
                in the report.
            ``(5) Due process for facility owner or operator.--
                    ``(A) <<NOTE: Determination.>>  In general.--If, 
                upon the review described in paragraph (4), the 
                Secretary determines that a violation of a provision of 
                this title, or a regulation prescribed under this title, 
                has occurred, the Secretary may--
                          ``(i) institute a civil enforcement under 
                      section 2104(a) of this title; or
                          ``(ii) if the Secretary makes the 
                      determination under section 2104(c), issue an 
                      emergency order.
                    ``(B) Written orders.--The action of the Secretary 
                under paragraph (4) shall be in a written form that--
                          ``(i) describes the violation;
                          ``(ii) states the authority under which the 
                      Secretary is proceeding; and
                          ``(iii) describes the standards and procedures 
                      for obtaining relief from the order.
                    ``(C) <<NOTE: Deadline.>>  Opportunity for review.--
                After taking action under paragraph (4), the Secretary 
                shall provide for review of the action if a petition for 
                review is filed within 20 calendar days of the date of 
                issuance of the order for the action.
                    ``(D) <<NOTE: Time period. Effective 
                date. Determination.>>  Expiration of effectiveness of 
                order.--If a petition for review of an action is filed 
                under subparagraph (C) and the review under that 
                subparagraph is not completed by the end of the 30-day 
                period beginning on the date the petition is filed, the 
                action shall cease to be effective at the end of such 
                period unless the Secretary determines, in writing, that 
                the violation providing a basis for the action continues 
                to exist.
            ``(6) Retaliation prohibited.--
                    ``(A) In general.--An owner or operator of a 
                chemical facility of interest or agent thereof may not 
                discharge an

[[Page 128 STAT. 2915]]

                employee or otherwise discriminate against an employee 
                with respect to the compensation provided to, or terms, 
                conditions, or privileges of the employment of, the 
                employee because the employee (or an individual acting 
                pursuant to a request of the employee) submitted a 
                report under paragraph (1).
                    ``(B) Exception.--An employee shall not be entitled 
                to the protections under this section if the employee--
                          ``(i) knowingly and willfully makes any false, 
                      fictitious, or fraudulent statement or 
                      representation; or
                          ``(ii) uses any false writing or document 
                      knowing the writing or document contains any 
                      false, fictitious, or fraudulent statement or 
                      entry.

    ``(b) Protected Disclosures.--Nothing in this title shall be 
construed to limit the right of an individual to make any disclosure--
            ``(1) protected or authorized under section 2302(b)(8) or 
        7211 of title 5, United States Code;
            ``(2) protected under any other Federal or State law that 
        shields the disclosing individual against retaliation or 
        discrimination for having made the disclosure in the public 
        interest; or
            ``(3) to the Special Counsel of an agency, the inspector 
        general of an agency, or any other employee designated by the 
        head of an agency to receive disclosures similar to the 
        disclosures described in paragraphs (1) and (2).

    ``(c) <<NOTE: Partnership. Public information. Web posting.>>  
Publication of Rights.--The Secretary, in partnership with industry 
associations and labor organizations, shall make publicly available both 
physically and online the rights that an individual who discloses 
information, including security-sensitive information, regarding 
problems, deficiencies, or vulnerabilities at a covered chemical 
facility would have under Federal whistleblower protection laws or this 
title.

    ``(d) Protected Information.--All information contained in a report 
made under this subsection (a) shall be protected in accordance with 
section 2103.
``SEC. 2106. <<NOTE: 6 USC 626.>>  RELATIONSHIP TO OTHER LAWS.

    ``(a) Other Federal Laws.--Nothing in this title shall be construed 
to supersede, amend, alter, or affect any Federal law that--
            ``(1) regulates (including by requiring information to be 
        submitted or made available) the manufacture, distribution in 
        commerce, use, handling, sale, other treatment, or disposal of 
        chemical substances or mixtures; or
            ``(2) authorizes or requires the disclosure of any record or 
        information obtained from a chemical facility under any law 
        other than this title.

    ``(b) States and Political Subdivisions.--This title shall not 
preclude or deny any right of any State or political subdivision thereof 
to adopt or enforce any regulation, requirement, or standard of 
performance with respect to chemical facility security that is more 
stringent than a regulation, requirement, or standard of performance 
issued under this section, or otherwise impair any right or jurisdiction 
of any State with respect to chemical facilities within that State, 
unless there is an actual conflict between this section and the law of 
that State.

[[Page 128 STAT. 2916]]

``SEC. 2107. <<NOTE: 6 USC 627.>>  CFATS REGULATIONS.

    ``(a) General Authority.--The Secretary may, in accordance with 
chapter 5 of title 5, United States Code, promulgate regulations or 
amend existing CFATS regulations to implement the provisions under this 
title.
    ``(b) Existing CFATS Regulations.--
            ``(1) In general.--Notwithstanding section 4(b) of the 
        Protecting and Securing Chemical Facilities from Terrorist 
        Attacks Act of 2014, each existing CFATS regulation shall remain 
        in effect unless the Secretary amends, consolidates, or repeals 
        the regulation.
            ``(2) <<NOTE: Deadline. Determination.>>  Repeal.--Not later 
        than 30 days after the date of enactment of the Protecting and 
        Securing Chemical Facilities from Terrorist Attacks Act of 2014, 
        the Secretary shall repeal any existing CFATS regulation that 
        the Secretary determines is duplicative of, or conflicts with, 
        this title.

    ``(c) Authority.--The Secretary shall exclusively rely upon 
authority provided under this title in--
            ``(1) determining compliance with this title;
            ``(2) identifying chemicals of interest; and
            ``(3) determining security risk associated with a chemical 
        facility.
``SEC. 2108. <<NOTE: 6 USC 628.>>  SMALL COVERED CHEMICAL 
                          FACILITIES.

    ``(a) Definition.--In this section, the term `small covered chemical 
facility' means a covered chemical facility that--
            ``(1) has fewer than 100 employees employed at the covered 
        chemical facility; and
            ``(2) is owned and operated by a small business concern (as 
        defined in section 3 of the Small Business Act (15 U.S.C. 632)).

    ``(b) Assistance to Facilities.--The Secretary may provide guidance 
and, as appropriate, tools, methodologies, or computer software, to 
assist small covered chemical facilities in developing the physical 
security, cybersecurity, recordkeeping, and reporting procedures 
required under this title.
    ``(c) Report.--The Secretary shall submit to the Committee on 
Homeland Security and Governmental Affairs of the Senate and the 
Committee on Homeland Security and the Committee on Energy and Commerce 
of the House of Representatives a report on best practices that may 
assist small covered chemical facilities in development of physical 
security best practices.
``SEC. 2109. <<NOTE: 6 USC 629.>>  OUTREACH TO CHEMICAL FACILITIES 
                          OF INTEREST.

    ``Not later <<NOTE: Deadline. Plans.>>  than 90 days after the date 
of enactment of the Protecting and Securing Chemical Facilities from 
Terrorist Attacks Act of 2014, the Secretary shall establish an outreach 
implementation plan, in coordination with the heads of other appropriate 
Federal and State agencies, relevant business associations, and public 
and private labor organizations, to--
            ``(1) identify chemical facilities of interest; and
            ``(2) make available compliance assistance materials and 
        information on education and training.''.

    (b) Clerical Amendment.--The table of contents in section 1(b) of 
the Homeland Security Act of 2002 (Public Law 107-196; 116 Stat. 2135) 
is amended by adding at the end the following:

[[Page 128 STAT. 2917]]

         ``TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS

``Sec. 2101. Definitions.
``Sec. 2102. Chemical Facility Anti-Terrorism Standards Program.
``Sec. 2103. Protection and sharing of information.-
``Sec. 2104. Civil enforcement.
``Sec. 2105. Whistleblower protections.
``Sec. 2106. Relationship to other laws.
``Sec. 2107. CFATS regulations.
``Sec. 2108. Small covered chemical facilities.
``Sec. 2109. Outreach to chemical facilities of interest.''.

SEC. 3. ASSESSMENT; REPORTS.

    (a) Definitions.--In this section--
            (1) the term ``Chemical Facility Anti-Terrorism Standards 
        Program'' means--
                    (A) the Chemical Facility Anti-Terrorism Standards 
                program initially authorized under section 550 of the 
                Department of Homeland Security Appropriations Act, 2007 
                (Public Law 109-295; 6 U.S.C. 121 note); and
                    (B) the Chemical Facility Anti-Terrorism Standards 
                Program subsequently authorized under section 2102(a) of 
                the Homeland Security Act of 2002, as added by section 
                2;
            (2) the term ``Department'' means the Department of Homeland 
        Security; and
            (3) the term ``Secretary'' means the Secretary of Homeland 
        Security.

    (b) Third-party Assessment.--Using amounts appropriated to the 
Department before the date of enactment of this Act, the Secretary shall 
commission a third-party study to assess vulnerabilities of covered 
chemical facilities, as defined in section 2101 of the Homeland Security 
Act of 2002 (as added by section 2), to acts of terrorism.
    (c) Reports.--
            (1) Report to congress.--Not later than 18 months after the 
        date of enactment of this Act, the Secretary shall submit to the 
        Committee on Homeland Security and Governmental Affairs of the 
        Senate and the Committee on Homeland Security and the Committee 
        on Energy and Commerce of the House of Representatives a report 
        on the Chemical Facility Anti-Terrorism Standards Program that 
        includes--
                    (A) <<NOTE: Certification.>>  a certification by the 
                Secretary that the Secretary has made significant 
                progress in the identification of all chemical 
                facilities of interest under section 2102(e)(1) of the 
                Homeland Security Act of 2002, as added by section 2, 
                including--
                          (i) a description of the steps taken to 
                      achieve that progress and the metrics used to 
                      measure the progress;
                          (ii) information on whether facilities that 
                      submitted Top-Screens as a result of the 
                      identification of chemical facilities of interest 
                      were tiered and in what tiers those facilities 
                      were placed; and
                          (iii) <<NOTE: Plans.>>  an action plan to 
                      better identify chemical facilities of interest 
                      and bring those facilities into compliance with 
                      title XXI of the Homeland Security Act of 2002, as 
                      added by section 2;
                    (B) <<NOTE: Certification.>>  a certification by the 
                Secretary that the Secretary has developed a risk 
                assessment approach and corresponding tiering 
                methodology under section 2102(e)(2)

[[Page 128 STAT. 2918]]

                of the Homeland Security Act of 2002, as added by 
                section 2;
                    (C) an assessment by the Secretary of the 
                implementation by the Department of the recommendations 
                made by the Homeland Security Studies and Analysis 
                Institute as outlined in the Institute's Tiering 
                Methodology Peer Review (Publication Number: RP12-22-
                02); and
                    (D) a description of best practices that may assist 
                small covered chemical facilities, as defined in section 
                2108(a) of the Homeland Security Act of 2002, as added 
                by section 2, in the development of physical security 
                best practices.
            (2) Annual gao report.--
                    (A) <<NOTE: Time period. Effective date.>>  In 
                general.--During the 3-year period beginning on the date 
                of enactment of this Act, the Comptroller General of the 
                United States shall submit to Congress an annual report 
                that assesses the implementation of this Act and the 
                amendments made by this Act.
                    (B) Initial report.--Not later than 180 days after 
                the date of enactment of this Act, the Comptroller 
                General shall submit to Congress the first report under 
                subparagraph (A).
                    (C) Second annual report.--Not later than 1 year 
                after the date of the initial report required under 
                subparagraph (B), the Comptroller General shall submit 
                to Congress the second report under subparagraph (A), 
                which shall include an assessment of the whistleblower 
                protections provided under section 2105 of the Homeland 
                Security Act of 2002, as added by section 2, and--
                          (i) describes the number and type of problems, 
                      deficiencies, and vulnerabilities with respect to 
                      which reports have been submitted under such 
                      section 2105;
                          (ii) evaluates the efforts of the Secretary in 
                      addressing the problems, deficiencies, and 
                      vulnerabilities described in subsection (a)(1) of 
                      such section 2105; and
                          (iii) <<NOTE: Evaluation.>>  evaluates the 
                      efforts of the Secretary to inform individuals of 
                      their rights, as required under subsection (c) of 
                      such section 2105.
                    (D) Third annual report.--Not later than 1 year 
                after the date on which the Comptroller General submits 
                the second report required under subparagraph (A), the 
                Comptroller General shall submit to Congress the third 
                report under subparagraph (A), which shall include an 
                assessment of--
                          (i) the expedited approval program authorized 
                      under section 2102(c)(4) of the Homeland Security 
                      Act of 2002, as added by section 2; and
                          (ii) the report on the expedited approval 
                      program submitted by the Secretary under 
                      subparagraph (I)(ii) of such section 2102(c)(4).
SEC. 4. <<NOTE: 6 USC 621 note.>>  EFFECTIVE DATE; CONFORMING 
                    REPEAL.

    (a) Effective Date.--This Act, and the amendments made by this Act, 
shall take effect on the date that is 30 days after the date of 
enactment of this Act.

[[Page 128 STAT. 2919]]

    (b) Conforming Repeal.--Section 550 of the Department of Homeland 
Security Appropriations Act, 2007 (Public Law 109-295; 120 Stat. 
1388), <<NOTE: 6 USC 621 note.>>  is repealed as of the effective date 
of this Act.
SEC. 5. <<NOTE: 6 USC 621 note.>>  TERMINATION.

    The authority provided under title XXI of the Homeland Security Act 
of 2002, as added by section 2(a), shall terminate on the date that is 4 
years after the effective date of this Act.

    Approved December 18, 2014.

LEGISLATIVE HISTORY--H.R. 4007:
---------------------------------------------------------------------------

HOUSE REPORTS: No. 113-491, Pt. 1 (Comm. on Homeland Security).
SENATE REPORTS: No. 113-263 (Comm. on Homeland Security and Governmental 
Affairs).
CONGRESSIONAL RECORD, Vol. 160 (2014):
            July 8, considered and passed House.
            Dec. 10, considered and passed Senate, amended.
            Dec. 11, House concurred in Senate amendment.

                                  <all>
```