U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

1 

39–010 

" ! SENATE 113TH CONGRESS

2d Session 

REPORT

2014

113–263 

Calendar No. 578 

CHEMICAL FACILITIES ANTI-TERRORISM 

STANDARDS PROGRAM AUTHORIZATION 

AND ACCOUNTABILITY ACT OF 2014 

R E P O R T 

OF THE

COMMITTEE ON HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

TO ACCOMPANY

H.R. 4007 

TO RECODIFY AND REAUTHORIZE THE CHEMICAL FACILITY ANTITERRORISM STANDARDS PROGRAM 

SEPTEMBER 18, 2014.—Ordered to be printed 


emcdonald on DSK67QTVN1PROD with HEARINGcongress.#13
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

THOMAS R. CARPER, Delaware, Chairman 

CARL LEVIN, Michigan 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

CLAIRE MCCASKILL, Missouri 

JON TESTER, Montana 

MARK BEGICH, Alaska 

TAMMY BALDWIN, Wisconsin 

HEIDI HEITKAMP, North Dakota 

TOM COBURN, Oklahoma 

JOHN MCCAIN, Arizona 

RON JOHNSON, Wisconsin 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

MICHAEL B. ENZI, Wyoming 

KELLY AYOTTE, New Hampshire 

GABRIELLE A. BATKIN, Staff Director 

JOHN P. KILVINGTON, Deputy Staff Director 

MARY BETH SCHULTZ, Chief Counsel 

JOHN G. COLLINS, Senior Professional Staff Member 

JASON M. YANUSSI, Senior Professional Staff Member 

ABIGAIL A. SHENKLE, Legislative Aide 

KEITH B. ASHDOWN, Minority Staff Director 

CHRISTOPHER J. BARKLEY, Minority Deputy Staff Director 

ANDREW C. DOCKHAM, Minority Chief Counsel 

WILLIAM H.W. MCKENNA, Minority Investigative Counsel 

LAURA W. KILBRIDE, Chief Clerk 


emcdonald on DSK67QTVN1PROD with HEARING
Calendar No. 578 

113TH CONGRESS SENATE REPORT " ! 2d Session 113–263 

CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS 

PROGRAM AUTHORIZATION AND ACCOUNTABILITY ACT 

OF 2014 

SEPTEMBER 18, 2014.—Ordered to be printed 

Mr. CARPER, from the Committee on Homeland Security and 

Governmental Affairs, submitted the following 

R E P O R T 

[To accompany H.R. 4007] 

The Committee on Homeland Security and Governmental Affairs, 

to which was referred the bill (H.R. 4007) to recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program, having considered the same, reports favorably thereon with an amendment in the nature of a substitute and recommends that the bill, 

as amended, do pass. 

CONTENTS 

Page 

I. Purpose and Summary .................................................................................. 1 

II. Background and Need for the Legislation ................................................... 2 

III. Legislative History ......................................................................................... 14 

IV. Section-by-Section Analysis of the Bill, as Reported .................................. 15 

V. Evaluation of Regulatory Impact .................................................................. 20 

VI. Congressional Budget Office Estimate ......................................................... 20 

VII. Changes in Existing Law Made by the Bill, as Reported ........................... 22 

I. PURPOSE AND SUMMARY

H.R. 4007, the Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of 2014, as amended by the Committee’s substitute amendment reauthorizes the Chemical Facility Anti-Terrorism Standards program (CFATS) of the Department of Homeland Security. The CFATS program is designed to help ensure that 

high-risk chemical facilities are secure from terrorist attack or sabotage. Facilities that make or use certain chemicals have been 

identified as a significant security concern and one that continues 


emcdonald on DSK67QTVN1PROD with HEARING
2 

1See P.L. 109–295, Department of Homeland Security Appropriations Act of 2007, Sec. 550. 2See 152 Cong. Rec. S10351 (September 28, 2006) (Statement of Senator Collins), at http:// 

www.gpo.gov/fdsys/pkg/CREC-2006-09-28/pdf/CREC-2006-09-28.pdf. 3Sec. 534(h) of P.L. 110–161, the Department of Homeland Security Appropriations Act of 

2008, which allowed states and political subdivisions thereof to adopt laws regulating chemical 

facilities, as long as they were at least as stringent as CFATS. Since this change amended the 

authorizing language for the program, it was carried forward in subsequent short-term extensions of the program. 

to warrant a dedicated security program at the federal level. The 

Committee substitute reauthorizes the CFATS program for four 

years, while at the same time mandating specific changes in response to concerns raised about that program by both stakeholders 

and overseers. Specifically, the bill directs DHS to identify highrisk facilities through the use of specific risk criteria and requires 

DHS to use risk-based performance standards for high-risk facilities to meet. The facilities, for their part, submit security plans laying out how they plan to meet the performance standards, and 

DHS reviews and approves the plans and then follows up with inperson inspections of the facilities to ensure compliance. 

II. BACKGROUND AND NEED FOR LEGISLATION

Chemicals are a ubiquitous part of modern life, forming indispensable parts of a vast number of products from the mundane to the 

complex. Thousands of facilities across the country produce and 

store chemicals, some of which could pose a significant threat to 

human health or safety if released or misused. Certain chemicals, 

if released into the water or air, pose a direct threat to the health 

or life of those in nearby communities. Other chemicals can explode 

if abused or mishandled posing a significant threat to the surrounding communities or, if the chemicals are stolen and smuggled, 

to other communities as well. Chemical facilities—places that 

produce, store or use significant quantities of certain chemicals— 

therefore offer attractive targets for terrorists because of the large 

scale damage and loss of life that can occur through a direct attack 

on a facility or the misappropriation of the chemicals they produce 

or store. While many of these chemicals are already regulated 

under various environmental or worker safety statutes, those regulations typically focus on the possibility of an accidental release or 

misuse rather than a deliberate effort to exploit the chemicals to 

inflict harm. 

To protect against this security risk, in the fall of 2006, Congress 

authorized the Department of Homeland Security (DHS) to determine which chemical facilities present a high level of security risk, 

establish risk-based performance standards for securing those highrisk facilities, and enforce regulations designed to ensure facilities 

posing the highest risk are meeting those standards.1 In response, 

DHS established the Chemical Facility Anti-Terrorism Standards 

(CFATS) program. The statute establishing the CFATS program included a three-year sunset for DHS’s authority, creating initial authority for the program but ensuring that the effectiveness of the 

approach outlined in the bill could be evaluated, and other measures considered, relatively soon after the program’s inception.2

Since then, Congress has passed several short-term extensions, 

only once making a change to the CFATS program despite Congress’ desire to monitor implementation of the program closely.3

With the Department’s current authority set to expire on October 


emcdonald on DSK67QTVN1PROD with HEARING
3 

4See Department of Homeland Security, CFATS Update August 2014 at http://www.dhs.gov/ 

sites/default/files/publications/CFATS%20FS_August2014.pdf. 5The number of chemical facilities covered under the program is variously quoted in this report as between 3,986 and 4,100. This fluctuation is due to the fact that chemical facilities can 

reduce or remove their holdings of chemicals in order to tier out of the program, so the number 

of covered facilities is dynamic based on facilities’ decision to ‘‘tier out’’ of the program. See 

‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th Cong. 

3 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 6These figures refer to preliminary tier assignments from the Department based on facility 

submission of a Top-Screen. Final tier assignment occurs after facilities submit Security Vulnerability Assessments; the Department then reviews these assessments to identify which facilities 

should be assigned to a high-risk tier under CFATS. 7 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. 3 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 

4, 2014, the Committee voted to extend the chemical security program with a longer-term authorization while also addressing identified weaknesses in the program. 

The original 2006 authorization—which has been extended repeatedly on various appropriations bills or spending resolutions— 

directed DHS to develop a security program for high-risk chemical 

facilities that would rely on performance standards rather than 

specific, prescriptive measures. It also exempted certain facilities 

already subject to other regulatory regimes aimed at ensuring the 

security of their facilities, such as facilities owned or operated by 

the Departments of Defense or Energy, facilities already regulated 

under the Maritime Transportation Security Act of 2002 or by the 

Nuclear Regulatory Commission, and water and wastewater treatment facilities. 

DHS developed the core features of the CFATS program in interim regulations issued in spring 2007. To determine which facilities face regulation under the program, DHS developed a list of 322 

‘‘chemicals of interest.’’ All non-exempt facilities possessing any of 

the 322 ‘‘chemicals of interest’’ beyond specified threshold amounts 

must fill out a questionnaire known as a ‘‘Top-Screen.’’ DHS uses 

the completed Top-Screens to determine whether a facility poses a 

high security risk such that it should be covered by the risk-based 

performance standards. If DHS finds the facility to be ‘‘high-risk,’’ 

the facility is covered by CFATS and must submit and comply with 

a security plan that meets the risk-based performance standards; 

those not determined to be high-risk face no further regulatory obligations under CFATS. DHS then assigns high-risk facilities to 

one of four risk-based tiers, with progressively stricter requirements for those in the highest risk tiers. Tier 1 facilities are the 

highest risk facilities; Tier 4 includes the lowest group of high-risk 

facilities. 

As of August 1, 2014, more than 48,000 facilities with chemicals 

of interest had submitted Top-Screens to DHS. From those submissions, DHS categorized approximately 3,986 facilities as high-risk, 

triggering some level of regulation under CFATS.4 As of April 

2014,5 121 facilities had been preliminarily assigned 6 to Tier 1; 

382 had been assigned to Tier 2; 1,088 had been assigned to Tier 

3; and 2,542 had been assigned to Tier 4.7

Facilities deemed high-risk by the Department generally must 

develop an effective security plan, submit the plan to DHS for review, and implement their security plan. The security standards reVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00005 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
4 

8 ‘‘A performance standard specifies the outcome required, but leaves the specific measures to 

achieve that outcome up to the discretion of the regulated entity. In contrast to a design standard or a technology-based standard that specifies exactly how to achieve compliance, a performance standard sets a goal and lets each regulated entity decide how to meet it.’’ See Department 

of Homeland Security, Risk-Based Performance Standards Guidelines, Chemical Facility AntiTerrorism Standards, May 2009 at http://www.dhs.gov/xlibrary/assets/ 

chemsec_cfats_riskbased_performance_standards.pdf, quoting Cary Coglianese et al., Performance-Based Regulation: Prospects and Limitations in Health, Safety, and Environmental Protection, 55 Admin. L. Rev. 705, 706–07 (2003). 9See Department of Homeland Security, CFATS Update August 2014 at http://www.dhs.gov/ 

sites/default/files/publications/CFATS%20FS_August2014.pdf. 10 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

quired under the CFATS program are performance based, rather 

than prescriptive. This means that the Department does not prescribe specific measures that must be taken by all facilities; instead, the manner in which a facility chooses to address its security 

vulnerabilities, although subject to approval by the Secretary, is 

developed by the facility owner.8

For example, facilities need to secure some chemicals from theft 

or diversion. They can do this through various inventory controls 

or physical measures (for example walls or locked doors). It is 

worth noting that facilities that receive an initial high-risk determination can resubmit their information and ‘‘tier out’’—remove 

themselves from further regulation—if they adjust their operations 

in a way that removes them from the high-risk category. According 

to DHS officials, to date over 3,000 facilities possessing chemicals 

of interest have ‘‘voluntarily removed, reduced, or modified their 

holdings of chemicals of interest.’’ 9

Under current procedures, following assignment of a final risk 

tier by the Department, but prior to approving a facility, DHS conducts an authorization inspection of the facility. An authorization 

inspection consists of an initial, physical review of the facility to 

determine if the Top-Screen, security vulnerability assessment, and 

facility security plan accurately represent and address the risks for 

the facility. Because the program requires performance-based 

standards to mitigate risk, facilities and the Department frequently 

discuss planned or alternative mitigation measures before a plan is 

approved. While this helps ensure facilities use both effective and 

cost-effective measures, it can and frequently has delayed progress 

within the program. Once the Department approves the covered facility’s security plan, the facility may begin implementing the plan. 

The Department maintains the authority to conduct subsequent 

compliance inspections to ensure facilities continue to meet the requirements of the security plan and the program. 

The implementation of the CFATS program has improved security of chemical facilities and the safety and security of communities located near the chemical facilities by throwing a spotlight 

on security, though the Committee acknowledges management 

challenges in the program have limited its effectiveness. Under the 

program, chemical facilities have systematically assessed security 

risks and invested in measures to mitigate those risks. This has led 

many companies to take measures to reduce risk in order to ‘‘tier 

out’’ of the program. Again, since the program’s inception, 3,000 facilities have reduced risk at their facilities enough to ‘‘tier out’’ of 

the program, either by reducing, eliminating, or modifying their 

stores of chemicals.10 The fact that 3,000 facilities have tiered out 


emcdonald on DSK67QTVN1PROD with HEARING
5 

Cong. 2 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 11See Department of Homeland Security, CFATS Update August 2014 at http://www.dhs.gov/ 

sites/default/files/publications/CFATS%20FS_August2014.pdf. 12 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. 1 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 13 E.g., Sen. Tom Coburn, Ranking Member, Homeland Security & Government Affairs Committee, Chemical Insecurity: An Assessment of Efforts to Secure the Nation’s Chemical Facilities 

from Terrorist Threats (2014), at http://www.coburn.senate.gov/public/index.cfm/2014/7/federalchemical-security-program-in-shambles-new-report-says. 14See Government Accountability Office (GAO), DHS is Taking Action to Better Manage Its 

Chemical Security Program, but It Is Too Early to Assess Results, (GAO–12–515T), July 26, 

2012, at 9. 15See Department of Homeland Security Office of the Inspector General (DHS OIG), Effectiveness of the Infrastructure Security Compliance Division’s Management Practices to Implement 

the Chemical Facility Anti-Terrorism Standards Program, (Report Number OIG–13–55), March 

2013 at 17, 19–20, and 22; and Government Accountability Office (GAO), Critical Infrastructure 

Protection: DHS Efforts to Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO–13–353), April 2013 at 18. 16 Id at 9–15. 17Memorandum from Penny Anderson, Director, Infrastructure Security Compliance Division, 

Office of lnfrastructure Protection and David WuIf, Deputy Director to NPPD Undersecretary, 

Rand Beers: ‘‘Challenges Facing ISCD, and the Path Forward.’’ November 10, 2011. 18See Government Accountability Office (GAO), Critical Infrastructure Protection: DHS Efforts 

to Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO–13–353), April 2013 at 4. 

is significant given that only 4,000 facilities are assigned to a risk 

tier under the program.11 Other chemical facilities have begun to 

install security measures as part of or in anticipation of security 

reviews by DHS under the program. The CFATS requirements 

work to level the playing field to allow companies to invest in security measures without facing a competitive disadvantage. Just as 

importantly, through the program the government has received information to allow it to for the first time develop a roadmap of the 

facilities in communities nationwide that pose security risks and 

warrant attention. DHS officials have testified that ‘‘interagency 

partners have benefited from this information as it has enhanced 

law enforcement cooperation with high-risk chemical facilities.’’ 12

Yet the program has not been without its shortcomings. It has 

suffered for lack of a long-term authorization that would allow administrators to engage in meaningful and efficient programmatic 

planning, and require industry to invest in security measures. 

Just as importantly, internal and external reviews have revealed 

problems with the design, implementation, and administration of 

the CFATS program.13 These include human capital issues,14 a 

considerable backlog of facility security plan reviews and compliance inspections,15 and a flawed risk assessment methodology.16 In 

2011, an internal management memorandum detailed significant 

mismanagement in the program, including buying unneeded equipment and vehicles and hiring ill-qualified workers. The memo also 

raised serious questions about whether facilities were being tiered 

correctly.17 An April 2013 GAO report looked at DHS’s implementation of the program from roughly 2011 to 2013.18 The report 

raised several concerns with the program, most importantly that 

there was a need for DHS to improve its process of assessing the 

risk posed by a facility by including economic consequence among 

the risk factors, and that DHS was behind in reviewing site security plans and inspecting facilities to verify compliance. Following 

an explosion at a facility in West, Texas in 2013 that never complied with its obligation to submit a Top-Screen despite having two 


emcdonald on DSK67QTVN1PROD with HEARING
6 

19 Id. 20The legislation referred to in the body of this section is the Carper-Coburn substitute 

amendment to H.R. 4007 as reported by the Committee. The main differences between H.R. 

4007 as reported by this Committee and the legislation by the same name passed in the House 

include strengthened whistleblower protections, the establishment of an expedited approval program, changes to the Personnel Surety Program, and a four-year authorization. For a full description of the underlying bill, see H.R., Rep. No. 113–491, Pt. 1 (2014). 

chemicals of interest on site over the regulatory thresholds, GAO 

also recommended that DHS focus on finding and subjecting to regulation other facilities that had thus far ignored the mandate to report their existence to DHS.19

Since the 2011 memo, DHS’s Infrastructure Security Compliance 

Division (ISCD), which manages the CFATS program, has taken 

steps to address some of these concerns. Among other things, DHS 

officials improved policies and training to ensure that inspections 

are conducted in a consistent and thorough fashion; implemented 

an improved, streamlined Site Security Plan (SSP) review process, 

which has enhanced ISCD’s ability to authorize and, as appropriate, approve security plans; and conducted an extensive threepart review of CFATS’s risk assessment methodology, including a 

peer review, which is now being partially implemented. 

This legislation is designed to address the challenges that have 

been identified, codify the improvements DHS has already begun 

making, and authorize additional steps DHS should take to make 

the program more effective. 

HIGHLIGHTS OF H.R. 4007, AS AMENDED BY THE COMMITTEE

H.R. 4007, as amended by the Committee’s substitute amendment, reauthorizes the Department’s CFATS program for a period 

of four years, providing much-needed programmatic stability and 

certainty for both the Department and regulated facilities. It 

achieves this by codifying reforms, strengthening management 

practices and whistleblower protections, simplifying facility reporting and information sharing practices, and authorizing a new expedited approval program for lower high-risk facilities to help reduce 

the backlog of unapproved facility security plans. Specifically, the 

substitute amendment to H.R. 4007 20 would: 

1. Authorize the program for a period of four years (the Housereported version of H.R. 4007 authorized the program for three 

years). 

2. Permit the submission of simplified facility security plans 

through an alternative security program to facilitate compliance for 

small businesses and reduce the backlog of plan approvals at the 

Department. 

3. Create an expedited approval program to enable facilities in 

the third and fourth risk tiers to implement security plans more 

quickly, without compromising the Department’s ability to ensure 

they meet the program’s security standards. 

4. Streamline the requirement for facilities to seek background 

checks on those with access to the facilities by allowing facilities 

to meet the requirement in more than just one way. 

5. Direct the Secretary to develop an implementation plan for 

outreach to chemical facilities with regulated amounts of chemicals 

of interest that have not submitted the required Top-Screen, in 

order to reduce the number of facilities not compliant with CFATS. 


emcdonald on DSK67QTVN1PROD with HEARING
7 

21See Pub. L. 109–295, title V, § 550, Oct. 4, 2006, 120 Stat. 1388, as amended by Pub. L. 

110–161, div. E, title V, § 534, Dec. 26, 2007, 121 Stat. 2075; Pub. L. 111–83, title V, § 550, Oct. 

28, 2009, 123 Stat. 2177; Pub. L. 112–10, div. B, title VI, § 1650, Apr. 15, 2011, 125 Stat. 146; 

Pub. L. 112–74, div. D, title V, § 540, Dec. 23, 2011, 125 Stat. 976; Pub. L. 113–6, div. D, title 

V, § 537, Mar. 26, 2013, 127 Stat. 373; and Pub. L. 113–76, div. F, title V, § 536, Jan. 17, 2014, 

128 Stat. 275. 22 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. 1 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 23 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. (May 14, 2014) (Testimony of Timothy J. Scott on behalf of Dow Chemical Company and 

the American Chemistry Council). 24 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. (May 14, 2014) (Testimony of David Wulf, Director, National Protection and Programs Directorate, Department of Homeland Security). 25 Id. 

6. Appropriately strengthen whistleblower protections by requiring the Secretary to establish a reporting process and prohibiting 

retaliation against whistleblowers. 

7. Ensure that sensitive security information provided by chemical facilities is protected and shared with first responders in a secure and responsible manner. 

8. Ensure DHS is regularly reviewing and updating its risk assessment model. 

9. Require DHS to provide Congress key metrics for better oversight of program performance. 

Four-year authorization 

The Committee substitute to H.R. 4007 will provide stability and 

predictability for both DHS and regulated facilities by providing a 

longer-term authorization than the CFATS program has had before 

now. Up until now, Congress has authorized the program via language in Appropriations bills, limping from year to year and sometimes month to month.21 The four-year authorization will provide 

industry stakeholders with the certainty they need to invest in 

CFATS compliance measures.22 At the Committee hearing in May, 

a witness representing Dow Chemical noted that: 

Three years is the minimum to really match up with the 

capital planning process for industry. If you tell me today 

I have got to go do something, I will get the money next 

year and probably finish the project the year after that 

. . . Three is good, four is better.23

Likewise, representatives from the Department of Homeland Security have noted that long-term Congressional authorization is 

needed in order to cement the Department’s enforcement authorities and eliminate confusion regarding authority for the program. 

For example, during the government shutdown in October 2013, Infrastructure Security Compliance Division staff were furloughed 

and the CFATS program effectively ceased to exist because the Department’s authority to manage the program also expired.24 DHS 

officials have noted the importance of a long-term authorization in 

order to convey clearly the intent of Congress, and the Department, 

to maintain a robust chemical facility security program—an intent 

that the series of short-term extensions simply could not convey.25

The Committee believes that a four-year authorization allows the 

greatest programmatic stability, affording the Department the abilVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00009 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
8 

26 Id. 27See Department of Homeland Security, CFATS Update August 2014 at http://www.dhs.gov/ 

sites/default/files/publications/CFATS%20FS_August2014.pdf. 28See Government Accountability Office (GAO), Critical Infrastructure Protection: DHS Efforts 

to Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO–13–353), April 2013 at 18. 29 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. (May 14, 2014) (Testimony of David Wulf, Director, National Protection and Programs Directorate, Department of Homeland Security). 30 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. 3 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 31 Ibid. 32See Department of Homeland Security, CFATS Fact Sheet, September 2014, http:// 

www.dhs.gov/sites/default/files/publications/CFATS-FS-September-2014-508.pdf. 

ity to hire qualified personnel, while requiring chemical facilities to 

invest in required security measures. 

Director David Wulf, of the Infrastructure Security Compliance 

Division of the Department, testified that a longer-term or permanent authorization would enable the Department to recruit and retain talent, while continuing efforts to improve the CFATS program.26

Finally, a long-term Congressional authorization, coupled with 

the additional reporting requirements in this Act, would allow 

needed Congressional oversight of the program. 

Alternative security programs and creation of an expedited approval 

program 

The legislation also creates two new, alternative options for review that will help the Department address the backlog of unapproved site security plans. The CFATS program has received over 

48,000 Top-Screens and has made progress in program goals, including assigning tiers to covered chemical facilities and assisting 

covered facilities in compliance and improving security. Some 3,000 

facilities have also reduced their holdings of chemicals of interest 

such that they are no longer covered by CFATS.27 Nevertheless, 

the program still faces a significant backlog of site security plan 

authorizations and compliance inspections. In its April 2013 report 

on CFATS, the Government Accountability Office estimated that it 

could take seven to nine years for the program to eliminate the 

backlog of reviewing facilities’ site security plans and conducting 

compliance inspections.28 At a May 2014 hearing, DHS officials testified that they had devoted more resources and attention to the 

issues creating the backlog, had already begun speeding up reviews, and believed they could get through the backlog in half the 

time GAO initially assessed.29 However, even accounting for that 

progress, sixty-one percent of the approximately 4,100 facilities covered under the CFATS program at that time 30 were awaiting authorization of the site security plans they submitted to DHS; ninety-nine percent had yet to undergo a compliance inspection.31

While the Committee believes that the Department has made 

considerable progress recently in speeding up its review of site security plans and conducting compliance inspections, it believes it 

crucial to expedite these reviews further so that needed security 

measures are put in place as soon as possible.32 These facilities 

and the threats they face can be complex and securing them in a 

manner that meets the mandated performance standards can be 


emcdonald on DSK67QTVN1PROD with HEARING
9 

time and capital intensive. Companies do not want to move ahead 

with changes until they are certain they know what is required. 

Thus the backlog in reviewing applications inhibits facilities from 

implementing the investments they want to make to improve security at their sites, which makes the communities that surround 

them less secure. 

In response to this problem, the Committee substitute to H.R. 

4007 authorizes two new, optional tracks for covered facilities to 

use in submitting security plans. The first, the alternative security 

program, allows facilities to implement security plans developed by 

industry associations and approved by DHS. The legislation creating the original authority for CFATS allowed the Department to 

approve Alternative Security Plans (ASPs) that had been ‘‘established by private sector entities.’’ But in 2007 the Department 

issued an Interim Final Rule that required that ASPs be approved 

individually. This change subverted Congressional intent and 

largely eliminated any efficiency the program would have created. 

The Committee substitute to H.R. 4007 would restore the program 

to its original intent, following the model set by the U.S. Coast 

Guard’s Maritime Transportation Security Act (MTSA) program. 

That program allows approval of ASPs for types of vessels or facilities carrying certain dangerous chemicals. 

Second, it also creates a voluntary expedited approval program 

to facilitate compliance for lower-risk companies. Under that program, which the Committee developed in consultation with the Department and key stakeholders, DHS would have the authority to 

set prescriptive, rather than performance-based, standards for site 

security for facilities assigned to tiers three and four. Facilities 

electing to participate in the program would forego the need for an 

authorization inspection, but could still be subject to compliance inspections. 

The Committee believes that the expedited approval program 

will lessen the potentially disproportionate regulatory burden that 

current CFATS regulations impose on smaller chemical companies, 

which may lack the compliance infrastructure and resources of 

large chemical facilities. It does this by requiring that the Department establish clear, prescriptive guidelines these facilities certify 

they will meet and to which they will continue to adhere. This obviates the need for an extensive submission and review process of a 

facility security plan, frees DHS resources to focus on the highest 

risk facilities, and allows facilities to implement security measures 

more quickly. The program still maintains strong Departmental 

oversight to ensure facilities are indeed secure. Under the expedited approval program, the Department may reject site security 

plans that are ‘‘facially deficient’’ or obviously insufficient under 

the guidelines established by the program. Under the program, the 

Department also retains the right to conduct compliance inspections in order to determine whether facilities have implemented the 

security measures outlined in their plans. 

The voluntary expedited approval program created under the bill 

would require additional work by the Department at the outset, 

while it develops prescriptive security measures and security plan 

templates. However, it should result in a notable reduction in the 

administrative burden on both facilities and the Department, and 


emcdonald on DSK67QTVN1PROD with HEARING
10 

33 6 C.F.R. Part 27. 34 RBPS–12 provision (iv). 35 79 F.R. 6417. 36While the legislation still includes requirements for vetting personnel at covered chemical 

facilities against the terrorist screening database, the Committee has included a clear definition 

for the terrorist screening database to help address any concerns or confusion that the term 

could be interpreted to include new, additional, or different databases. The legislation clarifies 

that the term terrorist screening database refers to the current database maintained by the Terrorist Screening Center. 37Department of Homeland Security. Transportation Security Administration, Transportation 

Worker Identification Credential. August 2014 at http://www.tsa.gov/stakeholders/ 

transportation-worker-identification-credential-twic%C2%AE. 38 79 F.R. 6417. 

help reduce the backlog of site security plan reviews of lower-risk 

facilities. 

Personnel Surety Program 

Consistent with the House bill, the Committee substitute to H.R. 

4007 establishes a functional and efficient Personnel Surety Program (PSP). As part of regulations promulgated under the CFATS 

program 33 the Department established eighteen ‘‘risk-based performance standards’’ (RBPSs) that covered chemical facilities are 

required to address. There has long been disagreement between 

regulated industry stakeholders and the Department as to how facilities can satisfy RBPS–12, which requires covered chemical facilities to take steps to determine whether persons with access to 

their facility may have terrorist ties.34

Specifically at issue has been the RBPS–12 provision (iv), which 

requires facilities to establish ‘‘measures designed to identify persons with terrorist ties.’’ DHS has issued an interim rule that 

would establish a Personnel Surety Program (PSP) that would require facilities (or other entities acting on a facility’s behalf) to submit information on individuals with access to a covered chemical 

facility through a DHS created and managed web portal at least 48 

hours prior to such a person’s initial access to the facility.35 The 

Department stated that this would allow facilities to submit information regarding covered individuals for DHS to check whether 

those individuals are on the FBI Terrorist Screening Database 

(TSDB).36 The concern raised by regulated entities with regards to 

the Department’s proposal centers on the fact that a number of 

other security screening programs of the Federal Government, including the Transportation Security Administration’s Transportation Worker Identification Credential (TWIC),37 already check individuals against the TSDB. However, the Department stated in its 

proposal that it would not accept the TWIC or other, similar credentials in lieu of a submission through the DHS PSP website as 

described above, unless the credential could be electronically 

verified. Since many individuals who access chemical facilities are 

already required to maintain a TWIC or other credential, regulated 

stakeholders argue that DHS’s requirement is unnecessary and duplicative. For its part, the Department argues that repeat vetting 

directly before accessing a facility is necessary to truly determine 

if the individual may pose a threat. 

The standards chemical facilities are required to meet under 

CFATS are by definition performance based, and not meant to be 

prescriptive.38 Industry partners argue that DHS’s proposed PSP 

rule is far more prescriptive than what is necessary to meet the reVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00012 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
11 

quirements of RBPS–12. Finally, the Committee believes the Department should avoid costly duplication of programs. 

To that end, the Committee believes that DHS should leverage 

existing infrastructure within DHS and industry to verify and validate identity, check criminal history, verify and validate legal authorization to work, and identify individuals with terrorist ties by 

utilizing a Federal vetting program. Additionally, given the intent 

of the CFATS program to be a flexible program based on performance, the Committee wants to ensure that facilities have a full 

cadre of tools at their disposal to meet the Risk-Based Performance 

Standards. 

The legislation also clarifies Congressional intent related to the 

CFATS program by stating that a facility may satisfy its obligation 

under RBPS–12(iv) by relying upon presentation and visual validation of any credential issued by a Federal screening program that 

periodically vets individuals against the TSDB. The intent of this 

provision is to ensure that the Department cannot compel a covered chemical facility that has already vetted an individual against 

an alternate Federal screening program to then also submit information about that individual directly to the Department, unless 

that person has been identified positively against the Terrorist 

Screening Database. 

Finally, the Personnel Surety Program outlined in this legislation requires DHS to provide feedback to a participating owner or 

operator of a covered chemical facility about an individual based on 

vetting the individual against the TSDB, to the extent that such 

feedback is necessary for the facility’s compliance with CFATS regulations. Under DHS’s proposal, DHS may refuse to tell facility 

owners and operators when an individual with access has come up 

as a TSDB match. DHS argues that it wants to avoid interfering 

with ongoing law enforcement or intelligence operations that might 

involve the individual in question. But, as regulated industry partners point out, the security of a facility is jeopardized when an 

owner or operator unknowingly allows access to a suspected terrorist, creating security and liability, concerns. H.R. 4007 attempts 

to strike a balance between these two concerns by limiting notification to a facility regarding an individual matching the TSDB only 

if that individual presents a threat to the facility’s physical security 

in such a way as to undermine the facility’s efforts to comply with 

the CFATS regulations. 

Outreach to covered chemical facilities 

This legislation improves DHS’s ability to address the issue of 

‘‘outlier facilities’’ and to identify the universe of chemical facilities 

which should be subject to requirements under CFATS. Outlier facilities are facilities that do not let DHS know of their existence 

much less take steps to comply with the CFATS program despite 

the fact that they possess enough chemicals of interest to trigger 

regulation under the program. 

Perhaps the most notable example of such a facility was the 

West Fertilizer Company located in West, Texas. That company’s 

facility caught fire and then exploded on April 17, 2013, killing fifteen people, injuring hundreds more, and causing an estimated 

$100 million in damage. Initial reports indicated a large amount of 

anhydrous ammonia as the source of the explosions; later, authoriVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00013 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
12 

39See U.S. Chemical Safety Board (CSB), Preliminary Findings of the U.S. Chemical Safety 

Board from its Investigation of the West Fertilizer Explosion and Fire, April 22, 2014 at http:// 

www.csb.gov/assets/1/19/West_Preliminary_Findings.pdf. 40 6 CFR Part 27. 41Letter from Suzanne Spaulding, Acting Under Secretary, National Protection and Programs 

Directorate, Department of Homeland Security, Hon. Thomas R. Carper, Chairman, Senate 

Committee on Homeland Security and Governmental Affairs, dated July 31, 2013. 42 Id. 43 EO 13650. 44 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. 5 (May 14, 2014) (Written testimony of Suzanne Spaulding, Under Secretary, and Director 

David Wulf, National Protection and Programs Directorate, Department of Homeland Security). 45The Committee substitute would allow the Secretary 18 months to produce such a plan, 

rather than the 90 days specified in the House bill. 

ties determined that the explosions were caused by ammonium nitrate that was stored at the facility.39 Both anhydrous ammonia 

and ammonium nitrate are designated by DHS as ‘‘chemicals of interest,’’ and possession of either above certain threshold amounts 

is subject to regulation under the CFATS program.40 Through an 

investigation following the disaster at West Fertilizer, the Department determined that the facility had not complied with the requirement of the CFATS program to submit a Top-Screen to 

DHS.41 As a result, until the explosion occurred program officials 

were unaware the facility existed. The EPA’s Risk Management 

Program (RMP), however, did have a record of this facility. 

Prior to the West Fertilizer Company disaster, DHS was taking 

some actions to identify outlier facilities. DHS relied on information sharing among state homeland security agencies, components 

within the Department, and stakeholders, the maintenance of a 

toll-free CFATS Tip Line, and a limited, regional pilot program allowing CFATS inspectors to review a database maintained by the 

Environmental Protection Agency. However, as the Department acknowledged, these efforts yielded relatively few identifications of 

outlier facilities.42 In August 2013, after the West disaster, the 

President issued an executive order addressing this issue, calling 

for a working group to improve federal, state, and local coordination to identify facilities subject to CFATS requirements.43 And at 

a Committee hearing in May, Department officials emphasized the 

critical need for continued and improved outreach in order to identify chemical facilities potentially subject to CFATS requirements.44

The Committee substitute to H.R. 4007 establishes and defines 

the term ‘‘chemical facilities of interest’’ to mean facilities that 

hold, or that the Secretary has a reasonable basis to believe hold, 

chemicals of interest in excess of the threshold quantities set under 

the existing CFATS standards. It requires the Secretary to consult 

with other government agencies, including state and local governments, business associations, and labor organizations to identify 

such facilities, to report to Congress regarding the steps the Department has taken to identify chemical facilities of interest and its 

progress toward achieving that goal, and to submit an action plan 

for better identifying and enforcing compliance among chemical facilities of interest to Congress.45

Whistleblower protections 

The Committee substitute to H.R. 4007 requires the Department 

to establish procedures to allow workers or contractors to report to 


emcdonald on DSK67QTVN1PROD with HEARING
13 

46 ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program,’’ 

hearing before the Senate Committee on Homeland Security and Governmental Affairs, 113th 

Cong. (May 14, 2014) (Testimony of Anna Fendley on behalf of the United Steelworkers). 47 In contrast, H.R. 4007 as passed by the House would require the Secretary to use the 

Homeland Security Information Network (HSIN) or the Homeland Secure Data Network 

(HSDN) to distribute such information. Though the HSDN reaches a more limited audience and 

is used only to share classified information, HSIN is a public-facing web portal that allows for 

the sharing of sensitive but not classified information to federal, state, local, tribal, territorial, 

international, and private sector partners. 48The Committee does not intend this provision to affect one way or the other the ability of 

anyone to access any information about a chemical facility, either from the company itself, or 

from the government, as provided for under any other law or program. 

the Secretary regarding potential problems or vulnerabilities at a 

covered chemical facility. Further, it protects those individuals who 

report problems from termination or other forms of retaliation, 

though it provides no protections for individuals who are found to 

have lied or misled authorities. The Committee believes that workers can play an important role in chemical security. Few individuals know and understand the particular vulnerabilities of a facility more than those who work there every day. As Anna Fendley 

from the United Steelworkers testified at the Committee’s hearing 

in May 2014, ‘‘[Workers] would be hurt first and worst in an attack 

on a facility, and therefore have the largest stake in ensuring safety.’’ 46 The Committee believes that protecting whistleblowers could 

potentially help DHS identify chemical facilities that are covered 

by CFATS but are not complying with its requirements. Furthermore, the Committee believes it is important to protect whistleblowers from retaliation. 

Information sharing with first responders 

The Committee substitute to H.R. 4007 would allow the Secretary to disseminate information collected from covered chemical 

facilities, including security vulnerability assessments, site security 

plans, and other information, to first responders through any medium or system the Secretary determines appropriate.47 The Committee’s change reflects its intent that this potentially sensitive information be shared in a secure and effective manner only with 

those individuals who possess a need to know, and our belief that 

mandating that information be shared via HSIN and HSDN could 

include too broad an audience. The Committee believes the Secretary, examining the sensitivity of the information and the relative needs of recipients, is in the best position to make a determination. Based on similar reasoning, the legislation exempts information gathered from chemical facilities under the authority 

granted in the bill from requests under the Freedom of Information 

Act. The Committee intends this blanket exemption to preclude the 

possibility that members of the public without a need to know, including potentially bad actors, seeking to access this information 

might receive it from the Federal Government through a FOIA request.48

Improved risk assessment methodology 

Finally, this legislation ensures that the Department fixes its 

historically flawed risk assessment and tiering methodology by requiring DHS to consider all areas of risk in developing risk assessments in order to more accurately reflect the core criteria of risk: 

threat, consequence (including both economic consequences and faVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00015 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
14 

49See Government Accountability Office (GAO), Critical Infrastructure Protection: DHS Efforts 

to Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO–13–353), April 2013 at 9–15. 50See Homeland Security Studies and Analysis Institute’s Tiering Methodology Peer Review, 

Publication Number: RP12–22–02. 

talities), and vulnerability. The Committee wants to ensure that all 

aspects of risk are being considered when determining whether a 

facility presents a high enough risk to be regulated under the 

CFATS program and into what tier a facility may be placed. It further instructs the Secretary to maintain a record of any changes 

to a facility’s tiering status and why the change was made. In its 

April 2013 report, GAO recommended that DHS should enhance its 

risk assessment approach to incorporate all elements of risk, and 

conduct an independent peer review to ensure the approach is effective.49 That peer review, conducted by the Homeland Security 

Studies and Analysis Institute, was published in September, 2013 

and laid out a number of recommendations for improvement.50 This 

legislation would require the Department to develop a risk assessment approach and tiering methodology based on that review and 

require the Secretary to report to Congress on the Infrastructure 

Security Compliance Division’s progress in doing so within 18 

months of the bill’s enactment. 

III. LEGISLATIVE HISTORY

H.R. 4007, the Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of 2014, was introduced by Representative 

Meehan on February 6, 2014. The House passed the bill on July 

8, 2014, on a motion to suspend the rules and pass the bill, as 

amended, by voice vote. The bill was received in the Senate on July 

9, 2014, and referred to the Homeland Security and Governmental 

Affairs Committee. 

Prior to the bill’s referral, the Committee held a hearing on May 

14, 2014, titled ‘‘Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program.’’ The purpose of the hearing was to examine the current state of the CFATS program and 

the need to reauthorize the program. Witnesses included two senior 

DHS officials responsible for managing the program, representatives from the Government Accountability Office and Congressional 

Research Service, an industry representative, and a labor representative. 

The Committee considered H.R. 4007 at a business meeting on 

July 30, 2014. Senators Carper and Coburn offered a substitute 

amendment that made a number of changes to the bill as passed 

by the House. The substitute added provisions permitting the submission of simplified security plans through the alternative security program; establishing an expedited approval program to allow 

lower high-risk facilities to more quickly implement security plans; 

requiring DHS to review and update its risk assessment model and 

report key metrics to Congress so that Congress can better perform 

oversight of the CFATS program; requiring sensitive security information to be protected and shared with first responders; and requiring the Secretary to: collect and report on program best practices in order to assist smaller facilities in complying with the program, develop an implementation plan for outreach to chemical facilities of interest; establish a program-specific reporting process for 


emcdonald on DSK67QTVN1PROD with HEARING
15 

51 Note that the House version was titled, ‘‘The Chemical Facility Anti-Terrorism Standards 

Program Authorization and Accountability Act of 2014.’’ 

whistleblowers, and work with industry and labor organizations to 

improve information sharing. 

The committee adopted the Carper-Coburn substitute, as modified, and ordered the bill, as amended, reported favorably, both by 

voice vote. Senators present for both votes were Senators Carper, 

Levin, Landrieu, McCaskill, Begich, Baldwin, Coburn, Johnson, 

and Ayotte. Senator Baldwin requested to be recorded as voting 

‘‘no’’ on the bill. 

IV. SECTION-BY-SECTION ANALYSIS OF THE BILL, AS REPORTED

Section 1—Short title 

This section establishes the title of the legislation as the ‘‘The 

Protecting and Securing Chemical Facilities from Terrorist Attacks 

Act of 2014.’’ 51

Section 2—Chemical Facility Anti-Terrorism Standards Program 

This section amends the Homeland Security Act of 2002 (6 

U.S.C. 101 et seq.), adding at the end a new title, Title XXI— 

Chemical Facility Anti-Terrorism Standards. 

New section 2101 of the Homeland Security Act of 2002—Definitions 

This section defines key terms used in the bill, including ‘‘CFATS 

regulation,’’ and specifies which types of facilities are considered to 

be ‘‘covered chemical facilities,’’ which facilities are exempted, and 

which types of facilities are considered to be ‘‘chemical facilities of 

interest.’’ 

This section defines ‘‘chemical facility of interest’’ as a facility 

that the Secretary has reason to believe holds threshold quantities 

of chemicals of interest. 

It defines ‘‘covered chemical facility’’ as a facility that the Secretary identifies as a chemical facility of interest, which is a highrisk facility, as determined by the Department’s risk assessment 

methodology. 

It defines ‘‘excluded facility’’ to mean a facility regulated under 

the U.S. Coast Guard’s Maritime Transportation Security Act 

(MTSA) protocol or the Safe Drinking Water Act, a wastewater 

treatment works regulated under the Federal Water Pollution Control Act, a facility owned or operated by the Department of Defense 

or the Department of Energy, or a facility regulated by the Nuclear 

Regulatory Commission or by a state that has entered into an 

agreement with the Nuclear Regulatory Commission. 

It defines ‘‘expedited approval facility’’ as a covered chemical facility for which the owner or operator elects to submit a site security plan for expedited approval under a new program authorized 

in the legislation. 

It defines a ‘‘facially deficient’’ security plan as a security plan 

that does not support a certification that the security measures in 

the plan address the security vulnerability assessment and riskbased performance standards. 


emcdonald on DSK67QTVN1PROD with HEARING
16 

New section 2102 of the Homeland Security Act of 2002—Chemical 

Facility Anti-Terrorism Standards Program 

Subsection (a) requires DHS to establish risk-based performance 

standards to ensure the security of chemical facilities. It charges 

the Secretary of Homeland Security (‘‘the Secretary’’) with identifying chemical facilities of interest and covered chemical facilities. 

It authorizes the Secretary to require chemical facilities of interest 

to submit a Top-Screen. The subsection authorizes the Secretary to 

require covered facilities to submit to the Department of Homeland 

Security (‘‘DHS’’) security vulnerability assessments, and to develop, submit, and implement site security plans. (This language 

largely mirrors the original CFATS authorizing statute, PL 109– 

295, the Department of Homeland Security Appropriations Act of 

2007, Sec. 550, hereinafter referred to as ‘‘Sec. 550’’). 

Subsection (b), Security Measures, describes the requirements of 

a site security plan, stating they should include security measures 

that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for 

securing the facility. 

Subsection (c), Approval or Disapproval of Site Security Plans, 

outlines the process for DHS’s review of site security plans and improves the efficiency of the site security plan approval process by 

allowing facilities to use an alternative security program. This subsection charges the Secretary with evaluating and approving site 

security plans described under subsection (a), and specifies that the 

Secretary may not require the presence or absence of particular 

measures. 

This subsection further authorizes the Secretary to approve alternative security programs created by outside entities, such as the 

American Chemistry Council, if those programs satisfy all the requirements of the Risk-Based Performance Standards. If the requirements of the alternative security program do not fully meet 

the requirements of the subsection, the Secretary may recommend 

additional security measures to allow the program to be approved. 

Further, the subsection allows the Secretary to accept an alreadyapproved alternative security program without reevaluating the 

program. 

This subsection further obligates the Secretary to employ the risk 

assessment procedures established under this title, and establishes 

a ‘‘grandfather clause’’ providing that, if the legislation is enacted, 

a site security plan already approved by the Secretary prior to the 

date of enactment of this Act need not be reevaluated solely because of enactment of this Act. 

This subsection also creates a new expedited approval program 

through which tier 3 and 4 facilities may develop and submit a site 

security plan for expedited approval. It requires that the Secretary 

first issue prescriptive guidance for such facilities to meet the riskbased performance standards, and outlines how facilities may certify that deviations from the guidance meet or exceed the prescriptive standards. The subsection requires the Secretary to consult 

with labor organizations and Sector Coordinating Councils to develop this guidance. The subsection establishes deadlines for facilities to submit and certify plans for expedited approval and for the 

Department to review certified plans, provides authority for the 

Secretary to enforce compliance under this program, and provides 


emcdonald on DSK67QTVN1PROD with HEARING
17 

a process by which facilities can amend site security plans. It allows the Secretary to suspend and ultimately revoke a facility’s 

ability to participate in the voluntary expedited approval program 

if it submits a facially deficient site security plan, and to recommend additional security measures if it suspends a facility’s certification. The subsection also allows DHS to develop prescriptive 

security plan templates that meet the risk-based performance 

standards and tier 3 and 4 facilities can submit as their site security plans. Finally, the subsection requires that the Secretary fully 

evaluate the expedited approval program within 18 months of enactment of the Act. 

Subsection (d), Compliance, requires the Secretary to conduct audits or inspections of covered chemical facilities, and would allow 

nongovernmental personnel to conduct audits or inspections on behalf of the Department in order to address the existing backlog. 

This section also requires the Secretary to establish a Personnel 

Surety Program that ensures individuals with access to covered 

chemical facilities are vetted against the Terrorist Screening Database, the central terrorist watchlist consolidated by the FBI’s Terrorist Screening Center. 

This subsection defines ‘‘nondepartmental’’ to refer to personnel 

and entities that are neither employed by nor are components or 

other authorities of DHS, and ‘‘nongovernmental’’ to refer to personnel or entities that are neither employed by nor are agencies, 

departments, or other authorities of the Federal Government. This 

subsection would allow the Secretary to make use of nondepartmental and nongovernmental facility inspectors in addition to DHS 

Inspectors, and requires the Secretary to set high standards and 

professional qualifications for both governmental and nongovernmental personnel. This will help to expedite the rate of inspections 

and address the backlog of authorization inspections DHS now 

faces. This subsection also makes clear that any duties carried out 

by a nongovernmental entity should not be inherently governmental functions, and that only the Secretary or the Secretary’s 

designee retains the authority to approve a site security plan. 

This subsection clarifies that a facility may utilize any Federal 

screening program that periodically vets individuals against the 

Terrorist Screening Database in order to comply with the requirement to vet personnel against the terrorist watchlist. This subsection also prohibits DHS from collecting information from covered 

chemical facilities about an individual unless that individual has 

been identified as presenting a terrorist threat, or is being vetted 

under the CFATS program’s Personnel Surety Program (PSP). Finally, this subsection instructs DHS to share any information with 

a facility that the facility needs to comply with this section. The 

Committee added this requirement to address concerns raised by 

industry groups that the Department was not required to share 

with a chemical facility information that an individual identified 

through the Terrorist Screening Database as potentially having 

terrorist ties had accessed the chemical facility. Under the requirement, the Committee intends for the Department to determine 

what information a facility needs in order to comply. 

Subsection (e) outlines the responsibilities of the Secretary. It ensures that DHS is communicating with state and local officials as 

well as other Federal agencies and industry associations to identify 


emcdonald on DSK67QTVN1PROD with HEARING
18 

chemical facilities of interest, and that DHS implements a comprehensive risk assessment and maintains records documenting the 

basis for any facility that experiences a change in risk tiering. 

This subsection instructs DHS to communicate with state and 

local officials, as well as other Federal agencies and industry associations, to identify chemical facilities of interest, which will help 

to ensure that outlier facilities are known to the Department. This 

subsection further ensures that DHS is taking into account all relevant risk information when developing its risk assessment standards and corresponding tiering methodology. It also requires that 

the Secretary document the basis for each change in a covered 

chemical facility’s tier. It also requires the Secretary to provide a 

biannual report to Congress detailing specific metrics on the program’s performance in order to aid Congressional evaluation and 

oversight of the program. 

New section 2103 of the Homeland Security Act of 2002—Protection 

and sharing of information 

This section ensures that sensitive security information is protected, and shared with first responders in a secure, responsible 

manner in order to prevent loss of life and property. It ensures that 

sensitive information regarding a facility, where disclosure could 

present a potential risk, developed under this Act shall not be 

made available for public disclosure. However such information 

may be shared with state and local government officials for purposes of carrying out this Act. This section further ensures that 

first responders are properly prepared and provided situational 

awareness when responding to incidents at CFATS facilities without compromising the security of the information. This section allows the Secretary to disseminate information through any medium 

or system deemed appropriate by the Secretary. It is the Committee’s intent that proprietary and chemical vulnerability information 

shared pursuant to this section continues to be protected against 

disclosure to unauthorized individuals and the public. 

New section 2104 of the Homeland Security Act of 2002—Civil enforcement 

This section specifies penalties for noncompliance and sets the 

parameters of civil liability. 

Subsection (a), Notice of Noncompliance, provides that if a facility is found to be non-compliant the Secretary must first present 

the facility with written notice of non-compliance before the Department may issue fines or penalties. It further specifies that in 

the event of continued non-compliance the Secretary may assess a 

civil penalty, order a facility to cease operations, or both. 

Subsection (b), Civil Penalties, provides that civil penalties may 

be assessed against a person who violates an order under this Act. 

It further provides that any owner of a chemical facility of interest 

who fails to comply with or knowingly submits false information 

under the Act shall be liable for a civil penalty. 

Subsection (c), Emergency Orders, authorizes the Secretary to direct a facility to implement emergency security measures, or cease 

some or all operations if the Secretary determines that there is a 

reasonable likelihood that a violation of the CFATS regulations 


emcdonald on DSK67QTVN1PROD with HEARING
19 

could result in death, serious illness, severe personal injury, or substantial endangerment to the public. 

Subsection (d), Right of Action, clarifies that only the Secretary 

(or his or her designee) may bring an action against the owner or 

operator of a covered chemical facility to enforce any of the Act’s 

provision. 

New section 2105 of the Homeland Security Act of 2002—Whistleblower protections 

This section clarifies whistleblower protections available to chemical facility employees and contractors, and requires these protections be publicly disclosed and advertised. It requires the Secretary 

to establish a reporting procedure for whistleblowers to report 

problems, deficiencies, or vulnerabilities related to chemical security at a covered chemical facility to DHS, and to protect the confidentiality of an individual making a report. It further requires 

the Secretary affirmatively acknowledge receipt of whistleblower 

reports, if possible, and take appropriate steps to address any problems the Department is able to substantiate. 

This section also prohibits retaliatory actions against whistleblowers by owners or operators of a chemical facility. The section 

also clarifies that no employee is entitled to the protection of this 

section if the employee makes false, fictitious, or fraudulent statements or representations, and that disclosures protected by other 

federal or state laws remain in place. 

New section 2106 of the Homeland Security Act of 2002—Relationship to other laws 

This section states that nothing in this Act supersedes Federal 

law governing the manufacture, sale or handling of chemical substances or mixtures. It also clarifies that States and political subdivisions may adopt more stringent requirements with respect to 

chemical facility security, unless there is an actual conflict between 

this section and the law of that State or subdivision. 

New section 2107 of the Homeland Security Act of 2002—CFATS 

regulations 

This section specifies that the Department can continue to follow 

previously-issued regulations, and does not need to undertake a 

new rulemaking. This section also stipulates that the Secretary 

shall rely on the authority provided in Title XXI of the Homeland 

Security Act of 2002 in determining chemicals of interest and relevant security risks, and determining compliance with Title XXI. 

New section 2108 of the Homeland Security Act of 2002—Small covered chemical facilities 

This section defines a ‘‘small covered chemical facility’’ as a facility with 100 employees or fewer. The House bill, in contrast, defines such a facility as one having 350 or fewer employees. The 

Committee believes that its definition more accurately reflects the 

size of chemical facilities likely to require the Departmental compliance assistance mandated under the legislation. The section also 

allows the Secretary to provide assistance and guidance to small 

covered chemical facilities in the development of their physical security, cybersecurity, recordkeeping, and reporting procedures. It 


emcdonald on DSK67QTVN1PROD with HEARING
20 

directs the Secretary to report to the authorizing committees on 

best practices that may assist small chemical facilities in meeting 

their physical security requirements under this title. 

New section 2109 of the Homeland Security Act of 2002—Outreach 

to chemical facilities of interest 

This section directs the Secretary to develop an implementation 

plan for outreach to chemical facilities of interest in order to minimize the number of outliers. 

Section 3—Assessment; reports 

This section requires the Secretary to commission a third-party 

study of vulnerability of covered chemical facilities to acts of terrorism, and requires that the Secretary report to Congress on a 

number of specific aspects of the CFATS program within 18 months 

of enactment of this Act. It also provides for GAO reports assessing 

the implementation of this Act, including a review of the expedited 

approval program not later than three years after enactment of 

this Act. 

Section 4—Effective date; Conforming repeal 

This section states that the Act shall take effect 30 days after the 

date of enactment. The section also repeals the previous authorization language, saying that it is superseded by this Act. 

Section 5—Termination 

This section would sunset the program four years after enactment. 

V. EVALUATION OF REGULATORY IMPACT

Pursuant to the requirement of paragraph 11(b)(1) of rule XXVI 

of the Standing Rules of the Senate the Committee has considered 

the regulatory impact of this bill. The bill as amended would extend an existing regulatory program with a number of changes. As 

indicated in the Congressional Budget Office cost estimate for this 

bill (included below), the bill as amended should not result in significant additional costs beyond the current costs of complying with 

the CFATS program. 

VI. CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

SEPTEMBER 10, 2014. 

Hon. TOM CARPER, 

Chairman, Committee on Homeland Security and Governmental Affairs, U.S. Senate, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 4007, the Protecting and 

Securing Chemical Facilities from Terrorist Attacks Act of 2014. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Jason Wheelock. 

Sincerely, 

DOUGLAS W. ELMENDORF. 

Enclosure. 


emcdonald on DSK67QTVN1PROD with HEARING
21 

H.R. 4007—Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 

H.R. 4007 would extend the Department of Homeland Security’s 

(DHS’s) authority to regulate security at certain chemical facilities 

in the United States. Under the Chemical Facility Anti-Terrorism 

Standards (CFATS) program, DHS collects and reviews information 

from chemical facilities in the United States to determine which facilities present security risks. Facilities determined to present a 

high level of security risk are then required to develop a Site Security Plan (SSP). DHS in turn conducts inspections to validate the 

adequacy of a facility’s SSP and their compliance with it. The program is set to end on October 4, 2014. 

H.R. 4007 would authorize CFATS for an additional four years 

and would create an expedited review procedure for facilities in the 

lower risk tiers of the CFATS program. Based on amounts requested for the CFATS in fiscal year 2015 as well as information 

from DHS, CBO estimates that continued implementation of 

CFATS would require appropriations of $87 million in 2015 and 

slightly higher amounts in fiscal years 2016 through 2018 after accounting for the effects of inflation. Assuming appropriation of the 

estimated amounts, CBO estimates that implementing H.R. 4007 

would result in outlays of $349 million over the 2015–2019 period. 

By fiscal year, in millions of dollars— 

2015 2016 2017 2018 2019 2015– 

2019 

CHANGES IN SPENDING SUBJECT TO APPROPRIATION 

Estimated Authorization Level .......................................... 87 89 92 95 0 363 

Estimated Outlays ............................................................ 45 78 100 103 23 349 

Enacting H.R. 4007 could result in the collection of additional 

civil penalties, which are recorded as revenues and deposited in the 

Treasury; therefore, pay-as-you-go procedures apply. However, 

CBO estimates that such collections would be insignificant. Enacting the bill would not affect direct spending. 

H.R. 4007 would extend intergovernmental and private-sector 

mandates, as defined in the Unfunded Mandates Reform Act 

(UMRA), on owners and operators of public and private facilities 

where certain chemicals are present. Current law requires owners 

and operators to assess the vulnerability of their facilities to a terrorist incident and to prepare and implement facility security 

plans. This bill would extend, for four years, the authority of DHS 

to regulate those facilities through minimum standards designed to 

protect facilities from acts of terrorism and other security risks. 

The requirement to meet those standards would be a mandate on 

public and private entities. 

The bill would impose an additional mandate on public and private employers by prohibiting them from discharging or discriminating against employees who report security problems at a covered chemical facility. 

Information from DHS indicates that owners and operators of 

chemical facilities already meet the existing security standards and 

that they would only need to make small changes to administrative 

procedures to comply with the new whistleblower protections for 

their employees. Therefore, CBO estimates that the aggregate addiVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00023 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
22 

tional costs of complying with the mandates would be small and 

would fall below the annual thresholds established in UMRA for 

intergovernmental and private-sector mandates ($76 million and 

$152 million, respectively, in 2014, adjusted annually for inflation). 

On May 30, 2014, CBO transmitted a cost estimate for H.R. 4007 

as ordered reported by the House Committee on Homeland Security 

on April 30, 2014. The difference in CBO’s estimates reflects differences in the two versions of the bill. The version reported by the 

House Committee on Homeland Security would permanently authorize CFATS and would authorize the appropriation of $87 million for each of fiscal years 2015 through 2017. The Senate version 

of H.R. 4007 would extend CFATS for four years and would not 

specify an authorization level for any fiscal year. Based on those 

differences, CBO estimates that implementing this version of the 

bill would cost approximately $80 million less than the House 

version over the 2015–2019 period, assuming the appropriation of 

the estimated amounts. 

The CBO staff contacts for this estimate are Jason Wheelock (for 

federal costs), Melissa Merrell (for the intergovernmental impact), 

and Paige Piper/Bach (for the private-sector impact). The estimate 

was approved by Theresa Gullo, Deputy Assistant Director for 

Budget Analysis. 

VII. CHANGES IN EXISTING STATUTE MADE BY THE BILL, AS

REPORTED

In compliance with paragraph 12 of rule XXVI of the Standing 

Rules of the Senate, changes in existing law made by H.R. 4007 as 

reported are shown as follows (existing law proposed to be omitted 

is enclosed in brackets, new matter is printed in italic, and existing 

law in which no change is proposed is shown in roman): 

DEPARTMENT OF HOMELAND SECURITY 

APPROPRIATIONS ACT OF 2007 

* * * * * * * 

øSEC. 550. (a) No later than six months after the date of enactment of this Act, the Secretary of Homeland Security shall issue 

interim final regulations establishing risk-based performance 

standards for security of chemical facilities and requiring vulnerability assessments and the development and implementation of 

site security plans for chemical facilities: Provided, That such regulations shall apply to chemical facilities that, in the discretion of 

the Secretary, present high levels of security risk: Provided further, 

That such regulations shall permit each such facility, in developing 

and implementing site security plans, to select layered security 

measures that, in combination, appropriately address the vulnerability assessment and the risk-based performance standards for 

security for the facility: Provided further, That the Secretary may 

not disapprove a site security plan submitted under this section 

based on the presence or absence of a particular security measure, 

but the Secretary may disapprove a site security plan if the plan 

fails to satisfy the risk-based performance standards established by 

this section: Provided further, That the Secretary may approve alternative security programs established by private sector entities, 

Federal, State, or local authorities, or other applicable laws if the 


emcdonald on DSK67QTVN1PROD with HEARING
23 

Secretary determines that the requirements of such programs meet 

the requirements of this section and the interim regulations: Provided further, That the Secretary shall review and approve each 

vulnerability assessment and site security plan required under this 

section: Provided further, That the Secretary shall not apply regulations issued pursuant to this section to facilities regulated pursuant to the Maritime Transportation Security Act of 2002, Public 

Law 107–295, as amended; Public Water Systems, as defined by 

section 1401 of the Safe Drinking Water Act, Public Law 93–523, 

as amended; Treatment Works as defined in section 212 of the Federal Water Pollution Control Act, Public Law 92–500, as amended; 

any facility owned or operated by the Department of Defense or the 

Department of Energy, or any facility subject to regulation by the 

Nuclear Regulatory Commission.¿ 

ø(b) Interim regulations issued under this section shall apply 

until the effective date of interim or final regulations promulgated 

under other laws that establish requirements and standards referred to in subsection (a) and expressly supersede this section: 

Provided, That the authority provided by this section shall terminate three years after the date of enactment of this Act.¿ 

ø(c) Notwithstanding any other provision of law and subsection 

(b), information developed under this section, including vulnerability assessments, site security plans, and other security related 

information, records, and documents shall be given protections 

from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 

70103 of title 46, United States Code: Provided, That this subsection does not prohibit the sharing of such information, as the 

Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law 

enforcement officials and first responders, for the purpose of carrying out this section, provided that such information may not be 

disclosed pursuant to any State or local law: Provided further, That 

in any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or 

obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material.¿ 

ø(d) Any person who violates an order issued under this section 

shall be liable for a civil penalty under section 70119(a) of title 46, 

United States Code: Provided, That nothing in this section confers 

upon any person except the Secretary a right of action against an 

owner or operator of a chemical facility to enforce any provision of 

this section. (e) The Secretary of Homeland Security shall audit 

and inspect chemical facilities for the purposes of determining compliance with the regulations issued pursuant to this section.¿ 

ø(f) Nothing in this section shall be construed to supersede, 

amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures.¿ 

ø(g) If the Secretary determines that a chemical facility is not in 

compliance with this section, the Secretary shall provide the owner 

or operator with written notification (including a clear explanation 

of deficiencies in the vulnerability assessment and site security 

plan) and opportunity for consultation, and issue an order to comVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00025 Fmt 6659 Sfmt 6602 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
24 

ply by such date as the Secretary determines to be appropriate 

under the circumstances: Provided, That if the owner or operator 

continues to be in noncompliance, the Secretary may issue an order 

for the facility to cease operation, until the owner or operator complies with the order.¿ 

ø(h) This section shall not preclude or deny any right of any 

State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to 

chemical facility security that is more stringent than a regulation, 

requirement, or standard of performance issued under this section, 

or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State.¿ 

* * * * * * * 

SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

(a) * * * 

(b) TABLE OF CONTENTS.—The table of contents for this Act is as 

follows: 

* * * * * * * 

TITLE XXI—CHEMICAL FACILITY ANTI-TERRORISM 

STANDARDS 

Sec. 2101. Definitions. 

Sec. 2102. Chemical Facility Anti-Terrorism Standards Program. 

Sec. 2103. Protection and sharing of information. 

Sec. 2104. Civil enforcement. 

Sec. 2105. Whistleblower protections. 

Sec. 2106. Relationship to other laws. 

Sec. 2107. CFATS regulations. 

Sec. 2108. Small covered chemical facilities. 

Sec. 2109. Outreach to chemical facilities of interest. 

* * * * * * * 

TITLE XXI—CHEMICAL FACILITY ANTITERRORISM STANDARDS 

SEC. 2101. DEFINITIONS. 

In this title— 

(1) the term ‘‘CFATS regulation’’ means— 

(A) an existing CFATs regulation; and 

(B) any regulation or amendment to an existing CFATS 

regulation issued pursuant to the authority under section 

2107; 

(2) the term ‘‘chemical facility of interest’’ means a facility 

that— 

(A) holds, or that the Secretary has a reasonable basis to 

believe holds, a chemical of interest, as designated under 

Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto, at a threshold quantity set 

pursuant to relevant risk-related security principles; and 

(B) is not an excluded facility; 

(3) the term ‘‘covered chemical facility’’ means a facility 

that— 

(A) the Secretary— 


emcdonald on DSK67QTVN1PROD with HEARING
25 

(i) identifies as a chemical facility of interest; and 

(ii) based upon review of the facility’s Top-Screen, determines meets the risk criteria developed under section 

2102(e)(2)(B); and 

(B) is not an excluded facility; 

(4) the term ‘‘excluded facility’’ means— 

(A) a facility regulated under the Maritime Transportation Security Act of 2002 (Public Law 107–295; 116 Stat. 

2064); 

(B) a public water system, as that term is defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f); 

(C) a Treatment Works, as that term is defined in section 

212 of the Federal Water Pollution Control Act (33 U.S.C. 

1292); 

(D) a facility owned or operated by the Department of Defense or the Department of Energy; or 

(E) a facility subject to regulation by the Nuclear Regulatory Commission, or by a State that has entered into an 

agreement with the Nuclear Regulatory Commission under 

section 274 b. of the Atomic Energy Act of 1954 (42 U.S.C. 

2021(b)) to protect against unauthorized access of any material, activity, or structure licensed by the Nuclear Regulatory Commission; 

(5) the term ‘‘existing CFATS regulation’’ means— 

(A) a regulation promulgated under section 550 of the 

Department of Homeland Security Appropriations Act, 

2007 (Public Law 109–295; 6 U.S.C. 121 note) that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014; and 

(B) a Federal Register notice or other published guidance 

relating to section 550 of the Department of Homeland Security Appropriations Act, 2007 that is in effect on the day 

before the date of enactment of the Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act of 2014; 

(6) the term ‘‘expedited approval facility’’ means a covered 

chemical facility for which the owner or operator elects to submit a site security plan in accordance with section 2102(c)(4); 

(7) the term ‘‘facially deficient’’, relating to a site security 

plan, means a site security plan that does not support a certification that the security measures in the plan address the security vulnerability assessment and the risk-based performance 

standards for security for the facility, based on a review of— 

(A) the facility’s site security plan; 

(B) the facility’s Top-Screen; 

(C) the facility’s security vulnerability assessment; or 

(D) any other information that— 

(i) the facility submits to the Department; or 

(ii) the Department obtains from a public source or 

other source; 

(8) the term ‘‘guidance for expedited approval facilities’’ 

means the guidance issued under section 2102(c)(4)(B)(i); 

(9) the term ‘‘risk assessment’’ means the Secretary’s application of relevant risk criteria identified in section 2102(e)(2)(B); 


emcdonald on DSK67QTVN1PROD with HEARING
26 

(10) the term ‘‘terrorist screening database’’ means the terrorist screening database maintained by the Federal Government Terrorist Screening Center or its successor; 

(11) the term ‘‘tier’’ has the meaning given the term in section 

27.105 of title 6, Code of Federal Regulations, or any successor 

thereto; 

(12) the terms ‘‘tiering’’ and ‘‘tiering methodology’’ mean the 

procedure by which the Secretary assigns a tier to each covered 

chemical facility based on the risk assessment for that covered 

chemical facility; 

(13) the term ‘‘Top-Screen’’ has the meaning given the term in 

section 27.105 of title 6, Code of Federal Regulations, or any 

successor thereto; and 

(14) the term ‘‘vulnerability assessment’’ means the identification of weaknesses in the security of a chemical facility of interest. 

SEC. 2102. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM. 

(a) PROGRAM ESTABLISHED.— (1) IN GENERAL.—There is in the Department a Chemical Facility Anti-Terrorism Standards Program. 

(2) REQUIREMENTS.—In carrying out the Chemical Facility 

Anti-Terrorism Standards Program, the Secretary shall— 

(A) identify— 

(i) chemical facilities of interest; and 

(ii) covered chemical facilities; 

(B) require each chemical facility of interest to submit a 

Top-Screen and any other information the Secretary determines necessary to enable the Department to assess the security risks associated with the facility; 

(C) establish risk-based performance standards designed 

to address high levels of security risk at covered chemical 

facilities; and 

(D) require each covered chemical facility to— 

(i) submit a security vulnerability assessment; and 

(ii) develop, submit, and implement a site security 

plan. 

(b) SECURITY MEASURES.—A facility, in developing a site security 

plan as required under subsection (a), shall include security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. 

(c) APPROVAL OR DISAPPROVAL OF SITE SECURITY PLANS.— 

(1) IN GENERAL.— 

(A) REVIEW.—Except as provided in paragraph (4), the 

Secretary shall review and approve or disapprove each site 

security plan submitted pursuant to subsection (a). 

(B) BASES FOR DISAPPROVAL.—The Secretary— 

(i) may not disapprove a site security plan based on 

the presence or absence of a particular security measure; and 

(ii) shall disapprove a site security plan if the plan 

fails to satisfy the risk-based performance standards 

established pursuant to subsection (a)(2)(C). 

(2) ALTERNATIVE SECURITY PROGRAMS.— 


emcdonald on DSK67QTVN1PROD with HEARING
27 

(A) AUTHORITY TO APPROVE.— (i) IN GENERAL.—The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or 

under other applicable laws, if the Secretary determines that the requirements of the program meet the 

requirements under this section. 

(ii) ADDITIONAL SECURITY MEASURES.—If the requirements of an alternative security program do not meet 

the requirements under this section, the Secretary may 

recommend additional security measures to the program that will enable the Secretary to approve the program. 

(B) SATISFACTION OF SITE SECURITY PLAN REQUIREMENT.—A covered chemical facility may satisfy the site security plan requirement under subsection (a) by adopting 

an alternative security program that the Secretary has— 

(i) reviewed and approved under subparagraph (A); 

and 

(ii) determined to be appropriate for the operations 

and security concerns of the covered chemical facility. 

(3) SITE SECURITY PLAN ASSESSMENTS.— (A) RISK ASSESSMENT POLICIES AND PROCEDURES.—In 

approving or disapproving a site security plan under this 

subsection, the Secretary shall employ the risk assessment 

policies and procedures developed under this title. 

(B) PREVIOUSLY APPROVED PLANS.—In the case of a covered chemical facility for which the Secretary approved a 

site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary may not require the facility 

to resubmit the site security plan solely by reason of the enactment of this title. 

(4) EXPEDITED APPROVAL PROGRAM.— 

(A) IN GENERAL.—A covered chemical facility assigned to 

tier 3 or 4 may meet the requirement to develop and submit 

a site security plan under subsection (a)(2)(D) by developing 

and submitting to the Secretary— 

(i) a site security plan and the certification described 

in subparagraph (C); or 

(ii) a site security plan in conformance with a template authorized under subparagraph (H). 

(B) GUIDANCE FOR EXPEDITED APPROVAL FACILITIES.— 

(i) IN GENERAL.—Not later than 180 days after the 

date of enactment of the Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act of 2014, 

the Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. 

(ii) MATERIAL DEVIATION FROM GUIDANCE.—If a security measure in the site security plan of an expedited 

approval facility materially deviates from a security 

measure in the guidance for expedited approval facilities, the site security plan shall include an explanation 


emcdonald on DSK67QTVN1PROD with HEARING
28 

of how such security measure meets the risk-based performance standards. 

(iii) PROCESS.—In developing and issuing, or amending, the guidance for expedited approval facilities 

under this subparagraph and in collecting information 

from expedited approval facilities, the Secretary— 

(I) shall consult with— 

(aa) Sector Coordinating Councils established under sections 201 and 871(a); and 

(bb) appropriate labor organizations; and 

(II) shall not be subject to section 553 of title 5, 

United States Code, the National Environmental 

Policy Act of 1969 (42 U.S.C. 4321 et seq.), subchapter I of chapter 35 of title 44, United States 

Code, or section 2107(b) of this title. 

(C) CERTIFICATION.—The owner or operator of an expedited approval facility shall submit to the Secretary a certification, signed under penalty of perjury, that— 

(i) the owner or operator is familiar with the requirements of this title and part 27 of title 6, Code of Federal Regulations, or any successor thereto, and the site 

security plan being submitted; 

(ii) the site security plan includes the security measures required by subsection (b); 

(iii)(I) the security measures in the site security plan 

do not materially deviate from the guidance for expedited approval facilities except where indicated in the 

site security plan; 

(II) any deviations from the guidance for expedited 

approval facilities in the site security plan meet the 

risk-based performance standards for the tier to which 

the facility is assigned; and 

(III) the owner or operator has provided an explanation of how the site security plan meets the riskbased performance standards for any material deviation; 

(iv) the owner or operator has visited, examined, documented, and verified that the expedited approval facility meets the criteria set forth in the site security 

plan; 

(v) the expedited approval facility has implemented 

all of the required performance measures outlined in 

the site security plan or set out planned measures that 

will be implemented within a reasonable time period 

stated in the site security plan; 

(vi) each individual responsible for implementing the 

site security plan is fully aware of the requirements relevant to the individual’s responsibility contained in the 

site security plan and is competent to carry out those 

requirements; and 

(vii) the owner or operator has committed, or, in the 

case of planned measures will commit, the necessary 

resources to fully implement the site security plan. 

(D) DEADLINE.— 


emcdonald on DSK67QTVN1PROD with HEARING
29 

(i) IN GENERAL.—Not later than 120 days after the 

date described in clause (ii), the owner or operator of 

an expedited approval facility shall submit to the Secretary the site security plan and the certification described in subparagraph (C). 

(ii) DATE.—The date described in this clause is— 

(I) for an expedited approval facility that was 

assigned to tier 3 or 4 under existing CFATS regulations before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the date that is 210 

days after the date of enactment of that Act; and 

(II) for any expedited approval facility not described in subclause (I), the later of— 

(aa) the date on which the expedited approval facility is assigned to tier 3 or 4 under 

subsection (e)(2)(A); or 

(bb) the date that is 210 days after the date 

of enactment of the Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act 

of 2014. 

(iii) NOTICE.—An owner or operator of an expedited 

approval facility shall notify the Secretary of the intent 

of the owner or operator to certify the site security plan 

for the expedited approval facility not later than 30 

days before the date on which the owner or operator 

submits the site security plan and certification described in subparagraph (C). 

(E) COMPLIANCE.— 

(i) IN GENERAL.—For an expedited approval facility 

submitting a site security plan and certification in accordance with subparagraphs (A), (B), (C), and (D)— 

(I) the expedited approval facility shall comply 

with all of the requirements of its site security 

plan; and 

(II) the Secretary— 

(aa) except as provided in subparagraph (G), 

may not disapprove the site security plan; and 

(bb) may audit and inspect the expedited approval facility under subsection (d) to verify 

compliance with its site security plan. 

(ii) NONCOMPLIANCE.—If the Secretary determines an 

expedited approval facility is not in compliance with 

the requirements of the site security plan or is otherwise in violation of this title, the Secretary may enforce 

compliance in accordance with section 2104. 

(F) AMENDMENTS TO SITE SECURITY PLAN.— 

(i) REQUIREMENT.— 

(I) IN GENERAL.—If the owner or operator of an 

expedited approval facility amends a site security 

plan submitted under subparagraph (A), the owner 

or operator shall submit the amended site security 

plan and a certification relating to the amended 

site security plan that contains the information described in subparagraph (C). 


emcdonald on DSK67QTVN1PROD with HEARING
30 

(II) TECHNICAL AMENDMENTS.—For purposes of 

this clause, an amendment to a site security plan 

includes any technical amendment to the site security plan. 

(ii) AMENDMENT REQUIRED.—The owner or operator 

of an expedited approval facility shall amend the site 

security plan if— 

(I) there is a change in the design, construction, 

operation, or maintenance of the expedited approval facility that affects the site security plan; 

(II) the Secretary requires additional security 

measures or suspends a certification and recommends additional security measures under subparagraph (G); or 

(III) the owner or operator receives notice from 

the Secretary of a change in tiering under subsection (e)(3). 

(iii) DEADLINE.—An amended site security plan and 

certification shall be submitted under clause (i)— 

(I) in the case of a change in design, construction, operation, or maintenance of the expedited 

approval facility that affects the security plan, not 

later than 120 days after the date on which the 

change in design, construction, operation, or maintenance occurred; 

(II) in the case of the Secretary requiring additional security measures or suspending a certification and recommending additional security 

measures under subparagraph (G), not later than 

120 days after the date on which the owner or operator receives notice of the requirement for additional security measures or suspension of the certification and recommendation of additional security measures; and 

(III) in the case of a change in tiering, not later 

than 120 days after the date on which the owner 

or operator receives notice under subsection (e)(3). 

(G) FACIALLY DEFICIENT SITE SECURITY PLANS.— (i) PROHIBITION.—Notwithstanding subparagraph 

(A) or (E), the Secretary may suspend the authority of 

a covered chemical facility to certify a site security plan 

if the Secretary— 

(I) determines the certified site security plan or 

an amended site security plan is facially deficient; 

and 

(II) not later than 100 days after the date on 

which the Secretary receives the site security plan 

and certification, provides the covered chemical facility with written notification that the site security 

plan is facially deficient, including a clear explanation of each deficiency in the site security plan. 

(ii) ADDITIONAL SECURITY MEASURES.— (I) IN GENERAL.—If, during or after a compliance inspection of an expedited approval facility, 

the Secretary determines that planned or impleVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00032 Fmt 6659 Sfmt 6603 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
31 

mented security measures in the site security plan 

of the facility are insufficient to meet the riskbased performance standards based on misrepresentation, omission, or an inadequate description 

of the site, the Secretary may— 

(aa) require additional security measures; or 

(bb) suspend the certification of the facility. 

(II) RECOMMENDATION OF ADDITIONAL SECURITY

MEASURES.—If the Secretary suspends the certification of an expedited approval facility under subclause (I), the Secretary shall— 

(aa) recommend specific additional security 

measures that, if made part of the site security 

plan by the facility, would enable the Secretary to approve the site security plan; and 

(bb) provide the facility an opportunity to 

submit a new or modified site security plan 

and certification under subparagraph (A). 

(III) SUBMISSION; REVIEW.—If an expedited approval facility determines to submit a new or 

modified site security plan and certification as authorized under subclause (II)(bb)— 

(aa) not later than 90 days after the date on 

which the facility receives recommendations 

under subclause (II)(aa), the facility shall submit the new or modified plan and certification; 

and 

(bb) not later than 45 days after the date on 

which the Secretary receives the new or modified plan under item (aa), the Secretary shall 

review the plan and determine whether the 

plan is facially deficient. 

(IV) DETERMINATION NOT TO INCLUDE ADDI- TIONAL SECURITY MEASURES.— 

(aa) REVOCATION OF CERTIFICATION.—If an 

expedited approval facility does not agree to 

include in its site security plan specific additional security measures recommended by the 

Secretary under subclause (II)(aa), or does not 

submit a new or modified site security plan in 

accordance with subclause (III), the Secretary 

may revoke the certification of the facility by 

issuing an order under section 2104(a)(1)(B). 

(bb) EFFECT OF REVOCATION.—If the Secretary revokes the certification of an expedited 

approval facility under item (aa) by issuing an 

order under section 2104(a)(1)(B)— 

(AA) the order shall require the owner 

or operator of the facility to submit a site 

security plan or alternative security program for review by the Secretary review 

under subsection (c)(1); and 

(BB) the facility shall no longer be eligible to certify a site security plan under 

this paragraph. 


emcdonald on DSK67QTVN1PROD with HEARING
32 

(V) FACIAL DEFICIENCY.—If the Secretary determines that a new or modified site security plan 

submitted by an expedited approval facility under 

subclause (III) is facially deficient— 

(aa) not later than 120 days after the date 

of the determination, the owner or operator of 

the facility shall submit a site security plan or 

alternative security program for review by the 

Secretary under subsection (c)(1); and 

(bb) the facility shall no longer be eligible to 

certify a site security plan under this paragraph. 

(H) TEMPLATES.— 

(i) IN GENERAL.—The Secretary may develop prescriptive site security plan templates with specific security measures to meet the risk-based performance 

standards under subsection (a)(2)(C) for adoption and 

certification by a covered chemical facility assigned to 

tier 3 or 4 in lieu of developing and certifying its own 

plan. 

(ii) PROCESS.—In developing and issuing, or amending, the site security plan templates under this subparagraph, issuing guidance for implementation of the 

templates, and in collecting information from expedited 

approval facilities, the Secretary— 

(I) shall consult with— 

(aa) Sector Coordinating Councils established under sections 201 and 871(a); and 

(bb) appropriate labor organizations; and 

(II) shall not be subject to section 553 of title 5, 

United States Code, the National Environmental 

Policy Act of 1969 (42 U.S.C. 4321 et seq.), subchapter I of chapter 35 of title 44, United States 

Code, or section 2107(b) of this title. 

(iii) RULE OF CONSTRUCTION.—Nothing in this subparagraph shall be construed to prevent a covered 

chemical facility from developing and certifying its own 

security plan in accordance with subparagraph (A). 

(I) EVALUATION.— (i) IN GENERAL.—Not later than 18 months after the 

date of enactment of the Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act of 2014, 

the Secretary shall take any appropriate action necessary for a full evaluation of the expedited approval 

program authorized under this paragraph, including 

conducting an appropriate number of inspections, as 

authorized under subsection (d), of expedited approval 

facilities. 

(ii) REPORT.—Not later than 18 months after the 

date of enactment of the Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act of 2014, 

the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate 

and the Committee on Homeland Security of the House 

of Representatives a report that contains— 


emcdonald on DSK67QTVN1PROD with HEARING
33 

(I) any costs and efficiencies associated with the 

expedited approval program authorized under this 

paragraph; 

(II) the impact of the expedited approval program on the backlog for site security plan approval 

and authorization inspections; 

(III) an assessment of the ability of expedited approval facilities to submit facially sufficient site security plans; 

(IV) an assessment of any impact of the expedited approval program on the security of chemical 

facilities; and 

(V) a recommendation by the Secretary on the 

frequency of compliance inspections that may be 

required for expedited approval facilities. 

(d) COMPLIANCE.— 

(1) AUDITS AND INSPECTIONS.— 

(A) DEFINITIONS.—In this paragraph— 

(i) the term ‘‘nondepartmental’’— 

(I) with respect to personnel, means personnel 

that is not employed by the Department; and 

(II) with respect to an entity, means an entity 

that is not a component or other authority of the 

Department; and 

(ii) the term ‘‘nongovernmental’’— 

(I) with respect to personnel, means personnel 

that is not employed by the Federal Government; 

and 

(II) with respect to an entity, means an entity 

that is not an agency, department, or other authority of the Federal Government. 

(B) AUTHORITY TO CONDUCT AUDITS AND INSPECTIONS.— 

The Secretary shall conduct audits or inspections under 

this title using— 

(i) employees of the Department; or 

(ii) nondepartmental or nongovernmental personnel 

approved by the Secretary. 

(C) SUPPORT PERSONNEL.—The Secretary may use nongovernmental personnel to provide administrative and 

logistical services in support of audits and inspections 

under this title. 

(D) REPORTING STRUCTURE.— 

(i) NONDEPARTMENTAL AND NONGOVERNMENTAL AUDITS AND INSPECTIONS.—Any audit or inspection conducted by an individual employed by a nondepartmental or nongovernmental entity shall be assigned in 

coordination with a regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department 

for the region in which the audit or inspection is to be 

conducted. 

(ii) REQUIREMENT TO REPORT.—While an individual 

employed by a nondepartmental or nongovernmental 

entity is in the field conducting an audit or inspection 

under this subsection, the individual shall report to the 


emcdonald on DSK67QTVN1PROD with HEARING
34 

regional supervisor with responsibility for supervising 

inspectors within the Infrastructure Security Compliance Division of the Department for the region in 

which the individual is operating. 

(iii) APPROVAL.—The authority to approve a site security plan under subsection (c) or determine if a covered chemical facility is in compliance with an approved site security plan shall be exercised solely by the 

Secretary or a designee of the Secretary within the Department. 

(E) STANDARDS FOR AUDITORS AND INSPECTORS.—The 

Secretary shall prescribe standards for the training and retraining of each individual used by the Department as an 

auditor or inspector, including each individual employed 

by the Department and all nondepartmental or nongovernmental personnel, including— 

(i) minimum training requirements for new auditors 

and inspectors; 

(ii) retraining requirements; 

(iii) minimum education and experience levels; 

(iv) the submission of information as required by the 

Secretary to enable determination of whether the auditor or inspector has a conflict of interest; 

(v) the proper certification or certifications necessary 

to handle chemical-terrorism vulnerability information 

(as defined in section 27.105 of title 6, Code of Federal 

Regulations, or any successor thereto); 

(vi) the reporting of any issue of non-compliance with 

this section to the Secretary within 24 hours; and 

(vii) any additional qualifications for fitness of duty 

as the Secretary may require. 

(F) CONDITIONS FOR NONGOVERNMENTAL AUDITORS AND

INSPECTORS.—If the Secretary arranges for an audit or inspection under subparagraph (B) to be carried out by a 

nongovernmental entity, the Secretary shall— 

(i) prescribe standards for the qualification of the individuals who carry out such audits and inspections 

that are commensurate with the standards for similar 

Government auditors or inspectors; and 

(ii) ensure that any duties carried out by a nongovernmental entity are not inherently governmental 

functions. 

(2) PERSONNEL SURETY.— 

(A) PERSONNEL SURETY PROGRAM.—For purposes of this 

title, the Secretary shall establish and carry out a Personnel Surety Program that— 

(i) does not require an owner or operator of a covered 

chemical facility that voluntarily participates in the 

program to submit information about an individual 

more than one time; 

(ii) provides a participating owner or operator of a 

covered chemical facility with relevant information 

about an individual based on vetting the individual 

against the terrorist screening database, to the extent 

that such feedback is necessary for the facility to be in 


emcdonald on DSK67QTVN1PROD with HEARING
35 

compliance with regulations promulgated under this 

title; and 

(iii) provides redress to an individual— 

(I) whose information was vetted against the terrorist screening database under the program; and 

(II) who believes that the personally identifiable 

information submitted to the Department for such 

vetting by a covered chemical facility, or its designated representative, was inaccurate. 

(B) PERSONNEL SURETY PROGRAM IMPLEMENTATION.—To 

the extent that a risk-based performance standard established under subsection (a) requires identifying individuals 

with ties to terrorism— 

(i) a covered chemical facility may satisfy its obligation under the standard by using any Federal screening program that periodically vets individuals against 

the terrorist screening database, or any successor program, including the Personnel Surety Program established under subparagraph (A); and 

(ii) the Secretary may not require a covered chemical 

facility to submit any information about an individual 

unless the individual— 

(I) is to be vetted under the Personnel Surety 

Program; or 

(II) has been identified as presenting a terrorism 

security risk. 

(3) AVAILABILITY OF INFORMATION.—The Secretary shall 

share with the owner or operator of a covered chemical facility 

any information that the owner or operator needs to comply 

with this section. 

(e) RESPONSIBILITIES OF THE SECRETARY.— (1) IDENTIFICATION OF CHEMICAL FACILITIES OF INTEREST.— 

In carrying out this title, the Secretary shall consult with the 

heads of other Federal agencies, States and political subdivisions thereof, relevant business associations, and public and 

private labor organizations to identify all chemical facilities of 

interest. 

(2) RISK ASSESSMENT.— (A) IN GENERAL.—For purposes of this title, the Secretary 

shall develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. 

(B) CRITERIA FOR DETERMINING SECURITY RISK.—The criteria for determining the security risk of terrorism associated with a covered chemical facility shall take into account— 

(i) relevant threat information; 

(ii) potential economic consequences and the potential loss of human life in the event of the facility being 

subject to a terrorist attack, compromise, infiltration, 

or exploitation; and 

(iii) vulnerability of the facility to a terrorist attack, 

compromise, infiltration, or exploitation. 

(3) CHANGES IN TIERING.— 


emcdonald on DSK67QTVN1PROD with HEARING
36 

(A) MAINTENANCE OF RECORDS.—The Secretary shall document the basis for each instance in which— 

(i) tiering for a covered chemical facility is changed; 

or 

(ii) a covered chemical facility is determined to no 

longer be subject to the requirements under this title. 

(B) REQUIRED INFORMATION.—The records maintained 

under subparagraph (A) shall include information on 

whether and how the Secretary confirmed the information 

that was the basis for the change or determination described in subparagraph (A). 

(4) SEMIANNUAL PERFORMANCE REPORTING.—Not later than 6 

months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, and 

not less frequently than once every 6 months thereafter, the Secretary shall submit to the Committee on Homeland Security 

and Governmental Affairs of the Senate and the Committee on 

Homeland Security of the House of Representatives a report 

that describes, for the period covered by the report— 

(A) the number of covered chemical facilities in the 

United States; 

(B) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval; 

(C) the number of covered chemical facilities inspected; 

(D) the average number of covered chemical facilities inspected per inspector; and 

(E) any other information that the Secretary determines 

will be helpful to Congress in evaluating the performance 

of the Chemical Facility Anti-Terrorism Standards Program. 

SEC. 2103. PROTECTION AND SHARING OF INFORMATION. 

(a) In GENERAL.—Notwithstanding any other provision of law, information developed under this title, including vulnerability assessments, site security plans, and other security related information, 

records, and documents shall be given protections from public disclosure consistent with the protection of similar information under 

section 70103(d) of title 46, United States Code. 

(b) SHARING OF INFORMATION WITH STATES AND LOCAL GOVERN- MENTS.—Nothing in this section shall be construed to prohibit the 

sharing of information developed under this title, as the Secretary 

determines appropriate, with State and local government officials 

possessing a need to know and the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title. 

(c) SHARING OF INFORMATION WITH FIRST RESPONDERS.— 

(1) REQUIREMENT.—The Secretary shall provide to State, 

local, and regional fusion centers (as that term is defined in 

section 210A(j)(1)) and State and local government officials, as 

the Secretary determines appropriate, such information as is 

necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to 

respond to security incidents at covered chemical facilities. 

(2) DISSEMINATION.—The Secretary shall disseminate information under paragraph (1) through a medium or system deterVerDate Sep 11 2014 05:16 Sep 26, 2014 Jkt 039010 PO 00000 Frm 00038 Fmt 6659 Sfmt 6603 E:\HR\OC\SR263.XXX SR263

emcdonald on DSK67QTVN1PROD with HEARING
37 

mined by the Secretary to be appropriate to ensure the secure 

and expeditious dissemination of such information to necessary 

selected individuals. 

(d) ENFORCEMENT PROCEEDINGS.—In any proceeding to enforce 

this section, vulnerability assessments, site security plans, and other 

information submitted to or obtained by the Secretary under this 

title, and related vulnerability or security information, shall be 

treated as if the information were classified information. 

(e) AVAILABILITY OF INFORMATION.—Notwithstanding any other 

provision of law (including section 552(b)(3) of title 5, United States 

Code), section 552 of title 5, United States Code (commonly known 

as the Freedom of Information Act’) shall not apply to information 

protected from public disclosure pursuant to subsection (a) of this 

section. 

SEC. 2104. CIVIL ENFORCEMENT. 

(a) NOTICE OF NONCOMPLIANCE.— (1) NOTICE.—If the Secretary determines that a covered chemical facility is not in compliance with this title, the Secretary 

shall— 

(A) provide the owner or operator of the facility with— 

(i) not later than 14 days after date on which the 

Secretary makes the determination, a written notification of noncompliance that includes a clear explanation 

of any deficiency in the security vulnerability assessment or site security plan; and 

(ii) an opportunity for consultation with the Secretary or the Secretary’s designee; and 

(B) issue to the owner or operator of the facility an order 

to comply with this title by a date specified by the Secretary 

in the order, which date shall be not later than 180 days 

after the date on which the Secretary issues the order. 

(2) CONTINUED NONCOMPLIANCE.—If an owner or operator 

continues to be in noncompliance with this title after the date 

specified in an order issued under paragraph (1)(B), the Secretary may enter an order in accordance with this section assessing a civil penalty, an order to cease operations, or both. 

(b) CIVIL PENALTIES.— (1) VIOLATIONS OF ORDERS.—Any person who violates an 

order issued under this title shall be liable for a civil penalty 

under section 70119(a) of title 46, United States Code. 

(2) NON-REPORTING CHEMICAL FACILITIES OF INTEREST.—Any 

owner of a chemical facility of interest who fails to comply with, 

or knowingly submits false information under, this title or the 

CFATS regulations shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. 

(c) EMERGENCY ORDERS.— 

(1) IN GENERAL.—Notwithstanding subsection (a) or any site 

security plan or alternative security program approved under 

this title, if the Secretary determines that there is a reasonable 

likelihood that a violation of this title or the CFATS regulations 

by a chemical facility could result in death, serious illness, severe personal injury, or substantial endangerment to the public, 

the Secretary may direct the facility, effective immediately or as 

soon as practicable, to— 

(A) cease some or all operations; or 


emcdonald on DSK67QTVN1PROD with HEARING
38 

(B) implement appropriate emergency security measures. 

(2) LIMITATION ON DELEGATION.—The Secretary may not delegate the authority under paragraph (1) to any official other 

than the Under Secretary for the National Protection and Programs Directorate. 

(d) RIGHT OF ACTION.—Nothing in this title confers upon any person except the Secretary or his or her designee a right of action 

against an owner or operator of a covered chemical facility to enforce any provision of this title. 

SEC. 2105. WHISTLEBLOWER PROTECTIONS. 

(a) PROCEDURE FOR REPORTING PROBLEMS.— 

(1) ESTABLISHMENT OF A REPORTING PROCEDURE.—Not later 

than 180 days after the date of enactment of the Protecting and 

Securing Chemical Facilities from Terrorist Attacks Act of 

2014, the Secretary shall establish, and provide information to 

the public regarding, a procedure under which any employee or 

contractor of a chemical facility may submit a report to the Secretary regarding problems, deficiencies, or vulnerabilities at a 

covered chemical facility that are associated with the risk of a 

chemical facility terrorist incident. 

(2) CONFIDENTIALITY.—The Secretary shall keep confidential 

the identity of an individual who submits a report under paragraph (1) and any such report shall be treated as a record containing protected information to the extent that the report does 

not consist of publicly available information. 

(3) ACKNOWLEDGMENT OF RECEIPT.—If a report submitted 

under paragraph (1) identifies the individual making the report, the Secretary shall promptly respond to the individual directly and shall promptly acknowledge receipt of the report. 

(4) STEPS TO ADDRESS PROBLEMS.—The Secretary shall— 

(A) review and consider the information provided in any 

report submitted under paragraph (1); and 

(B) take appropriate steps under this title if necessary to 

address any substantiated problems, deficiencies, or 

vulnerabilities associated with the risk of a chemical facility terrorist incident identified in the report. 

(5) RETALIATION PROHIBITED.— 

(A) IN GENERAL.—An owner or operator of a covered 

chemical facility or agent thereof may not discharge an employee or otherwise discriminate against an employee with 

respect to the compensation provided to, or terms, conditions, or privileges of the employment of, the employee because the employee (or an individual acting pursuant to a 

request of the employee) submitted a report under paragraph (1). 

(B) EXCEPTION.—An employee shall not be entitled to the 

protections under this section if the employee— 

(i) knowingly and willfully makes any false, fictitious, or fraudulent statement or representation; or 

(ii) uses any false writing or document knowing the 

writing or document contains any false, fictitious, or 

fraudulent statement or entry. 

(b) PROTECTED DISCLOSURES.—Nothing in this title shall be construed to limit the right of an individual to make any disclosure— 


emcdonald on DSK67QTVN1PROD with HEARING
39 

(1) protected or authorized under section 2302(b)(8) or 7211 

of title 5, United States Code; 

(2) protected under any other Federal or State law that 

shields the disclosing individual against retaliation or discrimination for having made the disclosure in the public interest; or 

(3) to the Special Counsel of an agency, the inspector general 

of an agency, or any other employee designated by the head of 

an agency to receive disclosures similar to the disclosures described in paragraphs (1) and (2). 

(c) PUBLICATION OF RIGHTS.—The Secretary, in partnership with 

industry associations and labor organizations, shall make publicly 

available both physically and online the rights that an individual 

who discloses information, including security-sensitive information, 

regarding problems, deficiencies, or vulnerabilities at a covered 

chemical facility would have under Federal whistleblower protection 

laws or this title. 

(d) PROTECTED INFORMATION.—All information contained in a report made under this subsection (a) shall be protected in accordance 

with section 2103. 

SEC. 2106. RELATIONSHIP TO OTHER LAWS. 

(a) OTHER FEDERAL LAWS.—Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that 

regulates the manufacture, distribution in commerce, use, sale, other 

treatment, or disposal of chemical substances or mixtures. 

(b) STATES AND POLITICAL SUBDIVISIONS.—This title shall not 

preclude or deny any right of any State or political subdivision 

thereof to adopt or enforce any regulation, requirement, or standard 

of performance with respect to chemical facility security that is more 

stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that 

State, unless there is an actual conflict between this section and the 

law of that State. 

SEC. 2107. CFATS REGULATIONS. 

(a) GENERAL AUTHORITY.—The Secretary may, in accordance with 

chapter 5 of title 5, United States Code, promulgate regulations or 

amend existing CFATS regulations to implement the provisions 

under this title. 

(b) EXISTING CFATS REGULATIONS.— 

(1) IN GENERAL.—Notwithstanding section 4(b) of the Protecting and Securing Chemical Facilities from Terrorist Attacks 

Act of 2014, each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals the 

regulation. 

(2) REPEAL.—Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of 2014, the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title. 

(c) AUTHORITY.—The Secretary shall exclusively rely upon authority provided under this title in— 

(1) determining compliance with this title; 

(2) identifying chemicals of interest; and 


emcdonald on DSK67QTVN1PROD with HEARING
40 

(3) determining security risk associated with a chemical facility. 

SEC. 2108. SMALL COVERED CHEMICAL FACILITIES. 

(a) DEFINITION.—In this section, the term ‘‘small covered chemical 

facility’’ means a covered chemical facility that— 

(1) has fewer than 100 employees employed at the covered 

chemical facility; and 

(2) is owned and operated by a small business concern (as defined in section 3 of the Small Business Act (15 U.S.C. 632)). 

(b) ASSISTANCE TO FACILITIES.—The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing the 

physical security, cybersecurity, recordkeeping, and reporting procedures required under this title. 

(c) REPORT.—The Secretary shall submit to the Committee on 

Homeland Security and Governmental Affairs of the Senate and the 

Committee on Homeland Security of the House of Representatives a 

report on best practices that may assist small covered chemical facilities in development of physical security best practices. 

SEC. 2109. OUTREACH TO CHEMICAL FACILITIES OF INTEREST. 

Not later than 90 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act 

of 2014, the Secretary shall establish an outreach implementation 

plan, in coordination with the heads of other appropriate Federal 

and State agencies, relevant business associations, and public and 

private labor organizations, to— 

(1) identify chemical facilities of interest; and 

(2) make available compliance assistance materials and information on education and training. 

Æ 


emcdonald on DSK67QTVN1PROD with HEARING