```

[Senate Report 115-384]
[From the U.S. Government Publishing Office]

                                                      Calendar No. 670
115th Congress         }                    {                 Report
                                 SENATE
 2d Session            }                    {                  115-384
_______________________________________________________________________

                                     

 PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT

                               __________

                              R E P O R T

                                 of the

                   COMMITTEE ON HOMELAND SECURITY AND

                          GOVERNMENTAL AFFAIRS

                          UNITED STATES SENATE

                              to accompany

                                S. 3405

          TO REAUTHORIZE THE CHEMICAL FACILITY ANTI-TERRORISM
        STANDARDS PROGRAM OF THE DEPARTMENT OF HOMELAND SECURITY
        
        
        
        
        
        
        
        
        

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

               November 26, 2018.--Ordered to be printed
                                   ______

                    U.S. GOVERNMENT PUBLISHING OFFICE 

89-010                      WASHINGTON : 2018

               
        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                    RON JOHNSON, Wisconsin, Chairman
JOHN McCAIN, Arizona                 CLAIRE McCASKILL, Missouri
ROB PORTMAN, Ohio                    THOMAS R. CARPER, Delaware
RAND PAUL, Kentucky                  HEIDI HEITKAMP, North Dakota
JAMES LANKFORD, Oklahoma             GARY C. PETERS, Michigan
MICHAEL B. ENZI, Wyoming             MAGGIE HASSAN, New Hampshire
JOHN HOEVEN, North Dakota            KAMALA D. HARRIS, California
STEVE DAINES, Montana                DOUG JONES, Alabama

                  Christopher R. Hixon, Staff Director
                Gabrielle D'Adamo Singer, Chief Counsel
              Colleen E. Berny, Professional Staff Member
               Margaret E. Daum, Minority Staff Director
       Charles A. Moskowitz, Minority Senior Legislative Counsel
           Julie G. Klein, Minority Professional Staff Member
                     Laura W. Kilbride, Chief Clerk

                                                      Calendar No. 670
115th Congress         }                    {                 Report
                                 SENATE
 2d Session            }                    {                  115-384

======================================================================

 
 PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT

                                _______
                                

               November 26, 2018.--Ordered to be printed

                                _______
                                

 Mr. Johnson, from the Committee on Homeland Security and Governmental 
                    Affairs, submitted the following

                              R E P O R T

                         [To accompany S. 3405]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Homeland Security and Governmental 
Affairs, to which was referred the bill (S. 3405), to 
reauthorize the Chemical Facility Anti-Terrorism Standards 
Program of the Department of Homeland Security, having 
considered the same, reports favorably thereon with an 
amendment (in the nature of a subsitute) and recommends that 
the bill, as amended, do pass.

                                CONTENTS

                                                                   Page
  I. Purpose and Summary..............................................1
 II. Background and Need for the Legislation..........................2
III. Legislative History.............................................18
 IV. Section-by-Section Analysis.....................................19
  V. Evaluation of Regulatory Impact.................................22
 VI. Congressional Budget Office Cost Estimate.......................22
VII. Changes in Existing Law Made by the Bill, as Reported...........25

                         I. Purpose and Summary

    The purpose of S. 3405, the Protecting and Securing 
Chemical Facilities from Terrorist Attacks Act of 2018, is to 
reauthorize and improve the Chemical Facility Anti-Terrorism 
Standards (CFATS) program at the Department of Homeland 
Security (``DHS'' or the ``Department'') for a period of five 
years.
    The legislation makes several important reforms to improve 
the CFATS program's effectiveness and efficiency. Importantly, 
it improves transparency regarding changes to tiers and the 
list of covered chemicals; requires improved reporting to 
Congress and assessments on how the program improves security; 
provides regulatory relief for certain covered facilities 
regulated by the Bureau of Alcohol, Tobacco, Firearms, and 
Explosives (ATF), and companies that participate in a CFATS 
recognition program; and extends authorization for the CFATS 
program for an additional five years.

              II. Background and the Need for Legislation

Background on the CFATS program

    In 2006, Congress authorized the Secretary of Homeland 
Security to regulate security at high-risk chemical facilities 
through the Department of Homeland Security Appropriations Act 
of 2007, thus creating the CFATS program.\1\ The program is 
managed by the Infrastructure Security Compliance Division 
(ISCD), within DHS's National Protection and Programs 
Directorate. DHS regulates 3,369 high-risk chemical facilities, 
and covers over 40,000 facilities.\2\ The CFATS program 
regulates facilities within multiple industries including 
``chemical manufacturing, storage and distribution, energy and 
utilities, agriculture and food, explosives, mining, 
electronics, plastics, universities and laboratories, paint and 
coatings, healthcare and pharmaceuticals.''\3\
---------------------------------------------------------------------------
    \1\Department of Homeland Security Appropriations Act, Pub. L. No. 
109-295, Sec. 550, 120 Stat. 1355, 1388-1389 (2006); see also Frank 
Gottron, Cong. Research Serv., IF10853, Chemical Facility Anti-
Terrorism Standards (2018), available at http://www.crs.gov/Reports/
IF10853.
    \2\Dep't of Homeland Sec., Chemical Facility Anti-Terrorism 
Standards (CFATS) (2018), available at https://www.dhs.gov/chemical-
facility-anti-terrorism-standards (last visited Nov. 9, 2018); see also 
Dep't of Homeland Sec., CFATS Monthly Statistics (2018), available at 
https://www.dhs.gov/cfats-monthly-statistics.
    \3\Dep't of Homeland Sec., CFATS Covered Facilities and Inspections 
(2018), available at https://www.dhs.gov/cfats-covered-chemical-
facilities (last visited Nov. 9, 2018).
---------------------------------------------------------------------------
    The CFATS program regulates chemical facilities throughout 
the United States determined to be high risk by DHS.\4\ Some 
facilities are exempt from the program, including those 
regulated by the U.S. Coast Guard under the Maritime 
Transportation Security Act\5\; public water systems and 
treatment works regulated by the Environmental Protection 
Agency\6\; facilities that are owned or operated by the 
Department of Defense and Department of Energy; facilities 
regulated by the Nuclear Regulatory Commission; and some 
agricultural production facilities.\7\
---------------------------------------------------------------------------
    \4\Chemical Facility Anti-Terrorism Standards, supra note 2.
    \5\Maritime Transportation Security Act of 2002, Pub. L. No. 107-
295, Sec. 116 Stat. 2064 (2002).
    \6\42 U.S.C. Sec.  300; 33 U.S.C. Sec.  1292.
    \7\CFATS Covered Facilities and Inspections, supra note 3.
---------------------------------------------------------------------------
    Under the CFATS program, non-exempt facilities are required 
to compare their chemical inventories to the 322 chemicals of 
interest and threshold quantities in Appendix A, created by the 
Department under the CFATS program.\8\ The chemicals listed on 
Appendix A are determined to be a chemical of interest based on 
their screening threshold quantities and the security issues 
related to each chemical.\9\ If the facilities' amounts of 
chemicals on Appendix A are below the threshold, they are not 
regulated by CFATS. If the company's amounts of chemicals on 
Appendix A are above the stated amount, the company is required 
to submit additional information to DHS via an online ``Top-
Screen'' to determine if they are to be regulated.\10\ Since 
the program's inception, the Department has received over 
90,000 Top-Screens from more than 40,000 chemical facilities 
nationwide.\11\
---------------------------------------------------------------------------
    \8\Frank Gottron, Cong. Research Serv., IF10853, Chemical Facility 
Anti-Terrorism Standards (2018), available at http://www.crs.gov/
Reports/IF10853.
    \9\Dep't of Homeland Sec., Appendix A: Chemicals of Interest (COI) 
(2018), available at https://www.dhs.gov/appendix-a-chemicals-interest-
list.
    \10\Dep't of Homeland Sec., Chemical Security Assessment Tool 
(CSAT) Top-Screen (2018), available at https://www.dhs.gov/csat-top-
screen (a Top-Screen is an online survey that helps DHS determine if a 
facility meets the level of risk to be regulated under CFATS).
    \11\Dep't of Homeland Sec., CFATS Monthly Statistics (2018), 
available at https://www.dhs.gov/cfats-monthly-statistics (last visited 
Nov. 9, 2018).
---------------------------------------------------------------------------
    Facilities subject to CFATS regulations are divided into 
four tiers based on the Department's determination of the 
relative security risks of the covered facilities, with Tier 1 
including the highest risk and Tier 4 covering the lowest 
risk.\12\ Most of the facilities regulated under CFATS fall 
under Tier 3 and Tier 4.\13\ According to an October 2018 
report by the Congressional Research Service (CRS), five 
percent of facilities fall under Tier 1; two percent of the 
facilities are under Tier 2; 40 percent of facilities are in 
Tier 3; and 53 percent of facilities fall under Tier 4.\14\
---------------------------------------------------------------------------
    \12\Frank Gottron, supra note 8.
    \13\Id.
    \14\Id.
---------------------------------------------------------------------------
    A covered chemical facility's security plans and 
implementation must comply with DHS's Risk-Based Performance 
Standards (RBPS).\15\ There are currently 18 RBPS which 
include: ``Restrict Area Perimeter''; ``Secure Site Assets''; 
``Screen and Control Access''; ``Deter, Detect, and Delay''; 
``Shipping, Receipt, and Storage''; ``Theft or Diversion''; 
``Sabotage''; ``Cyber''; ``Response''; ``Monitoring''; 
``Training''; ``Personnel Surety''; ``Elevated Threats''; 
``Specific Threats, Vulnerabilities, or Risks''; ``Reporting of 
Significant Security Incidents''; ``Significant Security 
Incidents and Suspicious Activities''; ``Officials and 
Organization''; and ``Records.''\16\ The highest risk 
facilities (Tier 1 and Tier 2) are required to comply with the 
most rigorous standards.\17\ According to CRS, ``[t]he statute 
does not permit DHS to require any particular security measure. 
Facilities may implement any security program or process that 
adequately meets the requisite performance level for its risk 
level.''\18\
---------------------------------------------------------------------------
    \15\Dep't of Homeland Sec., Risk-Based Performance Standards (RBPS) 
(2018) available at https://www.dhs.gov/cfats-rbps.
    \16\Dep't of Homeland Sec., Risk-Based Performance Standards 
Guidance (2009), available at https://www.dhs.gov/sites/default/files/
publications/CFATS-Risk-Based-Performance-Standards-508.pdf.
    \17\Frank Gottron, supra note 8.
    \18\Id.
---------------------------------------------------------------------------
    Between 2007 and 2014, Congress extended the CFATS program 
annually via appropriations.\19\ However, the program was 
plagued with significant problems. According to the Government 
Accountability Office (GAO), the program had a seven to nine 
year backlog to review approximately 3,120 site security 
plans.\20\ GAO also reported to Congress that DHS's tiering 
methodology did not consider key risk elements, including 
economic consequences and facility vulnerability.\21\ GAO also 
referenced program management issues with executing the CFATS 
program.
---------------------------------------------------------------------------
    \19\Dana A. Shea, Cong. Research Serv., R41642, Chemical Facility 
Security: Issues and Options for the 112th Congress (2012), available 
at https://fas.org/sgp/crs/homesec/R41642.pdf.
    \20\U.S. Gov't Accountability Office, GAO-13-353, Critical 
Infrastructure Protection (2013), available at https://www.gao.gov/
products/gao-13-353.
    \21\Id.
---------------------------------------------------------------------------
    According to a leaked 2011 DHS memorandum, management 
issues within the program included ``an array of challenges 
that ISCD had experienced implementing the CFATS program, 
including an inability to hire staff with the needed skills, an 
overly complicated security plan review process, and a 
compliance inspection process that had yet to be 
developed.''\22\ The DHS Office of Inspector General (DHS OIG) 
also issued a report in 2013 questioning whether the CFATS 
program could achieve its mission, documenting 13 major 
deficiencies and providing 24 recommendations.\23\ According to 
the report, ``[p]rogram progress has been slowed by inadequate 
tools, poorly executed processes, and insufficient feedback on 
facility submissions.''\24\ The DHS OIG also found that 
``[o]verall efforts to implement the program have resulted in 
systematic noncompliance with sound Federal Government internal 
controls and fiscal stewardship. . . .''\25\
---------------------------------------------------------------------------
    \22\U.S. Gov't Accountability Office, GAO-13-801T, Critical 
Infrastructure Protection (2013), available at https://www.gao.gov/
assets/660/656482.pdf.
    \23\Dep't of Homeland Sec., Office of Inspector Gen., OIG-13-55, 
Effectiveness of the Infrastructure Security Compliance Division's 
Management Practices to Implement the Chemical Facility Anti-Terrorism 
Standards Program (2013), available at https://www.oig.dhs.gov/sites/
default/files/assets/Mgmt/2013/OIG_13-55_Mar13.pdf.
    \24\Id.
    \25\Id.
---------------------------------------------------------------------------
    Congress also questioned whether the program was 
successfully reducing risk and enhancing security. In 2014, 
Senator Tom Coburn, then the Ranking Member of the Senate 
Committee on Homeland Security and Governmental Affairs, 
released a minority staff report evaluating CFATS. According to 
the report, the Department's own internal review found 
``fundamental problems, errors, inconsistencies, and 
unsupported assumptions in the methodology underlying the whole 
CFATS program as well as a general lack of transparency with 
the private sector and outside experts.''\26\ It also found 
``fundamental problems in the design, implementation, and 
management of the CFATS program,'' including multiple 
challenges with DHS risk formulas.\27\
---------------------------------------------------------------------------
    \26\Sen. Tom Coburn of Sen. Comm. on Homeland Sec. & Governmental 
Affairs, 113th Cong., Chemical Insecurity, (Comm. Print 2014), 
available at https://www.hsgac.senate.gov/imo/media/doc/
Chemical_Insecurity.pdf.
    \27\Id.
---------------------------------------------------------------------------
    Based on his oversight and the available information from 
watchdogs in 2014, Senator Coburn wrote:

          In its current form, CFATS isn't working. The program 
        regulates the wrong chemical plants--increasing costs 
        for companies at lower risk while missing those at 
        higher risk--and would not make us significantly more 
        secure even if it worked as designed. Faced with new 
        evidence of on-going challenges in CFATS, and the 
        likelihood that the program will not be adequately 
        fixed for many more years--if ever--Congress must act 
        decisively. Whether Congress decides to substantially 
        overhaul CFATS and put it on track, or terminate the 
        program altogether, one thing is clear: small fixes 
        here are no fix at all.\28\
---------------------------------------------------------------------------
    \28\Id.
---------------------------------------------------------------------------

Protecting and Securing Chemical Facilities from Terrorist Attacks Act 
        of 2014

    In 2014, Congress attempted to fix these problems by 
authorizing and reforming the program in the Protecting and 
Securing Chemical Facilities from Terrorist Attacks Act of 2014 
(2014 Authorization).\29\ The legislation made several changes 
to the program. First, the legislation established the 
Expedited Approval Program, providing greater flexibility for 
Tier 3 and Tier 4 owners and operators to develop their 
facility's site security plans.\30\ Second, the 2014 
Authorization improved whistleblower protections.\31\ Third, 
the 2014 Authorization required DHS to biannually report its 
performance metrics to Congress and conduct outreach to 
chemical facilities.\32\ The 2014 Authorization included a 
four-year sunset of the CFATS program, setting the program to 
expire on January 17, 2019.\33\
---------------------------------------------------------------------------
    \29\Protecting and Securing Chemical Facilities from Terrorist 
Attacks Act of 2014, Pub. L. No. 113-254, Sec.  128 Stat. 2898 (2014); 
see also Frank Gottron, supra note 8.
    \30\Id.
    \31\Id.
    \32\Id.
    \33\Id.
---------------------------------------------------------------------------

The Committee's oversight in the 115th Congress

    Throughout the 115th Congress, the Committee has conducted 
oversight of the CFATS program. On March 13, 2017, Chairman Ron 
Johnson, Ranking Member Claire McCaskill, and Ranking Member 
Bennie Thompson of the House Committee on Homeland Security 
requested GAO conduct a review of the CFATS program.\34\ On 
April 4, 2018, Chairman Johnson wrote a letter to ISCD 
requesting additional information on the CFATS program, 
including the status of overdue reports to Congress, and the 
number of facilities certified under expedited approval.\35\ On 
June 12, 2018, the Committee held a roundtable titled, 
Examining the Chemical Facility Anti-Terrorism Standards, that 
included DHS, GAO, a CFATS chemical inspector, and a variety of 
chemical facilities and industry groups.\36\ On October 23, 
2018, Chairman Johnson and Senator Capito wrote a letter to the 
House Committee on Homeland Security and the House Committee on 
Energy and Commerce regarding the CFATS reauthorization, urging 
both Committees to work with the Senate and incorporate the 
reforms in S. 3405 into the CFATS reauthorization.\37\ 
Committee staff has also met with chemical facilities owners, 
industry trade associations, and received multiple briefings 
from DHS, ATF, CRS, GAO, the Federal Bureau of Investigation 
(FBI), and Sandia National Laboratories.\38\
---------------------------------------------------------------------------
    \34\Request letter from S. Comm. on Homeland Sec. & Governmental 
Affairs and H. Comm. on Homeland Sec. to U.S. Government Accountability 
Office (March 13, 2017) (on file with Comm. majority staff). Chairman 
Michael McCaul later joined the request.
    \35\Request letter from Chairman Ron Johnson to U.S. Dep't of 
Homeland Sec., National Protection and Programs Directorate, 
Infrastructure Security Compliance Division (April 4, 2018) (on file 
with Comm. majority staff).
    \36\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, 115th Cong. (2018), available at https://www.hsgac.senate.gov/
hearings/roundtable_-examining-the-chemical-facility-anti-terrorism-
standards-program.
    \37\Letter from Chairman Ron Johnson and Senator Shelley Moore 
Capito to the House Committee on Homeland Security and the House 
Committee on Energy and Commerce (October 23, 2018) (on file with Comm. 
majority staff).
    \38\See e.g., Comm. staff briefing with FBI (Feb. 8, 2018); Comm. 
staff briefing with FBI (Apr. 9, 2018); Comm. staff briefing with 
Envtl. Tech. Council (Apr. 12, 1018); Comm. staff briefing with Dep't 
of Homeland Sec. (May 14, 2018); Comm. staff briefing with Dep't of 
Homeland Sec. (June 1, 2018); Comm. staff briefing with GAO (June 7, 
2018).
---------------------------------------------------------------------------
    Through congressional oversight and DHS OIG and GAO 
reports, the management and performance of the CFATS program 
has improved. For example, DHS has completely reduced the 
number of facilities awaiting final tiering into the CFATS 
program.\39\ GAO previously estimated it could take seven to 
nine years for DHS to verify site security plans and clear the 
backlog.\40\ Additional improvements include an increase in the 
number of compliance inspections, and a reduced timeframe for 
facilities to submit an initial Site Security Plan or 
Alternative Security Plan.\41\
---------------------------------------------------------------------------
    \39\Majority staff analysis of U.S. Dep't of Homeland Sec., 
Chemical Facility Anti-Terrorism Standards Semiannual Performance 
Reports (Sept. 26, 2015 to Sept. 12, 2018) (on file with Comm. majority 
staff) [hereinafter Majority staff analysis of Chemical Facility Anti-
Terrorism Standards Semiannual Performance Reports].
    \40\Critical Infrastructure Protection, supra note 20.
    \41\Majority staff analysis of Chemical Facility Anti-Terrorism 
Standards Semiannual Performance Reports.
---------------------------------------------------------------------------
    As discussed below, additional reforms are still needed 
before the program is reauthorized. As discussed below, S. 3405 
incorporates the information learned from the Committee's 
oversight to make improvements in the CFATS program.

S. 3405 Requires DHS to ensure broader awareness of the Expedited 
        Approval Program

    The Expedited Approval Program allows flexibility for Tier 
3 and Tier 4 facilities to develop expedited security plans 
versus the standard security plans, effectively encouraging 
companies that own covered chemical facilities to proactively 
implement security measures in compliance with CFATS without 
requiring a DHS authorization inspection.\42\ The Expedited 
Approval Program was also intended to reduce the time and costs 
required to comply with the CFATS program.\43\
---------------------------------------------------------------------------
    \42\U.S. Gov't Accountability Office, GAO-17-502, Critical 
Infrastructure Protection (2017), available at https://www.gao.gov/
assets/690/685520.pdf.
    \43\Id.
---------------------------------------------------------------------------
    However, few companies have participated in expedited 
approval since the 2014 Authorization. In 2015, DHS reported 
that only one facility was utilizing the program.\44\ According 
to GAO, in April 2017, only 2 facilities were using the program 
out of 2,496 eligible facilities.\45\ Representatives from 
facilities that have used the Expedited Approval Program said 
``its prescriptive nature helped them quickly determine what 
they needed to do to implement required security measures and 
reduced the time and cost to prepare and submit their security 
plans to DHS.''\46\
---------------------------------------------------------------------------
    \44\Id.
    \45\Id.
    \46\Id.
---------------------------------------------------------------------------
    Low participation in the Expedited Approval Program has 
been attributed to how it was implemented by DHS, its stringent 
security measures, and the desire for in-person authorization 
inspections.\47\ Further, the online assessment tool used to 
collect data for facilities not participating in expedited 
approval (CSAT 2.0) has become more user friendly and less 
burdensome, resulting in facilities to choose the normal CFATS 
process.\48\ In addition, majority Committee staff found that 
some facility representatives and industry groups are unaware 
of the Expedited Approval Program's existence, raising 
questions about DHS's efforts to proactively inform companies 
of their options to effectively self-certify their security 
measures through the Expedited Approval Program.\49\ Today, 
participation in the expedited approval option within the CFATS 
program remains limited, with only 17 facilities out of 3,130 
participating.\50\ To increase participation, S. 3405 requires 
DHS to notify all new and currently covered CFATS facilities of 
the Expedited Approval Program. The bill also gives facility 
owners and operators additional time to certify expedited 
approval security plans to potentially allow more businesses to 
use the Expedited Approval Program.
---------------------------------------------------------------------------
    \47\Id.
    \48\Id.
    \49\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (For example, on July 20, 2018, Committee staff 
attended a CFATS facility tour organized by DHS and asked the facility 
if they have heard of the Expedited Approval Program. The facility said 
they had not heard of the program.).
    \50\Email from Dep't of Homeland Sec. to Comm. majority staff (Oct. 
24, 2018) (on file with Committee majority staff).
---------------------------------------------------------------------------

S. 3405 Requires DHS to provide greater regulatory relief for companies 
        that participate in the CFATS Recognition Program

    During the Committee's June 12, 2018, roundtable, six 
representatives from the chemical industry expressed their 
support for greater regulatory relief for covered chemical 
facilities that participate in industry-led best practices or 
recognition programs and exceed compliance of CFATS security 
standards. Currently, the chemical industry has a variety of 
stewardship programs, which assist facilities in complying with 
various standards and regulations, including health, 
environmental, safety, and security.\51\ At the roundtable, 
industry and participating facilities described the potential 
benefits of creating a CFATS Recognition Program to provide 
covered facilities participating in current and future industry 
stewardship programs additional regulatory relief. Randall 
Eppli of Columbus Chemical Industries, a chemical facility 
headquartered in Columbus, Wisconsin, explained that companies 
that participate in verified industry security standard 
programs ``have made a strong commitment to operate their 
facilities safely and securely,'' and argued that, 
``[r]ecognizing these responsible companies through simple 
measures like less frequent inspections would allow DHS to 
prioritize resources to concentrate on the outliers' or bad 
actors who don't participate in these programs that may pose a 
greater security risk to themselves or the population at 
large.''\52\
---------------------------------------------------------------------------
    \51\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (statement of William Erny, Senior Director, 
American Chemistry Council), available at https://www.hsgac.senate.gov/
hearings/roundtable_-examining-the-chemical-facility-anti-terrorism-
standards-program; see also Responsible Care, American Chemistry 
Council, https://responsiblecare.americanchemistry. &fnl;com/.
    \52\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (written testimony of Randall Eppli, President 
and CEO, Columbus Chemical Industries, Inc.).
---------------------------------------------------------------------------
    Justin Louchheim, Director of Government Affairs at The 
Fertilizer Institute (TFI), which represents both large and 
small fertilizer companies nationwide, highlighted 
ResponsibleAg, the agricultural retailers' industry compliance 
program that assists in ensuring its members comply with 
various Federal regulations, including CFATS, as an example of 
an Industry-led program that should be eligible for a CFATS 
Recognition Program.\53\ According to Mr. Louchheim, ``[t]o 
date, over 2,500 facilities are registered with the 
ResponsibleAg program, over 1,000 of these facilities have been 
certified, 185 auditors have been trained, and almost 2,000 
audits have been completed.''\54\
---------------------------------------------------------------------------
    \53\Id. (written testimony of Justin Louchheim, Director of 
Government Affairs, The Fertilizer Institute).
    \54\Id.
---------------------------------------------------------------------------
    William Erny, Senior Director of the American Chemistry 
Council, which represents major chemical producers and 
businesses within the chemistry field, also expressed support 
for the concept of a recognition program: ``DHS can provide 
regulatory recognition for responsible operators that 
demonstrate superior performance and who exceed regulatory 
compliance. Such a program would incentivize the implementation 
of existing industry stewardship programs-and the creation of 
new ones where necessary--thus enhancing chemical security 
across the sector and beyond the universe of CFATS regulated 
facilities.''\55\
---------------------------------------------------------------------------
    \55\Id. (written testimony of William Erny, Senior Director, 
American Chemistry Council).
---------------------------------------------------------------------------
    DHS told the Committee that encouraging industry security 
best practices through a recognition program would enhance 
security. Specifically, David Wulf, then Acting Deputy 
Assistant Secretary for Infrastructure Protection, stated that 
industry stewardship programs ``do great work, and they raise 
the bar for security . . . not only at the 10 percent or so of 
facilities that find themselves covered under CFATS but at 
those other 90 percent.''\56\ Mr. Wulf also said they are 
``very interested in working with the Committee on prospects 
for ways in which we can recognize those programs within CFATS, 
whether that is the ability to place facilities that are in 
good standing with those programs on a . . . less frequent 
inspection cycle, or other ways of recognizing.''\57\
---------------------------------------------------------------------------
    \56\Id. (statement of David Wulf, Acting Deputy Assistant Sec'y for 
Infrastructure Protect., Nat'l Prot. and Programs Directorate U.S. 
Dep't of Homeland Sec.).
    \57\Id.
---------------------------------------------------------------------------
    S. 3405 requires the establishment of a CFATS Recognition 
Program within 270 days of enactment that will leverage 
industry stewardship programs to better secure covered chemical 
facilities. Specifically, the bill requires the Secretary of 
Homeland Security to establish criteria for the CFATS 
Recognition Program, minimum eligibility criteria for industry 
stewardship programs that would like to participate, and 
performance requirements for participating facilities within 
nine months of the bill's passage. S. 3405 also requires the 
Secretary of Homeland Security to establish program incentives 
for participation in the CFATS Recognition Program. This 
includes a reduction in the frequency of compliance 
inspections; streamlined processes for vulnerability 
assessments and site security plans; and any additional 
regulatory relief determined appropriate. The Committee expects 
that DHS will work with industry to develop the CFATS 
Recognition Program and ensure facilities are aware of how they 
can use it.

S. 3405 Requires DHS to reduce the frequency of audits and inspections

    The purpose of a compliance inspection is to ensure covered 
facilities are completely implementing their security 
measures.\58\ According to the Department, 3,995 Compliance 
Inspections have been conducted since the program's 
inception.\59\ On average, the frequency of audits and 
inspections take place every 18 months to two years.\60\
---------------------------------------------------------------------------
    \58\U.S. Dep't of Homeland Sec., Chemical Facility Anti-Terrorism 
Standards: Compliance Inspection (CI) (2017), available at https://
www.dhs.gov/sites/default/files/publications/fs-cfats-compliance-
inspection-508_0.pdf.
    \59\Dep't of Homeland Sec., CFATS Monthly Statistics (2018), 
available at https://www.dhs.gov/cfats-monthly-statistics.
    \60\Comm. majority and minority staff meeting with Dep't of 
Homeland Sec. (Sept. 18, 2018).
---------------------------------------------------------------------------
    This legislation changes the frequency of CFATS audits and 
inspections to be more in line with other Federal regulatory 
inspection regimes. Under the Safe Explosives Act, for example, 
ATF is required to inspect storage magazines of every licensee 
at least once every three years.\61\ Under the Clean Air Act, 
the Environmental Protection Agency (EPA) is required to 
conduct a full ``compliance evaluation at title V major 
facilities once every two federal fiscal years; at mega-sites, 
which are the largest title V major facilities, once every 
three federal fiscal years; and at SM-80s once every five 
federal fiscal years.''\62\ Under the Clean Water Act, the EPA 
inspects major facilities at least once every two years and 
non-major facilities at least once every five years.\63\ Under 
the Resource Conservation and Recovery Act, large quantity 
generators are inspected by the EPA every five years.\64\ Under 
the Department of Labor's Occupational Safety and Health 
Administration process safety management standards, compliance 
audits of highly hazardous chemicals are conducted at least 
every three years.\65\
---------------------------------------------------------------------------
    \61\Safe Explosives Act, Pub. L. No. 107-296, Sec. 116 Stat. 2280 
(2002).
    \62\U.S. Envtl. Prot. Agency, State Compliance Monitoring 
Expectations (2018), available at https://echo.epa.gov/trends/
comparative-maps-dashboards/state-compliance-monitoring-expectations.
    \63\Id.
    \64\Id.
    \65\U.S. Dep't of Labor, Occupational Safety and Health 
Administration, OSHA 3132, Process Safety Management (2000), available 
at https://www.osha.gov/Publications/osha3132.pdf.
---------------------------------------------------------------------------
    Under S. 3405, covered chemical facilities cannot be 
inspected more frequently than once every two years. This 
codifies the two-year duration of DHS's current practice\66\ 
and will also help increase efficiency. In addition, under S. 
3405, those companies participating in a CFATS recognition 
program that meet compliance, audit, and inspection 
requirements cannot be inspected more frequently than once 
every three years. However, the Secretary may conduct more 
frequent audits and inspections for specific reasons, including 
when: the facility has identified planned enhancements that 
have not been verified; the facility commits a deficiency or 
infraction that could result in an enforcement action; the 
Department has identified a specific or elevated threat; 
suspicious activity or a security incident has occurred at the 
facility; or the Secretary determines, due to exigent 
circumstances, that an inspection or audit is needed.
---------------------------------------------------------------------------
    \66\Comm. majority and minority staff meeting with Dep't of 
Homeland Sec. (Sept. 18, 2018).
---------------------------------------------------------------------------

S. 3405 Improves the Personnel Surety Program

    Under RBPS-12, covered facilities are required ``to account 
for four types of background checks on facility personnel and 
unescorted visitors who have or are seeking access to 
restricted areas, critical assets, and chemicals of interest at 
high-risk facilities.''\67\ The purpose of these background 
checks are to confirm a person's identity; check for any 
criminal history; certify legal authorization to work at the 
facility; and identify individuals with terrorist 
connections.\68\
---------------------------------------------------------------------------
    \67\U.S. Dep't of Homeland Sec., CFATS Personnel Surety Program 
(last updated Aug. 22, 2018), available at https://www.dhs.gov/cfats-
personnel-surety-program.
    \68\Id.
---------------------------------------------------------------------------
    Currently, only Tier 1 and Tier 2 facilities are required 
to screen for individuals with terrorists connections through 
the Personnel Surety Program (PSP).\69\ Under RBPS-12, frequent 
vetting of individuals' information against the Terrorist 
Screening Database is required.\70\ The Terrorist Screening 
Database is administered by the FBI and supports Federal 
agencies in detecting known or suspected terrorists.\71\ 
Facilities can submit an individual's information to DHS in 
different ways to screen an individual against the Terrorist 
Screening Database. This includes via DHS's online portal; 
directly verifying an individual's enrollment in an existing 
DHS program; utilizing an electronic reader to verify 
credentials; or using another Federal screening program that 
operates the Terrorist Screening Database.\72\
---------------------------------------------------------------------------
    \69\Id.
    \70\Comm. majority and minority staff briefing with Dep't of 
Homeland Sec. (June 1, 2018) (briefing notes on file with Comm. 
majority staff).
    \71\Fed. Bureau of Investigations, Leadership and Structure, 
Terrorist Screening Center, available at https://www.fbi.gov/about/
leadership-and-structure/national-security-branch/tsc.
    \72\CFATS Personnel Surety Program supra note 67.
---------------------------------------------------------------------------
    On December 27, 2017, DHS posted a notice in the Federal 
Register seeking comment on its proposal to extend the PSP 
terror screening requirements to Tier 3 and Tier 4 
facilities.\73\ Industry has voiced concerns with this proposed 
expansion.\74\ According to written testimony from Mr. Erny of 
the American Chemistry Council (ACC),
---------------------------------------------------------------------------
    \73\Chemical Facility Anti-Terrorism Standards Personnel Surety 
Program, 82 Fed. Reg. 61312 (proposed Dec. 27, 2017) (to be codified in 
C.F.R. pt. 6), available at https://www.federalregister.gov/documents/
2017/12/27/2017-27519/chemical-facility-anti-terrorism-standards-
personnel-surety-program.
    \74\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36.

        such an expansion of the PSP program is unnecessary and 
        will needlessly put personal employee information at 
        risk. ACC believes the benefit associated with 
        [Terrorist Screening Database] vetting is simply not 
        worth the cost or the risk. While we support [Terrorist 
        Screening Database] vetting at high risk Tier 1 and 2 
        facilities, ACC recommends elimination of this 
        requirement for lower risk Tiers 3 and 4 facilities, or 
        could be an option for those who choose to 
        participate.\75\
---------------------------------------------------------------------------
    \75\Id. (written testimony of William Erny, Senior Director 
American, Chemistry Council).

Additionally, Mr. Louchheim from the The Fertilizer Institute 
stated that this is an ``exponential expansion of the program 
from the less than 200 facilities presently covered to more 
than 3,500. Many of the 1,500 or so agricultural retail 
facilities are not equipped to implement this program at this 
time.''\76\
---------------------------------------------------------------------------
    \76\Id. (written testimony of Justin Louchheim, Director, 
Government Affairs The Fertilizer Institute).

    All covered CFATS facilities are required to run background 
checks to confirm a person's identity; check for any criminal 
history; and certify legal authorization to work at the 
facility.\77\ Committee majority staff oversight and review of 
DHS's data on the use of the terror screening strategy suggests 
that it is not effective in achieving DHS's purported personnel 
security objectives.\78\ Industry standard background checks 
plus the additional background checks required under RBPS-12 
for all covered facilities eliminates the need to require 
terror screening at lower-risk Tier 3 and Tier 4 facilities.
---------------------------------------------------------------------------
    \77\U.S. Dep't of Homeland Sec., CFATS Personnel Surety Program 
(last updated Aug. 22, 2018), available at https://www.dhs.gov/cfats-
personnel-surety-program.
    \78\Comm. majority staff briefing with Dep't of Homeland Sec. (July 
24, 2018) (briefing notes on file with Comm. majority staff).
---------------------------------------------------------------------------
    S. 3405 makes clear that terror screening must be conducted 
by all Tier 1 and Tier 2 covered facilities, consistent with 
the policy that was implemented during the Obama Administration 
in 2015,\79\ but is only optional for all Tier 3 and Tier 4 
covered facilities.
---------------------------------------------------------------------------
    \79\Dep't of Homeland Sec., Chemical Facility Anti-Terrorism 
Standards: RBPS 12(iv)--Screening for Terrorist Ties (2017), available 
at https://www.dhs.gov/sites/default/files/publications/fs-rbps-12iv-
psp-508.pdf.
---------------------------------------------------------------------------

S. 3405 Requires DHS to be more transparent regarding changes in 
        facility tiering

    In 2013, outside industry and government experts conducted 
a review of the CFATS risk-tiering methodology and provided 
findings and recommendations to DHS.\80\ The review determined 
that DHS needed to develop an enhanced tiering methodology to 
more adequately assign risk to chemical facilities.\81\ In 
2016, DHS introduced a new tiering methodology and notified all 
chemical facilities potentially subject to CFATS regulations to 
submit information through a new online tool, the Chemical 
Security Assessment Tool (CSAT) 2.0.\82\ In April 2017, DHS, 
using its new, enhanced methodology, began notifying facilities 
of their CFATS program tier.\83\ The Department continues to 
notify facilities of their tiering status on a rolling basis as 
new facilities submit Top-Screens or currently regulated 
facilities update their chemical holdings.\84\
---------------------------------------------------------------------------
    \80\Dep't of Homeland Sec., CFATS Tiering Methodology (2018), 
available at https://www.dhs.gov/cfats-tiering-methodology.
    \81\Id.
    \82\Id.
    \83\Id.
    \84\Id.
---------------------------------------------------------------------------
    According to DHS, ``some facilities have seen a change in 
their tier. Some facilities that were previously not covered 
under CFATS found themselves covered, and some previously-
covered facilities are no longer considered high-risk.''\85\
---------------------------------------------------------------------------
    \85\Id.
---------------------------------------------------------------------------
    During the Committee's roundtable in June 2018, 
representatives of the chemical industry discussed these 
changes in tiering and the need for DHS to be more transparent 
regarding methodology changes.\86\ For example, Linda Menendez, 
Director of Operations for Austin Powder, an explosives company 
headquartered in Cleveland, Ohio, explained the company had a 
facility ``that was previously tiered a 2, requiring us to 
implement all of these security measures. When CFATS 2.0 came 
about we had to re-tier. We dropped to a Tier 3, with no 
explanation. We had no change in the facility, no change in the 
chemicals, no change in the quantity of the chemicals, and we 
dropped down to a Tier 3.''\87\
---------------------------------------------------------------------------
    \86\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36.
    \87\Id. (statement of Linda Menendez, Dir. of Operations, Austin 
Powder Co.).
---------------------------------------------------------------------------
    Mr. Erny from the American Chemistry Council called for 
greater transparency and information sharing when DHS changes a 
facility's tiering level: ``Often times the facility security 
director--the very person with the overall responsibility and 
authority for making critical security risk management 
decisions for the site--is not aware of the determining 
factor(s) behind the assigned risk tier level.''\88\ Mr. 
Louchheim from The Fertilizer Institute also explained that 
``some TFI facilities were reclassified into a higher risk 
classification. What was not clear to TFI members, was the 
underlying basis for the new categorizations. We believe this 
should be a more transparent effort between DHS and individual 
facilities, allowing for a more thorough discussion of the 
security risks posed by individual facilities. This could 
ultimately bolster the quality of site security plans.''\89\ If 
facilities receive information as to why their tier changed, 
they will have an actual understanding of the current and 
changing risks their facilities pose to their employees and 
surrounding communities. This can result in facilities taking 
additional security measures or reducing their chemical 
inventories.
---------------------------------------------------------------------------
    \88\Id. (written testimony of William Erny, Senior Dir., Ame. 
Chemistry Council).
    \89\Id. (written testimony of Justin Louchheim, Dir. of Gov't 
Affairs, Fertilizer Institute).
---------------------------------------------------------------------------
    S. 3405 includes changes to the CFATS program to increase 
transparency between DHS and the regulated chemical facilities. 
Specifically, the bill requires the Secretary of Homeland 
Security to submit a controlled unclassified\90\ statement to 
facilities within 30 days on why their tier changed or they are 
no longer regulated under CFATS.
---------------------------------------------------------------------------
    \90\This is defined as sensitive, but not classified, information.
---------------------------------------------------------------------------

S. 3405 Requires DHS to improve the metrics it uses to evaluate program 
        success

    Prior to the 2014 reauthorization, the Committee's then-
Ranking Member, Senator Coburn, issued a report about the CFATS 
program, and included a finding that ``without better metrics 
DHS has no way of knowing [if] CFATS is improving security and 
reducing the risk of terrorist attack[s].''\91\ Senator 
Coburn's report concluded that DHS must implement metrics ``to 
show to the private sector and Congress CFATS is improving 
chemical security at high risk chemical facilities, the 
facilities being regulated are truly high risk, CFATS reflects 
plausible attack scenarios, and the program is not merely 
shifting risk elsewhere.''\92\
---------------------------------------------------------------------------
    \91\Sen. Tom Coburn of Sen. Comm. on Homeland Sec. & Governmental 
Affairs, 113th Cong., Chemical Insecurity, (Comm. Print 2014), 
available at https://www.hsgac.senate.gov/imo/media/doc/
Chemical_Insecurity.pdf.
    \92\Id.
---------------------------------------------------------------------------
    To help Congress more effectively evaluate whether the 
CFATS program was improving, the 2014 legislation required DHS 
to biannually report to Congress on the program's performance 
and include metrics to assist in its oversight of the 
program.\93\ However, because the program had implementation 
issues, the metrics required under the 2014 legislation did not 
address risk reduction and instead looked at basic program 
implementation metrics. For example, DHS was required to 
provide metrics on how many compliance or authorization 
inspections were completed during the reporting period and how 
many inspectors attended each inspection on average.\94\
---------------------------------------------------------------------------
    \93\Protecting and Securing Chemical Facilities from Terrorist 
Attacks Act of 2014, Pub. L. No. 113-254, Sec. 128 Stat. 2898 (2014).
    \94\Id.
---------------------------------------------------------------------------
    Through its oversight, the Committee has found that these 
basic data points were not sufficient to address the degree to 
which CFATS was materially reducing terrorism risks. At the 
June 12, 2018 Committee roundtable, GAO representative 
Christopher Currie stated that ``measuring risk reduction or 
the security benefit [of the CFATS program] is really 
difficult. It is hard to do that with just outputs. So I think 
we need to continue to push DHS to try to measure across the 
country how we are reducing risk.''\95\ An August 2018 GAO 
report confirmed this statement, finding that DHS does not 
evaluate or measure vulnerability reduction.\96\ GAO emphasized 
that ``[d]oing so would provide DHS an opportunity to begin 
assessing how vulnerability is reduced--and by extension, risk 
lowered--not only for individual high-risk facilities but for 
the CFATS program as a whole.''\97\
---------------------------------------------------------------------------
    \95\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (statement of Christopher Currie, Dir., Homeland 
Sec. & Justice Team, U.S. Gov't Accountability Office).
    \96\U.S. Gov't Accountability Office, GAO-18-538, Critical 
Infrastructure Protection (2018), available at https://www.gao.gov/
assets/700/693817.pdf.
    \97\Id.
---------------------------------------------------------------------------
    S. 3405 includes language to update the CFATS program 
metrics requirements. New metrics include how effective CFATS 
is at managing security risks and measuring risk reduction. The 
updated requirements push DHS to evolve its very basic program 
metrics to more advanced risk-focused metrics to measure 
program effectiveness and risk reduction. The Committee is 
directing DHS to measure and demonstrate actual risk reduction, 
if any, provided by CFATS, and benefits, if any, for the money 
spent by U.S. taxpayers on the CFATS program. The metrics 
reporting period is also increased from six months to one year 
to allow the Department more time to focus on the report.

S. 3405 Modifies the petition process for the exemption of covered 
        products or mixtures

    DHS has voiced concerns to the Committee regarding the 
petition process for the exemption of covered chemical products 
or mixtures. DHS officials explained that there have been 
instances when mixtures of multiple chemicals include one 
chemical of interest, but in that mixture do not present the 
same hazard as the original form of the chemical of interest 
listed under Appendix A.\98\ As a result, the mixture is no 
longer a chemical of interest and therefore will not be subject 
to CFATS regulation.
---------------------------------------------------------------------------
    \98\Comm. majority and minority staff briefing with Dep't of 
Homeland Sec. (Sept. 18, 2018) (briefing notes on file with Comm. 
majority staff).
---------------------------------------------------------------------------
    Based on the Department's feedback, S. 3405 includes 
language for an interested party to petition DHS to exempt 
certain chemical mixtures that no longer pose the same hazard 
as a pure CFATS chemical of interest listed under Appendix A. 
If, during processing, the pure CFATS chemical of interest is 
converted to a new chemical compound that is no longer a 
security risk, the company may petition DHS for an exemption on 
the final chemical product.\99\ DHS can then review the 
petition and the technical basis for the exemption request. 
Following DHS's review, DHS will make a final decision on 
whether or not to exempt the final chemical product, and notify 
the petitioner of the decision.
---------------------------------------------------------------------------
    \99\Comm. majority staff phone briefing with Dep't of Homeland Sec. 
(Oct. 29, 2018) (notes on file with Comm. majority staff).
---------------------------------------------------------------------------

S. 3405 Reduces duplicative regulations by exempting regulated 
        explosive materials from CFATS

    A number of facilities are excluded from the CFATS program 
to prevent facilities from being subject to duplicative or 
contradictory regulatory regimes. The Department of Homeland 
Security Appropriations Act of 2007 (and later the 2014 
Authorization) exempted facilities from the CFATS regulations 
when those facilities are:

        regulated pursuant to the Maritime Transportation 
        Security Act of 2002, Public Law 107-295, as amended; 
        Public Water Systems, as defined by section 1401 of the 
        Safe Drinking Water Act, Public Law 93-523, as amended; 
        Treatment Works as defined in section 212 of the 
        Federal Water Pollution Control Act, Public Law 92-500, 
        as amended; any facility owned or operated by the 
        Department of Defense or the Department of Energy, or 
        any facility subject to regulation by the Nuclear 
        Regulatory Commission.\100\

    \100\Department of Homeland Security Appropriations Act, 2007 Pub. 
L. N. 109-29, Sec. 120 Stat. 138 (2007); Protecting and Securing 
Chemical Facilities from Terrorist Attacks Act of 2014, Pub. L. No. 
113-254, Sec. 128 Stat. 2898 (2014).

    S. 3405 maintains these exemptions. The CFATS program also 
overlaps with the ATF's regulation of facilities used to store 
certain explosive materials. Explosive materials are regulated 
by ATF under the Organized Crime Control Act of 1970 and the 
Safe Explosive Act of 2002.\101\ When CFATS regulations were 
established in 2007, explosive materials became regulated by 
both the ATF and DHS.\102\
---------------------------------------------------------------------------
    \101\See generally Organized Crime Control Act of 1970 18 U.S.C.A. 
Sec. 842; Safe Explosives Act, Pub. L. No. 107-296, Sec. 116 Stat. 2280 
(2002).
    \102\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (written statement of Debra Satkowiak, 
President, Institute of Makers of Explosives).
---------------------------------------------------------------------------
    Under the Organized Crime Control Act of 1970, ATF annually 
publishes a list of explosive materials that it is responsible 
for regulating.\103\ As of December 28, 2017, there are 238 
explosive materials on ATF's annual Notice of List of Explosive 
Materials.\104\ CFATS currently regulates 322 chemicals of 
interest.\105\ Thirty-four explosive materials are regulated by 
both ATF and CFATS.\106\ In practice, this means that companies 
with facilities that are covered by both the CFATS and ATF 
regulatory regimes must comply with specific aspects of the 
program that are duplicative, such as background checks, 
inspections, and reviews of physical security measures. 
Companies must spend additional time (30.5 hours) to complete 
DHS's Top Screens in addition to ATF's permitting applications 
and submit duplicative reporting of potential security 
incidents to both agencies.\107\
---------------------------------------------------------------------------
    \103\See Commerce in Explosives; 2017 Annual List of Explosive 
Materials, 56 Fed. Reg. 248 (Proposed Dec. 28, 2017), available at 
https://www.gpo.gov/fdsys/pkg/FR-2017-12-28/pdf/2017-28010.pdf.
    \104\Id.
    \105\Frank Gottron, supra note 8.
    \106\Comm. majority staff analysis of ATF's annual Notice of List 
of Explosive Materials and CFATS Appendix A chemicals of interest.
    \107\Comm. majority staff analysis of DOJ and ATF's explosive 
regulations and DHS's CFATS regulations.
---------------------------------------------------------------------------
    The duplicative regulations come at a significant and 
unnecessary cost to the explosives industry. According to four 
case studies conducted by the Institute of Makers of Explosives 
(IME), ``for the four sites reviewed, the total expected 
compliance cost reached over $2.6 Million; a sum that saw no 
proportionate increase in facility security.''\108\ In addition 
to increasing costs, the duplicative regulations have also 
resulted in potential safety issues. For example, ``[o]ne 
facility, also regulated by the Department of Defense (DoD) and 
ATF, was asked to run electricity to a mandated no-spark 
environment.''\109\ This is a safety hazard as electricity 
cannot be within a certain range of explosives. ``The result 
was the imposition of massive cost, upwards of $500,000, to run 
underground electricity in accordance with DoD regulations or 
put in place round-the-clock in-person surveillance over 
multiple storage sites, which carried with it an estimated cost 
of $3 [million].''\110\
---------------------------------------------------------------------------
    \108\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (written statement of Debra Satkowiak, 
President, Institute of Makers of Explosives).
    \109\Id.
    \110\Id.
---------------------------------------------------------------------------
    At the Committee's June 12, 2018 roundtable, Ms. Menendez 
testified about Austin Powder's experience complying with both 
regulatory regimes and the costs imposed to specific explosive 
facilities because they are also regulated by CFATS.\111\ For 
example, one Austin Powder facility went from not being a 
CFATS-covered facility in 2008 to being a Tier 2 after 
submitting a Top Screen in 2013.\112\ To comply with Tier 2 
RBPS, Austin Powder spent $325,000 on labor and implementation 
costs and has an annual expense of $70,000 for contracted 
monitoring services.\113\ Another Austin Powder facility not a 
CFATS-covered facility in 2008, but after Top Screen 
submissions in 2015 and 2017 it became a Tier 3 facility. Costs 
to comply with Tier 3 RBPS totaled $837,400 with an additional 
annual recurring expense.\114\
---------------------------------------------------------------------------
    \111\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36.
    \112\Id. (written testimony of Linda Menendez, Dir. of Operations, 
Austin Powder Co.).
    \113\Id.
    \114\Id.
---------------------------------------------------------------------------
    Data and information provided to the Committee by the 
explosives industry shows that the CFATS program does not 
appear to have resulted in any change in the number of thefts 
of explosives, which raises questions about whether the 
duplicative regulatory regime under CFATS is enhancing 
security.\115\ During the Committee's June 12, 2018 roundtable, 
Debra Satkowiak, President of IME explained:
---------------------------------------------------------------------------
    \115\Id. (written and oral statement of Debra Satkowiak, President, 
Institute of Makers of Explosives) (additional data and information on 
file with Comm. majority staff).

         IME found that while there has been a consistent and 
        remarkable reduction in thefts of explosives over the 
        last 30 plus years, there is no marked increase in that 
        rate of decline following the beginning of the CFATS 
        program. Clearly, the record shows that ATF regulations 
        and industry best practices effectively ensure security 
        of commercial explosives and prevent diversion for 
        criminal or other illicit use.\116\
---------------------------------------------------------------------------
    \116\Id. (written statement of Debra Satkowiak, President, 
Institute of Makers of Explosives).

    When discussing exempting explosive materials at the 
Committee's June 12, 2018 roundtable, Mr. Wulf, Acting Deputy 
Assistant Secretary for Infrastructure Protection, stated that 
DHS is ``sympathetic to the duplicative regulation situation. . 
. .''\117\
---------------------------------------------------------------------------
    \117\Id. (statement of David Wulf, Acting Deputy Assistant Sec'y 
for Infrastructure Prot., Nat'l Prot. & Programs Directorate U.S. Dep't 
of Homeland Sec.).
---------------------------------------------------------------------------
    S. 3405 exempts explosive materials regulated by DOJ under 
chapter 40 of title 18, United States Code, or by the ATF under 
part 555 of title 27, Code of Federal Regulations, as CFATS 
chemicals of interest. The bill also requires the Secretary of 
Homeland Security to remove any additional explosive material 
designated as a CFATS chemical of interest if it becomes 
regulated by DOJ or ATF in the future. For example, DHS will 
continue to regulate improvised explosive device precursor 
chemicals because ATF does not regulate the precursor 
chemicals.

S. 3405 Requires notice of proposed rulemaking before changes to 
        Appendix A

    As stated previously, Appendix A is a list of 322 chemicals 
of interest that are regulated under the CFATS program.\118\ 
The list has not been modified since its inclusion in the final 
rule on November 30, 2007.\119\ During the Committee's June 12, 
2018 roundtable, industry recommended clarifying the process 
required to make changes to Appendix A. For example, Jennifer 
Gibson, Vice President of Regulatory Affairs from the National 
Association of Chemical Distributors, suggested that:
---------------------------------------------------------------------------
    \118\Frank Gottron, supra note 8.
    \119\See generally Appendix to Chemical Facility Anti-Terrorism 
Standards, 6 Fed. Reg. pt. 2 (Nov. 20, 2007) available at https://
www.gpo.gov/fdsys/pkg/FR-2007-11-20/pdf/07-5585.pdf.

        any changes to the Appendix A list of chemicals remain 
        subject to notice and comment rulemaking. Changes to 
        this [chemicals of interest] list have major impacts on 
        many companies' businesses and security investments. 
        While changes may periodically be needed, it is 
        important to give the regulated community the 
        opportunity to provide information and explain the 
        impacts of any proposed changes.\120\
---------------------------------------------------------------------------
    \120\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (written statement of Jennifer Gibson, Vice 
President, Regulatory Affairs Nat'l Ass'n of Chem. Distrib.).

    Mr. Louchheim from The Fertilizer Institute also discussed 
the need for increased transparency in regards to Appendix A 
and how ``uncertainties could be remedied through a 
comprehensive notice and comment rulemaking.''\121\
---------------------------------------------------------------------------
    \121\Id. (written testimony of Justin Louchheim, Dir. of Gov't 
Affairs, Fertilizer Institute).
---------------------------------------------------------------------------
    This legislation requires the Secretary of Homeland 
Security to publish a notice of proposed rulemaking before 
making any changes to Appendix A, which will give industry the 
opportunity to comment. Changes include a chemical being added 
as a CFATS chemical of interest; a chemical being removed as a 
CFATS chemical of interest; or a modification of a CFATS 
chemical of interest's amount, concentration, or threshold 
quantity under Appendix A.

S. 3405 Requires DHS to more effectively assess the program's success

    The Committee's oversight in the 115th Congress has focused 
on whether the CFATS program effectively reduces risk and 
enhances national security.\122\ GAO recommended in August 2018 
that DHS take further action to measure risk reduction and 
national security benefits resulting from the CFATS 
implementation.\123\ GAO also found that ``DHS shares some 
CFATS information, but first responders and emergency planners 
may not have all of the information they need to minimize the 
risk of injury or death when responding to incidents at high-
risk facilities.''\124\ The GAO review also reported that DHS 
does not evaluate or measure vulnerability reduction.\125\
---------------------------------------------------------------------------
    \122\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36.
    \123\U.S. Gov't Accountability Office, GAO-18-538, Critical 
Infrastructure Protection (2018), available at https://www.gao.gov/
assets/700/693817.pdf.
    \124\Id.
    \125\Id.
---------------------------------------------------------------------------
    This legislation requires a third-party assessment to help 
address the issues raised by GAO. The assessment will address 
the CFATS program's effectiveness in managing security 
requirements and the Department's preparedness and response 
planning with first responders and emergency planners. It will 
also examine the development of metrics and capabilities to 
measure risk reduction.
    One area where additional improvement is needed, based on 
the Committee's oversight during the 115th Congress, is 
inspector training. During the Committee's June 2018 
roundtable, a CFATS chemical inspector, Jesse LeGros, Jr., 
provided insight on current issues with inspector 
training.\126\ For example, inspector training has been 
significantly shortened compared to the first formal inspector 
academy class, to the point where most training is now acquired 
on the job.\127\ According to Mr. LeGros, the Department has 
also ``hired a number of individuals with little to no physical 
security training or experience.''\128\ In addition, Mr. LeGros 
discussed a particular lack of cybersecurity training, which is 
covered under RBPS-8.\129\ The two limited classes provided to 
inspectors ``was about hackers and how they could access cyber 
systems''\130\ and ``did not get into the various technical 
aspects of the Cyber world or Cyber Security.''\131\ As a 
result, some inspectors have obtained additional cybersecurity 
training outside the inspector program.\132\ Although 
cybersecurity experts from DHS are available to assist 
inspectors when appropriate, the Department's Compliance Branch 
Chief\133\ recommends who should ultimately complete RBPS-
8.\134\ This has resulted in additional confusion for the 
chemical inspectors and has the potential to result in 
inconsistent compliance inspection results.\135\
---------------------------------------------------------------------------
    \126\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President, 
Infrastructure Prot., AFGE National Local #918).
    \127\Id. (written statement of Jesse LeGros, Jr. Vice President, 
Infrastructure Prote., AFGE National Local #918).
    \128\Id.
    \129\Id.; see also Dep't of Homeland Sec., Risk-Based Performance 
Standards (RBPS) (2018) available at https://www.dhs.gov/cfats-rbps.
    \130\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President, 
Infrastructure Prot., AFGE National Local #918).
    \131\Id.
    \132\Id.
    \133\Individuals responsible for overseeing, reviewing, and 
approving compliance inspections.
    \134\Roundtable: Examining the Chemical Facility Anti-Terrorism 
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental 
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President, 
Infrastructure Prot., AFGE National Local #918).
    \135\Id.
---------------------------------------------------------------------------
    S. 3405 requires GAO to submit a report to Congress on 
CFATS inspector training and how it can be improved. This 
includes information about how DHS selects inspectors; what 
training is completed before inspectors are selected as CFATS 
facility inspectors; a review of the qualification standards, 
on-the-job training, final qualification, approval standards, 
and continuous qualification and training; and issues with 
inspector cybersecurity training and how it can be further 
improved.
    Since the CFATS program was authorized in 2006, America's 
threat environment has changed. According to a recent report by 
the National Academies, ``[b]etween the 1970s and 2000, a 
series of larger vehicle bombs emerged in terrorist attacks 
with main charges in the thousands of pounds range, but in the 
following decade, bombs with smaller charges like those seen in 
the 1970s started to appear again. By the 2010s, the use of 
[homemade explosives] in smaller charges was growing.''\136\ In 
recent attacks in the U.S. and Europe, such as the Boston, 
Paris, and Brussels, terrorists have utilized smaller 
improvised explosive devices, such as backpack bombs.\137\ 
However, ``[p]ast research and regulatory efforts have tended 
to focus on the threat posed by [vehicle-borne improvised 
explosive devices (IEDs)], but attacks that employ [person-
borne IEDs] can have and have had serious consequences both 
domestically and internationally.''\138\
---------------------------------------------------------------------------
    \136\Nat'l Academies of Sciences, Engineering, and Medicine, 
Reducing the Threat of Improvised Explosive Device Attacks by 
Restricting Access to Explosive Precursor Chemicals 23 (2017), 
available at https://www.nap.edu/catalog/24862/reducing-the-threat-of-
improvised-explosive-device-attacks-by-restricting-access-to-explosive-
precursor-chemicals.
    \137\Id. at vii.
    \138\Id. at 2.
---------------------------------------------------------------------------
    This legislation requires DHS to provide an annual briefing 
to Congress on current threats to chemical facilities; how bad 
actors are utilizing CFATS chemicals of interest; how CFATS is 
addressing the threat landscape and making the United States 
safer; and data, rationale, and metrics on how the CFATS 
program is effectively reducing risk and enhancing security.
    In 2007, DHS completed an initial estimate that predicted 
the CFATS program would regulate 5,000 chemical facilities and 
have an economic cost of $8.5 billion over the period of 2006-
2015.\139\ To date, the Department has not completed an updated 
estimate. This legislation requires DHS to complete an updated 
retrospective estimate on costs to carry out the CFATS program.
---------------------------------------------------------------------------
    \139\Chemical Facility Anti-Terrorism Standards, 6 C.F.R. Sec. 27 
(2006), available at https://www.dhs.gov/xlibrary/assets/
IP_ChemicalFacilitySecurity.pdf.
---------------------------------------------------------------------------

S. 3405 Ends the program after five years

    The Committee continues to believe that putting a sunset on 
the program's authorization ensures that Congress can 
periodically review its effectiveness and make any necessary 
improvements. Accordingly, S. 3405 terminates the CFATS program 
five years after the date of enactment.

                        III. Legislative History

    On September 4, 2018, Chairman Johnson (R-WI) introduced S. 
3405, Protecting and Securing Chemical Facilities from 
Terrorists Attacks Act of 2018, which was referred to the 
Committee on Homeland Security and Governmental Affairs. 
Senators Shelley Moore Capito (R-WV) and Steve Daines (R-MT) 
are cosponsors.
    The Committee considered S. 3405 at a business meeting on 
September 26, 2018. During the business meeting, a modified 
substitute amendment was offered by Chairman Johnson and 
accepted by unanimous consent.
    Ranking Member McCaskill (D-MO) offered two amendments at 
the business meeting. McCaskill Amendment 1 as modified 
requires that the Secretary of Homeland Security determine 
which industry stewardship programs can participate in the 
CFATS Recognition Program. McCaskill Amendment 2 as modified 
clarified that only explosive materials regulated by ATF are 
exempt from CFATS. It also requires the removal of any 
additional explosive material that is designated as a CFATS 
chemical of interest if it becomes regulated by DOJ or ATF in 
the future. The Committee adopted McCaskill Amendment 1 as 
modified and McCaskill Amendment 2 as modified both by voice 
vote. Senators present for the votes on the amendments were: 
Johnson, Paul, Lankford, Enzi, Daines, McCaskill, Heitkamp, 
Peters, Hassan, Harris, and Jones.
    The Committee favorably reported the bill, as amended, by 
voice vote. Senators present were: Johnson, Portman, Paul, 
Lankford, Enzi, Daines, McCaskill, Heitkamp, Peters, Hassan, 
Harris, and Jones.
    Consistent with Committee Rule 11, the Committee reports 
the bill with a technical amendment by mutual agreement of the 
Chairman and Ranking Member.

        IV. Section-by-Section Analysis of the Bill, as Reported

Section 1. Short title; table of contents

    This section provides the bill's short title, the 
``Protecting and Securing Chemical Facilities from Terrorists 
Attacks Act of 2018'', and a table of contents.

Section 2. Definitions

    This section clarifies the definition of the term 
``guidance for expedited approval facilities''.

Section. 3. Expedited approval program

    This section requires the Secretary of Homeland Security to 
maintain guidance for the expedited approval program. This 
section also adds language that an owner or operator of a 
facility should consider, but is not required, to utilize the 
guidance for expedited approval facilities to determine 
appropriate security measures for site security plans.
    This section also shortens the length of the required 
notice period from 30 days to 7 days before a facility owner or 
operator may submit their expedited approval site security plan 
and certification to the Department.
    This section also requires that DHS notify all new and 
currently-covered CFATS facilities of the expedited approval 
program.

Section. 4. CFATS Recognition Program

    This section requires the Secretary of Homeland Security to 
establish a CFATS recognition program within 270 days of 
enactment that leverages industry stewardship programs to 
further secure covered chemical facilities. It also requires 
the Secretary to establish criteria for the CFATS recognition 
program, including industry stewardship program eligibility, 
performance requirements, incentives to encourage 
participation, and issue guidance.
    This section also requires the Secretary of Homeland 
Security to establish minimum eligibility criteria for industry 
stewardship programs that would like to participate in the 
program. The section mandates certain requirements, including 
industry stewardship programs be governed by an industry 
association or technical organization; documentation showing 
the industry stewardship program's top management is committed 
to chemical facility security; criteria for program auditing, 
security vulnerability assessment requirements, Risk-Based 
Performance Standards incorporated into security measures, and 
required reporting.
    This section also requires the Secretary of Homeland 
Security to establish facility performance requirements. This 
includes the facility submitting an acknowledgment by its 
sponsor industry stewardship organization that the facility is 
a member in good standing and in full compliance with the 
industry stewardship program's security requirements. It also 
requires a participating facility to notify the Secretary of 
Homeland Security if they cease to be in good standing or in 
full compliance with the requirements of the participating 
industry stewardship program.
    This section requires the Secretary of Homeland Security to 
establish program incentives for participation in the CFATS 
Recognition Program, including lowering the occurrence of 
compliance inspections; streamlining processes for 
vulnerability assessments and site security plans; and 
providing additional regulatory relief as appropriate.

Section. 5. Frequency of audits and inspections

    This section limits the frequency of CFATS facility audits 
and inspections to once every two years for a covered chemical 
facility and once every three years for a covered chemical 
facility participating in a CFATS recognition program that 
meets compliance, audit, and inspection requirements.
    This section stipulates that the Secretary may only conduct 
more frequent audits and inspections for the following reasons: 
a covered facility has identified planned enhancements that 
have not been verified; DHS identifies a deficiency or 
infraction that could result in an enforcement action against 
the facility; the Department has identified a specific or 
elevated threat to a chemical facility; a specific incident or 
suspicious activity occurred at the facility; or the Secretary 
determines there are exigent circumstances requiring an 
inspection or audit.

Section. 6. Personnel Surety Program

    This section makes terrorist screening provisions under the 
Personnel Surety Program mandatory for Tier 1 and Tier 2 
covered facilities and optional for Tier 3 and Tier 4 covered 
facilities.

Section. 7. Security risk assessment approach and corresponding tiering 
        methodology

    This section requires the Secretary of Homeland Security to 
maintain additional information on why DHS changed a covered 
facility's tier or DHS determines the covered facility should 
no longer be regulated under CFATS.
    Whenever DHS modifies a covered facilities tier or 
determines they should no longer be regulated by the CFATS 
program, this section also requires the Secretary to submit a 
controlled unclassified explanation for the change to 
facilities within 30 days.

Section. 8. Annual performance reporting

    This section requires the Secretary of Homeland Security to 
report annually to Congress on performance metrics, instead of 
every six months. It also requires DHS to report on how 
effectively the program manages security risks, develops and 
utilizes metrics, and its ability to measure risk reduction 
over time.

Section. 9. Specific products and mixtures containing chemicals of 
        interest

    This section gives the Secretary of Homeland Security sole 
and unreviewable discretion to review petitions from interested 
parties to remove a covered product or mixture from CFATS 
regulation if the Secretary determines that specific product or 
mixture does not present the same hazards for which the 
chemical of interest was originally designated under CFATS. 
Within one year of enactment, the Secretary must publish 
regulations on the petition process for which an interested 
party can request for an exclusion of a covered product or 
mixture.

Section. 10. CFATS regulations

    This section amends and provides technical edits to Section 
2107(b) of the Homeland Security Act of 2002 (6 U.S.C. 627(b)).

Section. 11. Explosive materials

    This section exempts explosive materials from the CFATS 
program if they are regulated by the Department of Justice 
under chapter 40 of title 18, United States Code, or by the ATF 
under part 555 of title 27, Code of Federal Regulations.
    This section also requires the Secretary of Homeland 
Security to remove any additional explosive material that is 
designated as a CFATS chemical of interest if it becomes 
regulated by DOJ or ATF in the future.

Section. 12. Changes to Appendix A to part 27 of title 6, Code of 
        Federal Regulations

    This section requires the Secretary of Homeland Security to 
publish a notice of proposed rulemaking before making changes 
to Appendix A if the Secretary determines that a chemical 
should now be designated as a CFATS chemical of interest; a 
chemical of interest under Appendix A should no longer be 
designated as a CFATS chemical of interest; or a CFATS chemical 
of interest's amount, concentration, or threshold quantity 
under Appendix A should be changed.

Section. 13. Assessment, report, briefing, and updated retrospective 
        estimate on costs

    This section requires a third-party assessment, within one 
year of enactment, to determine how effective the CFATS program 
is at managing security risks, developing and using appropriate 
metrics and analysis capabilities to measure risk reduction, 
and engaging with first responders and emergency planners. 
Within 90 days of the assessment's completion, the Secretary of 
Homeland Security must provide a briefing on the assessment to 
the Senate Committee on Homeland Security and Governmental 
Affairs, House Committee on Homeland Security, and House 
Committee on Energy and Commerce.
    This section requires a GAO report on CFATS inspector 
training and how it can be improved. The report should review 
how DHS selects inspectors; the amount of training completed 
before inspectors are selected as CFATS facility inspectors; 
review of qualification standards, on-the-job training, final 
qualification, approval standards, and continuous qualification 
and training; and improving inspector cybersecurity training.
    This section requires an annual briefing to Congress on 
current threats to chemical facilities; how bad actors are 
utilizing CFATS chemicals of interest; how CFATS is addressing 
the threat landscape and making the United States safer; and 
data, rationale, and metrics on how the CFATS program is 
effectively reducing risk and enhancing security.
    This section requires the Secretary of Homeland Security to 
complete an updated retrospective estimate on costs to carry 
out the CFATS program within one year of enactment. This 
includes costs to the Government, regulated entities, and the 
public.

Section. 14. Effective date

    This section states that the legislation, any amendments 
made by it, will take effect 30 days after the date of 
enactment.

Section. 15. Termination

    This section terminates the CFATS program five years after 
the date of enactment.

Section. 16. Technical and conforming amendment

    This section provides a technical and conforming amendment.

                   V. Evaluation of Regulatory Impact

    Pursuant to the requirements of paragraph 11(b) of rule 
XXVI of the Standing Rules of the Senate, the Committee has 
considered the regulatory impact of this bill and determined 
that the bill will have no regulatory impact within the meaning 
of the rules. The Committee agrees with the Congressional 
Budget Office's statement that the bill contains no 
intergovernmental or private-sector mandates as defined in the 
Unfunded Mandates Reform Act (UMRA) and would impose no costs 
on state, local, or tribal governments.

             VI. Congressional Budget Office Cost Estimate

                                     U.S. Congress,
                               Congressional Budget Office,
                                 Washington, DC, November 13, 2018.
Hon. Ron Johnson,
Chairman, Committee on Homeland Security and Governmental Affairs, U.S. 
        Senate, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for S. 3405, the Protecting 
and Securing Chemical Facilities from Terrorist Attacks Act of 
2018.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is William Ma.
            Sincerely,
                                                Keith Hall,
                                                          Director.
    Enclosure.

S. 3405--Protecting and Securing Chemical Facilities from Terrorist 
        Attacks Act of 2018

    Summary: S. 3405 would extend for five years the Chemical 
Facility Anti-Terrorism Standards (CFATS) program. CBO 
estimates that implementing the bill would cost $348 million 
over the 2019-2023 period, assuming appropriation of the 
estimated amounts.
    CBO also estimates that enacting S. 3405 would increase 
direct spending by $2 million and would increase revenues by an 
insignificant amount over the 2019-2028 period; therefore, pay-
as-you-go procedures apply.
    CBO estimates that enacting S. 3405 would not increase net 
direct spending or on-budget deficits in any of the four 
consecutive 10-year periods beginning in 2029.
    S. 3405 would impose intergovernmental and private-sector 
mandates as defined in the Unfunded Mandates Reform Act (UMRA) 
on operators of chemical facilities by reauthorizing existing 
security standards and duties under the CFATS program. CBO 
estimates the cost of the mandates would fall below the annual 
intergovernmental and private-sector thresholds established in 
UMRA ($80 million and $160 million in 2018, respectively, 
adjusted annually for inflation).
    Estimated cost to the Federal Government: The estimated 
budgetary effects of S. 3405 are shown in the following table. 
The costs of the legislation fall within budget functions 050 
(national defense) and 800 (general government).

----------------------------------------------------------------------------------------------------------------
                                    By fiscal year, in millions of dollars--
-----------------------------------------------------------------------------------------------------------------
                                                       2019      2020      2021      2022      2023    2019-2023
----------------------------------------------------------------------------------------------------------------
                                 INCREASES IN SPENDING SUBJECT TO APPROPRIATIONa
 
Estimated Authorization Level......................        60        74        76        79        81        370
Estimated Outlays..................................        46        69        75        78        80        348
 
                                          INCREASES IN DIRECT SPENDINGb
 
Estimated Budget Authority.........................         0         0         0         0         0          0
Estimated Outlays..................................         1         1         0         0         0          2
----------------------------------------------------------------------------------------------------------------
Enacting S. 3405 also would increase revenues by an insignificant amount over the 2019-2028 period.
a. Implementing S. 3405 would require an additional appropriation of $25 million in 2024, CBO estimates. Another
  $45 million in estimated outlays would occur over the 2024-2028 period, assuming appropriation of the
  estimated amounts.
b. Enacting S. 3405 would increase direct spending by $2 million over the 2019-2028 period.

    Basis of estimate: For this estimate, CBO assumes that S. 
3405 will be enacted near the beginning of calendar year 2019. 
Outlays are based on historical spending patterns for similar 
programs.

Spending subject to appropriation

    S. 3405 would extend the CFATS program for five years after 
the date of enactment; the authority to carry out the current 
program will expire in January 2019. Under CFATS, the 
Department of Homeland Security (DHS) regulates security at 
facilities that manufacture, store, or distribute any of more 
than 300 chemicals that could be used by terrorists to cause 
mass injury or death. The regulations set minimum standards for 
perimeter security, access control, personnel security, and 
cybersecurity to reduce the risk that those chemicals could be 
stolen, released, or sabotaged. DHS provides technical 
assistance and inspects regulated facilities to ensure that 
they meet those standards.
    For 2018, the Congress appropriated $72 million for the 
CFATS program. CBO estimates that the reauthorization in the 
bill would cover the last three quarters of fiscal year 2019 
through the end of the first quarter of fiscal year 2024; thus, 
the estimated amounts for CFATS in fiscal years 2019 and 2024 
cover only nine months and three months, respectively. On the 
basis of information from DHS, CBO estimates that implementing 
the program extension would cost $346 million over the 2019-
2023 period, assuming appropriation of the estimated amounts. 
Another $45 million would be spent after 2023.
    S. 3045 would require the Government Accountability Office 
and DHS to report to the Congress on the CFATS program. CBO 
estimates that in addition to the costs mentioned above, 
preparing those reports would cost $2 million over the 2019-
2023 period, CBO estimates.
    Actual costs could differ if the Congress appropriates more 
or less than the amounts estimated here; such decisions could 
be based on information from federal agencies or other sources 
that differs from the information CBO used for this estimate.

Direct spending

    Section 13 would require DHS to use appropriations that are 
available to the department under current law to obtain a 
third-party assessment of the effectiveness of the CFATS 
program. CBO expects that DHS would spend previously 
appropriated funds that would otherwise not be spent. Changes 
in outlays from enacted appropriations are classified as direct 
spending. On the basis of information from DHS, CBO estimates 
that the study would increase direct spending by $2 million 
over the 2019-2028 period.

Revenues

    Reauthorizing the CFATS program also would extend DHS's 
authority to levy civil penalties against owners or operators 
of facilities that fail to comply with orders to correct 
deficiencies in their security plans. Funds collected under 
that authority are deposited in the Treasury and recorded as 
revenues. CBO estimates that DHS would collect less than 
$500,000 over the 2019-2028 period.
    Pay-As-You-Go considerations: The Statutory Pay-As-You-Go 
Act of 2010 establishes budget-reporting and enforcement 
procedures for legislation affecting direct spending or 
revenues. The net changes in outlays and revenues that are 
subject to those pay-as-you-go procedures are shown in the 
following table.

    CBO ESTIMATE OF PAY-AS-YOU-GO EFFECTS FOR S. 3405, THE PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT OF 2018, AS ORDERED
                          REPORTED BY THE SENATE COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS ON SEPTEMBER 26, 2018
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                       By fiscal year, in millions of dollars--
                                                             -------------------------------------------------------------------------------------------
                                                                                                                                       2019-      2019-
                                                               2019   2020   2021   2022   2023   2024   2025   2026   2027   2028     2023       2028
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               NET INCREASE IN THE DEFICIT
 
Statutory Pay-As-You-Go Effect..............................      1      1      0      0      0      0      0      0      0      0         2          2
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Increase in long-term direct spending and deficits: CBO 
estimates that enacting S. 3405 would not increase net direct 
spending or on-budget deficits in any of the four consecutive 
10-year periods beginning in 2029.
    Mandates: S. 3405 would impose intergovernmental and 
private-sector mandates as defined in UMRA on operators of 
chemical facilities. The bill would reauthorize existing 
security requirements, including vulnerability assessments and 
site security plans, under the CFATS program. Because chemical 
facilities are already subject to these mandates, the cost to 
comply with the reauthorization would be small. The bill also 
would introduce alternative processes for meeting some 
requirements and would ease the stringency of requirements on 
lower-risk facilities. These changes would further reduce the 
costliness of the mandates. In total, CBO estimates that the 
cost of the mandates would fall below the annual 
intergovernmental and private-sector thresholds established in 
UMRA ($80 million and $160 million in 2018, respectively, 
adjusted annually for inflation).
    Estimate prepared by: Federal Costs: William Ma; Mandates: 
Andrew Laughlin.
    Estimate reviewed by: David Newman, Chief, Defense, 
International Affairs, and Veterans' Affairs Cost Estimates 
Unit; Susan Willie, Chief, Public and Private Mandates Unit; 
Leo Lex, Deputy Assistant Director for Budget Analysis.

       VII. Changes in Existing Law Made by the Bill, as Reported

    In compliance with paragraph 12 of rule XXVI of the 
Standing Rules of the Senate, changes in existing law made by 
the bill, as reported, are shown as follows: (existing law 
proposed to be omitted is enclosed in brackets, new matter is 
printed in italic, and existing law in which no change is 
proposed is shown in roman):

HOMELAND SECURITY ACT OF 2002

           *       *       *       *       *       *       *

SEC. 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Homeland 
Security Act of 2002.''
    (b) Table of Contents.--The table of contents for this Act 
is as follows:
Sec. 1. * * *
     * * * * * * *

           TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS

     * * * * * * *
Sec. 2103. Protection and sharing of information.[--]
     * * * * * * *
[Sec. 2109. Outreach to chemical facilities of interest.]
Sec. 2109. Explosive materials.
Sec. 2110. Changes to Appendix A to part 27 of title 6, Code of Federal 
          Regulations.

           *       *       *       *       *       *       *

         TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS

SEC. 2101. DEFINITIONS.

    In this title--
          (1) * * *

           *       *       *       *       *       *       *

          (8) the term ``guidance for expedited approval 
        facilities'' means the guidance issued under [section 
        2102(c)(4)(B)(i)] section 2102(c)(4) by the Secretary 
        that identifies specific security measures that are 
        sufficient to meet the risk-based performance standards 
        for facilities in tiers 3 and 4 that elect to utilize 
        the expedited approval program;

           *       *       *       *       *       *       *

SEC. 2102. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM.

    (a) * * *
    (b) * * *
    (c) Approval or Disapproval of Site Security Plans.--
          (1) * * *

           *       *       *       *       *       *       *

          (4) Expedited approval program.--
                  (A) In general.--A covered chemical facility 
                assigned to tier 3 or 4 may meet the 
                requirement to develop and submit a site 
                security plan under subsection (a)(2)(D) by 
                developing and submitting to the Secretary--
                          (i) a site security plan and the 
                        certification described in 
                        [subparagraph (C)] subparagraph (C)(i); 
                        or
                          (ii) * * *
                  (B) Guidance for expedited approval 
                facilities.--
                          (i) In general.--[Not later than 180 
                        days after the date of enactment of the 
                        Protecting and Securing Chemical 
                        Facilities from Terrorist Attacks Act 
                        of 2014, the Secretary shall issue] The 
                        secretary shall maintain guidance for 
                        expedited approval facilities that 
                        identifies specific security measures 
                        that are sufficient to meet the risk-
                        based performance standards.
                          (ii) * * *
                          [(iii) Applicability of other laws to 
                        development and issuance of initial 
                        guidance.--During the period before the 
                        Secretary has met the deadline under 
                        clause (i), in developing and issuing, 
                        or amending, the guidance for expedited 
                        approval facilities under this 
                        subparagraph and in collecting 
                        information from expedited approval 
                        facilities, the Secretary shall not be 
                        subject to--
                                  [(I) section 553 of title 5, 
                                United States Code;
                                  [(II) subchapter I of chapter 
                                35 of title 44, United States 
                                Code; or
                                  [(III) section 2107(b) of 
                                this title.]
                  (C) Certification.--[The owner]
                          (i) In general._The owner or operator 
                        of an expedited approval facility shall 
                        submit to the Secretary a 
                        certification, signed under penalty of 
                        perjury, that--
                                  [(i)] (I) the owner or 
                                operator is familiar with the 
                                requirements of this title and 
                                part 27 of title 6, Code of 
                                Federal Regulations, or any 
                                successor thereto, and the site 
                                security plan being submitted;
                                  [(ii)] (II) the site security 
                                plan includes the security 
                                measures required by subsection 
                                (b);
                                  [(iii)] (III)
                                  [(I)] (aa) the security 
                                measures in the site security 
                                plan do not materially deviate 
                                from the guidance for expedited 
                                approval facilities except 
                                where indicated in the site 
                                security plan;
                                  [(II)] (bb) any deviations 
                                from the guidance for expedited 
                                approval facilities in the site 
                                security plan meet the risk-
                                based performance standards for 
                                the tier to which the facility 
                                is assigned; and
                                  [(III)] (cc) the owner or 
                                operator has provided an 
                                explanation of how the site 
                                security plan meets the risk-
                                based performance standards for 
                                any material deviation;
                                  [(iv)] (IV) the owner or 
                                operator has visited, examined, 
                                documented, and verified that 
                                the expedited approval facility 
                                meets the criteria set forth in 
                                the site security plan;
                                  [(v)] (V) the expedited 
                                approval facility has 
                                implemented all of the required 
                                performance measures outlined 
                                in the site security plan or 
                                set out planned measures that 
                                will be implemented within a 
                                reasonable time period stated 
                                in the site security plan;
                                  [(vi)] (VI) each individual 
                                responsible for implementing 
                                the site security plan has been 
                                made aware of the requirements 
                                relevant to the individual's 
                                responsibility contained in the 
                                site security plan and has 
                                demonstrated competency to 
                                carry out those requirements;
                                  [(vii)] (VII) the owner or 
                                operator has committed, or, in 
                                the case of planned measures 
                                will commit, the necessary 
                                resources to fully implement 
                                the site security plan; and
                                  [(viii)] (VIII) the planned 
                                measures include an adequate 
                                procedure for addressing events 
                                beyond the control of the owner 
                                or operator in implementing any 
                                planned measures.
                          (ii) Risk-based performance 
                        standards.--In submitting a site 
                        security plan and certification under 
                        subparagraph (A)(i), an owner or 
                        operator of an expedited approval 
                        facility should consider using the 
                        guidance for expedited approval 
                        facilities to determine appropriate 
                        measures for the site security plan of 
                        the expedited approval facility.
                  (D) Deadline.--
                          (i) In general.--Not later than 120 
                        days after the date described in clause 
                        (ii), the owner or operator of an 
                        expedited approval facility shall 
                        submit to the Secretary the site 
                        security plan and the certification 
                        described in [subparagraph (C)] 
                        subparagraph (C)(i).
                          (ii) * * *
                          (iii) Notice.--An owner or operator 
                        of an expedited approval facility shall 
                        notify the Secretary of the intent of 
                        the owner or operator to certify the 
                        site security plan for the expedited 
                        approval facility not later than [30] 7 
                        days before the date on which the owner 
                        or operator submits the site security 
                        plan and certification described in 
                        [subparagraph (C)] subparagraph (C)(i).
                  (E) * * *
                  (F) Amendments to site security plan.--
                          (i) Requirement.--
                                  (I) In general.--If the owner 
                                or operator of an expedited 
                                approval facility amends a site 
                                security plan submitted under 
                                subparagraph (A), the owner or 
                                operator shall submit the 
                                amended site security plan and 
                                a certification relating to the 
                                amended site security plan that 
                                contains the information 
                                described in [subparagraph (C)] 
                                subparagraph (C)(i).
                                  (II) * * *
                  (G) * * *
                  (H) * * *
                  [(I) Evaluation.--
                          [(i) In general.--Not later than 18 
                        months after the date of enactment of 
                        the Protecting and Securing Chemical 
                        Facilities from Terrorist Attacks Act 
                        of 2014, the Secretary shall take any 
                        appropriate action necessary for a full 
                        evaluation of the expedited approval 
                        program authorized under this 
                        paragraph, including conducting an 
                        appropriate number of inspections, as 
                        authorized under subsection (d), of 
                        expedited approval facilities.
                          [(ii) Report.--Not later than 18 
                        months after the date of enactment of 
                        the Protecting and Securing Chemical 
                        Facilities from Terrorist Attacks Act 
                        of 2014, the Secretary shall submit to 
                        the Committee on Homeland Security and 
                        Governmental Affairs of the Senate and 
                        the Committee on Homeland Security and 
                        the Committee on Energy and Commerce of 
                        the House of Representatives a report 
                        that contains--
                                  [(I)(aa) the number of 
                                eligible facilities using the 
                                expedited approval program 
                                authorized under this 
                                paragraph; and
                                  [(bb) the number of 
                                facilities that are eligible 
                                for the expedited approval 
                                program but are using the 
                                standard process for developing 
                                and submitting a site security 
                                plan under subsection 
                                (a)(2)(D);
                                  [(II) any costs and 
                                efficiencies associated with 
                                the expedited approval program;
                                  [(III) the impact of the 
                                expedited approval program on 
                                the backlog for site security 
                                plan approval and authorization 
                                inspections;
                                  [(IV) an assessment of the 
                                ability of expedited approval 
                                facilities to submit facially 
                                sufficient site security plans;
                                  [(V) an assessment of any 
                                impact of the expedited 
                                approval program on the 
                                security of chemical 
                                facilities; and
                                  [(VI) a recommendation by the 
                                Secretary on the frequency of 
                                compliance inspections that may 
                                be required for expedited 
                                approval facilities.]
                  (I) Notice by the Secretary.--The Secretary 
                shall provide notice to each covered chemical 
                facility of the expedited approval program 
                under this paragraph.
          (5) CFATS recognition program.--
                  (A) Definitions.--In this paragraph--
                          (i) the term ``CFATS Recognition 
                        Program'' means the program established 
                        under subparagraph (B);
                          (ii) the term ``participating 
                        facility'' means a covered chemical 
                        facility that is a member of a 
                        participating industry stewardship 
                        program;
                          (iii) the term ``participating 
                        industry stewardship program'' means an 
                        industry stewardship program that--
                                  (I) meets the eligibility 
                                requirements under subparagraph 
                                (C)(i); and
                                  (II) is accepted by the 
                                Secretary to participate in the 
                                CFATS Recognition Program; and
                          (iv) the term ``sponsor 
                        organization'' means the governing body 
                        of a participating industry stewardship 
                        program.
                  (B) Establishment.--
                          (i) In general.--Not later than 270 
                        days after the date of enactment of 
                        this paragraph, the Secretary shall 
                        establish a program that shall be known 
                        as the CFATS Recognition Program--
                                  (I) with the goal of 
                                leveraging CFATS regulations 
                                and industry stewardship 
                                programs to further enhance 
                                security relating to hazardous 
                                chemicals; and
                                  (II) under which the 
                                Secretary shall--
                                          (aa) establish--
                                                  (AA) 
                                                eligibility 
                                                criteria under 
                                                subparagraph 
                                                (C)(i) for 
                                                industry 
                                                stewardship 
                                                programs 
                                                seeking to 
                                                Participate in 
                                                the CFATS 
                                                Recognition 
                                                Program; and
                                                  (BB) 
                                                performance 
                                                requirements 
                                                under 
                                                subparagraph(C)(
                                                ii) for 
                                                participating 
                                                facilities;
                                          (bb) provide 
                                        incentives under 
                                        subparagraph(C)(iii) to 
                                        Encourage participation 
                                        in the CFATS 
                                        Recognition Program; 
                                        and
                                          (cc) issue such 
                                        guidance as the 
                                        Secretary deems 
                                        necessary or 
                                        appropriate for the 
                                        implementation of the 
                                        CFATS Recognition 
                                        Program.
                          (ii) Applicability of other laws.--
                        During the period before the Secretary 
                        has met the deadline under clause (i), 
                        in developing and issuing, or amending, 
                        the guidance relating to carrying out 
                        the CFATS Recognition Program and 
                        collecting information from industry 
                        stewardship programs, sponsor 
                        organizations, and participating 
                        facilities, the Secretary shall not be 
                        subject to--
                                  (I) section 553 of title 5, 
                                United States Code;
                                  (II) subchapter I of chapter 
                                35 of title 44, United States 
                                Code; or
                                  (III) section 2107(b) of this 
                                Act.
                  (C) Eligibility criteria; facility 
                performance requirements; incentives.--
                          (i) Eligibility criteria for industry 
                        stewardship programs.--Not later than 
                        270 days after the date of enactment of 
                        this paragraph, the Secretary shall 
                        establish minimum eligibility criteria 
                        for industry stewardship programs 
                        desiring to be considered by the 
                        Secretary for participation in the 
                        CFATS Recognition Program that shall 
                        include--
                                  (I) a requirement that any 
                                industry stewardship program 
                                desiring to participate in the 
                                CFATS Recognition Program be 
                                governed by an industry 
                                association or technical 
                                organization that is an entity 
                                described in paragraph (3) or 
                                (6) of section 501(c) of the 
                                Internal Revenue Code of 1986;
                                  (II) a documented top 
                                management commitment to 
                                chemical facility security;
                                  (III) criteria relating to--
                                          (aa) program auditing 
                                        requirements and 
                                        frequency;
                                          (bb) security 
                                        vulnerability 
                                        assessment requirements 
                                        and frequency; and
                                          (cc) security 
                                        measures that align 
                                        with the risk-based 
                                        performance standards 
                                        established under 
                                        subsection (a)(2)(C), 
                                        including--
                                                  (AA) 
                                                detection 
                                                measures;
                                                  (BB) delay 
                                                measures;
                                                  (CC) 
                                                cybersecurity 
                                                measures;
                                                  (DD) response 
                                                measures; and
                                                  (EE) security 
                                                management; and
                                          (dd) reporting 
                                        required to be done by 
                                        any industry 
                                        stewardship program 
                                        desiring to participate 
                                        in the CFATS 
                                        Recognition Program.
                          (ii) Performance requirements for 
                        participating facilities.--The 
                        Secretary shall require that each 
                        participating facility--
                                  (I) submit an acknowledgment 
                                by the sponsor organization of 
                                the participating industry 
                                steward program, of which the 
                                participating facility is a 
                                member, that the participating 
                                facility is--
                                          (aa) a member in good 
                                        standing of the 
                                        participating industry 
                                        stewardship program; 
                                        and
                                          (bb) in full 
                                        compliance with the 
                                        requirements of the 
                                        participating industry 
                                        stewardship program; 
                                        and
                                  (II) promptly notify the 
                                Secretary if the participating 
                                facility ceases to be--
                                          (aa) a member in good 
                                        standing of the 
                                        participating industry 
                                        stewardship program; or
                                          (bb) in full 
                                        compliance with the 
                                        requirements of the 
                                        participating industry 
                                        stewardship program.
                          (iii) Program incentives.--Not later 
                        than 270 days after the date of 
                        enactment of this paragraph, the 
                        Secretary shall--
                                  (I) establish incentives for 
                                participation in the CFATS 
                                Recognition Program, which 
                                shall include--
                                          (aa) a reduction in 
                                        the frequency of 
                                        compliance inspections, 
                                        except--
                                                  (AA) in the 
                                                case of any 
                                                inspection 
                                                relating to any 
                                                planned measure 
                                                in the site 
                                                security plan 
                                                of a 
                                                participating 
                                                facility that 
                                                has not been 
                                                fully 
                                                implemented; or
                                                  (BB) in a 
                                                case in which a 
                                                participating 
                                                facility is not 
                                                in full 
                                                compliance with 
                                                the 
                                                requirements 
                                                under the 
                                                Chemical 
                                                Facility Anti-
                                                Terrorism 
                                                Standards 
                                                Program;
                                          (bb) streamlined 
                                        vulnerability 
                                        assessment and site 
                                        security plan 
                                        processes; and
                                          (cc) any other 
                                        regulatory relief as 
                                        determined appropriate 
                                        by the Secretary; and
                                  (II) provide written guidance 
                                on any incentive established 
                                under subclause (I).
                  (D) Evaluation.--Not later than 1 year after 
                the date on which the CFATS Recognition Program 
                is established under subparagraph (B)(i), the 
                Secretary shall provide a briefing to the 
                Committee on Homeland Security and Governmental 
                Affairs of the Senate and the Committees on 
                Homeland Security and Energy and Commerce of 
                the House of Representatives on the progress in 
                carrying out the CFATS Recognition Program.
    (d) Compliance.--
          (1) Audits and inspections.--
                  (A) * * *
                  (B) Authority to conduct audits and 
                inspections.--[The Secretary] Subject to 
                subparagraph (G), the Secretary shall conduct 
                audits or inspections under this subchapter 
                using--
                          (i) * * *
                          (ii) * * *
                          (iii) * * *

           *       *       *       *       *       *       *

                  (G) Frequency of audits and inspections.--
                          (i) In general.--Except as provided 
                        in clauses (ii) and (iii), the 
                        Secretary may not conduct any audit or 
                        inspection under this paragraph of a 
                        covered chemical facility more 
                        frequently than once every 2 years.
                          (ii) CFATS recognition program.--
                        Except as provided in clause (iii), in 
                        the case of a covered chemical facility 
                        that participates in the CFATS 
                        Recognition Program under subsection 
                        (c)(5) and meets compliance, audit, and 
                        inspection requirements under that 
                        program, the Secretary may not conduct 
                        any audit or inspection under this 
                        paragraph of that covered chemical 
                        facility more frequently than once 
                        every 3 years.
                          (iii) Increased frequency of audits 
                        and inspections.--The Secretary may 
                        conduct audits and inspections more 
                        frequently than provided in clauses (i) 
                        and (ii) when--
                                  (I) the covered chemical 
                                facility has identified planned 
                                enhancements that have not yet 
                                been validated by an audit or 
                                inspection;
                                  (II) a deficiency or 
                                infraction at the covered 
                                chemical facility has been 
                                identified that may result in 
                                an enforcement action against 
                                the covered chemical facility;
                                  (III) an elevated or specific 
                                threat has been identified;
                                  (IV) a security incident or 
                                suspicious activity has 
                                occurred at the covered 
                                chemical facility; or
                                  (V) the Secretary determines 
                                that an inspection or audit is 
                                warranted by exigent 
                                circumstances.
          (2) Personnel surety.--
                  (A) Personnel surety program.--For purposes 
                of this title, the Secretary shall establish 
                and carry out a Personnel Surety Program that 
                is mandatory for each owner or operator of a 
                covered chemical facility assigned to tier 1 or 
                2 and optional for each owner or operator of a 
                covered chemical facility assigned to tier 3 or 
                4 that--
                          (i) * * *
                          (ii) provides a participating owner 
                        or operator of a covered chemical 
                        facility with relevant information 
                        about an individual who will have 
                        access to any chemical of interest 
                        designated under Appendix A to part 27 
                        of title 6, Code of Federal 
                        Regulations, or any successor thereto, 
                        based on vetting the individual against 
                        the terrorist screening database, to 
                        the extent that such feedback is 
                        necessary for the facility to be in 
                        compliance with regulations promulgated 
                        under this title; and

           *       *       *       *       *       *       *

    (e) Responsibilities of the Secretary.--
          (1) * * *
          (2) Risk assessment.--
                  (A) In general.--For purposes of this title, 
                the Secretary shall [develop] maintain a 
                security risk assessment approach and 
                corresponding tiering methodology for covered 
                chemical facilities that incorporates the 
                relevant elements of risk, including threat, 
                vulnerability, and consequence.
                  (B) * * *
          (3) Changes in tiering.--
                  (A) * * *
                  (B) Required information.--The records 
                maintained under subparagraph (A) shall include 
                information on whether and how the Secretary 
                confirmed the information that was the basis 
                for the change or determination described in 
                subparagraph (A)[.], including--
                          (i) each input and assumption under 
                        the tiering methodology;
                          (ii) the rationale for each input; 
                        and
                          (iii) the output of the tiering 
                        methodology.
                  (C) Reports.--Not later than 30 days after 
                the Secretary makes a determination that 
                tiering for a covered chemical facility is 
                changed, or that a covered chemical facility is 
                no longer subject to the requirements under 
                this title, the Secretary shall submit to the 
                owner or operator of the covered chemical 
                facility a written report that contains--
                          (i) the information described in 
                        subparagraphs (A) and (B); and
                          (ii) a controlled unclassified 
                        statement--
                                  (I) of the criteria under 
                                paragraph (2)(B) and how the 
                                security risk of terrorism 
                                associated with the covered 
                                chemical facility was evaluated 
                                under those criteria; and
                                  (II) that includes any 
                                chemical terrorism 
                                vulnerability information (as 
                                defined in section 27.105 of 
                                title 6, Code of Federal 
                                Regulations, or any successor 
                                thereto) relating to the 
                                determination.
                  (D) Public disclosure.--Reports submitted to 
                the owner or operator of the covered chemical 
                facility to which the report pertains under 
                subparagraph (C) shall be protected from public 
                disclosure under section 2103.
          (4) [Semiannual] Annual performance reporting--Not 
        later than [6 months after the date] 1 year after the 
        date of enactment of the Protecting and Securing 
        Chemical Facilities from Terrorist Attacks Act of 
        [2014] 2018, and not less frequently than [once every 6 
        months] once each year thereafter, the Secretary shall 
        submit to the Committee on Homeland Security and 
        Governmental Affairs of the Senate and the Committee on 
        Homeland Security and the Committee on Energy and 
        Commerce of the House of Representatives a report that 
        includes, for the period covered by the report--
                  (A) * * *
                  (B) * * *
                  [(C) the average number of days spent 
                reviewing site security or an alternative 
                security program for a covered chemical 
                facility prior to approval;]
                  [(D)] (C) the number of covered chemical 
                facilities inspected;
                  (D) the effectiveness of the Chemical 
                Facility Anti-Terrorism Standards Program at--
                          (i) managing security risks; and
                          (ii) developing and using appropriate 
                        metrics and analysis capabilities to 
                        measure risk reduction, including--
                                  (I) vulnerability and 
                                consequence mitigation 
                                indicators; and
                                  (II) outcome metrics that 
                                measure cumulative risk 
                                reduction over time; and
                  [(E) the average number of covered chemical 
                facilities inspected per inspector; and]
                  [(F)] (E) any other information that the 
                Secretary determines will be helpful to 
                Congress in evaluating the performance of the 
                Chemical Facility Anti-Terrorism Standards 
                Program.
          (5) Specific products and mixtures containing 
        chemicals of interest.--
                  (A) Definitions.--In this paragraph--
                          (i) the term ``chemical of interest'' 
                        means a chemical designated as a 
                        chemical of interest under Appendix A 
                        to part 27 of title 6, Code of Federal 
                        Regulations, or any successor thereto; 
                        and
                          (ii) the term ``covered product or 
                        mixture'' means a specific product or 
                        mixture that contains a chemical of 
                        interest at or above the minimum 
                        concentration listed under Appendix A 
                        to part 27 of title 6, Code of Federal 
                        Regulations, or any successor thereto.
                  (B) In general.--The Secretary may exclude a 
                covered product or mixture from the designation 
                as a chemical of interest for the purposes of 
                the definition of the term ``chemical facility 
                of interest'' if, in the sole and unreviewable 
                discretion of the Secretary, the Secretary 
                determines that the covered product or mixture 
                does not present the same hazards for which the 
                chemical of interest contained in the covered 
                product or mixture was designated as a chemical 
                of interest.
                  (C) Regulations.--
                          (i) Promulgation.--Not later than 1 
                        year after the date of enactment of 
                        this paragraph, the Secretary shall 
                        promulgate regulations to prescribe a 
                        process under which an interested party 
                        may petition the Secretary for 
                        exclusion of a covered product or 
                        mixture under subparagraph (B).
                          (ii) Federal information policy.--In 
                        collecting information from petitioners 
                        pursuant to this subparagraph, the 
                        Secretary shall not be subject to 
                        subchapter I of chapter 35 of title 44, 
                        United States Code.

           *       *       *       *       *       *       *

SEC. 2107. CFATS REGULATIONS.

    (a) * * *
    (b) Existing CFATS Regulations.--
          (1) In general.--Notwithstanding section 4(b) of the 
        Protecting and Securing Chemical Facilities from 
        Terrorist Attacks Act of 2014 (Public Law 113-254; 128 
        Stat. 2919), each existing CFATS regulation shall 
        remain in effect unless the Secretary amends, 
        consolidates, or repeals the regulation.
          (2) Repeal.--Not later than 30 days after the date of 
        enactment of the Protecting and Securing Chemical 
        Facilities from Terrorist Attacks Act of [2014] 2018, 
        the Secretary shall repeal any existing CFATS 
        regulation that the Secretary determines is duplicative 
        of, or conflicts with, this title.
    (c) * * *

           *       *       *       *       *       *       *

[SEC. 2109. OUTREACH TO CHEMICAL FACILITIES OF INTEREST.

    [Not later than 90 days after the date of enactment of the 
Protecting and Securing Chemical Facilities from Terrorist 
Attacks Act of 2014, the Secretary shall establish an outreach 
implementation plan, in coordination with the heads of other 
appropriate Federal and State agencies, relevant business 
associations, and public and private labor organizations, to--
          [(1) identify chemical facilities of interest; and
          [(2) make available compliance assistance materials 
        and information on education and training.]

SEC. 2109. EXPLOSIVE MATERIALS.

    (a) In General.--The Secretary may not designate any 
explosive material regulated by the Department of Justice under 
chapter 40 of title 18, United States Code, or by the Bureau of 
Alcohol, Tobacco, Firearms, and Explosives under part 555 of 
title 27, Code of Federal Regulations, as a chemical of 
interest under Appendix A to part 27 of title 6, Code of 
Federal Regulations, or any successor thereto.
    (b) Explosive Material Regulated After Designation.--If any 
explosive material that is designated as a chemical of interest 
under Appendix A to part 27 of title 6, Code of Federal 
Regulations, or any successor thereto, becomes regulated by the 
Department of Justice under chapter 40 of title 18, United 
States Code, or by the Bureau of Alcohol, Tobacco, Firearms, 
and Explosives under part 555 of title 27, Code of Federal 
Regulations, or any successor thereto, the Secretary shall 
remove the designation of such explosive material as a chemical 
of interest.

SEC. 2110. CHANGES TO APPENDIX A TO PART 27 OF TITLE 6, CODE OF FEDERAL 
                    REGULATIONS.

    (a) Definition.--In this section, the term ``Appendix A'' 
means Appendix A to part 27 of title 6, Code of Federal 
Regulations, or any successor thereto.
    (b) Notice of Proposed Rulemaking.--The Secretary shall 
publish a notice of proposed rulemaking in the Federal Register 
relating to any proposed change to Appendix A if the Secretary 
determines that--
          (1) a chemical should be designated as a chemical of 
        interest under Appendix A;
          (2) a chemical designated as a chemical of interest 
        under Appendix A should not be so designated; or
          (3) a chemical amount, concentration, or threshold 
        quantity described in Appendix A should be modified.

                                  [all]
```