```

[Congressional Bills 113th Congress]
[From the U.S. Government Publishing Office]
[S. 67 Introduced in Senate (IS)]

113th CONGRESS
  1st Session
                                 S. 67

 To amend the Safe Drinking Water Act and the Federal Water Pollution 
    Control Act to authorize the Administrator of the Environmental 
   Protection Agency to reduce or eliminate the risk of releases of 
hazardous chemicals from public water systems and wastewater treatment 
                     works, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

             January 23 (legislative day, January 3), 2013

Mr. Lautenberg introduced the following bill; which was read twice and 
       referred to the Committee on Environment and Public Works

_______________________________________________________________________

                                 A BILL

 
 To amend the Safe Drinking Water Act and the Federal Water Pollution 
    Control Act to authorize the Administrator of the Environmental 
   Protection Agency to reduce or eliminate the risk of releases of 
hazardous chemicals from public water systems and wastewater treatment 
                     works, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Secure Water 
Facilities Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
                TITLE I--DRINKING WATER SYSTEM SECURITY

Sec. 101. Short title.
Sec. 102. Intentional acts affecting security of covered water systems.
Sec. 103. Study to assess threat of contamination of drinking water 
                            distribution systems.
             TITLE II--WASTEWATER TREATMENT WORKS SECURITY

Sec. 201. Short title.
Sec. 202. Wastewater treatment works security.
Sec. 203. Study to assess threat of contamination of wastewater 
                            treatment works.

                TITLE I--DRINKING WATER SYSTEM SECURITY

SEC. 101. SHORT TITLE.

    This title may be cited as the ``Secure Drinking Water Facilities 
Act''.

SEC. 102. INTENTIONAL ACTS AFFECTING SECURITY OF COVERED WATER SYSTEMS.

    (a) Amendment.--
            (1) In general.--Section 1433 of the Safe Drinking Water 
        Act (42 U.S.C. 300i-2) is amended to read as follows:

``SEC. 1433. INTENTIONAL ACTS AFFECTING SECURITY OF COVERED WATER 
              SYSTEMS.

    ``(a) Definitions.--In this section:
            ``(1) Covered water system.--The term `covered water 
        system' means a public water system that--
                    ``(A) is a community water system serving a 
                population of more than 3,300 individuals; or
                    ``(B) as determined by the Administrator, presents 
                a security risk that requires regulation under this 
                section.
            ``(2) Secretary.--The term `Secretary' means the Secretary 
        of Homeland Security.
    ``(b) Regulations.--
            ``(1) In general.--Not later than 2 years after the date of 
        enactment of the Secure Water Facilities Act, the Administrator 
        shall promulgate final regulations to establish--
                    ``(A) risk-based performance standards for the 
                security of covered water systems in accordance with 
                subsection (c); and
                    ``(B) requirements and deadlines for each covered 
                water system--
                            ``(i)(I) to conduct a vulnerability 
                        assessment in accordance with subsection (d) 
                        and submit the vulnerability assessment to the 
                        Administrator; or
                            ``(II) if a vulnerability assessment has 
                        already been conducted relating to the covered 
                        water system--
                                    ``(aa) to revise the assessment in 
                                accordance with subsection (d); and
                                    ``(bb) to submit the revised 
                                assessment to the Administrator;
                            ``(ii) to update and resubmit a 
                        vulnerability assessment relating to the 
                        covered water system--
                                    ``(I) not less frequently than once 
                                every 5 years; and
                                    ``(II) promptly after any change at 
                                the covered water system that could 
                                cause the reassignment of the covered 
                                water system to a different risk-based 
                                tier under subsection (h);
                            ``(iii) to develop, implement, revise (as 
                        appropriate), and submit to the Administrator a 
                        site security plan in accordance with 
                        subsection (e)--
                                    ``(I) not less frequently than once 
                                every 5 years; and
                                    ``(II) promptly after any revision 
                                to the vulnerability assessment of the 
                                covered water system under clause (ii);
                            ``(iv)(I)(aa) to develop an emergency 
                        response plan in accordance with subsection 
                        (f); or
                            ``(bb) if an emergency response plan has 
                        already been developed for the covered water 
                        system, to revise the plan in accordance with 
                        subsection (f); and
                            ``(II) to revise the plan not less 
                        frequently than once every 5 years; and
                            ``(v) to provide annual training to 
                        employees and contractors of covered water 
                        systems regarding the implementation of site 
                        security plans and emergency response plans in 
                        accordance with subsection (g).
            ``(2) Consultation.--In promulgating regulations pursuant 
        to paragraph (1), the Administrator shall consult with--
                    ``(A) States that exercise primary enforcement 
                responsibility for public water systems; and
                    ``(B) the Secretary and other appropriate 
                individuals and entities regarding--
                            ``(i) a process for the development and 
                        evaluation of vulnerability assessments, site 
                        security plans, and emergency response plans;
                            ``(ii) the development of risk-based 
                        performance standards under subsection (c);
                            ``(iii) the establishment of risk-based 
                        tiers and a process for the assignment of 
                        covered water systems to the risk-based tiers 
                        under subsection (h);
                            ``(iv) the designation of substances of 
                        concern under subsection (i);
                            ``(v) the provision of threat-related and 
                        other baseline information to covered water 
                        systems under subsection (j);
                            ``(vi) the treatment of protected 
                        information in accordance with subsection (o); 
                        and
                            ``(vii) such other matters as the 
                        Administrator determines to be necessary.
    ``(c) Risk-Based Performance Standards.--
            ``(1) In general.--The risk-based performance standards for 
        site security plans under this subsection shall be--
                    ``(A) delineated by risk-based tier under 
                subsection (h); and
                    ``(B) increasingly stringent, based on the level of 
                risk associated with each risk-based tier.
            ``(2) Factor for consideration.--In developing standards 
        under this subsection, the Administrator shall take into 
        consideration section 27.230 of title 6, Code of Federal 
        Regulations (or successor regulations).
    ``(d) Vulnerability Assessments.--
            ``(1) In general.--A vulnerability assessment under this 
        subsection shall include an evaluation by each covered water 
        system of the vulnerability of the covered water system to a 
        range of intentional acts, including any intentional act that 
        results in a release of a substance of concern that is known, 
        or may be reasonably anticipated, to cause death, injury, or 
        serious adverse effects to human health or the environment.
            ``(2) Minimum requirements.--At a minimum, a vulnerability 
        assessment under this subsection shall include a review of, 
        with respect to the relevant covered water system--
                    ``(A) pipes and constructed conveyances;
                    ``(B) physical barriers;
                    ``(C) water collection, pretreatment, treatment, 
                storage, and distribution facilities, including fire 
                hydrants;
                    ``(D) electronic, computer, and other automated 
                systems that are used by the covered water system;
                    ``(E) the use, storage, or handling of various 
                chemicals, including substances of concern;
                    ``(F) the operation and maintenance of the covered 
                water system; and
                    ``(G) the resiliency and ability of the covered 
                water system to ensure continuity of operations in the 
                event of a disruption caused by an intentional act.
    ``(e) Site Security Plans.--In developing and implementing a site 
security plan under this section, a covered water system may select 
layered security and preparedness measures that, in combination, 
appropriately--
            ``(1) address the security risks identified in the 
        vulnerability assessment of the covered water system; and
            ``(2) comply with the applicable risk-based performance 
        standards required under this section.
    ``(f) Emergency Response Plans.--
            ``(1) In general.--Each covered water system shall prepare 
        or revise, as appropriate, an emergency response plan that 
        incorporates the results of the most recent vulnerability 
        assessment and site security plan of the covered water system.
            ``(2) Contents.--An emergency response plan under this 
        subsection shall include--
                    ``(A) a description of the plans and procedures, 
                and an identification of the equipment, that can be 
                implemented or used in the event of an intentional act 
                at the covered water system; and
                    ``(B) a description of the actions and procedures, 
                and an identification of the equipment, that can 
                obviate or significantly lessen the impact on public 
                health and the safety and supply of drinking water 
                provided to communities and individuals of an 
                intentional act at the covered water system.
            ``(3) Coordination.--
                    ``(A) In general.--As part of the emergency 
                response plan of a covered water system, each covered 
                water system shall provide to the individuals and 
                entities described in subparagraph (B) appropriate 
                information to ensure an effective collective response 
                to an intentional act at the covered water system.
                    ``(B) Description of individuals and entities.--An 
                individual or entity referred to in subparagraph (A) 
                is--
                            ``(i) a local emergency planning committee;
                            ``(ii) a State emergency response 
                        commission;
                            ``(iii) a local law enforcement official; 
                        or
                            ``(iv) a local emergency response provider.
            ``(4) Certification.--
                    ``(A) In general.--Not later than 180 days after 
                the date on which a vulnerability assessment is 
                completed or revised, as appropriate, for a covered 
                water system under subsection (d), the covered water 
                system shall submit to the Administrator a 
                certification that the covered water system has 
                completed an emergency response plan in accordance with 
                this subsection.
                    ``(B) Updates.--As soon as practicable after any 
                update of an emergency response plan of a covered water 
                system under this section, a covered water system shall 
                submit to the Administrator an updated certification 
                under subparagraph (A).
    ``(g) Role of Employees.--
            ``(1) Description of role.--Each site security plan and 
        emergency response plan required under this section shall 
        describe the appropriate roles and responsibilities that 
        employees and contractors of the covered water system are 
        expected to perform to deter or respond to an intentional act 
        described in subsection (h)(2)(C).
            ``(2) Training for employees.--Not less frequently than 
        once each year, each covered water system shall provide to 
        employees and contractors of the covered water system with 
        roles or responsibilities described in paragraph (1) not less 
        than 8 hours of training regarding the conduct of those roles 
        and responsibilities.
            ``(3) Employee participation.--In developing, revising, or 
        updating a vulnerability assessment, site security plan, or 
        emergency response plan required under this section, a covered 
        water system shall include--
                    ``(A) at least 1 supervisory and at least 1 
                nonsupervisory employee of the covered water system; 
                and
                    ``(B) at least 1 representative of each certified 
                or recognized bargaining agent representing employees 
                or contractors of the covered water system with roles 
                or responsibilities described in paragraph (1), if any, 
                in a collective bargaining relationship with the 
                private or public owner or operator of the covered 
                water system or a contractor to the covered water 
                system.  
    ``(h) Risk-Based Tiers.--
            ``(1) Establishment.--The Administrator shall establish, by 
        regulation, 4 risk-based tiers for the categorization of 
        covered water systems under this section, with tier 1 
        representing the highest degree of security risk.
            ``(2) Assignment.--
                    ``(A) In general.--The Administrator shall assign 
                (and reassign, as appropriate) each covered water 
                system to 1 of the risk-based tiers established under 
                paragraph (1).
                    ``(B) Submission of information.--The Administrator 
                may require a covered water system to submit to the 
                Administrator such information as the Administrator 
                determines to be necessary to determine the appropriate 
                risk-based tier for the covered water system.
                    ``(C) Factors for consideration.--In assigning a 
                covered water system to a risk-based tier under this 
                paragraph, the Administrator shall take into 
                consideration--
                            ``(i) the potential consequences (such as 
                        death, injury, or serious adverse effects to 
                        human health, the environment, critical 
                        infrastructure, national security, and the 
                        national economy) of an intentional act at the 
                        covered water system--
                                    ``(I) to cause a release, including 
                                a worst-case release, of a substance of 
                                concern;
                                    ``(II)(aa) to introduce a 
                                contaminant into the drinking water 
                                supply; or
                                    ``(bb) to disrupt the safe and 
                                reliable supply of drinking water; and
                                    ``(III) to steal, misappropriate, 
                                or misuse a substance of concern;
                            ``(ii) the size of the population served; 
                        and
                            ``(iii) the proximity of the water system 
                        to large population centers.
            ``(3) Explanation for risk-based tier assignment.--The 
        Administrator shall provide to each covered water system 
        assigned to a risk-based tier under this subsection a written 
        explanation of--
                    ``(A) the reasons for the assignment to that risk-
                based tier; and
                    ``(B) the determination by the Administrator 
                regarding whether the covered water system is required 
                to submit an assessment under subsection (k)(2).
    ``(i) Substances of Concern.--For purposes of this section, the 
Administrator, in consultation with the Secretary--
            ``(1) may designate any chemical substance as a substance 
        of concern, taking into consideration appendix A of part 27 of 
        title 6, Code of Federal Regulations (or successor 
        regulations); and
            ``(2) on the designation of a chemical substance as a 
        substance of concern under paragraph (1), shall establish, by 
        regulation, a threshold quantity for the release or theft of 
        the chemical substance, taking into consideration--
                    ``(A) the toxicity, reactivity, volatility, 
                dispersability, combustibility, and flammability of the 
                chemical substance; and
                    ``(B) the quantity of the chemical substance that, 
                as a result of a release, is known, or may be 
                reasonably anticipated, to cause death, injury, or 
                serious adverse effects to human health or the 
                environment.
    ``(j) Baseline Information.--To facilitate compliance with the 
requirements of this section, as soon as practicable after the 
effective date of the regulations promulgated pursuant to subsection 
(b), and thereafter as appropriate, the Administrator, after 
consultation with appropriate Federal departments and agencies and 
State, local, and tribal governments, shall provide baseline 
information to covered water systems regarding the types of intentional 
acts that constitute probable threats with respect to--
            ``(1) the substantial disruption of the ability of the 
        covered water system to provide a safe and reliable supply of 
        drinking water;
            ``(2) the release of a substance of concern at the covered 
        water system; or
            ``(3) the theft, misuse, or misappropriation of a substance 
        of concern at the covered water system.
    ``(k) Methods To Reduce Consequences of Chemical Releases From 
Intentional Acts.--
            ``(1) Definition of method to reduce the consequences of a 
        chemical release from an intentional act.--
                    ``(A) In general.--In this subsection, the term 
                `method to reduce the consequences of a chemical 
                release from an intentional act' means a measure at a 
                covered water system that reduces or eliminates the 
                potential consequences of a release of a substance of 
                concern from an intentional act.
                    ``(B) Inclusions.--The term `method to reduce the 
                consequences of a chemical release from an intentional 
                act' includes--
                            ``(i) the elimination or reduction in 
                        quantity of a substance of concern possessed or 
                        planned to be possessed by a covered water 
                        system through the use of alternate substances, 
                        formulations, or processes;
                            ``(ii) the modification of the pressure, 
                        temperature, or concentration of a substance of 
                        concern; and
                            ``(iii) the reduction or elimination of 
                        onsite handling of a substance of concern 
                        through improvement of inventory control or 
                        chemical use efficiency.
            ``(2) Assessment.--
                    ``(A) In general.--Each covered water system that 
                possesses or plans to possess a substance of concern in 
                excess of the release threshold quantity established by 
                the Administrator under subsection (i)(2)(B) shall--
                            ``(i) include in the site security plan of 
                        the covered water system an assessment of 
                        methods to reduce the consequences of a 
                        chemical release from an intentional act at the 
                        covered water system; and
                            ``(ii) submit the assessment under clause 
                        (i) to--
                                    ``(I) the Administrator; and
                                    ``(II) the State exercising primary 
                                enforcement responsibility for the 
                                covered water system, if any.
                    ``(B) Factors for consideration.--In preparing an 
                assessment under this paragraph, a covered water system 
                shall take into consideration factors appropriate to 
                ensuring public health and the security and 
                environmental mission of the covered water system.
                    ``(C) Inclusions.--Each assessment under this 
                paragraph shall include a description of--
                            ``(i) the methods to reduce the 
                        consequences of a chemical release from an 
                        intentional act at the covered water system;
                            ``(ii) the means by which each method to 
                        reduce the consequences of a chemical release 
                        from an intentional act at the covered water 
                        system could, if applied--
                                    ``(I) reduce the potential extent 
                                of death, injury, or serious adverse 
                                effects to human health resulting from 
                                the chemical release; and
                                    ``(II) affect the presence of 
                                contaminants in treated water, human 
                                health, or the environment;
                            ``(iii) whether each described method to 
                        reduce the consequences of a chemical release 
                        from an intentional act at the covered water 
                        system is feasible (as defined in section 
                        1412(b)(4)(D)), not including consideration of 
                        the costs calculated under clause (iv);
                            ``(iv) the costs (including capital and 
                        operational costs) and avoided costs (including 
                        savings and liabilities) associated with 
                        applying each method to reduce the consequences 
                        of a chemical release from an intentional act 
                        at the covered water system;
                            ``(v) any other relevant information relied 
                        on by the covered water system in conducting 
                        the assessment;
                            ``(vi) whether the covered water system has 
                        implemented or plans to implement 1 or more 
                        methods to reduce the consequences of a 
                        chemical release from an intentional act and a 
                        description of any such method; and
                            ``(vii) in the case of a covered water 
                        system described in paragraph (3)(A), an 
                        explanation of the reasons for any decision not 
                        to implement a method to reduce the 
                        consequences of a chemical release from an 
                        intentional act at the covered water system.
            ``(3) Required methods.--
                    ``(A) Applicability.--This paragraph applies to a 
                covered water system that--
                            ``(i) is assigned to 1 of the 2 highest 
                        risk-based tiers under subsection (h); and
                            ``(ii) possesses or plans to possess a 
                        substance of concern in excess of the release 
                        threshold quantity established by the 
                        Administrator under subsection (i)(2)(B).
                    ``(B) Highest-risk systems.--If, on the basis of an 
                assessment under paragraph (2), a covered water system 
                described in subparagraph (A) decides not to implement 
                a method to reduce the consequences of a chemical 
                release from an intentional act at the covered water 
                system--
                            ``(i) the State exercising primary 
                        enforcement responsibility for the covered 
                        water system (if the covered water system is 
                        located in such a State) shall, in accordance 
                        with a timeline established by the 
                        Administrator--
                                    ``(I) determine whether to require 
                                the covered water system to implement 
                                the method to reduce the consequences 
                                of a chemical release from an 
                                intentional act; and
                                    ``(II) notify the Administrator of 
                                the determination; or
                            ``(ii) the Administrator (if the covered 
                        water system is not located in a State that 
                        exercises primary enforcement responsibility 
                        for the covered water system) shall determine 
                        whether to require the covered water system to 
                        implement the method to reduce the consequences 
                        of a chemical release from an intentional act.
                    ``(C) Factors for consideration.--Before making a 
                determination to require implementation of a method to 
                reduce consequences of a chemical release from an 
                intentional act under clause (i)(I) or (ii) of 
                subparagraph (B), the State or the Administrator, as 
                applicable, shall take into consideration factors 
                appropriate to the security, public health, and 
                environmental missions of covered water systems, 
                including an examination of whether the applicable 
                method to reduce the consequences of a chemical release 
                from an intentional act--
                            ``(i) would significantly reduce the risk 
                        of death, injury, or serious adverse effects to 
                        human health resulting directly from a chemical 
                        release from an intentional act at the covered 
                        water system;
                            ``(ii) would not increase the interim 
                        storage of a substance of concern by the 
                        covered water system;
                            ``(iii) would not render the covered water 
                        system unable to comply with--
                                    ``(I) other requirements of this 
                                Act; or
                                    ``(II) drinking water standards 
                                established by the State or political 
                                subdivision in which the covered water 
                                system is located; and
                            ``(iv) is feasible (as defined in section 
                        1412(b)(4)(D)) to be incorporated into the 
                        operation of the covered water system.
                    ``(D) Appeals.--If a determination is made to 
                require a covered water system to implement a method to 
                reduce the consequences of a chemical release from an 
                intentional act under clause (i)(I) or (ii) of 
                subparagraph (B), the State or the Administrator, as 
                applicable, shall provide to the affected covered water 
                system an opportunity to appeal the determination, 
                including the opportunity for a determination of 
                consequences of an intentional act occurring outside 
                the covered water system pursuant to subparagraph (E).
                    ``(E) Consequences of an intentional act occurring 
                outside a covered water system.--
                            ``(i) In general.--A covered water system 
                        may request, as part of an appeal under 
                        subparagraph (D), a determination of whether 
                        the implementation of a method to reduce the 
                        consequences of a chemical release from an 
                        intentional act would result in a significant 
                        increase in the existing potential consequences 
                        of an intentional act occurring outside the 
                        covered water system that is directly related 
                        to the method to reduce consequences of an 
                        intentional act at the covered water system 
                        that is the subject of the appeal.
                            ``(ii) Duties upon receipt of request.--
                        Upon receiving a request under clause (i)--
                                    ``(I) the State exercising primary 
                                enforcement responsibility for the 
                                covered water system (if the covered 
                                water system is located in such a 
                                State) shall notify the Administrator, 
                                and the Administrator shall consult 
                                with the Secretary, as necessary, to 
                                quantify whether there will be a 
                                significant increase in the existing 
                                potential consequences of an 
                                intentional act occurring outside the 
                                covered water system (that is directly 
                                related to the method to reduce 
                                consequences of an intentional act at 
                                the covered water system that is the 
                                subject of the appeal) as compared to 
                                the consequences of a chemical release 
                                at the covered water system that would 
                                be reduced by the implementation of the 
                                method; or
                                    ``(II) the Administrator (if the 
                                covered water system is not located in 
                                a State exercising primary enforcement 
                                responsibility for the covered water 
                                system) shall consult with the 
                                Secretary, as necessary, to quantify 
                                whether there will be a significant 
                                increase in the existing potential 
                                consequences of an intentional act 
                                occurring outside the covered water 
                                system (that is directly related to the 
                                method to reduce consequences of an 
                                intentional act at the covered water 
                                system that is the subject of the 
                                appeal) as compared to the consequences 
                                of a chemical release at the covered 
                                water system that would be reduced by 
                                the implementation of the method.
                            ``(iii) Significantly increased 
                        consequences outside covered water system.--If 
                        a determination is made pursuant to subclause 
                        (I) or (II) of clause (ii) that implementation 
                        of a method to reduce consequences of a 
                        chemical release from an intentional act 
                        pursuant to clause (i)(I) or (ii) of 
                        subparagraph (B) would result in a significant 
                        increase in the existing potential consequences 
                        of an intentional act occurring outside the 
                        covered water system as compared to the reduced 
                        consequences of a chemical release at the 
                        covered water system, the State exercising 
                        primary enforcement responsibility for the 
                        covered water system (if the covered water 
                        system is located in such a State), or the 
                        Administrator (if the covered water system is 
                        not located in a State exercising primary 
                        enforcement responsibility for the covered 
                        water system), shall take into consideration 
                        the determination made under this subparagraph 
                        when making a final determination under clause 
                        (i)(I) or (ii) of subparagraph (B).
            ``(4) Incomplete and late assessments.--
                    ``(A) Incomplete assessments.--
                            ``(i) In general.--If the Administrator 
                        determines that a covered water system failed 
                        to meet the requirements of this subsection in 
                        conducting an assessment, the Administrator, 
                        after notifying the covered water system and 
                        the State exercising primary enforcement 
                        responsibility for the covered water system, if 
                        any, shall require the covered water system to 
                        submit a revised assessment in accordance with 
                        this subsection by not later than 60 days after 
                        the date of receipt of notification.
                            ``(ii) Review.--The State exercising 
                        primary enforcement responsibility for a 
                        covered water system subject to clause (i) (if 
                        the covered water system is located in such a 
                        State) or the Administrator (if the covered 
                        water system is not located in such a State) 
                        shall review a revised assessment submitted 
                        under clause (i) to determine whether to 
                        require the covered water system to implement 
                        any method to reduce the consequences of an 
                        intentional act pursuant to paragraph (3).
                    ``(B) Late assessments.--If the Administrator 
                determines that a covered water system failed to 
                complete an assessment under this subsection in 
                accordance with the deadline established for completion 
                by the Administrator, the Administrator, after 
                notifying the covered water system and the State 
                exercising primary enforcement responsibility for the 
                covered water system, if any, may take appropriate 
                enforcement action under subsection (q).
            ``(5) Failures by state to act.--
                    ``(A) Determinations.--
                            ``(i) In general.--If the Administrator 
                        determines that a State exercising primary 
                        enforcement responsibility for a covered water 
                        system has failed to determine whether to 
                        require the covered water system to implement a 
                        method to reduce the consequences of a chemical 
                        release from an intentional act, as required by 
                        paragraph (3)(B)(i)(I), the Administrator shall 
                        notify the State and the applicable covered 
                        water system of the determination.
                            ``(ii) Action by administrator.--If a State 
                        has failed to make a determination required by 
                        paragraph (3)(B)(i)(I) by the date that is 30 
                        days after the date of receipt of the notice of 
                        the Administrator under clause (i), the 
                        Administrator shall--
                                    ``(I) notify the State and the 
                                applicable covered water system of the 
                                failure by the State to make the 
                                determination; and
                                    ``(II) determine whether to require 
                                the covered water system to implement 
                                the applicable method to reduce the 
                                consequences of a chemical release from 
                                an intentional act, based on the 
                                factors described in paragraph (3)(C).
                    ``(B) Enforcement actions.--
                            ``(i) In general.--If the Administrator 
                        determines that a covered water system, with 
                        respect to a period in which a State has 
                        primary enforcement responsibility for the 
                        system, has failed to implement a method to 
                        reduce the consequences of a chemical release 
                        from an intentional act that is required by the 
                        State or the Administrator under paragraph 
                        (3)(B), or by the Administrator under 
                        subparagraph (A), the Administrator shall 
                        notify the State and the covered water system 
                        of the determination.
                            ``(ii) Enforcement actions.--If the 
                        Administrator determines that a State has 
                        failed to commence an appropriate enforcement 
                        action by the date that is 30 days after the 
                        date of notification by the Administrator under 
                        clause (i), the Administrator shall--
                                    ``(I) notify the State and the 
                                applicable covered water system of the 
                                determination; and
                                    ``(II) determine whether to 
                                commence an appropriate enforcement 
                                action against the covered water system 
                                in accordance with subsection (q) to 
                                require the implementation of the 
                                relevant method to reduce the 
                                consequences of a chemical release from 
                                an intentional act at the covered water 
                                system.
                    ``(C) Consideration of continued primary 
                enforcement responsibility.--The Administrator may take 
                into consideration the failure of a State with primary 
                enforcement responsibility for a covered water system 
                to make a determination as described in subparagraph 
                (A), or to bring an enforcement action as described in 
                subparagraph (B), in determining whether the State may 
                retain primary enforcement responsibility for the 
                covered water system under this Act.
            ``(6) Guidance for covered water systems.--
                    ``(A) Guidance.--Not later than 180 days after the 
                date of enactment of the Secure Water Facilities Act, 
                the Administrator shall develop, and update thereafter 
                as appropriate, nonbinding guidance, including guidance 
                regarding Federal procurement, to assist covered water 
                systems in assessing and implementing methods to reduce 
                consequences of a chemical release from an intentional 
                act by reducing or eliminating reliance on the use of 
                threshold quantities of substances of concern at the 
                covered water systems, as established under subsection 
                (i)(2)(B).
                    ``(B) Recommendations.--The Administrator shall, as 
                appropriate, provide or recommend tools, methodologies, 
                or computer software to assist covered water systems 
                assigned to tier 3 or tier 4 under subsection (h) and 
                required to conduct an assessment under paragraph (2) 
                to achieve compliance with the requirements of this 
                section.
    ``(l) Review by Administrator.--
            ``(1) In general.--Each covered water system shall submit 
        to the Administrator the vulnerability assessment and site 
        security plan of the covered water system, in accordance with 
        such deadline as the Administrator may establish.
            ``(2) Review.--The Administrator shall--
                    ``(A) review each vulnerability assessment and site 
                security plan submitted under this subsection; and
                    ``(B)(i) if the assessment or plan has any 
                significant deficiency described in paragraph (3), 
                require the covered water system to correct the 
                deficiency; or
                    ``(ii) approve the assessment or plan.
            ``(3) Significant deficiencies.--
                    ``(A) In general.--Subject to subparagraph (B), a 
                vulnerability assessment or site security plan of a 
                covered water system has a significant deficiency under 
                this paragraph if the Administrator, in consultation 
                with the State exercising primary enforcement 
                responsibility for the covered water system, if any, 
                determines that--
                            ``(i) the vulnerability assessment does not 
                        comply with the regulations promulgated 
                        pursuant to subsection (b); or
                            ``(ii) the site security plan fails--
                                    ``(I) to meet applicable risk-based 
                                performance standards under subsection 
                                (c); or
                                    ``(II) to address a vulnerability 
                                identified in the vulnerability 
                                assessment under subsection (d).
                    ``(B) Exclusion.--A deficiency in the content or 
                implementation of the portion of the site security plan 
                of a covered water system relating to methods to reduce 
                the consequences of a chemical release from an 
                intentional act shall not be considered to be a 
                significant deficiency under this paragraph.
            ``(4) Identification of deficiencies.--If the Administrator 
        identifies a significant deficiency in the vulnerability 
        assessment or site security plan of a covered water system 
        under paragraph (3), the Administrator shall provide to the 
        covered water system a written notification of the deficiency 
        that--
                    ``(A) includes a clear explanation of the 
                deficiency;
                    ``(B) provides guidance to assist the covered water 
                system in addressing the deficiency; and
                    ``(C) requires the covered water system--
                            ``(i) to correct the deficiency; and
                            ``(ii) by such date as the Administrator 
                        determines to be appropriate, to submit to the 
                        Administrator a revised vulnerability 
                        assessment or site security plan.
            ``(5) State, regional, and local governmental entities.--No 
        covered water system shall be required under State, local, or 
        tribal law to provide a vulnerability assessment or site 
        security plan under this section to any State, regional, local, 
        or tribal governmental entity solely due to the requirement of 
        paragraph (1) to submit such an assessment or plan to the 
        Administrator.
    ``(m) Maintenance of Records.--Each covered water system shall 
maintain an updated copy of the vulnerability assessment, site security 
plan, and emergency response plan of the covered water system.
    ``(n) Audits; Inspections.--
            ``(1) In general.--Notwithstanding section 1445(b)(2), the 
        Administrator (or a designee) shall audit and inspect covered 
        water systems as necessary to determine compliance with this 
        section.
            ``(2) Access.--In conducting an audit or inspection of a 
        covered water system under this subsection, the Administrator 
        shall have access to the owners, operators, employees, 
        contractors, and employee representatives, if any, of the 
        covered water system.
            ``(3) Confidential communication of information; aiding 
        inspections.--
                    ``(A) Confidential communication of information.--
                The Administrator shall offer nonsupervisory employees 
                of a covered water system the opportunity to 
                confidentially communicate to the Administrator 
                information relevant to the compliance or noncompliance 
                by the covered water system with the requirements of 
                this section (including regulations promulgated 
                pursuant to this section).
                    ``(B) Aiding inspections.--A representative of each 
                certified or recognized bargaining agent described in 
                subsection (g)(3)(B), or a nonsupervisory employee if 
                no such representative exists, shall be given an 
                opportunity to accompany the Administrator during any 
                physical inspection of a covered water system under 
                this subsection to assist in the inspection, if a 
                representative of the covered water system will also be 
                accompanying the Administrator during the inspection.
    ``(o) Protection of Information.--
            ``(1) Definition of protected information.--
                    ``(A) In general.--In this section, the term 
                `protected information' means--
                            ``(i) a vulnerability assessment or site 
                        security plan under this section (including any 
                        assessment developed under subsection (k)(2));
                            ``(ii) any document directly relating to a 
                        review by the Administrator of an assessment or 
                        plan described in clause (i), and, where 
                        applicable, review by a State of an assessment 
                        developed under subsection (k)(2);
                            ``(iii) any document directly relating to 
                        an inspection or audit under subsection (n);
                            ``(iv) any order, notice, or letter 
                        regarding the compliance of a covered water 
                        system with the requirements of this section;
                            ``(v) any information, document, or record 
                        required to be provided to, or created by, the 
                        Administrator under subsection (h);
                            ``(vi) any document directly related to--
                                    ``(I) a security drill or training 
                                exercise;
                                    ``(II) a security threat or breach; 
                                or
                                    ``(III) maintenance, calibration, 
                                or testing of security equipment; and
                            ``(vii) any other information, document, or 
                        record developed exclusively for purposes of 
                        this section, the disclosure of which, as 
                        determined by the Administrator, by regulation, 
                        would be detrimental to the security of 1 or 
                        more covered water systems.
                    ``(B) Detriment requirement.--For purposes of 
                clauses (ii) through (vi) of subparagraph (A), the only 
                portion of any document, record, order, notice, or 
                letter that shall be considered to be protected 
                information is any portion--
                            ``(i) the disclosure of which, as 
                        determined by the Administrator, by regulation, 
                        would be detrimental to the security of 1 or 
                        more covered water systems; and
                            ``(ii) that is developed by the 
                        Administrator, a State, or a covered water 
                        system for purposes of this section.
                    ``(C) Exclusions.--The term `protected information' 
                does not include--
                            ``(i) any information, other than a 
                        vulnerability assessment or site security plan, 
                        that the Administrator has determined, by 
                        regulation--
                                    ``(I) to be appropriate to 
                                demonstrate compliance by a covered 
                                water system with the requirements of 
                                this section; and
                                    ``(II) would not be detrimental to 
                                the security of any covered water 
                                system if disclosed; or
                            ``(ii) any information that is obtained 
                        from another source with respect to which the 
                        Administrator has not made a determination 
                        under subparagraph (A)(vii) or (B), regardless 
                        of whether the information is included in an 
                        assessment or plan under this section, 
                        including--
                                    ``(I) information that is required 
                                to be made publicly available under any 
                                other provision of law; and
                                    ``(II) information that a covered 
                                water system has lawfully disclosed 
                                other than through a submission to the 
                                Administrator under this section.
            ``(2) Prohibition.--Protected information--
                    ``(A) shall be exempt from disclosure under section 
                552 of title 5, United States Code; and
                    ``(B) shall not be made available pursuant to any 
                State, local, or tribal law requiring disclosure of 
                information or records.
            ``(3) Information sharing.--
                    ``(A) In general.--The Administrator shall 
                promulgate such regulations, and may issue such orders, 
                as the Administrator determines to be necessary to 
                prohibit the unauthorized disclosure of protected 
                information.
                    ``(B) Sharing of protected information.--
                            ``(i) In general.--The regulations under 
                        subparagraph (A) shall establish standards for, 
                        and facilitate, the appropriate sharing of 
                        protected information among--
                                    ``(I) Federal, State, local, and 
                                tribal authorities;
                                    ``(II) first responders;
                                    ``(III) law enforcement officials;
                                    ``(IV) designated supervisory and 
                                nonsupervisory covered water system 
                                personnel with security, operational, 
                                or fiduciary responsibility for the 
                                covered water system; and
                                    ``(V) designated employee 
                                representatives of covered water 
                                systems, if any.
                            ``(ii) Inclusions.--The standards 
                        established under clause (i) shall include 
                        procedures for the sharing of all portions of a 
                        vulnerability assessment or site security plan 
                        of a covered water system relating to the roles 
                        and responsibilities of employees or 
                        contractors of the covered water system under 
                        subsection (g) with--
                                    ``(I) a representative of each 
                                certified or recognized bargaining 
                                agent representing those employees and 
                                contractors, if any; or
                                    ``(II) if a representative 
                                described in subclause (I) does not 
                                exist, at least 1 supervisory and at 
                                least 1 nonsupervisory employee with 
                                roles and responsibilities described in 
                                subsection (g).
                    ``(C) Penalties.--
                            ``(i) In general.--Protected information 
                        shall not be shared, except in accordance with 
                        the standards established and orders issued 
                        pursuant to subparagraph (A).
                            ``(ii) Knowing violation.--Whoever 
                        discloses protected information in knowing 
                        violation of the regulations promulgated under 
                        paragraph (1) shall--
                                    ``(I) be fined under title 18, 
                                United States Code, imprisoned for not 
                                more than 1 year, or both; and
                                    ``(II) in the case of a Federal 
                                officeholder or employee, removed from 
                                Federal office or employment.
            ``(4) Treatment of information in adjudicative 
        proceedings.--In any judicial or administrative proceeding, 
        protected information shall be treated in a manner consistent 
        with the treatment of sensitive security information under 
        section 525 of the Department of Homeland Security 
        Appropriations Act, 2007 (Public Law 109-295; 120 Stat. 1381).
            ``(5) Other obligations unaffected.--Except as provided in 
        subsection (l)(5), nothing in this section modifies or 
        otherwise affects an obligation of a covered water system--
                    ``(A) to submit or make available information to 
                employees of the covered water system, employee 
                organizations, health professionals, emergency response 
                organizations, or a Federal, State, tribal, or local 
                government agency under any other provision of law; or
                    ``(B) to comply with any other provision of law.
            ``(6) Congressional oversight.--Nothing in this section 
        authorizes the withholding of information from Congress.
            ``(7) Disclosure of independently furnished information.--
        Nothing in this section modifies or otherwise affects any 
        authority or obligation of a Federal, State, local, or tribal 
        agency to protect or disclose any record or information that 
        the Federal, State, local, or tribal government agency obtains 
        from a covered water system or the Administrator under any 
        other provision of law.
    ``(p) Preemption.--Nothing in this section precludes or denies the 
right of any State or political subdivision of a State to adopt or 
enforce any regulation, requirement, or standard of performance with 
respect to a covered water system that is more stringent than a 
regulation, requirement, or standard of performance established under 
this section.
    ``(q) Violations.--
            ``(1) In general.--A covered water system that violates any 
        requirement of this section (including by failing to implement 
        all or part of an applicable site security plan by such date as 
        the Administrator may require) shall be liable for a civil 
        penalty in an amount equal to not more than $25,000 for each 
        day of the violation.
            ``(2) Procedure.--On a determination by the Administrator 
        that a covered water system is subject to a civil penalty under 
        paragraph (1), the Administrator, after consultation with the 
        State for a covered water system located in a State exercising 
        primary responsibility for the covered water system, and after 
        taking into consideration the severity of the violation or 
        deficiency and the record of the covered water system in 
        carrying out the requirements of this section, may--
                    ``(A) after providing notice and an opportunity for 
                the covered water system to be heard, issue an order--
                            ``(i) assessing a penalty under paragraph 
                        (1) for any past or current violation; and
                            ``(ii) requiring compliance immediately or 
                        within a specified time period; or
                    ``(B) commence a civil action in the United States 
                district court in the district in which the violation 
                occurred for appropriate relief, including temporary or 
                permanent injunction.
            ``(3) Methods to reduce consequences of chemical releases 
        from intentional acts.--Except as provided in paragraphs (4) 
        and (5) of subsection (k), if a covered water system is located 
        in a State exercising primary enforcement responsibility for 
        the covered water system, the Administrator may not issue an 
        order or commence a civil action under this section for any 
        deficiency in the content or implementation of the portion of 
        the site security plan of the covered water system relating to 
        methods to reduce the consequences of a chemical release from 
        an intentional act (as defined in subsection (k)(1)).
    ``(r) Reports to Congress.--
            ``(1) Annual report.--Not later than 3 years after the 
        effective date of the regulations promulgated pursuant to 
        subsection (b), and annually thereafter for each of the 
        following 8 calendar years, the Administrator shall submit to 
        the Committee on Environment and Public Works of the Senate and 
        the Committee on Energy and Commerce of the House of 
        Representatives a report describing the progress made during 
        the reporting period in achieving compliance with this section, 
        including, at a minimum--
                    ``(A) a generalized summary of measures implemented 
                by covered water systems to meet each risk-based 
                performance standard established under subsection (c); 
                and
                    ``(B) a summary of the means by which--
                            ``(i) covered water systems, as categorized 
                        by risk-based tier assignment under subsection 
                        (h), are achieving compliance with the 
                        requirements of this section; and
                            ``(ii) the Administrator is implementing 
                        and enforcing those requirements, including a 
                        description of--
                                    ``(I) the number of public water 
                                systems that provided information to 
                                the Administrator pursuant to 
                                subsection (h)(2)(B);
                                    ``(II) the number of covered water 
                                systems assigned to each risk-based 
                                tier under subsection (h);
                                    ``(III) the number of vulnerability 
                                assessments and site security plans--
                                            ``(aa) submitted by covered 
                                        water systems; and
                                            ``(bb) approved and 
                                        disapproved by the 
                                        Administrator;
                                    ``(IV) the number of covered water 
                                systems without approved vulnerability 
                                assessments or site security plans in 
                                place;
                                    ``(V)(aa) the number of covered 
                                water systems that have been assigned 
                                to a different risk-based tier or are 
                                no longer regulated by the 
                                Administrator under this section due to 
                                implementation of a method to reduce 
                                the consequences of a chemical release 
                                from an intentional act; and
                                    ``(bb) a description of the types 
                                of each such method to reduce the 
                                consequences of a chemical release from 
                                an intentional act;
                                    ``(VI) the number of audits and 
                                inspections conducted by the 
                                Administrator (or a designee) under 
                                subsection (n);
                                    ``(VII) the number of orders for 
                                compliance issued by the Administrator 
                                under subsection (q);
                                    ``(VIII) the administrative 
                                penalties assessed by the Administrator 
                                for noncompliance with the requirements 
                                of this section;
                                    ``(IX) the civil penalties assessed 
                                by courts for noncompliance with the 
                                requirements of this section; and
                                    ``(X) any other regulatory data the 
                                Administrator determines to be 
                                appropriate to describe--
                                            ``(aa) compliance by 
                                        covered water systems with the 
                                        requirements of this section; 
                                        and
                                            ``(bb) the implementation 
                                        by the Administrator of those 
                                        requirements.
            ``(2) Public availability.--Each report submitted under 
        this section shall be made publicly available.
    ``(s) Grant Programs.--
            ``(1) Implementation grants to states.--The Administrator 
        may provide grants to, or enter into cooperative agreements 
        with, States, based on an allocation formula established by the 
        Administrator, to assist the States in implementing this 
        section.
            ``(2) Research, training, and technical assistance 
        grants.--The Administrator may provide grants to, or enter into 
        cooperative agreements with, nonprofit organizations to provide 
        research, training, and technical assistance to covered water 
        systems to assist the covered water systems in achieving 
        compliance with this section.
            ``(3) Preparation grants.--
                    ``(A) Grants.--The Administrator may provide grants 
                to, or enter into cooperative agreements with, covered 
                water systems to assist the covered water systems in--
                            ``(i) preparing and updating vulnerability 
                        assessments, site security plans, and emergency 
                        response plans;
                            ``(ii) assessing and implementing methods 
                        to reduce the consequences of a release of a 
                        substance of concern from an intentional act; 
                        and
                            ``(iii) implementing any other security 
                        reviews or enhancements that are necessary to 
                        achieve compliance with this section.
                    ``(B) Priority.--
                            ``(i) Need.--In providing grants and 
                        entering into cooperative agreements under 
                        subparagraph (A)(i), the Administrator shall 
                        give priority to covered water systems that, as 
                        determined by the Administrator, have the 
                        greatest need.
                            ``(ii) Security risk.--In providing grants 
                        and entering into cooperative agreements under 
                        subparagraph (A)(ii), the Administrator shall 
                        give priority to covered water systems that, as 
                        determined by the Administrator, present the 
                        greatest security risk.
            ``(4) Worker training grants.--
                    ``(A) Definition of eligible entity.--In this 
                paragraph, the term `eligible entity' means a nonprofit 
                organization with demonstrated experience in 
                implementing and operating successful worker or first 
                responder health and safety or security training 
                programs.
                    ``(B) Grants.--The Administrator shall establish a 
                program under which the Administrator shall provide 
                grants to eligible entities to provide for training and 
                education of--
                            ``(i) employees and contractors of covered 
                        water systems with roles or responsibilities 
                        described in subsection (g); and
                            ``(ii) first responders and emergency 
                        response providers who would respond to an 
                        intentional act at a covered water system.
                    ``(C) Administration.--The Administrator shall 
                offer to enter into an agreement with the National 
                Institute of Environmental Health Sciences to 
                administer the program under this paragraph.
                    ``(D) Use of funds.--An eligible entity shall use a 
                grant received under this paragraph for--
                            ``(i) training and education of employees 
                        and contractors with roles or responsibilities 
                        described in subsection (g), including the 
                        annual mandatory training specified in 
                        subsection (g)(2), with priority given to 
                        covered water systems assigned to tier 1 or 
                        tier 2 under subsection (h);
                            ``(ii) training of first responders in 
                        protecting nearby residents and property or the 
                        environment from the effects of a release of a 
                        substance of concern at a covered water system, 
                        with priority given to covered water systems 
                        assigned to tier 1 or tier 2 under subsection 
                        (h); and
                            ``(iii) appropriate training for first 
                        responders and emergency response providers who 
                        would respond to an intentional act at a 
                        covered water system.
    ``(t) Timely Provision of Threat-Related Information.--The 
Secretary shall, upon receipt of information concerning a specific 
threat that is relevant to a certain covered water system, provide the 
information in a timely manner, to the maximum extent practicable under 
applicable authority and in the interests of national security, to--
            ``(1) the covered water system;
            ``(2) the Administrator; and
            ``(3) appropriate Federal, State, and local law enforcement 
        officials.
    ``(u) Authorization of Appropriations.--
            ``(1) In general.--There is authorized to be appropriated 
        to carry out this section $340,000,000 for each of fiscal years 
        2013 through 2017, of which--
                    ``(A) not more than $30,000,000 may be used during 
                each fiscal year for administrative costs incurred by 
                the Administrator or States, as applicable, in carrying 
                out this section; and
                    ``(B) not more than $225,000,000 may be used during 
                each fiscal year to implement methods to reduce the 
                consequences of chemical releases from intentional acts 
                at covered water systems, with priority given to 
                covered water systems assigned to tier 1 or tier 2 
                under subsection (h).
            ``(2) Security enhancements.--Amounts provided under this 
        subsection for basic security enhancements shall not be used 
        for--
                    ``(A) personnel costs; or
                    ``(B) monitoring, operation, or maintenance of 
                facilities, equipment, or systems.
    ``(v) Relation to Chemical Facility Security Requirements.--No 
provision of any appropriations Act relating to chemical facility 
security, and no law or regulation establishing a chemical facility 
antiterrorism standard, shall apply to a covered water system under 
this section.''.
            (2) Effective date.--The amendment made by paragraph (1) 
        takes effect on the date of promulgation by the Administrator 
        of the Environmental Protection Agency of final regulations 
        pursuant to subsection (b)(1) of section 1433 of the Safe 
        Drinking Water Act (42 U.S.C. 300i-2) (as amended by paragraph 
        (1)).
    (b) Effect of Section.--
            (1) In general.--Nothing in this section or the amendment 
        made by this section affects the applicability of section 1433 
        of the Safe Drinking Water Act (42 U.S.C. 300i-2) (as in effect 
        before the effective date of the amendment made by subsection 
        (a)(1)) to any violation of that section that occurs before 
        that effective date.
            (2) Violations.--The requirements of section 1433 of the 
        Safe Drinking Water Act (42 U.S.C. 300i-2) (as in effect before 
        the effective date of the amendment made by subsection (a)(1)) 
        shall remain in effect with respect to violations described in 
        paragraph (1) until the later of--
                    (A) the date on which the violation is corrected; 
                and
                    (B) the date on which enforcement proceedings 
                relating to the violation are completed.

SEC. 103. STUDY TO ASSESS THREAT OF CONTAMINATION OF DRINKING WATER 
              DISTRIBUTION SYSTEMS.

    Not later than 180 days after the date of enactment of this Act, 
the Administrator of the Environmental Protection Agency, in 
consultation with the Secretary of Homeland Security, shall--
            (1) conduct a study to assess--
                    (A) the threat to drinking water posed by 
                intentional acts of contamination; and
                    (B) the vulnerability of public water systems, 
                including fire hydrants, to such a threat; and
            (2) submit to the Committee on Environment and Public Works 
        of the Senate and the Committee on Energy and Commerce of the 
        House of Representatives a report describing the results of the 
        study.

             TITLE II--WASTEWATER TREATMENT WORKS SECURITY

SEC. 201. SHORT TITLE.

    This title may be cited as ``Secure Wastewater Treatment Facilities 
Act''.

SEC. 202. WASTEWATER TREATMENT WORKS SECURITY.

    (a) Amendment.--
            (1) In general.--Title III of the Federal Water Pollution 
        Control Act (33 U.S.C. 1311 et seq.) is amended by adding at 
        the end the following:

``SEC. 321. WASTEWATER TREATMENT WORKS SECURITY.

    ``(a) Definitions.--In this section:
            ``(1) Covered treatment works.--The term `covered treatment 
        works' means a treatment works that--
                    ``(A) has a treatment capacity of not less than 
                2,500,000 gallons per day; or
                    ``(B) as determined by the Administrator, presents 
                a security risk that requires regulation under this 
                section.
            ``(2) Secretary.--The term `Secretary' means the Secretary 
        of Homeland Security.
    ``(b) Regulations.--
            ``(1) In general.--Not later than 2 years after the date of 
        enactment of the Secure Water Facilities Act, the Administrator 
        shall promulgate final regulations to establish--
                    ``(A) risk-based performance standards for the 
                security of covered treatment works in accordance with 
                subsection (c); and
                    ``(B) requirements and deadlines for each covered 
                treatment works--
                            ``(i)(I) to conduct a vulnerability 
                        assessment in accordance with subsection (d) 
                        and submit the vulnerability assessment to the 
                        Administrator; or
                            ``(II) if a vulnerability assessment has 
                        already been conducted relating to the covered 
                        treatment works--
                                    ``(aa) to revise the assessment in 
                                accordance with subsection (d); and
                                    ``(bb) to submit the revised 
                                assessment to the Administrator;
                            ``(ii) to update and resubmit a 
                        vulnerability assessment relating to the 
                        covered treatment works--
                                    ``(I) not less frequently than once 
                                every 5 years; and
                                    ``(II) promptly after any change at 
                                the covered treatment works that could 
                                cause the reassignment of the covered 
                                treatment works to a different risk-
                                based tier under subsection (h);
                            ``(iii) to develop, implement, revise (as 
                        appropriate), and submit to the Administrator a 
                        site security plan in accordance with 
                        subsection (e)--
                                    ``(I) not less frequently than once 
                                every 5 years; and
                                    ``(II) promptly after any revision 
                                to the vulnerability assessment of the 
                                covered treatment works under clause 
                                (ii);
                            ``(iv)(I)(aa) to develop an emergency 
                        response plan in accordance with subsection 
                        (f); or
                            ``(bb) if an emergency response plan has 
                        already been developed for the covered 
                        treatment works, to revise the plan in 
                        accordance with subsection (f); and
                            ``(II) to revise the plan not less 
                        frequently than once every 5 years; and
                            ``(v) to provide annual training to 
                        employees and contractors of covered treatment 
                        works regarding the implementation of site 
                        security plans and emergency response plans in 
                        accordance with subsection (g).
            ``(2) Consultation.--In promulgating regulations pursuant 
        to paragraph (1), the Administrator shall consult with--
                    ``(A) States with approved programs under section 
                402; and
                    ``(B) the Secretary and other appropriate 
                individuals and entities regarding--
                            ``(i) a process for the development and 
                        evaluation of vulnerability assessments, site 
                        security plans, and emergency response plans;
                            ``(ii) the development of risk-based 
                        performance standards under subsection (c);
                            ``(iii) the establishment of risk-based 
                        tiers and a process for the assignment of 
                        covered treatment works to the risk-based tiers 
                        under subsection (h);
                            ``(iv) the designation of substances of 
                        concern under subsection (i);
                            ``(v) the provision of threat-related and 
                        other baseline information to covered treatment 
                        works under subsection (j);
                            ``(vi) the treatment of protected 
                        information in accordance with subsection (o); 
                        and
                            ``(vii) such other matters as the 
                        Administrator determines to be necessary.
    ``(c) Risk-Based Performance Standards.--
            ``(1) In general.--The risk-based performance standards for 
        site security plans under this subsection shall be--
                    ``(A) delineated by risk-based tier under 
                subsection (h); and
                    ``(B) increasingly stringent, based on the level of 
                risk associated with each risk-based tier.
            ``(2) Factor for consideration.--In developing standards 
        under this subsection, the Administrator shall take into 
        consideration section 27.230 of title 6, Code of Federal 
        Regulations (or successor regulations).
    ``(d) Vulnerability Assessments.--
            ``(1) In general.--A vulnerability assessment under this 
        subsection shall include an evaluation by each covered 
        treatment works of the vulnerability of the covered treatment 
        works to a range of intentional acts, including any intentional 
        act that results in a release of a substance of concern that is 
        known, or may be reasonably anticipated, to cause death, 
        injury, or serious adverse effects to human health or the 
        environment.
            ``(2) Minimum requirements.--At a minimum, a vulnerability 
        assessment under this subsection shall include a review of, 
        with respect to the relevant covered treatment works--
                    ``(A) intercepting sewers, outfall sewers, sewage 
                collection systems, and other constructed conveyances 
                under the control of the treatment works;
                    ``(B) physical barriers;
                    ``(C) facilities, systems, and devices used in the 
                storage, treatment, recycling, or reclamation of 
                municipal sewage or industrial wastes;
                    ``(D) electronic, computer, and other automated 
                systems that are used by the covered treatment works;
                    ``(E) the use, storage, or handling of various 
                chemicals, including substances of concern;
                    ``(F) the operation and maintenance of the covered 
                treatment works; and
                    ``(G) the resiliency and ability of the covered 
                treatment works to ensure continuity of operations in 
                the event of a disruption caused by an intentional act.
    ``(e) Site Security Plans.--In developing and implementing a site 
security plan under this section, a covered treatment works may select 
layered security and preparedness measures that, in combination, 
appropriately--
            ``(1) address the security risks identified in the 
        vulnerability assessment of the covered treatment works; and
            ``(2) comply with the applicable risk-based performance 
        standards required under this section.
    ``(f) Emergency Response Plans.--
            ``(1) In general.--Each covered treatment works shall 
        prepare or revise, as appropriate, an emergency response plan 
        that incorporates the results of the most recent vulnerability 
        assessment and site security plan of the covered treatment 
        works.
            ``(2) Contents.--An emergency response plan under this 
        subsection shall include--
                    ``(A) a description of the plans and procedures, 
                and an identification of the equipment, that can be 
                implemented or used in the event of an intentional act 
                at the covered treatment works; and
                    ``(B) a description of the actions and procedures, 
                and an identification of the equipment, that can 
                obviate or significantly lessen the impact on public 
                health, and the ability of the treatment works to 
                safely and reliably operate on the occurrence, of an 
                intentional act at the covered treatment works.
            ``(3) Coordination.--
                    ``(A) In general.--As part of the emergency 
                response plan of a covered treatment works, each 
                covered treatment works shall provide to the 
                individuals and entities described in subparagraph (B) 
                appropriate information to ensure an effective 
                collective response to an intentional act at the 
                covered treatment works.
                    ``(B) Description of individuals and entities.--An 
                individual or entity referred to in subparagraph (A) 
                is--
                            ``(i) a local emergency planning committee;
                            ``(ii) a State emergency response 
                        commission;
                            ``(iii) a local law enforcement official; 
                        or
                            ``(iv) a local emergency response provider.
            ``(4) Certification.--
                    ``(A) In general.--Not later than 180 days after 
                the date on which a vulnerability assessment is 
                completed or revised, as appropriate, for a covered 
                treatment works under subsection (d), the covered 
                treatment works shall submit to the Administrator a 
                certification that the covered treatment works has 
                completed an emergency response plan in accordance with 
                this subsection.
                    ``(B) Updates.--As soon as practicable after any 
                update of an emergency response plan of a covered 
                treatment works under this section, a covered treatment 
                works shall submit to the Administrator an updated 
                certification under subparagraph (A).
    ``(g) Role of Employees.--
            ``(1) Description of role.--Each site security plan and 
        emergency response plan required under this section shall 
        describe the appropriate roles and responsibilities that 
        employees and contractors of the covered treatment works are 
        expected to perform to deter or respond to an intentional act 
        described in subsection (h)(2)(C).
            ``(2) Training for employees.--Not less frequently than 
        once each year, each covered treatment works shall provide to 
        employees and contractors of the covered treatment works with 
        roles or responsibilities described in paragraph (1) not less 
        than 8 hours of training regarding the conduct of those roles 
        and responsibilities.
            ``(3) Employee participation.--In developing, revising, or 
        updating a vulnerability assessment, site security plan, or 
        emergency response plan required under this section, a covered 
        treatment works shall include--
                    ``(A) at least 1 supervisory and at least 1 
                nonsupervisory employee of the covered treatment works; 
                and
                    ``(B) at least 1 representative of each certified 
                or recognized bargaining agent representing employees 
                or contractors of the covered treatment works with 
                roles or responsibilities described in paragraph (1), 
                if any, in a collective bargaining relationship with 
                the owner or operator of the covered treatment works or 
                a contractor to the covered treatment works.  
    ``(h) Risk-Based Tiers.--
            ``(1) Establishment.--The Administrator shall establish, by 
        regulation, 4 risk-based tiers for the categorization of 
        covered treatment works under this section, with tier 1 
        representing the highest degree of security risk.
            ``(2) Assignment.--
                    ``(A) In general.--The Administrator shall assign 
                (and reassign, as appropriate) each covered treatment 
                works to 1 of the risk-based tiers established under 
                paragraph (1).
                    ``(B) Submission of information.--The Administrator 
                may require a covered treatment works to submit to the 
                Administrator such information as the Administrator 
                determines to be necessary to determine the appropriate 
                risk-based tier for the covered treatment works.
                    ``(C) Factors for consideration.--In assigning a 
                covered treatment works to a risk-based tier under this 
                paragraph, the Administrator shall take into 
                consideration--
                            ``(i) the potential consequences (such as 
                        death, injury, or serious adverse effects to 
                        human health, the environment, critical 
                        infrastructure, national security, and the 
                        national economy) of an intentional act at the 
                        covered treatment works--
                                    ``(I) to cause a release, including 
                                a worst-case release, of a substance of 
                                concern;
                                    ``(II) to disrupt the safe and 
                                reliable operation of the covered 
                                treatment works; and
                                    ``(III) to steal, misappropriate, 
                                or misuse a substance of concern at the 
                                covered treatment works;
                            ``(ii) the design flow of the treatment 
                        works; and
                            ``(iii) the proximity of the treatment 
                        works to large population centers.
            ``(3) Explanation for risk-based tier assignment.--The 
        Administrator shall provide to each covered treatment works 
        assigned to a risk-based tier under this subsection a written 
        explanation of--
                    ``(A) the reasons for the assignment to that risk-
                based tier; and
                    ``(B) the determination by the Administrator 
                regarding whether the covered treatment works is 
                required to submit an assessment under subsection 
                (k)(2).
    ``(i) Substances of Concern.--For purposes of this section, the 
Administrator, in consultation with the Secretary--
            ``(1) may designate any chemical substance as a substance 
        of concern, taking into consideration appendix A of part 27 of 
        title 6, Code of Federal Regulations (or successor 
        regulations); and
            ``(2) on the designation of a chemical substance as a 
        substance of concern under paragraph (1), shall establish, by 
        regulation, a threshold quantity for the release or theft of 
        the chemical substance, taking into consideration--
                    ``(A) the toxicity, reactivity, volatility, 
                dispersability, combustibility, and flammability of the 
                chemical substance; and
                    ``(B) the quantity of the chemical substance that, 
                as a result of a release, is known, or may be 
                reasonably anticipated, to cause death, injury, or 
                serious adverse effects to human health or the 
                environment.
    ``(j) Baseline Information.--To facilitate compliance with the 
requirements of this section, as soon as practicable after the 
effective date of the regulations promulgated pursuant to subsection 
(b), and thereafter as appropriate, the Administrator, after 
consultation with appropriate Federal departments and agencies and 
State, local, and tribal governments, shall provide baseline 
information to covered treatment works regarding the types of 
intentional acts that constitute probable threats with respect to--
            ``(1) the substantial disruption of the ability of the 
        covered treatment works to operate safely and reliably;
            ``(2) the release of a substance of concern at the covered 
        treatment works; or
            ``(3) the theft, misuse, or misappropriation of a substance 
        of concern at the covered treatment works.
    ``(k) Methods To Reduce Consequences of Chemical Releases From 
Intentional Acts.--
            ``(1) Definition of method to reduce the consequences of a 
        chemical release from an intentional act.--
                    ``(A) In general.--In this subsection, the term 
                `method to reduce the consequences of a chemical 
                release from an intentional act' means a measure at a 
                covered treatment works that reduces or eliminates the 
                potential consequences of a release of a substance of 
                concern from an intentional act.
                    ``(B) Inclusions.--The term `method to reduce the 
                consequences of a chemical release from an intentional 
                act' includes--
                            ``(i) the elimination or reduction in 
                        quantity of a substance of concern possessed or 
                        planned to be possessed by a covered treatment 
                        works through the use of alternate substances, 
                        formulations, or processes;
                            ``(ii) the modification of the pressure, 
                        temperature, or concentration of a substance of 
                        concern; and
                            ``(iii) the reduction or elimination of 
                        onsite handling of a substance of concern 
                        through improvement of inventory control or 
                        chemical use efficiency.
            ``(2) Assessment.--
                    ``(A) In general.--Each covered treatment works 
                that possesses or plans to possess a substance of 
                concern in excess of the release threshold quantity 
                established by the Administrator under subsection 
                (i)(2)(B) shall--
                            ``(i) include in the site security plan of 
                        the covered treatment works an assessment of 
                        methods to reduce the consequences of a 
                        chemical release from an intentional act at the 
                        covered treatment works; and
                            ``(ii) submit the assessment under clause 
                        (i) to--
                                    ``(I) the Administrator; and
                                    ``(II) the State in which the 
                                covered treatment works is located, if 
                                the State has an approved program under 
                                section 402.
                    ``(B) Factors for consideration.--In preparing an 
                assessment under this paragraph, a covered treatment 
                works shall take into consideration factors appropriate 
                to ensuring public health and the security and 
                environmental mission of the covered treatment works.
                    ``(C) Inclusions.--Each assessment under this 
                paragraph shall include a description of--
                            ``(i) the methods to reduce the 
                        consequences of a chemical release from an 
                        intentional act at the covered treatment works;
                            ``(ii) the means by which each method to 
                        reduce the consequences of a chemical release 
                        from an intentional act at the covered 
                        treatment works could, if applied--
                                    ``(I) reduce the potential extent 
                                of death, injury, or serious adverse 
                                effects to human health resulting from 
                                the chemical release; and
                                    ``(II) affect the presence of 
                                contaminants in treated water, human 
                                health, or the environment;
                            ``(iii) whether each described method to 
                        reduce the consequences of a chemical release 
                        from an intentional act at the covered 
                        treatment works is feasible (as determined by 
                        the Administrator);
                            ``(iv) the costs (including capital and 
                        operational costs) and avoided costs (including 
                        savings and liabilities) associated with 
                        applying each method to reduce the consequences 
                        of a chemical release from an intentional act 
                        at the covered treatment works;
                            ``(v) any other relevant information relied 
                        on by the covered treatment works in conducting 
                        the assessment;
                            ``(vi) a statement of whether the covered 
                        treatment works has implemented or plans to 
                        implement 1 or more methods to reduce the 
                        consequences of a chemical release from an 
                        intentional act and a description of any such 
                        method; and
                            ``(vii) in the case of a covered treatment 
                        works described in paragraph (3)(A), an 
                        explanation of the reasons for any decision not 
                        to implement a method to reduce the 
                        consequences of a chemical release from an 
                        intentional act at the covered treatment works.
            ``(3) Required methods.--
                    ``(A) Applicability.--This paragraph applies to a 
                covered treatment works that--
                            ``(i) is assigned to 1 of the 2 highest 
                        risk-based tiers under subsection (h); and
                            ``(ii) possesses or plans to possess a 
                        substance of concern in excess of the release 
                        threshold quantity established by the 
                        Administrator under subsection (i)(2)(B).
                    ``(B) Highest-risk systems.--If, on the basis of an 
                assessment under paragraph (2), a covered treatment 
                works described in subparagraph (A) decides not to 
                implement a method to reduce the consequences of a 
                chemical release from an intentional act at the covered 
                treatment works--
                            ``(i) the State with an approved program 
                        under section 402 (if the covered treatment 
                        works is located in such a State) shall, in 
                        accordance with a timeline established by the 
                        Administrator--
                                    ``(I) determine whether to require 
                                the covered treatment works to 
                                implement the method to reduce the 
                                consequences of a chemical release from 
                                an intentional act; and
                                    ``(II) notify the Administrator of 
                                the determination; or
                            ``(ii) the Administrator (if the covered 
                        treatment works is not located in a State with 
                        an approved program under section 402) shall 
                        determine whether to require the covered 
                        treatment works to implement the method to 
                        reduce the consequences of a chemical release 
                        from an intentional act.
                    ``(C) Factors for consideration.--In making a 
                determination under clause (i)(I) or (ii) of 
                subparagraph (B), the State or the Administrator, as 
                applicable, shall take into consideration factors 
                appropriate to the security, public health, and 
                environmental missions of covered treatment works, 
                including an examination of whether the applicable 
                method to reduce the consequences of a chemical release 
                from an intentional act--
                            ``(i) would significantly reduce the risk 
                        of death, injury, or serious adverse effects to 
                        human health resulting directly from a chemical 
                        release from an intentional act at the covered 
                        treatment works;
                            ``(ii) would not increase the interim 
                        storage of a substance of concern by the 
                        covered treatment works;
                            ``(iii) would not render the covered 
                        treatment works unable to comply with--
                                    ``(I) other requirements of this 
                                Act; or
                                    ``(II) applicable standards 
                                established by the State or political 
                                subdivision in which the covered 
                                treatment works is located; and
                            ``(iv) is feasible (as determined by the 
                        Administrator), to be incorporated into the 
                        operation of the covered treatment works.
                    ``(D) Appeals.--If a determination is made to 
                require a covered treatment works to implement a method 
                to reduce the consequences of a chemical release from 
                an intentional act under clause (i)(I) or (ii) of 
                subparagraph (B), the State or the Administrator, as 
                applicable, shall provide to the affected covered 
                treatment works an opportunity to appeal the 
                determination, including the opportunity for a 
                determination of consequences of an intentional act 
                occurring outside the covered treatment works pursuant 
                to subparagraph (E).
                    ``(E) Consequences of intentional act occurring 
                outside covered treatment works.--
                            ``(i) In general.--A covered treatment 
                        works may request, as part of an appeal under 
                        subparagraph (D), a determination of whether 
                        the implementation of a method to reduce the 
                        consequences of a chemical release from an 
                        intentional act would result in a significant 
                        increase in the existing potential consequences 
                        of an intentional act occurring outside the 
                        covered treatment works that is directly 
                        related to the method to reduce consequences of 
                        an intentional act at the covered treatment 
                        works that is the subject of the appeal.
                            ``(ii) Duties upon receipt of request.--
                        Upon receiving a request under clause (i)--
                                    ``(I) the State with an approved 
                                program under section 402 (if the 
                                covered treatment works is located in 
                                such a State), shall notify the 
                                Administrator, and the Administrator 
                                shall consult with the Secretary, as 
                                necessary, to quantify whether there 
                                would be a significant increase in the 
                                existing potential consequences of an 
                                intentional act occurring outside the 
                                covered treatment works (that is 
                                directly related to the method to 
                                reduce consequences of an intentional 
                                act at the covered treatment works that 
                                is the subject of the appeal) as 
                                compared to the consequences of a 
                                chemical release at the covered 
                                treatment works that would be reduced 
                                by the implementation of the method; or
                                    ``(II) the Administrator (if the 
                                covered treatment works is not located 
                                in a State with an approved program 
                                under section 402), shall consult with 
                                the Secretary, as necessary, to 
                                quantify whether there would be a 
                                significant increase in the existing 
                                potential consequences of an 
                                intentional act occurring outside the 
                                covered treatment works (that is 
                                directly related to the method to 
                                reduce consequences of an intentional 
                                act at the covered treatment works that 
                                is the subject of the appeal) as 
                                compared to the consequences of a 
                                chemical release at the covered 
                                treatment works that would be reduced 
                                by the implementation of the method.
                            ``(iii) Significantly increased 
                        consequences outside covered treatment works.--
                        If a determination is made pursuant to 
                        subclause (I) or (II) of clause (ii) that 
                        implementation of a method to reduce 
                        consequences of a chemical release from an 
                        intentional act pursuant to clause (i)(I) or 
                        (ii) of subparagraph (B) would result in a 
                        significant increase in the existing potential 
                        consequences of an intentional act occurring 
                        outside the covered treatment works as compared 
                        to the reduced consequences of a chemical 
                        release at the covered treatment works, the 
                        State with an approved program under section 
                        402 (if the covered treatment works is located 
                        in such a State), or the Administrator (if the 
                        covered treatment works is not located in a 
                        State), shall take that determination into 
                        consideration in making a final determination 
                        under clause (i)(I) or (ii) of subparagraph 
                        (B).
            ``(4) Incomplete and late assessments.--
                    ``(A) Incomplete assessments.--
                            ``(i) In general.--If the Administrator 
                        determines that a covered treatment works 
                        failed to meet the requirements of this 
                        subsection in conducting an assessment, the 
                        Administrator, after notifying the covered 
                        treatment works and the State with an approved 
                        program under section 402, if applicable, shall 
                        require the covered treatment works to submit a 
                        revised assessment in accordance with this 
                        subsection by not later than 60 days after the 
                        date of receipt of notification.
                            ``(ii) Review.--The State in which a 
                        covered treatment works subject to clause (i) 
                        is located (if the covered treatment works is 
                        located in a State with an approved program 
                        under section 402) or the Administrator (if the 
                        covered treatment works is not located in such 
                        a State) shall review a revised assessment 
                        submitted under clause (i) to determine whether 
                        to require the covered treatment works to 
                        implement any method to reduce the consequences 
                        of an intentional act pursuant to paragraph 
                        (3).
                    ``(B) Late assessments.--If the Administrator 
                determines that a covered treatment works failed to 
                complete an assessment under this subsection in 
                accordance with the deadline established for completion 
                by the Administrator, the Administrator, after 
                notifying the covered treatment works and the State 
                with an approved program under section 402, if 
                applicable, may take appropriate enforcement action 
                under subsection (q).
            ``(5) Failure by state to act.--
                    ``(A) Determinations.--
                            ``(i) In general.--If the Administrator 
                        determines that a State with an approved 
                        program under section 402 has failed to 
                        determine whether to require a covered 
                        treatment works to implement a method to reduce 
                        the consequences of a chemical release from an 
                        intentional act, as required by paragraph 
                        (3)(B)(i)(I), the Administrator shall notify 
                        the State and the applicable covered treatment 
                        works of the determination.
                            ``(ii) Action by administrator.--If a State 
                        has failed to make a determination required by 
                        paragraph (3)(B)(i)(I), not later than 30 days 
                        after the date of receipt of the notice of the 
                        Administrator under clause (i) the 
                        Administrator shall--
                                    ``(I) notify the State and the 
                                applicable covered treatment works of 
                                the failure by the State to make the 
                                determination; and
                                    ``(II) determine whether to require 
                                the covered treatment works to 
                                implement the applicable method to 
                                reduce the consequences of a chemical 
                                release from an intentional act, based 
                                on the factors described in paragraph 
                                (3)(C).
                    ``(B) Enforcement actions.--
                            ``(i) In general.--If the Administrator 
                        determines that a covered treatment works has 
                        failed while located in a State with an 
                        approved program under section 402 to implement 
                        a method to reduce the consequences of a 
                        chemical release from an intentional act that 
                        is required by the State or the Administrator 
                        under paragraph (3)(B), or by the Administrator 
                        under subparagraph (A), the Administrator shall 
                        notify the State and the covered treatment 
                        works of the determination.
                            ``(ii) Enforcement action.--If the 
                        Administrator determines that a State has 
                        failed to commence an appropriate enforcement 
                        action by the date that is 30 days after the 
                        date of notification by the Administrator under 
                        clause (i), the Administrator shall--
                                    ``(I) notify the State and the 
                                applicable covered treatment works of 
                                the determination; and
                                    ``(II) determine whether to 
                                commence an appropriate enforcement 
                                action against the covered treatment 
                                works in accordance with subsection (q) 
                                to require the implementation of the 
                                relevant method to reduce the 
                                consequences of a chemical release from 
                                an intentional act at the covered 
                                treatment works.
                    ``(C) Consideration of continued program 
                approval.--The Administrator may take into 
                consideration the failure of a State with an approved 
                program under section 402 to make a determination as 
                described in subparagraph (A), or to bring an 
                enforcement action as described in subparagraph (B), in 
                determining whether the State may retain the approved 
                program under section 402.
            ``(6) Guidance for covered treatment works.--
                    ``(A) Guidance.--Not later than 180 days after the 
                date of enactment of the Secure Water Facilities Act, 
                the Administrator shall develop, and update thereafter 
                as appropriate, nonbinding guidance, including guidance 
                regarding Federal procurement, to assist covered 
                treatment works in assessing and implementing methods 
                to reduce consequences of a chemical release from an 
                intentional act by reducing or eliminating reliance on 
                the use of threshold quantities of substances of 
                concern at the covered treatment works, as established 
                under subsection (i)(2)(B).
                    ``(B) Recommendations.--The Administrator shall, as 
                appropriate, provide or recommend tools, methodologies, 
                or computer software to assist covered treatment works 
                assigned to tier 3 or tier 4 under subsection (h) and 
                required to conduct an assessment under paragraph (2) 
                to achieve compliance with the requirements of this 
                section.
    ``(l) Review by Administrator.--
            ``(1) In general.--Each covered treatment works shall 
        submit to the Administrator the vulnerability assessment and 
        site security plan of the covered treatment works, in 
        accordance with such deadline as the Administrator may 
        establish.
            ``(2) Review.--The Administrator shall--
                    ``(A) review each vulnerability assessment and site 
                security plan submitted under this subsection; and
                    ``(B)(i) if the assessment or plan has any 
                significant deficiency described in paragraph (3), 
                require the covered treatment works to correct the 
                deficiency; or
                    ``(ii) approve the assessment or plan.
            ``(3) Significant deficiencies.--
                    ``(A) In general.--Subject to subparagraph (B), a 
                vulnerability assessment or site security plan of a 
                covered treatment works has a significant deficiency 
                under this paragraph if the Administrator, in 
                consultation with the State with an approved program 
                under section 402 (if the covered treatment works is 
                located in such a State), determines that--
                            ``(i) the vulnerability assessment does not 
                        comply with the regulations promulgated 
                        pursuant to subsection (b); or
                            ``(ii) the site security plan fails--
                                    ``(I) to meet applicable risk-based 
                                performance standards under subsection 
                                (c); or
                                    ``(II) to address a vulnerability 
                                identified in the vulnerability 
                                assessment under subsection (d).
                    ``(B) Exclusion.--A deficiency in the content or 
                implementation of the portion of the site security plan 
                of a covered treatment works relating to methods to 
                reduce the consequences of a chemical release from an 
                intentional act shall not be considered to be a 
                significant deficiency under this paragraph.
            ``(4) Identification of deficiencies.--If the Administrator 
        identifies a significant deficiency in the vulnerability 
        assessment or site security plan of a covered treatment works 
        under paragraph (3), the Administrator shall provide to the 
        covered treatment works a written notification of the 
        deficiency that--
                    ``(A) includes a clear explanation of the 
                deficiency;
                    ``(B) provides guidance to assist the covered 
                treatment works in addressing the deficiency; and
                    ``(C) requires the covered treatment works--
                            ``(i) to correct the deficiency; and
                            ``(ii) by such date as the Administrator 
                        determines to be appropriate, to submit to the 
                        Administrator a revised vulnerability 
                        assessment or site security plan.
            ``(5) State, regional, and local governmental entities.--No 
        covered treatment works shall be required under State, local, 
        or tribal law to provide a vulnerability assessment or site 
        security plan under this section to any State, regional, local, 
        or tribal governmental entity solely due to the requirement of 
        paragraph (1) to submit such an assessment or plan to the 
        Administrator.
    ``(m) Maintenance of Records.--Each covered treatment works shall 
maintain an updated copy of the vulnerability assessment, site security 
plan, and emergency response plan of the covered treatment works.
    ``(n) Audits; Inspections.--
            ``(1) In general.--The Administrator (or a designee) shall 
        audit and inspect covered treatment works as necessary to 
        determine compliance with this section.
            ``(2) Access.--In conducting an audit or inspection of a 
        covered treatment works under this subsection, the 
        Administrator shall have access to the owners, operators, 
        employees, contractors, and employee representatives, if any, 
        of the covered treatment works.
            ``(3) Confidential communication of information; aiding 
        inspections.--
                    ``(A) Confidential communication of information.--
                The Administrator shall offer nonsupervisory employees 
                of a covered treatment works the opportunity to 
                confidentially communicate to the Administrator 
                information relevant to the compliance or noncompliance 
                by the covered treatment works with the requirements of 
                this section (including regulations promulgated 
                pursuant to this section).
                    ``(B) Aiding inspections.--A representative of each 
                certified or recognized bargaining agent described in 
                subsection (g)(3)(B), or a nonsupervisory employee if 
                no such representative exists, shall be given an 
                opportunity to accompany the Administrator during any 
                physical inspection of a covered treatment works under 
                this subsection to assist in the inspection, if a 
                representative of the covered treatment works will also 
                be accompanying the Administrator during the 
                inspection.
    ``(o) Protection of Information.--
            ``(1) Definition of protected information.--
                    ``(A) In general.--In this section, the term 
                `protected information' means--
                            ``(i) a vulnerability assessment or site 
                        security plan under this section (including any 
                        assessment developed under subsection (k)(2));
                            ``(ii) any document directly related to a 
                        review by the Administrator of an assessment or 
                        plan described in clause (i) and, where 
                        applicable, a review by a State of an 
                        assessment developed under subsection (k)(2);
                            ``(iii) any document directly related to an 
                        inspection or audit under subsection (n);
                            ``(iv) any order, notice, or letter 
                        regarding the compliance of a covered treatment 
                        works with the requirements of this section;
                            ``(v) any information, document, or record 
                        required to be provided to, or created by, the 
                        Administrator under subsection (h);
                            ``(vi) any document directly related to--
                                    ``(I) a security drill or training 
                                exercise;
                                    ``(II) a security threat or breach; 
                                or
                                    ``(III) maintenance, calibration, 
                                or testing of security equipment; and
                            ``(vii) any other information, document, or 
                        record developed exclusively for purposes of 
                        this section, the disclosure of which, as 
                        determined by the Administrator, by regulation, 
                        would be detrimental to the security of 1 or 
                        more covered treatment works.
                    ``(B) Detriment requirement.--For purposes of 
                clauses (ii) through (vi) of subparagraph (A), the only 
                portion of any document, record, order, notice, or 
                letter that shall be considered to be protected 
                information is any portion--
                            ``(i) the disclosure of which, as 
                        determined by the Administrator, by regulation, 
                        would be detrimental to the security of 1 or 
                        more covered treatment works; and
                            ``(ii) that is developed by the 
                        Administrator, a State, or a covered treatment 
                        works for purposes of this section.
                    ``(C) Exclusions.--The term `protected information' 
                does not include--
                            ``(i) any information, other than a 
                        vulnerability assessment or site security plan, 
                        that the Administrator has determined, by 
                        regulation--
                                    ``(I) to be appropriate to 
                                demonstrate compliance by a covered 
                                treatment works with the requirements 
                                of this section; and
                                    ``(II) would not be detrimental to 
                                the security of any covered treatment 
                                works if disclosed; or
                            ``(ii) any information that is obtained 
                        from another source with respect to which the 
                        Administrator has not made a determination 
                        under subparagraph (A)(vii) or (B), regardless 
                        of whether the information is included in an 
                        assessment or plan under this section, 
                        including--
                                    ``(I) information that is required 
                                to be made publicly available under any 
                                other provision of law; and
                                    ``(II) information that a covered 
                                treatment works has lawfully disclosed 
                                other than through a submission to the 
                                Administrator under this section.
            ``(2) Prohibition.--Protected information--
                    ``(A) shall be exempt from disclosure under section 
                552 of title 5, United States Code; and
                    ``(B) shall not be made available pursuant to any 
                State, local, or tribal law requiring disclosure of 
                information or records.
            ``(3) Information sharing.--
                    ``(A) In general.--The Administrator shall 
                promulgate such regulations, and may issue such orders, 
                as the Administrator determines to be necessary to 
                prohibit the unauthorized disclosure of protected 
                information.
                    ``(B) Sharing of protected information.--
                            ``(i) In general.--The regulations under 
                        subparagraph (A) shall establish standards for, 
                        and facilitate, the appropriate sharing of 
                        protected information among--
                                    ``(I) Federal, State, local, and 
                                tribal authorities;
                                    ``(II) first responders;
                                    ``(III) law enforcement officials;
                                    ``(IV) designated supervisory and 
                                nonsupervisory covered treatment works 
                                personnel with security, operational, 
                                or fiduciary responsibility for the 
                                covered treatment works; and
                                    ``(V) designated employee 
                                representatives of covered treatment 
                                works, if any.
                            ``(ii) Inclusions.--The standards 
                        established under clause (i) shall include 
                        procedures for the sharing of all portions of a 
                        vulnerability assessment or site security plan 
                        of a covered treatment works relating to the 
                        roles and responsibilities of employees or 
                        contractors of the covered treatment works 
                        under subsection (g) with--
                                    ``(I) a representative of each 
                                certified or recognized bargaining 
                                agent representing those employees and 
                                contractors, if any; or
                                    ``(II) if a representative 
                                described in subclause (I) does not 
                                exist, at least 1 supervisory and at 
                                least 1 nonsupervisory employee with 
                                roles and responsibilities described in 
                                subsection (g).
                    ``(C) Penalties.--
                            ``(i) In general.--Protected information 
                        shall not be shared, except in accordance with 
                        the standards established and orders issued 
                        pursuant to subparagraph (A).
                            ``(ii) Knowing violation.--Whoever 
                        discloses protected information in knowing 
                        violation of the regulations promulgated under 
                        paragraph (1) shall--
                                    ``(I) be fined under title 18, 
                                United States Code, imprisoned for not 
                                more than 1 year, or both; and
                                    ``(II) in the case of a Federal 
                                officeholder or employee, removed from 
                                Federal office or employment.
            ``(4) Treatment of information in adjudicative 
        proceedings.--In any judicial or administrative proceeding, 
        protected information shall be treated in a manner consistent 
        with the treatment of sensitive security information under 
        section 525 of the Department of Homeland Security 
        Appropriations Act, 2007 (Public Law 109-295; 120 Stat. 1381).
            ``(5) Other obligations unaffected.--Except as provided in 
        subsection (l)(5), nothing in this section modifies or 
        otherwise affects an obligation of a covered treatment works--
                    ``(A) to submit or make available information to 
                employees of the covered treatment works, employee 
                organizations, health professionals, emergency response 
                organizations, or a Federal, State, tribal, or local 
                government agency under any other provision of law; or
                    ``(B) to comply with any other provision of law.
            ``(6) Congressional oversight.--Nothing in this section 
        authorizes the withholding of information from Congress.
            ``(7) Disclosure of independently furnished information.--
        Nothing in this section modifies or otherwise affects any 
        authority or obligation of a Federal, State, local, or tribal 
        agency to protect or disclose any record or information that 
        the Federal, State, local, or tribal agency obtains from a 
        covered treatment works or the Administrator under any other 
        provision of law.
    ``(p) Preemption.--Nothing in this section precludes or denies the 
right of any State or political subdivision of a State to adopt or 
enforce any regulation, requirement, or standard of performance with 
respect to a covered treatment works that is more stringent than a 
regulation, requirement, or standard of performance established under 
this section.
    ``(q) Violations.--
            ``(1) In general.--For purposes of section 309, any 
        violation of a requirement under this section (including a 
        regulation promulgated pursuant to this section) by a covered 
        treatment works shall be treated in the same manner as a 
        violation of a condition of a permit under section 402.
            ``(2) Methods to reduce the consequences of a chemical 
        release from an intentional act.--Except as provided in 
        paragraphs (4) and (5) of subsection (k), if a covered 
        treatment works is located in a State with an approved program 
        under section 402, the Administrator may not issue an order or 
        commence a civil action under this section for any deficiency 
        in the content or implementation of the portion of the site 
        security plan of the covered treatment works relating to 
        methods to reduce the consequences of a chemical release from 
        an intentional act (as defined in subsection (k)(1)).
    ``(r) Report to Congress.--
            ``(1) Annual report.--Not later than 3 years after the 
        effective date of the regulations promulgated pursuant to 
        subsection (b), and annually thereafter for each of the 
        following 8 calendar years, the Administrator shall submit to 
        the Committee on Environment and Public Works of the Senate and 
        the Committee on Transportation and Infrastructure of the House 
        of Representatives a report describing the progress made during 
        the reporting period in achieving compliance with this section, 
        including, at a minimum--
                    ``(A) a generalized summary of measures implemented 
                by covered treatment works to meet each risk-based 
                performance standard established under subsection (c); 
                and
                    ``(B) a summary of the means by which--
                            ``(i) covered treatment works, as 
                        categorized by risk-based tier assignment under 
                        subsection (h), are achieving compliance with 
                        the requirements of this section; and
                            ``(ii) the Administrator is implementing 
                        and enforcing those requirements, including a 
                        description of--
                                    ``(I) the number of treatment works 
                                that provided information to the 
                                Administrator pursuant to subsection 
                                (h)(2)(B);
                                    ``(II) the number of covered 
                                treatment works assigned to each risk-
                                based tier under subsection (h);
                                    ``(III) the number of vulnerability 
                                assessments and site security plans--
                                            ``(aa) submitted by covered 
                                        treatment works; and
                                            ``(bb) approved and 
                                        disapproved by the 
                                        Administrator;
                                    ``(IV) the number of covered 
                                treatment works without approved 
                                vulnerability assessments or site 
                                security plans in place;
                                    ``(V)(aa) the number of covered 
                                treatment works that have been assigned 
                                to a different risk-based tier or are 
                                no longer regulated by the 
                                Administrator under this section due to 
                                implementation of a method to reduce 
                                the consequences of a chemical release 
                                from an intentional act; and
                                    ``(bb) a description of the types 
                                of each such method to reduce the 
                                consequences of a chemical release from 
                                an intentional act;
                                    ``(VI) the number of audits and 
                                inspections conducted by the 
                                Administrator (or a designee) under 
                                subsection (n);
                                    ``(VII) the number of orders for 
                                compliance issued by the Administrator 
                                under subsection (q);
                                    ``(VIII) the administrative 
                                penalties assessed by the Administrator 
                                for noncompliance with the requirements 
                                of this section;
                                    ``(IX) the civil penalties assessed 
                                by courts for noncompliance with the 
                                requirements of this section; and
                                    ``(X) any other regulatory data the 
                                Administrator determines to be 
                                appropriate to describe--
                                            ``(aa) compliance by 
                                        covered treatment works with 
                                        the requirements of this 
                                        section; and
                                            ``(bb) the implementation 
                                        by the Administrator of those 
                                        requirements.
            ``(2) Public availability.--Each report submitted under 
        this section shall be made publicly available.
    ``(s) Grant Programs.--
            ``(1) Implementation grants to states.--The Administrator 
        may provide grants to, or enter into cooperative agreements 
        with, States, based on an allocation formula established by the 
        Administrator, to assist the States in implementing this 
        section.
            ``(2) Research, training, and technical assistance 
        grants.--The Administrator may provide grants to, or enter into 
        cooperative agreements with, nonprofit organizations to provide 
        research, training, and technical assistance to covered 
        treatment works to assist the covered treatment works in 
        achieving compliance with this section.
            ``(3) Preparation grants.--
                    ``(A) Grants.--The Administrator may provide grants 
                to, or enter into cooperative agreements with, covered 
                treatment works to assist the covered treatment works 
                in--
                            ``(i) preparing and updating vulnerability 
                        assessments, site security plans, and emergency 
                        response plans;
                            ``(ii) assessing and implementing methods 
                        to reduce the consequences of a release of a 
                        substance of concern from an intentional act; 
                        and
                            ``(iii) implementing any other security 
                        reviews or enhancements that are necessary to 
                        achieve compliance with this section.
                    ``(B) Priority.--
                            ``(i) Need.--In providing grants and 
                        entering into cooperative agreements under 
                        subparagraph (A)(i), the Administrator shall 
                        give priority to covered treatment works that, 
                        as determined by the Administrator, have the 
                        greatest need.
                            ``(ii) Security risk.--In providing grants 
                        and entering into cooperative agreements under 
                        subparagraph (A)(ii), the Administrator shall 
                        give priority to covered treatment works that, 
                        as determined by the Administrator, present the 
                        greatest security risk.
            ``(4) Worker training grants.--
                    ``(A) Definition of eligible entity.--In this 
                paragraph, the term `eligible entity' means a nonprofit 
                organization with demonstrated experience in 
                implementing and operating successful worker or first 
                responder health and safety or security training 
                programs.
                    ``(B) Grants.--The Administrator shall establish a 
                program under which the Administrator shall provide 
                grants to eligible entities to provide for training and 
                education of--
                            ``(i) employees and contractors of covered 
                        treatment works with roles or responsibilities 
                        described in subsection (g); and
                            ``(ii) first responders and emergency 
                        response providers who would respond to an 
                        intentional act at a covered treatment works.
                    ``(C) Administration.--The Administrator shall 
                offer to enter into an agreement with the National 
                Institute of Environmental Health Sciences to 
                administer the program under this paragraph.
                    ``(D) Use of funds.--An eligible entity shall use a 
                grant received under this paragraph for--
                            ``(i) training and education of employees 
                        and contractors with roles or responsibilities 
                        described in subsection (g), including the 
                        annual mandatory training specified in 
                        subsection (g)(2), with priority given to 
                        covered treatment works assigned to tier 1 or 
                        tier 2 under subsection (h);
                            ``(ii) training of first responders in 
                        protecting nearby residents and property or the 
                        environment from the effects of a release of a 
                        substance of concern at a covered treatment 
                        works, with priority given to covered treatment 
                        works assigned to tier 1 or tier 2 under 
                        subsection (h); and
                            ``(iii) appropriate training for first 
                        responders and emergency response providers who 
                        would respond to an intentional act at a 
                        covered treatment works.
    ``(t) Timely Provision of Threat-Related Information.--The 
Secretary shall, upon receipt of information concerning a specific 
threat that is relevant to a certain covered water treatment works, 
provide the information in a timely manner, to the maximum extent 
practicable under applicable authority and in the interests of national 
security, to--
            ``(1) covered treatment works;
            ``(2) the Administrator; and
            ``(3) the appropriate Federal, State, and local law 
        enforcement officials.
    ``(u) Authorization of Appropriations.--
            ``(1) In general.--There are authorized to be appropriated 
        to carry out this section $200,000,000 for each of fiscal years 
        2013 through 2017, of which--
                    ``(A) not more than $30,000,000 may be used during 
                each fiscal year for administrative costs incurred by 
                the Administrator or States, as applicable, in carrying 
                out this section; and
                    ``(B) not more than $150,000,000 may be used during 
                each fiscal year to implement methods to reduce the 
                consequences of chemical releases from intentional acts 
                at covered treatment works, with priority given to 
                covered treatment works assigned to tier 1 or tier 2 
                under subsection (h).
            ``(2) Security enhancements.--Amounts provided under this 
        subsection for basic security enhancements shall not be used 
        for--
                    ``(A) personnel costs; or
                    ``(B) monitoring, operation, or maintenance of 
                facilities, equipment, or systems.
    ``(v) Relation to Chemical Facility Security Requirements.--No 
provision of any appropriations Act relating to chemical facility 
security, and no law or regulation establishing a chemical facility 
antiterrorism standard, shall apply to a covered treatment works under 
this section.''.
            (2) Effective date.--The amendment made by paragraph (1) 
        takes effect on the date of promulgation by the Administrator 
        of the Environmental Protection Agency of final regulations 
        pursuant to subsection (b)(1) of section 321 of the Federal 
        Water Pollution Control Act (as amended by paragraph (1)).
    (b) Effect of Section.--
            (1) In general.--Nothing in this section or the amendment 
        made by this section affects the applicability of any provision 
        of title III of the Federal Water Pollution Control Act (33 
        U.S.C. 1311 et seq.) (as in effect before the effective date of 
        the amendment made by subsection (a)(1)).
            (2) Violations.--
                    (A) In general.--Nothing in this section or the 
                amendment made by this section affects the 
                applicability of any provision of title III of the 
                Federal Water Pollution Control Act (33 U.S.C. 1311 et 
                seq.) (as in effect before the effective date of the 
                amendment made by subsection (a)(1)) to any violation 
                of that Act that occurs before that effective date.
                    (B) Requirements.--The requirements of title III of 
                the Federal Water Pollution Control Act (33 U.S.C. 1311 
                et seq.) (as in effect before the effective date of the 
                amendment made by subsection (a)(1)) shall remain in 
                effect with respect to violations described in 
                subparagraph (A) until the later of--
                            (i) the date on which the violation is 
                        corrected; and
                            (ii) the date on which enforcement 
                        proceedings relating to the violation are 
                        completed.

SEC. 203. STUDY TO ASSESS THREAT OF CONTAMINATION OF WASTEWATER 
              TREATMENT WORKS.

    Not later than 180 days after the date of enactment of this Act, 
the Administrator of the Environmental Protection Agency, in 
consultation with the Secretary of Homeland Security, shall--
            (1) conduct a study to assess--
                    (A) the threat to wastewater treatment works posed 
                by intentional acts of contamination; and
                    (B) the vulnerability of wastewater treatment works 
                to such a threat; and
            (2) submit to the Committee on Environment and Public Works 
        of the Senate and the Committee on Energy and Commerce of the 
        House of Representatives a report describing the results of the 
        study.
                                 <all>
```