```

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[H.R. 3256 Reported in House (RH)]

<DOC>

                                                 Union Calendar No. 427
116th CONGRESS
  2d Session
                                H. R. 3256

                      [Report No. 116-341, Part I]

 To amend the Homeland Security Act of 2002 to reauthorize and improve 
 the Chemical Facility Anti-Terrorism Standards Program, and for other 
                               purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                             June 13, 2019

 Mr. Richmond (for himself and Mr. Thompson of Mississippi) introduced 
  the following bill; which was referred to the Committee on Homeland 
Security, and in addition to the Committee on Energy and Commerce, for 
a period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the 
                          committee concerned

                           December 12, 2019

   Reported from the Committee on Homeland Security with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

                           September 21, 2020

Committee on Energy and Commerce discharged; committed to the Committee 
 of the Whole House on the State of the Union and ordered to be printed
 [For text of introduced bill, see copy of bill as introduced on June 
                               13, 2019]

_______________________________________________________________________

                                 A BILL

 
 To amend the Homeland Security Act of 2002 to reauthorize and improve 
 the Chemical Facility Anti-Terrorism Standards Program, and for other 
                               purposes.

 

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Protecting and 
Securing Chemical Facilities from Terrorist Attacks Act of 2019''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Chemical Facility Anti-Terrorism Standards Program.
Sec. 4. Protection and sharing of information.
Sec. 5. Civil enforcement.
Sec. 6. Whistleblower protection.
Sec. 7. Chemical Security Advisory Committee.
Sec. 8. Implementation plan and report to Congress.
Sec. 9. Study on risks posed by excluded facilities.
Sec. 10. Study on feasibility of waiver program.
Sec. 11. Review of tiering methodology.
Sec. 12. Comptroller General reports.
Sec. 13. Voluntary mechanism for reporting drones and other emerging 
                            threats.
Sec. 14. Regulations regarding specific products and mixtures 
                            containing chemicals of interest.
Sec. 15. Voluntary program.
Sec. 16. Study on local emergency response capacity to respond to 
                            chemical security incidents.
Sec. 17. Previously approved facilities.
Sec. 18. Termination.

SEC. 2. DEFINITIONS.

    Section 2101 of the Homeland Security Act of 2002 (6 U.S.C. 621) is 
amended--
            (1) in paragraph (4)(E), by striking ``subject to 
        regulation'' and inserting ``regulated'';
            (2) in paragraph (5)--
                    (A) in subparagraph (A), by striking ``that is in 
                effect on the day before the date of enactment of the 
                Protecting and Securing Chemical Facilities from 
                Terrorist Attacks Act of 2014;'' and inserting ``or 
                this title''; and
                    (B) in subparagraph (B), by striking ``that is in 
                effect on the day before the date of enactment of the 
                Protecting and Securing Chemical Facilities from 
                Terrorist Attacks Act of 2014;'' and inserting ``or 
                this title'';
            (3) by striking paragraphs (6), (7), and (8); and
            (4) by redesignating paragraphs (9) through (14) as 
        paragraphs (6) through (11), respectively.

SEC. 3. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM.

    (a) Additional CFATS Program Requirement.--Section 2102(a)(2) of 
such Act (6 U.S.C. 622) is amended--
            (1) in subparagraph (C), by striking ``and'' at the end;
            (2) in subparagraph (D), by striking the period and 
        inserting ``; and'' ; and
            (3) by adding at the end the following new subparagraph:
                    ``(E) verify information submitted by a covered 
                chemical facility prior to assigning such facility a 
                lower risk tier or determining that such facility no 
                longer presents a high level of security risk.''.
    (b) Employee Input Regarding Security Measures.--Paragraph (2) of 
subsection (b) of section 2102 of such Act (6 U.S.C. 622) is amended to 
read as follows:
            ``(2) Employee consultation and awareness.--
                    ``(A) Employee consultation requirement.--A 
                facility's security vulnerability assessment and site 
                security plan shall be developed in consultation with--
                            ``(i) at least one facility employee, in 
                        addition to the facility security officer or 
                        other individual who serves as a point of 
                        contact under section 27.230(a)(17) of title 6, 
                        Code of Federal Regulations, and the 
                        corresponding guidance issued under section 
                        27.220(d) of such title, or any successor 
                        thereto, who possesses relevant knowledge, 
                        experience, training, or education pertaining 
                        to matters of site security.
                            ``(ii) in the case of a facility where 
                        facility employees are represented by a 
                        bargaining agent, at least one employee 
                        representative who--
                                    ``(I) is selected by the bargaining 
                                agent at that facility; and
                                    ``(II) has relevant knowledge, 
                                experience, training, or education 
                                pertaining to matters of site security.
                    ``(B) Record of employee consultation.--A covered 
                chemical facility shall maintain a written record of 
                the employee consultation required by subparagraph (A), 
                including a record of--
                            ``(i) the name of the employee with whom 
                        the facility security officer or other similar 
                        official consulted;
                            ``(ii) how often and when such consultation 
                        took place;
                            ``(iii) what mechanisms the facility used 
                        to capture feedback; and
                            ``(iv) any recommendations that were 
                        offered, accepted, or rejected as part of the 
                        security vulnerability assessment or site 
                        security plan.
                    ``(C) Access to employees.--Each owner or operator 
                of a covered chemical facility shall, upon request, 
                provide to an employee of the Department engaged in 
                carrying out audits and inspections of such facility 
                access to any employee who participated in the 
                development of the facility's security vulnerability 
                assessment and site security plan.
                    ``(D) Employee awareness.--The Secretary shall 
                produce a poster that a chemical facility of interest 
                shall display in areas accessible to facility employees 
                to inform employees about requirements under this title 
                and the whistleblower protections provided under 
                section 2105.''.
    (c) Site Security Plans.--
            (1) Disapproval.--Subsection (c)(1)(B) of section 2102 of 
        such Act (6 U.S.C. 622) is amended--
                    (A) in clause (i), by striking ``and'' at the end; 
                and
                    (B) by amending clause (ii) to read as follows:
                            ``(ii) shall disapprove a site security 
                        plan if--
                                    ``(I) the plan fails to satisfy the 
                                risk-based performance standards 
                                established pursuant to subsection 
                                (a)(2)(C); or
                                    ``(II) the plan fails to include 
                                the name, organizational affiliation, 
                                and phone number of a local emergency 
                                manager or local emergency response 
                                provider and a documented policy to 
                                contact the local emergency manager or 
                                local emergency response provider at 
                                least annually regarding emergency 
                                response plans at the facility.''.
            (2) Assessments.--Paragraph (3) of subsection (c) of such 
        section is amended to read as follows:
            ``(3) Site security plan assessments.--In approving or 
        disapproving a site security plan under this subsection, the 
        Secretary shall--
                    ``(A) employ the risk assessment policies and 
                procedures developed under this title; and
                    ``(B) confirm that the covered chemical facility 
                has complied with the employee consultation 
                requirements in paragraph (2) of subsection (b), 
                including by reviewing and recording compliance with 
                the record-keeping requirements under subparagraph (B) 
                of that paragraph.''.
    (d) Elimination of Expedited Approval Program.--Section 2102(c) of 
such Act (6 U.S.C. 622) is amended by striking paragraph (4).
    (e) Audits and Inspections.--
            (1) Authority to conduct.--Subparagraph (B) of paragraph 
        (1) of subsection (d) of section 2102 of such Act (6 U.S.C. 
        622) is amended by striking ``under this title using'' and 
        inserting ``at chemical facilities of interest and covered 
        chemical facilities and shall obtain information and records to 
        ensure compliance with this title. Such audits and inspections 
        shall be conducted using''.
            (2) Reporting structure.--Subparagraph (D) of such 
        paragraph is amended--
                    (A) in clause (i), by inserting ``, or any 
                successor organization that implements the requirements 
                of subsection (a)(2),'' after ``Department''; and
                    (B) in clause (ii), by inserting ``, or any 
                successor organization that implements the requirements 
                of subsection (a)(2),'' after ``Department''.
            (3) Standards for auditors and inspectors.--Subparagraph 
        (E) of such paragraph is amended--
                    (A) in the matter preceding clause (i)--
                            (i) by striking ``The Secretary'' and 
                        inserting ``For each individual responsible for 
                        carrying out audits or inspections on behalf of 
                        the Secretary, the Secretary'';
                            (ii) by inserting ``to ensure such 
                        individuals receive'' before ``the training''; 
                        and
                            (iii) by striking ``and retraining of each 
                        individual used by the Department as an auditor 
                        or inspector, including each individual 
                        employed by the Department and all 
                        nondepartmental or nongovernmental personnel'' 
                        and inserting ``, continuing education, and 
                        other professional development tools necessary 
                        to carry out duties and responsibilities''; and
                    (B) in clause (i), by striking ``requirements'' and 
                inserting ``necessary to audit and inspect compliance 
                with all aspects of the risk-based performance 
                standards, including standards related to 
                cybersecurity,'';
                    (C) by redesignating clauses (vi) and (vii) as 
                clauses (vii) and (viii), respectively; and
                    (D) by inserting after clause (v) the following new 
                clause:
                            ``(vi) the proper credential or 
                        certification necessary to conduct inspections 
                        related to the cybersecurity standard.''.
            (4) Emergency response plans.--Such subsection is further 
        amended by adding at the end the following new paragraph:
            ``(4) Audit of emergency response plan.--As part of the 
        audit and inspection process under this subsection, the 
        Secretary shall annually confirm compliance of a chemical 
        facility with the requirements under subsection 
        (c)(1)(B)(ii)(II) including adherence to the facility's 
        documented policy to contact the local emergency manager or 
        local emergency response provider at least annually regarding 
        emergency response plans at the facility under such 
        subsection.''.
    (f) Risk Assessment.--Section 2102(e) of such Act (6 U.S.C. 622(e)) 
is amended--
            (1) in paragraph (2)(B)--
                    (A) in the matter preceding clause (i), by 
                inserting ``and other malicious acts'' after 
                ``terrorism''; and
                    (B) in clause (ii), by striking ``severe economic 
                consequences and the potential loss of human life in 
                the event of the facility being subject to attack, 
                compromise, infiltration, or exploitation by 
                terrorists'' and inserting ``consequences in event of 
                the facility being subject to attack, compromise, 
                infiltration, or the exploitation of chemicals of 
                interest by a terrorist or other malicious actor'';
            (2) in paragraph (3)--
                    (A) in subparagraph (A)--
                            (i) by redesignating clauses (i) and (ii) 
                        as clauses (ii) and (iii), respectively;
                            (ii) by inserting before clause (ii), as so 
                        redesignated, the following new clause (i):
                            ``(i) the Secretary determines that a 
                        chemical facility of interest does not present 
                        a high level of security risk;''; and
                            (iii) in clause (iii), as so redesignated, 
                        by inserting ``or chemical facility of 
                        interest'' after ``covered chemical facility'';
                    (B) in subparagraph (B)--
                            (i) by striking ``information on'' and all 
                        that follows and inserting ``information on--
                        ''; and
                            (ii) by adding at the end the following 
                        clauses:
                            ``(i) how the Secretary confirmed the 
                        information that was the basis for the change 
                        or determination described in subparagraph (A); 
                        and
                            ``(ii) actions taken or practices employed 
                        by the facility to reduce or remove terrorism-
                        related chemical security risks, where 
                        applicable.''; and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(C) Treatment of certain information.--For the 
                purposes of subsection (a) of section 2103--
                            ``(i) information described in subparagraph 
                        (B)(i) shall be given protections from public 
                        disclosure under such subsection; and
                            ``(ii) information described in 
                        subparagraph (B)(ii) shall not be given 
                        protections from public disclosure under such 
                        subsection.'';
            (3) by redesignating paragraph (4) as paragraph (7);
            (4) by inserting after paragraph (3) the following new 
        paragraphs:
            ``(4) Sharing information with emergency response 
        providers.--
                    ``(A) In general.--The Secretary shall make 
                available to State, local, and regional fusion centers 
                (as that term is defined in section 210A(j)(1) of this 
                Act) and State and local government officials such 
                information as the Secretary determines necessary to 
                ensure that emergency response providers are prepared 
                and provided with the situational awareness needed to 
                respond to security incidents at covered chemical 
                facilities.
                    ``(B) Dissemination.--The Secretary shall 
                disseminate information under subparagraph (A) to 
                individuals identified and entities described in such 
                subparagraph in a secure and expeditious manner.
            ``(5) Practices that may reduce chemical security risks.--
                    ``(A) In general.--Based on the information 
                maintained under paragraph (3)(B)(ii) regarding actions 
                taken or practices employed by chemical facilities of 
                interest to successfully reduce or remove terrorism-
                related chemical security risks, the Secretary shall 
                develop voluntary, publicly available practices that 
                could be used to guide other facility owners and 
                operators in preventing, reducing, and mitigating 
                chemical security risks.
                    ``(B) Treatment of sensitive information.--In 
                developing and disseminating practices under 
                subparagraph (A), the Secretary shall protect from 
                public disclosure all information described in section 
                2103(a).
            ``(6) Congressional notification.--Any time a determination 
        is not made with respect to a chemical facility of interest 
        within 9 months of the facility submitting a Top-Screen, the 
        Secretary shall notify the Committees on Homeland Security and 
        Energy and Commerce of the House and the Committee on Homeland 
        Security and Governmental Affairs of the Senate and provide an 
        explanation.''; and
            (5) in paragraph (6), as redesignated by paragraph (3) of 
        this subsection--
                    (A) in subparagraph (B)(i)(I)--
                            (i) in item (aa), by striking ``or'' at the 
                        end;
                            (ii) in item (bb), by striking ``and'' and 
                        inserting ``or''; and
                            (iii) by adding at the end the following 
                        new item:
                                            ``(cc) determined that a 
                                        chemical facility of interest 
                                        did not present a high level of 
                                        risk; and'';
                    (B) by amending subparagraph (C) to read as 
                follows:
                    ``(C) for the period beginning on the date that is 
                one year before the date of the enactment of the 
                Protecting and Securing Chemical Facilities from 
                Terrorist Attacks Act of 2019 and ending on the date of 
                the enactment of such Act, the average length of time 
                required to--
                            ``(i) review and approve site security 
                        plans or alternative security programs for 
                        covered chemical facilities;
                            ``(ii) ensure a facility has achieved full 
                        implementation of planned security measures; 
                        and
                            ``(iii) conduct a compliance inspection, 
                        including the average length of time inspectors 
                        spend on an individual compliance 
                        inspection;'';
                    (C) in subparagraph (E), by striking ``and'' at the 
                end;
                    (D) by redesignating subparagraph (F) as 
                subparagraph (I); and
                    (E) by inserting after subparagraph (E) the 
                following new subparagraphs:
                    ``(F) a detailed summary of reports and other 
                information generated under paragraph (3) regarding 
                facilities that receive a change in tier or that are 
                determined not to present a high level of security 
                risk;
                    ``(G) a detailed summary of practices identified 
                and disseminated under such paragraph;
                    ``(H) actions taken and results produced in 
                implementing the practices, to the extent feasible; 
                and''.
    (g) Specific Products and Mixtures.--Such section (6 U.S.C. 622) is 
further amended by adding at the end the following new subsection:
    ``(f) Specific Products and Mixtures Containing Chemicals of 
Interest.-- The Secretary may exclude a specific product or mixture 
that contains a chemical of interest at or above the minimum 
concentration listed on Appendix A to part 27 of title 6, Code of 
Federal Regulations, or any successor thereto, from any reporting 
requirements under this section if the Secretary determines that the 
product or mixture does not present a terrorism risk for which the 
chemical of interest contained within the product or mixture was 
included on Appendix A.''.

SEC. 4. PROTECTION AND SHARING OF INFORMATION.

    Section 2103 of the Homeland Security Act of 2002 (6 U.S.C. 623) is 
amended--
            (1) by striking subsections (b), (c), and (f); and
            (2) by inserting after subsection (a) the following new 
        subsections (b) and (c):
    ``(b) Authorized Recipients of Information.--The Secretary shall 
make available, upon request, information protected pursuant to 
subsection (a) to the following recipients:
            ``(1) State and local government officials, including law 
        enforcement and emergency response providers, with respect to 
        information on any chemical facility of interest within the 
        jurisdiction of the official, but only if such information may 
        not be disclosed pursuant to any State or local law.
            ``(2) Members of Congress.
            ``(3) Members of the Chemical Security Advisory Committee 
        under section 2010, in the course of conducting official duties 
        and responsibilities as described in such section.
            ``(4) The Comptroller General of the United States.
    ``(c) Information Developed for Other Purposes.--Nothing in this 
section shall be construed to prohibit a chemical facility of interest 
from disclosing information that was not created solely for the purpose 
of meeting the requirements of this title.''.

SEC. 5. CIVIL ENFORCEMENT.

    Section 2104 of the Homeland Security Act of 2002 (6 U.S.C. 624) is 
amended--
            (1) in subsection (a)(1)--
                    (A) in subparagraph (A)(i), by striking ``14 days 
                after date on which'' and inserting ``three days after 
                the date on which''; and
                    (B) in subparagraph (B), by striking ``180 days'' 
                and inserting ``30 days'';
            (2) in subsection (b)(2), by inserting ``section 
        2102(a)(2)(B) or any requirement issued by the Secretary 
        thereunder'' after ``comply with'';
            (3) in subsection (c), by inserting ``or other malicious 
        act'' after ``terrorist incident''; and
            (4) in subsection (d), by inserting ``, except as provided 
        in section 2105(a)(5) regarding whistleblower retaliation'' 
        before the period at the end.

SEC. 6. WHISTLEBLOWER PROTECTION.

    Section 2105 of the Homeland Security Act of 2002 (6 U.S.C. 625) is 
amended--
            (1) in subsection (a)--
                    (A) in paragraph (1), by striking ``Not later than 
                180 days after the date of enactment of the Protecting 
                and Securing Chemical Facilities from Terrorist Attacks 
                Act of 2014, the Secretary'' and inserting ``The 
                Secretary'';
                    (B) by amending paragraph (2) to read as follows:
            ``(2) Confidentiality.--
                    ``(A) In general.--Except as provided in 
                subparagraph (B), in the absence of the written consent 
                of an individual who submits a report under paragraph 
                (1)--
                            ``(i) the Secretary shall keep confidential 
                        the identity of and any identifying information 
                        relating to that individual; and
                            ``(ii) any such report shall be subject to 
                        the protections on information under section 
                        2103 of this Act to the extent that the report 
                        does not consist of publicly available 
                        information.
                    ``(B) Notice.--In a case in which it is necessary 
                to disclose the identity of or any identifying 
                information relating to an individual who submits a 
                report under paragraph (1) because it is essential to 
                investigate the information contained in the report or 
                because of compulsory legal process, the Secretary 
                shall provide timely advance notice to the individual 
                of such disclosure.'';
                    (C) by amending paragraph (3) to read as follows:
            ``(3) Response to reports.--If a report submitted under 
        paragraph (1) contains information identifying the individual 
        making the report, the Secretary, or the designee of the 
        Secretary shall, by not later than 15 days after the date on 
        which the report is received, respond to the individual 
        directly and acknowledge receipt of the report.'';
                    (D) in paragraph (5)--
                            (i) by amending subparagraph (C) to read as 
                        follows:
                    ``(C) Opportunity for review.--In any action under 
                paragraph (4) that is based on information received 
                under the procedure established under paragraph (1), 
                the Secretary shall provide for review of the action if 
                a petition for review is filed within 20 calendar days 
                of the date of issuance of the order for the action.'';
                            (ii) in subparagraph (D)--
                                    (I) by striking ``unless the 
                                Secretary determines'' and inserting 
                                ``, except that the Secretary may 
                                provide for a 30-day extension if the 
                                Secretary determines'';
                                    (II) by striking ``that the 
                                violation providing a basis for the 
                                action continues to exist.'' and 
                                inserting ``that--''; and
                                    (III) by adding at the end the 
                                following new clauses:
                            ``(i) the violation providing a basis for 
                        the action continues to exist; or
                            ``(ii) such period is insufficient to 
                        complete the review of the action.''; and
                    (E) in paragraph (6)--
                            (i) in subparagraph (A), by striking 
                        ``discharge an employee or otherwise 
                        discriminate against an employee with respect 
                        to the compensation provided to, or terms, 
                        conditions, or privileges of the employment of, 
                        the employee because the employee (or an 
                        individual acting pursuant to a request of the 
                        employee) submitted a report under paragraph 
                        (1).'' and inserting ``discharge an employee or 
                        otherwise discriminate against an employee or 
                        former employee with respect to the 
                        compensation provided to, or terms, conditions, 
                        or privileges associated with current or past 
                        employment of, the employee or former employee 
                        because the employee or former employee (or an 
                        individual acting pursuant to a request of the 
                        employee or former employee) submitted a report 
                        under paragraph (1).''; and
                            (ii) in subparagraph (B), in the matter 
                        preceding clause (i), by--
                                    (I) inserting ``or former 
                                employee'' after ``An employee''; and
                                    (II) inserting ``or former employee 
                                (or an individual acting pursuant to a 
                                request of the employee or former 
                                employee)'' after ``the employee''; and
                            (iii) by adding at the end the following 
                        new subparagraph:
                    ``(C) Procedure and remedy.--
                            ``(i) In general.--The Secretary shall 
                        establish a procedure for the review and 
                        investigation of complaints of reprisals 
                        prohibited under subparagraph (A) and for 
                        remedies for violations of such subparagraph.
                            ``(ii) Judicial remedies.--Nothing in this 
                        title shall be construed to deny an individual 
                        who submits a complaint for any reprisal 
                        prohibited under subparagraph (A) from seeking 
                        a judicial remedy against the owner or operator 
                        of the chemical facility of interest as long as 
                        the individual has exhausted administrative 
                        remedies.''; and
            (2) by striking subsection (d).

SEC. 7. CHEMICAL SECURITY ADVISORY COMMITTEE.

    (a) In General.--Title XXI of the Homeland Security Act of 2002 (6 
U.S.C. 621 et seq.) is amended by adding at the end the following new 
section:

``SEC. 2110. CHEMICAL SECURITY ADVISORY COMMITTEE.

    ``(a) Establishment.--The Secretary shall establish a standing 
Chemical Security Advisory Committee to advise the Secretary on the 
implementation of this title.
    ``(b) Membership.--
            ``(1) In general.--The Advisory Committee shall be 
        comprised of 12 members selected by the Secretary, which shall 
        include at least one individual who is a multi-disciplinary 
        stakeholder with scientific or other expertise representing 
        each of the following:
                    ``(A) Industry.
                    ``(B) Academia.
                    ``(C) Labor.
                    ``(D) Emergency response providers.
                    ``(E) Local emergency planners.
                    ``(F) Environmental, community, or public health 
                advocates, particularly for communities with high 
                concentrations of covered chemical facilities.
                    ``(G) Cybersecurity and information policy.
            ``(2) Terms.--Each member shall be appointed for an initial 
        term of three years and may be reappointed for one additional 
        three-year term.
            ``(3) Chair.--The Committee shall have a chair, who shall 
        be selected by the members of the Committee.
            ``(4) Pay.--Members shall serve without pay.
            ``(5) Quorum.--A majority of members of the Advisory 
        Committee shall constitute a quorum but a lesser number may 
        hold hearings.
    ``(c) Subcommittees.--The Advisory Committee may establish 
subcommittees to assesses and recommend improvements to the risk 
tiering methodology for chemical facilities, the risk-based performance 
standards for chemical facilities, risk reduction strategies, and other 
aspects of the program under this title as the Secretary determines 
appropriate.
    ``(d) Information Protection.--Members of Advisory Committee shall 
maintain information protections pursuant to section 2103 of this Act. 
Any member who needs to access classified information to carry out 
assessments and recommendations for improving the risk tiering 
methodology for chemical facilities shall have an appropriate security 
clearance.
    ``(e) Annual Report.--
            ``(1) Submission to the secretary.--Not later than January 
        30 each year, the chair shall submit to the Secretary a report 
        on the activities of the Committee during the year preceding 
        the year during which the report is submitted.
            ``(2) Submission to congress.--Not later than 45 days after 
        receiving a report from the Advisory Committee under paragraph 
        (1), the Secretary shall provide to the Committees on Homeland 
        Security and Energy and Commerce of the House of 
        Representatives and the Committee on Homeland Security and 
        Governmental Affairs of the Senate a copy of the report 
        together with any Secretarial feedback on the report.
    ``(f) Applicability of FACA.--The Federal Advisory Committee Act (5 
U.S.C. App.) shall not apply to the Committee established under this 
section.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by inserting after the item relating to section 
2109 the following new item:

``2110. Chemical Security Advisory Committee.''.

SEC. 8. IMPLEMENTATION PLAN AND REPORT TO CONGRESS.

    (a) Implementation Plan.--Not later than 120 days after the date of 
the enactment of this Act, the Secretary of Homeland Security shall 
develop, and submit to Congress, an implementation plan outlining how 
the Secretary plans to--
            (1) aggregate, anonymize, and analyze data collected from 
        covered chemical facilities or chemical facilities of interest 
        to identify practices that such facilities have employed to 
        successfully reduce or remove terrorism-related chemical 
        security risks;
            (2) develop voluntary, publicly available, practices based 
        on such data, which may be updated as necessary, to guide 
        facility owners and operators in preventing, reducing, and 
        managing security risks; and
            (3) disseminate such practices to chemical facility owners 
        and operators through an appropriate medium or system, 
        including by making such practices available to the public to 
        the greatest extent practicable.
    (b) Report.--
            (1) Initial report.--Not later than two years after the 
        date of the enactment of this Act, the Secretary shall submit 
        to Congress a report on the status of implementation plan 
        required under subsection (a), a description of the voluntary, 
        publicly available, practices identified, and the system or 
        medium used to disseminate such practices to chemical facility 
        owners and operators.
            (2) Annual updates.--Not later than one year after the 
        submission of the report required under paragraph (1), and 
        annually thereafter, the Secretary shall submit to Congress 
        information on changes to the voluntary practices information 
        disseminated and bases for such changes, information on 
        feedback collected from facility owners and operators regarding 
        the extent to which voluntary practices were adopted, and 
        information on what impact the dissemination of voluntary 
        practices have had on the effectiveness of the program.

SEC. 9. STUDY ON RISKS POSED BY EXCLUDED FACILITIES.

    (a) Study Required.--The Secretary of Homeland Security shall enter 
into an agreement with a non-Department of Homeland Security entity for 
the conduct of an independent assessment of--
            (1) the implications for national security and homeland 
        security of exempting from regulation under title XXI of the 
        Homeland Security Act of 2002 (6 U.S.C. 621 et seq.) excluded 
        facilities, as such term is defined in section 2101(4) of such 
        Act.;
            (2) the implications for such excluded facilities of 
        exempting such facilities from regulation; and
            (3) the implications of exempting such facilities from 
        regulation for the communities located in the same geographic 
        areas as such facilities.
    (b) Report to Congress.--Not later than 16 months after entering 
into an agreement under subsection (a), the Secretary of Homeland 
Security shall submit to the appropriate congressional committees a 
report that includes the findings and recommendations of the 
independent assessment required by subsection (a).
    (c) Appropriate Congressional Committees.--In this section, the 
term ``appropriate congressional committees'' means--
            (1) the Committee on Homeland Security and Governmental 
        Affairs of the Senate; and
            (2) the Committee on Homeland Security and the Committee on 
        Energy and Commerce of the House of Representatives.

SEC. 10. STUDY ON FEASIBILITY OF WAIVER PROGRAM.

    (a) Study Required.--The Secretary of Homeland Security shall 
conduct a study to assess the feasibility and desirability of 
establishing a process under which certain chemical facilities, as 
determined by the Secretary, may apply to for a waiver of certain 
regulatory requirements under title XXI of the Homeland Security Act of 
2002 (6 U.S.C. 621 et seq.) upon showing that--
            (1) the requirements under such title are covered, to the 
        same extent and in the same manner, under another Federal 
        regulatory program;
            (2) the facility is in full and complete compliance with 
        such other Federal regulatory program, as shown through timely 
        scheduled inspections, audits, and other supporting evidence; 
        and
            (3) the facility has not, during the five-year period 
        preceding the date on which a waiver is requested, been subject 
        to an enforcement action brought by the Federal regulator 
        overseeing such regulatory program or been found to be 
        noncompliant with any aspect of such regulatory program.
    (b) Report to Congress.--Not later than two years after the date of 
the enactment of this Act, the Secretary of Homeland Security shall 
submit to the appropriate congressional committees a report that 
includes detailed findings regarding the establishment of the process 
described in subsection (a) and, if appropriate, recommendations for 
implementation.
    (c) Appropriate Congressional Committees.--In this section, the 
term ``appropriate congressional committees'' means--
            (1) the Committee on Homeland Security and Governmental 
        Affairs of the Senate; and
            (2) the Committee on Homeland Security and the Committee on 
        Energy and Commerce of the House of Representatives.

SEC. 11. REVIEW OF TIERING METHODOLOGY.

    (a) Review Required.--The Director of the Cybersecurity and 
Infrastructure Security Agency shall--
            (1) conduct a review of the risk assessment approach and 
        corresponding tiering methodology for covered chemical 
        facilities required pursuant to section 2102(e)(2) of the 
        Homeland Security Act of 2002, as amended by this Act, and 
        assess the extent to which the approach and tiering methodology 
        takes into account--
                    (A) the nature of the area surrounding the chemical 
                facility, the presence of nearby facilities or other 
                critical infrastructure, and other features of the 
                community that could contribute to the consequences of 
                a terrorist attack or exploitation of chemicals of 
                interest;
                    (B) the potential effects on the health and 
                economic conditions of communities disproportionately 
                vulnerable to the consequences of a terrorist attack or 
                exploitation of chemicals of interest; and
                    (C) the vulnerabilities of chemical facilities to 
                cybersecurity threats, including the vulnerabilities of 
                facilities' information technology and operational 
                technology and the implications on the potential for 
                penetration of both the physical security and 
                cybersecurity of facilities; and
            (2) based on the review under paragraph (1), develop a plan 
        to ensure that when the tiering methodology is next updated, 
        the nature of the surrounding area, the presence of nearby 
        facilities or other critical infrastructure, and other features 
        of the community that could contribute to the consequences of a 
        terrorist attack or exploitation of chemicals of interest and 
        impacts on communities disproportionately vulnerable to the 
        consequences of a terrorist attack or exploitation of chemicals 
        of interest are considered.
    (b) Report to Congress.--
            (1) Report on review.--Not later than two years after the 
        date of the enactment of this Act, the Director shall submit to 
        the appropriate congressional committees a report on the 
        tiering methodology review required under subsection (a).
            (2) Submittal of plan.-- Not later than one year after 
        submitting the report under paragraph (1), the Director shall 
        submit to the appropriate congressional committees the tiering 
        methodology plan required under subsection (a)(2).
            (3) Appropriate congressional committees.--In this section, 
        the term ``appropriate congressional committees'' means--
                    (A) the Committee on Homeland Security and 
                Governmental Affairs of the Senate; and
                    (B) the Committee on Homeland Security and the 
                Committee on Energy and Commerce of the House of 
                Representatives.

SEC. 12. COMPTROLLER GENERAL REPORTS.

    (a) Evaluation of Effectiveness of Risk-based Performance 
Standards.--
            (1) Study and report.--Not later than 18 months after the 
        date of the enactment of this Act, the Comptroller General of 
        the United States shall conduct a study and submit to the 
        appropriate congressional committees a report on the 
        effectiveness of the risk-based performance standards used by 
        the Department of Homeland Security under title XXI of the 
        Homeland Security Act of 2002 (6 U.S.C. 621 et seq.) in 
        protecting businesses, employees, the economy, the public, and 
        national security against existing and evolving threats of 
        concern.
            (2) Contents of report.--The report required by paragraph 
        (1) shall address--
                    (A) the sufficiency of security risk determinations 
                and countermeasures under title XXI of the Homeland 
                Security Act of 2002 (6 U.S.C. 621 et seq.); and
                    (B) the need for revised or additional methods to 
                address evolving security risks.
    (b) Evaluation of Information Management.--Not later than one year 
after the date of the enactment of this Act, the Comptroller General of 
the United States shall conduct a study and submit to the appropriate 
congressional committees a report on--
            (1) how the Secretary of Homeland Security documents, 
        maintains, and uses information on tiering changes pursuant to 
        section 2102(e)(3) of the Homeland Security Act of 2002 (6 
        U.S.C. 622(e)(3)); and
            (2) how management, maintenance, utility, and use of the 
        information could be improved to better identify and 
        disseminate practices to reduce chemical security risks.
    (c) Evaluation of Practices to Reduce Chemical Security Risks.--Not 
later than three years after the date of the enactment of this Act, the 
Comptroller General of the United States shall submit to the 
appropriate congressional committees a report on the effectiveness of 
the development and distribution by the Secretary of Homeland Security 
of practices to address chemical security risks and of any actions 
taken or results produced in response to such practices.
    (d) Appropriate Congressional Committees.--In this section, the 
term ``appropriate congressional committees'' means--
            (1) the Committee on Homeland Security and Governmental 
        Affairs of the Senate; and
            (2) the Committee on Homeland Security and the Committee on 
        Energy and Commerce of the House of Representatives.

SEC. 13. VOLUNTARY MECHANISM FOR REPORTING DRONES AND OTHER EMERGING 
              THREATS.

    (a) In General.--Not later than 120 days after the date of the 
enactment of this Act, the Secretary of Homeland Security, acting 
through the Director of the Cybersecurity and Infrastructure Security 
Agency, shall provide a secure communications and information 
technology infrastructure or platform that allows owners and operators 
of covered chemical facilities to report, on a voluntary basis, 
information on emerging threats, including terrorism threats posed by 
unmanned aircraft systems (as defined in section 331(9) of the FAA 
Modernization and Reform Act of 2012 (Public Law 112-95; 49 U.S.C. 
40101 note) to covered chemical facilities.
    (b) Platform Capabilities.--The Secretary shall ensure that the 
secure communications and information technology infrastructure or 
platform established pursuant to subsection (a) is designed to support 
data mining and other advanced analytic tools to access, receive, and 
analyze data and information to facilitate the reporting of the 
information described in subsection (a).

SEC. 14. REGULATIONS REGARDING SPECIFIC PRODUCTS AND MIXTURES 
              CONTAINING CHEMICALS OF INTEREST.

    Not later than one year after the date of the enactment of this 
Act, the Secretary of Homeland Security shall prescribe regulations to 
enact a process through which the Secretary can be petitioned to 
exclude a product or mixture under subsection (f) of section 2102 of 
the Homeland Security Act, as added by section 3. In collecting 
information from petitioners under such subsection, the Secretary shall 
not be subject to subchapter I of chapter 35 of title 44, United States 
Code, or section 553 of title 5, United States Code.

SEC. 15. VOLUNTARY PROGRAM.

    (a) In General.--The Director of Cybersecurity and Infrastructure 
Security of the Department of Homeland Security may develop a voluntary 
program for chemical facilities to address potential security risks at 
such facilities.
    (b) Congressional Notification.--Not less than 15 days prior to 
commencing a voluntary program pursuant to subsection (a), the Director 
shall provide notification to the Committee on Homeland Security and 
the Committee on Energy and Commerce of the House of Representatives 
and the Committee on Homeland Security and Governmental Affairs of the 
Senate.

SEC. 16. STUDY ON LOCAL EMERGENCY RESPONSE CAPACITY TO RESPOND TO 
              CHEMICAL SECURITY INCIDENTS.

    (a) Study Required.--The Secretary of Homeland Security, acting 
through the Under Secretary for Science and Technology, shall conduct a 
study on how to improve training and support for local emergency 
response providers in areas with high concentrations of covered 
chemical facilities in how to respond to a terrorist attack on a 
chemical facility.
    (b) Features.--In carrying out the study required under subsection 
(a), the Secretary shall consider, as appropriate--
            (1) the degree to which jurisdictions with high 
        concentrations of covered chemical facilities have fire, 
        police, medical, and other response personnel trained and 
        equipped to respond to a terrorist attack on a chemical 
        facility and have--
                    (A) evacuation and shelter in place protocols 
                tailored to the unique needs of the jurisdiction and 
                the chemical properties of chemicals of interest that 
                would be involved in the attack and that take into 
                consideration vulnerable populations, including 
                schools, child care centers, nursing facilities, and 
                hospitals;
                    (B) community notification and warning systems; and
                    (C) surge capacities of hospitals and other health 
                care facilities in the area; and
            (2) what, if any, distinctions are there in preparedness 
        for a terrorist attack on a chemical facility in jurisdictions 
        that rely on volunteers to carry out fire, police, medical and 
        other response and jurisdictions that do not rely, in whole or 
        in part, on volunteers; and
            (3) all training, equipment, and support provided by the 
        Department of Homeland Security to local emergency response 
        providers in areas with a high concentration of covered 
        chemical facilities and chemical facilities of interest.
    (c) Survey.--In carrying out the study required under subsection 
(a), the Secretary may partner with a non-Departmental entity for the 
survey of a representative sample of emergency response providers in 
areas with a high concentration of covered chemical facilities, 
chemical facilities of interest, or other facilities with large 
quantities of chemicals.
    (d) Report.--No later than two years from the date on which the 
Secretary commences the study required under subsection (a), the 
Secretary shall submit to Congress the study, accompanied by plans, as 
appropriate, to--
            (1) improve the Department's counter-terrorism preparedness 
        and response planning, training, and equipment efforts to 
        ensure that they are better tailored and resourced to address 
        the unique needs of local emergency response providers in areas 
        with a high concentration of covered chemical facilities and 
        chemical facilities of interest; and
            (2) improve coordination among Federal, State, local, 
        tribal, and territorial government officials in emergency 
        planning and response in areas with high concentrations of 
        covered chemical facilities, chemical facilities of interest, 
        or other facilities with large quantities of hazardous 
        chemicals.
    (e) Public Availability.--The report required under this section 
shall be made publicly available, but may include a classified annex.

SEC. 17. PREVIOUSLY APPROVED FACILITIES.

    In the case of a chemical facility that is a covered chemical 
facility under title XXI of the Homeland Security Act of 2002 for which 
the Secretary of Homeland Security approved a site security plan under 
such title before the date of enactment of this Act, the Secretary 
shall not require the facility to resubmit the site security plan 
solely by reason of the enactment of this Act or the amendments made by 
this Act.

SEC. 18. TERMINATION.

    Section 5 of the Protecting and Securing Chemical Facilities From 
Terrorist Attacks Act of 2014 (Public Law 113-254; 6 U.S.C. 621 note) 
is amended by striking ``the date that is 5 years and 3 months after 
the effective date of this Act'' and inserting ``May 1, 2025''.
                                                 Union Calendar No. 427

116th CONGRESS

  2d Session

                               H. R. 3256

                      [Report No. 116-341, Part I]

_______________________________________________________________________

                                 A BILL

 To amend the Homeland Security Act of 2002 to reauthorize and improve 
 the Chemical Facility Anti-Terrorism Standards Program, and for other 
                               purposes.

_______________________________________________________________________

                           September 21, 2020

Committee on Energy and Commerce discharged; committed to the Committee 
 of the Whole House on the State of the Union and ordered to be printed
```