```

[Congressional Bills 110th Congress]
[From the U.S. Government Publishing Office]
[H.R. 5577 Introduced in House (IH)]

110th CONGRESS
  2d Session
                                H. R. 5577

   To amend the Homeland Security Act of 2002 to extend, modify, and 
recodify the authority of the Secretary of Homeland Security to enhance 
    security and protect against acts of terrorism against chemical 
                  facilities, and for other purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                             March 11, 2008

Mr. Thompson of Mississippi (for himself, Ms. Jackson-Lee of Texas, Mr. 
 Markey, Ms. Loretta Sanchez of California, Mr. Dicks, Ms. Harman, Mr. 
 DeFazio, Mrs. Lowey, Ms. Norton, Ms. Zoe Lofgren of California, Mrs. 
Christensen, Mr. Etheridge, Mr. Langevin, Mr. Cuellar, Mr. Carney, Ms. 
   Clarke, Mr. Al Green of Texas, Mr. Perlmutter, and Mr. Pascrell) 
 introduced the following bill; which was referred to the Committee on 
   Homeland Security, and in addition to the Committee on Energy and 
Commerce, for a period to be subsequently determined by the Speaker, in 
   each case for consideration of such provisions as fall within the 
                jurisdiction of the committee concerned

_______________________________________________________________________

                                 A BILL

 
   To amend the Homeland Security Act of 2002 to extend, modify, and 
recodify the authority of the Secretary of Homeland Security to enhance 
    security and protect against acts of terrorism against chemical 
                  facilities, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Chemical Facility Anti-Terrorism Act 
of 2008''.

SEC. 2. FINDINGS AND PURPOSE.

    (a) Findings.--Congress makes the following findings:
            (1) The Nation's chemical sector represents a target that 
        terrorists could exploit to cause consequences, including 
        death, injury, or serious adverse effects to human health, the 
        environment, critical infrastructure, national security, the 
        national economy, and public welfare.
            (2) Chemical facilities that pose such potential 
        consequences and that are vulnerable to terrorist attacks must 
        be protected.
            (3) The Secretary of Homeland Security has statutory 
        authority pursuant to section 550 of the Department of Homeland 
        Security Appropriations Act, 2007 (Public Law 109-295) to 
        regulate the security practices at chemical facilities that are 
        at significant risk of being terrorist targets.
            (4) The Secretary of Homeland Security issued interim final 
        regulations called the Chemical Facility Anti-Terrorism 
        Standards (hereinafter referred to in this section as 
        ``CFATS''), which became effective on June 8, 2007.
            (5) Such regulations, which are in the process of being 
        implemented by the Secretary, largely address the concerns of 
        Congress with respect to chemical facility security.
            (6) However, under current law, the statutory authority of 
        the Secretary of Homeland Security to regulate security 
        practices at chemical facilities and the CFATS regulations will 
        sunset in October of 2009.
    (b) Purpose.--The purpose of this Act is to give permanent status 
to the CFATS regulations and to provide additional Congressional 
guidance for the future implementation of such regulations.

SEC. 3. SENSE OF CONGRESS.

    (a) Sense of Congress With Respect to CFATS Regulations.--It is the 
sense of Congress that--
            (1) the Secretary of Homeland Security should develop and 
        administer all requirements of this Act to extend and modify 
        the regulations called the Chemical Facility Anti-Terrorism 
        Standards (hereinafter referred to in this section as 
        ``CFATS''), as in effect on the date of the enactment of this 
        Act; and
            (2) in carrying out this Act, the Secretary should use such 
        rules, regulations, or tools developed for purposes of the 
        CFATS regulations as the Secretary determines are appropriate, 
        including the list of chemicals of concern under Appendix A and 
        the Top Screen tool used to determine which facilities are 
        covered facilities under such regulations.
    (b) Sense of Congress With Respect to Chemical Security.--It is the 
sense of Congress that--
            (1) the Secretary of Homeland Security should take a 
        holistic approach to securing sources of chemicals against a 
        terrorist attack, which should not only secure the physical 
        facilities at which hazardous chemicals are stored or 
        manufactured, but should also secure the supply chain of such 
        chemicals; and
            (2) in keeping with the direction that Congress has 
        previously issued to the Secretary to address various aspects 
        of the supply of hazardous chemicals, the Secretary should 
        expediently exercise the Secretary's existing authority to 
        ensure that by focusing on chemicals at fixed-site facilities, 
        risk is not transferred to other potential sources of such 
        chemicals.

SEC. 4. EXTENSION, MODIFICATION, AND RECODIFICATION OF AUTHORITY OF 
              SECRETARY OF HOMELAND SECURITY TO REGULATE SECURITY 
              PRACTICES AT CHEMICAL FACILITIES.

    (a) In General.--The Homeland Security Act of 2002 (6 U.S.C. 101 et 
seq.) is amended by adding at the end the following new title:

  ``TITLE XXI--REGULATION OF SECURITY PRACTICES AT CHEMICAL FACILITIES

``SEC. 2101. DEFINITIONS.

    ``In this title, the following definitions apply:
            ``(1) The term `chemical facility' means any facility--
                    ``(A) at which a chemical is or may be used, 
                stored, manufactured, processed or distributed; and
                    ``(B) for which the Secretary requires the owner or 
                operator of the chemical facility to submit information 
                pursuant to section 2102(b)(2).
            ``(2) The term `chemical facility security performance 
        standard' means a risk-based standard established by the 
        Secretary to ensure or enhance the security of a chemical 
        facility against a chemical facility terrorist incident that is 
        designed to address--
                    ``(A) restricting the area perimeter;
                    ``(B) securing site assets;
                    ``(C) screening and controlling access to the 
                facility and to restricted areas within the facility by 
                screening or inspecting individuals and vehicles as 
                they enter, including--
                            ``(i) measures to deter the unauthorized 
                        introduction of dangerous substances and 
                        devices that may facilitate a chemical facility 
                        terrorist incident or actions having serious 
                        negative consequences for the population 
                        surrounding the chemical facility; and
                            ``(ii) measures implementing a regularly 
                        updated identification system that checks the 
                        identification of chemical facility personnel 
                        and other persons seeking access to the 
                        chemical facility and that discourages abuse 
                        through established disciplinary measures;
                    ``(D) methods to deter, detect, and delay a 
                chemical facility terrorist incident, creating 
                sufficient time between detection of a chemical 
                facility terrorist incident and the point at which the 
                chemical facility terrorist incident becomes 
                successful, including measures to--
                            ``(i) deter vehicles from penetrating the 
                        chemical facility perimeter, gaining 
                        unauthorized access to restricted areas, or 
                        otherwise presenting a hazard to potentially 
                        critical targets;
                            ``(ii) deter chemical facility terrorist 
                        incidents through visible, professional, well-
                        maintained security measures and systems, 
                        including security personnel, detection 
                        systems, barriers and barricades, and hardened 
                        or reduced value targets;
                            ``(iii) detect chemical facility terrorist 
                        incidents at early stages through counter 
                        surveillance, frustration of opportunity to 
                        observe potential targets, surveillance and 
                        sensing systems, and barriers and barricades; 
                        and
                            ``(iv) delay a chemical facility terrorist 
                        incident for a sufficient period of time so as 
                        to allow appropriate response through on-site 
                        security response, barriers and barricades, 
                        hardened targets, and well-coordinated response 
                        planning;
                    ``(E) securing and monitoring the shipping, 
                receipt, and storage of a substance of concern for the 
                chemical facility;
                    ``(F) deterring theft or diversion of a substance 
                of concern;
                    ``(G) deterring insider sabotage;
                    ``(H) deterring cyber sabotage, including by 
                preventing unauthorized onsite or remote access to 
                critical process controls, including supervisory 
                control and data acquisition systems, distributed 
                control systems, process control systems, industrial 
                control systems, critical business systems, and other 
                sensitive computerized systems;
                    ``(I) developing an emergency plan to respond to 
                chemical facility terrorist incidents with the guidance 
                of the Secretary that includes, as appropriate, an 
                early warning system for local emergency response 
                providers and the community surrounding the facility, 
                and exercising such plan internally and with the 
                assistance of local law enforcement officials and 
                emergency response providers to enhance the collective 
                response to terrorism;
                    ``(J) maintaining effective monitoring, 
                communications, and warning systems, including--
                            ``(i) measures designed to ensure that 
                        security systems and equipment are in good 
                        working order and inspected, tested, 
                        calibrated, and otherwise maintained;
                            ``(ii) measures designed to regularly test 
                        security systems, note deficiencies, correct 
                        for detected deficiencies, and record results 
                        so that they are available for inspection by 
                        the Department; and
                            ``(iii) measures to allow the chemical 
                        facility to promptly identify and respond to 
                        security system and equipment failures or 
                        malfunctions;
                    ``(K) ensuring mandatory annual security training, 
                exercises, and drills of chemical facility personnel;
                    ``(L) performing personnel surety for individuals 
                with access to restricted areas or critical assets by 
                conducting appropriate background checks and ensuring 
                appropriate credentials for unescorted visitors and 
                chemical facility personnel, including permanent and 
                part-time personnel, temporary personnel, and contract 
                personnel, including--
                            ``(i) measures designed to verify and 
                        validate identity;
                            ``(ii) measures designed to check criminal 
                        history;
                            ``(iii) measures designed to verify and 
                        validate legal authorization to work; and
                            ``(iv) measures designed to identify people 
                        with terrorist ties;
                    ``(M) escalating the level of protective measures 
                for periods of elevated threat;
                    ``(N) specific threats, vulnerabilities, or risks 
                identified by the Secretary for that chemical facility;
                    ``(O) reporting of significant security incidents 
                to the Department and to appropriate local law 
                enforcement officials;
                    ``(P) identifying, investigating, reporting, and 
                maintaining records of significant security incidents 
                and suspicious activities in or near the site;
                    ``(Q) establishing one or more officials and an 
                organization responsible for security and for 
                compliance with these standards;
                    ``(R) maintaining appropriate records relating to 
                the security of the facility;
                    ``(S) assessing, as appropriate, or utilizing 
                methods to reduce the consequences of a terrorist 
                attack; or
                    ``(T) any additional security performance standards 
                the Secretary may specify.
            ``(3) The term `chemical facility terrorist incident' means 
        an act or attempted act of terrorism committed at, near, or 
        against a chemical facility, including--
                    ``(A) the release of a substance of concern from a 
                chemical facility into the surrounding area as a 
                consequence of an act of terrorism;
                    ``(B) the obtaining of a substance of concern by 
                any person for the purpose of using the substance at a 
                location other than the chemical facility in 
                furtherance of an act of terrorism; or
                    ``(C) the sabotage of a chemical facility or a 
                substance of concern at a chemical facility in 
                furtherance of an act of terrorism.
            ``(4) The term `employee representative' means a 
        representative of the certified or recognized bargaining agent 
        engaged in a collective bargaining relationship with a private 
        or public owner or operator of a chemical facility.
            ``(5) The term `covered individual' means a permanent, 
        temporary, full-time, or part-time employee of a covered 
        chemical facility or an employee of an entity with which the 
        covered chemical facility has entered into a contract who is 
        performing responsibilities at the facility pursuant to the 
        contract.
            ``(6) The term `covered chemical facility' means a chemical 
        facility that the Secretary assigns to a risk-based tier under 
        section 2102(c) that is required to submit a security 
        vulnerability assessment and site security plan under section 
        2103.
            ``(7) The term `environment' has the meaning given the term 
        in section 101 of the Comprehensive Environmental Response 
        Compensation and Liability Act of 1980 (42 U.S.C. 9601).
            ``(8) The term `owner or operator of a chemical facility' 
        means any of the following:
                    ``(A) The person who owns a chemical facility.
                    ``(B) The person who leases such a facility.
                    ``(C) The person who operates such a facility.
            ``(9) The term `release' has the meaning given the term in 
        section 101 of the Comprehensive Environmental Response 
        Compensation and Liability Act of 1980 (42 U.S.C. 9601).
            ``(10) The term `substance of concern' means a chemical 
        substance in quantity and form that is designated by the 
        Secretary under section 2102(a) as a chemical substance that 
        poses a risk of being used in furtherance of a chemical 
        facility terrorist incident.
            ``(11) The term `method to reduce the consequences of a 
        terrorist attack' includes--
                    ``(A) input substitution;
                    ``(B) catalyst or carrier substitution;
                    ``(C) process redesign (including reuse or 
                recycling of a substance of concern);
                    ``(D) product reformulation;
                    ``(E) procedure simplification;
                    ``(F) technology modification;
                    ``(G) use of less hazardous substances or benign 
                substances;
                    ``(H) use of smaller quantities of substances of 
                concern;
                    ``(I) reduction of hazardous pressures or 
                temperatures;
                    ``(J) reduction of the possibility and potential 
                consequences of equipment failure and human error;
                    ``(K) improvement of inventory control and chemical 
                use efficiency; and
                    ``(L) reduction or elimination of the storage, 
                transportation, handling, disposal, and discharge of 
                substances of concern.

``SEC. 2102. RISK-BASED DESIGNATION AND RANKING OF CHEMICAL FACILITIES.

    ``(a) Substances of Concern.--
            ``(1) Designation by the secretary.--The Secretary may 
        designate any chemical substance as a substance of concern and 
        establish and revise the threshold quantity for a substance of 
        concern.
            ``(2) Matters for consideration.--In designating a chemical 
        substance or establishing or adjusting the threshold quantity 
        for a chemical substance under paragraph (1), the Secretary 
        shall consider the potential extent of death, injury, and 
        serious adverse effects to human health, the environment, 
        critical infrastructure, national security, the national 
        economy, and public welfare that would result from a chemical 
        facility terrorist incident.
    ``(b) List of Covered Chemical Facilities.--
            ``(1) Criteria for list of facilities.--The Secretary shall 
        maintain a list of covered chemical facilities that the 
        Secretary determines are of sufficient security risk for 
        inclusion on the list based on the following criteria:
                    ``(A) The potential threat or likelihood that the 
                chemical facility will be the target of a chemical 
                facility terrorist incident.
                    ``(B) The potential extent and likelihood of death, 
                injury, or serious adverse effects to human health, the 
                environment, critical infrastructure, national 
                security, the national economy, and public welfare that 
                could result from a chemical facility terrorist 
                incident.
                    ``(C) The proximity of the chemical facility to 
                population centers.
            ``(2) Submission of information.--The Secretary may require 
        the submission of information with respect to the quantities of 
        substances of concern that are used, stored, manufactured, 
        processed, or distributed by any chemical facility to determine 
        whether to designate a chemical facility as a covered chemical 
        facility for purposes of this title.
    ``(c) Assignment of Chemical Facilities to Risk-Based Tiers.--
            ``(1) Assignment.--The Secretary shall assign each covered 
        chemical facility to one of at least four risk-based tiers 
        established by the Secretary.
            ``(2) Provision of information.--The Secretary may request, 
        and the owner or operator of a covered chemical facility shall 
        provide, any additional information beyond any information 
        required to be submitted under subsection (b)(2) that is needed 
        for the Secretary to assign the chemical facility to the 
        appropriate tier under paragraph (1).
            ``(3) High-risk chemical facilities.--At least one of the 
        tiers established by the Secretary for the assignment of 
        chemical facilities under this subsection shall be a tier 
        designated for high-risk chemical facilities.
            ``(4) Authority to review.--The Secretary shall 
        periodically review the criteria under subsection (b)(1) and 
        may, at any time, determine whether a chemical facility is a 
        covered chemical facility or is no longer a covered chemical 
        facility or change the tier assignment under paragraph (1) of 
        any covered chemical facility.
            ``(5) Notification.--Not later than 60 days after the date 
        on which the Secretary determines that a chemical facility is a 
        covered chemical facility or is no longer a covered chemical 
        facility or changes the tier assignment under paragraph (1) of 
        a covered chemical facility, the Secretary shall notify the 
        owner or operator of that chemical facility of that 
        determination or change together with the reason for the 
        determination or change.

``SEC. 2103. SECURITY VULNERABILITY ASSESSMENTS AND SITE SECURITY 
              PLANS.

    ``(a) Security Vulnerability Assessment and Site Security Plan 
Required for Covered Chemical Facilities.--
            ``(1) Requirement for security vulnerability assessment and 
        site security plan.--The Secretary shall--
                    ``(A) establish standards, protocols, and 
                procedures for security vulnerability assessments and 
                site security plans to be required for covered chemical 
                facilities;
                    ``(B) provide to the owner or operator of each 
                covered chemical facility--
                            ``(i) the number of individuals at risk of 
                        death, injury, or severe adverse effects to 
                        human health as a result of a worst case 
                        chemical facility terrorist incident at the 
                        covered chemical facility;
                            ``(ii) information related to the 
                        criticality of the covered chemical facility 
                        for purposes of assessing the degree to which 
                        the facility is critical to the economy or 
                        national security of the United States;
                            ``(iii) the proximity or interrelationship 
                        of the covered chemical facility to other 
                        critical infrastructure, including any utility 
                        or infrastructure (including transportation) 
                        upon which the chemical facility relies to 
                        operate safely and securely; and
                            ``(iv) recommended best practices for 
                        securing chemical facilities;
                    ``(C) require the owner or operator of each such 
                covered chemical facility to--
                            ``(i) conduct an assessment of the 
                        vulnerability of the covered chemical facility 
                        to a chemical facility terrorist incident;
                            ``(ii) prepare and implement a site 
                        security plan for that covered chemical 
                        facility that addresses the security 
                        vulnerability assessment and the risk-based 
                        chemical security performance standards under 
                        subsection (c); and
                            ``(iii) include appropriate supervisory and 
                        non-supervisory employees of the covered 
                        chemical facility, and any employee 
                        representatives, as appropriate, in developing 
                        the security vulnerability assessment and site 
                        security plan required under this clause; and
                    ``(D) set deadlines for the completion of security 
                vulnerability assessments and site security plans.
            ``(2) Criteria.--The Secretary shall ensure that the 
        requirements under paragraph (1)--
                    ``(A) are risk-based;
                    ``(B) are performance-based; and
                    ``(C) take into consideration--
                            ``(i) the cost and technical feasibility of 
                        compliance by a covered chemical facility with 
                        the requirements under this title;
                            ``(ii) the different quantities and forms 
                        of substances of concern stored, used, and 
                        handled at covered chemical facilities; and
                            ``(iii) the criteria under section 
                        2102(a)(2).
    ``(b) Minimum Requirements for High-Risk Chemical Facilities.--
            ``(1) Requirements for security vulnerability 
        assessments.--In the case of a covered chemical facility 
        assigned to a high-risk tier under section 2102(c)(3), the 
        Secretary shall require that the security vulnerability 
        assessment required under this section for that chemical 
        facility include each of the following:
                    ``(A) The identification of any hazard that could 
                result from a chemical facility terrorist incident at 
                the facility.
                    ``(B) Any vulnerability of the chemical facility 
                with respect to--
                            ``(i) physical security;
                            ``(ii) programmable electronic devices, 
                        computers, computer or communications networks, 
                        Supervisory Control and Data Acquisition 
                        systems, Process Control Systems, or other 
                        automated systems used by the chemical 
                        facility;
                            ``(iii) alarms, cameras, and other 
                        protection systems;
                            ``(iv) communication systems;
                            ``(v) insider threats; and
                            ``(vi) the structural integrity of 
                        equipment for storage, handling, and other 
                        purposes.
                    ``(C) Consideration of information relating to 
                threats relevant to the chemical facility that is 
                provided by the Secretary in accordance with paragraph 
                (3).
                    ``(D) Such other information as the Secretary 
                determines is appropriate.
            ``(2) Requirements for site security plans.--In the case of 
        a covered chemical facility assigned to a high-risk tier under 
        section 2102(c)(3), the Secretary shall require that the site 
        security plan required under this section for that chemical 
        facility include each of the following:
                    ``(A) A description of security measures selected 
                by the facility that--
                            ``(i) address the vulnerabilities of the 
                        facility identified in the security 
                        vulnerability assessment; and
                            ``(ii) meet the risk-based chemical 
                        facility security performance standards 
                        established by the Secretary.
                    ``(B) A plan and schedule for periodic drills and 
                exercises to be conducted at the chemical facility the 
                development and execution of which includes 
                participation by appropriate supervisory and non-
                supervisory facility employees and any employee 
                representatives, local law enforcement agencies, and 
                emergency response providers.
                    ``(C) Equipment, plans, and procedures to be 
                implemented or used by or at the chemical facility in 
                the event of a chemical facility terrorist incident 
                that affects the facility, including site evacuation, 
                release mitigation, and containment plans.
                    ``(D) An identification of any steps taken to 
                coordinate with State, local, and tribal law 
                enforcement agencies, emergency response providers, the 
                Department and other Federal agencies, and Federal 
                officials on security measures and plans for the 
                collective response to a chemical facility terrorist 
                incident.
                    ``(E) A specification of the security officer who 
                will be the point of contact for incident management 
                purposes and for Federal, State, local, and tribal law 
                enforcement and emergency response providers.
                    ``(F) A description of enhanced security measures 
                to be used during periods of time when the Secretary 
                determines that heightened terrorist threat conditions 
                exist.
                    ``(G) An assessment and, as appropriate, a plan to 
                implement methods to reduce the consequences of a 
                terrorist attack.
            ``(3) Provision of threat-related information.--
                    ``(A) Responsibilities of the secretary.--The 
                Secretary shall provide in a timely manner, to the 
                maximum extent practicable under applicable authority 
                and in the interests of national security, to an owner, 
                operator, or security officer of a chemical facility 
                assigned to the high-risk tier under section 
                2102(c)(3), or another appropriate person, threat 
                information that is relevant to that chemical facility, 
                including an assessment of the most likely method that 
                could be used by terrorists to exploit any 
                vulnerabilities of the chemical facility and the 
                likelihood of the success of such method.
                    ``(B) Responsibilities of owner or operator.--The 
                Secretary shall require the owner or operator of a 
                covered chemical facility to provide in a timely manner 
                to the Secretary a full report on any intentional, 
                attempted, or accidental penetration of the physical 
                security or cyber security of the covered chemical 
                facility.
            ``(4) Red team exercises.--The Secretary shall conduct red 
        team exercises at chemical facilities selected by the Secretary 
        that have been assigned to a high-risk tier under section 
        2102(c)(3). The Secretary shall ensure that each such facility 
        shall undergo a red team exercise during the six-year period 
        that begins on the effective date of the regulations prescribed 
        to carry out this title. The exercises required under this 
        paragraph shall be--
                    ``(A) conducted after informing the owner or 
                operator and any employee representative of the 
                selected chemical facility and receiving positive 
                confirmation from such owner or operator and employee 
                representative, if any;
                    ``(B) designed to identify at the selected chemical 
                facility--
                            ``(i) any vulnerabilities of the chemical 
                        facility;
                            ``(ii) possible methods of a chemical 
                        facility terrorist incident at that facility; 
                        and
                            ``(iii) any weaknesses in the security plan 
                        of the chemical facility; and
                    ``(C) conducted so as not to compromise the 
                security or safety of the chemical facility during the 
                exercises.
            ``(5) Provision of technical guidance.--The Secretary shall 
        provide, upon request, assistance and guidance to a covered 
        chemical facility conducting a security vulnerability 
        assessment or site security plan required under this section.
    ``(c) Risk-Based Chemical Security Performance Standards.--
            ``(1) In general.--The Secretary shall establish risk-based 
        chemical security performance standards for the site security 
        plans required to be prepared by covered chemical facilities. 
        The standards shall--
                    ``(A) require separate and increasingly stringent 
                risk-based chemical security performance standards for 
                site security plans as the level of risk associated 
                with the tier increases; and
                    ``(B) permit each covered chemical facility 
                submitting a site security plan to select a combination 
                of security measures that satisfy the risk-based 
                chemical security performance standards established by 
                the Secretary under this subsection.
            ``(2) Criteria.--In establishing the risk-based chemical 
        security performance standards under paragraph (1), the 
        Secretary shall consider the criteria under subsection (a)(2).
            ``(3) Guidance.--The Secretary shall provide guidance to 
        each covered chemical facility regarding the types of security 
        performance measures that, if applied, could satisfy the 
        requirements under this section, including measures using 
        methods to reduce the consequences of a terrorist attack that, 
        if applied, could result in the Secretary removing the facility 
        from the list or assigning the facility to a lower risk tier.
    ``(d) Co-Located Chemical Facilities.--The Secretary shall allow 
the owner or operator of two or more chemical facilities that are 
located geographically close to each other or otherwise co-located to 
develop and implement coordinated security vulnerability assessments 
and site security plans, at the discretion of the owner or operator of 
the chemical facilities.
    ``(e) Alternate Security Programs Satisfying Requirements for 
Security Vulnerability Assessment and Site Security Plan.--
            ``(1) Determination by the secretary.--In response to a 
        request by an owner or operator of a covered chemical facility, 
        or at the discretion of the Secretary, the Secretary may accept 
        an alternative security program that the Secretary determines 
        meets all or part of the requirements of this section and that 
        provides for an equivalent level of security to the level of 
        security provided for by the requirements of this title.
            ``(2) Use of alternate security programs.--
                    ``(A) Use by individual chemical facilities.--Upon 
                review and written determination by the Secretary under 
                paragraph (1) that the alternate security program of a 
                covered chemical facility subject to the requirements 
                of this section satisfies some or all of the 
                requirements of this section, the chemical facility may 
                use that alternate security program.
                    ``(B) Use by classes of chemical facilities.--At 
                the discretion of the Secretary, the Secretary may 
                identify a class or category of covered chemical 
                facilities subject to the requirements of this section 
                that may use an alternate security program recognized 
                under this section in order to comply with all or part 
                of the requirements of this section.
            ``(3) Partial recognition.--If the Secretary finds that an 
        alternate security program satisfies only part of the 
        requirements of this section, the Secretary may allow a covered 
        chemical facility subject to the requirements of this section 
        to comply with that alternate security program for purposes of 
        that requirement, but shall require the covered chemical 
        facility to submit any additional information required to 
        satisfy the requirements of this section not met by that 
        alternate security program.
            ``(4) Notification.--If the Secretary does not approve an 
        alternate security program for which a petition is submitted 
        under paragraph (1), the Secretary shall provide to the person 
        submitting a petition under paragraph (1) written notification 
        that includes an explanation of the reasons why the approval 
        was not made.
            ``(5) Review required.--Nothing in this subsection shall 
        relieve the Secretary of the obligation--
                    ``(A) to review a security vulnerability assessment 
                and site security plan submitted by a covered chemical 
                facility under this section; and
                    ``(B) to approve or disapprove each such assessment 
                or plan on an individual basis.
    ``(f) Other Authorities.--
            ``(1) Other provisions of law.--A covered chemical facility 
        that is required to prepare a security vulnerability assessment 
        or site security plan or to submit or develop other relevant 
        documents under chapter 701 of title 46, United States Code, 
        the Federal Water Pollution Control Act (33 U.S.C. 1251 et 
        seq.), or section 1433 of the Safe Drinking Water Act (42 
        U.S.C. 300i-2) shall submit such plan or documents to the 
        Secretary. The Secretary shall determine the extent to which 
        actions taken by such a chemical facility pursuant to another 
        provision of law fulfill the requirements of this section and 
        may require such a chemical facility to complete any additional 
        action required by this section. The Secretary shall work with 
        the heads of the other Federal departments and agencies with 
        authority with respect to such a covered chemical facility to 
        ensure that requirements under other provisions of law and the 
        requirements under this title are non-duplicative and non-
        contradictory.
            ``(2) Coordination of storage licensing or permitting 
        requirement.--In the case of any storage required to be 
        licensed or permitted under chapter 40 of title 18, United 
        States Code, the Secretary shall prescribe the rules and 
        regulations for the implementation of this section with the 
        concurrence of the Attorney General and avoid unnecessary 
        duplication of regulatory requirements.
    ``(g) Role of Employees.--
            ``(1) Description of role required.--As appropriate, 
        security vulnerability assessments or site security plans 
        required under this section should describe the roles or 
        responsibilities that chemical facility employees are expected 
        to perform to deter or respond to a chemical facility terrorist 
        incident.
            ``(2) Training for employees.--The owner or operator of a 
        covered facility required to submit a site security plan under 
        this section shall annually provide each employee of the 
        facility with a minimum of 8 hours of training. Such training 
        shall include--
                    ``(A) an identification and discussion of 
                substances of concern that pose a risk to the 
                workforce, emergency response providers, and the 
                community;
                    ``(B) a discussion of the prevention, preparedness, 
                and response plan for the facility, including off-site 
                consequence impacts;
                    ``(C) an identification of opportunities to reduce 
                or eliminate the vulnerability of the facility to a 
                terrorist incident through the use of methods to reduce 
                the consequences of a terrorist attack; and
                    ``(D) a discussion and practice of appropriate 
                emergency response procedures.

``SEC. 2104. RECORD KEEPING; SITE INSPECTIONS.

    ``(a) Record Keeping.--The Secretary shall require each covered 
chemical facility required to submit a security vulnerability 
assessment or site security plan under section 2103 to maintain a 
current copy of the assessment and the plan at the chemical facility.
    ``(b) Right of Entry.--For purposes of carrying out this title, the 
Secretary (or a designee of the Secretary) shall have, at a reasonable 
time and on presentation of credentials, a right of entry to, on, or 
through any property of a covered chemical facility or any property on 
which any record required to be maintained under this section is 
located.
    ``(c) Inspections and Verifications.--
            ``(1) In general.--The Secretary shall, at such time and 
        place as the Secretary determines to be reasonable and 
        appropriate, conduct or require the conduct of chemical 
        facility security inspections and verifications and may, by 
        regulation, authorize third-party inspections and verifications 
        by persons trained and certified by the Secretary for that 
        purpose.
            ``(2) Requirements.--To ensure and evaluate compliance with 
        this title, including any regulations or requirements adopted 
        by the Secretary in furtherance of the purposes of this title, 
        in conducting or requiring an inspection or verification under 
        paragraph (1), the Secretary shall--
                    ``(A) consult with owners, operators, and 
                supervisory and non-supervisory employees of the 
                covered chemical facility, and any employee 
                representatives, as appropriate; and
                    ``(B) provide an opportunity to such owners, 
                operators, employees, and employee representatives to 
                be present during the inspection or verification for 
                the purpose of providing assistance when and where it 
                is appropriate.
    ``(d) Requests for Records.--
            ``(1) In general.--In carrying out this title, the 
        Secretary (or a designee of the Secretary) may require the 
        submission of or, on presentation of credentials, may at 
        reasonable times obtain access to and copy any documentation 
        necessary for--
                    ``(A) reviewing or analyzing a security 
                vulnerability assessment or site security plan 
                submitted under section 2103; or
                    ``(B) implementing such a site security plan.
            ``(2) Proper handling of records.--In accessing or copying 
        any documentation under paragraph (1), the Secretary (or a 
        designee of the Secretary) shall ensure that the documentation 
        is handled and secured appropriately.
    ``(e) Provision of Records to Employee Representatives.--If a 
covered chemical facility required to submit a security vulnerability 
assessment or site security plan submitted under section 2103 has an 
employee representative, the owner or operator of the facility shall 
provide the employee representative with a copy of any security 
vulnerability assessment or site security plan submitted. The employee 
representative shall ensure that any such assessment or plan provided 
to the representative is handled and secured appropriately in 
accordance with section 2108.
    ``(f) Compliance.--If the Secretary determines that an owner or 
operator of a covered chemical facility required to submit a security 
vulnerability assessment or site security plan under section 2103 fails 
to maintain, produce, or allow access to records or to the property of 
the covered chemical facility as required by this section, the 
Secretary shall issue an order requiring compliance with this section.

``SEC. 2105. ENFORCEMENT.

    ``(a) Submission of Information.--
            ``(1) Initial submission.--The Secretary shall establish 
        specific deadlines for the submission to the Secretary of the 
        security vulnerability assessments and site security plans 
        required under this title. The Secretary may establish 
        different submission requirements for the different tiers of 
        chemical facilities under section 2102(c).
            ``(2) Major changes requirement.--The Secretary shall 
        establish specific deadlines and requirements for the 
        submission by a covered chemical facility of information 
        describing--
                    ``(A) any change in the use by the covered chemical 
                facility of more than a threshold amount of any 
                substance of concern that could affect the requirements 
                of the chemical facility under this title; and
                    ``(B) any significant change in a security 
                vulnerability assessment or site security plan 
                submitted by the covered chemical facility.
            ``(3) Periodic review by chemical facility required.--The 
        Secretary shall require the owner or operator of a covered 
        chemical facility required to submit a security vulnerability 
        assessment or site security plan under this section to 
        periodically submit to the Secretary a review of the adequacy 
        of the security vulnerability assessment or site security plan 
        that includes a description of any changes made to the security 
        vulnerability assessment or site security plan.
    ``(b) Review of Site Security Plan.--
            ``(1) Deadline for review.--Not later than 180 days after 
        the date on which the Secretary receives a security 
        vulnerability assessment or site security plan under this 
        title, the Secretary shall review and approve or disapprove 
        such assessment or plan.
            ``(2) Disapproval.--The Secretary shall disapprove a 
        security vulnerability assessment or site security plan if the 
        Secretary determines that--
                    ``(A) the security vulnerability assessment or site 
                security plan does not comply with the requirements 
                under section 2103; or
                    ``(B) in the case of a site security plan, the plan 
                or the implementation of the plan is insufficient to 
                address any vulnerabilities identified in a security 
                vulnerability assessment of the covered chemical 
                facility or associated oversight actions taken under 
                section 2103 or section 2104, including a red team 
                exercise.
            ``(3) Provision of notification of disapproval.--If the 
        Secretary disapproves the security vulnerability assessment or 
        site security plan submitted by a covered chemical facility 
        under this title or the implementation of a site security plan 
        by such a chemical facility, the Secretary shall--
                    ``(A) provide the owner or operator of the covered 
                chemical facility a written notification of the 
                disapproval, that--
                            ``(i) includes a clear explanation of 
                        deficiencies in the assessment, plan, or 
                        implementation of the plan; and
                            ``(ii) requires the owner or operator of 
                        the covered chemical facility to revise the 
                        assessment or plan to address any deficiencies 
                        and, by such date as the Secretary determines 
                        is appropriate, to submit to the Secretary the 
                        revised assessment or plan;
                    ``(B) provide guidance to assist the owner or 
                operator of the covered chemical facility in addressing 
                such deficiency;
                    ``(C) in the case of a covered chemical facility 
                for which the owner or operator of the facility does 
                not address such deficiencies by such date as the 
                Secretary determines to be appropriate, issue an order 
                requiring the owner or operator to correct specified 
                deficiencies by a specified date; and
                    ``(D) in the case of a covered chemical facility 
                assigned to a high-risk tier under section 2102(c)(3), 
                upon the request of the owner or operator of the 
                facility, consult with the owner or operator to 
                identify appropriate steps to be taken by the owner or 
                operator to address the deficiencies identified by the 
                Secretary.
            ``(4) Order to cease operations.--If the Secretary 
        determines that the owner or operator of a chemical facility 
        assigned to a high-risk tier under section 2102(c)(3) continues 
        to be in noncompliance after an order for compliance is issued 
        under paragraph (3), the Secretary may issue an order to the 
        owner or operator to cease operations at the facility until the 
        owner or operator complies with the order issued under 
        paragraph (3). Notwithstanding the preceding sentence, the 
        Secretary may not issue an order to cease operations under this 
        paragraph to the owner or operator of a drinking water or 
        wastewater facility unless the Secretary determines that 
        continued operation of the facility represents a clear and 
        present danger to homeland security.
    ``(c) Reporting Process.--
            ``(1) Establishment.--The Secretary shall establish, and 
        provide information to the public regarding a process by which 
        any person may submit a report to the Secretary regarding 
        problems, deficiencies, or vulnerabilities at a covered 
        chemical facility associated with the risk of a chemical 
        facility terrorist incident.
            ``(2) Confidentiality.--The Secretary shall keep 
        confidential the identity of a person that submits a report 
        under paragraph (1) and any such report shall be treated as 
        protected information under section 2108(f) to the extent that 
        it does not consist of publicly available information.
            ``(3) Acknowledgment of receipt.--If a report submitted 
        under paragraph (1) identifies the person submitting the 
        report, the Secretary shall respond promptly to such person to 
        acknowledge receipt of the report.
            ``(4) Steps to address problems.--The Secretary shall 
        review and consider the information provided in any report 
        submitted under paragraph (1) and shall take appropriate steps 
        under this title to address any problem, deficiency, or 
        vulnerability identified in the report.
    ``(d) Retaliation Prohibited.--
            ``(1) Prohibition.--No owner or operator of a chemical 
        facility, profit or not-for-profit corporation, association, or 
        any contractor, subcontractor or agent thereof, or a Federal, 
        State, local, or tribal government agency may discharge any 
        employee or otherwise discriminate against any employee with 
        respect to his compensation, terms, conditions, security 
        clearance or other access to classified or sensitive 
        information, or other privileges of employment because the 
        employee (or any person acting pursuant to a request of the 
        employee)--
                    ``(A) notified the Secretary, the owner or operator 
                of a chemical facility, or the employee's employer of 
                an alleged violation of this title, including 
                communications related to carrying out the employee's 
                job duties;
                    ``(B) refused to engage in any practice made 
                unlawful by this title, if the employee has identified 
                the alleged illegality to the employer;
                    ``(C) testified before or otherwise provided 
                information relevant for Congress or for any Federal or 
                State proceeding regarding any provision (or proposed 
                provision) of this title;
                    ``(D) commenced, caused to be commenced, or is 
                about to commence or cause to be commenced a proceeding 
                under this title;
                    ``(E) testified or is about to testify in any such 
                proceeding; or
                    ``(F) assisted or participated or is about to 
                assist or participate in any manner in such a 
                proceeding or in any other manner in such a proceeding 
                or in any other action to carry out the purposes of 
                this title.
            ``(2) Enforcement action.--Any employee covered by this 
        section who alleges discrimination by an employer in violation 
        of subsection (a) may bring an action governed by the rules and 
        procedures, legal burdens of proof, and remedies applicable 
        under subsections (c) through (g) of section 20109 of title 49, 
        United States Code.

``SEC. 2106. PENALTIES.

    ``(a) Civil Penalties.--
            ``(1) In general.--The Secretary may bring an action in a 
        United States district court against any owner or operator of a 
        chemical facility that violates or fails to comply with--
                    ``(A) any order issued by the Secretary under this 
                title; or
                    ``(B) any site security plan approved by the 
                Secretary under this title.
            ``(2) Relief.--In any action under paragraph (1), a court 
        may issue an order for injunctive relief and may award a civil 
        penalty of not more than $50,000 for each day on which a 
        violation occurs or a failure to comply continues.
    ``(b) Penalties for Unauthorized Disclosure.--Any officer or 
employee of a Federal, State, local, or tribal government agency who, 
in a manner or to an extent not authorized by law, knowingly discloses 
any record containing protected information described in section 
2108(f) shall--
            ``(1) be imprisoned not more than 1 year, fined under 
        chapter 227 of title 18, United States Code, or both; and
            ``(2) if an officer or employee of the Government, be 
        removed from Federal office or employment.
    ``(c) Treatment of Information in Adjudicative Proceedings.--In a 
proceeding under this title, information protected under section 2108, 
or related vulnerability or security information, shall be treated in 
any judicial or administrative action as if the information were 
classified material.

``SEC. 2107. FEDERAL PREEMPTION.

    ``(a) In General.--Nothing in this title shall preclude or deny any 
right of any State or political subdivision thereof to adopt or enforce 
any regulation, requirement, or standard of performance with respect to 
chemical facility security to deter, detect, or respond to a chemical 
facility terrorist incident that is more stringent than a regulation, 
requirement, or standard of performance issued pursuant to this title, 
or shall otherwise impair any right or jurisdiction of any State or 
political subdivision thereof with respect to chemical facilities 
within that State or political subdivision thereof unless a direct 
conflict exists between this title and the regulation, requirement, or 
standard of performance issued by a State or political subdivision 
thereof.
    ``(b) Other Requirements.--Nothing in this title shall preclude or 
deny the right of any State or political subdivision thereof to adopt 
or enforce any regulation, requirement, or standard of performance 
relating to environmental protection, health, or safety.

``SEC. 2108. PROTECTION OF INFORMATION.

    ``(a) Prohibition of Public Disclosure of Protected Information.--
            ``(1) In general.--The Secretary shall ensure that 
        protected information, as described in subsection (f), is not 
        disclosed except as provided in this title.
            ``(2) Specific prohibitions.--In carrying out paragraph 
        (1), the Secretary shall ensure that protected information is 
        not disclosed--
                    ``(A) by any Federal agency under section 552 of 
                title 5, United States Code; or
                    ``(B) under any State or local law.
    ``(b) Regulations.--
            ``(1) In general.--In carrying out the requirements of this 
        title, the Secretary shall prescribe such regulations, and may 
        issue such orders, as necessary to prohibit the unauthorized 
        disclosure of protected information, as described in subsection 
        (f).
            ``(2) Requirements.--The regulations prescribed under 
        paragraph (1) shall--
                    ``(A) allow for information sharing, on a 
                confidential basis, with and between, Federal, State, 
                local, and tribal law enforcement officials, and 
                emergency response providers, and appropriate 
                supervisory and non-supervisory chemical facility 
                personnel, and employee representatives, if any, with 
                security, operational, or fiduciary responsibility for 
                the facility;
                    ``(B) provide for the confidential use of protected 
                information in any administrative or judicial 
                proceeding, including placing under seal any such 
                information that is contained in any filing, order, or 
                other document used in such proceedings that could 
                otherwise become part of the public record;
                    ``(C) limit access to protected information to 
                persons designated by the Secretary; and
                    ``(D) ensure, to the maximum extent practicable, 
                that--
                            ``(i) protected information shall be 
                        maintained in a secure location; and
                            ``(ii) access to protected information 
                        shall be limited as may be necessary to--
                                    ``(I) enable enforcement of this 
                                title; or
                                    ``(II) address an imminent and 
                                substantial threat to security or an 
                                imminent chemical facility terrorist 
                                incident.
    ``(c) Other Obligations Unaffected.--Nothing in this section 
affects any obligation of the owner or operator of a chemical facility 
to submit or make available information to facility employees, employee 
organizations, or a Federal, State, tribal, or local government agency 
under, or otherwise to comply with, any other law.
    ``(d) Submission of Information to Congress.--Nothing in this title 
shall be construed as authorizing the withholding of any information 
from Congress.
    ``(e) Disclosure of Independently Furnished Information.--Nothing 
in this title shall be construed as affecting any authority or 
obligation of a Federal agency to disclose any record or information 
that the Federal agency obtains from a chemical facility under any 
other law.
    ``(f) Protected Information.--
            ``(1) In general.--For purposes of this section, protected 
        information includes the following:
                    ``(A) The criteria and data used by the Secretary 
                to assign chemical facilities to risk-based tiers under 
                section 2102 and the tier to which each such facility 
                is assigned.
                    ``(B) The security vulnerability assessments and 
                site security plans submitted to the Secretary under 
                this title.
                    ``(C) Information concerning the risk-based 
                chemical facility security performance standards for a 
                chemical facility under section 2103(c).
                    ``(D) Any other information generated or collected 
                by a Federal, State, local, or tribal government agency 
                or by a chemical facility for the purpose of carrying 
                out or complying with this title--
                            ``(i) that describes any vulnerability of a 
                        chemical facility to an act of terrorism;
                            ``(ii) that describes the assignment of any 
                        chemical facility to a risk-based tier under 
                        this title; or
                            ``(iii) that describes any security measure 
                        (including any procedure, equipment, training, 
                        or exercise) for the protection of a chemical 
                        facility from an act of terrorism.
            ``(2) Exclusions.--For purposes of this section, protected 
        information does not include--
                    ``(A) information that is publicly available;
                    ``(B) information that a chemical facility has 
                disclosed other than in accordance with this section; 
                or
                    ``(C) information that, if disclosed, would not be 
                detrimental to the security of a chemical facility.

``SEC. 2109. CERTIFICATION BY THIRD-PARTY ENTITIES.

    ``(a) Certification by Third-Party Entities.--The Secretary may 
designate a third-party entity to carry out any function under 
subsection (e)(5) of section 2103, subsection (b), (c), or (d) of 
section 2104, or subsection (b)(1) of section 2105.
    ``(b) Qualifications.--The Secretary shall establish standards for 
the qualifications of third-party entities, including knowledge of 
physical infrastructure protection, cybersecurity, chemical facility 
security, hazard analysis, chemical process engineering, chemical 
process safety reviews, and other such factors that the Secretary 
determines to be necessary.
    ``(c) Procedures and Requirements for Private Entities.--Before 
designating a third-party entity to carry out a function under 
subsection (a), the Secretary shall--
            ``(1) develop, document, and update, as necessary, minimum 
        standard operating procedures and requirements applicable to 
        such entities designated under subsection (a), including--
                    ``(A) conducting a 90-day independent review of the 
                procedures and requirements (or updates thereto) and 
                the results of the analyses of such procedures (or 
                updates thereto) pursuant to subtitle G of title VIII; 
                and
                    ``(B) upon completion of the independent review 
                under subparagraph (A), designating any procedure or 
                requirement (or any update thereto) as a qualified 
                anti-terrorism technology pursuant to section 862(b);
            ``(2) conduct safety and hazard analyses of the standard 
        operating procedures and requirements developed under paragraph 
        (1);
            ``(3) conduct a review of the third-party entities' 
        business engagements to ensure that no conflict exists that 
        could compromise the execution of any functions under 
        subsection (e)(5) of section 2103, subsection (b), (c), or (d) 
        of section 2104, or subsection (c)(1) of section 2105; and
            ``(4) conduct a review of the third-party entities' 
        business practices and disqualify any of these organizations 
        that offer related auditing or consulting services to chemical 
        facilities as private sector vendors.
    ``(d) Ensuring Contracting With Certain Small Business Concerns.--
            ``(1) Requirements for prime contracts.--The Secretary 
        shall include in each contract awarded to a third-party 
        entity--
                    ``(A) a requirement that the third-party entity 
                develop and implement a plan for the award of 
                subcontracts, as appropriate, to small business 
                concerns and disadvantaged business concerns in 
                accordance with other applicable requirements, 
                including the terms of such plan, as appropriate; and
                    ``(B) a requirement that the third-party entity 
                shall submit to the Secretary, during performance of 
                the contract, periodic reports describing the extent to 
                which the contractor has complied with such plan, 
                including specification (by total dollar amount and by 
                percentage of the total dollar value of the contract) 
                of the value of subcontracts awarded at all tiers of 
                subcontracting to small business concerns, including 
                socially and economically disadvantaged small 
                businesses concerns, small business concerns owned and 
                controlled by service-disabled veterans, HUBZone small 
                business concerns, small business concerns eligible to 
                be awarded contracts pursuant to section 8(a) of the 
                Small Business Act (15 U.S.C. 637(a)), and historically 
                black colleges and universities and Hispanic-serving 
                institutions, tribal colleges and universities, and 
                other minority institutions.
            ``(2) Definitions.--For purposes of this subsection:
                    ``(A) The terms `socially and economically 
                disadvantaged small businesses concern', `small 
                business concern owned and controlled by service-
                disabled veterans', and `HUBZone small business 
                concern' have the meaning given such terms under the 
                Small Business Act (15 U.S.C. 631 et seq.).
                    ``(B) The term `historically black colleges and 
                universities' means part B institutions under title III 
                of the Higher Education Act of 1965 (20 U.S.C. 1061).
                    ``(C) The term `Hispanic-serving institution' has 
                the meaning given such term under title V of the Higher 
                Education Act of 1965 (20 U.S.C. 1101a(a)(5)).
                    ``(D) The term `tribal colleges and universities' 
                has the meaning given such term under the Tribally 
                Controlled College or University Assistance Act of 1978 
                (25 U.S.C. 1801 et seq.)).
            ``(3) Utilization of alliances.--The Secretary shall, to 
        the maximum extent practicable, seek to facilitate the award of 
        contracts to conduct certification under subsection (a) to 
        alliances of business concerns referred to in paragraph (1)(B).
            ``(4) Annual report.--
                    ``(A) In general.--By not later than October 31 of 
                each year, the Secretary shall submit to the Committee 
                on Homeland Security of the House of Representatives 
                and the Committee on Homeland Security and Governmental 
                Affairs of the Senate a report on the award of 
                contracts to conduct certification under subsection (a) 
                to business concerns referred to in paragraph (1)(B) 
                during the fiscal year preceding the fiscal year in 
                which the report is submitted.
                    ``(B) Contents.--The Secretary shall include in 
                each report under subparagraph (A)--
                            ``(i) a specification of the value of such 
                        contracts, by dollar amount and as a percentage 
                        of the total dollar value of all contracts 
                        awarded by the Department in such fiscal year;
                            ``(ii) a specification of the total dollar 
                        value of such contracts awarded to each of the 
                        categories of business concerns referred to in 
                        paragraph (1)(B); and
                            ``(iii) if the percentage of the total 
                        dollar value of contracts awarded under this 
                        section specified under clause (i) is less than 
                        25 percent, an explanation of--
                                    ``(I) why the percentage is less 
                                than 25 percent; and
                                    ``(II) what will be done to ensure 
                                that the percentage for the following 
                                fiscal year will not be less than 25 
                                percent.
    ``(e) Technical Review and Approval.--Not later than 60 days after 
the date on which the results of the safety and hazard analysis of the 
standard operating procedures and requirements are completed under 
subsection (c)(2), the Secretary shall--
            ``(1) complete a technical review of the procedures and 
        requirements (or updates thereto) under sections 862(b) and 
        863(d)(2); and
            ``(2) approve or disapprove such procedures and 
        requirements (or updates thereto).
    ``(f) Effect of Approval.--
            ``(1) Issuance of certificate of conformance.--In 
        accordance with section 863(d)(3), the Secretary shall issue a 
        certificate of conformance to a third-party entity to perform a 
        function under subsection (a) if the entity--
                    ``(A) demonstrates to the satisfaction of the 
                Secretary the ability to perform functions in 
                accordance with standard operating procedures and 
                requirements (or updates thereto) approved by the 
                Secretary under this section;
                    ``(B) agrees to--
                            ``(i) perform such function in accordance 
                        with such standard operating procedures and 
                        requirements (or updates thereto); and
                            ``(ii) maintain liability insurance 
                        coverage at policy limits and in accordance 
                        with conditions to be established by the 
                        Secretary pursuant to section 864; and
                    ``(C) signs an agreement to protect the proprietary 
                and confidential information of any chemical facility 
                with respect to which the entity will perform such 
                function.
            ``(2) Litigation and risk management protections.--A third-
        party entity that maintains liability insurance coverage at 
        policy limits and in accordance with conditions to be 
        established by the Secretary pursuant to section 864 and 
        receives a certificate of conformance under paragraph (1) shall 
        receive all applicable litigation and risk management 
        protections under sections 863 and 864.
            ``(3) Reciprocal waiver of claims.--A reciprocal waiver of 
        claims shall be deemed to have been entered into between a 
        third-party entity that receives a certificate of conformance 
        under paragraph (1) and its contractors, subcontractors, 
        suppliers, vendors, customers, and contractors and 
        subcontractors of customers involved in the use or operation of 
        any function performed by the third-party entity under 
        subparagraph (a).
            ``(4) Information for establishing limits of liability 
        insurance.--A third-party entity seeking a certificate of 
        conformance under paragraph (1) shall provide to the Secretary 
        necessary information for establishing the limits of liability 
        insurance required to be maintained by the entity under section 
        864(a).
    ``(g) Monitoring.--The Secretary shall regularly monitor and 
inspect the operations of a third-party entity that performs a function 
under subsection (a) to ensure that the entity is meeting the minimum 
standard operating procedures and requirements established under 
subsection (c) and any other applicable requirement under this section.

``SEC. 2110. METHODS TO REDUCE THE CONSEQUENCES OF A TERRORIST ATTACK.

    ``(a) Assessment Required.--The owner or operator of a covered 
chemical facility shall include in the site security plan conducted 
pursuant to section 2103, an assessment of methods to reduce the 
consequences of a terrorist attack on that chemical facility, 
including--
            ``(1) a description of the methods to reduce the 
        consequences of a terrorist attack assessed by the covered 
        chemical facility;
            ``(2) the degree to which each method to reduce the 
        consequences of a terrorist attack could, if applied, reduce 
        the potential extent of death, injury, or serious adverse 
        effects to human health resulting from a terrorist release;
            ``(3) the technical viability, costs, avoided costs 
        (including liabilities), savings, and applicability of applying 
        each method to reduce the consequences of a terrorist attack; 
        and
            ``(4) any other information that the owner or operator of 
        the covered chemical facility considered in conducting the 
        assessment.
    ``(b) Implementation.--
            ``(1) Implementation.--The owner or operator of a chemical 
        facility assigned to a high-risk tier under section 2102(c)(3) 
        that is required to conduct an assessment under subsection (a) 
        shall implement methods to reduce the consequences of a 
        terrorist attack on the chemical facility if the Secretary 
        determines, based on an assessment in subsection (a), that the 
        implementation of such methods at the facility--
                    ``(A) would significantly reduce the risk of death, 
                injury, or serious adverse effects to human health 
                resulting from a chemical facility terrorist incident 
                but would not increase the interim storage of a 
                substance of concern outside the facility or directly 
                result in the creation of a new covered chemical 
                facility assigned to a high-risk tier under section 
                2102(c)(3) or the assignment of an existing facility to 
                a high-risk tier;
                    ``(B) can feasibly be incorporated into the 
                operation of the covered chemical facility; and
                    ``(C) would not significantly and demonstrably 
                impair the ability of the owner or operator of the 
                covered chemical facility to continue the business of 
                the facility at a location within the United States.
            ``(2) Review of inability to comply.--
                    ``(A) In general.--An owner or operator of a 
                covered chemical facility who is unable to comply with 
                the Secretary's determination under paragraph (1) 
                shall, within 60 days of receipt of the Secretary's 
                determination, provide to the Secretary a written 
                explanation that includes the reasons thereto.
                    ``(B) Review.--Not later than 60 days of receipt of 
                an explanation submitted under subparagraph (A), the 
                Secretary after consulting with the owner or operator 
                who submitted such explanation, shall provide to the 
                owner or operator a written determination of whether 
                implementation shall be required pursuant to paragraph 
                (1). If the Secretary determines that implementation is 
                required, the facility shall be required to begin 
                implementation within 180 days of that determination.
    ``(c) Provision of Information on Alternative Approaches.--
            ``(1) In general.--The Secretary shall provide information 
        to chemical facilities on the use and availability of methods 
        to reduce the consequences of a terrorist attack at a covered 
        chemical facility to aid a covered chemical facility in meeting 
        the requirements of subsection (a).
            ``(2) Information to be included.--The information under 
        paragraph (1) may include information about--
                    ``(A) general and specific types of such methods;
                    ``(B) combinations of chemical sources, substances 
                of concern, and hazardous processes or conditions for 
                which such methods could be appropriate;
                    ``(C) the availability of specific methods to 
                reduce the consequences of a terrorist attack;
                    ``(D) the costs and cost savings resulting from the 
                use of such methods;
                    ``(E) emerging technologies that could be 
                transferred from research models or prototypes to 
                practical applications;
                    ``(F) the availability of technical assistance and 
                best practices; and
                    ``(G) such other matters as the Secretary 
                determines is appropriate.
            ``(3) Collection of information.--The Secretary may collect 
        information necessary to fulfill the requirements of paragraph 
        (1)--
                    ``(A) from information obtained from owners or 
                operators of chemical facilities pursuant to this 
                title, including those who have registered such 
                facilities pursuant to part 68 of title 40 Code of 
                Federal Regulations (or successor regulations);
                    ``(B) from studies and reports published by 
                academic institutions, National Laboratories, and other 
                relevant and reputable public and private sector 
                experts; and
                    ``(C) through such other methods as the Secretary 
                deems appropriate.
            ``(4) Public availability.--Information made available 
        publicly under this subsection shall not identify any specific 
        chemical facility, violate the protection of information 
        provisions under section 2108, or disclose any confidential or 
        proprietary information.
    ``(d) Protected Information.--An assessment prepared under 
subsection (a) is protected information under section 2108(f).
    ``(e) Funding for Methods To Reduce the Consequences of a Terrorist 
Attack.--The Secretary shall make funds available to help defray the 
cost of implementing methods to reduce the consequences of a terrorist 
attack to covered chemical facilities that are required by the 
Secretary to implement such methods or that voluntarily choose to 
implement such methods. In making such funds available, the Secretary 
shall give special consideration to those facilities required by the 
Secretary to implement methods to reduce the consequences of a 
terrorist attack pursuant to subsection (b) and water and wastewater 
facilities administered by State, local, tribal, or municipal 
authorities that are subject to the Federal Water Pollution Control Act 
(33 U.S.C. 1251 et seq.) or section 1433 of the Safe Drinking Water Act 
(42 U.S.C. 300i-2).
    ``(f) Publicly-Owned Water and Wastewater Treatment Facilities.--
Notwithstanding any other provision of this title, the Secretary may 
not require a publicly-owned facility regulated under the Safe Drinking 
Water Act (42 U.S.C. 300i-2) or the Federal Water Pollution Control Act 
(33 U.S.C. 1251 et seq.) to implement methods to reduce the 
consequences of a terrorist attack under subsection (b) unless that 
facility receives funding under subsection (e).

``SEC. 2111. APPLICABILITY.

    ``This title shall not apply to--
            ``(1) any chemical facility that is owned and operated by 
        the Secretary of Defense, the Attorney General, or the 
        Secretary of Energy;
            ``(2) the transportation in commerce, including incidental 
        storage, of any substance of concern regulated as a hazardous 
        material under chapter 51 of title 49, United States Code; or
            ``(3) any chemical facility that is owned or operated by a 
        licensee or certificate holder of the Nuclear Regulatory 
        Commission.

``SEC. 2112. SAVINGS CLAUSE.

    ``Nothing in this title shall affect or modify in any way any 
obligation or liability of any person under any other Federal law, 
including section 112 of the Clean Air Act (42 U.S.C. 7412), the 
Federal Water Pollution Control Act (33 U.S.C. 1251 et seq.), the 
Resource Conservation and Recovery Act of 1976 (42 U.S.C. 6901 et 
seq.), the National Environmental Policy Act of 1969 (42 U.S.C. 4321 et 
seq.), the Occupational Safety and Health Act (29 U.S.C. 651 et seq.), 
the National Labor Relations Act (29 U.S.C. 151 et seq.), the Emergency 
Planning and Community Right to Know Act of 1996 (42 U.S.C. 11001 et 
seq.), the Safe Drinking Water Act (42 U.S.C. 300f et seq.), the 
Maritime Transportation Security Act of 2002 (Pubic Law 107-295), and 
the Comprehensive Environmental Response, Compensation, and Liability 
Act of 1980 (42 U.S.C. 9601 et seq.).

``SEC. 2113. OFFICE OF CHEMICAL FACILITY SECURITY.

    ``(a) In General.--There is in the Department an Office of Chemical 
Facility Security, headed by a Director, who shall be a member of the 
Senior Executive Service in accordance with subchapter VI of chapter 33 
of title 5, United States Code, under section 5382 of that title, and 
who shall be responsible for carrying out the responsibilities of the 
Secretary under this title.
    ``(b) Professional Qualifications.--The individual selected by the 
Secretary as the Director Office of Chemical Facility Security should 
have a demonstrated knowledge of physical infrastructure protection, 
cybersecurity, chemical facility security, hazard analysis, chemical 
process engineering, chemical process safety reviews, and other such 
factors that the Secretary determines to be necessary.
    ``(c) Selection Process.--The Secretary shall make a reasonable 
effort to select an individual to serve as the Director from among a 
group of candidates that is diverse with respect to race, ethnicity, 
age, gender, and disability characteristics and submit to the Committee 
on Homeland Security of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of the Senate information 
on the selection process, including details on efforts to assure 
diversity among the candidates considered for this position.

``SEC. 2114. SECURITY BACKGROUND CHECKS OF COVERED INDIVIDUALS AT 
              CERTAIN CHEMICAL FACILITIES.

    ``(a) Regulations Issued by the Secretary.--
            ``(1) In general.--The Secretary shall issue regulations to 
        require a covered chemical facility assigned to a high-risk 
        tier under section 2102(c)(3) to subject covered individuals 
        who have access to restricted areas or critical assets or who 
        are determined to require security background checks under 
        risk-based guidance to security background checks based on 
        risk-based guidance. Such regulations shall set forth--
                    ``(A) the scope of the security background checks, 
                including the types of disqualifying offenses and the 
                time period covered for each covered individual;
                    ``(B) the processes to conduct the security 
                background checks;
                    ``(C) the necessary biographical information and 
                other data required in order to conduct the security 
                background checks; and
                    ``(D) a redress process for adversely-affected 
                covered individuals consistent with subsections (b) and 
                (c).
            ``(2) Enforcement.--If the owner or operator of a covered 
        chemical facility that is subject to paragraph (1) fails to 
        comply with the requirements of that paragraph, the Secretary 
        may issue a penalty against the owner or operator in accordance 
        with section 2106.
            ``(3) Requirement for redress process.--If a covered 
        chemical facility performs a security background check on a 
        covered individual to comply with regulations issued by the 
        Secretary under paragraph (1), the Secretary shall not consider 
        the facility in compliance unless an adequate redress process 
        as described in subsection (c) is provided to covered 
        individuals.
    ``(b) Requirements.--Upon issuance of a final regulation under 
subsection (a), or any future rule, regulation, directive or guidance, 
by the Secretary regarding a security background check of a covered 
individual, the Secretary shall prohibit the covered chemical facility 
from making an adverse employment decision, including removal or 
suspension of the employee, due to such rule, regulation, directive, or 
guidance with respect to a covered individual unless the covered 
individual--
            ``(1) has been convicted of, has been found not guilty of 
        by reason of insanity of, or is under want, warrant, or 
        indictment for a permanent disqualifying criminal offense 
        listed in part 1572 of title 49, Code of Federal Regulations;
            ``(2) was convicted of or found not guilty by reason of 
        insanity of an interim disqualifying criminal offense listed in 
        part 1572 of title 49, Code of Federal Regulations, within 7 
        years of the date on which the chemical facility performs the 
        security background check;
            ``(3) was incarcerated for an interim disqualifying 
        criminal offense listed in part 1572 of title 49, Code of 
        Federal Regulations, and released from incarceration within 5 
        years of the date that the chemical facility performs the 
        security background check;
            ``(4) is determined, as a result of the security background 
        check, to be a known terrorist or to have terrorist ties; or
            ``(5) is determined, as a result of the security background 
        check, not to be legally authorized to work in the United 
        States.
    ``(c) Redress Process.--Upon the issuance of a final regulation 
under subsection (a), or any future rule, regulation, directive, or 
guidance, requiring a covered chemical facility to perform a security 
background check of a covered individual, the Secretary shall--
            ``(1) require an adequate redress process for a covered 
        individual subjected to an adverse employment decision, 
        including removal or suspension of the employee, due to such 
        rule, regulation, directive, or guidance that is consistent 
        with the appeals and waiver processes established for 
        applicants for commercial motor vehicle hazardous materials 
        endorsements and transportation workers at ports, as required 
        by section 70105(c) of title 46, United States Code, including 
        all rights to hearings before an administration law judge, 
        scope of review, a review of an unclassified summary of 
        classified evidence equivalent to the summary provided in part 
        1515 of title 49, Code of Federal Regulations, and procedures 
        for new evidence for both appeals and waiver decisions;
            ``(2) have the authority to order an appropriate remedy, 
        including reinstatement of the covered individual, should the 
        Secretary determine that a covered chemical facility wrongfully 
        made an adverse employment decision regarding a covered 
        individual pursuant to such rule, regulation, directive, or 
        guidance;
            ``(3) ensure that the redress process required under this 
        subsection affords to the covered individual a full disclosure 
        of any public-record event covered by subsection (b) that 
        provides the basis for an adverse employment decision; and
            ``(4) ensure that covered individual receives the 
        individual's full wages and benefits until all appeals and 
        waiver procedures are exhausted.
    ``(d) False Statements.--
            ``(1) In general.--A covered chemical facility may not 
        knowingly misrepresent to an employee or other relevant person, 
        including an arbiter involved in a labor arbitration, the 
        scope, application, or meaning of any rules, regulations, 
        directives, or guidance issued by the Secretary related to 
        security background check requirements for covered individuals 
        when conducting a security background check under this section.
            ``(2) Deadline for regulations.--Not later than 1 year 
        after the date of enactment of the Chemical Facility Anti-
        Terrorism Act of 2008, the Secretary shall issue a regulation 
        that prohibits a covered chemical facility from knowingly 
        misrepresenting to an employee or other relevant person, 
        including an arbiter involved in a labor arbitration, the 
        scope, application, or meaning of any rules, regulations, 
        directives, or guidance issued by the Secretary related to 
        security background check requirements for covered individuals 
        when conducting a security background check.
    ``(e) Restrictions on Use and Maintenance of Information.--
Information obtained under this section by the Secretary or a covered 
chemical facility that is an employer of a covered individual shall be 
handled as follows:
            ``(1) Such information may not be made available to the 
        public.
            ``(2) Such information may not be accessed by employees of 
        the facility except for such employees who are directly 
        involved with collecting the information or conducting or 
        evaluating security background checks.
            ``(3) Such information shall be maintained confidentially 
        by facility and the Secretary and may be used only for making 
        determinations under this section.
            ``(4) The Secretary may share such information with other 
        Federal law enforcement agencies.
    ``(f) Rights and Responsibilities.--Nothing in the section shall be 
construed to abridge any right or responsibility of a covered 
individual or covered chemical facility under any other Federal, State, 
local, or tribal law or collective bargaining agreement.
    ``(g) No Preemption of Federal or State Law.--Nothing in this 
section shall be construed to preempt a Federal, State, local, or 
tribal law that requires criminal history background checks, checks on 
the authorization of an individual to work in the United States, or 
other background checks of covered individuals.
    ``(h) Definition of Security Background Check.--The term `security 
background check' means a review at no cost to any covered individual 
of the following for the purpose of identifying individuals who may 
pose a threat to chemical facility security, to national security, or 
of terrorism.
            ``(1) Relevant databases to verify and validate identity.
            ``(2) Relevant criminal history databases.
            ``(3) In the case of an alien (as defined in section 101 of 
        the Immigration and Nationality Act (8 U.S.C. 1101(a)(3))), the 
        relevant data bases to determine the status of the alien under 
        the immigration laws of the United States.
            ``(4) Relevant databases to identify terrorists or people 
        with known ties to terrorists.
            ``(5) Other relevant information or data bases, as 
        determined by the Secretary.
    ``(i) Included Individuals.--The Secretary shall require any 
individual at a covered chemical facility or associated with a covered 
chemical facility who is provided a copy of a security vulnerability 
assessment or site security plan to be subjected to a security 
background check.
    ``(j) Savings Clause.--Nothing in this section shall be construed 
as creating any new right or modifying any existing right of an 
individual to appeal a determination by the Secretary as a result of a 
check against a terrorist watch list.

``SEC. 2115. NATIONAL CHEMICAL SECURITY CENTER OF EXCELLENCE.

    ``(a) Establishment.--
            ``(1) In general.--The Secretary shall establish a National 
        Chemical Security Center of Excellence to conduct research and 
        education and to develop technologies to lower the overall risk 
        of terrorist chemical attack, including technologies or 
        practices to decrease threats, vulnerabilities, and 
        consequences in order to ensure the security of chemical 
        facilities.
            ``(2) Additional requirements.--In establishing the 
        National Chemical Security Center of Excellence under paragraph 
        (1), or in reorganizing any other chemical, biological, or 
        agricultural Center of Excellence established before the date 
        of enactment of the Chemical Facility Anti-Terrorism Act of 
        2008, the Secretary shall--
                    ``(A) recognize the unique scientific, technical, 
                and funding requirements of the chemical, biological, 
                and agricultural fields with respect to the mission of 
                the Department of Homeland Security; and
                    ``(B) maintain the National Chemical Security 
                Center of Excellence and any such other chemical, 
                biological, or agricultural Center of Excellence as a 
                distinct entity with respect to organization and 
                funding.
    ``(b) Designation of Lead Institution.--The Secretary shall select 
at least one of the institutions identified in subsection (c) as the 
lead institution responsible for coordinating the National Chemical 
Security Center of Excellence. Any member institution that is part of 
the consortium under subsection (c) may serve as a lead institution for 
the Center.
    ``(c) Member Institutions; Consortium.--
            ``(1) Consortium.--The lead institution selected under 
        subsection (b) shall execute agreements with the other 
        institutions of higher education identified in this subsection 
        and other institutions designated by the Secretary to develop a 
        consortium to assist in accomplishing the goals of the Center.
            ``(2) Members.--The National Chemical Security Center of 
        Excellence shall consist of at least three institutions of 
        higher education with current expertise or the capability to 
        produce appropriate expertise, including--
                    ``(A) one historically black college or university; 
                and
                    ``(B) one Hispanic-serving institution.
            ``(3) Inclusions.--The Secretary shall ensure that an 
        appropriate number of any additional partner colleges or 
        universities designated by the Secretary under this subsection 
        are historically black colleges and universities, Hispanic-
        serving institutions, and tribal colleges and universities.
            ``(4) Definitions.--For the purposes of this subsection, 
        the terms `historically black colleges and universities', 
        `Hispanic-serving institutions', and `tribal colleges and 
        universities' have the meanings given such terms under section 
        2109(d)(2).

``SEC. 2116. AUTHORIZATION OF APPROPRIATIONS.

    ``There is authorized to be appropriated to the Secretary of 
Homeland Security to carry out this title--
            ``(1) $325,000,000 for fiscal year 2010, of which 
        $100,000,000 shall be made available to provide funding for 
        methods to reduce the consequences of a terrorist attack 
        pursuant to section 2110(e);
            ``(2) $300,000,000 for fiscal year 2011, of which 
        $75,000,000 shall be made available to provide funding for 
        methods to reduce the consequences of a terrorist attack 
        pursuant to section 2110(e); and
            ``(3) $275,000,000 for fiscal year 2012, of which 
        $50,000,000 shall be made available to provide funding for 
        methods to reduce the consequences of a terrorist attack 
        pursuant to section 2110(e).''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by adding at the end the following:

  ``TITLE XXI--REGULATION OF SECURITY PRACTICES AT CHEMICAL FACILITIES

``Sec. 2101. Definitions.
``Sec. 2102. Risk-based designation and ranking of chemical facilities.
``Sec. 2103. Security vulnerability assessments and site security 
                            plans.
``Sec. 2104. Record keeping; site inspections.
``Sec. 2105. Enforcement.
``Sec. 2106. Penalties.
``Sec. 2107. Federal preemption.
``Sec. 2108. Protection of information.
``Sec. 2109. Certification by third-party entities.
``Sec. 2110. Methods to reduce the consequences of a terrorist attack.
``Sec. 2111. Applicability.
``Sec. 2112. Savings clause.
``Sec. 2113. Office of Chemical Facility Security.
``Sec. 2114. Security background checks of covered individuals at 
                            certain chemical facilities.
``Sec. 2114. National chemical security center of excellence.
``Sec. 2115. Authorization of appropriations.''.
    (c) Conforming Repeal.--
            (1) Repeal.--The Department of Homeland Security 
        Appropriations Act, 2007 (Public Law 109-295) is amended by 
        striking section 550.
            (2) Effective date.--The amendment made by paragraph (1) 
        shall take effect on October 1, 2009.
    (d) Regulations.--In carrying out the requirements of title XXI of 
the Homeland Security Act of 2002, as added by subsection (a), the 
Secretary may, to the extent that the Secretary determines is 
appropriate, use any of the regulations known as CFATS regulations, as 
in effect immediately before the enactment of this Act, that the 
Secretary determines carry out such requirements.
    (e) Compliance With Preexisting Timelines.--In the case of a 
chemical facility that is required to submit a security vulnerability 
assessment and site security plan under section 2103 of the Homeland 
Security Act of 2002, as added by subsection (a), and that, as of the 
date of the enactment of this Act, is subject to the regulations known 
as CFATS regulations, as in effect immediately before the date of the 
enactment of this Act, the Secretary may require the facility to adhere 
to any timelines applicable under such regulations instead of any 
applicable timeline under subsection (i) of that section.
    (f) Deadlines.--
            (1) Deadline for issuing certain guidance.--Not later than 
        October 1, 2009, the Secretary of Homeland Security shall 
        update any guidance, recommendations, suggested action items, 
        or any other widely disseminated voluntary action item relating 
        to performing a security background check (as such term is 
        defined in section 2114(g) of the Homeland Security Act of 
        2002, as added by subsection (a)) of a covered individual (as 
        that term is defined in section 2101(5) of such Act, as so 
        added) that was issued to a covered chemical facility (as that 
        term is defined in section 2101(6) of such Act, as so added) 
        prior to that date to ensure that such guidance, 
        recommendations, suggested action items or other widely 
        disseminated voluntary action item is compliance with section 
        2114(a)(1) of such Act, as so added.
            (2) Deadline for high-risk facilities to submit security 
        vulnerability assessments and site security plans.--
                    (A) In general.--The owner or operator of a 
                chemical facility assigned to a high-risk tier under 
                paragraph (3) of subsection (c) of section 2102 of the 
                Homeland Security Act of 2002, as added by section 4, 
                shall submit to the Secretary of Homeland Security--
                            (i) the security vulnerability assessment 
                        required under that subsection by not later 
                        than 3 months after the date on which the 
                        Secretary prescribes regulations to carry out 
                        that subsection; and
                            (ii) the site security plan required under 
                        that subsection by not later than 4 months 
                        after receiving notice that the Secretary has 
                        approved the security vulnerability assessment 
                        submitted under clause (i).
                    (B) Extension.--The Secretary may extend the 
                deadline under subparagraph (A) for a chemical facility 
                for not longer than six months.
                    (C) Facilities covered by cfats.--The owner or 
                operator of a chemical facility assigned to a high-risk 
                tier under section 2102(c)(3) of the Homeland Security 
                Act of 2002, as added by subsection (a), who, before 
                October 1, 2009, submits a security vulnerability 
                assessment or site security plan under the regulations 
                known as CFATS regulations, as in effect immediately 
                before the enactment of this Act, shall be required to 
                submit an addendum to the facility's security 
                vulnerability assessment or site security plan to 
                reflect any additional requirements of this Act or the 
                amendments made by this Act.

SEC. 5. ANNUAL REPORT TO CONGRESS.

    (a) Annual Report.--Not later than one year after the date of the 
enactment of this Act, and annually thereafter for the next four years, 
the Secretary of Homeland Security shall submit to Congress a report on 
progress in achieving compliance with title XXI of the Homeland 
Security Act of 2002, as added by section 4. Each such report shall 
include--
            (1) an assessment of the effectiveness of the site security 
        plans developed under this title;
            (2) any lessons learned in implementing this title 
        (including as a result of a red-team exercise); and
            (3) any recommendations of the Secretary to improve the 
        programs, plans, and procedures under this title, including the 
        feasibility of programs to increase the number of economically 
        disadvantaged businesses eligible to perform third-party entity 
        responsibilities pursuant to sections 2103(e)(5), 2104(b) and 
        (c), and 2105(b)(1) of such Act, as so added.
    (b) Protected Information.--A report under this section may not 
include information protected under section 2108 of such Act, as so 
added.

SEC. 6. INSPECTOR GENERAL REPORT.

    (a) Report Required.--Not later than October 1, 2010, the Inspector 
General of the Department of Homeland Security shall submit to the 
Committee on Homeland Security of the House of Representatives and the 
Committee on Homeland Security and Governmental Affairs of the Senate a 
report that reviews the effectiveness of the implementation of title 
XXI of the Homeland Security Act of 2002, as added by subsection (a), 
including the effectiveness of site security plans required under such 
title and any recommendations to improve the programs, plans, and 
procedures required under such title, including the Secretary's 
dissemination of best practices under section 2103(a)(1)(A) of such 
Act, as so added, and the participating rates of economically 
disadvantaged businesses eligible to perform third-party entity 
responsibilities pursuant to sections 2103(e)(5), 2104(b), (c), and 
(d), and 2105(b)(1) of such Act, as so added.
    (b) Classified Annex.--The report required under subsection (a) 
shall be in unclassified form but may include a classified annex, if 
the Inspector General determines a classified annex is necessary.

SEC. 7. DEADLINE FOR REGULATIONS.

    (a) In General.--The Secretary shall conduct the rulemaking process 
so that final rules carrying out the provisions of this Act and the 
amendments made by this Act are effective on October 1, 2009.

SEC. 8. CHEMICAL FACILITY TRAINING PROGRAM.

    (a) In General.--Subtitle A of title VIII of the Homeland Security 
Act of 2002 (6 U.S.C. 361) is amended by adding at the end the 
following new section:

``SEC. 802. CHEMICAL FACILITY TRAINING PROGRAM.

    ``(a) In General.--The Secretary shall establish a Chemical 
Facility Security Training Program (referred to in this section as the 
`Program') for the purpose of enhancing the collective response to 
terrorism and the capabilities of chemical facilities to prevent, 
prepare for, respond to, mitigate against, and recover from threatened 
or actual chemical facility terrorist incidents.
    ``(b) Requirements.--The Program shall provide training that--
            ``(1) reaches multiple disciplines, including Federal, 
        State, local, and tribal government officials, chemical 
        facility owners, operators, and employees, and governmental and 
        nongovernmental emergency response providers;
            ``(2) utilizes multiple training mediums and methods;
            ``(3) addresses chemical facility security and site 
        security plans, including--
                    ``(A) site security plans and procedures for 
                differing threat levels;
                    ``(B) physical security, security equipment and 
                systems, access control, and methods for preventing and 
                countering theft;
                    ``(C) recognition and detection of weapons and 
                devices;
                    ``(D) security incident procedures, including 
                procedures for communicating with emergency response 
                providers;
                    ``(E) evacuation procedures and use of appropriate 
                personal protective equipment; and
                    ``(F) other requirements that the Secretary deems 
                appropriate.
            ``(4) is consistent with, and supports implementation of, 
        the National Incident Management System, the National Response 
        Framework, the National Infrastructure Protection Plan, the 
        National Preparedness Guidelines, and other national 
        initiatives;
            ``(5) includes consideration of existing security and 
        hazardous chemical training programs including Federal or 
        industry programs; and
            ``(6) is evaluated against clear and consistent performance 
        measures.
    ``(c) National Voluntary Consensus Standards.--The Secretary 
shall--
            ``(1) support the promulgation, and regular updating as 
        necessary and appropriate of national voluntary consensus 
        standards for chemical facility security training ensuring that 
        training is consistent with such standards; and
            ``(2) ensure that the training provided under this section 
        is consistent with such standards.
    ``(d) Training Partners.--In developing and delivering training 
under the Program, the Secretary shall--
            ``(1) work with government training programs, chemical 
        facilities, academic institutions, industry and private 
        organizations, employee organizations, and other relevant 
        entities that provide specialized state-of-the-art training; 
        and
            ``(2) utilize, as appropriate, training provided by 
        industry, public safety academies, Federal programs, employee 
        organizations, State and private colleges and universities, and 
        other chemical facilities.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by inserting after the item relating to section 801 
the following:

``Sec. 802. Chemical facility training program.''.
                                 <all>
```