H. R. 1—99 
(F) A list and analysis of the laws and regulations 
that govern the information being or to be collected, 
reviewed, gathered, analyzed, or used in conjunction with 
the data mining activity, to the extent applicable in the 
context of the data mining activity. 
(G) A thorough discussion of the policies, procedures, 
and guidelines that are in place or that are to be developed 
and applied in the use of such data mining activity in 
order to— 
(i) protect the privacy and due process rights of 
individuals, such as redress procedures; and 
(ii) ensure that only accurate and complete 
information is collected, reviewed, gathered, analyzed, 
or used, and guard against any harmful consequences 
of potential inaccuracies. 
(3) ANNEX.— 
(A) IN
GENERAL.—A report under subparagraph (A) 
shall include in an annex any necessary— 
(i) classified information; 
(ii) law enforcement sensitive information; 
(iii) proprietary business information; or 
(iv) trade secrets (as that term is defined in section 
1839 of title 18, United States Code). 
(B) AVAILABILITY.—Any annex described in clause (i)— 
(i) shall be available, as appropriate, and con-
sistent with the National Security Act of 1947 (50 
U.S.C. 401 et seq.), to the Committee on Homeland 
Security and Governmental Affairs, the Committee on 
the Judiciary, the Select Committee on Intelligence, 
the Committee on Appropriations, and the Committee 
on Banking, Housing, and Urban Affairs of the Senate 
and the Committee on Homeland Security, the Com-
mittee on the Judiciary, the Permanent Select Com-
mittee on Intelligence, the Committee on Appropria-
tions, and the Committee on Financial Services of the 
House of Representatives; and 
(ii) shall not be made available to the public. 
(4) TIME
FOR
REPORT.—Each report required under 
subparagraph (A) shall be— 
(A) submitted not later than 180 days after the date 
of enactment of this Act; and 
(B) updated not less frequently than annually there-
after, to include any activity to use or develop data mining 
engaged in after the date of the prior report submitted 
under subparagraph (A). 
TITLE IX—PRIVATE SECTOR 
PREPAREDNESS 
SEC. 901. PRIVATE SECTOR PREPAREDNESS. 
(a) IN GENERAL.—Title V of the Homeland Security Act of 
2002 (6 U.S.C. 311 et seq.), as amended by section 409, is further 
amended by adding at the end the following:
H. R. 1—100 
‘‘SEC. 523. GUIDANCE AND RECOMMENDATIONS. 
‘‘(a) IN GENERAL.—Consistent with their responsibilities and 
authorities under law, as of the day before the date of the enactment 
of this section, the Administrator and the Assistant Secretary for 
Infrastructure Protection, in consultation with the private sector, 
may develop guidance or recommendations and identify best prac-
tices to assist or foster action by the private sector in— 
‘‘(1) identifying potential hazards and assessing risks and 
impacts; 
‘‘(2) mitigating the impact of a wide variety of hazards, 
including weapons of mass destruction; 
‘‘(3) managing necessary emergency preparedness and 
response resources; 
‘‘(4) developing mutual aid agreements; 
‘‘(5) developing and maintaining emergency preparedness 
and response plans, and associated operational procedures; 
‘‘(6) developing and conducting training and exercises to 
support and evaluate emergency preparedness and response 
plans and operational procedures; 
‘‘(7) developing and conducting training programs for secu-
rity guards to implement emergency preparedness and response 
plans and operations procedures; and 
‘‘(8) developing procedures to respond to requests for 
information from the media or the public. 
‘‘(b) ISSUANCE AND PROMOTION.—Any guidance or recommenda-
tions developed or best practices identified under subsection (a) 
shall be— 
‘‘(1) issued through the Administrator; and 
‘‘(2) promoted by the Secretary to the private sector. 
‘‘(c) SMALL BUSINESS CONCERNS.—In developing guidance or 
recommendations or identifying best practices under subsection (a), 
the Administrator and the Assistant Secretary for Infrastructure 
Protection shall take into consideration small business concerns 
(under the meaning given that term in section 3 of the Small 
Business Act (15 U.S.C. 632)), including any need for separate 
guidance or recommendations or best practices, as necessary and 
appropriate. 
‘‘(d) RULE
OF CONSTRUCTION.—Nothing in this section may 
be construed to supersede any requirement established under any 
other provision of law. 
‘‘SEC. 524. VOLUNTARY PRIVATE SECTOR PREPAREDNESS ACCREDITA-
TION AND CERTIFICATION PROGRAM. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN GENERAL.—The Secretary, acting through the officer 
designated under paragraph (2), shall establish and implement 
the voluntary private sector preparedness accreditation and 
certification program in accordance with this section. 
‘‘(2) DESIGNATION OF OFFICER.—The Secretary shall des-
ignate an officer responsible for the accreditation and certifi-
cation program under this section. Such officer (hereinafter 
referred to in this section as the ‘designated officer’) shall 
be one of the following: 
‘‘(A) The Administrator, based on consideration of— 
‘‘(i) the expertise of the Administrator in emer-
gency management and preparedness in the United 
States; and
H. R. 1—101 
‘‘(ii) the responsibilities of the Administrator as 
the principal advisor to the President for all matters 
relating to emergency management in the United 
States. 
‘‘(B) The Assistant Secretary for Infrastructure Protec-
tion, based on consideration of the expertise of the Assistant 
Secretary in, and responsibilities for— 
‘‘(i) protection of critical infrastructure; 
‘‘(ii) risk assessment methodologies; and 
‘‘(iii) interacting with the private sector on the 
issues described in clauses (i) and (ii). 
‘‘(C) The Under Secretary for Science and Technology, 
based on consideration of the expertise of the Under Sec-
retary in, and responsibilities associated with, standards. 
‘‘(3) COORDINATION.—In carrying out the accreditation and 
certification program under this section, the designated officer 
shall coordinate with— 
‘‘(A) the other officers of the Department referred to 
in paragraph (2), using the expertise and responsibilities 
of such officers; and 
‘‘(B) the Special Assistant to the Secretary for the 
Private Sector, based on consideration of the expertise of 
the Special Assistant in, and responsibilities for, interacting 
with the private sector. 
‘‘(b) VOLUNTARY PRIVATE SECTOR PREPAREDNESS STANDARDS; 
VOLUNTARY ACCREDITATION AND CERTIFICATION PROGRAM FOR THE 
PRIVATE SECTOR.— 
‘‘(1) ACCREDITATION
AND
CERTIFICATION
PROGRAM.—Not 
later than 210 days after the date of enactment of the Imple-
menting Recommendations of the 9/11 Commission Act of 2007, 
the designated officer shall— 
‘‘(A) begin supporting the development and updating, 
as necessary, of voluntary preparedness standards through 
appropriate organizations that coordinate or facilitate the 
development and use of voluntary consensus standards and 
voluntary consensus standards development organizations; 
and 
‘‘(B) in consultation with representatives of appropriate 
organizations that coordinate or facilitate the development 
and use of voluntary consensus standards, appropriate vol-
untary consensus standards development organizations, 
each private sector advisory council created under section 
102(f)(4), appropriate representatives of State and local 
governments, including emergency management officials, 
and appropriate private sector advisory groups, such as 
sector coordinating councils and information sharing and 
analysis centers— 
‘‘(i) develop and promote a program to certify the 
preparedness of private sector entities that voluntarily 
choose to seek certification under the program; and 
‘‘(ii) implement the program under this subsection 
through any entity with which the designated officer 
enters into an agreement under paragraph (3)(A), 
which shall accredit third parties to carry out the 
certification process under this section. 
‘‘(2) PROGRAM ELEMENTS.— 
‘‘(A) IN GENERAL.—
H. R. 1—102 
‘‘(i) PROGRAM.—The program developed and imple-
mented under this subsection shall assess whether a 
private sector entity complies with voluntary prepared-
ness standards. 
‘‘(ii) GUIDELINES.—In developing the program 
under this subsection, the designated officer shall 
develop guidelines for the accreditation and certifi-
cation processes established under this subsection. 
‘‘(B) STANDARDS.—The designated officer, in consulta-
tion with representatives of appropriate organizations that 
coordinate or facilitate the development and use of vol-
untary consensus standards, representatives of appropriate 
voluntary consensus standards development organizations, 
each private sector advisory council created under section 
102(f)(4), appropriate representatives of State and local 
governments, including emergency management officials, 
and appropriate private sector advisory groups such as 
sector coordinating councils and information sharing and 
analysis centers— 
‘‘(i) shall adopt one or more appropriate voluntary 
preparedness standards that promote preparedness, 
which may be tailored to address the unique nature 
of various sectors within the private sector, as nec-
essary and appropriate, that shall be used in the 
accreditation and certification program under this sub-
section; and 
‘‘(ii) after the adoption of one or more standards 
under clause (i), may adopt additional voluntary 
preparedness standards or modify or discontinue the 
use of voluntary preparedness standards for the 
accreditation and certification program, as necessary 
and appropriate to promote preparedness. 
‘‘(C) SUBMISSION OF RECOMMENDATIONS.—In adopting 
one or more standards under subparagraph (B), the des-
ignated officer may receive recommendations from any 
entity described in that subparagraph relating to appro-
priate voluntary preparedness standards, including appro-
priate sector specific standards, for adoption in the pro-
gram. 
‘‘(D) SMALL
BUSINESS
CONCERNS.—The designated 
officer and any entity with which the designated officer 
enters into an agreement under paragraph (3)(A) shall 
establish separate classifications and methods of certifi-
cation for small business concerns (under the meaning 
given that term in section 3 of the Small Business Act 
(15 U.S.C. 632)) for the program under this subsection. 
‘‘(E) CONSIDERATIONS.—In developing and imple-
menting the program under this subsection, the designated 
officer shall— 
‘‘(i) consider the unique nature of various sectors 
within the private sector, including preparedness 
standards, business continuity standards, or best prac-
tices, established— 
‘‘(I) under any other provision of Federal law; 
or
H. R. 1—103 
‘‘(II) by any sector-specific agency, as defined 
under Homeland Security Presidential Directive– 
7; and 
‘‘(ii) coordinate the program, as appropriate, with— 
‘‘(I) other Department private sector related 
programs; and 
‘‘(II) preparedness and business continuity pro-
grams in other Federal agencies. 
‘‘(3) ACCREDITATION AND CERTIFICATION PROCESSES.— 
‘‘(A) AGREEMENT.— 
‘‘(i) IN GENERAL.—Not later than 210 days after 
the date of enactment of the Implementing Rec-
ommendations of the 9/11 Commission Act of 2007, 
the designated officer shall enter into one or more 
agreements with a highly qualified nongovernmental 
entity with experience or expertise in coordinating and 
facilitating the development and use of voluntary con-
sensus standards and in managing or implementing 
accreditation and certification programs for voluntary 
consensus standards, or a similarly qualified private 
sector entity, to carry out accreditations and oversee 
the certification process under this subsection. An 
entity entering into an agreement with the designated 
officer under this clause (hereinafter referred to in 
this section as a ‘selected entity’) shall not perform 
certifications under this subsection. 
‘‘(ii) CONTENTS.—A selected entity shall manage 
the accreditation process and oversee the certification 
process in accordance with the program established 
under this subsection and accredit qualified third par-
ties to carry out the certification program established 
under this subsection. 
‘‘(B) PROCEDURES AND REQUIREMENTS FOR ACCREDITA-
TION AND CERTIFICATION.— 
‘‘(i) IN GENERAL.—Any selected entity shall collabo-
rate to develop procedures and requirements for the 
accreditation and certification processes under this 
subsection, in accordance with the program established 
under this subsection and guidelines developed under 
paragraph (2)(A)(ii). 
‘‘(ii) CONTENTS
AND
USE.—The procedures and 
requirements developed under clause (i) shall— 
‘‘(I) ensure reasonable uniformity in any 
accreditation and certification processes if there 
is more than one selected entity; and 
‘‘(II) be used by any selected entity in con-
ducting accreditations and overseeing the certifi-
cation process under this subsection. 
‘‘(iii) DISAGREEMENT.—Any disagreement among 
selected entities in developing procedures under clause 
(i) shall be resolved by the designated officer. 
‘‘(C) DESIGNATION.—A selected entity may accredit any 
qualified third party to carry out the certification process 
under this subsection. 
‘‘(D) 
DISADVANTAGED
BUSINESS
INVOLVEMENT.—In 
accrediting qualified third parties to carry out the certifi-
cation process under this subsection, a selected entity shall
H. R. 1—104 
ensure, to the extent practicable, that the third parties 
include qualified small, minority, women-owned, or dis-
advantaged business concerns when appropriate. The term 
‘disadvantaged business concern’ means a small business 
that is owned and controlled by socially and economically 
disadvantaged individuals, as defined in section 124 of 
title 13, United States Code of Federal Regulations. 
‘‘(E) TREATMENT
OF
OTHER
CERTIFICATIONS.—At the 
request of any entity seeking certification, any selected 
entity may consider, as appropriate, other relevant certifi-
cations acquired by the entity seeking certification. If the 
selected entity determines that such other certifications 
are sufficient to meet the certification requirement or 
aspects of the certification requirement under this section, 
the selected entity may give credit to the entity seeking 
certification, as appropriate, to avoid unnecessarily duplica-
tive certification requirements. 
‘‘(F) THIRD PARTIES.—To be accredited under subpara-
graph (C), a third party shall— 
‘‘(i) demonstrate that the third party has the ability 
to certify private sector entities in accordance with 
the procedures and requirements developed under 
subparagraph (B); 
‘‘(ii) agree to perform certifications in accordance 
with such procedures and requirements; 
‘‘(iii) agree not to have any beneficial interest in 
or any direct or indirect control over— 
‘‘(I) a private sector entity for which that third 
party conducts a certification under this sub-
section; or 
‘‘(II) any organization that provides prepared-
ness consulting services to private sector entities; 
‘‘(iv) agree not to have any other conflict of interest 
with respect to any private sector entity for which 
that third party conducts a certification under this 
subsection; 
‘‘(v) maintain liability insurance coverage at policy 
limits in accordance with the requirements developed 
under subparagraph (B); and 
‘‘(vi) enter into an agreement with the selected 
entity accrediting that third party to protect any 
proprietary information of a private sector entity 
obtained under this subsection. 
‘‘(G) MONITORING.— 
‘‘(i) IN GENERAL.—The designated officer and any 
selected entity shall regularly monitor and inspect the 
operations of any third party conducting certifications 
under this subsection to ensure that the third party 
is complying with the procedures and requirements 
established under subparagraph (B) and all other 
applicable requirements. 
‘‘(ii) REVOCATION.—If the designated officer or any 
selected entity determines that a third party is not 
meeting the procedures or requirements established 
under subparagraph (B), the selected entity shall— 
‘‘(I) revoke the accreditation of that third party 
to conduct certifications under this subsection; and
H. R. 1—105 
‘‘(II) review any certification conducted by that 
third party, as necessary and appropriate. 
‘‘(4) ANNUAL REVIEW.— 
‘‘(A) IN GENERAL.—The designated officer, in consulta-
tion with representatives of appropriate organizations that 
coordinate or facilitate the development and use of vol-
untary consensus standards, appropriate voluntary con-
sensus standards development organizations, appropriate 
representatives of State and local governments, including 
emergency management officials, and each private sector 
advisory council created under section 102(f)(4), shall 
annually review the voluntary accreditation and certifi-
cation program established under this subsection to ensure 
the effectiveness of such program (including the operations 
and management of such program by any selected entity 
and the selected entity’s inclusion of qualified disadvan-
taged business concerns under paragraph (3)(D)) and make 
improvements and adjustments to the program as nec-
essary and appropriate. 
‘‘(B) REVIEW
OF
STANDARDS.—Each review under 
subparagraph (A) shall include an assessment of the vol-
untary preparedness standard or standards used in the 
program under this subsection. 
‘‘(5) VOLUNTARY PARTICIPATION.—Certification under this 
subsection shall be voluntary for any private sector entity. 
‘‘(6) PUBLIC LISTING.—The designated officer shall maintain 
and make public a listing of any private sector entity certified 
as being in compliance with the program established under 
this subsection, if that private sector entity consents to such 
listing. 
‘‘(c) RULE OF CONSTRUCTION.—Nothing in this section may be 
construed as— 
‘‘(1) a requirement to replace any preparedness, emergency 
response, or business continuity standards, requirements, or 
best practices established— 
‘‘(A) under any other provision of federal law; or 
‘‘(B) by any sector-specific agency, as those agencies 
are defined under Homeland Security Presidential Direc-
tive–7; or 
‘‘(2) exempting any private sector entity seeking certifi-
cation or meeting certification requirements under subsection 
(b) from compliance with all applicable statutes, regulations, 
directives, policies, and industry codes of practice.’’. 
(b) REPORT TO CONGRESS.—Not later than 210 days after the 
date of enactment of this Act, the Secretary shall submit to the 
Committee on Homeland Security and Governmental Affairs of 
the Senate and the Committee on Homeland Security and the 
Committee on Transportation and Infrastructure of the House of 
Representatives a report detailing— 
(1) any action taken to implement section 524(b) of the 
Homeland Security Act of 2002, as added by subsection (a), 
including a discussion of— 
(A) the separate methods of classification and certifi-
cation for small business concerns (under the meaning 
given that term in section 3 of the Small Business Act 
(15 U.S.C. 632)) as compared to other private sector enti-
ties; and
H. R. 1—106 
(B) whether the separate classifications and methods 
of certification for small business concerns are likely to 
help to ensure that such measures are not overly burden-
some and are adequate to meet the voluntary preparedness 
standard or standards adopted by the program under sec-
tion 524(b) of the Homeland Security Act of 2002, as added 
by subsection (a); and 
(2) the status, as of the date of that report, of the 
implementation of that subsection. 
(c) DEADLINE FOR DESIGNATION OF OFFICER.—The Secretary 
of Homeland Security shall designate the officer as described in 
section 524 of the Homeland Security Act of 2002, as added by 
subsection (a), by not later than 30 days after the date of the 
enactment of this Act. 
(d) DEFINITION.—Section 2 of the Homeland Security Act of 
2002 (6 U.S.C. 101) is amended by adding at the end the following: 
‘‘(18) The term ‘voluntary preparedness standards’ means 
a common set of criteria for preparedness, disaster manage-
ment, emergency management, and business continuity pro-
grams, such as the American National Standards Institute’s 
National Fire Protection Association Standard on Disaster/ 
Emergency Management and Business Continuity Programs 
(ANSI/NFPA 1600).’’. 
(e) CLERICAL AMENDMENTS.—The table of contents in section 
1(b) of such Act is further amended by adding at the end the 
following: 
‘‘Sec. 523. Guidance and recommendations. 
‘‘Sec. 524. Voluntary private sector preparedness accreditation and certification 
program.’’. 
(f) AUTHORIZATION OF APPROPRIATIONS.—There are authorized 
to be appropriated such sums as may be necessary to carry out 
this section and the amendments made by this section. 
SEC. 902. RESPONSIBILITIES OF THE PRIVATE SECTOR OFFICE OF 
THE DEPARTMENT. 
(a) IN GENERAL.—Section 102(f) of the Homeland Security Act 
of 2002 (6 U.S.C. 112(f)) is amended— 
(1) by redesignating paragraphs (8) through (10) as para-
graphs (9) through (11), respectively; and 
(2) by inserting after paragraph (7) the following: 
‘‘(8) providing information to the private sector regarding 
voluntary preparedness standards and the business justification 
for preparedness and promoting to the private sector the adop-
tion of voluntary preparedness standards;’’. 
(b) PRIVATE SECTOR ADVISORY COUNCILS.—Section 102(f)(4) of 
the Homeland Security Act of 2002 (6 U.S.C. 112(f)(4)) is amended— 
(1) in subparagraph (A), by striking ‘‘and’’ at the end; 
(2) in subparagraph (B), by inserting ‘‘and’’ after the semi-
colon at the end; and 
(3) by adding at the end the following: 
‘‘(C) advise the Secretary on private sector prepared-
ness issues, including effective methods for— 
‘‘(i) promoting voluntary preparedness standards 
to the private sector; and 
‘‘(ii) assisting the private sector in adopting vol-
untary preparedness standards;’’.
H. R. 1—107 
TITLE X—IMPROVING CRITICAL 
INFRASTRUCTURE SECURITY 
SEC. 1001. NATIONAL ASSET DATABASE. 
(a) IN GENERAL.—Subtitle A of title II of the Homeland Security 
Act of 2002, as amended by title V, is further amended by adding 
at the end the following new section: 
‘‘SEC. 210E. NATIONAL ASSET DATABASE. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) NATIONAL ASSET DATABASE.—The Secretary shall estab-
lish and maintain a national database of each system or asset 
that— 
‘‘(A) the Secretary, in consultation with appropriate 
homeland security officials of the States, determines to 
be vital and the loss, interruption, incapacity, or destruction 
of which would have a negative or debilitating effect on 
the economic security, public health, or safety of the United 
States, any State, or any local government; or 
‘‘(B) the Secretary determines is appropriate for inclu-
sion in the database. 
‘‘(2) 
PRIORITIZED
CRITICAL
INFRASTRUCTURE
LIST.—In 
accordance with Homeland Security Presidential Directive–7, 
as in effect on January 1, 2007, the Secretary shall establish 
and maintain a single classified prioritized list of systems and 
assets included in the database under paragraph (1) that the 
Secretary determines would, if destroyed or disrupted, cause 
national or regional catastrophic effects. 
‘‘(b) USE OF DATABASE.—The Secretary shall use the database 
established under subsection (a)(1) in the development and 
implementation of Department plans and programs as appropriate. 
‘‘(c) MAINTENANCE OF DATABASE.— 
‘‘(1) IN
GENERAL.—The Secretary shall maintain and 
annually update the database established under subsection 
(a)(1) and the list established under subsection (a)(2), 
including— 
‘‘(A) establishing data collection guidelines and pro-
viding such guidelines to the appropriate homeland security 
official of each State; 
‘‘(B) regularly reviewing the guidelines established 
under subparagraph (A), including by consulting with the 
appropriate homeland security officials of States, to solicit 
feedback about the guidelines, as appropriate; 
‘‘(C) after providing the homeland security official of 
a State with the guidelines under subparagraph (A), 
allowing the official a reasonable amount of time to submit 
to the Secretary any data submissions recommended by 
the official for inclusion in the database established under 
subsection (a)(1); 
‘‘(D) examining the contents and identifying any 
submissions made by such an official that are described 
incorrectly or that do not meet the guidelines established 
under subparagraph (A); and 
‘‘(E) providing to the appropriate homeland security 
official of each relevant State a list of submissions identified 
under subparagraph (D) for review and possible correction