113 
will be required to implement methods to reduce 
the consequences of an intentional act pursuant 
to paragraph (3). 
‘‘(5) ENFORCEMENT.— 
‘‘(A) FAILURE BY STATE TO MAKE DETER-
MINATION.—Whenever the Administrator finds 
that a State exercising primary enforcement re-
sponsibility for a covered water system has 
failed to determine whether to require the cov-
ered water system to implement methods to re-
duce the consequences of a chemical release 
from an intentional act, as required by para-
graph (3)(B), the Administrator shall so notify 
the State and covered water system. If, beyond 
the thirtieth day after the Administrator’s noti-
fication under the preceding sentence, the State 
has failed to make the determination described 
in such sentence, the Administrator shall so no-
tify the State and covered water system and 
shall determine whether to require the covered 
water system to implement methods to reduce 
the consequences of a chemical release from an 
intentional act based on the factors described in 
paragraph (3)(C).
114 
‘‘(B) FAILURE BY STATE TO BRING EN-
FORCEMENT
ACTION.—If the Administrator 
finds, with respect to a period in which a State 
has primary enforcement responsibility for a 
covered water system, that the system has 
failed to implement methods to reduce the con-
sequences of a chemical release from an inten-
tional act (as required by the State or the Ad-
ministrator under paragraph (3)(B) or the Ad-
ministrator under subparagraph (A)), the Ad-
ministrator shall so notify the State and the 
covered water system. If, beyond the thirtieth 
day after the Administrator’s notification under 
the preceding sentence, the State has not com-
menced appropriate enforcement action, the Ad-
ministrator shall so notify the State and may 
take appropriate enforcement action under sub-
section (o), to require implementation of such 
methods. 
‘‘(C) CONSIDERATION OF CONTINUED PRI-
MARY ENFORCEMENT RESPONSIBILITY.—For a 
State with primary enforcement responsibility 
for a covered water system, the Administrator 
may consider the failure of such State to make 
a determination as described under subpara-
115 
graph (A) or to bring enforcement action as de-
scribed under subparagraph (B) when deter-
mining whether a State may retain primary en-
forcement responsibility under this Act. 
‘‘(6) GUIDANCE FOR COVERED WATER SYSTEMS 
ASSIGNED
TO
TIER
AND
TIER
4.—For covered 
water systems required to conduct an assessment 
under paragraph (2) and assigned by the Adminis-
trator to tier 3 or tier 4 under subsection (d), the 
Administrator shall issue guidance and, as appro-
priate, provide or recommend tools, methodologies, 
or computer software, to assist such covered water 
systems in complying with the requirements of this 
section. 
‘‘(h) REVIEW BY ADMINISTRATOR.— 
‘‘(1) IN GENERAL.—The regulations under sub-
section (a)(1) shall require each covered water sys-
tem to submit its vulnerability assessment and site 
security plan to the Administrator for review accord-
ing to deadlines set by the Administrator. The Ad-
ministrator shall review each vulnerability assess-
ment and site security plan submitted under this 
section and— 
‘‘(A) if the assessment or plan has any sig-
nificant deficiency described in paragraph (2),
116 
require the covered water system to correct the 
deficiency; or 
‘‘(B) approve such assessment or plan. 
‘‘(2) SIGNIFICANT
DEFICIENCIES.—A vulner-
ability assessment or site security plan of a covered 
water system has a significant deficiency under this 
subsection if the Administrator, in consultation, as 
appropriate, with the State exercising primary en-
forcement responsibility for such system, if any, de-
termines that— 
‘‘(A) such assessment does not comply with 
the regulations established under section (a)(1); 
or 
‘‘(B) such plan— 
‘‘(i) fails to address vulnerabilities 
identified in a vulnerability assessment; or 
‘‘(ii) fails to meet applicable risk- 
based performance standards.
‘‘(3) STATE, REGIONAL, OR
LOCAL
GOVERN-
MENTAL ENTITIES.—No covered water system shall 
be required under State, local, or tribal law to pro-
vide a vulnerability assessment or site security plan 
described in this section to any State, regional, local, 
or tribal governmental entity solely by reason of the 
requirement set forth in paragraph (1) that the sys-
117 
tem submit such an assessment and plan to the Ad-
ministrator. 
‘‘(i) EMERGENCY RESPONSE PLAN.— 
‘‘(1) IN GENERAL.—Each covered water system 
shall prepare or revise, as appropriate, an emergency 
response plan that incorporates the results of the 
system’s most current vulnerability assessment and 
site security plan. 
‘‘(2) CERTIFICATION.—Each covered water sys-
tem shall certify to the Administrator that the sys-
tem has completed an emergency response plan. The 
system shall submit such certification to the Admin-
istrator not later than 6 months after the system’s 
first completion or revision of a vulnerability assess-
ment under this section and shall submit an addi-
tional certification following any update of the emer-
gency response plan. 
‘‘(3) CONTENTS.—A covered water system’s 
emergency response plan shall include— 
‘‘(A) plans, procedures, and identification 
of equipment that can be implemented or used 
in the event of an intentional act at the covered 
water system; and 
‘‘(B) actions, procedures, and identification 
of equipment that can obviate or significantly
118 
lessen the impact of intentional acts on public 
health and the safety and supply of drinking 
water provided to communities and individuals. 
‘‘(4) COORDINATION.—As part of its emergency 
response plan, each covered water system shall pro-
vide appropriate information to any local emergency 
planning committee, local law enforcement officials, 
and local emergency response providers to ensure an 
effective, collective response. 
‘‘(j) MAINTENANCE
OF RECORDS.—Each covered 
water system shall maintain an updated copy of its vulner-
ability assessment, site security plan, and emergency re-
sponse plan. 
‘‘(k) AUDIT; INSPECTION.— 
‘‘(1) IN
GENERAL.—Notwithstanding section 
1445(b)(2), the Administrator, or duly designated 
representatives of the Administrator, shall audit and 
inspect covered water systems, as necessary, for pur-
poses of determining compliance with this section. 
‘‘(2) ACCESS.—In conducting an audit or in-
spection of a covered water system, the Adminis-
trator or duly designated representatives of the Ad-
ministrator, as appropriate, shall have access to the 
owners, operators, employees and contractor employ-
120 
‘‘(1) PROHIBITION OF PUBLIC DISCLOSURE OF 
PROTECTED
INFORMATION.—Protected information 
shall— 
‘‘(A) be exempt from disclosure under sec-
tion 552 of title 5, United States Code; and 
‘‘(B) not be made available pursuant to 
any State, local, or tribal law requiring disclo-
sure of information or records. 
‘‘(2) INFORMATION SHARING.— 
‘‘(A) IN
GENERAL.—The Administrator 
shall prescribe such regulations, and may issue 
such orders, as necessary to prohibit the unau-
thorized disclosure of protected information. 
‘‘(B) SHARING OF PROTECTED INFORMA-
TION.—The regulations under subparagraph 
(A) shall provide standards for and facilitate 
the appropriate sharing of protected informa-
tion with and between Federal, State, local, and 
tribal authorities, first responders, law enforce-
ment officials, designated supervisory and non- 
supervisory covered water system personnel 
with security, operational, or fiduciary responsi-
bility for the system, and designated facility 
employee representatives, if any. Such stand-
ards shall include procedures for the sharing of
121 
all portions of a covered water system’s vulner-
ability assessment and site security plan relat-
ing to the roles and responsibilities of system 
employees or contractor employees under sub-
section (f)(1) with a representative of each cer-
tified or recognized bargaining agent rep-
resenting such employees, if any, or, if none, 
with at least one supervisory and at least one 
non-supervisory employee with roles and re-
sponsibilities under subsection (f)(1). 
‘‘(C) PENALTIES.—Protected information 
shall not be shared except in accordance with 
the standards provided by the regulations under 
subparagraph (A). Whoever discloses protected 
information in knowing violation of the regula-
tions and orders issued under subparagraph (A) 
shall be fined under title 18, United States 
Code, imprisoned for not more than one year, 
or both, and, in the case of a Federal office-
holder or employee, shall be removed from Fed-
eral office or employment. 
‘‘(3) TREATMENT OF INFORMATION IN ADJU-
DICATIVE PROCEEDINGS.—In any judicial or admin-
istrative proceeding, protected information shall be 
treated in a manner consistent with the treatment of
122 
Sensitive Security Information under section 525 of 
the Department of Homeland Security Appropria-
tions Act, 2007 (Public Law 109–295; 120 Stat. 
1381). 
‘‘(4) OTHER OBLIGATIONS UNAFFECTED.—Ex-
cept as provided in subsection (h)(3), nothing in this 
section amends or affects an obligation of a covered 
water system— 
‘‘(A) to submit or make available informa-
tion to system employees, employee organiza-
tions, or a Federal, State, tribal, or local gov-
ernment agency under any other provision of 
law; or 
‘‘(B) to comply with any other provision of 
law. 
‘‘(5) CONGRESSIONAL OVERSIGHT.—Nothing in 
this section permits or authorizes the withholding of 
information from Congress or any committee or sub-
committee thereof. 
‘‘(6) DISCLOSURE
OF
INDEPENDENTLY
FUR-
NISHED
INFORMATION.—Nothing in this section 
amends or affects any authority or obligation of a 
Federal, State, local, or tribal agency to protect or 
disclose any record or information that the Federal, 
State, local, or tribal agency obtains from a covered
123 
water system or the Administrator under any other 
provision of law. 
‘‘(7) PROTECTED INFORMATION.— 
‘‘(A) IN GENERAL.—For purposes of this 
section, the term ‘protected information’ means 
any of the following: 
‘‘(i) Vulnerability assessments and 
site security plans under this section, in-
cluding any assessment developed pursuant 
to subsection (g)(2). 
‘‘(ii) Documents directly related to the 
Administrator’s review of assessments and 
plans described in clause (i) and, as appli-
cable, the State’s review of an assessment 
prepared under subsection (g)(2). 
‘‘(iii) Documents directly related to 
inspections and audits under this section. 
‘‘(iv) Orders, notices, or letters re-
garding the compliance of a covered water 
system with the requirements of this sec-
tion. 
‘‘(v) 
Information, 
documents, 
or 
records required to be provided to or cre-
ated by, the Administrator under sub-
section (d).
124 
‘‘(vi) Documents directly related to se-
curity drills and training exercises, security 
threats and breaches of security, and 
maintenance, calibration, and testing of se-
curity equipment. 
‘‘(vii) Other information, documents, 
and records developed exclusively for the 
purposes of this section that the Adminis-
trator has determined by regulation would 
be detrimental to the security of one or 
more covered water systems if disclosed. 
‘‘(B) 
DETRIMENT
REQUIREMENT.—For 
purposes of clauses (ii), (iii), (iv), (v), and (vi) 
of subparagraph (A), the only portions of docu-
ments, records, orders, notices, and letters that 
shall be considered protected information are 
those portions that— 
‘‘(i) the Secretary has determined by 
regulation would be detrimental to the se-
curity of one or more covered water sys-
tems if disclosed; and 
‘‘(ii) are developed by the Adminis-
trator, the State, or the covered water sys-
tem for the purposes of this section.
125 
‘‘(C) EXCLUSIONS.—Notwithstanding sub-
paragraphs (A) and (B), the term ‘protected in-
formation’ does not include— 
‘‘(i) information, other than a security 
vulnerability assessment or site security 
plan, that the Administrator has deter-
mined by regulation to be— 
‘‘(I) appropriate to describe sys-
tem compliance with the requirements 
of this title and the Administrator’s 
implementation of such requirements; 
and 
‘‘(II) not detrimental to the secu-
rity of one or more covered water sys-
tems if disclosed; or 
‘‘(ii) information, whether or not also 
contained in a security vulnerability assess-
ment, site security plan, or in a document, 
record, order, notice, or letter, or portion 
thereof, described in any of clauses (ii) 
through (vii) of subparagraph (A) that is 
obtained from another source with respect 
to which the Administrator has not made 
a determination under either subparagraph 
(A)(vii) or (B), including—
126 
‘‘(I) information that is required 
to be made publicly available under 
any other provision of law; and 
‘‘(II) information that a covered 
water system has lawfully disclosed 
other than in a submission to the Ad-
ministrator pursuant to a requirement 
of this title. 
‘‘(m) RELATION TO CHEMICAL FACILITY SECURITY 
REQUIREMENTS.—Title XXI of the Homeland Security 
Act of 2002 and title I of the Chemical and Water Secu-
rity Act of 2009 shall not apply to any public water system 
subject to this Act. 
‘‘(n) PREEMPTION.—This section does not preclude 
or deny the right of any State or political subdivision 
thereof to adopt or enforce any regulation, requirement, 
or standard of performance with respect to a covered 
water system that is more stringent than a regulation, re-
quirement, or standard of performance under this section. 
‘‘(o) VIOLATIONS.— 
‘‘(1) IN
GENERAL.—A covered water system 
that violates any requirement of this section, includ-
ing by not implementing all or part of its site secu-
rity plan by such date as the Administrator requires, 
shall be liable for a civil penalty of not more than
127 
$25,000 for each day on which
the violation oc-
curs. 
‘‘(2) PROCEDURE.—When the Administrator 
determines that a covered water system is subject to 
a civil penalty under paragraph (1), the Adminis-
trator, after consultation with the State, for covered 
water systems located in a State exercising primary 
responsibility for the covered water system, and, 
after considering the severity of the violation or defi-
ciency and the record of the covered water system in 
carrying out the requirements of this section, may— 
‘‘(A) after notice and an opportunity for 
the covered water system to be heard, issue an 
order assessing a penalty under such paragraph 
for any past or current violation, requiring com-
pliance immediately or within a specified time 
period; or 
‘‘(B) commence a civil action in the United 
States district court in the district in which the 
violation occurred for appropriate relief, includ-
ing temporary or permanent injunction. 
‘‘(3) 
METHODS
TO
REDUCE
THE
CON-
SEQUENCES OF A CHEMICAL RELEASE FROM AN IN-
TENTIONAL ACT.—Except as provided in subsections 
(g)(4) and (g)(5), if a covered water system is lo-
128 
cated in a State exercising primary enforcement re-
sponsibility for the system, the Administrator may 
not issue an order or commence a civil action under 
this section for any deficiency in the content or im-
plementation of the portion of the system’s site secu-
rity plan relating to methods to reduce the con-
sequences of a chemical release from an intentional 
act (as defined in subsection (g)(1)). 
‘‘(p) REPORT TO CONGRESS.— 
‘‘(1) PERIODIC
REPORT.—Not later than 3 
years after the effective date of the regulations 
under subsection (a)(1), and every 3 years there-
after, the Administrator shall transmit to the Com-
mittee on Energy and Commerce of the House of 
Representatives and the Committee on Environment 
and Public Works of the Senate a report on progress 
in achieving compliance with this section. Each such 
report shall include, at a minimum, the following: 
‘‘(A) A generalized summary of measures 
implemented by covered water systems in order 
to meet each risk-based performance standard 
established by this section. 
‘‘(B) A summary of how the covered water 
systems, differentiated by risk-based tier as-
signment, are complying with the requirements
129 
of this section during the period covered by the 
report and how the Administrator is imple-
menting and enforcing such requirements dur-
ing such period including— 
‘‘(i) the number of public water sys-
tems that provided the Administrator with 
information pursuant to subsection (d)(1); 
‘‘(ii) the number of covered water sys-
tems assigned to each risk-based tier; 
‘‘(iii) the number of vulnerability as-
sessments and site security plans sub-
mitted by covered water systems; 
‘‘(iv) the number of vulnerability as-
sessments and site security plans approved 
and disapproved by the Administrator; 
‘‘(v) the number of covered water sys-
tems without approved vulnerability assess-
ments or site security plans; 
‘‘(vi) the number of covered water sys-
tems that have been assigned to a different 
risk-based tier due to implementation of a 
method to reduce the consequences of a 
chemical release from an intentional act 
and a description of the types of such im-
plemented methods;
130 
‘‘(vii) the number of audits and in-
spections conducted by the Administrator 
or duly designated representatives of the 
Administrator; 
‘‘(viii) the number of orders for com-
pliance issued by the Administrator; 
‘‘(ix) the administrative penalties as-
sessed by the Administrator for non-com-
pliance with the requirements of this sec-
tion; 
‘‘(x) the civil penalties assessed by 
courts for non-compliance with the require-
ments of this section; and 
‘‘(xi) any other regulatory data the 
Administrator determines appropriate to 
describe covered water system compliance 
with the requirements of this section and 
the Administrator’s implementation of 
such requirements. 
‘‘(2) PUBLIC
AVAILABILITY.—A report sub-
mitted under this section shall be made publicly 
available. 
‘‘(q) GRANT PROGRAMS.— 
‘‘(1) IMPLEMENTATION GRANTS TO STATES.— 
The Administrator may award grants to, or enter
131 
into cooperative agreements with, States, based on 
an allocation formula established by the Adminis-
trator, to assist the States in implementing this sec-
tion. 
‘‘(2) RESEARCH, TRAINING, AND
TECHNICAL 
ASSISTANCE
GRANTS.—The 
Administrator 
may 
award grants to, or enter into cooperative agree-
ments with, non-profit organizations to provide re-
search, training, and technical assistance to covered 
water systems to assist them in carrying out their 
responsibilities under this section. 
‘‘(3) PREPARATION GRANTS.— 
‘‘(A) GRANTS.—The Administrator may 
award grants to, or enter into cooperative 
agreements with, covered water systems to as-
sist such systems in— 
‘‘(i) preparing and updating vulner-
ability assessments, site security plans, and 
emergency response plans; 
‘‘(ii) 
assessing 
and 
implementing 
methods to reduce the consequences of a 
release of a substance of concern from an 
intentional act; and
132 
‘‘(iii) implementing any other security 
reviews and enhancements necessary to 
comply with this section. 
‘‘(B) PRIORITY.— 
‘‘(i) NEED.—The Administrator, in 
awarding grants or entering into coopera-
tive agreements for purposes described in 
subparagraph (A)(i), shall give priority to 
covered water systems that have the great-
est need. 
‘‘(ii) SECURITY RISK.—The Adminis-
trator, in awarding grants or entering into 
cooperative agreements for purposes de-
scribed in subparagraph (A)(ii), shall give 
priority to covered water systems that pose 
the greatest security risk. 
‘‘(4) WORKER TRAINING GRANTS PROGRAM AU-
THORITY.— 
‘‘(A) IN
GENERAL.—The Administrator 
shall establish a grant program to award grants 
to eligible entities to provide for training and 
education of employees and contractor employ-
ees with roles or responsibilities described in 
subsection (f)(1) and first responders and emer-
133 
gency response providers who would respond to 
an intentional act at a covered water system. 
‘‘(B) 
ADMINISTRATION.—The 
Adminis-
trator shall enter into an agreement with the 
National Institute of Environmental Health 
Sciences to make and administer grants under 
this paragraph. 
‘‘(C) USE OF FUNDS.—The recipient of a 
grant under this paragraph shall use the grant 
to provide for— 
‘‘(i) training and education of employ-
ees and contractor employees with roles or 
responsibilities described in subsection 
(f)(1), including the annual mandatory 
training specified in subsection (f)(2) or 
training for first responders in protecting 
nearby persons, property, or the environ-
ment from the effects of a release of a sub-
stance of concern at the covered water sys-
tem, with priority given to covered water 
systems assigned to tier one or tier two 
under subsection (d); and 
‘‘(ii) appropriate training for first re-
sponders and emergency response pro-
134 
viders who would respond to an intentional 
act at a covered water system. 
‘‘(D) ELIGIBLE ENTITIES.—For purposes 
of this paragraph, an eligible entity is a non-
profit organization with demonstrated experi-
ence in implementing and operating successful 
worker or first responder health and safety or 
security training programs. 
‘‘(r) AUTHORIZATION OF APPROPRIATIONS.— 
‘‘(1) IN GENERAL.—To carry out this section, 
there are authorized to be appropriated— 
‘‘(A) $315,000,000 for fiscal year 2011, of 
which up to— 
‘‘(i) $30,000,000 may be used for ad-
ministrative costs incurred by the Adminis-
trator or the States, as appropriate; and 
‘‘(ii) $125,000,000 may be used to 
implement methods to reduce the con-
sequences of a chemical release from an in-
tentional act at covered water systems with 
priority given to covered water systems as-
signed to tier one or tier two under sub-
section (d); and 
‘‘(B) such sums as may be necessary for 
fiscal years 2012 through 2015.
135 
‘‘(2) 
SECURITY
ENHANCEMENTS.—Funding 
under this subsection for basic security enhance-
ments shall not include expenditures for personnel 
costs or monitoring, operation, or maintenance of fa-
cilities, equipment, or systems.’’. 
(b) REGULATIONS; TRANSITION.— 
(1) REGULATIONS.—Not later than 2 years 
after the date of the enactment of this title, the Ad-
ministrator of the Environmental Protection Agency 
shall promulgate final regulations to carry out sec-
tion 1433 of the Safe Drinking Water Act, as 
amended by subsection (a). 
(2) EFFECTIVE DATE.—Until the effective date 
of the regulations promulgated under paragraph (1), 
section 1433 of the Safe Drinking Water Act, as in 
effect on the day before the date of the enactment 
of this title, shall continue to apply. 
(3) SAVINGS PROVISION.—Nothing in this sec-
tion or the amendment made by this section shall af-
fect the application of section 1433 of the Safe 
Drinking Water Act, as in effect before the effective 
date of the regulations promulgated under para-
graph (1), to any violation of such section 1433 oc-
curring before such effective date, and the require-
ments of such section 1433 shall remain in force and
136 
effect with respect to such violation until the viola-
tion has been corrected or enforcement proceedings 
completed, whichever is later. 
SEC. 203. STUDY TO ASSESS THE THREAT OF CONTAMINA-
TION OF DRINKING WATER DISTRIBUTION 
SYSTEMS. 
Not later than 180 days after the date of the enact-
ment of this title, the Administrator of the Environmental 
Protection Agency, in consultation with the Secretary of 
Homeland Security, shall— 
(1) conduct a study to assess the threat to 
drinking water posed by an intentional act of con-
tamination, and the vulnerability of public water sys-
tems, including fire hydrants, to such a threat; and 
(2) submit a report to the Congress on the re-
sults of such study. 
TITLE III—WASTEWATER 
TREATMENT WORKS SECURITY 
SEC. 301. SHORT TITLE. 
This title may be cited as the ‘‘Wastewater Treat-
ment Works Security Act of 2009’’. 
SEC. 302. WASTEWATER TREATMENT WORKS SECURITY. 
(a) IN GENERAL.—Title II of the Federal Water Pol-
lution Control Act (33 U.S.C. 1281 et seq.) is amended 
by adding at the end the following:
137 
‘‘SEC. 222. WASTEWATER TREATMENT WORKS SECURITY. 
‘‘(a) ASSESSMENT OF TREATMENT WORKS VULNER-
ABILITY AND IMPLEMENTATION OF SITE SECURITY AND 
EMERGENCY RESPONSE PLANS.— 
‘‘(1) IN GENERAL.—Each owner or operator of 
a treatment works with either a treatment capacity 
of at least 2,500,000 gallons per day or, in the dis-
cretion of the Administrator, that presents a secu-
rity risk making coverage under this section appro-
priate shall, consistent with regulations developed 
under subsection (b)— 
‘‘(A) conduct and, as required, update a 
vulnerability assessment of its treatment works; 
‘‘(B) develop, periodically update, and im-
plement a site security plan for the treatment 
works; and 
‘‘(C) develop and, as required, revise an 
emergency response plan for the treatment 
works. 
‘‘(2) VULNERABILITY ASSESSMENT.— 
‘‘(A) DEFINITION.—In this section, the 
term ‘vulnerability assessment’ means an as-
sessment of the vulnerability of a treatment 
works to intentional acts that may—
138 
‘‘(i) substantially disrupt the ability of 
the treatment works to safely and reliably 
operate; or 
‘‘(ii) have a substantial adverse effect 
on critical infrastructure, public health or 
safety, or the environment. 
‘‘(B) REVIEW.—A vulnerability assessment 
shall include an identification of the vulner-
ability of the treatment works’— 
‘‘(i) facilities, systems, and devices 
used in the storage, treatment, recycling, 
or reclamation of municipal sewage or in-
dustrial wastes; 
‘‘(ii) intercepting sewers, outfall sew-
ers, sewage collection systems, and other 
constructed conveyances under the control 
of the owner or operator of the treatment 
works; 
‘‘(iii) electronic, computer, and other 
automated systems; 
‘‘(iv) pumping, power, and other 
equipment; 
‘‘(v) use, storage, and handling of var-
ious chemicals, including substances of
139 
concern, as identified by the Adminis-
trator; 
‘‘(vi) operation and maintenance pro-
cedures; and 
‘‘(vii) ability to ensure continuity of 
operations. 
‘‘(3) SITE SECURITY PLAN.— 
‘‘(A) DEFINITION.—In this section, the 
term ‘site security plan’ means a process devel-
oped by the owner or operator of a treatment 
works to address security risks identified in a 
vulnerability assessment developed for the treat-
ment works. 
‘‘(B) IDENTIFICATION
OF
SECURITY
EN-
HANCEMENTS.—A site security plan carried out 
under paragraph (1)(B) shall identify specific 
security enhancements, including procedures, 
countermeasures, or equipment, that, when im-
plemented 
or 
utilized, 
will 
reduce 
the 
vulnerabilities identified in a vulnerability as-
sessment (including the identification of the ex-
tent to which implementation or utilization of 
such security enhancements may impact the op-
erations of the treatment works in meeting the 
goals and requirements of this Act).
140 
‘‘(b) RULEMAKING AND GUIDANCE DOCUMENTS.— 
‘‘(1) IN GENERAL.—Not later than December 
31, 2010, the Administrator, after providing notice 
and an opportunity for public comment, shall issue 
regulations— 
‘‘(A) establishing risk-based performance 
standards for the security of a treatment works 
identified under subsection (a)(1); and 
‘‘(B) establishing requirements and dead-
lines for each owner or operator of a treatment 
works identified under subsection (a)(1)— 
‘‘(i) to conduct and submit to the Ad-
ministrator a vulnerability assessment or, 
if the owner or operator of a treatment 
works already has conducted a vulner-
ability assessment, to revise and submit to 
the Administrator such assessment in ac-
cordance with this section; 
‘‘(ii) to update and submit to the Ad-
ministrator the vulnerability assessment 
not less than every 5 years and promptly 
after any change at the treatment works 
that could cause the reassignment of the 
treatment works to a different risk-based 
tier under paragraph (2)(B);
141 
‘‘(iii) to develop and implement a site 
security plan and to update such plan not 
less than every 5 years and promptly after 
an update to the vulnerability assessment; 
‘‘(iv) to develop an emergency re-
sponse plan (or, if the owner or operator of 
a treatment works has already developed 
an emergency response plan, to revise the 
plan to be in accordance with this section) 
and to revise the plan not less than every 
5 years and promptly after an update to 
the vulnerability assessment; and 
‘‘(v) to provide annual training to em-
ployees of the treatment works on imple-
menting site security plans and emergency 
response plans. 
‘‘(2) RISK-BASED
TIERS
AND
PERFORMANCE 
STANDARDS.— 
‘‘(A) IN GENERAL.—In developing regula-
tions under this subsection, the Administrator 
shall— 
‘‘(i) provide for 4 risk-based tiers ap-
plicable to treatment works identified 
under subsection (a)(1), with tier one rep-
142 
resenting the highest degree of security 
risk; and 
‘‘(ii) establish risk-based performance 
standards for site security plans and emer-
gency response plans required under this 
section. 
‘‘(B) RISK-BASED TIERS.— 
‘‘(i) ASSIGNMENT
OF
RISK-BASED 
TIERS.—The Administrator shall assign 
(and reassign when appropriate) each 
treatment works identified under sub-
section (a)(1) to one of the risk-based tiers 
established pursuant to this paragraph. 
‘‘(ii) FACTORS TO CONSIDER.—In as-
signing a treatment works to a risk-based 
tier, the Administrator shall consider— 
‘‘(I) the size of the treatment 
works; 
‘‘(II) the proximity of the treat-
ment works to large population cen-
ters; 
‘‘(III) the adverse impacts of an 
intentional act, including a worst-case 
release of a substance of concern des-
ignated under subsection (c), on the
143 
operation of the treatment works or 
on 
critical 
infrastructure, 
public 
health or safety, or the environment; 
and 
‘‘(IV) any other factor that the 
Administrator determines to be appro-
priate. 
‘‘(iii) INFORMATION
REQUEST
FOR 
TREATMENT
WORKS.—The Administrator 
may require the owner or operator of a 
treatment works identified under sub-
section (a)(1) to submit information in 
order to determine the appropriate risk- 
based tier for the treatment works. 
‘‘(iv) EXPLANATION FOR RISK-BASED 
TIER
ASSIGNMENT.—The 
Administrator 
shall provide the owner or operator of each 
treatment works assigned to a risk-based 
tier with the reasons for the tier assign-
ment and whether such owner or operator 
of a treatment works is required to submit 
an assessment under paragraph (3)(B). 
‘‘(C) RISK-BASED
PERFORMANCE
STAND-
ARDS.—
144 
‘‘(i) CLASSIFICATION.—In establishing 
risk-based performance standards under 
subparagraph (A)(ii), the Administrator 
shall ensure that the standards are sepa-
rate and, as appropriate, increasingly more 
stringent based on the level of risk associ-
ated with the risk-based tier assignment 
under subparagraph (B) for the treatment 
works. 
‘‘(ii) CONSIDERATION.—In carrying 
out this subparagraph, the Administrator 
shall take into account section 27.230 of 
title 6, Code of Federal Regulations (or 
any successor regulation). 
‘‘(D) SITE SECURITY PLANS.— 
‘‘(i) IN GENERAL.—In developing reg-
ulations under this subsection, the Admin-
istrator shall permit the owner or operator 
of a treatment works identified under sub-
section (a)(1), in developing and imple-
menting a site security plan, to select lay-
ered security and preparedness measures 
that, in combination—
145 
‘‘(I) address the security risks 
identified in its vulnerability assess-
ment; and 
‘‘(II) comply with the applicable 
risk-based performance standards re-
quired by this subsection. 
‘‘(3) 
METHODS
TO
REDUCE
THE
CON-
SEQUENCES OF A CHEMICAL RELEASE FROM AN IN-
TENTIONAL ACT.— 
‘‘(A) DEFINITION.—In this section, the 
term ‘method to reduce the consequences of a 
chemical release from an intentional act’ means 
a measure at a treatment works identified 
under subsection (a)(1) that reduces or elimi-
nates the potential consequences of a release of 
a substance of concern designated under sub-
section (c) from an intentional act, such as— 
‘‘(i) the elimination of or a reduction 
in the amount of a substance of concern 
possessed or planned to be possessed by a 
treatment works through the use of alter-
nate substances, formulations, or proc-
esses;
146 
‘‘(ii) the modification of pressures, 
temperatures, or concentrations of a sub-
stance of concern; and 
‘‘(iii) the reduction or elimination of 
onsite handling of a substance of concern 
through the improvement of inventory con-
trol or chemical use efficiency. 
‘‘(B) ASSESSMENT.— 
‘‘(i) IN GENERAL.—In developing the 
regulations under this subsection, for each 
treatment works identified under sub-
section (a)(1) that possesses or plans to 
possess a substance of concern in excess of 
the release threshold quantity set by the 
Administrator under subsection (c)(2), the 
Administrator shall require the treatment 
works to include in its site security plan an 
assessment of methods to reduce the con-
sequences of a chemical release from an in-
tentional act at the treatment works. 
‘‘(ii) CONSIDERATIONS
FOR
ASSESS-
MENT.—In 
developing 
the 
regulations 
under this subsection, the Administrator 
shall require the owner or operator of each 
treatment works, in preparing the assess-
147 
ment, to consider factors appropriate to 
address the responsibilities of the treat-
ment works to meet the goals and require-
ments of this Act and to include— 
‘‘(I) a description of the methods 
to reduce the consequences of a chem-
ical release from an intentional act; 
‘‘(II) a description of how each 
described method to reduce the con-
sequences of a chemical release from 
an intentional act could, if applied— 
‘‘(aa) reduce the extent of 
death, injury, or serious adverse 
effects to human health or the 
environment as a result of a re-
lease, theft, or misappropriation 
of a substance of concern des-
ignated under subsection (c); and 
‘‘(bb) impact the operations 
of the treatment works in meet-
ing the goals and requirements of 
this Act; 
‘‘(III) whether each described 
method to reduce the consequences of 
a chemical release from an intentional
148 
act at the treatment works is feasible, 
as determined by the Administrator; 
‘‘(IV) the costs (including capital 
and operational costs) and avoided 
costs (including potential savings) as-
sociated with applying each described 
method to reduce the consequences of 
a chemical release from an intentional 
act at the treatment works; 
‘‘(V) any other relevant informa-
tion that the owner or operator of a 
treatment works relied on in con-
ducting the assessment; and 
‘‘(VI) a statement of whether the 
owner or operator of a treatment 
works has implemented or plans to 
implement a method to reduce the 
consequences of a chemical release 
from an intentional act, a description 
of any such method, and, in the case 
of a treatment works described in sub-
paragraph (C)(i), an explanation of 
the reasons for any decision not to 
implement any such method. 
‘‘(C) REQUIRED METHODS.—
149 
‘‘(i) 
APPLICATION.—This 
subpara-
graph applies to a treatment works identi-
fied under subsection (a)(1) that— 
‘‘(I) is assigned to one of the two 
highest risk-based tiers established 
under paragraph (2)(A); and 
‘‘(II) possesses or plans to pos-
sess a substance of concern in excess 
of the threshold quantity set by the 
Administrator under subsection (c)(2). 
‘‘(ii) HIGHEST-RISK SYSTEMS.—If, on 
the basis of its assessment developed pur-
suant to subparagraph (B), the owner or 
operator of a treatment works described in 
clause (i) decides not to implement a meth-
od to reduce the consequences of a chem-
ical release from an intentional act, in ac-
cordance with a timeline set by the Admin-
istrator— 
‘‘(I) the Administrator or, where 
applicable, a State with an approved 
program under section 402, shall de-
termine whether to require the owner 
or operator of a treatment works to 
implement such method; and
150 
‘‘(II) in the case of a State with 
such approved program, the State 
shall report such determination to the 
Administrator. 
‘‘(iii) CONSIDERATIONS.—Before re-
quiring the implementation of a method to 
reduce the consequences of a chemical re-
lease from an intentional act under clause 
(ii), the Administrator or a State, as the 
case may be, shall consider factors appro-
priate to address the responsibilities of the 
treatment works to meet the goals and re-
quirements of this Act, including an exam-
ination of whether the method— 
‘‘(I) would significantly reduce 
the risk of death, injury, or serious 
adverse effects to human health re-
sulting from a chemical release from 
an intentional act at the treatment 
works; 
‘‘(II) would not increase the in-
terim storage by the treatment works 
of a substance of concern designated 
under subsection (c);
151 
‘‘(III) could impact the oper-
ations of the treatment works in meet-
ing the goals and requirements of this 
Act or any more stringent standards 
established by the State or munici-
pality in which the treatment works is 
located; and 
‘‘(IV) is feasible, as determined 
by the Administrator, to be incor-
porated into the operations of the 
treatment works. 
‘‘(D) APPEAL.—Before requiring the im-
plementation of a method to reduce the con-
sequences of a chemical release from an inten-
tional act under clause (ii), the Administrator 
or a State, as the case may be, shall provide the 
owner or operator of the treatment works an 
opportunity to appeal the determination to re-
quire such implementation. 
‘‘(E) INCOMPLETE
OR
LATE
ASSESS-
MENTS.— 
‘‘(i) INCOMPLETE
ASSESSMENTS.—If 
the Administrator determines that a treat-
ment works fails to meet the requirements 
of subparagraph (B) and the applicable
152 
regulations, the Administrator shall, after 
notifying the owner or operator of a treat-
ment works and the State in which the 
treatment works is located, require the 
owner or operator of the treatment works 
to submit a revised assessment not later 
than 60 days after the Administrator noti-
fies the owner or operator. The Adminis-
trator may require such additional revi-
sions as are necessary to ensure that the 
treatment works meets the requirements of 
subparagraph (B) and the applicable regu-
lations. 
‘‘(ii) LATE ASSESSMENTS.—If the Ad-
ministrator finds that the owner or oper-
ator of a treatment works, in conducting 
an assessment pursuant to subparagraph 
(B), did not complete such assessment in 
accordance with the deadline set by the 
Administrator, the Administrator may, 
after notifying the owner or operator of the 
treatment works and the State in which 
the treatment works is located, take appro-
priate enforcement action under subsection 
(j).
153 
‘‘(iii) REVIEW.—A State with an ap-
proved program under section 402 or the 
Administrator, as the case may be, shall 
review a revised assessment that meets the 
requirements of subparagraph (B) and ap-
plicable regulations to determine whether 
the treatment works will be required to im-
plement methods to reduce the con-
sequences of a chemical release from an in-
tentional act pursuant to subparagraph 
(C). 
‘‘(F) ENFORCEMENT.— 
‘‘(i) FAILURE BY STATE TO MAKE DE-
TERMINATION.— 
‘‘(I) IN
GENERAL.—If the Ad-
ministrator determines that a State 
with an approved program under sec-
tion 402 failed to determine whether 
to require a treatment works to imple-
ment a method to reduce the con-
sequences of a chemical release from 
an intentional act, as required by sub-
paragraph (C)(ii), the Administrator 
shall notify the State and the owner 
or operator of the treatment works.
154 
‘‘(II) 
ADMINISTRATIVE
AC-
TION.—If, after 30 days after the no-
tification described in subclause (I), a 
State fails to make the determination 
described in that subclause, the Ad-
ministrator shall notify the State and 
the owner or operator of the treat-
ment works and shall determine 
whether to require the owner or oper-
ator to implement a method to reduce 
the consequences of a chemical release 
from an intentional act based on the 
factors described in subparagraph 
(C)(iii). 
‘‘(ii) FAILURE
BY
STATE
TO
BRING 
ENFORCEMENT ACTION.— 
‘‘(I) IN GENERAL.—If, in a State 
with an approved program under sec-
tion 402, the Administrator deter-
mines that the owner or operator of a 
treatment works fails to implement a 
method to reduce the consequences of 
a chemical release from an intentional 
act (as required by the State or the 
Administrator 
under 
subparagraph
155 
(C)(ii) or the Administrator under 
clause (i)(II)), the Administrator shall 
notify the State and the owner or op-
erator of the treatment works. 
‘‘(II) ADMINISTRATIVE ENFORCE-
MENT
ACTION.—If, after 30 days 
after the notification described in sub-
clause (I), the State has not com-
menced appropriate enforcement ac-
tion, the Administrator shall notify 
the State and may commence an en-
forcement action against the owner or 
operator of the treatment works, in-
cluding by seeking or imposing civil 
penalties under subsection (j), to re-
quire implementation of such method. 
‘‘(4) CONSULTATION
WITH
STATE
AUTHORI-
TIES.—In developing the regulations under this sub-
section, the Administrator shall consult with States 
with approved programs under section 402. 
‘‘(5) CONSULTATION WITH OTHER PERSONS.— 
In developing the regulations under this subsection, 
the Administrator shall consult with the Secretary of 
Homeland Security, and, as appropriate, other per-
sons regarding—
156 
‘‘(A) the provision of threat-related and 
other baseline information to treatment works 
identified under subsection (a)(1); 
‘‘(B) the designation of substances of con-
cern under subsection (c); 
‘‘(C) the development of risk-based per-
formance standards; 
‘‘(D) the establishment of risk-based tiers 
and the process for the assignment of treatment 
works identified under subsection (a)(1) to such 
tiers; 
‘‘(E) the process for the development and 
evaluation of vulnerability assessments, site se-
curity plans, and emergency response plans; 
‘‘(F) the treatment of protected informa-
tion; and 
‘‘(G) any other factor that the Adminis-
trator determines to be appropriate. 
‘‘(6) CONSIDERATION.—In developing the regu-
lations under this subsection, the Administrator 
shall ensure that such regulations are consistent 
with the goals and requirements of this Act. 
‘‘(c) SUBSTANCES OF CONCERN.—For purposes of 
this section, the Administrator, in consultation with the 
Secretary of Homeland Security—
157 
‘‘(1) may designate any chemical substance as 
a substance of concern; 
‘‘(2) at the time any chemical substance is des-
ignated pursuant to paragraph (1), shall establish by 
rulemaking a threshold quantity for the release or 
theft of a substance, taking into account the toxicity, 
reactivity, volatility, dispersability, combustability, 
and flammability of the substance and the amount 
of the substance, that, as a result of the release or 
theft, is known to cause, or may be reasonably an-
ticipated to cause, death, injury, or serious adverse 
impacts to human health or the environment; and 
‘‘(3) in making such a designation, shall take 
into account appendix A to part 27 of title 6, Code 
of Federal Regulations (or any successor regulation). 
‘‘(d) REVIEW OF VULNERABILITY ASSESSMENT AND 
SITE SECURITY PLAN.— 
‘‘(1) IN GENERAL.—Each owner or operator of 
a treatment works identified under subsection (a)(1) 
shall submit its vulnerability assessment and site se-
curity plan to the Administrator for review in ac-
cordance with deadlines established by the Adminis-
trator. 
‘‘(2) STANDARD
OF
REVIEW.—The Adminis-
trator shall review each vulnerability assessment and
158 
site security plan submitted under this subsection 
and— 
‘‘(A) if the assessment or plan has a sig-
nificant deficiency described in paragraph (3), 
require the owner or operator of the treatment 
works to correct the deficiency; or 
‘‘(B) approve such assessment or plan. 
‘‘(3) SIGNIFICANT
DEFICIENCY.—A vulner-
ability assessment or site security plan of a treat-
ment works has a significant deficiency under this 
subsection if the Administrator, in consultation, as 
appropriate, with a State with an approved program 
under section 402, determines that— 
‘‘(A) such assessment does not comply with 
the regulations promulgated under subsection 
(b); or 
‘‘(B) such plan— 
‘‘(i) fails to address vulnerabilities 
identified in a vulnerability assessment; or 
‘‘(ii) fails to meet applicable risk- 
based performance standards. 
‘‘(4) IDENTIFICATION
OF
DEFICIENCIES.—If 
the Administrator identifies a significant deficiency 
in the vulnerability assessment or site security plan 
of an owner or operator of a treatment works under
159 
paragraph (3), the Administrator shall provide the 
owner or operator with a written notification of the 
deficiency that— 
‘‘(A) includes a clear explanation of the de-
ficiency in the vulnerability assessment or site 
security plan; 
‘‘(B) provides guidance to assist the owner 
or operator in addressing the deficiency; and 
‘‘(C) requires the owner or operator to cor-
rect the deficiency and, by such date as the Ad-
ministrator determines appropriate, to submit 
to the Administrator a revised vulnerability as-
sessment or site security plan. 
‘‘(5) STATE, 
LOCAL, 
OR
TRIBAL
GOVERN-
MENTAL
ENTITIES.—No owner or operator of a 
treatment works identified under subsection (a)(1) 
shall be required under State, local, or tribal law to 
provide a vulnerability assessment or site security 
plan described in this section to any State, local, or 
tribal governmental entity solely by reason of the re-
quirement set forth in paragraph (1) that the owner 
or operator of a treatment works submit such an as-
sessment and plan to the Administrator. 
‘‘(e) EMERGENCY RESPONSE PLAN.—
160 
‘‘(1) IN GENERAL.—The owner or operator of a 
treatment works identified under subsection (a)(1) 
shall develop or revise, as appropriate, an emergency 
response plan that incorporates the results of the 
current vulnerability assessment and site security 
plan for the treatment works. 
‘‘(2) CERTIFICATION.—The owner or operator 
of a treatment works identified under subsection 
(a)(1) shall certify to the Administrator that the 
owner or operator has completed an emergency re-
sponse plan, shall submit such certification to the 
Administrator not later than 6 months after the first 
completion or revision of a vulnerability assessment 
under this section, and shall submit an additional 
certification following any update of the emergency 
response plan. 
‘‘(3) CONTENTS.—An emergency response plan 
shall include a description of— 
‘‘(A) plans, procedures, and identification 
of equipment that can be implemented or used 
in the event of an intentional act at the treat-
ment works; and 
‘‘(B) actions, procedures, and identification 
of equipment that can obviate or significantly 
reduce the impact of intentional acts to—
161 
‘‘(i) substantially disrupt the ability of 
the treatment works to safely and reliably 
operate; or 
‘‘(ii) have a substantial adverse effect 
on critical infrastructure, public health or 
safety, or the environment. 
‘‘(4) COORDINATION.—As part of its emergency 
response plan, the owner or operator of a treatment 
works shall provide appropriate information to any 
local emergency planning committee, local law en-
forcement officials, and local emergency response 
providers to ensure an effective, collective response. 
‘‘(f) ROLE OF EMPLOYEES.— 
‘‘(1) DESCRIPTION
OF
ROLE.—Site security 
plans and emergency response plans required under 
this section shall describe the appropriate roles or 
responsibilities that employees and contractor em-
ployees of treatment works are expected to perform 
to deter or respond to the intentional acts identified 
in a current vulnerability assessment. 
‘‘(2) TRAINING FOR EMPLOYEES.—The owner 
or operator of a treatment works identified under 
subsection (a)(1) shall annually provide employees 
and contractor employees with the roles or respon-
sibilities described in paragraph (1) with sufficient
162 
training, as determined by the Administrator, on 
carrying out those roles or responsibilities. 
‘‘(3) EMPLOYEE
PARTICIPATION.—In devel-
oping, revising, or updating a vulnerability assess-
ment, site security plan, and emergency response 
plan required under this section, the owner or oper-
ator of a treatment works shall include— 
‘‘(A) at least one supervisory and at least 
one nonsupervisory employee of the treatment 
works; and 
‘‘(B) at least one representative of each 
certified or recognized bargaining agent rep-
resenting facility employees or contractor em-
ployees with roles or responsibilities described 
in paragraph (1), if any, in a collective bar-
gaining relationship with the owner or operator 
of the treatment works or with a contractor to 
the treatment works. 
‘‘(g) MAINTENANCE OF RECORDS.—The owner or op-
erator of a treatment works identified under subsection 
(a)(1) shall maintain an updated copy of its vulnerability 
assessment, site security plan, and emergency response 
plan on the premises of the treatment works. 
‘‘(h) AUDIT; INSPECTION.—
163 
‘‘(1) IN
GENERAL.—The Administrator shall 
audit and inspect a treatment works identified under 
subsection (a)(1), as necessary, for purposes of de-
termining compliance with this section. 
‘‘(2) ACCESS.—In conducting an audit or in-
spection of a treatment works under paragraph (1), 
the Administrator shall have access to the owners, 
operators, employees and contractor employees, and 
employee representatives, if any, of such treatment 
works. 
‘‘(3) CONFIDENTIAL
COMMUNICATION
OF
IN-
FORMATION; AIDING
INSPECTIONS.—The Adminis-
trator shall offer nonsupervisory employees of a 
treatment works the opportunity confidentially to 
communicate information relevant to the compliance 
or noncompliance of the owner or operator of the 
treatment works with this section, including compli-
ance or noncompliance with any regulation or re-
quirement adopted by the Administrator in further-
ance of the purposes of this section. A representative 
of each certified or recognized bargaining agent de-
scribed in subsection (f)(3)(B), if any, or, if none, a 
nonsupervisory employee, shall be given an oppor-
tunity to accompany the Administrator during the 
physical inspection of any treatment works for the
164 
purpose of aiding such inspection, if representatives 
of the treatment works will also be accompanying 
the Administrator on such inspection. 
‘‘(i) PROTECTION OF INFORMATION.— 
‘‘(1) PROHIBITION OF PUBLIC DISCLOSURE OF 
PROTECTED
INFORMATION.—Protected information 
shall— 
‘‘(A) be exempt from disclosure under sec-
tion 552 of title 5, United States Code; and 
‘‘(B) not be made available pursuant to 
any State, local, or tribal law requiring disclo-
sure of information or records. 
‘‘(2) INFORMATION SHARING.— 
‘‘(A) IN
GENERAL.—The Administrator 
shall prescribe such regulations, and may issue 
such orders, as necessary to prohibit the unau-
thorized disclosure of protected information, as 
described in paragraph (7). 
‘‘(B) SHARING OF PROTECTED INFORMA-
TION.—The regulations under subparagraph 
(A) shall provide standards for and facilitate 
the appropriate sharing of protected informa-
tion with and among Federal, State, local, and 
tribal authorities, first responders, law enforce-
ment officials, supervisory and nonsupervisory
165 
treatment works personnel with security, oper-
ational, or fiduciary responsibility for the sys-
tem designated by the owner or operator of the 
treatment works, and facility employee rep-
resentatives designated by the owner or oper-
ator of the treatment works, if any. 
‘‘(C) 
INFORMATION
SHARING
PROCE-
DURES.—Such standards shall include proce-
dures for the sharing of all portions of the vul-
nerability assessment and site security plan of 
a treatment works relating to the roles and re-
sponsibilities of the employees or contractor em-
ployees of a treatment works under subsection 
(f)(1) with a representative of each certified or 
recognized bargaining agent representing such 
employees, if any, or, if none, with at least one 
supervisory and at least one non-supervisory 
employee with roles and responsibilities under 
subsection (f)(1). 
‘‘(D) PENALTIES.—Protected information, 
as described in paragraph (7), shall not be 
shared except in accordance with the standards 
provided by the regulations under subparagraph 
(A). Whoever discloses protected information in 
knowing violation of the regulations and orders
166 
issued under subparagraph (A) shall be fined 
under title 18, United States Code, imprisoned 
for not more than one year, or both, and, in the 
case of a Federal officeholder or employee, shall 
be removed from Federal office or employment. 
‘‘(3) TREATMENT OF INFORMATION IN ADJU-
DICATIVE PROCEEDINGS.—In any judicial or admin-
istrative proceeding, protected information, as de-
scribed in paragraph (7), shall be treated in a man-
ner consistent with the treatment of sensitive secu-
rity information under section 525 of the Depart-
ment of Homeland Security Appropriations Act, 
2007 (120 Stat. 1381). 
‘‘(4) OTHER
OBLIGATIONS
UNAFFECTED.— 
Nothing in this section amends or affects an obliga-
tion of the owner or operator of a treatment works 
to— 
‘‘(A) submit or make available information 
to employees of the treatment works, employee 
organizations, or a Federal, State, local, or trib-
al government agency under any other provision 
of law; or 
‘‘(B) comply with any other provision of 
law.
167 
‘‘(5) CONGRESSIONAL OVERSIGHT.—Nothing in 
this section permits or authorizes the withholding of 
information from Congress or any committee or sub-
committee thereof. 
‘‘(6) DISCLOSURE
OF
INDEPENDENTLY
FUR-
NISHED
INFORMATION.—Nothing in this section 
amends or affects any authority or obligation of a 
Federal, State, local, or tribal agency to protect or 
disclose any record or information that the Federal, 
State, local, or tribal agency obtains from a treat-
ment works or the Administrator under any other 
provision of law except as provided in subsection 
(d)(5). 
‘‘(7) PROTECTED INFORMATION.— 
‘‘(A) IN GENERAL.—For purposes of this 
section, the term ‘protected information’ means 
any of the following: 
‘‘(i) Vulnerability assessments and 
site security plans under this section, in-
cluding any assessment developed under 
subsection (b)(3)(B). 
‘‘(ii) Documents directly related to the 
Administrator’s review of assessments and 
plans described in clause (i) and, as appli-
168 
cable, the State’s review of an assessment 
developed under subsection (b)(3)(B). 
‘‘(iii) Documents directly related to 
inspections and audits under this section. 
‘‘(iv) Orders, notices, or letters re-
garding the compliance of a treatment 
works described in subsection (a)(1) with 
the requirements of this section. 
‘‘(v) Information required to be pro-
vided to, or documents and records created 
by, the Administrator under subsection 
(b)(2). 
‘‘(vi) Documents directly related to se-
curity drills and training exercises, security 
threats and breaches of security, and 
maintenance, calibration, and testing of se-
curity equipment. 
‘‘(vii) Other information, documents, 
and records developed for the purposes of 
this section that the Administrator has de-
termined by regulation would be detri-
mental to the security of a treatment 
works if disclosed. 
‘‘(B) 
DETRIMENT
REQUIREMENT.—For 
purposes of clauses (ii), (iii), (iv), (v), and (vi)
169 
of subparagraph (A), the only portions of docu-
ments, records, orders, notices, and letters that 
shall be considered protected information are 
those portions that— 
‘‘(i) the Secretary has determined by 
regulation would be detrimental to the se-
curity of a treatment works if disclosed; 
and 
‘‘(ii) are developed by the Adminis-
trator, the State, or the treatment works 
for the purposes of this section. 
‘‘(C) EXCLUSIONS.—Notwithstanding sub-
paragraphs (A) and (B), the term ‘protected in-
formation’ does not include— 
‘‘(i) information, other than a security 
vulnerability assessment or site security 
plan, that the Administrator has deter-
mined by regulation to be— 
‘‘(I) 
appropriate 
to 
describe 
treatment works compliance with the 
requirements of this title and the Ad-
ministrator’s implementation of such 
requirements; and
170 
‘‘(II) not detrimental to the secu-
rity of one or more treatment works if 
disclosed; or 
‘‘(ii) information, whether or not also 
contained in a security vulnerability assess-
ment, site security plan, or in a document, 
record, order, notice, or letter, or portion 
thereof, described in any of clauses (ii) 
through (vii) of subparagraph (A) that is 
obtained from another source with respect 
to which the Administrator has not made 
a determination under either subparagraph 
(A)(vii) or (B), including— 
‘‘(I) information that is required 
to be made publicly available under 
any other provision of law; and 
‘‘(II) information that a treat-
ment works has lawfully disclosed 
other than in a submission to the Ad-
ministrator pursuant to a requirement 
of this title. 
‘‘(j) VIOLATIONS.—For the purposes of section 309 
of this Act, any violation of any requirement of this sec-
tion, including any regulations promulgated pursuant to 
this section, by an owner or operator of a treatment works
171 
described in subsection (a)(1) shall be treated in the same 
manner as a violation of a permit condition under section 
402 of this Act. 
‘‘(k) REPORT TO CONGRESS.— 
‘‘(1) PERIODIC
REPORT.—Not later than 3 
years after the effective date of the regulations 
issued under subsection (b) and every 3 years there-
after, the Administrator shall transmit to the Com-
mittee on Transportation and Infrastructure of the 
House of Representatives and the Committee on En-
vironment and Public Works of the Senate a report 
on progress in achieving compliance with this sec-
tion. 
‘‘(2) CONTENTS OF THE REPORT.—Each such 
report shall include, at a minimum, the following: 
‘‘(A) A generalized summary of measures 
implemented by the owner or operator of a 
treatment works identified under subsection 
(a)(1) in order to meet each risk-based per-
formance standard established by this section. 
‘‘(B) A summary of how the treatment 
works, differentiated by risk-based tier assign-
ment, are complying with the requirements of 
this section during the period covered by the re-
port and how the Administrator is imple-
172 
menting and enforcing such requirements dur-
ing such period, including— 
‘‘(i) the number of treatment works 
that provided the Administrator with infor-
mation 
pursuant 
to 
subsection 
(b)(2)(B)(iii); 
‘‘(ii) the number of treatment works 
assigned to each risk-based tier; 
‘‘(iii) the number of vulnerability as-
sessments and site security plans sub-
mitted by treatment works; 
‘‘(iv) the number of vulnerability as-
sessments and site security plans approved 
or found to have a significant deficiency 
under subsection (d)(2) by the Adminis-
trator; 
‘‘(v) the number of treatment works 
without approved vulnerability assessments 
or site security plans; 
‘‘(vi) the number of treatment works 
that have been assigned to a different risk- 
based tier due to implementation of a 
method to reduce the consequences of a 
chemical release from an intentional act
173 
and a description of the types of such im-
plemented methods; 
‘‘(vii) the number of audits and in-
spections conducted by the Administrator; 
and 
‘‘(viii) any other regulatory data the 
Administrator determines appropriate to 
describe the compliance of owners or oper-
ators of treatment works with the require-
ments of this section and the Administra-
tor’s implementation of such requirements. 
‘‘(3) PUBLIC
AVAILABILITY.—A report sub-
mitted under this section shall be made publicly 
available. 
‘‘(l) GRANTS
FOR VULNERABILITY ASSESSMENTS, 
SECURITY ENHANCEMENTS, AND WORKER TRAINING 
PROGRAMS.— 
‘‘(1) IN
GENERAL.—The Administrator may 
make a grant to a State, municipality, or inter-
municipal or interstate agency— 
‘‘(A) to conduct or update a vulnerability 
assessment, site security plan, or emergency re-
sponse plan for a publicly owned treatment 
works identified under subsection (a)(1);
174 
‘‘(B) to implement a security enhancement 
at a publicly owned treatment works identified 
under subsection (a)(1), including a method to 
reduce the consequences of a chemical release 
from an intentional act, identified in an ap-
proved site security plan and listed in para-
graph (2); 
‘‘(C) to implement an additional security 
enhancement at a publicly owned treatment 
works identified under subsection (a)(1), includ-
ing a method to reduce the consequences of a 
chemical release from an intentional act, identi-
fied in an approved site security plan; and 
‘‘(D) to provide for security-related train-
ing of employees or contractor employees of the 
treatment works and training for first respond-
ers and emergency response providers. 
‘‘(2) 
GRANTS
FOR
SECURITY
ENHANCE-
MENTS.— 
‘‘(A) PREAPPROVED SECURITY ENHANCE-
MENTS.—The Administrator may make a grant 
under paragraph (1)(B) to implement a secu-
rity enhancement of a treatment works for one 
or more of the following:
175 
‘‘(i) Purchase and installation of 
equipment for access control, intrusion 
prevention and delay, and detection of in-
truders and hazardous or dangerous sub-
stances, including— 
‘‘(I) barriers, fencing, and gates; 
‘‘(II) security lighting and cam-
eras; 
‘‘(III) metal grates, wire mesh, 
and outfall entry barriers; 
‘‘(IV) securing of manhole covers 
and fill and vent pipes; 
‘‘(V) installation and re-keying of 
doors and locks; and 
‘‘(VI) smoke, chemical, and ex-
plosive mixture detection systems. 
‘‘(ii) Security improvements to elec-
tronic, computer, or other automated sys-
tems and remote security systems, includ-
ing controlling access to such systems, in-
trusion detection and prevention, and sys-
tem backup. 
‘‘(iii) Participation in training pro-
grams and the purchase of training manu-
176 
als and guidance materials relating to se-
curity. 
‘‘(iv) Security screening of employees 
or contractor support services. 
‘‘(B) ADDITIONAL
SECURITY
ENHANCE-
MENTS.—The Administrator may make a grant 
under paragraph (1)(C) for additional security 
enhancements not listed in subparagraph (A) 
that are identified in an approved site security 
plan. The additional security enhancements 
may include the implementation of a method to 
reduce the consequences of a chemical release 
from an intentional act. 
‘‘(C) LIMITATION
ON
USE
OF
FUNDS.— 
Grants under this subsection may not be used 
for personnel costs or operation or maintenance 
of facilities, equipment, or systems. 
‘‘(D) 
FEDERAL
SHARE.—The 
Federal 
share of the cost of activities funded by a grant 
under paragraph (1) may not exceed 75 per-
cent. 
‘‘(3) ELIGIBILITY.—To be eligible for a grant 
under this subsection, a State, municipality, or 
intermunicipal or interstate agency shall submit in-
formation to the Administrator at such time, in such
177 
form, and with such assurances as the Administrator 
may require. 
‘‘(m) PREEMPTION.—This section does not preclude 
or deny the right of any State or political subdivision 
thereof to adopt or enforce any regulation, requirement, 
or standard of performance with respect to a treatment 
works that is more stringent than a regulation, require-
ment, or standard of performance under this section. 
‘‘(n) AUTHORIZATION OF APPROPRIATIONS.—There 
is authorized to be appropriated to the Administrator 
$200,000,000 for each of fiscal years 2010 through 2014 
for making grants under subsection (l). Such sums shall 
remain available until expended. 
‘‘(o) RELATION TO CHEMICAL FACILITY SECURITY 
REQUIREMENTS.—Title XXI of the Homeland Security 
Act of 2002 and title I of the Chemical and Water Secu-
rity Act of 2009 shall not apply to any treatment works.’’. 
Passed the House of Representatives November 6, 
2009. 
Attest: 
Clerk.
111TH CONGRESS 
1ST SESSION 
H. R. 2868 
AN ACT 
To amend the Homeland Security Act of 2002 to 
enhance security and protect against acts of ter-
rorism against chemical facilities, to amend the 
Safe Drinking Water Act to enhance the security 
of public water systems, and to amend the Fed-
eral Water Pollution Control Act to enhance the 
security of wastewater treatment works, and for 
other purposes.