Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014

Bill: 113-hr-4007
Sponsor: full_name: Rep. Meehan, Patrick [R-PA-7]
Introduced: 2014-02-06
Policy area: Emergency Management
Subjects: Administrative law and regulatory procedures

Civil actions and liability

Criminal justice information and records

Department of Homeland Security

Hazardous wastes and toxic substances

Homeland security

Industrial facilities

Performance measurement

Personnel records

Terrorism
Latest action: action_date: 2014-12-18
text: Became Public Law No: 113-254.

Summaries:
action_date: 2014-02-06
action_desc: Introduced in House
text: <p>Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 - Reestablishes the Chemical Facility Anti-Terrorism Standards (CFATS) Program, under which the Secretary of Homeland Security (DHS) is required to: (1) establish risk-based performance standards designed to protect covered chemical facilities from acts of terrorism; (2) require such facilities to submit security vulnerability assessments and develop and implement site security plans; (3) review and approve or disapprove each such assessment and plan; (4) arrange for the audit and inspection of covered chemical facilities to determine compliance with this Act; and (5) notify, and issue an order to comply to, the owner or operator of a facility not in compliance. </p> <p>Authorizes the Secretary to: (1) issue an order assessing a civil penalty or to cease operations if an owner or operator fails to comply; and (2) approve an alternative security program established by a private sector entity or a federal, state, or local authority that meets the requirements of this Act. </p> <p>Authorizes a covered chemical facility, in order to satisfy the requirements of a risk-based performance standard that addresses personnel surety by identifying individuals with terrorist ties, to utilize any federal screening program that periodically vets individuals against the terrorist screening database. </p> <p>Requires the Secretary to: (1) consult with the heads of other federal agencies, states and political subdivisions, and relevant business associations to identify all chemical facilities of interest; and (2) develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. Defines "covered chemical facility" to mean a chemical facility that the Secretary designates as a facility of interest and determines presents a high level of security risk, with specified exceptions.</p> <p>Requires: (1) information developed pursuant to this Act to be protected from public disclosure, but permits the sharing of such information with state and local government officials possessing the necessary security clearances; and (2) information submitted to or obtained by the Secretary under this Act to be treated as classified material. </p> <p>Sets forth civil penalties for violations of orders issued under this Act.</p> <p> Terminates this Act two years after its enactment.</p>

action_date: 2014-07-08
action_desc: Passed House amended
text: <p>Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 - (Sec. 2) Amends the Homeland Security Act of 2002 to reestablish the Chemical Facility Anti-Terrorism Standards (CFATS) Program in the Department of Homeland Security (DHS) and to authorize appropriations for such Program for FY2015-FY2017.</p> <p>Requires the Secretary of Homeland Security, under such Program, to: (1) establish risk-based performance standards designed to protect covered chemical facilities from acts of terrorism and other security risks; and (2) require such facilities to submit security vulnerability assessments and develop and implement site security plans. Authorizes the Secretary to approve an alternative security program established by a private sector entity or a federal, state, or local authority that meets the requirements of this Act.</p> <p>Requires the Secretary to:</p> <ul> <li>review and approve or disapprove each such assessment and plan using the risk assessment policies and procedures developed under this Act; </li> <li>conduct the audit and inspection of covered chemical facilities, including by using a non-government entity, to determine compliance with this Act; </li> <li>prescribe standards for the training and retraining of DHS or non-governmental auditors and inspectors; and </li> <li>provide written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) to the owner or operator of a covered facility determined to not be in compliance with this Act; and </li> <li>issue to the owner or operator of such a facility an order to comply with this Act. </li></ul> <p>Authorizes the Secretary to issue an order assessing a civil penalty or requiring such a facility to cease operations if the owner or operator fails to comply. </p> <p>Defines: (1) a "covered chemical facility" to mean a chemical facility that the Secretary designates as a facility of interest and determines meets specified risk criteria, and (2) a "chemical facility of interest" to mean a facility that holds a chemical of interest at a threshold quantity that meets relevant risk-related criteria developed under this Act. Excepts certain chemical facilities, including Department of Defense (DOD) and Department of Energy (DOE) facilities.</p> <p>Requires the Secretary to carry out a Personnel Surety Program that provides a participating facility owner or operator with feedback about individuals based on vetting against the terrorist screening database. Authorizes a covered chemical facility to use such a federal screening program in order to satisfy the requirements of a risk-based performance standard that address personnel surety. Requires the Secretary to direct DHS's Security Screening Coordination Office to coordinate with the National Protection and Programs Directorate to expedite the development of a common credential that screens against the terrorist screening database on a recurrent basis.</p> <p>Directs the Secretary to: (1) consult with the heads of other federal agencies, states and political subdivisions, and relevant business associations to identify all chemical facilities of interest; and (2) develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. Requires the criteria for determining the security risk of terrorism associated with a facility to include: (1) the relevant threat information, (2) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, and (3) the vulnerability of the facility to a terrorist attack.</p> <p>Requires: (1) information developed pursuant to this Act to be protected from public disclosure, but permits the sharing of such information with state and local government officials possessing the necessary security clearances; and (2) information submitted to or obtained by the Secretary under this Act to be treated as classified material in any proceeding to enforce this Act.</p> <p>Sets forth civil penalties for violations of orders issued under this Act. </p> <p>Directs the Secretary to publish, including on the DHS website, the whistleblower protections that an individual providing information under this Act would have.</p> <p>Requires: (1) the Secretary to submit to Congress, within 18 months after enactment of this Act, a report on the CFATS Program, including certifications that the Secretary has made significant progress in the identification of all chemical facilities of interest and has developed a risk assessment approach and corresponding tiering methodology and an assessment of DHS's implementation of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute's Tiering Methodology Peer Review; and (2) the Comptroller General (GAO) to submit a semiannual assessments of the implementation of this Act.</p> <p>Authorizes the Secretary to: (1) provide guidance and tools, methodologies, or computer software to assist small covered chemical facilities (covered facilities having fewer than 350 employees) in developing their physical security; and (2) submit a report on best practices that may assist small chemical facilities.</p> <p>Directs the Secretary to: (1) establish an outreach implementation plan to identify chemical facilities of interest and make available compliance assistance materials and information on education and training, (2) commission a third-party study to assess vulnerabilities to acts of terrorism associated with the Program, and (3) submit a plan for the utilization of metrics to assess the effectiveness of the Program to reduce the risk of a terrorist attack or other security risk to citizens and communities surrounding covered chemical facilities.</p>

action_date: 2014-12-10
action_desc: Passed Senate amended
text: <p>Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 - Amends the Homeland Security Act of 2002 to: (1) reestablish the Chemical Facility Anti-Terrorism Standards (CFATS) Program in the Department of Homeland Security (DHS), and (2) authorize such Program for four years.</p> <p>Directs the Secretary of Homeland Security to: </p> <ul> <li> identify chemical facilities of interest and covered chemical facilities; </li> <li> require each chemical facility of interest to submit a Top-Screen and any other information the Secretary determines necessary to enable DHS to assess the facility's security risks; </li> <li> establish risk-based performance standards designed to address high levels of security risk at covered chemical facilities; and </li> <li> require each covered chemical facility to submit a security vulnerability assessment and develop, submit, and implement a site security plan..</li> </ul> <p>Defines: (1) a &quot;chemical facility of interest&quot; to mean a facility that holds a chemical of interest at a threshold quantity set pursuant to relevant risk-related security principles and that is not an excluded facility; (2) a &quot;covered chemical facility&quot; to mean a chemical facility of interest that the Secretary determines meets risk criteria under this Act based upon a review of the facility's Top-Screen; and (3) an &quot;excluded facility&quot; to mean a facility regulated under the Maritime Transportation Security Act of 2002, a public water system, a treatment works, a facility owned or operated by the Department of Defense (DOD) or the Department of Energy (DOE), or a facility subject to regulation by the Nuclear Regulatory Commission (NRC).</p> <p>Requires a covered chemical facility, in developing a site security plan, to include security measures that appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. </p> <p>Directs the Secretary to review and approve or disapprove each site security plan. Authorizes the Secretary to approve an alternative security program established by a private sector entity or a federal, state, or local authority that meets the requirements of this Act.</p> <p>Provides for expedited approval of site security plans for covered chemical facilities assigned to tier 3 or 4 (expedited approval facilities). Directs the Secretary to issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. Requires the owner or operator of an expedited approval facility to certify that: (1) its site security plan includes required security measures, (2) such security measures do not materially deviate from such guidance except where indicated, (3) any deviations meet the risk-based performance standards for the tier to which the facility is assigned, (4) the owner or operator will commit necessary resources to fully implement the plan, and (5) planned measures include an adequate procedure for addressing events beyond the control of the owner or operator. </p> <p>Authorizes the Secretary: (1) to audit and inspect an expedited approval facility to verify its compliance with its site security plan; (2) to enforce compliance with such plan; (3) to suspend the facility's authority to certify a site security plan upon determining that its plan is facially deficient; (4) upon determining that security measures in such plan are insufficient to meet risk-based performance standards, to require additional security measures or suspend the facility's certification and provide the facility an opportunity to submit a new or modified site security plan and certification; and (5) revoke a facility's certification if it does not agree to include recommended additional security measures in its site security plan or does not submit a new or modified plan. Prohibits a facility whose certification has been revoked from being eligible to certify a site security plan. </p> <p>Authorizes the Secretary to develop prescriptive site security plan templates with specific security measures to meet risk-based performance standards for adoption and certification by a covered chemical facility assigned to tier 3 or 4 in lieu of developing and certifying its own plan.</p> <p>Directs the Secretary, within 18 months after this Act's enactment, to evaluate the expedited approval program and report to specified congressional committees on any costs and efficiencies of such program and on its impact on the backlog for site security plan approval and authorization inspections and on the security of chemical facilities. </p> <p>Directs the Secretary to: (1) conduct audits or inspections using DHS employees or nondepartmental or nongovernmental personnel approved by the Secretary, and (2) prescribe standards for the training and retraining of each individual used by DHS as an auditor or inspector.</p> <p>Directs the Secretary to establish and carry out a Personnel Surety Program (a program used by covered chemical facilities to determine whether persons with access to their facility may have ties to terrorism) that: (1) does not require an owner or operator of a facility that voluntarily participates in the Program to submit information about an individual more than one time, (2) provides a participating owner or operator with relevant information based on vetting the individual against the terrorist screening database, and (3) provides redress to an individual who believes that the personally identifiable information submitted to DHS by a facility for such vetting was inaccurate.</p> <p>Requires the Secretary to consult with the heads of other federal agencies, states, political subdivisions, relevant business associations, and public and private labor organizations to identify all chemical facilities of interest. </p> <p>Directs the Secretary to develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. Requires the criteria for determining the security risk of terrorism associated with a covered chemical facility to take into account: (1) relevant threat information; (2) potential economic consequences and the potential loss of human life in the event of the facility being subject to an act of terrorism; and (3) vulnerability of the facility to an act of terrorism.</p> <p>Requires the Secretary to document the basis for each instance in which: (1) tiering for a covered chemical facility is changed, or (2) a covered chemical facility is determined to no longer be subject to the requirements under this Act.</p> <p>Directs the Secretary to report every six months on: (1) the number of covered chemical facilities in the United States, (2) the number of instances in which the Secretary placed a facility in a lower risk tier or determined that a facility that had previously met the criteria for a covered chemical facility no longer met the criteria, (3) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval, and (4) the number of facilities inspected and the average number of facilities inspected per inspector.</p> <p>Requires that information developed under this Act be given protection from public disclosure consistent with the protection of similar information in the National Maritime Transportation Security Plan. Exempts any such protected information from disclosure under the Freedom of Information Act.</p> <p>Permits the sharing of information under this Act, as the Secretary determines appropriate, with state and local government officials possessing a need to know and the necessary security clearances, including law enforcement officials and first responders. Directs the Secretary to provide to state, local, and regional fusion centers and state and local government officials such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to security incidents at covered chemical facilities. </p> <p>Directs the Secretary, upon determining that a covered chemical facility is not in compliance with this Act, to: (1) provide the facility owner or operator a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan and an opportunity for consultation with the Secretary; and (2) issue to the owner or operator an order to comply by a specified date. Authorizes the Secretary to enter an order assessing a civil penalty, an order to cease operations, or both if an owner or operator continues to be in noncompliance after such date. Directs the Secretary, upon determining that there is a reasonable likelihood that a violation of this Act or the CFATS regulations by a chemical facility could result in death, serious illness, severe personal injury, or substantial endangerment to the public, to direct the facility to cease some or all operations or to implement appropriate emergency security measures. </p> <p>Directs the Secretary to: </p> <ul> <li> establish a procedure under which any employee or contractor of a chemical facility of interest may report a violation of a requirement under this Act,</li> <li> keep confidential the identity of an individual who makes such a report and treat any such report as protected information to the extent it does not consist of publicly available information,</li> <li> respond to and acknowledge receipt of the report promptly, and </li> <li> review the information provided in such report and take steps necessary to address any violation.</li> </ul> <p>Prohibits an owner or operator of a covered chemical facility from discharging or otherwise discriminating against an employee because the employee makes such a report, with exceptions for reports involving fraudulent statements or documents.</p> <p>Directs the Secretary to make publicly available the rights that an individual who discloses information regarding problems, deficiencies, or vulnerabilities at a covered chemical facility would have under federal whistleblower protection laws or this Act.</p> <p>Authorizes the Secretary to promulgate regulations or amend existing CFATS regulations to implement this Act. Provides that each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals it. Directs the Secretary to repeal any existing CFATS regulation that is duplicative of, or that conflicts with, this Act.</p> <p>Authorizes the Secretary to provide guidance and tools, methodologies, or computer software to assist small covered chemical facilities (chemical facilities with fewer than 100 employees that are owned and operated by a small business concern) in developing physical security, cybersecurity, recordkeeping, and reporting procedures required under this Act. Directs the Secretary to report on best practices that may assist such facilities in the development of physical security best practices.</p> <p>Directs the Secretary to: (1) establish an outreach implementation plan to identify chemical facilities of interest and make available compliance assistance materials and information on education and training, and (2) commission a third-party study to assess vulnerabilities of covered chemical facilities to acts of terrorism.</p> <p>Requires the Secretary, within 18 months after enactment of this Act, to report to specified congressional committees on the Chemical Facility Anti-Terrorism Standards Program, including: (1) a certification that the Secretary has made significant progress in the identification of all chemical facilities of interest, (2) a certification that the Secretary has developed a risk assessment approach and corresponding tiering methodology, (3) an assessment of DHS implementation of the recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute's Tiering Methodology Peer Review, and (4) a description of best practices that may assist small covered chemical facilities in the development of physical security best practices. </p> <p>Requires the Comptroller General, during the three-year period beginning with this Act's enactment, to submit annual reports assessing the implementation of this Act.</p> <p>

action_date: 2014-12-18
action_desc: Public Law
text: <p><b>(This measure has not been amended since it was passed by the Senate on December 10, 2014. The summary of that version is repeated here.)</b></p> <p>Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 - Amends the Homeland Security Act of 2002 to: (1) reestablish the Chemical Facility Anti-Terrorism Standards (CFATS) Program in the Department of Homeland Security (DHS), and (2) authorize such Program for four years.</p> <p>Directs the Secretary of Homeland Security to: </p> <ul> <li> identify chemical facilities of interest and covered chemical facilities; </li> <li> require each chemical facility of interest to submit a Top-Screen and any other information the Secretary determines necessary to enable DHS to assess the facility's security risks; </li> <li> establish risk-based performance standards designed to address high levels of security risk at covered chemical facilities; and </li> <li> require each covered chemical facility to submit a security vulnerability assessment and develop, submit, and implement a site security plan..</li> </ul> <p>Defines: (1) a &quot;chemical facility of interest&quot; to mean a facility that holds a chemical of interest at a threshold quantity set pursuant to relevant risk-related security principles and that is not an excluded facility; (2) a &quot;covered chemical facility&quot; to mean a chemical facility of interest that the Secretary determines meets risk criteria under this Act based upon a review of the facility's Top-Screen; and (3) an &quot;excluded facility&quot; to mean a facility regulated under the Maritime Transportation Security Act of 2002, a public water system, a treatment works, a facility owned or operated by the Department of Defense (DOD) or the Department of Energy (DOE), or a facility subject to regulation by the Nuclear Regulatory Commission (NRC).</p> <p>Requires a covered chemical facility, in developing a site security plan, to include security measures that appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. </p> <p>Directs the Secretary to review and approve or disapprove each site security plan. Authorizes the Secretary to approve an alternative security program established by a private sector entity or a federal, state, or local authority that meets the requirements of this Act.</p> <p>Provides for expedited approval of site security plans for covered chemical facilities assigned to tier 3 or 4 (expedited approval facilities). Directs the Secretary to issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. Requires the owner or operator of an expedited approval facility to certify that: (1) its site security plan includes required security measures, (2) such security measures do not materially deviate from such guidance except where indicated, (3) any deviations meet the risk-based performance standards for the tier to which the facility is assigned, (4) the owner or operator will commit necessary resources to fully implement the plan, and (5) planned measures include an adequate procedure for addressing events beyond the control of the owner or operator. </p> <p>Authorizes the Secretary: (1) to audit and inspect an expedited approval facility to verify its compliance with its site security plan; (2) to enforce compliance with such plan; (3) to suspend the facility's authority to certify a site security plan upon determining that its plan is facially deficient; (4) upon determining that security measures in such plan are insufficient to meet risk-based performance standards, to require additional security measures or suspend the facility's certification and provide the facility an opportunity to submit a new or modified site security plan and certification; and (5) revoke a facility's certification if it does not agree to include recommended additional security measures in its site security plan or does not submit a new or modified plan. Prohibits a facility whose certification has been revoked from being eligible to certify a site security plan. </p> <p>Authorizes the Secretary to develop prescriptive site security plan templates with specific security measures to meet risk-based performance standards for adoption and certification by a covered chemical facility assigned to tier 3 or 4 in lieu of developing and certifying its own plan.</p> <p>Directs the Secretary, within 18 months after this Act's enactment, to evaluate the expedited approval program and report to specified congressional committees on any costs and efficiencies of such program and on its impact on the backlog for site security plan approval and authorization inspections and on the security of chemical facilities. </p> <p>Directs the Secretary to: (1) conduct audits or inspections using DHS employees or nondepartmental or nongovernmental personnel approved by the Secretary, and (2) prescribe standards for the training and retraining of each individual used by DHS as an auditor or inspector.</p> <p>Directs the Secretary to establish and carry out a Personnel Surety Program (a program used by covered chemical facilities to determine whether persons with access to their facility may have ties to terrorism) that: (1) does not require an owner or operator of a facility that voluntarily participates in the Program to submit information about an individual more than one time, (2) provides a participating owner or operator with relevant information based on vetting the individual against the terrorist screening database, and (3) provides redress to an individual who believes that the personally identifiable information submitted to DHS by a facility for such vetting was inaccurate.</p> <p>Requires the Secretary to consult with the heads of other federal agencies, states, political subdivisions, relevant business associations, and public and private labor organizations to identify all chemical facilities of interest. </p> <p>Directs the Secretary to develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. Requires the criteria for determining the security risk of terrorism associated with a covered chemical facility to take into account: (1) relevant threat information; (2) potential economic consequences and the potential loss of human life in the event of the facility being subject to an act of terrorism; and (3) vulnerability of the facility to an act of terrorism.</p> <p>Requires the Secretary to document the basis for each instance in which: (1) tiering for a covered chemical facility is changed, or (2) a covered chemical facility is determined to no longer be subject to the requirements under this Act.</p> <p>Directs the Secretary to report every six months on: (1) the number of covered chemical facilities in the United States, (2) the number of instances in which the Secretary placed a facility in a lower risk tier or determined that a facility that had previously met the criteria for a covered chemical facility no longer met the criteria, (3) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval, and (4) the number of facilities inspected and the average number of facilities inspected per inspector.</p> <p>Requires that information developed under this Act be given protection from public disclosure consistent with the protection of similar information in the National Maritime Transportation Security Plan. Exempts any such protected information from disclosure under the Freedom of Information Act.</p> <p>Permits the sharing of information under this Act, as the Secretary determines appropriate, with state and local government officials possessing a need to know and the necessary security clearances, including law enforcement officials and first responders. Directs the Secretary to provide to state, local, and regional fusion centers and state and local government officials such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to security incidents at covered chemical facilities. </p> <p>Directs the Secretary, upon determining that a covered chemical facility is not in compliance with this Act, to: (1) provide the facility owner or operator a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan and an opportunity for consultation with the Secretary; and (2) issue to the owner or operator an order to comply by a specified date. Authorizes the Secretary to enter an order assessing a civil penalty, an order to cease operations, or both if an owner or operator continues to be in noncompliance after such date. Directs the Secretary, upon determining that there is a reasonable likelihood that a violation of this Act or the CFATS regulations by a chemical facility could result in death, serious illness, severe personal injury, or substantial endangerment to the public, to direct the facility to cease some or all operations or to implement appropriate emergency security measures. </p> <p>Directs the Secretary to: </p> <ul> <li> establish a procedure under which any employee or contractor of a chemical facility of interest may report a violation of a requirement under this Act,</li> <li> keep confidential the identity of an individual who makes such a report and treat any such report as protected information to the extent it does not consist of publicly available information,</li> <li> respond to and acknowledge receipt of the report promptly, and </li> <li> review the information provided in such report and take steps necessary to address any violation.</li> </ul> <p>Prohibits an owner or operator of a covered chemical facility from discharging or otherwise discriminating against an employee because the employee makes such a report, with exceptions for reports involving fraudulent statements or documents.</p> <p>Directs the Secretary to make publicly available the rights that an individual who discloses information regarding problems, deficiencies, or vulnerabilities at a covered chemical facility would have under federal whistleblower protection laws or this Act.</p> <p>Authorizes the Secretary to promulgate regulations or amend existing CFATS regulations to implement this Act. Provides that each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals it. Directs the Secretary to repeal any existing CFATS regulation that is duplicative of, or that conflicts with, this Act.</p> <p>Authorizes the Secretary to provide guidance and tools, methodologies, or computer software to assist small covered chemical facilities (chemical facilities with fewer than 100 employees that are owned and operated by a small business concern) in developing physical security, cybersecurity, recordkeeping, and reporting procedures required under this Act. Directs the Secretary to report on best practices that may assist such facilities in the development of physical security best practices.</p> <p>Directs the Secretary to: (1) establish an outreach implementation plan to identify chemical facilities of interest and make available compliance assistance materials and information on education and training, and (2) commission a third-party study to assess vulnerabilities of covered chemical facilities to acts of terrorism.</p> <p>Requires the Secretary, within 18 months after enactment of this Act, to report to specified congressional committees on the Chemical Facility Anti-Terrorism Standards Program, including: (1) a certification that the Secretary has made significant progress in the identification of all chemical facilities of interest, (2) a certification that the Secretary has developed a risk assessment approach and corresponding tiering methodology, (3) an assessment of DHS implementation of the recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute's Tiering Methodology Peer Review, and (4) a description of best practices that may assist small covered chemical facilities in the development of physical security best practices. </p> <p>Requires the Comptroller General, during the three-year period beginning with this Act's enactment, to submit annual reports assessing the implementation of this Act.</p> <p>

tv_txt: I 113th CONGRESS 2d Session H. R. 4007 IN THE HOUSE OF REPRESENTATIVES February 6, 2014 Mr. Meehan (for himself, Mr. McCaul , Mr. King of New York , Mr. Gene Green of Texas , Mrs. Miller of Michigan , and Mr. Rogers of Alabama ) introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Energy and Commerce , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) Program established There is in the Department of Homeland Security a Chemical Facility Anti-Terrorism Standards Program. Under such Program, the Secretary of Homeland Security shall establish risk-based performance standards designed to protect covered chemical facilities from acts of terrorism and require such facilities to submit security vulnerability assessments and to develop and implement site security plans. (b) Security measures Site security plans required under subsection (a) may include layered security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general The Secretary shall review and approve or disapprove each security vulnerability assessment and site security plan under subsection (a). The Secretary may not disapprove a site security plan based on the presence or absence of a particular security measure, but the Secretary shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established under subsection (a). (2) Alternative security programs The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or pursuant to other applicable laws, if the Secretary determines that the requirements of such program meet the requirements of this section. A covered chemical facility may meet the site security plan requirement under subsection (a) by adopting an alternative security program that has been reviewed and approved by the Secretary under this paragraph. (3) Site security plan assessments In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this Act. In the case of a covered chemical facility for which a site security plan has been approved by the Secretary before the date of the enactment of this Act, the Secretary may not require the resubmission of the site security information solely by reason of the enactment of this Act. (d) Compliance (1) Audits and inspections The Secretary shall arrange for the audit and inspection of covered chemical facilities for the purpose of determining compliance with this Act. Under any such arrangement, the audit and inspection may be carried out by a non-Department or nongovernment entity, as approved by the Secretary. (2) Notice of noncompliance If the Secretary determines that a covered chemical facility is not in compliance with this section, the Secretary shall provide the owner or operator of the facility with written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) and opportunity for consultation with the Secretary or the Secretary’s designee, and shall issue an order to comply by such date as the Secretary determines to be appropriate under the circumstances. If the owner or operator continues to be in noncompliance after the date specified in such order, the Secretary may enter an order assessing a civil penalty, an order to cease operations, or both. (3) Personnel surety To satisfy the requirements of a risk-based performance standard that addresses personnel surety by identifying individuals with terrorist ties, a covered chemical facility may utilize any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor, including the Department of Homeland Security Personnel Surety Program. (4) Facility access For purposes of the compliance of a covered chemical facility with a risk-based performance standard established under subsection (a), the Secretary may not require the facility to submit any information about an individual who has been granted access to the facility unless the individual— (A) was vetted under the Department of Homeland Security Personnel Surety Program; or (B) has been identified as presenting a terrorism security risk. (5) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility such information as the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of facilities of interest In carrying out this Act, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, and relevant business associations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this Act, the Secretary shall develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a facility shall include— (i) the threat to the facility based upon available intelligence; (ii) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack; and (iii) the vulnerability of the facility to a terrorist attack. (f) Covered chemical facility In this Act, the term covered chemical facility means a chemical facility that the Secretary designates as a chemical facility of interest under subsection (e)(1) and determines presents a high level of security risk. Such term does not include any of the following: (1) A facility regulated pursuant to the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ). (2) A Public Water System, as such term is defined by section 1401 of the Safe Drinking Water Act ( Public Law 93–523 ; 42 U.S.C. 300f ). (3) A Treatment Works, as such term is defined in section 212 of the Federal Water Pollution Control Act ( Public Law 92–500 ; 33 U.S.C. 12920 ). (4) Any facility owned or operated by the Department of Defense or the Department of Energy. (5) Any facility subject to regulation by the Nuclear Regulatory Commission. 3. Protection of information (a) In general Notwithstanding any other provision of law, information developed pursuant to this Act, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 70103 of title 46, United States Code. (b) Sharing of information with States and local governments This section does not prohibit the sharing of information developed pursuant to this Act, as the Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this Act, if such information may not be disclosed pursuant to any State or local law. (c) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material. 4. Civil penalties (a) Violations Any person who violates an order issued under this Act shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (b) Right of action Nothing in this Act confers upon any person except the Secretary a right of action against an owner or operator of a covered chemical facility to enforce any provision of this Act. 5. Relationship to other laws (a) Other Federal laws Nothing in this Act shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This Act shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. 6. Reports (a) Report to Congress Not later than 18 months after the date of the enactment of this Act, the Secretary shall submit to Congress a report on the Chemical Facilities Anti-Terrorism Standards Program. Such report shall include each of the following: (1) Certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest pursuant to section 2(e)(1), including a description of the steps taken to achieve such progress and the metrics used to measure it. (2) Certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology pursuant to section 2(e)(2). (3) An assessment by the Secretary of the implementation by the Department of Homeland Security of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02). (b) Semiannual GAO report During the 2-year period beginning on the date of the enactment of this Act, the Comptroller General of the United States shall submit a semiannual report to Congress containing the assessment of the Comptroller General of the implementation of this Act. The Comptroller General shall submit the first such report by not later than the date that is 180 days after the date of the enactment of this Act. 7. Termination The authority under this Act shall terminate on the date that is 2 years after the date of the enactment of this Act. 8. Effective date This Act shall take effect on the date that is 30 days after the date of the enactment of this Act. 9. Use of existing regulations (a) In general In carrying out the requirements of this Act, the Secretary may, to the extent that the Secretary determines is appropriate, use any of the CFATS regulations, as in effect immediately before the date of the enactment of this Act, that the Secretary determines carry out such requirements. (b) CFATS regulations In this section, the term CFATS regulations means the regulations prescribed pursuant to section 550 of the Department of Homeland Security Appropriations Act ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note).

tv_txt: IB Union Calendar No. 366 113th CONGRESS 2d Session H. R. 4007 [Report No. 113–491, Part I] IN THE HOUSE OF REPRESENTATIVES February 6, 2014 Mr. Meehan (for himself, Mr. McCaul , Mr. King of New York , Mr. Gene Green of Texas , Mrs. Miller of Michigan , and Mr. Rogers of Alabama ) introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Energy and Commerce , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned June 23, 2014 Additional sponsors: Mr. Marino , Mr. Daines , Mr. Perry , and Mr. Vela June 23, 2014 Reported from the Committee on Homeland Security with an amendment Strike out all after the enacting clause and insert the part printed in italic June 23, 2014 The Committee on Energy and Commerce discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed For text of introduced bill, see copy of bill as introduced on February 6, 2014 A BILL To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI CHEMICAL FACILITY ANTI–TERRORISM STANDARDS 2101. Chemical Facility Anti-Terrorism Standards Program (a) Program established There is in the Department a Chemical Facility Anti-Terrorism Standards Program. Under such Program, the Secretary shall establish risk-based performance standards designed to protect covered chemical facilities and chemical facilities of interest from acts of terrorism and other security risks and require such facilities to submit security vulnerability assessments and to develop and implement site security plans. (b) Security measures Site security plans required under subsection (a) may include layered security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general The Secretary shall review and approve or disapprove each security vulnerability assessment and site security plan under subsection (a). The Secretary may not disapprove a site security plan based on the presence or absence of a particular security measure, but the Secretary shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established under subsection (a). (2) Alternative security programs The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or pursuant to other applicable laws, if the Secretary determines that the requirements of such program meet the requirements of this section. A covered chemical facility may meet the site security plan requirement under subsection (a) by adopting an alternative security program that has been reviewed and approved by the Secretary under this paragraph. (3) Site security plan assessments In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. In the case of a covered chemical facility for which a site security plan has been approved by the Secretary before the date of the enactment of this title, the Secretary may not require the resubmission of the site security information solely by reason of the enactment of this title. (4) Consultation The Secretary may consult with the Government Accountability Office to investigate the feasibility and applicability a third party accreditation program that would work with industry stakeholders to develop site security plans that may be applicable to all similarly situated facilities. The program would include the development of Program-Specific Handbooks for facilities to reference on site. (d) Compliance (1) Audits and inspections (A) In general The Secretary shall conduct the audit and inspection of covered chemical facilities for the purpose of determining compliance with this Act. The audit and inspection may be carried out by a non-Department or nongovernment entity, as approved by the Secretary. (B) Reporting structure Any audit or inspection conducted by an individual employed by a nongovernment entity shall be assigned in coordination with the head of audits and inspections for the region in which the audit or inspection is to be conducted. When in the field, any individual employed by a nongovernment entity shall report to the respective head of audits and inspections for the region in which the individual is operating. (C) Requirements for nongovernment personnel If the Secretary arranges for an audit or inspection under subparagraph (A) to be carried out by a nongovernment entity, the Secretary shall require, as a condition of such arrangement, that any individual who conducts the audit or inspection be a citizen of the United States and shall prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for a Government auditor or inspector. Such standards shall include— (i) minimum training requirements for new auditors or inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the maintenance of a secret security clearance; (vi) reporting any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may establish. (D) Training of Department auditors and inspectors The Secretary shall prescribe standards for the training and retraining of individuals employed by the Department as auditors and inspectors. Such standards shall include— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; and (iii) any additional requirements the Secretary may establish. (2) Notice of noncompliance (A) Notice If the Secretary determines that a covered chemical facility or a chemical facility of interest is not in compliance with this section, the Secretary shall— (i) provide the owner or operator of the facility with— (I) written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) by not later than 14 days after the determination is made; and (II) an opportunity for consultation with the Secretary or the Secretary’s designee; and (ii) issue an order to comply by such date as the Secretary determines to be appropriate under the circumstances. (B) Continued noncompliance If the owner or operator continues to be in noncompliance after the date specified in such order, the Secretary may enter an order assessing a civil penalty, an order to cease operations, or both. (3) Personnel surety (A) Personnel surety program For purposes of this title, the Secretary shall carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates to submit information about an individual more than one time; (ii) provides a participating owner or operator of a covered chemical facility with feedback about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility’s compliance with regulations promulgated under this title; and (iii) provides redress to an individual whose information was vetted against the terrorist screening database under the program and who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel surety implementation To the extent that a risk-based performance standard under subsection (a) is directed toward identifying individuals with terrorist ties— (i) a covered chemical facility may satisfy its obligation under such standard with respect to an individual by utilizing any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor, including the Personnel Surety Program under subparagraph (A); and (ii) the Secretary may not require a covered chemical facility to submit any information about such individual unless the individual— (I) is vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Responsibilities of Security Screening Coordination Office (i) In general The Secretary shall direct the Security Screening Coordination Office of the Department to coordinate with the National Protection and Programs Directorate to expedite the development of a common credential that screens against the terrorist screening database on a recurrent basis and meets all other screening requirements of this title. (ii) Report Not later than March 1, 2015, and annually thereafter, the Secretary shall submit to Congress a report on the progress of the Secretary in meeting the requirements of clause (i). (4) Facility access For purposes of the compliance of a covered chemical facility with a risk-based performance standard established under subsection (a), the Secretary may not require the facility to submit any information about an individual who has been granted access to the facility unless the individual— (A) was vetted under the Personnel Surety Program; or (B) has been identified as presenting a terrorism security risk. (5) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility such information as the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, and relevant business associations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a facility shall include— (i) the relevant threat information; (ii) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, compromise, infiltration, or exploitation; and (iii) the vulnerability of the facility to a terrorist attack, compromise, infiltration, or exploitation. (3) Changes in tiering Any time that tiering for a covered chemical facility is changed and the facility is determined to no longer be subject to the requirements of this title, the Secretary shall maintain records to reflect the basis for this determination. The records shall include information on whether and how the information that was the basis for the determination was confirmed by the Secretary. (f) Definitions In this title: (1) The term covered chemical facility means a facility that the Secretary identifies as a chemical facility of interest and, based upon review of a Top-Screen, as such term is defined in section 27.105 of title 6 of Code of Federal Regulations, determines meets the risk criteria developed pursuant subsection (e)(2)(B). Such term does not include any of the following: (A) A facility regulated pursuant to the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ). (B) A Public Water System, as such term is defined by section 1401 of the Safe Drinking Water Act ( Public Law 93–523 ; 42 U.S.C. 300f ). (C) A Treatment Works, as such term is defined in section 212 of the Federal Water Pollution Control Act ( Public Law 92–500 ; 33 U.S.C. 12920 ). (D) Any facility owned or operated by the Department of Defense or the Department of Energy. (E) Any facility subject to regulation by the Nuclear Regulatory Commission. (2) The term chemical facility of interest means a facility that holds, or that the Secretary has a reasonable basis to believe holds, a Chemical of Interest, as designated under in Appendix A of title 6 of the Code of Federal Regulations, at a threshold quantity that meets relevant risk-related criteria developed pursuant to subsection (e)(2)(B). 2102. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed pursuant to this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 70103 of title 46, United States Code. (b) Sharing of information with States and local governments This section does not prohibit the sharing of information developed pursuant to this title, as the Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, if such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders The Secretary shall provide to State, local, and regional fusion centers (as such term is defined in section 210A(j)(1) of this Act) and State and local government officials, as determined appropriate by the Secretary, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to incidents at covered chemical facilities. Such information shall be disseminated through the Homeland Security Information Network or the Homeland Secure Data Network, as appropriate. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material. 2103. Civil penalties (a) Violations Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (b) Right of action Nothing in this title confers upon any person except the Secretary a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2104. Whistleblower protections The Secretary shall publish on the Internet website of the Department and in other materials made available to the public the whistleblower protections that an individual providing such information would have. 2105. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. (c) Rail transit (1) Duplicative regulations The Secretary shall coordinate with the Assistant Secretary of Homeland Security (Transportation Security Administration) to eliminate any provision of this title applicable to rail security that would duplicate any security measure under the Rail Transportation Security Rule under section 1580 of title 49 of the Code of Federal Regulations, as in effect as of the date of the enactment of this title. To the extent that there is a conflict between this title and any regulation under the jurisdiction of the Transportation Security Administration, the regulation under the jurisdiction of the Transportation Security Administration shall prevail. (2) Exemption from Top-Screen A rail transit facility or a rail facility, as such terms are defined in section 1580.3 of title 49 of the Code of Federal Regulations, to which subpart 3 of such title applies pursuant to section 1580.100 of such title shall not be required to complete a Top-Screen as such term is defined in section 27.105 of title 6 of the Code of Federal Regulations. 2106. Reports (a) Report to Congress Not later than 18 months after the date of the enactment of this title, the Secretary shall submit to Congress a report on the Chemical Facilities Anti-Terrorism Standards Program. Such report shall include each of the following: (1) Certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest pursuant to section 2101(e)(1), including a description of the steps taken to achieve such progress and the metrics used to measure it, information on whether facilities that submitted Top-Screens as a result of such efforts were tiered and in what tiers they were placed, and an action plan to better identify chemical facilities of interest and bring those facilities into compliance. (2) Certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology pursuant to section 2101(e)(2). (3) An assessment by the Secretary of the implementation by the Department of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02). (b) Semiannual GAO report During the 3-year period beginning on the date of the enactment of this title, the Comptroller General of the United States shall submit a semiannual report to Congress containing the assessment of the Comptroller General of the implementation of this title. The Comptroller General shall submit the first such report by not later than the date that is 180 days after the date of the enactment of this title. 2107. CFATS regulations (a) In general The Secretary is authorized, in accordance with chapter 5 of title 5, United States Code, to promulgate regulations implementing the provisions of this title. (b) Existing CFATS regulations In carrying out the requirements of this title, the Secretary shall use the CFATS regulations, as in effect immediately before the date of the enactment of this title, that the Secretary determines carry out such requirements, and may issue new regulations or amend such regulations pursuant to the authority in subsection (a). (c) Definition of CFATS regulations In this section, the term CFATS regulations means the regulations prescribed pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note), as well as all Federal Register notices and other published guidance concerning section 550 of the Department of Homeland Security Appropriations Act, 2007. (d) Authority The Secretary shall exclusively rely upon authority provided in this title for determining compliance with this title in— (1) identifying chemicals of interest; (2) designating chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) In general The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing their physical security. (b) Report The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on best practices that may assist small chemical facilities, as defined by the Secretary, in development of physical security best practices. (c) Definition For purposes of this section, the term small covered chemical facility means a covered chemical facility that has fewer than 350 employees employed at the covered chemical facility, and is not a branch or subsidiary of another entity. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of the enactment of this title, the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies and relevant business associations, to identify chemical facilities of interest and make available compliance assistance materials and information on education and training. 2110. Authorization of appropriations There is authorized to be appropriated to carry out this title $87,436,000 for each of fiscal years 2015, 2016, and 2017. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Chemical Facility Anti-Terrorism Standards Program. Sec. 2102. Protection and sharing of information. Sec. 2103. Civil penalties. Sec. 2104. Whistleblower protections. Sec. 2105. Relationship to other laws. Sec. 2106. Reports. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. Sec. 2110. Authorization of appropriations. . (c) Third-party assessment Using amounts authorized to be appropriated under section 2110 of the Homeland Security Act of 2002, as added by subsection (a), the Secretary of Homeland Security shall commission a third-party study to assess vulnerabilities to acts of terrorism associated with the Chemical Facility Anti-Terrorism Standards program, as authorized pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note). (d) Metrics Not later than 180 days after the date of the enactment of this Act, the Secretary shall submit to Congress a plan for the utilization of metrics to assess the effectiveness of the Chemical Facility Anti-Terrorism Standards program to reduce the risk of a terrorist attack or other security risk to those citizens and communities surrounding covered chemical facilities. The plan shall include benchmarks on when the program will begin utilizing the metrics and how the Department of Homeland Security plans to use the information to inform the program. 3. Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of the enactment of this Act.

June 23, 2014 Reported from the Committee on Homeland Security with an amendment June 23, 2014 The Committee on Energy and Commerce discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed

tv_txt: I 113th CONGRESS 2d Session H. R. 4007 IN THE HOUSE OF REPRESENTATIVES AN ACT To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI CHEMICAL FACILITY ANTI–TERRORISM STANDARDS 2101. Chemical Facility Anti-Terrorism Standards Program (a) Program established There is in the Department a Chemical Facility Anti-Terrorism Standards Program. Under such Program, the Secretary shall establish risk-based performance standards designed to protect covered chemical facilities and chemical facilities of interest from acts of terrorism and other security risks and require such facilities to submit security vulnerability assessments and to develop and implement site security plans. (b) Security measures Site security plans required under subsection (a) may include layered security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general The Secretary shall review and approve or disapprove each security vulnerability assessment and site security plan under subsection (a). The Secretary may not disapprove a site security plan based on the presence or absence of a particular security measure, but the Secretary shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established under subsection (a). (2) Alternative security programs The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or pursuant to other applicable laws, if the Secretary determines that the requirements of such program meet the requirements of this section. A covered chemical facility may meet the site security plan requirement under subsection (a) by adopting an alternative security program that has been reviewed and approved by the Secretary under this paragraph. (3) Site security plan assessments In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. In the case of a covered chemical facility for which a site security plan has been approved by the Secretary before the date of the enactment of this title, the Secretary may not require the resubmission of the site security information solely by reason of the enactment of this title. (4) Consultation The Secretary may consult with the Government Accountability Office to investigate the feasibility and applicability a third party accreditation program that would work with industry stakeholders to develop site security plans that may be applicable to all similarly situated facilities. The program would include the development of Program-Specific Handbooks for facilities to reference on site. (d) Compliance (1) Audits and inspections (A) In general The Secretary shall conduct the audit and inspection of covered chemical facilities for the purpose of determining compliance with this Act. The audit and inspection may be carried out by a non-Department or nongovernment entity, as approved by the Secretary. (B) Reporting structure Any audit or inspection conducted by an individual employed by a nongovernment entity shall be assigned in coordination with the head of audits and inspections for the region in which the audit or inspection is to be conducted. When in the field, any individual employed by a nongovernment entity shall report to the respective head of audits and inspections for the region in which the individual is operating. (C) Requirements for nongovernment personnel If the Secretary arranges for an audit or inspection under subparagraph (A) to be carried out by a nongovernment entity, the Secretary shall require, as a condition of such arrangement, that any individual who conducts the audit or inspection be a citizen of the United States and shall prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for a Government auditor or inspector. Such standards shall include— (i) minimum training requirements for new auditors or inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the maintenance of a secret security clearance; (vi) reporting any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may establish. (D) Training of Department auditors and inspectors The Secretary shall prescribe standards for the training and retraining of individuals employed by the Department as auditors and inspectors. Such standards shall include— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; and (iii) any additional requirements the Secretary may establish. (2) Notice of noncompliance (A) Notice If the Secretary determines that a covered chemical facility or a chemical facility of interest is not in compliance with this section, the Secretary shall— (i) provide the owner or operator of the facility with— (I) written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) by not later than 14 days after the determination is made; and (II) an opportunity for consultation with the Secretary or the Secretary’s designee; and (ii) issue an order to comply by such date as the Secretary determines to be appropriate under the circumstances. (B) Continued noncompliance If the owner or operator continues to be in noncompliance after the date specified in such order, the Secretary may enter an order assessing a civil penalty, an order to cease operations, or both. (3) Personnel surety (A) Personnel surety program For purposes of this title, the Secretary shall carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates to submit information about an individual more than one time; (ii) provides a participating owner or operator of a covered chemical facility with feedback about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility’s compliance with regulations promulgated under this title; and (iii) provides redress to an individual whose information was vetted against the terrorist screening database under the program and who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel surety implementation To the extent that a risk-based performance standard under subsection (a) is directed toward identifying individuals with terrorist ties— (i) a covered chemical facility may satisfy its obligation under such standard with respect to an individual by utilizing any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor, including the Personnel Surety Program under subparagraph (A); and (ii) the Secretary may not require a covered chemical facility to submit any information about such individual unless the individual— (I) is vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Responsibilities of Security Screening Coordination Office (i) In general The Secretary shall direct the Security Screening Coordination Office of the Department to coordinate with the National Protection and Programs Directorate to expedite the development of a common credential that screens against the terrorist screening database on a recurrent basis and meets all other screening requirements of this title. (ii) Report Not later than March 1, 2015, and annually thereafter, the Secretary shall submit to Congress a report on the progress of the Secretary in meeting the requirements of clause (i). (4) Facility access For purposes of the compliance of a covered chemical facility with a risk-based performance standard established under subsection (a), the Secretary may not require the facility to submit any information about an individual who has been granted access to the facility unless the individual— (A) was vetted under the Personnel Surety Program; or (B) has been identified as presenting a terrorism security risk. (5) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility such information as the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, and relevant business associations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a facility shall include— (i) the relevant threat information; (ii) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, compromise, infiltration, or exploitation; and (iii) the vulnerability of the facility to a terrorist attack, compromise, infiltration, or exploitation. (3) Changes in tiering Any time that tiering for a covered chemical facility is changed and the facility is determined to no longer be subject to the requirements of this title, the Secretary shall maintain records to reflect the basis for this determination. The records shall include information on whether and how the information that was the basis for the determination was confirmed by the Secretary. (f) Definitions In this title: (1) The term covered chemical facility means a facility that the Secretary identifies as a chemical facility of interest and, based upon review of a Top-Screen, as such term is defined in section 27.105 of title 6 of Code of Federal Regulations, determines meets the risk criteria developed pursuant subsection (e)(2)(B). Such term does not include any of the following: (A) A facility regulated pursuant to the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ). (B) A Public Water System, as such term is defined by section 1401 of the Safe Drinking Water Act ( Public Law 93–523 ; 42 U.S.C. 300f ). (C) A Treatment Works, as such term is defined in section 212 of the Federal Water Pollution Control Act ( Public Law 92–500 ; 33 U.S.C. 12920 ). (D) Any facility owned or operated by the Department of Defense or the Department of Energy. (E) Any facility subject to regulation by the Nuclear Regulatory Commission. (2) The term chemical facility of interest means a facility that holds, or that the Secretary has a reasonable basis to believe holds, a Chemical of Interest, as designated under in Appendix A of title 6 of the Code of Federal Regulations, at a threshold quantity that meets relevant risk-related criteria developed pursuant to subsection (e)(2)(B). 2102. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed pursuant to this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 70103 of title 46, United States Code. (b) Sharing of information with States and local governments This section does not prohibit the sharing of information developed pursuant to this title, as the Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, if such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders The Secretary shall provide to State, local, and regional fusion centers (as such term is defined in section 210A(j)(1) of this Act) and State and local government officials, as determined appropriate by the Secretary, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to incidents at covered chemical facilities. Such information shall be disseminated through the Homeland Security Information Network or the Homeland Secure Data Network, as appropriate. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material. 2103. Civil penalties (a) Violations Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (b) Right of action Nothing in this title confers upon any person except the Secretary a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2104. Whistleblower protections The Secretary shall publish on the Internet website of the Department and in other materials made available to the public the whistleblower protections that an individual providing such information would have. 2105. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. (c) Rail transit (1) Duplicative regulations The Secretary shall coordinate with the Assistant Secretary of Homeland Security (Transportation Security Administration) to eliminate any provision of this title applicable to rail security that would duplicate any security measure under the Rail Transportation Security Rule under section 1580 of title 49 of the Code of Federal Regulations, as in effect as of the date of the enactment of this title. To the extent that there is a conflict between this title and any regulation under the jurisdiction of the Transportation Security Administration, the regulation under the jurisdiction of the Transportation Security Administration shall prevail. (2) Exemption from Top-Screen A rail transit facility or a rail facility, as such terms are defined in section 1580.3 of title 49 of the Code of Federal Regulations, to which subpart 3 of such title applies pursuant to section 1580.100 of such title shall not be required to complete a Top-Screen as such term is defined in section 27.105 of title 6 of the Code of Federal Regulations. 2106. Reports (a) Report to Congress Not later than 18 months after the date of the enactment of this title, the Secretary shall submit to Congress a report on the Chemical Facilities Anti-Terrorism Standards Program. Such report shall include each of the following: (1) Certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest pursuant to section 2101(e)(1), including a description of the steps taken to achieve such progress and the metrics used to measure it, information on whether facilities that submitted Top-Screens as a result of such efforts were tiered and in what tiers they were placed, and an action plan to better identify chemical facilities of interest and bring those facilities into compliance. (2) Certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology pursuant to section 2101(e)(2). (3) An assessment by the Secretary of the implementation by the Department of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02). (b) Semiannual GAO report During the 3-year period beginning on the date of the enactment of this title, the Comptroller General of the United States shall submit a semiannual report to Congress containing the assessment of the Comptroller General of the implementation of this title. The Comptroller General shall submit the first such report by not later than the date that is 180 days after the date of the enactment of this title. 2107. CFATS regulations (a) In general The Secretary is authorized, in accordance with chapter 5 of title 5, United States Code, to promulgate regulations implementing the provisions of this title. (b) Existing CFATS regulations In carrying out the requirements of this title, the Secretary shall use the CFATS regulations, as in effect immediately before the date of the enactment of this title, that the Secretary determines carry out such requirements, and may issue new regulations or amend such regulations pursuant to the authority in subsection (a). (c) Definition of CFATS regulations In this section, the term CFATS regulations means the regulations prescribed pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note), as well as all Federal Register notices and other published guidance concerning section 550 of the Department of Homeland Security Appropriations Act, 2007. (d) Authority The Secretary shall exclusively rely upon authority provided in this title for determining compliance with this title in— (1) identifying chemicals of interest; (2) designating chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) In general The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing their physical security. (b) Report The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on best practices that may assist small chemical facilities, as defined by the Secretary, in development of physical security best practices. (c) Definition For purposes of this section, the term small covered chemical facility means a covered chemical facility that has fewer than 350 employees employed at the covered chemical facility, and is not a branch or subsidiary of another entity. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of the enactment of this title, the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies and relevant business associations, to identify chemical facilities of interest and make available compliance assistance materials and information on education and training. 2110. Authorization of appropriations There is authorized to be appropriated to carry out this title $81,000,000 for each of fiscal years 2015, 2016, and 2017. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Chemical Facility Anti-Terrorism Standards Program. Sec. 2102. Protection and sharing of information. Sec. 2103. Civil penalties. Sec. 2104. Whistleblower protections. Sec. 2105. Relationship to other laws. Sec. 2106. Reports. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. Sec. 2110. Authorization of appropriations. . (c) Third-party assessment Using amounts authorized to be appropriated under section 2110 of the Homeland Security Act of 2002, as added by subsection (a), the Secretary of Homeland Security shall commission a third-party study to assess vulnerabilities to acts of terrorism associated with the Chemical Facility Anti-Terrorism Standards program, as authorized pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note). (d) Metrics Not later than 180 days after the date of the enactment of this Act, the Secretary shall submit to Congress a plan for the utilization of metrics to assess the effectiveness of the Chemical Facility Anti-Terrorism Standards program to reduce the risk of a terrorist attack or other security risk to those citizens and communities surrounding covered chemical facilities. The plan shall include benchmarks on when the program will begin utilizing the metrics and how the Department of Homeland Security plans to use the information to inform the program. 3. Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of the enactment of this Act.

Passed the House of Representatives July 8, 2014. Karen L. Haas, Clerk.

tv_txt: IIB 113th CONGRESS 2d Session H. R. 4007 IN THE SENATE OF THE UNITED STATES July 9, 2014 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI CHEMICAL FACILITY ANTI–TERRORISM STANDARDS 2101. Chemical Facility Anti-Terrorism Standards Program (a) Program established There is in the Department a Chemical Facility Anti-Terrorism Standards Program. Under such Program, the Secretary shall establish risk-based performance standards designed to protect covered chemical facilities and chemical facilities of interest from acts of terrorism and other security risks and require such facilities to submit security vulnerability assessments and to develop and implement site security plans. (b) Security measures Site security plans required under subsection (a) may include layered security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general The Secretary shall review and approve or disapprove each security vulnerability assessment and site security plan under subsection (a). The Secretary may not disapprove a site security plan based on the presence or absence of a particular security measure, but the Secretary shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established under subsection (a). (2) Alternative security programs The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or pursuant to other applicable laws, if the Secretary determines that the requirements of such program meet the requirements of this section. A covered chemical facility may meet the site security plan requirement under subsection (a) by adopting an alternative security program that has been reviewed and approved by the Secretary under this paragraph. (3) Site security plan assessments In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. In the case of a covered chemical facility for which a site security plan has been approved by the Secretary before the date of the enactment of this title, the Secretary may not require the resubmission of the site security information solely by reason of the enactment of this title. (4) Consultation The Secretary may consult with the Government Accountability Office to investigate the feasibility and applicability a third party accreditation program that would work with industry stakeholders to develop site security plans that may be applicable to all similarly situated facilities. The program would include the development of Program-Specific Handbooks for facilities to reference on site. (d) Compliance (1) Audits and inspections (A) In general The Secretary shall conduct the audit and inspection of covered chemical facilities for the purpose of determining compliance with this Act. The audit and inspection may be carried out by a non-Department or nongovernment entity, as approved by the Secretary. (B) Reporting structure Any audit or inspection conducted by an individual employed by a nongovernment entity shall be assigned in coordination with the head of audits and inspections for the region in which the audit or inspection is to be conducted. When in the field, any individual employed by a nongovernment entity shall report to the respective head of audits and inspections for the region in which the individual is operating. (C) Requirements for nongovernment personnel If the Secretary arranges for an audit or inspection under subparagraph (A) to be carried out by a nongovernment entity, the Secretary shall require, as a condition of such arrangement, that any individual who conducts the audit or inspection be a citizen of the United States and shall prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for a Government auditor or inspector. Such standards shall include— (i) minimum training requirements for new auditors or inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the maintenance of a secret security clearance; (vi) reporting any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may establish. (D) Training of Department auditors and inspectors The Secretary shall prescribe standards for the training and retraining of individuals employed by the Department as auditors and inspectors. Such standards shall include— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; and (iii) any additional requirements the Secretary may establish. (2) Notice of noncompliance (A) Notice If the Secretary determines that a covered chemical facility or a chemical facility of interest is not in compliance with this section, the Secretary shall— (i) provide the owner or operator of the facility with— (I) written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) by not later than 14 days after the determination is made; and (II) an opportunity for consultation with the Secretary or the Secretary’s designee; and (ii) issue an order to comply by such date as the Secretary determines to be appropriate under the circumstances. (B) Continued noncompliance If the owner or operator continues to be in noncompliance after the date specified in such order, the Secretary may enter an order assessing a civil penalty, an order to cease operations, or both. (3) Personnel surety (A) Personnel surety program For purposes of this title, the Secretary shall carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates to submit information about an individual more than one time; (ii) provides a participating owner or operator of a covered chemical facility with feedback about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility’s compliance with regulations promulgated under this title; and (iii) provides redress to an individual whose information was vetted against the terrorist screening database under the program and who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel surety implementation To the extent that a risk-based performance standard under subsection (a) is directed toward identifying individuals with terrorist ties— (i) a covered chemical facility may satisfy its obligation under such standard with respect to an individual by utilizing any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor, including the Personnel Surety Program under subparagraph (A); and (ii) the Secretary may not require a covered chemical facility to submit any information about such individual unless the individual— (I) is vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Responsibilities of Security Screening Coordination Office (i) In general The Secretary shall direct the Security Screening Coordination Office of the Department to coordinate with the National Protection and Programs Directorate to expedite the development of a common credential that screens against the terrorist screening database on a recurrent basis and meets all other screening requirements of this title. (ii) Report Not later than March 1, 2015, and annually thereafter, the Secretary shall submit to Congress a report on the progress of the Secretary in meeting the requirements of clause (i). (4) Facility access For purposes of the compliance of a covered chemical facility with a risk-based performance standard established under subsection (a), the Secretary may not require the facility to submit any information about an individual who has been granted access to the facility unless the individual— (A) was vetted under the Personnel Surety Program; or (B) has been identified as presenting a terrorism security risk. (5) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility such information as the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, and relevant business associations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a facility shall include— (i) the relevant threat information; (ii) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, compromise, infiltration, or exploitation; and (iii) the vulnerability of the facility to a terrorist attack, compromise, infiltration, or exploitation. (3) Changes in tiering Any time that tiering for a covered chemical facility is changed and the facility is determined to no longer be subject to the requirements of this title, the Secretary shall maintain records to reflect the basis for this determination. The records shall include information on whether and how the information that was the basis for the determination was confirmed by the Secretary. (f) Definitions In this title: (1) The term covered chemical facility means a facility that the Secretary identifies as a chemical facility of interest and, based upon review of a Top-Screen, as such term is defined in section 27.105 of title 6 of Code of Federal Regulations, determines meets the risk criteria developed pursuant subsection (e)(2)(B). Such term does not include any of the following: (A) A facility regulated pursuant to the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ). (B) A Public Water System, as such term is defined by section 1401 of the Safe Drinking Water Act ( Public Law 93–523 ; 42 U.S.C. 300f ). (C) A Treatment Works, as such term is defined in section 212 of the Federal Water Pollution Control Act ( Public Law 92–500 ; 33 U.S.C. 12920 ). (D) Any facility owned or operated by the Department of Defense or the Department of Energy. (E) Any facility subject to regulation by the Nuclear Regulatory Commission. (2) The term chemical facility of interest means a facility that holds, or that the Secretary has a reasonable basis to believe holds, a Chemical of Interest, as designated under in Appendix A of title 6 of the Code of Federal Regulations, at a threshold quantity that meets relevant risk-related criteria developed pursuant to subsection (e)(2)(B). 2102. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed pursuant to this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 70103 of title 46, United States Code. (b) Sharing of information with States and local governments This section does not prohibit the sharing of information developed pursuant to this title, as the Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, if such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders The Secretary shall provide to State, local, and regional fusion centers (as such term is defined in section 210A(j)(1) of this Act) and State and local government officials, as determined appropriate by the Secretary, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to incidents at covered chemical facilities. Such information shall be disseminated through the Homeland Security Information Network or the Homeland Secure Data Network, as appropriate. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material. 2103. Civil penalties (a) Violations Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (b) Right of action Nothing in this title confers upon any person except the Secretary a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2104. Whistleblower protections The Secretary shall publish on the Internet website of the Department and in other materials made available to the public the whistleblower protections that an individual providing such information would have. 2105. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. (c) Rail transit (1) Duplicative regulations The Secretary shall coordinate with the Assistant Secretary of Homeland Security (Transportation Security Administration) to eliminate any provision of this title applicable to rail security that would duplicate any security measure under the Rail Transportation Security Rule under section 1580 of title 49 of the Code of Federal Regulations, as in effect as of the date of the enactment of this title. To the extent that there is a conflict between this title and any regulation under the jurisdiction of the Transportation Security Administration, the regulation under the jurisdiction of the Transportation Security Administration shall prevail. (2) Exemption from Top-Screen A rail transit facility or a rail facility, as such terms are defined in section 1580.3 of title 49 of the Code of Federal Regulations, to which subpart 3 of such title applies pursuant to section 1580.100 of such title shall not be required to complete a Top-Screen as such term is defined in section 27.105 of title 6 of the Code of Federal Regulations. 2106. Reports (a) Report to Congress Not later than 18 months after the date of the enactment of this title, the Secretary shall submit to Congress a report on the Chemical Facilities Anti-Terrorism Standards Program. Such report shall include each of the following: (1) Certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest pursuant to section 2101(e)(1), including a description of the steps taken to achieve such progress and the metrics used to measure it, information on whether facilities that submitted Top-Screens as a result of such efforts were tiered and in what tiers they were placed, and an action plan to better identify chemical facilities of interest and bring those facilities into compliance. (2) Certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology pursuant to section 2101(e)(2). (3) An assessment by the Secretary of the implementation by the Department of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02). (b) Semiannual GAO report During the 3-year period beginning on the date of the enactment of this title, the Comptroller General of the United States shall submit a semiannual report to Congress containing the assessment of the Comptroller General of the implementation of this title. The Comptroller General shall submit the first such report by not later than the date that is 180 days after the date of the enactment of this title. 2107. CFATS regulations (a) In general The Secretary is authorized, in accordance with chapter 5 of title 5, United States Code, to promulgate regulations implementing the provisions of this title. (b) Existing CFATS regulations In carrying out the requirements of this title, the Secretary shall use the CFATS regulations, as in effect immediately before the date of the enactment of this title, that the Secretary determines carry out such requirements, and may issue new regulations or amend such regulations pursuant to the authority in subsection (a). (c) Definition of CFATS regulations In this section, the term CFATS regulations means the regulations prescribed pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note), as well as all Federal Register notices and other published guidance concerning section 550 of the Department of Homeland Security Appropriations Act, 2007. (d) Authority The Secretary shall exclusively rely upon authority provided in this title for determining compliance with this title in— (1) identifying chemicals of interest; (2) designating chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) In general The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing their physical security. (b) Report The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on best practices that may assist small chemical facilities, as defined by the Secretary, in development of physical security best practices. (c) Definition For purposes of this section, the term small covered chemical facility means a covered chemical facility that has fewer than 350 employees employed at the covered chemical facility, and is not a branch or subsidiary of another entity. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of the enactment of this title, the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies and relevant business associations, to identify chemical facilities of interest and make available compliance assistance materials and information on education and training. 2110. Authorization of appropriations There is authorized to be appropriated to carry out this title $81,000,000 for each of fiscal years 2015, 2016, and 2017. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Chemical Facility Anti-Terrorism Standards Program. Sec. 2102. Protection and sharing of information. Sec. 2103. Civil penalties. Sec. 2104. Whistleblower protections. Sec. 2105. Relationship to other laws. Sec. 2106. Reports. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. Sec. 2110. Authorization of appropriations. . (c) Third-party assessment Using amounts authorized to be appropriated under section 2110 of the Homeland Security Act of 2002, as added by subsection (a), the Secretary of Homeland Security shall commission a third-party study to assess vulnerabilities to acts of terrorism associated with the Chemical Facility Anti-Terrorism Standards program, as authorized pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note). (d) Metrics Not later than 180 days after the date of the enactment of this Act, the Secretary shall submit to Congress a plan for the utilization of metrics to assess the effectiveness of the Chemical Facility Anti-Terrorism Standards program to reduce the risk of a terrorist attack or other security risk to those citizens and communities surrounding covered chemical facilities. The plan shall include benchmarks on when the program will begin utilizing the metrics and how the Department of Homeland Security plans to use the information to inform the program. 3. Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of the enactment of this Act.

Passed the House of Representatives July 8, 2014. Karen L. Haas, Clerk

tv_txt: II Calendar No. 578 113th CONGRESS 2d Session H. R. 4007 [Report No. 113–263] IN THE SENATE OF THE UNITED STATES July 9, 2014 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs September 18, 2014 Reported by Mr. Carper , with an amendment Strike out all after the enacting clause and insert the part printed in italic AN ACT To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI CHEMICAL FACILITY ANTI–TERRORISM STANDARDS 2101. Chemical Facility Anti-Terrorism Standards Program (a) Program established There is in the Department a Chemical Facility Anti-Terrorism Standards Program. Under such Program, the Secretary shall establish risk-based performance standards designed to protect covered chemical facilities and chemical facilities of interest from acts of terrorism and other security risks and require such facilities to submit security vulnerability assessments and to develop and implement site security plans. (b) Security measures Site security plans required under subsection (a) may include layered security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general The Secretary shall review and approve or disapprove each security vulnerability assessment and site security plan under subsection (a). The Secretary may not disapprove a site security plan based on the presence or absence of a particular security measure, but the Secretary shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established under subsection (a). (2) Alternative security programs The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or pursuant to other applicable laws, if the Secretary determines that the requirements of such program meet the requirements of this section. A covered chemical facility may meet the site security plan requirement under subsection (a) by adopting an alternative security program that has been reviewed and approved by the Secretary under this paragraph. (3) Site security plan assessments In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. In the case of a covered chemical facility for which a site security plan has been approved by the Secretary before the date of the enactment of this title, the Secretary may not require the resubmission of the site security information solely by reason of the enactment of this title. (4) Consultation The Secretary may consult with the Government Accountability Office to investigate the feasibility and applicability a third party accreditation program that would work with industry stakeholders to develop site security plans that may be applicable to all similarly situated facilities. The program would include the development of Program-Specific Handbooks for facilities to reference on site. (d) Compliance (1) Audits and inspections (A) In general The Secretary shall conduct the audit and inspection of covered chemical facilities for the purpose of determining compliance with this Act. The audit and inspection may be carried out by a non-Department or nongovernment entity, as approved by the Secretary. (B) Reporting structure Any audit or inspection conducted by an individual employed by a nongovernment entity shall be assigned in coordination with the head of audits and inspections for the region in which the audit or inspection is to be conducted. When in the field, any individual employed by a nongovernment entity shall report to the respective head of audits and inspections for the region in which the individual is operating. (C) Requirements for nongovernment personnel If the Secretary arranges for an audit or inspection under subparagraph (A) to be carried out by a nongovernment entity, the Secretary shall require, as a condition of such arrangement, that any individual who conducts the audit or inspection be a citizen of the United States and shall prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for a Government auditor or inspector. Such standards shall include— (i) minimum training requirements for new auditors or inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the maintenance of a secret security clearance; (vi) reporting any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may establish. (D) Training of Department auditors and inspectors The Secretary shall prescribe standards for the training and retraining of individuals employed by the Department as auditors and inspectors. Such standards shall include— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; and (iii) any additional requirements the Secretary may establish. (2) Notice of noncompliance (A) Notice If the Secretary determines that a covered chemical facility or a chemical facility of interest is not in compliance with this section, the Secretary shall— (i) provide the owner or operator of the facility with— (I) written notification (including a clear explanation of any deficiency in the security vulnerability assessment or site security plan) by not later than 14 days after the determination is made; and (II) an opportunity for consultation with the Secretary or the Secretary’s designee; and (ii) issue an order to comply by such date as the Secretary determines to be appropriate under the circumstances. (B) Continued noncompliance If the owner or operator continues to be in noncompliance after the date specified in such order, the Secretary may enter an order assessing a civil penalty, an order to cease operations, or both. (3) Personnel surety (A) Personnel surety program For purposes of this title, the Secretary shall carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates to submit information about an individual more than one time; (ii) provides a participating owner or operator of a covered chemical facility with feedback about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility’s compliance with regulations promulgated under this title; and (iii) provides redress to an individual whose information was vetted against the terrorist screening database under the program and who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel surety implementation To the extent that a risk-based performance standard under subsection (a) is directed toward identifying individuals with terrorist ties— (i) a covered chemical facility may satisfy its obligation under such standard with respect to an individual by utilizing any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor, including the Personnel Surety Program under subparagraph (A); and (ii) the Secretary may not require a covered chemical facility to submit any information about such individual unless the individual— (I) is vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Responsibilities of Security Screening Coordination Office (i) In general The Secretary shall direct the Security Screening Coordination Office of the Department to coordinate with the National Protection and Programs Directorate to expedite the development of a common credential that screens against the terrorist screening database on a recurrent basis and meets all other screening requirements of this title. (ii) Report Not later than March 1, 2015, and annually thereafter, the Secretary shall submit to Congress a report on the progress of the Secretary in meeting the requirements of clause (i). (4) Facility access For purposes of the compliance of a covered chemical facility with a risk-based performance standard established under subsection (a), the Secretary may not require the facility to submit any information about an individual who has been granted access to the facility unless the individual— (A) was vetted under the Personnel Surety Program; or (B) has been identified as presenting a terrorism security risk. (5) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility such information as the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, and relevant business associations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a risk assessment approach and corresponding tiering methodology that incorporates all relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a facility shall include— (i) the relevant threat information; (ii) the potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, compromise, infiltration, or exploitation; and (iii) the vulnerability of the facility to a terrorist attack, compromise, infiltration, or exploitation. (3) Changes in tiering Any time that tiering for a covered chemical facility is changed and the facility is determined to no longer be subject to the requirements of this title, the Secretary shall maintain records to reflect the basis for this determination. The records shall include information on whether and how the information that was the basis for the determination was confirmed by the Secretary. (f) Definitions In this title: (1) The term covered chemical facility means a facility that the Secretary identifies as a chemical facility of interest and, based upon review of a Top-Screen, as such term is defined in section 27.105 of title 6 of Code of Federal Regulations, determines meets the risk criteria developed pursuant subsection (e)(2)(B). Such term does not include any of the following: (A) A facility regulated pursuant to the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ). (B) A Public Water System, as such term is defined by section 1401 of the Safe Drinking Water Act ( Public Law 93–523 ; 42 U.S.C. 300f ). (C) A Treatment Works, as such term is defined in section 212 of the Federal Water Pollution Control Act ( Public Law 92–500 ; 33 U.S.C. 12920 ). (D) Any facility owned or operated by the Department of Defense or the Department of Energy. (E) Any facility subject to regulation by the Nuclear Regulatory Commission. (2) The term chemical facility of interest means a facility that holds, or that the Secretary has a reasonable basis to believe holds, a Chemical of Interest, as designated under in Appendix A of title 6 of the Code of Federal Regulations, at a threshold quantity that meets relevant risk-related criteria developed pursuant to subsection (e)(2)(B). 2102. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed pursuant to this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with similar information developed by chemical facilities subject to regulation under section 70103 of title 46, United States Code. (b) Sharing of information with States and local governments This section does not prohibit the sharing of information developed pursuant to this title, as the Secretary deems appropriate, with State and local government officials possessing the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, if such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders The Secretary shall provide to State, local, and regional fusion centers (as such term is defined in section 210A(j)(1) of this Act) and State and local government officials, as determined appropriate by the Secretary, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to incidents at covered chemical facilities. Such information shall be disseminated through the Homeland Security Information Network or the Homeland Secure Data Network, as appropriate. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material. 2103. Civil penalties (a) Violations Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (b) Right of action Nothing in this title confers upon any person except the Secretary a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2104. Whistleblower protections The Secretary shall publish on the Internet website of the Department and in other materials made available to the public the whistleblower protections that an individual providing such information would have. 2105. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. (c) Rail transit (1) Duplicative regulations The Secretary shall coordinate with the Assistant Secretary of Homeland Security (Transportation Security Administration) to eliminate any provision of this title applicable to rail security that would duplicate any security measure under the Rail Transportation Security Rule under section 1580 of title 49 of the Code of Federal Regulations, as in effect as of the date of the enactment of this title. To the extent that there is a conflict between this title and any regulation under the jurisdiction of the Transportation Security Administration, the regulation under the jurisdiction of the Transportation Security Administration shall prevail. (2) Exemption from Top-Screen A rail transit facility or a rail facility, as such terms are defined in section 1580.3 of title 49 of the Code of Federal Regulations, to which subpart 3 of such title applies pursuant to section 1580.100 of such title shall not be required to complete a Top-Screen as such term is defined in section 27.105 of title 6 of the Code of Federal Regulations. 2106. Reports (a) Report to Congress Not later than 18 months after the date of the enactment of this title, the Secretary shall submit to Congress a report on the Chemical Facilities Anti-Terrorism Standards Program. Such report shall include each of the following: (1) Certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest pursuant to section 2101(e)(1), including a description of the steps taken to achieve such progress and the metrics used to measure it, information on whether facilities that submitted Top-Screens as a result of such efforts were tiered and in what tiers they were placed, and an action plan to better identify chemical facilities of interest and bring those facilities into compliance. (2) Certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology pursuant to section 2101(e)(2). (3) An assessment by the Secretary of the implementation by the Department of any recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02). (b) Semiannual GAO report During the 3-year period beginning on the date of the enactment of this title, the Comptroller General of the United States shall submit a semiannual report to Congress containing the assessment of the Comptroller General of the implementation of this title. The Comptroller General shall submit the first such report by not later than the date that is 180 days after the date of the enactment of this title. 2107. CFATS regulations (a) In general The Secretary is authorized, in accordance with chapter 5 of title 5, United States Code, to promulgate regulations implementing the provisions of this title. (b) Existing CFATS regulations In carrying out the requirements of this title, the Secretary shall use the CFATS regulations, as in effect immediately before the date of the enactment of this title, that the Secretary determines carry out such requirements, and may issue new regulations or amend such regulations pursuant to the authority in subsection (a). (c) Definition of CFATS regulations In this section, the term CFATS regulations means the regulations prescribed pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note), as well as all Federal Register notices and other published guidance concerning section 550 of the Department of Homeland Security Appropriations Act, 2007. (d) Authority The Secretary shall exclusively rely upon authority provided in this title for determining compliance with this title in— (1) identifying chemicals of interest; (2) designating chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) In general The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing their physical security. (b) Report The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on best practices that may assist small chemical facilities, as defined by the Secretary, in development of physical security best practices. (c) Definition For purposes of this section, the term small covered chemical facility means a covered chemical facility that has fewer than 350 employees employed at the covered chemical facility, and is not a branch or subsidiary of another entity. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of the enactment of this title, the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies and relevant business associations, to identify chemical facilities of interest and make available compliance assistance materials and information on education and training. 2110. Authorization of appropriations There is authorized to be appropriated to carry out this title $81,000,000 for each of fiscal years 2015, 2016, and 2017. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Chemical Facility Anti-Terrorism Standards Program. Sec. 2102. Protection and sharing of information. Sec. 2103. Civil penalties. Sec. 2104. Whistleblower protections. Sec. 2105. Relationship to other laws. Sec. 2106. Reports. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. Sec. 2110. Authorization of appropriations. . (c) Third-party assessment Using amounts authorized to be appropriated under section 2110 of the Homeland Security Act of 2002, as added by subsection (a), the Secretary of Homeland Security shall commission a third-party study to assess vulnerabilities to acts of terrorism associated with the Chemical Facility Anti-Terrorism Standards program, as authorized pursuant to section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388; 6 U.S.C. 121 note). (d) Metrics Not later than 180 days after the date of the enactment of this Act, the Secretary shall submit to Congress a plan for the utilization of metrics to assess the effectiveness of the Chemical Facility Anti-Terrorism Standards program to reduce the risk of a terrorist attack or other security risk to those citizens and communities surrounding covered chemical facilities. The plan shall include benchmarks on when the program will begin utilizing the metrics and how the Department of Homeland Security plans to use the information to inform the program. 3. Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of the enactment of this Act.

1. Short title This Act may be cited as the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI Chemical facility anti–terrorism standards 2101. Definitions In this title— (1) the term CFATS regulation means— (A) an existing CFATs regulation; and (B) any regulation or amendment to an existing CFATS regulation issued pursuant to the authority under section 2107; (2) the term chemical facility of interest means a facility that— (A) holds, or that the Secretary has a reasonable basis to believe holds, a chemical of interest, as designated under Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto, at a threshold quantity set pursuant to relevant risk-related security principles; and (B) is not an excluded facility; (3) the term covered chemical facility means a facility that— (A) the Secretary— (i) identifies as a chemical facility of interest; and (ii) based upon review of the facility's Top-Screen, determines meets the risk criteria developed under section 2102(e)(2)(B); and (B) is not an excluded facility; (4) the term excluded facility means— (A) a facility regulated under the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ; 116 Stat. 2064); (B) a public water system, as that term is defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f); (C) a Treatment Works, as that term is defined in section 212 of the Federal Water Pollution Control Act ( 33 U.S.C. 1292 ); (D) a facility owned or operated by the Department of Defense or the Department of Energy; or (E) a facility subject to regulation by the Nuclear Regulatory Commission, or by a State that has entered into an agreement with the Nuclear Regulatory Commission under section 274 b. of the Atomic Energy Act of 1954 ( 42 U.S.C. 2021(b) ) to protect against unauthorized access of any material, activity, or structure licensed by the Nuclear Regulatory Commission; (5) the term existing CFATS regulation means— (A) a regulation promulgated under section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 6 U.S.C. 121 note) that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; and (B) a Federal Register notice or other published guidance relating to section 550 of the Department of Homeland Security Appropriations Act, 2007 that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; (6) the term expedited approval facility means a covered chemical facility for which the owner or operator elects to submit a site security plan in accordance with section 2102(c)(4); (7) the term facially deficient , relating to a site security plan, means a site security plan that does not support a certification that the security measures in the plan address the security vulnerability assessment and the risk-based performance standards for security for the facility, based on a review of— (A) the facility's site security plan; (B) the facility's Top-Screen; (C) the facility's security vulnerability assessment; or (D) any other information that— (i) the facility submits to the Department; or (ii) the Department obtains from a public source or other source; (8) the term guidance for expedited approval facilities means the guidance issued under section 2102(c)(4)(B)(i); (9) the term risk assessment means the Secretary’s application of relevant risk criteria identified in section 2102(e)(2)(B); (10) the term terrorist screening database means the terrorist screening database maintained by the Federal Government Terrorist Screening Center or its successor; (11) the term tier has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; (12) the terms tiering and tiering methodology mean the procedure by which the Secretary assigns a tier to each covered chemical facility based on the risk assessment for that covered chemical facility; (13) the term Top-Screen has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; and (14) the term vulnerability assessment means the identification of weaknesses in the security of a chemical facility of interest. 2102. Chemical facility anti-terrorism standards program (a) Program established (1) In general There is in the Department a Chemical Facility Anti-Terrorism Standards Program. (2) Requirements In carrying out the Chemical Facility Anti-Terrorism Standards Program, the Secretary shall— (A) identify— (i) chemical facilities of interest; and (ii) covered chemical facilities; (B) require each chemical facility of interest to submit a Top-Screen and any other information the Secretary determines necessary to enable the Department to assess the security risks associated with the facility; (C) establish risk-based performance standards designed to address high levels of security risk at covered chemical facilities; and (D) require each covered chemical facility to— (i) submit a security vulnerability assessment; and (ii) develop, submit, and implement a site security plan. (b) Security measures A facility, in developing a site security plan as required under subsection (a), shall include security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (c) Approval or disapproval of site security plans (1) In general (A) Review Except as provided in paragraph (4), the Secretary shall review and approve or disapprove each site security plan submitted pursuant to subsection (a). (B) Bases for disapproval The Secretary— (i) may not disapprove a site security plan based on the presence or absence of a particular security measure; and (ii) shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established pursuant to subsection (a)(2)(C). (2) Alternative security programs (A) Authority to approve (i) In general The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or under other applicable laws, if the Secretary determines that the requirements of the program meet the requirements under this section. (ii) Additional security measures If the requirements of an alternative security program do not meet the requirements under this section, the Secretary may recommend additional security measures to the program that will enable the Secretary to approve the program. (B) Satisfaction of site security plan requirement A covered chemical facility may satisfy the site security plan requirement under subsection (a) by adopting an alternative security program that the Secretary has— (i) reviewed and approved under subparagraph (A); and (ii) determined to be appropriate for the operations and security concerns of the covered chemical facility. (3) Site security plan assessments (A) Risk assessment policies and procedures In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. (B) Previously approved plans In the case of a covered chemical facility for which the Secretary approved a site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary may not require the facility to resubmit the site security plan solely by reason of the enactment of this title. (4) Expedited approval program (A) In general A covered chemical facility assigned to tier 3 or 4 may meet the requirement to develop and submit a site security plan under subsection (a)(2)(D) by developing and submitting to the Secretary— (i) a site security plan and the certification described in subparagraph (C); or (ii) a site security plan in conformance with a template authorized under subparagraph (H). (B) Guidance for expedited approval facilities (i) In general Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. (ii) Material deviation from guidance If a security measure in the site security plan of an expedited approval facility materially deviates from a security measure in the guidance for expedited approval facilities, the site security plan shall include an explanation of how such security measure meets the risk-based performance standards. (iii) Process In developing and issuing, or amending, the guidance for expedited approval facilities under this subparagraph and in collecting information from expedited approval facilities, the Secretary— (I) shall consult with— (aa) Sector Coordinating Councils established under sections 201 and 871(a); and (bb) appropriate labor organizations; and (II) shall not be subject to section 553 of title 5, United States Code, the National Environmental Policy Act of 1969 ( 42 U.S.C. 4321 et seq. ), subchapter I of chapter 35 of title 44, United States Code, or section 2107(b) of this title. (C) Certification The owner or operator of an expedited approval facility shall submit to the Secretary a certification, signed under penalty of perjury, that— (i) the owner or operator is familiar with the requirements of this title and part 27 of title 6, Code of Federal Regulations, or any successor thereto, and the site security plan being submitted; (ii) the site security plan includes the security measures required by subsection (b); (iii) (I) the security measures in the site security plan do not materially deviate from the guidance for expedited approval facilities except where indicated in the site security plan; (II) any deviations from the guidance for expedited approval facilities in the site security plan meet the risk-based performance standards for the tier to which the facility is assigned; and (III) the owner or operator has provided an explanation of how the site security plan meets the risk-based performance standards for any material deviation; (iv) the owner or operator has visited, examined, documented, and verified that the expedited approval facility meets the criteria set forth in the site security plan; (v) the expedited approval facility has implemented all of the required performance measures outlined in the site security plan or set out planned measures that will be implemented within a reasonable time period stated in the site security plan; (vi) each individual responsible for implementing the site security plan is fully aware of the requirements relevant to the individual’s responsibility contained in the site security plan and is competent to carry out those requirements; and (vii) the owner or operator has committed, or, in the case of planned measures will commit, the necessary resources to fully implement the site security plan. (D) Deadline (i) In general Not later than 120 days after the date described in clause (ii), the owner or operator of an expedited approval facility shall submit to the Secretary the site security plan and the certification described in subparagraph (C). (ii) Date The date described in this clause is— (I) for an expedited approval facility that was assigned to tier 3 or 4 under existing CFATS regulations before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the date that is 210 days after the date of enactment of that Act; and (II) for any expedited approval facility not described in subclause (I), the later of— (aa) the date on which the expedited approval facility is assigned to tier 3 or 4 under subsection (e)(2)(A); or (bb) the date that is 210 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . (iii) Notice An owner or operator of an expedited approval facility shall notify the Secretary of the intent of the owner or operator to certify the site security plan for the expedited approval facility not later than 30 days before the date on which the owner or operator submits the site security plan and certification described in subparagraph (C). (E) Compliance (i) In general For an expedited approval facility submitting a site security plan and certification in accordance with subparagraphs (A), (B), (C), and (D)— (I) the expedited approval facility shall comply with all of the requirements of its site security plan; and (II) the Secretary— (aa) except as provided in subparagraph (G), may not disapprove the site security plan; and (bb) may audit and inspect the expedited approval facility under subsection (d) to verify compliance with its site security plan. (ii) Noncompliance If the Secretary determines an expedited approval facility is not in compliance with the requirements of the site security plan or is otherwise in violation of this title, the Secretary may enforce compliance in accordance with section 2104. (F) Amendments to site security plan (i) Requirement (I) In general If the owner or operator of an expedited approval facility amends a site security plan submitted under subparagraph (A), the owner or operator shall submit the amended site security plan and a certification relating to the amended site security plan that contains the information described in subparagraph (C). (II) Technical amendments For purposes of this clause, an amendment to a site security plan includes any technical amendment to the site security plan. (ii) Amendment required The owner or operator of an expedited approval facility shall amend the site security plan if— (I) there is a change in the design, construction, operation, or maintenance of the expedited approval facility that affects the site security plan; (II) the Secretary requires additional security measures or suspends a certification and recommends additional security measures under subparagraph (G); or (III) the owner or operator receives notice from the Secretary of a change in tiering under subsection (e)(3). (iii) Deadline An amended site security plan and certification shall be submitted under clause (i)— (I) in the case of a change in design, construction, operation, or maintenance of the expedited approval facility that affects the security plan, not later than 120 days after the date on which the change in design, construction, operation, or maintenance occurred; (II) in the case of the Secretary requiring additional security measures or suspending a certification and recommending additional security measures under subparagraph (G), not later than 120 days after the date on which the owner or operator receives notice of the requirement for additional security measures or suspension of the certification and recommendation of additional security measures; and (III) in the case of a change in tiering, not later than 120 days after the date on which the owner or operator receives notice under subsection (e)(3). (G) Facially deficient site security plans (i) Prohibition Notwithstanding subparagraph (A) or (E), the Secretary may suspend the authority of a covered chemical facility to certify a site security plan if the Secretary— (I) determines the certified site security plan or an amended site security plan is facially deficient; and (II) not later than 100 days after the date on which the Secretary receives the site security plan and certification, provides the covered chemical facility with written notification that the site security plan is facially deficient, including a clear explanation of each deficiency in the site security plan. (ii) Additional security measures (I) In general If, during or after a compliance inspection of an expedited approval facility, the Secretary determines that planned or implemented security measures in the site security plan of the facility are insufficient to meet the risk-based performance standards based on misrepresentation, omission, or an inadequate description of the site, the Secretary may— (aa) require additional security measures; or (bb) suspend the certification of the facility. (II) Recommendation of additional security measures If the Secretary suspends the certification of an expedited approval facility under subclause (I), the Secretary shall— (aa) recommend specific additional security measures that, if made part of the site security plan by the facility, would enable the Secretary to approve the site security plan; and (bb) provide the facility an opportunity to submit a new or modified site security plan and certification under subparagraph (A). (III) Submission; review If an expedited approval facility determines to submit a new or modified site security plan and certification as authorized under subclause (II)(bb)— (aa) not later than 90 days after the date on which the facility receives recommendations under subclause (II)(aa), the facility shall submit the new or modified plan and certification; and (bb) not later than 45 days after the date on which the Secretary receives the new or modified plan under item (aa), the Secretary shall review the plan and determine whether the plan is facially deficient. (IV) Determination not to include additional security measures (aa) Revocation of certification If an expedited approval facility does not agree to include in its site security plan specific additional security measures recommended by the Secretary under subclause (II)(aa), or does not submit a new or modified site security plan in accordance with subclause (III), the Secretary may revoke the certification of the facility by issuing an order under section 2104(a)(1)(B). (bb) Effect of revocation If the Secretary revokes the certification of an expedited approval facility under item (aa) by issuing an order under section 2104(a)(1)(B)— (AA) the order shall require the owner or operator of the facility to submit a site security plan or alternative security program for review by the Secretary review under subsection (c)(1); and (BB) the facility shall no longer be eligible to certify a site security plan under this paragraph. (V) Facial deficiency If the Secretary determines that a new or modified site security plan submitted by an expedited approval facility under subclause (III) is facially deficient— (aa) not later than 120 days after the date of the determination, the owner or operator of the facility shall submit a site security plan or alternative security program for review by the Secretary under subsection (c)(1); and (bb) the facility shall no longer be eligible to certify a site security plan under this paragraph. (H) Templates (i) In general The Secretary may develop prescriptive site security plan templates with specific security measures to meet the risk-based performance standards under subsection (a)(2)(C) for adoption and certification by a covered chemical facility assigned to tier 3 or 4 in lieu of developing and certifying its own plan. (ii) Process In developing and issuing, or amending, the site security plan templates under this subparagraph, issuing guidance for implementation of the templates, and in collecting information from expedited approval facilities, the Secretary— (I) shall consult with— (aa) Sector Coordinating Councils established under sections 201 and 871(a); and (bb) appropriate labor organizations; and (II) shall not be subject to section 553 of title 5, United States Code, the National Environmental Policy Act of 1969 ( 42 U.S.C. 4321 et seq. ), subchapter I of chapter 35 of title 44, United States Code, or section 2107(b) of this title. (iii) Rule of construction Nothing in this subparagraph shall be construed to prevent a covered chemical facility from developing and certifying its own security plan in accordance with subparagraph (A). (I) Evaluation (i) In general Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall take any appropriate action necessary for a full evaluation of the expedited approval program authorized under this paragraph, including conducting an appropriate number of inspections, as authorized under subsection (d), of expedited approval facilities. (ii) Report Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report that contains— (I) any costs and efficiencies associated with the expedited approval program authorized under this paragraph; (II) the impact of the expedited approval program on the backlog for site security plan approval and authorization inspections; (III) an assessment of the ability of expedited approval facilities to submit facially sufficient site security plans; (IV) an assessment of any impact of the expedited approval program on the security of chemical facilities; and (V) a recommendation by the Secretary on the frequency of compliance inspections that may be required for expedited approval facilities. (d) Compliance (1) Audits and inspections (A) Definitions In this paragraph— (i) the term nondepartmental — (I) with respect to personnel, means personnel that is not employed by the Department; and (II) with respect to an entity, means an entity that is not a component or other authority of the Department; and (ii) the term nongovernmental — (I) with respect to personnel, means personnel that is not employed by the Federal Government; and (II) with respect to an entity, means an entity that is not an agency, department, or other authority of the Federal Government. (B) Authority to conduct audits and inspections The Secretary shall conduct audits or inspections under this title using— (i) employees of the Department; or (ii) nondepartmental or nongovernmental personnel approved by the Secretary. (C) Support personnel The Secretary may use nongovernmental personnel to provide administrative and logistical services in support of audits and inspections under this title. (D) Reporting structure (i) Nondepartmental and nongovernmental audits and inspections Any audit or inspection conducted by an individual employed by a nondepartmental or nongovernmental entity shall be assigned in coordination with a regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the audit or inspection is to be conducted. (ii) Requirement to report While an individual employed by a nondepartmental or nongovernmental entity is in the field conducting an audit or inspection under this subsection, the individual shall report to the regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the individual is operating. (iii) Approval The authority to approve a site security plan under subsection (c) or determine if a covered chemical facility is in compliance with an approved site security plan shall be exercised solely by the Secretary or a designee of the Secretary within the Department. (E) Standards for auditors and inspectors The Secretary shall prescribe standards for the training and retraining of each individual used by the Department as an auditor or inspector, including each individual employed by the Department and all nondepartmental or nongovernmental personnel, including— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the proper certification or certifications necessary to handle chemical-terrorism vulnerability information (as defined in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto); (vi) the reporting of any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may require. (F) Conditions for nongovernmental auditors and inspectors If the Secretary arranges for an audit or inspection under subparagraph (B) to be carried out by a nongovernmental entity, the Secretary shall— (i) prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for similar Government auditors or inspectors; and (ii) ensure that any duties carried out by a nongovernmental entity are not inherently governmental functions. (2) Personnel surety (A) Personnel surety program For purposes of this title, the Secretary shall establish and carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates in the program to submit information about an individual more than one time; (ii) provides a participating owner or operator of a covered chemical facility with relevant information about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility to be in compliance with regulations promulgated under this title; and (iii) provides redress to an individual— (I) whose information was vetted against the terrorist screening database under the program; and (II) who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel surety program implementation To the extent that a risk-based performance standard established under subsection (a) requires identifying individuals with ties to terrorism— (i) a covered chemical facility may satisfy its obligation under the standard by using any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor program, including the Personnel Surety Program established under subparagraph (A); and (ii) the Secretary may not require a covered chemical facility to submit any information about an individual unless the individual— (I) is to be vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (3) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility any information that the owner or operator needs to comply with this section. (e) Responsibilities of the secretary (1) Identification of chemical facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, relevant business associations, and public and private labor organizations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a covered chemical facility shall take into account— (i) relevant threat information; (ii) potential economic consequences and the potential loss of human life in the event of the facility being subject to a terrorist attack, compromise, infiltration, or exploitation; and (iii) vulnerability of the facility to a terrorist attack, compromise, infiltration, or exploitation. (3) Changes in tiering (A) Maintenance of records The Secretary shall document the basis for each instance in which— (i) tiering for a covered chemical facility is changed; or (ii) a covered chemical facility is determined to no longer be subject to the requirements under this title. (B) Required information The records maintained under subparagraph (A) shall include information on whether and how the Secretary confirmed the information that was the basis for the change or determination described in subparagraph (A). (4) Semiannual performance reporting Not later than 6 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, and not less frequently than once every 6 months thereafter, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report that describes, for the period covered by the report— (A) the number of covered chemical facilities in the United States; (B) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval; (C) the number of covered chemical facilities inspected; (D) the average number of covered chemical facilities inspected per inspector; and (E) any other information that the Secretary determines will be helpful to Congress in evaluating the performance of the Chemical Facility Anti-Terrorism Standards Program. 2103. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed under this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with the protection of similar information under section 70103(d) of title 46, United States Code. (b) Sharing of information with States and local governments Nothing in this section shall be construed to prohibit the sharing of information developed under this title, as the Secretary determines appropriate, with State and local government officials possessing a need to know and the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title. (c) Sharing of information with first responders (1) Requirement The Secretary shall provide to State, local, and regional fusion centers (as that term is defined in section 210A(j)(1)) and State and local government officials, as the Secretary determines appropriate, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to security incidents at covered chemical facilities. (2) Dissemination The Secretary shall disseminate information under paragraph (1) through a medium or system determined by the Secretary to be appropriate to ensure the secure and expeditious dissemination of such information to necessary selected individuals. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this title, and related vulnerability or security information, shall be treated as if the information were classified information. (e) Availability of information Notwithstanding any other provision of law (including section 552(b)(3) of title 5, United States Code), section 552 of title 5, United States Code (commonly known as the Freedom of Information Act ) shall not apply to information protected from public disclosure pursuant to subsection (a) of this section. 2104. Civil enforcement (a) Notice of noncompliance (1) Notice If the Secretary determines that a covered chemical facility is not in compliance with this title, the Secretary shall— (A) provide the owner or operator of the facility with— (i) not later than 14 days after date on which the Secretary makes the determination, a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan; and (ii) an opportunity for consultation with the Secretary or the Secretary’s designee; and (B) issue to the owner or operator of the facility an order to comply with this title by a date specified by the Secretary in the order, which date shall be not later than 180 days after the date on which the Secretary issues the order. (2) Continued noncompliance If an owner or operator continues to be in noncompliance with this title after the date specified in an order issued under paragraph (1)(B), the Secretary may enter an order in accordance with this section assessing a civil penalty, an order to cease operations, or both. (b) Civil penalties (1) Violations of orders Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (2) Non-reporting chemical facilities of interest Any owner of a chemical facility of interest who fails to comply with, or knowingly submits false information under, this title or the CFATS regulations shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (c) Emergency orders (1) In general Notwithstanding subsection (a) or any site security plan or alternative security program approved under this title, if the Secretary determines that there is a reasonable likelihood that a violation of this title or the CFATS regulations by a chemical facility could result in death, serious illness, severe personal injury, or substantial endangerment to the public, the Secretary may direct the facility, effective immediately or as soon as practicable, to— (A) cease some or all operations; or (B) implement appropriate emergency security measures. (2) Limitation on delegation The Secretary may not delegate the authority under paragraph (1) to any official other than the Under Secretary for the National Protection and Programs Directorate. (d) Right of action Nothing in this title confers upon any person except the Secretary or his or her designee a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2105. Whistleblower protections (a) Procedure for reporting problems (1) Establishment of a reporting procedure Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall establish, and provide information to the public regarding, a procedure under which any employee or contractor of a chemical facility may submit a report to the Secretary regarding problems, deficiencies, or vulnerabilities at a covered chemical facility that are associated with the risk of a chemical facility terrorist incident. (2) Confidentiality The Secretary shall keep confidential the identity of an individual who submits a report under paragraph (1) and any such report shall be treated as a record containing protected information to the extent that the report does not consist of publicly available information. (3) Acknowledgment of receipt If a report submitted under paragraph (1) identifies the individual making the report, the Secretary shall promptly respond to the individual directly and shall promptly acknowledge receipt of the report. (4) Steps to address problems The Secretary shall— (A) review and consider the information provided in any report submitted under paragraph (1); and (B) take appropriate steps under this title if necessary to address any substantiated problems, deficiencies, or vulnerabilities associated with the risk of a chemical facility terrorist incident identified in the report. (5) Retaliation prohibited (A) In general An owner or operator of a covered chemical facility or agent thereof may not discharge an employee or otherwise discriminate against an employee with respect to the compensation provided to, or terms, conditions, or privileges of the employment of, the employee because the employee (or an individual acting pursuant to a request of the employee) submitted a report under paragraph (1). (B) Exception An employee shall not be entitled to the protections under this section if the employee— (i) knowingly and willfully makes any false, fictitious, or fraudulent statement or representation; or (ii) uses any false writing or document knowing the writing or document contains any false, fictitious, or fraudulent statement or entry. (b) Protected disclosures Nothing in this title shall be construed to limit the right of an individual to make any disclosure— (1) protected or authorized under section 2302(b)(8) or 7211 of title 5, United States Code; (2) protected under any other Federal or State law that shields the disclosing individual against retaliation or discrimination for having made the disclosure in the public interest; or (3) to the Special Counsel of an agency, the inspector general of an agency, or any other employee designated by the head of an agency to receive disclosures similar to the disclosures described in paragraphs (1) and (2). (c) Publication of rights The Secretary, in partnership with industry associations and labor organizations, shall make publicly available both physically and online the rights that an individual who discloses information, including security-sensitive information, regarding problems, deficiencies, or vulnerabilities at a covered chemical facility would have under Federal whistleblower protection laws or this title. (d) Protected information All information contained in a report made under this subsection (a) shall be protected in accordance with section 2103. 2106. Relationship to other laws (a) Other federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. 2107. CFATS regulations (a) General authority The Secretary may, in accordance with chapter 5 of title 5, United States Code, promulgate regulations or amend existing CFATS regulations to implement the provisions under this title. (b) Existing CFATS regulations (1) In general Notwithstanding section 4(b) of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals the regulation. (2) Repeal Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title. (c) Authority The Secretary shall exclusively rely upon authority provided under this title in— (1) determining compliance with this title; (2) identifying chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) Definition In this section, the term small covered chemical facility means a covered chemical facility that— (1) has fewer than 100 employees employed at the covered chemical facility; and (2) is owned and operated by a small business concern (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )). (b) Assistance to facilities The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing the physical security, cybersecurity, recordkeeping, and reporting procedures required under this title. (c) Report The Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on best practices that may assist small covered chemical facilities in development of physical security best practices. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies, relevant business associations, and public and private labor organizations, to— (1) identify chemical facilities of interest; and (2) make available compliance assistance materials and information on education and training. . (b) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( Public Law 107–196 ; 116 Stat. 2135) is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Definitions. Sec. 2102. Chemical Facility Anti-Terrorism Standards Program. Sec. 2103. Protection and sharing of information. Sec. 2104. Civil enforcement. Sec. 2105. Whistleblower protections. Sec. 2106. Relationship to other laws. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. . 3. Assessment; reports (a) Definitions In this section— (1) the term Chemical Facility Anti-Terrorism Standards Program means— (A) the Chemical Facility Anti-Terrorism Standards program initially authorized under section 550 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109-295; 6 U.S.C. 121 note); and (B) the Chemical Facility Anti-Terrorism Standards Program subsequently authorized under section 2102(a) of the Homeland Security Act of 2002, as added by section 2; (2) the term Department means the Department of Homeland Security; and (3) the term Secretary means the Secretary of Homeland Security. (b) Third-party assessment Using amounts appropriated to the Department before the date of enactment of this Act, the Secretary shall commission a third-party study to assess vulnerabilities of covered chemical facilities, as defined in section 2101 of the Homeland Security Act of 2002 (as added by section 2), to acts of terrorism. (c) Reports (1) Report to Congress Not later than 18 months after the date of enactment of this Act, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the Chemical Facility Anti-Terrorism Standards Program that includes— (A) a certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest under section 2102(e)(1) of the Homeland Security Act of 2002, as added by section 2, including— (i) a description of the steps taken to achieve that progress and the metrics used to measure the progress; (ii) information on whether facilities that submitted Top-Screens as a result of the identification of chemical facilities of interest were tiered and in what tiers those facilities were placed; and (iii) an action plan to better identify chemical facilities of interest and bring those facilities into compliance with title XXI of the Homeland Security Act of 2002, as added by section 2; (B) a certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology under section 2102(e)(2) of the Homeland Security Act of 2002, as added by section 2; (C) an assessment by the Secretary of the implementation by the Department of the recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02); and (D) a description of best practices that may assist small covered chemical facilities, as defined in section 2108(a) of the Homeland Security Act of 2002, as added by section 2, in the development of physical security best practices. (2) Annual GAO report (A) In general During the 3-year period beginning on the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress an annual report that assesses the implementation of this Act and the amendments made by this Act. (B) Initial report Not later than 180 days after the date of enactment of this Act, the Comptroller General shall submit to Congress the first report under subparagraph (A). (C) Second annual report Not later than one year from the date of the initial report required under subparagraph (B), the Comptroller General shall submit to Congress the second report under subparagraph (A), which shall include an assessment of the whistleblower protections provided under section 2105 of the Homeland Security Act of 2002, as added by section 2, and— (i) describes the number and type of problems, deficiencies, and vulnerabilities with respect to which reports have been submitted under such section 2105; (ii) evaluates the efforts of the Secretary in addressing the problems, deficiencies, and vulnerabilities described in subsection (a)(1) of such section 2105; and (iii) evaluates the efforts of the Secretary to inform individuals of their rights, as required under subsection (c) of such section 2105. (D) Third annual report Not later than 1 year after the date on which the Comptroller General submits the second report required under subparagraph (A), the Comptroller General shall submit to Congress the third report under subparagraph (A), which shall include an assessment of— (i) the expedited approval program authorized under section 2102(c)(4) of the Homeland Security Act of 2002, as added by section 2; and (ii) the report on the expedited approval program submitted by the Secretary under subparagraph (I)(ii) of such section 2102(c)(4). 4. Effective date; conforming repeal (a) Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of enactment of this Act. (b) Conforming repeal Section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388), is repealed as of the effective date of this Act. 5. Termination The authority provided under title XXI of the Homeland Security Act of 2002, as added by section 2(a), shall terminate on the date that is 4 years after the effective date of this Act.

September 18, 2014 Reported with an amendment

tv_txt: I One Hundred Thirteenth Congress of the United States of America At the Second Session Begun and held at the City of Washington on Friday, the third day of January, two thousand and fourteen H. R. 4007 AN ACT To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program.

1. Short title This Act may be cited as the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI Chemical facility anti–terrorism standards 2101. Definitions In this title— (1) the term CFATS regulation means— (A) an existing CFATS regulation; and (B) any regulation or amendment to an existing CFATS regulation issued pursuant to the authority under section 2107; (2) the term chemical facility of interest means a facility that— (A) holds, or that the Secretary has a reasonable basis to believe holds, a chemical of interest, as designated under Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto, at a threshold quantity set pursuant to relevant risk-related security principles; and (B) is not an excluded facility; (3) the term covered chemical facility means a facility that— (A) the Secretary— (i) identifies as a chemical facility of interest; and (ii) based upon review of the facility's Top-Screen, determines meets the risk criteria developed under section 2102(e)(2)(B); and (B) is not an excluded facility; (4) the term excluded facility means— (A) a facility regulated under the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ; 116 Stat. 2064); (B) a public water system, as that term is defined in section 1401 of the Safe Drinking Water Act ( 42 U.S.C. 300f ); (C) a Treatment Works, as that term is defined in section 212 of the Federal Water Pollution Control Act ( 33 U.S.C. 1292 ); (D) a facility owned or operated by the Department of Defense or the Department of Energy; or (E) a facility subject to regulation by the Nuclear Regulatory Commission, or by a State that has entered into an agreement with the Nuclear Regulatory Commission under section 274 b. of the Atomic Energy Act of 1954 ( 42 U.S.C. 2021(b) ) to protect against unauthorized access of any material, activity, or structure licensed by the Nuclear Regulatory Commission; (5) the term existing CFATS regulation means— (A) a regulation promulgated under section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 6 U.S.C. 121 note) that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; and (B) a Federal Register notice or other published guidance relating to section 550 of the Department of Homeland Security Appropriations Act, 2007 that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; (6) the term expedited approval facility means a covered chemical facility for which the owner or operator elects to submit a site security plan in accordance with section 2102(c)(4); (7) the term facially deficient , relating to a site security plan, means a site security plan that does not support a certification that the security measures in the plan address the security vulnerability assessment and the risk-based performance standards for security for the facility, based on a review of— (A) the facility's site security plan; (B) the facility's Top-Screen; (C) the facility's security vulnerability assessment; or (D) any other information that— (i) the facility submits to the Department; or (ii) the Department obtains from a public source or other source; (8) the term guidance for expedited approval facilities means the guidance issued under section 2102(c)(4)(B)(i); (9) the term risk assessment means the Secretary’s application of relevant risk criteria identified in section 2102(e)(2)(B); (10) the term terrorist screening database means the terrorist screening database maintained by the Federal Government Terrorist Screening Center or its successor; (11) the term tier has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; (12) the terms tiering and tiering methodology mean the procedure by which the Secretary assigns a tier to each covered chemical facility based on the risk assessment for that covered chemical facility; (13) the term Top-Screen has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; and (14) the term vulnerability assessment means the identification of weaknesses in the security of a chemical facility of interest. 2102. Chemical facility anti-terrorism standards program (a) Program established (1) In general There is in the Department a Chemical Facility Anti-Terrorism Standards Program. (2) Requirements In carrying out the Chemical Facility Anti-Terrorism Standards Program, the Secretary shall— (A) identify— (i) chemical facilities of interest; and (ii) covered chemical facilities; (B) require each chemical facility of interest to submit a Top-Screen and any other information the Secretary determines necessary to enable the Department to assess the security risks associated with the facility; (C) establish risk-based performance standards designed to address high levels of security risk at covered chemical facilities; and (D) require each covered chemical facility to— (i) submit a security vulnerability assessment; and (ii) develop, submit, and implement a site security plan. (b) Security measures (1) In general A facility, in developing a site security plan as required under subsection (a), shall include security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (2) Employee input To the greatest extent practicable, a facility’s security vulnerability assessment and site security plan shall include input from at least 1 facility employee and, where applicable, 1 employee representative from the bargaining agent at that facility, each of whom possesses, in the determination of the facility’s security officer, relevant knowledge, experience, training, or education as pertains to matters of site security. (c) Approval or disapproval of site security plans (1) In general (A) Review Except as provided in paragraph (4), the Secretary shall review and approve or disapprove each site security plan submitted pursuant to subsection (a). (B) Bases for disapproval The Secretary— (i) may not disapprove a site security plan based on the presence or absence of a particular security measure; and (ii) shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established pursuant to subsection (a)(2)(C). (2) Alternative security programs (A) Authority to approve (i) In general The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or under other applicable laws, if the Secretary determines that the requirements of the program meet the requirements under this section. (ii) Additional security measures If the requirements of an alternative security program do not meet the requirements under this section, the Secretary may recommend additional security measures to the program that will enable the Secretary to approve the program. (B) Satisfaction of site security plan requirement A covered chemical facility may satisfy the site security plan requirement under subsection (a) by adopting an alternative security program that the Secretary has— (i) reviewed and approved under subparagraph (A); and (ii) determined to be appropriate for the operations and security concerns of the covered chemical facility. (3) Site security plan assessments (A) Risk assessment policies and procedures In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. (B) Previously approved plans In the case of a covered chemical facility for which the Secretary approved a site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary may not require the facility to resubmit the site security plan solely by reason of the enactment of this title. (4) Expedited approval program (A) In general A covered chemical facility assigned to tier 3 or 4 may meet the requirement to develop and submit a site security plan under subsection (a)(2)(D) by developing and submitting to the Secretary— (i) a site security plan and the certification described in subparagraph (C); or (ii) a site security plan in conformance with a template authorized under subparagraph (H). (B) Guidance for expedited approval facilities (i) In general Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. (ii) Material deviation from guidance If a security measure in the site security plan of an expedited approval facility materially deviates from a security measure in the guidance for expedited approval facilities, the site security plan shall include an explanation of how such security measure meets the risk-based performance standards. (iii) Applicability of other laws to development and issuance of initial guidance During the period before the Secretary has met the deadline under clause (i), in developing and issuing, or amending, the guidance for expedited approval facilities under this subparagraph and in collecting information from expedited approval facilities, the Secretary shall not be subject to— (I) section 553 of title 5, United States Code; (II) subchapter I of chapter 35 of title 44, United States Code; or (III) section 2107(b) of this title. (C) Certification The owner or operator of an expedited approval facility shall submit to the Secretary a certification, signed under penalty of perjury, that— (i) the owner or operator is familiar with the requirements of this title and part 27 of title 6, Code of Federal Regulations, or any successor thereto, and the site security plan being submitted; (ii) the site security plan includes the security measures required by subsection (b); (iii) (I) the security measures in the site security plan do not materially deviate from the guidance for expedited approval facilities except where indicated in the site security plan; (II) any deviations from the guidance for expedited approval facilities in the site security plan meet the risk-based performance standards for the tier to which the facility is assigned; and (III) the owner or operator has provided an explanation of how the site security plan meets the risk-based performance standards for any material deviation; (iv) the owner or operator has visited, examined, documented, and verified that the expedited approval facility meets the criteria set forth in the site security plan; (v) the expedited approval facility has implemented all of the required performance measures outlined in the site security plan or set out planned measures that will be implemented within a reasonable time period stated in the site security plan; (vi) each individual responsible for implementing the site security plan has been made aware of the requirements relevant to the individual’s responsibility contained in the site security plan and has demonstrated competency to carry out those requirements; (vii) the owner or operator has committed, or, in the case of planned measures will commit, the necessary resources to fully implement the site security plan; and (viii) the planned measures include an adequate procedure for addressing events beyond the control of the owner or operator in implementing any planned measures. (D) Deadline (i) In general Not later than 120 days after the date described in clause (ii), the owner or operator of an expedited approval facility shall submit to the Secretary the site security plan and the certification described in subparagraph (C). (ii) Date The date described in this clause is— (I) for an expedited approval facility that was assigned to tier 3 or 4 under existing CFATS regulations before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the date that is 210 days after the date of enactment of that Act; and (II) for any expedited approval facility not described in subclause (I), the later of— (aa) the date on which the expedited approval facility is assigned to tier 3 or 4 under subsection (e)(2)(A); or (bb) the date that is 210 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . (iii) Notice An owner or operator of an expedited approval facility shall notify the Secretary of the intent of the owner or operator to certify the site security plan for the expedited approval facility not later than 30 days before the date on which the owner or operator submits the site security plan and certification described in subparagraph (C). (E) Compliance (i) In general For an expedited approval facility submitting a site security plan and certification in accordance with subparagraphs (A), (B), (C), and (D)— (I) the expedited approval facility shall comply with all of the requirements of its site security plan; and (II) the Secretary— (aa) except as provided in subparagraph (G), may not disapprove the site security plan; and (bb) may audit and inspect the expedited approval facility under subsection (d) to verify compliance with its site security plan. (ii) Noncompliance If the Secretary determines an expedited approval facility is not in compliance with the requirements of the site security plan or is otherwise in violation of this title, the Secretary may enforce compliance in accordance with section 2104. (F) Amendments to site security plan (i) Requirement (I) In general If the owner or operator of an expedited approval facility amends a site security plan submitted under subparagraph (A), the owner or operator shall submit the amended site security plan and a certification relating to the amended site security plan that contains the information described in subparagraph (C). (II) Technical amendments For purposes of this clause, an amendment to a site security plan includes any technical amendment to the site security plan. (ii) Amendment required The owner or operator of an expedited approval facility shall amend the site security plan if— (I) there is a change in the design, construction, operation, or maintenance of the expedited approval facility that affects the site security plan; (II) the Secretary requires additional security measures or suspends a certification and recommends additional security measures under subparagraph (G); or (III) the owner or operator receives notice from the Secretary of a change in tiering under subsection (e)(3). (iii) Deadline An amended site security plan and certification shall be submitted under clause (i)— (I) in the case of a change in design, construction, operation, or maintenance of the expedited approval facility that affects the security plan, not later than 120 days after the date on which the change in design, construction, operation, or maintenance occurred; (II) in the case of the Secretary requiring additional security measures or suspending a certification and recommending additional security measures under subparagraph (G), not later than 120 days after the date on which the owner or operator receives notice of the requirement for additional security measures or suspension of the certification and recommendation of additional security measures; and (III) in the case of a change in tiering, not later than 120 days after the date on which the owner or operator receives notice under subsection (e)(3). (G) Facially deficient site security plans (i) Prohibition Notwithstanding subparagraph (A) or (E), the Secretary may suspend the authority of a covered chemical facility to certify a site security plan if the Secretary— (I) determines the certified site security plan or an amended site security plan is facially deficient; and (II) not later than 100 days after the date on which the Secretary receives the site security plan and certification, provides the covered chemical facility with written notification that the site security plan is facially deficient, including a clear explanation of each deficiency in the site security plan. (ii) Additional security measures (I) In general If, during or after a compliance inspection of an expedited approval facility, the Secretary determines that planned or implemented security measures in the site security plan of the facility are insufficient to meet the risk-based performance standards based on misrepresentation, omission, or an inadequate description of the site, the Secretary may— (aa) require additional security measures; or (bb) suspend the certification of the facility. (II) Recommendation of additional security measures If the Secretary suspends the certification of an expedited approval facility under subclause (I), the Secretary shall— (aa) recommend specific additional security measures that, if made part of the site security plan by the facility, would enable the Secretary to approve the site security plan; and (bb) provide the facility an opportunity to submit a new or modified site security plan and certification under subparagraph (A). (III) Submission; review If an expedited approval facility determines to submit a new or modified site security plan and certification as authorized under subclause (II)(bb)— (aa) not later than 90 days after the date on which the facility receives recommendations under subclause (II)(aa), the facility shall submit the new or modified plan and certification; and (bb) not later than 45 days after the date on which the Secretary receives the new or modified plan under item (aa), the Secretary shall review the plan and determine whether the plan is facially deficient. (IV) Determination not to include additional security measures (aa) Revocation of certification If an expedited approval facility does not agree to include in its site security plan specific additional security measures recommended by the Secretary under subclause (II)(aa), or does not submit a new or modified site security plan in accordance with subclause (III), the Secretary may revoke the certification of the facility by issuing an order under section 2104(a)(1)(B). (bb) Effect of revocation If the Secretary revokes the certification of an expedited approval facility under item (aa) by issuing an order under section 2104(a)(1)(B)— (AA) the order shall require the owner or operator of the facility to submit a site security plan or alternative security program for review by the Secretary review under subsection (c)(1); and (BB) the facility shall no longer be eligible to certify a site security plan under this paragraph. (V) Facial deficiency If the Secretary determines that a new or modified site security plan submitted by an expedited approval facility under subclause (III) is facially deficient— (aa) not later than 120 days after the date of the determination, the owner or operator of the facility shall submit a site security plan or alternative security program for review by the Secretary under subsection (c)(1); and (bb) the facility shall no longer be eligible to certify a site security plan under this paragraph. (H) Templates (i) In general The Secretary may develop prescriptive site security plan templates with specific security measures to meet the risk-based performance standards under subsection (a)(2)(C) for adoption and certification by a covered chemical facility assigned to tier 3 or 4 in lieu of developing and certifying its own plan. (ii) Applicability of other laws to development and issuance of initial site security plan templates and related guidance During the period before the Secretary has met the deadline under subparagraph (B)(i), in developing and issuing, or amending, the site security plan templates under this subparagraph, in issuing guidance for implementation of the templates, and in collecting information from expedited approval facilities, the Secretary shall not be subject to— (I) section 553 of title 5, United States Code; (II) subchapter I of chapter 35 of title 44, United States Code; or (III) section 2107(b) of this title. (iii) Rule of construction Nothing in this subparagraph shall be construed to prevent a covered chemical facility from developing and certifying its own security plan in accordance with subparagraph (A). (I) Evaluation (i) In general Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall take any appropriate action necessary for a full evaluation of the expedited approval program authorized under this paragraph, including conducting an appropriate number of inspections, as authorized under subsection (d), of expedited approval facilities. (ii) Report Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report that contains— (I) (aa) the number of eligible facilities using the expedited approval program authorized under this paragraph; and (bb) the number of facilities that are eligible for the expedited approval program but are using the standard process for developing and submitting a site security plan under subsection (a)(2)(D); (II) any costs and efficiencies associated with the expedited approval program; (III) the impact of the expedited approval program on the backlog for site security plan approval and authorization inspections; (IV) an assessment of the ability of expedited approval facilities to submit facially sufficient site security plans; (V) an assessment of any impact of the expedited approval program on the security of chemical facilities; and (VI) a recommendation by the Secretary on the frequency of compliance inspections that may be required for expedited approval facilities. (d) Compliance (1) Audits and inspections (A) Definitions In this paragraph— (i) the term nondepartmental — (I) with respect to personnel, means personnel that is not employed by the Department; and (II) with respect to an entity, means an entity that is not a component or other authority of the Department; and (ii) the term nongovernmental — (I) with respect to personnel, means personnel that is not employed by the Federal Government; and (II) with respect to an entity, means an entity that is not an agency, department, or other authority of the Federal Government. (B) Authority to conduct audits and inspections The Secretary shall conduct audits or inspections under this title using— (i) employees of the Department; (ii) nondepartmental or nongovernmental personnel approved by the Secretary; or (iii) a combination of individuals described in clauses (i) and (ii). (C) Support personnel The Secretary may use nongovernmental personnel to provide administrative and logistical services in support of audits and inspections under this title. (D) Reporting structure (i) Nondepartmental and nongovernmental audits and inspections Any audit or inspection conducted by an individual employed by a nondepartmental or nongovernmental entity shall be assigned in coordination with a regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the audit or inspection is to be conducted. (ii) Requirement to report While an individual employed by a nondepartmental or nongovernmental entity is in the field conducting an audit or inspection under this subsection, the individual shall report to the regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the individual is operating. (iii) Approval The authority to approve a site security plan under subsection (c) or determine if a covered chemical facility is in compliance with an approved site security plan shall be exercised solely by the Secretary or a designee of the Secretary within the Department. (E) Standards for auditors and inspectors The Secretary shall prescribe standards for the training and retraining of each individual used by the Department as an auditor or inspector, including each individual employed by the Department and all nondepartmental or nongovernmental personnel, including— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the proper certification or certifications necessary to handle chemical-terrorism vulnerability information (as defined in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto); (vi) the reporting of any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may require. (F) Conditions for nongovernmental auditors and inspectors If the Secretary arranges for an audit or inspection under subparagraph (B) to be carried out by a nongovernmental entity, the Secretary shall— (i) prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for similar Government auditors or inspectors; and (ii) ensure that any duties carried out by a nongovernmental entity are not inherently governmental functions. (2) Personnel surety (A) Personnel Surety Program For purposes of this title, the Secretary shall establish and carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates in the program to submit information about an individual more than 1 time; (ii) provides a participating owner or operator of a covered chemical facility with relevant information about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility to be in compliance with regulations promulgated under this title; and (iii) provides redress to an individual— (I) whose information was vetted against the terrorist screening database under the program; and (II) who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel Surety Program implementation To the extent that a risk-based performance standard established under subsection (a) requires identifying individuals with ties to terrorism— (i) a covered chemical facility— (I) may satisfy its obligation under the standard by using any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor program, including the Personnel Surety Program established under subparagraph (A); and (II) shall— (aa) accept a credential from a Federal screening program described in subclause (I) if an individual who is required to be screened presents such a credential; and (bb) address in its site security plan or alternative security program the measures it will take to verify that a credential or documentation from a Federal screening program described in subclause (I) is current; (ii) visual inspection shall be sufficient to meet the requirement under clause (i)(II)(bb), but the facility should consider other means of verification, consistent with the facility’s assessment of the threat posed by acceptance of such credentials; and (iii) the Secretary may not require a covered chemical facility to submit any information about an individual unless the individual— (I) is to be vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Rights unaffected Nothing in this section shall supersede the ability— (i) of a facility to maintain its own policies regarding the access of individuals to restricted areas or critical assets; or (ii) of an employing facility and a bargaining agent, where applicable, to negotiate as to how the results of a background check may be used by the facility with respect to employment status. (3) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility any information that the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of chemical facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, relevant business associations, and public and private labor organizations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a covered chemical facility shall take into account— (i) relevant threat information; (ii) potential severe economic consequences and the potential loss of human life in the event of the facility being subject to attack, compromise, infiltration, or exploitation by terrorists; and (iii) vulnerability of the facility to attack, compromise, infiltration, or exploitation by terrorists. (3) Changes in tiering (A) Maintenance of records The Secretary shall document the basis for each instance in which— (i) tiering for a covered chemical facility is changed; or (ii) a covered chemical facility is determined to no longer be subject to the requirements under this title. (B) Required information The records maintained under subparagraph (A) shall include information on whether and how the Secretary confirmed the information that was the basis for the change or determination described in subparagraph (A). (4) Semiannual performance reporting Not later than 6 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , and not less frequently than once every 6 months thereafter, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report that includes, for the period covered by the report— (A) the number of covered chemical facilities in the United States; (B) information— (i) describing— (I) the number of instances in which the Secretary— (aa) placed a covered chemical facility in a lower risk tier; or (bb) determined that a facility that had previously met the criteria for a covered chemical facility under section 2101(3) no longer met the criteria; and (II) the basis, in summary form, for each action or determination under subclause (I); and (ii) that is provided in a sufficiently anonymized form to ensure that the information does not identify any specific facility or company as the source of the information when viewed alone or in combination with other public information; (C) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval; (D) the number of covered chemical facilities inspected; (E) the average number of covered chemical facilities inspected per inspector; and (F) any other information that the Secretary determines will be helpful to Congress in evaluating the performance of the Chemical Facility Anti-Terrorism Standards Program. 2103. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed under this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with the protection of similar information under section 70103(d) of title 46, United States Code. (b) Sharing of information with States and local governments Nothing in this section shall be construed to prohibit the sharing of information developed under this title, as the Secretary determines appropriate, with State and local government officials possessing a need to know and the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, provided that such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders (1) Requirement The Secretary shall provide to State, local, and regional fusion centers (as that term is defined in section 210A(j)(1)) and State and local government officials, as the Secretary determines appropriate, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to security incidents at covered chemical facilities. (2) Dissemination The Secretary shall disseminate information under paragraph (1) through a medium or system determined by the Secretary to be appropriate to ensure the secure and expeditious dissemination of such information to necessary selected individuals. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this title, and related vulnerability or security information, shall be treated as if the information were classified information. (e) Availability of information Notwithstanding any other provision of law (including section 552(b)(3) of title 5, United States Code), section 552 of title 5, United States Code (commonly known as the Freedom of Information Act ) shall not apply to information protected from public disclosure pursuant to subsection (a) of this section. (f) Sharing of information with Members of Congress Nothing in this section shall prohibit the Secretary from disclosing information developed under this title to a Member of Congress in response to a request by a Member of Congress. 2104. Civil enforcement (a) Notice of noncompliance (1) Notice If the Secretary determines that a covered chemical facility is not in compliance with this title, the Secretary shall— (A) provide the owner or operator of the facility with— (i) not later than 14 days after date on which the Secretary makes the determination, a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan; and (ii) an opportunity for consultation with the Secretary or the Secretary’s designee; and (B) issue to the owner or operator of the facility an order to comply with this title by a date specified by the Secretary in the order, which date shall be not later than 180 days after the date on which the Secretary issues the order. (2) Continued noncompliance If an owner or operator remains noncompliant after the procedures outlined in paragraph (1) have been executed, or demonstrates repeated violations of this title, the Secretary may enter an order in accordance with this section assessing a civil penalty, an order to cease operations, or both. (b) Civil penalties (1) Violations of orders Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (2) Non-reporting chemical facilities of interest Any owner of a chemical facility of interest who fails to comply with, or knowingly submits false information under, this title or the CFATS regulations shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (c) Emergency orders (1) In general Notwithstanding subsection (a) or any site security plan or alternative security program approved under this title, if the Secretary determines that there is an imminent threat of death, serious illness, or severe personal injury, due to a violation of this title or the risk of a terrorist incident that may affect a chemical facility of interest, the Secretary— (A) shall consult with the facility, if practicable, on steps to mitigate the risk; and (B) may order the facility, without notice or opportunity for a hearing, effective immediately or as soon as practicable, to— (i) implement appropriate emergency security measures; or (ii) cease or reduce some or all operations, in accordance with safe shutdown procedures, if the Secretary determines that such a cessation or reduction of operations is the most appropriate means to address the risk. (2) Limitation on delegation The Secretary may not delegate the authority under paragraph (1) to any official other than the Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department appointed under section 103(a)(1)(H). (3) Limitation on authority The Secretary may exercise the authority under this subsection only to the extent necessary to abate the imminent threat determination under paragraph (1). (4) Due process for facility owner or operator (A) Written orders An order issued by the Secretary under paragraph (1) shall be in the form of a written emergency order that— (i) describes the violation or risk that creates the imminent threat; (ii) states the security measures or order issued or imposed; and (iii) describes the standards and procedures for obtaining relief from the order. (B) Opportunity for review After issuing an order under paragraph (1) with respect to a chemical facility of interest, the Secretary shall provide for review of the order under section 554 of title 5 if a petition for review is filed not later than 20 days after the date on which the Secretary issues the order. (C) Expiration of effectiveness of order If a petition for review of an order is filed under subparagraph (B) and the review under that paragraph is not completed by the last day of the 30-day period beginning on the date on which the petition is filed, the order shall vacate automatically at the end of that period unless the Secretary determines, in writing, that the imminent threat providing a basis for the order continues to exist. (d) Right of action Nothing in this title confers upon any person except the Secretary or his or her designee a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2105. Whistleblower protections (a) Procedure for reporting problems (1) Establishment of a reporting procedure Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall establish, and provide information to the public regarding, a procedure under which any employee or contractor of a chemical facility of interest may submit a report to the Secretary regarding a violation of a requirement under this title. (2) Confidentiality The Secretary shall keep confidential the identity of an individual who submits a report under paragraph (1) and any such report shall be treated as a record containing protected information to the extent that the report does not consist of publicly available information. (3) Acknowledgment of receipt If a report submitted under paragraph (1) identifies the individual making the report, the Secretary shall promptly respond to the individual directly and shall promptly acknowledge receipt of the report. (4) Steps to address problems The Secretary— (A) shall review and consider the information provided in any report submitted under paragraph (1); and (B) may take action under section 2104 of this title if necessary to address any substantiated violation of a requirement under this title identified in the report. (5) Due process for facility owner or operator (A) In general If, upon the review described in paragraph (4), the Secretary determines that a violation of a provision of this title, or a regulation prescribed under this title, has occurred, the Secretary may— (i) institute a civil enforcement under section 2104(a) of this title; or (ii) if the Secretary makes the determination under section 2104(c), issue an emergency order. (B) Written orders The action of the Secretary under paragraph (4) shall be in a written form that— (i) describes the violation; (ii) states the authority under which the Secretary is proceeding; and (iii) describes the standards and procedures for obtaining relief from the order. (C) Opportunity for review After taking action under paragraph (4), the Secretary shall provide for review of the action if a petition for review is filed within 20 calendar days of the date of issuance of the order for the action. (D) Expiration of effectiveness of order If a petition for review of an action is filed under subparagraph (C) and the review under that subparagraph is not completed by the end of the 30-day period beginning on the date the petition is filed, the action shall cease to be effective at the end of such period unless the Secretary determines, in writing, that the violation providing a basis for the action continues to exist. (6) Retaliation prohibited (A) In general An owner or operator of a chemical facility of interest or agent thereof may not discharge an employee or otherwise discriminate against an employee with respect to the compensation provided to, or terms, conditions, or privileges of the employment of, the employee because the employee (or an individual acting pursuant to a request of the employee) submitted a report under paragraph (1). (B) Exception An employee shall not be entitled to the protections under this section if the employee— (i) knowingly and willfully makes any false, fictitious, or fraudulent statement or representation; or (ii) uses any false writing or document knowing the writing or document contains any false, fictitious, or fraudulent statement or entry. (b) Protected disclosures Nothing in this title shall be construed to limit the right of an individual to make any disclosure— (1) protected or authorized under section 2302(b)(8) or 7211 of title 5, United States Code; (2) protected under any other Federal or State law that shields the disclosing individual against retaliation or discrimination for having made the disclosure in the public interest; or (3) to the Special Counsel of an agency, the inspector general of an agency, or any other employee designated by the head of an agency to receive disclosures similar to the disclosures described in paragraphs (1) and (2). (c) Publication of rights The Secretary, in partnership with industry associations and labor organizations, shall make publicly available both physically and online the rights that an individual who discloses information, including security-sensitive information, regarding problems, deficiencies, or vulnerabilities at a covered chemical facility would have under Federal whistleblower protection laws or this title. (d) Protected information All information contained in a report made under this subsection (a) shall be protected in accordance with section 2103. 2106. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that— (1) regulates (including by requiring information to be submitted or made available) the manufacture, distribution in commerce, use, handling, sale, other treatment, or disposal of chemical substances or mixtures; or (2) authorizes or requires the disclosure of any record or information obtained from a chemical facility under any law other than this title. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. 2107. CFATS regulations (a) General authority The Secretary may, in accordance with chapter 5 of title 5, United States Code, promulgate regulations or amend existing CFATS regulations to implement the provisions under this title. (b) Existing CFATS regulations (1) In general Notwithstanding section 4(b) of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals the regulation. (2) Repeal Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title. (c) Authority The Secretary shall exclusively rely upon authority provided under this title in— (1) determining compliance with this title; (2) identifying chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) Definition In this section, the term small covered chemical facility means a covered chemical facility that— (1) has fewer than 100 employees employed at the covered chemical facility; and (2) is owned and operated by a small business concern (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )). (b) Assistance to facilities The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing the physical security, cybersecurity, recordkeeping, and reporting procedures required under this title. (c) Report The Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report on best practices that may assist small covered chemical facilities in development of physical security best practices. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies, relevant business associations, and public and private labor organizations, to— (1) identify chemical facilities of interest; and (2) make available compliance assistance materials and information on education and training. . (b) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( Public Law 107–196 ; 116 Stat. 2135) is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Definitions. Sec. 2102. Chemical Facility Anti-Terrorism Standards Program. Sec. 2103. Protection and sharing of information.– Sec. 2104. Civil enforcement. Sec. 2105. Whistleblower protections. Sec. 2106. Relationship to other laws. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. . 3. Assessment; reports (a) Definitions In this section— (1) the term Chemical Facility Anti-Terrorism Standards Program means— (A) the Chemical Facility Anti-Terrorism Standards program initially authorized under section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 6 U.S.C. 121 note); and (B) the Chemical Facility Anti-Terrorism Standards Program subsequently authorized under section 2102(a) of the Homeland Security Act of 2002, as added by section 2; (2) the term Department means the Department of Homeland Security; and (3) the term Secretary means the Secretary of Homeland Security. (b) Third-party assessment Using amounts appropriated to the Department before the date of enactment of this Act, the Secretary shall commission a third-party study to assess vulnerabilities of covered chemical facilities, as defined in section 2101 of the Homeland Security Act of 2002 (as added by section 2), to acts of terrorism. (c) Reports (1) Report to Congress Not later than 18 months after the date of enactment of this Act, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report on the Chemical Facility Anti-Terrorism Standards Program that includes— (A) a certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest under section 2102(e)(1) of the Homeland Security Act of 2002, as added by section 2, including— (i) a description of the steps taken to achieve that progress and the metrics used to measure the progress; (ii) information on whether facilities that submitted Top-Screens as a result of the identification of chemical facilities of interest were tiered and in what tiers those facilities were placed; and (iii) an action plan to better identify chemical facilities of interest and bring those facilities into compliance with title XXI of the Homeland Security Act of 2002, as added by section 2; (B) a certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology under section 2102(e)(2) of the Homeland Security Act of 2002, as added by section 2; (C) an assessment by the Secretary of the implementation by the Department of the recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02); and (D) a description of best practices that may assist small covered chemical facilities, as defined in section 2108(a) of the Homeland Security Act of 2002, as added by section 2, in the development of physical security best practices. (2) Annual GAO report (A) In general During the 3-year period beginning on the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress an annual report that assesses the implementation of this Act and the amendments made by this Act. (B) Initial report Not later than 180 days after the date of enactment of this Act, the Comptroller General shall submit to Congress the first report under subparagraph (A). (C) Second annual report Not later than 1 year after the date of the initial report required under subparagraph (B), the Comptroller General shall submit to Congress the second report under subparagraph (A), which shall include an assessment of the whistleblower protections provided under section 2105 of the Homeland Security Act of 2002, as added by section 2, and— (i) describes the number and type of problems, deficiencies, and vulnerabilities with respect to which reports have been submitted under such section 2105; (ii) evaluates the efforts of the Secretary in addressing the problems, deficiencies, and vulnerabilities described in subsection (a)(1) of such section 2105; and (iii) evaluates the efforts of the Secretary to inform individuals of their rights, as required under subsection (c) of such section 2105. (D) Third annual report Not later than 1 year after the date on which the Comptroller General submits the second report required under subparagraph (A), the Comptroller General shall submit to Congress the third report under subparagraph (A), which shall include an assessment of— (i) the expedited approval program authorized under section 2102(c)(4) of the Homeland Security Act of 2002, as added by section 2; and (ii) the report on the expedited approval program submitted by the Secretary under subparagraph (I)(ii) of such section 2102(c)(4). 4. Effective date; conforming repeal (a) Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of enactment of this Act. (b) Conforming repeal Section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388), is repealed as of the effective date of this Act. 5. Termination The authority provided under title XXI of the Homeland Security Act of 2002, as added by section 2(a), shall terminate on the date that is 4 years after the effective date of this Act.

Speaker of the House of Representatives. Vice President of the United States and President of the Senate.

tv_txt: 113th CONGRESS 2d Session H.R. 4007 In the Senate of the United States, December 10, 2014. Amendment:

That the bill from the House of Representatives (H.R. 4007) entitled An Act to recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program. , do pass with the following In lieu of the matter proposed to be inserted, insert the following: 1. Short title This Act may be cited as the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . 2. Chemical Facility Anti-Terrorism Standards Program (a) In general The Homeland Security Act of 2002 ( 6 U.S.C. 101 et seq. ) is amended by adding at the end the following: XXI Chemical facility anti–terrorism standards 2101. Definitions In this title— (1) the term CFATS regulation means— (A) an existing CFATS regulation; and (B) any regulation or amendment to an existing CFATS regulation issued pursuant to the authority under section 2107; (2) the term chemical facility of interest means a facility that— (A) holds, or that the Secretary has a reasonable basis to believe holds, a chemical of interest, as designated under Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto, at a threshold quantity set pursuant to relevant risk-related security principles; and (B) is not an excluded facility; (3) the term covered chemical facility means a facility that— (A) the Secretary— (i) identifies as a chemical facility of interest; and (ii) based upon review of the facility's Top-Screen, determines meets the risk criteria developed under section 2102(e)(2)(B); and (B) is not an excluded facility; (4) the term excluded facility means— (A) a facility regulated under the Maritime Transportation Security Act of 2002 ( Public Law 107–295 ; 116 Stat. 2064); (B) a public water system, as that term is defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f); (C) a Treatment Works, as that term is defined in section 212 of the Federal Water Pollution Control Act ( 33 U.S.C. 1292 ); (D) a facility owned or operated by the Department of Defense or the Department of Energy; or (E) a facility subject to regulation by the Nuclear Regulatory Commission, or by a State that has entered into an agreement with the Nuclear Regulatory Commission under section 274 b. of the Atomic Energy Act of 1954 ( 42 U.S.C. 2021(b) ) to protect against unauthorized access of any material, activity, or structure licensed by the Nuclear Regulatory Commission; (5) the term existing CFATS regulation means— (A) a regulation promulgated under section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 6 U.S.C. 121 note) that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; and (B) a Federal Register notice or other published guidance relating to section 550 of the Department of Homeland Security Appropriations Act, 2007 that is in effect on the day before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ; (6) the term expedited approval facility means a covered chemical facility for which the owner or operator elects to submit a site security plan in accordance with section 2102(c)(4); (7) the term facially deficient , relating to a site security plan, means a site security plan that does not support a certification that the security measures in the plan address the security vulnerability assessment and the risk-based performance standards for security for the facility, based on a review of— (A) the facility's site security plan; (B) the facility's Top-Screen; (C) the facility's security vulnerability assessment; or (D) any other information that— (i) the facility submits to the Department; or (ii) the Department obtains from a public source or other source; (8) the term guidance for expedited approval facilities means the guidance issued under section 2102(c)(4)(B)(i); (9) the term risk assessment means the Secretary’s application of relevant risk criteria identified in section 2102(e)(2)(B); (10) the term terrorist screening database means the terrorist screening database maintained by the Federal Government Terrorist Screening Center or its successor; (11) the term tier has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; (12) the terms tiering and tiering methodology mean the procedure by which the Secretary assigns a tier to each covered chemical facility based on the risk assessment for that covered chemical facility; (13) the term Top-Screen has the meaning given the term in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto; and (14) the term vulnerability assessment means the identification of weaknesses in the security of a chemical facility of interest. 2102. Chemical facility anti-terrorism standards program (a) Program established (1) In general There is in the Department a Chemical Facility Anti-Terrorism Standards Program. (2) Requirements In carrying out the Chemical Facility Anti-Terrorism Standards Program, the Secretary shall— (A) identify— (i) chemical facilities of interest; and (ii) covered chemical facilities; (B) require each chemical facility of interest to submit a Top-Screen and any other information the Secretary determines necessary to enable the Department to assess the security risks associated with the facility; (C) establish risk-based performance standards designed to address high levels of security risk at covered chemical facilities; and (D) require each covered chemical facility to— (i) submit a security vulnerability assessment; and (ii) develop, submit, and implement a site security plan. (b) Security measures (1) In general A facility, in developing a site security plan as required under subsection (a), shall include security measures that, in combination, appropriately address the security vulnerability assessment and the risk-based performance standards for security for the facility. (2) Employee input To the greatest extent practicable, a facility’s security vulnerability assessment and site security plan shall include input from at least 1 facility employee and, where applicable, 1 employee representative from the bargaining agent at that facility, each of whom possesses, in the determination of the facility’s security officer, relevant knowledge, experience, training, or education as pertains to matters of site security. (c) Approval or disapproval of site security plans (1) In general (A) Review Except as provided in paragraph (4), the Secretary shall review and approve or disapprove each site security plan submitted pursuant to subsection (a). (B) Bases for disapproval The Secretary— (i) may not disapprove a site security plan based on the presence or absence of a particular security measure; and (ii) shall disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established pursuant to subsection (a)(2)(C). (2) Alternative security programs (A) Authority to approve (i) In general The Secretary may approve an alternative security program established by a private sector entity or a Federal, State, or local authority or under other applicable laws, if the Secretary determines that the requirements of the program meet the requirements under this section. (ii) Additional security measures If the requirements of an alternative security program do not meet the requirements under this section, the Secretary may recommend additional security measures to the program that will enable the Secretary to approve the program. (B) Satisfaction of site security plan requirement A covered chemical facility may satisfy the site security plan requirement under subsection (a) by adopting an alternative security program that the Secretary has— (i) reviewed and approved under subparagraph (A); and (ii) determined to be appropriate for the operations and security concerns of the covered chemical facility. (3) Site security plan assessments (A) Risk assessment policies and procedures In approving or disapproving a site security plan under this subsection, the Secretary shall employ the risk assessment policies and procedures developed under this title. (B) Previously approved plans In the case of a covered chemical facility for which the Secretary approved a site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary may not require the facility to resubmit the site security plan solely by reason of the enactment of this title. (4) Expedited approval program (A) In general A covered chemical facility assigned to tier 3 or 4 may meet the requirement to develop and submit a site security plan under subsection (a)(2)(D) by developing and submitting to the Secretary— (i) a site security plan and the certification described in subparagraph (C); or (ii) a site security plan in conformance with a template authorized under subparagraph (H). (B) Guidance for expedited approval facilities (i) In general Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards. (ii) Material deviation from guidance If a security measure in the site security plan of an expedited approval facility materially deviates from a security measure in the guidance for expedited approval facilities, the site security plan shall include an explanation of how such security measure meets the risk-based performance standards. (iii) Applicability of other laws to development and issuance of initial guidance During the period before the Secretary has met the deadline under clause (i), in developing and issuing, or amending, the guidance for expedited approval facilities under this subparagraph and in collecting information from expedited approval facilities, the Secretary shall not be subject to— (I) section 553 of title 5, United States Code; (II) subchapter I of chapter 35 of title 44, United States Code; or (III) section 2107(b) of this title. (C) Certification The owner or operator of an expedited approval facility shall submit to the Secretary a certification, signed under penalty of perjury, that— (i) the owner or operator is familiar with the requirements of this title and part 27 of title 6, Code of Federal Regulations, or any successor thereto, and the site security plan being submitted; (ii) the site security plan includes the security measures required by subsection (b); (iii) (I) the security measures in the site security plan do not materially deviate from the guidance for expedited approval facilities except where indicated in the site security plan; (II) any deviations from the guidance for expedited approval facilities in the site security plan meet the risk-based performance standards for the tier to which the facility is assigned; and (III) the owner or operator has provided an explanation of how the site security plan meets the risk-based performance standards for any material deviation; (iv) the owner or operator has visited, examined, documented, and verified that the expedited approval facility meets the criteria set forth in the site security plan; (v) the expedited approval facility has implemented all of the required performance measures outlined in the site security plan or set out planned measures that will be implemented within a reasonable time period stated in the site security plan; (vi) each individual responsible for implementing the site security plan has been made aware of the requirements relevant to the individual’s responsibility contained in the site security plan and has demonstrated competency to carry out those requirements; (vii) the owner or operator has committed, or, in the case of planned measures will commit, the necessary resources to fully implement the site security plan; and (viii) the planned measures include an adequate procedure for addressing events beyond the control of the owner or operator in implementing any planned measures. (D) Deadline (i) In general Not later than 120 days after the date described in clause (ii), the owner or operator of an expedited approval facility shall submit to the Secretary the site security plan and the certification described in subparagraph (C). (ii) Date The date described in this clause is— (I) for an expedited approval facility that was assigned to tier 3 or 4 under existing CFATS regulations before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the date that is 210 days after the date of enactment of that Act; and (II) for any expedited approval facility not described in subclause (I), the later of— (aa) the date on which the expedited approval facility is assigned to tier 3 or 4 under subsection (e)(2)(A); or (bb) the date that is 210 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 . (iii) Notice An owner or operator of an expedited approval facility shall notify the Secretary of the intent of the owner or operator to certify the site security plan for the expedited approval facility not later than 30 days before the date on which the owner or operator submits the site security plan and certification described in subparagraph (C). (E) Compliance (i) In general For an expedited approval facility submitting a site security plan and certification in accordance with subparagraphs (A), (B), (C), and (D)— (I) the expedited approval facility shall comply with all of the requirements of its site security plan; and (II) the Secretary— (aa) except as provided in subparagraph (G), may not disapprove the site security plan; and (bb) may audit and inspect the expedited approval facility under subsection (d) to verify compliance with its site security plan. (ii) Noncompliance If the Secretary determines an expedited approval facility is not in compliance with the requirements of the site security plan or is otherwise in violation of this title, the Secretary may enforce compliance in accordance with section 2104. (F) Amendments to site security plan (i) Requirement (I) In general If the owner or operator of an expedited approval facility amends a site security plan submitted under subparagraph (A), the owner or operator shall submit the amended site security plan and a certification relating to the amended site security plan that contains the information described in subparagraph (C). (II) Technical amendments For purposes of this clause, an amendment to a site security plan includes any technical amendment to the site security plan. (ii) Amendment required The owner or operator of an expedited approval facility shall amend the site security plan if— (I) there is a change in the design, construction, operation, or maintenance of the expedited approval facility that affects the site security plan; (II) the Secretary requires additional security measures or suspends a certification and recommends additional security measures under subparagraph (G); or (III) the owner or operator receives notice from the Secretary of a change in tiering under subsection (e)(3). (iii) Deadline An amended site security plan and certification shall be submitted under clause (i)— (I) in the case of a change in design, construction, operation, or maintenance of the expedited approval facility that affects the security plan, not later than 120 days after the date on which the change in design, construction, operation, or maintenance occurred; (II) in the case of the Secretary requiring additional security measures or suspending a certification and recommending additional security measures under subparagraph (G), not later than 120 days after the date on which the owner or operator receives notice of the requirement for additional security measures or suspension of the certification and recommendation of additional security measures; and (III) in the case of a change in tiering, not later than 120 days after the date on which the owner or operator receives notice under subsection (e)(3). (G) Facially deficient site security plans (i) Prohibition Notwithstanding subparagraph (A) or (E), the Secretary may suspend the authority of a covered chemical facility to certify a site security plan if the Secretary— (I) determines the certified site security plan or an amended site security plan is facially deficient; and (II) not later than 100 days after the date on which the Secretary receives the site security plan and certification, provides the covered chemical facility with written notification that the site security plan is facially deficient, including a clear explanation of each deficiency in the site security plan. (ii) Additional security measures (I) In general If, during or after a compliance inspection of an expedited approval facility, the Secretary determines that planned or implemented security measures in the site security plan of the facility are insufficient to meet the risk-based performance standards based on misrepresentation, omission, or an inadequate description of the site, the Secretary may— (aa) require additional security measures; or (bb) suspend the certification of the facility. (II) Recommendation of additional security measures If the Secretary suspends the certification of an expedited approval facility under subclause (I), the Secretary shall— (aa) recommend specific additional security measures that, if made part of the site security plan by the facility, would enable the Secretary to approve the site security plan; and (bb) provide the facility an opportunity to submit a new or modified site security plan and certification under subparagraph (A). (III) Submission; review If an expedited approval facility determines to submit a new or modified site security plan and certification as authorized under subclause (II)(bb)— (aa) not later than 90 days after the date on which the facility receives recommendations under subclause (II)(aa), the facility shall submit the new or modified plan and certification; and (bb) not later than 45 days after the date on which the Secretary receives the new or modified plan under item (aa), the Secretary shall review the plan and determine whether the plan is facially deficient. (IV) Determination not to include additional security measures (aa) Revocation of certification If an expedited approval facility does not agree to include in its site security plan specific additional security measures recommended by the Secretary under subclause (II)(aa), or does not submit a new or modified site security plan in accordance with subclause (III), the Secretary may revoke the certification of the facility by issuing an order under section 2104(a)(1)(B). (bb) Effect of revocation If the Secretary revokes the certification of an expedited approval facility under item (aa) by issuing an order under section 2104(a)(1)(B)— (AA) the order shall require the owner or operator of the facility to submit a site security plan or alternative security program for review by the Secretary review under subsection (c)(1); and (BB) the facility shall no longer be eligible to certify a site security plan under this paragraph. (V) Facial deficiency If the Secretary determines that a new or modified site security plan submitted by an expedited approval facility under subclause (III) is facially deficient— (aa) not later than 120 days after the date of the determination, the owner or operator of the facility shall submit a site security plan or alternative security program for review by the Secretary under subsection (c)(1); and (bb) the facility shall no longer be eligible to certify a site security plan under this paragraph. (H) Templates (i) In general The Secretary may develop prescriptive site security plan templates with specific security measures to meet the risk-based performance standards under subsection (a)(2)(C) for adoption and certification by a covered chemical facility assigned to tier 3 or 4 in lieu of developing and certifying its own plan. (ii) Applicability of other laws to development and issuance of initial site security plan templates and related guidance During the period before the Secretary has met the deadline under subparagraph (B)(i), in developing and issuing, or amending, the site security plan templates under this subparagraph, in issuing guidance for implementation of the templates, and in collecting information from expedited approval facilities, the Secretary shall not be subject to— (I) section 553 of title 5, United States Code; (II) subchapter I of chapter 35 of title 44, United States Code; or (III) section 2107(b) of this title. (iii) Rule of construction Nothing in this subparagraph shall be construed to prevent a covered chemical facility from developing and certifying its own security plan in accordance with subparagraph (A). (I) Evaluation (i) In general Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall take any appropriate action necessary for a full evaluation of the expedited approval program authorized under this paragraph, including conducting an appropriate number of inspections, as authorized under subsection (d), of expedited approval facilities. (ii) Report Not later than 18 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report that contains— (I) (aa) the number of eligible facilities using the expedited approval program authorized under this paragraph; and (bb) the number of facilities that are eligible for the expedited approval program but are using the standard process for developing and submitting a site security plan under subsection (a)(2)(D); (II) any costs and efficiencies associated with the expedited approval program; (III) the impact of the expedited approval program on the backlog for site security plan approval and authorization inspections; (IV) an assessment of the ability of expedited approval facilities to submit facially sufficient site security plans; (V) an assessment of any impact of the expedited approval program on the security of chemical facilities; and (VI) a recommendation by the Secretary on the frequency of compliance inspections that may be required for expedited approval facilities. (d) Compliance (1) Audits and inspections (A) Definitions In this paragraph— (i) the term nondepartmental — (I) with respect to personnel, means personnel that is not employed by the Department; and (II) with respect to an entity, means an entity that is not a component or other authority of the Department; and (ii) the term nongovernmental — (I) with respect to personnel, means personnel that is not employed by the Federal Government; and (II) with respect to an entity, means an entity that is not an agency, department, or other authority of the Federal Government. (B) Authority to conduct audits and inspections The Secretary shall conduct audits or inspections under this title using— (i) employees of the Department; (ii) nondepartmental or nongovernmental personnel approved by the Secretary; or (iii) a combination of individuals described in clauses (i) and (ii). (C) Support personnel The Secretary may use nongovernmental personnel to provide administrative and logistical services in support of audits and inspections under this title. (D) Reporting structure (i) Nondepartmental and nongovernmental audits and inspections Any audit or inspection conducted by an individual employed by a nondepartmental or nongovernmental entity shall be assigned in coordination with a regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the audit or inspection is to be conducted. (ii) Requirement to report While an individual employed by a nondepartmental or nongovernmental entity is in the field conducting an audit or inspection under this subsection, the individual shall report to the regional supervisor with responsibility for supervising inspectors within the Infrastructure Security Compliance Division of the Department for the region in which the individual is operating. (iii) Approval The authority to approve a site security plan under subsection (c) or determine if a covered chemical facility is in compliance with an approved site security plan shall be exercised solely by the Secretary or a designee of the Secretary within the Department. (E) Standards for auditors and inspectors The Secretary shall prescribe standards for the training and retraining of each individual used by the Department as an auditor or inspector, including each individual employed by the Department and all nondepartmental or nongovernmental personnel, including— (i) minimum training requirements for new auditors and inspectors; (ii) retraining requirements; (iii) minimum education and experience levels; (iv) the submission of information as required by the Secretary to enable determination of whether the auditor or inspector has a conflict of interest; (v) the proper certification or certifications necessary to handle chemical-terrorism vulnerability information (as defined in section 27.105 of title 6, Code of Federal Regulations, or any successor thereto); (vi) the reporting of any issue of non-compliance with this section to the Secretary within 24 hours; and (vii) any additional qualifications for fitness of duty as the Secretary may require. (F) Conditions for nongovernmental auditors and inspectors If the Secretary arranges for an audit or inspection under subparagraph (B) to be carried out by a nongovernmental entity, the Secretary shall— (i) prescribe standards for the qualification of the individuals who carry out such audits and inspections that are commensurate with the standards for similar Government auditors or inspectors; and (ii) ensure that any duties carried out by a nongovernmental entity are not inherently governmental functions. (2) Personnel surety (A) Personnel Surety Program For purposes of this title, the Secretary shall establish and carry out a Personnel Surety Program that— (i) does not require an owner or operator of a covered chemical facility that voluntarily participates in the program to submit information about an individual more than 1 time; (ii) provides a participating owner or operator of a covered chemical facility with relevant information about an individual based on vetting the individual against the terrorist screening database, to the extent that such feedback is necessary for the facility to be in compliance with regulations promulgated under this title; and (iii) provides redress to an individual— (I) whose information was vetted against the terrorist screening database under the program; and (II) who believes that the personally identifiable information submitted to the Department for such vetting by a covered chemical facility, or its designated representative, was inaccurate. (B) Personnel Surety Program implementation To the extent that a risk-based performance standard established under subsection (a) requires identifying individuals with ties to terrorism— (i) a covered chemical facility— (I) may satisfy its obligation under the standard by using any Federal screening program that periodically vets individuals against the terrorist screening database, or any successor program, including the Personnel Surety Program established under subparagraph (A); and (II) shall— (aa) accept a credential from a Federal screening program described in subclause (I) if an individual who is required to be screened presents such a credential; and (bb) address in its site security plan or alternative security program the measures it will take to verify that a credential or documentation from a Federal screening program described in subclause (I) is current; (ii) visual inspection shall be sufficient to meet the requirement under clause (i)(II)(bb), but the facility should consider other means of verification, consistent with the facility’s assessment of the threat posed by acceptance of such credentials; and (iii) the Secretary may not require a covered chemical facility to submit any information about an individual unless the individual— (I) is to be vetted under the Personnel Surety Program; or (II) has been identified as presenting a terrorism security risk. (C) Rights unaffected Nothing in this section shall supersede the ability— (i) of a facility to maintain its own policies regarding the access of individuals to restricted areas or critical assets; or (ii) of an employing facility and a bargaining agent, where applicable, to negotiate as to how the results of a background check may be used by the facility with respect to employment status. (3) Availability of information The Secretary shall share with the owner or operator of a covered chemical facility any information that the owner or operator needs to comply with this section. (e) Responsibilities of the Secretary (1) Identification of chemical facilities of interest In carrying out this title, the Secretary shall consult with the heads of other Federal agencies, States and political subdivisions thereof, relevant business associations, and public and private labor organizations to identify all chemical facilities of interest. (2) Risk assessment (A) In general For purposes of this title, the Secretary shall develop a security risk assessment approach and corresponding tiering methodology for covered chemical facilities that incorporates the relevant elements of risk, including threat, vulnerability, and consequence. (B) Criteria for determining security risk The criteria for determining the security risk of terrorism associated with a covered chemical facility shall take into account— (i) relevant threat information; (ii) potential severe economic consequences and the potential loss of human life in the event of the facility being subject to attack, compromise, infiltration, or exploitation by terrorists; and (iii) vulnerability of the facility to attack, compromise, infiltration, or exploitation by terrorists. (3) Changes in tiering (A) Maintenance of records The Secretary shall document the basis for each instance in which— (i) tiering for a covered chemical facility is changed; or (ii) a covered chemical facility is determined to no longer be subject to the requirements under this title. (B) Required information The records maintained under subparagraph (A) shall include information on whether and how the Secretary confirmed the information that was the basis for the change or determination described in subparagraph (A). (4) Semiannual performance reporting Not later than 6 months after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , and not less frequently than once every 6 months thereafter, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report that includes, for the period covered by the report— (A) the number of covered chemical facilities in the United States; (B) information— (i) describing— (I) the number of instances in which the Secretary— (aa) placed a covered chemical facility in a lower risk tier; or (bb) determined that a facility that had previously met the criteria for a covered chemical facility under section 2101(3) no longer met the criteria; and (II) the basis, in summary form, for each action or determination under subclause (I); and (ii) that is provided in a sufficiently anonymized form to ensure that the information does not identify any specific facility or company as the source of the information when viewed alone or in combination with other public information; (C) the average number of days spent reviewing site security or an alternative security program for a covered chemical facility prior to approval; (D) the number of covered chemical facilities inspected; (E) the average number of covered chemical facilities inspected per inspector; and (F) any other information that the Secretary determines will be helpful to Congress in evaluating the performance of the Chemical Facility Anti-Terrorism Standards Program. 2103. Protection and sharing of information (a) In general Notwithstanding any other provision of law, information developed under this title, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with the protection of similar information under section 70103(d) of title 46, United States Code. (b) Sharing of information with States and local governments Nothing in this section shall be construed to prohibit the sharing of information developed under this title, as the Secretary determines appropriate, with State and local government officials possessing a need to know and the necessary security clearances, including law enforcement officials and first responders, for the purpose of carrying out this title, provided that such information may not be disclosed pursuant to any State or local law. (c) Sharing of information with first responders (1) Requirement The Secretary shall provide to State, local, and regional fusion centers (as that term is defined in section 210A(j)(1)) and State and local government officials, as the Secretary determines appropriate, such information as is necessary to help ensure that first responders are properly prepared and provided with the situational awareness needed to respond to security incidents at covered chemical facilities. (2) Dissemination The Secretary shall disseminate information under paragraph (1) through a medium or system determined by the Secretary to be appropriate to ensure the secure and expeditious dissemination of such information to necessary selected individuals. (d) Enforcement proceedings In any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this title, and related vulnerability or security information, shall be treated as if the information were classified information. (e) Availability of information Notwithstanding any other provision of law (including section 552(b)(3) of title 5, United States Code), section 552 of title 5, United States Code (commonly known as the Freedom of Information Act ) shall not apply to information protected from public disclosure pursuant to subsection (a) of this section. (f) Sharing of information with Members of Congress Nothing in this section shall prohibit the Secretary from disclosing information developed under this title to a Member of Congress in response to a request by a Member of Congress. 2104. Civil enforcement (a) Notice of noncompliance (1) Notice If the Secretary determines that a covered chemical facility is not in compliance with this title, the Secretary shall— (A) provide the owner or operator of the facility with— (i) not later than 14 days after date on which the Secretary makes the determination, a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan; and (ii) an opportunity for consultation with the Secretary or the Secretary’s designee; and (B) issue to the owner or operator of the facility an order to comply with this title by a date specified by the Secretary in the order, which date shall be not later than 180 days after the date on which the Secretary issues the order. (2) Continued noncompliance If an owner or operator remains noncompliant after the procedures outlined in paragraph (1) have been executed, or demonstrates repeated violations of this title, the Secretary may enter an order in accordance with this section assessing a civil penalty, an order to cease operations, or both. (b) Civil penalties (1) Violations of orders Any person who violates an order issued under this title shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (2) Non-reporting chemical facilities of interest Any owner of a chemical facility of interest who fails to comply with, or knowingly submits false information under, this title or the CFATS regulations shall be liable for a civil penalty under section 70119(a) of title 46, United States Code. (c) Emergency orders (1) In general Notwithstanding subsection (a) or any site security plan or alternative security program approved under this title, if the Secretary determines that there is an imminent threat of death, serious illness, or severe personal injury, due to a violation of this title or the risk of a terrorist incident that may affect a chemical facility of interest, the Secretary— (A) shall consult with the facility, if practicable, on steps to mitigate the risk; and (B) may order the facility, without notice or opportunity for a hearing, effective immediately or as soon as practicable, to— (i) implement appropriate emergency security measures; or (ii) cease or reduce some or all operations, in accordance with safe shutdown procedures, if the Secretary determines that such a cessation or reduction of operations is the most appropriate means to address the risk. (2) Limitation on delegation The Secretary may not delegate the authority under paragraph (1) to any official other than the Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department appointed under section 103(a)(1)(H). (3) Limitation on authority The Secretary may exercise the authority under this subsection only to the extent necessary to abate the imminent threat determination under paragraph (1). (4) Due process for facility owner or operator (A) Written orders An order issued by the Secretary under paragraph (1) shall be in the form of a written emergency order that— (i) describes the violation or risk that creates the imminent threat; (ii) states the security measures or order issued or imposed; and (iii) describes the standards and procedures for obtaining relief from the order. (B) Opportunity for review After issuing an order under paragraph (1) with respect to a chemical facility of interest, the Secretary shall provide for review of the order under section 554 of title 5 if a petition for review is filed not later than 20 days after the date on which the Secretary issues the order. (C) Expiration of effectiveness of order If a petition for review of an order is filed under subparagraph (B) and the review under that paragraph is not completed by the last day of the 30-day period beginning on the date on which the petition is filed, the order shall vacate automatically at the end of that period unless the Secretary determines, in writing, that the imminent threat providing a basis for the order continues to exist. (d) Right of action Nothing in this title confers upon any person except the Secretary or his or her designee a right of action against an owner or operator of a covered chemical facility to enforce any provision of this title. 2105. Whistleblower protections (a) Procedure for reporting problems (1) Establishment of a reporting procedure Not later than 180 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall establish, and provide information to the public regarding, a procedure under which any employee or contractor of a chemical facility of interest may submit a report to the Secretary regarding a violation of a requirement under this title. (2) Confidentiality The Secretary shall keep confidential the identity of an individual who submits a report under paragraph (1) and any such report shall be treated as a record containing protected information to the extent that the report does not consist of publicly available information. (3) Acknowledgment of receipt If a report submitted under paragraph (1) identifies the individual making the report, the Secretary shall promptly respond to the individual directly and shall promptly acknowledge receipt of the report. (4) Steps to address problems The Secretary— (A) shall review and consider the information provided in any report submitted under paragraph (1); and (B) may take action under section 2104 of this title if necessary to address any substantiated violation of a requirement under this title identified in the report. (5) Due process for facility owner or operator (A) In general If, upon the review described in paragraph (4), the Secretary determines that a violation of a provision of this title, or a regulation prescribed under this title, has occurred, the Secretary may— (i) institute a civil enforcement under section 2104(a) of this title; or (ii) if the Secretary makes the determination under section 2104(c), issue an emergency order. (B) Written orders The action of the Secretary under paragraph (4) shall be in a written form that— (i) describes the violation; (ii) states the authority under which the Secretary is proceeding; and (iii) describes the standards and procedures for obtaining relief from the order. (C) Opportunity for review After taking action under paragraph (4), the Secretary shall provide for review of the action if a petition for review is filed within 20 calendar days of the date of issuance of the order for the action. (D) Expiration of effectiveness of order If a petition for review of an action is filed under subparagraph (C) and the review under that subparagraph is not completed by the end of the 30-day period beginning on the date the petition is filed, the action shall cease to be effective at the end of such period unless the Secretary determines, in writing, that the violation providing a basis for the action continues to exist. (6) Retaliation prohibited (A) In general An owner or operator of a chemical facility of interest or agent thereof may not discharge an employee or otherwise discriminate against an employee with respect to the compensation provided to, or terms, conditions, or privileges of the employment of, the employee because the employee (or an individual acting pursuant to a request of the employee) submitted a report under paragraph (1). (B) Exception An employee shall not be entitled to the protections under this section if the employee— (i) knowingly and willfully makes any false, fictitious, or fraudulent statement or representation; or (ii) uses any false writing or document knowing the writing or document contains any false, fictitious, or fraudulent statement or entry. (b) Protected disclosures Nothing in this title shall be construed to limit the right of an individual to make any disclosure— (1) protected or authorized under section 2302(b)(8) or 7211 of title 5, United States Code; (2) protected under any other Federal or State law that shields the disclosing individual against retaliation or discrimination for having made the disclosure in the public interest; or (3) to the Special Counsel of an agency, the inspector general of an agency, or any other employee designated by the head of an agency to receive disclosures similar to the disclosures described in paragraphs (1) and (2). (c) Publication of rights The Secretary, in partnership with industry associations and labor organizations, shall make publicly available both physically and online the rights that an individual who discloses information, including security-sensitive information, regarding problems, deficiencies, or vulnerabilities at a covered chemical facility would have under Federal whistleblower protection laws or this title. (d) Protected information All information contained in a report made under this subsection (a) shall be protected in accordance with section 2103. 2106. Relationship to other laws (a) Other Federal laws Nothing in this title shall be construed to supersede, amend, alter, or affect any Federal law that— (1) regulates (including by requiring information to be submitted or made available) the manufacture, distribution in commerce, use, handling, sale, other treatment, or disposal of chemical substances or mixtures; or (2) authorizes or requires the disclosure of any record or information obtained from a chemical facility under any law other than this title. (b) States and political subdivisions This title shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State. 2107. CFATS regulations (a) General authority The Secretary may, in accordance with chapter 5 of title 5, United States Code, promulgate regulations or amend existing CFATS regulations to implement the provisions under this title. (b) Existing CFATS regulations (1) In general Notwithstanding section 4(b) of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , each existing CFATS regulation shall remain in effect unless the Secretary amends, consolidates, or repeals the regulation. (2) Repeal Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title. (c) Authority The Secretary shall exclusively rely upon authority provided under this title in— (1) determining compliance with this title; (2) identifying chemicals of interest; and (3) determining security risk associated with a chemical facility. 2108. Small covered chemical facilities (a) Definition In this section, the term small covered chemical facility means a covered chemical facility that— (1) has fewer than 100 employees employed at the covered chemical facility; and (2) is owned and operated by a small business concern (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )). (b) Assistance to facilities The Secretary may provide guidance and, as appropriate, tools, methodologies, or computer software, to assist small covered chemical facilities in developing the physical security, cybersecurity, recordkeeping, and reporting procedures required under this title. (c) Report The Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report on best practices that may assist small covered chemical facilities in development of physical security best practices. 2109. Outreach to chemical facilities of interest Not later than 90 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 , the Secretary shall establish an outreach implementation plan, in coordination with the heads of other appropriate Federal and State agencies, relevant business associations, and public and private labor organizations, to— (1) identify chemical facilities of interest; and (2) make available compliance assistance materials and information on education and training. . (b) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( Public Law 107–196 ; 116 Stat. 2135) is amended by adding at the end the following: TITLE XXI—CHEMICAL FACILITY ANTI–TERRORISM STANDARDS Sec. 2101. Definitions. Sec. 2102. Chemical Facility Anti-Terrorism Standards Program. Sec. 2103. Protection and sharing of information.– Sec. 2104. Civil enforcement. Sec. 2105. Whistleblower protections. Sec. 2106. Relationship to other laws. Sec. 2107. CFATS regulations. Sec. 2108. Small covered chemical facilities. Sec. 2109. Outreach to chemical facilities of interest. . 3. Assessment; reports (a) Definitions In this section— (1) the term Chemical Facility Anti-Terrorism Standards Program means— (A) the Chemical Facility Anti-Terrorism Standards program initially authorized under section 550 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295; 6 U.S.C. 121 note); and (B) the Chemical Facility Anti-Terrorism Standards Program subsequently authorized under section 2102(a) of the Homeland Security Act of 2002, as added by section 2; (2) the term Department means the Department of Homeland Security; and (3) the term Secretary means the Secretary of Homeland Security. (b) Third-party assessment Using amounts appropriated to the Department before the date of enactment of this Act, the Secretary shall commission a third-party study to assess vulnerabilities of covered chemical facilities, as defined in section 2101 of the Homeland Security Act of 2002 (as added by section 2), to acts of terrorism. (c) Reports (1) Report to Congress Not later than 18 months after the date of enactment of this Act, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Energy and Commerce of the House of Representatives a report on the Chemical Facility Anti-Terrorism Standards Program that includes— (A) a certification by the Secretary that the Secretary has made significant progress in the identification of all chemical facilities of interest under section 2102(e)(1) of the Homeland Security Act of 2002, as added by section 2, including— (i) a description of the steps taken to achieve that progress and the metrics used to measure the progress; (ii) information on whether facilities that submitted Top-Screens as a result of the identification of chemical facilities of interest were tiered and in what tiers those facilities were placed; and (iii) an action plan to better identify chemical facilities of interest and bring those facilities into compliance with title XXI of the Homeland Security Act of 2002, as added by section 2; (B) a certification by the Secretary that the Secretary has developed a risk assessment approach and corresponding tiering methodology under section 2102(e)(2) of the Homeland Security Act of 2002, as added by section 2; (C) an assessment by the Secretary of the implementation by the Department of the recommendations made by the Homeland Security Studies and Analysis Institute as outlined in the Institute’s Tiering Methodology Peer Review (Publication Number: RP12–22–02); and (D) a description of best practices that may assist small covered chemical facilities, as defined in section 2108(a) of the Homeland Security Act of 2002, as added by section 2, in the development of physical security best practices. (2) Annual GAO report (A) In general During the 3-year period beginning on the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress an annual report that assesses the implementation of this Act and the amendments made by this Act. (B) Initial report Not later than 180 days after the date of enactment of this Act, the Comptroller General shall submit to Congress the first report under subparagraph (A). (C) Second annual report Not later than 1 year after the date of the initial report required under subparagraph (B), the Comptroller General shall submit to Congress the second report under subparagraph (A), which shall include an assessment of the whistleblower protections provided under section 2105 of the Homeland Security Act of 2002, as added by section 2, and— (i) describes the number and type of problems, deficiencies, and vulnerabilities with respect to which reports have been submitted under such section 2105; (ii) evaluates the efforts of the Secretary in addressing the problems, deficiencies, and vulnerabilities described in subsection (a)(1) of such section 2105; and (iii) evaluates the efforts of the Secretary to inform individuals of their rights, as required under subsection (c) of such section 2105. (D) Third annual report Not later than 1 year after the date on which the Comptroller General submits the second report required under subparagraph (A), the Comptroller General shall submit to Congress the third report under subparagraph (A), which shall include an assessment of— (i) the expedited approval program authorized under section 2102(c)(4) of the Homeland Security Act of 2002, as added by section 2; and (ii) the report on the expedited approval program submitted by the Secretary under subparagraph (I)(ii) of such section 2102(c)(4). 4. Effective date; conforming repeal (a) Effective date This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of enactment of this Act. (b) Conforming repeal Section 550 of the Department of Homeland Security Appropriations Act, 2007 ( Public Law 109–295 ; 120 Stat. 1388), is repealed as of the effective date of this Act. 5. Termination The authority provided under title XXI of the Homeland Security Act of 2002, as added by section 2(a), shall terminate on the date that is 4 years after the effective date of this Act.

Secretary