[Senate Report 113-263]
[From the U.S. Government Publishing Office]
113th Congress } { Report
2nd Session } SENATE { 113-263
_______________________________________________________________________
Calendar No. 578
CHEMICAL FACILITIES ANTI-TERRORISM
STANDARDS PROGRAM AUTHORIZATION AND ACCOUNTABILITY ACT OF 2014
__________
R E P O R T
of the
COMMITTEE ON HOMELAND SECURITY AND
GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
to accompany
H.R. 4007
TO RECODIFY AND REAUTHORIZE THE CHEMICAL FACILITY ANTI-TERRORISM
STANDARDS PROGRAM
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
September 18, 2014.--Ordered to be printed
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
THOMAS R. CARPER, Delaware, Chairman
CARL LEVIN, Michigan TOM COBURN, Oklahoma
MARK L. PRYOR, Arkansas JOHN McCAIN, Arizona
MARY L. LANDRIEU, Louisiana RON JOHNSON, Wisconsin
CLAIRE McCASKILL, Missouri ROB PORTMAN, Ohio
JON TESTER, Montana RAND PAUL, Kentucky
MARK BEGICH, Alaska MICHAEL B. ENZI, Wyoming
TAMMY BALDWIN, Wisconsin KELLY AYOTTE, New Hampshire
HEIDI HEITKAMP, North Dakota
Gabrielle A. Batkin, Staff Director
John P. Kilvington, Deputy Staff Director
Mary Beth Schultz, Chief Counsel
John G. Collins, Senior Professional Staff Member
Jason M. Yanussi, Senior Professional Staff Member
Abigail A. Shenkle, Legislative Aide
Keith B. Ashdown, Minority Staff Director
Christopher J. Barkley, Minority Deputy Staff Director
Andrew C. Dockham, Minority Chief Counsel
William H.W. McKenna, Minority Investigative Counsel
Laura W. Kilbride, Chief Clerk
Calendar No. 578
113th Congress } { Report
2d Session } SENATE { 113-263
=======================================================================
CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS PROGRAM AUTHORIZATION AND
ACCOUNTABILITY ACT OF 2014
_______
September 18, 2014.--Ordered to be printed
_______
Mr. Carper, from the Committee on Homeland Security and Governmental
Affairs, submitted the following
R E P O R T
[To accompany H.R. 4007]
The Committee on Homeland Security and Governmental
Affairs, to which was referred the bill (H.R. 4007) to recodify
and reauthorize the Chemical Facility Anti-Terrorism Standards
Program, having considered the same, reports favorably thereon
with an amendment in the nature of a substitute and recommends
that the bill, as amended, do pass.
CONTENTS
Page
I. Purpose and Summary..............................................1
II. Background and Need for the Legislation..........................2
III. Legislative History.............................................14
IV. Section-by-Section Analysis of the Bill, as Reported............15
V. Evaluation of Regulatory Impact.................................20
VI. Congressional Budget Office Estimate............................20
VII. Changes in Existing Law Made by the Bill, as Reported...........22
I. Purpose and Summary
H.R. 4007, the Protecting and Securing Chemical Facilities
from Terrorist Attacks Act of 2014, as amended by the
Committee's substitute amendment reauthorizes the Chemical
Facility Anti-Terrorism Standards program (CFATS) of the
Department of Homeland Security. The CFATS program is designed
to help ensure that high-risk chemical facilities are secure
from terrorist attack or sabotage. Facilities that make or use
certain chemicals have been identified as a significant
security concern and one that continues to warrant a dedicated
security program at the federal level. The Committee substitute
reauthorizes the CFATS program for four years, while at the
same time mandating specific changes in response to concerns
raised about that program by both stakeholders and overseers.
Specifically, the bill directs DHS to identify high-risk
facilities through the use of specific risk criteria and
requires DHS to use risk-based performance standards for high-
risk facilities to meet. The facilities, for their part, submit
security plans laying out how they plan to meet the performance
standards, and DHS reviews and approves the plans and then
follows up with in-person inspections of the facilities to
ensure compliance.
II. Background and Need for Legislation
Chemicals are a ubiquitous part of modern life, forming
indispensable parts of a vast number of products from the
mundane to the complex. Thousands of facilities across the
country produce and store chemicals, some of which could pose a
significant threat to human health or safety if released or
misused. Certain chemicals, if released into the water or air,
pose a direct threat to the health or life of those in nearby
communities. Other chemicals can explode if abused or
mishandled posing a significant threat to the surrounding
communities or, if the chemicals are stolen and smuggled, to
other communities as well. Chemical facilities--places that
produce, store or use significant quantities of certain
chemicals--therefore offer attractive targets for terrorists
because of the large scale damage and loss of life that can
occur through a direct attack on a facility or the
misappropriation of the chemicals they produce or store. While
many of these chemicals are already regulated under various
environmental or worker safety statutes, those regulations
typically focus on the possibility of an accidental release or
misuse rather than a deliberate effort to exploit the chemicals
to inflict harm.
To protect against this security risk, in the fall of 2006,
Congress authorized the Department of Homeland Security (DHS)
to determine which chemical facilities present a high level of
security risk, establish risk-based performance standards for
securing those high-risk facilities, and enforce regulations
designed to ensure facilities posing the highest risk are
meeting those standards.\1\ In response, DHS established the
Chemical Facility Anti-Terrorism Standards (CFATS) program. The
statute establishing the CFATS program included a three-year
sunset for DHS's authority, creating initial authority for the
program but ensuring that the effectiveness of the approach
outlined in the bill could be evaluated, and other measures
considered, relatively soon after the program's inception.\2\
Since then, Congress has passed several short-term extensions,
only once making a change to the CFATS program despite
Congress' desire to monitor implementation of the program
closely.\3\ With the Department's current authority set to
expire on October 4, 2014, the Committee voted to extend the
chemical security program with a longer-term authorization
while also addressing identified weaknesses in the program.
---------------------------------------------------------------------------
\1\See P.L. 109-295, Department of Homeland Security Appropriations
Act of 2007, Sec. 550.
\2\See 152 Cong. Rec. S10351 (September 28, 2006) (Statement of
Senator Collins), at http://www.gpo.gov/fdsys/pkg/CREC-2006-09-28/pdf/
CREC-2006-09-28.pdf.
\3\Sec. 534(h) of P.L. 110-161, the Department of Homeland Security
Appropriations Act of 2008, which allowed states and political
subdivisions thereof to adopt laws regulating chemical facilities, as
long as they were at least as stringent as CFATS. Since this change
amended the authorizing language for the program, it was carried
forward in subsequent short-term extensions of the program.
---------------------------------------------------------------------------
The original 2006 authorization--which has been extended
repeatedly on various appropriations bills or spending
resolutions--directed DHS to develop a security program for
high-risk chemical facilities that would rely on performance
standards rather than specific, prescriptive measures. It also
exempted certain facilities already subject to other regulatory
regimes aimed at ensuring the security of their facilities,
such as facilities owned or operated by the Departments of
Defense or Energy, facilities already regulated under the
Maritime Transportation Security Act of 2002 or by the Nuclear
Regulatory Commission, and water and wastewater treatment
facilities.
DHS developed the core features of the CFATS program in
interim regulations issued in spring 2007. To determine which
facilities face regulation under the program, DHS developed a
list of 322 ``chemicals of interest.'' All non-exempt
facilities possessing any of the 322 ``chemicals of interest''
beyond specified threshold amounts must fill out a
questionnaire known as a ``Top-Screen.'' DHS uses the completed
Top-Screens to determine whether a facility poses a high
security risk such that it should be covered by the risk-based
performance standards. If DHS finds the facility to be ``high-
risk,'' the facility is covered by CFATS and must submit and
comply with a security plan that meets the risk-based
performance standards; those not determined to be high-risk
face no further regulatory obligations under CFATS. DHS then
assigns high-risk facilities to one of four risk-based tiers,
with progressively stricter requirements for those in the
highest risk tiers. Tier 1 facilities are the highest risk
facilities; Tier 4 includes the lowest group of high-risk
facilities.
As of August 1, 2014, more than 48,000 facilities with
chemicals of interest had submitted Top-Screens to DHS. From
those submissions, DHS categorized approximately 3,986
facilities as high-risk, triggering some level of regulation
under CFATS.\4\ As of April 2014,\5\ 121 facilities had been
preliminarily assigned\6\ to Tier 1; 382 had been assigned to
Tier 2; 1,088 had been assigned to Tier 3; and 2,542 had been
assigned to Tier 4.\7\
---------------------------------------------------------------------------
\4\See Department of Homeland Security, CFATS Update August 2014 at
http://www.dhs.gov/sites/default/files/publications/
CFATS%20FS_August2014.pdf.
\5\The number of chemical facilities covered under the program is
variously quoted in this report as between 3,986 and 4,100. This
fluctuation is due to the fact that chemical facilities can reduce or
remove their holdings of chemicals in order to tier out of the program,
so the number of covered facilities is dynamic based on facilities'
decision to ``tier out'' of the program. See ``Charting a Path Forward
for the Chemical Facilities Anti-Terrorism Standards Program,'' hearing
before the Senate Committee on Homeland Security and Governmental
Affairs, 113th Cong. 3 (May 14, 2014) (Written testimony of Suzanne
Spaulding, Under Secretary, and Director David Wulf, National
Protection and Programs Directorate, Department of Homeland Security).
\6\These figures refer to preliminary tier assignments from the
Department based on facility submission of a Top-Screen. Final tier
assignment occurs after facilities submit Security Vulnerability
Assessments; the Department then reviews these assessments to identify
which facilities should be assigned to a high-risk tier under CFATS.
\7\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 3 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
---------------------------------------------------------------------------
Facilities deemed high-risk by the Department generally
must develop an effective security plan, submit the plan to DHS
for review, and implement their security plan. The security
standards required under the CFATS program are performance
based, rather than prescriptive. This means that the Department
does not prescribe specific measures that must be taken by all
facilities; instead, the manner in which a facility chooses to
address its security vulnerabilities, although subject to
approval by the Secretary, is developed by the facility
owner.\8\
---------------------------------------------------------------------------
\8\``A performance standard specifies the outcome required, but
leaves the specific measures to achieve that outcome up to the
discretion of the regulated entity. In contrast to a design standard or
a technology-based standard that specifies exactly how to achieve
compliance, a performance standard sets a goal and lets each regulated
entity decide how to meet it.'' See Department of Homeland Security,
Risk-Based Performance Standards Guidelines, Chemical Facility Anti-
Terrorism Standards, May 2009 at http://www.dhs.gov/xlibrary/assets/
chemsec_cfats_riskbased_performance_standards.pdf, quoting Cary
Coglianese et al., Performance-Based Regulation: Prospects and
Limitations in Health, Safety, and Environmental Protection, 55 Admin.
L. Rev. 705, 706-07 (2003).
---------------------------------------------------------------------------
For example, facilities need to secure some chemicals from
theft or diversion. They can do this through various inventory
controls or physical measures (for example walls or locked
doors). It is worth noting that facilities that receive an
initial high-risk determination can resubmit their information
and ``tier out''--remove themselves from further regulation--if
they adjust their operations in a way that removes them from
the high-risk category. According to DHS officials, to date
over 3,000 facilities possessing chemicals of interest have
``voluntarily removed, reduced, or modified their holdings of
chemicals of interest.''\9\
---------------------------------------------------------------------------
\9\See Department of Homeland Security, CFATS Update August 2014 at
http://www.dhs.gov/sites/default/files/publications/
CFATS%20FS_August2014.pdf.
---------------------------------------------------------------------------
Under current procedures, following assignment of a final
risk tier by the Department, but prior to approving a facility,
DHS conducts an authorization inspection of the facility. An
authorization inspection consists of an initial, physical
review of the facility to determine if the Top-Screen, security
vulnerability assessment, and facility security plan accurately
represent and address the risks for the facility. Because the
program requires performance-based standards to mitigate risk,
facilities and the Department frequently discuss planned or
alternative mitigation measures before a plan is approved.
While this helps ensure facilities use both effective and cost-
effective measures, it can and frequently has delayed progress
within the program. Once the Department approves the covered
facility's security plan, the facility may begin implementing
the plan. The Department maintains the authority to conduct
subsequent compliance inspections to ensure facilities continue
to meet the requirements of the security plan and the program.
The implementation of the CFATS program has improved
security of chemical facilities and the safety and security of
communities located near the chemical facilities by throwing a
spotlight on security, though the Committee acknowledges
management challenges in the program have limited its
effectiveness. Under the program, chemical facilities have
systematically assessed security risks and invested in measures
to mitigate those risks. This has led many companies to take
measures to reduce risk in order to ``tier out'' of the
program. Again, since the program's inception, 3,000 facilities
have reduced risk at their facilities enough to ``tier out'' of
the program, either by reducing, eliminating, or modifying
their stores of chemicals.\10\ The fact that 3,000 facilities
have tiered out is significant given that only 4,000 facilities
are assigned to a risk tier under the program.\11\ Other
chemical facilities have begun to install security measures as
part of or in anticipation of security reviews by DHS under the
program. The CFATS requirements work to level the playing field
to allow companies to invest in security measures without
facing a competitive disadvantage. Just as importantly, through
the program the government has received information to allow it
to for the first time develop a roadmap of the facilities in
communities nationwide that pose security risks and warrant
attention. DHS officials have testified that ``interagency
partners have benefited from this information as it has
enhanced law enforcement cooperation with high-risk chemical
facilities.''\12\
---------------------------------------------------------------------------
\10\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 2 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
\11\See Department of Homeland Security, CFATS Update August 2014
at http://www.dhs.gov/sites/default/files/publications/
CFATS%20FS_August2014.pdf.
\12\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 1 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
---------------------------------------------------------------------------
Yet the program has not been without its shortcomings. It
has suffered for lack of a long-term authorization that would
allow administrators to engage in meaningful and efficient
programmatic planning, and require industry to invest in
security measures.
Just as importantly, internal and external reviews have
revealed problems with the design, implementation, and
administration of the CFATS program.\13\ These include human
capital issues,\14\ a considerable backlog of facility security
plan reviews and compliance inspections,\15\ and a flawed risk
assessment methodology.\16\ In 2011, an internal management
memorandum detailed significant mismanagement in the program,
including buying unneeded equipment and vehicles and hiring
ill-qualified workers. The memo also raised serious questions
about whether facilities were being tiered correctly.\17\ An
April 2013 GAO report looked at DHS's implementation of the
program from roughly 2011 to 2013.\18\ The report raised
several concerns with the program, most importantly that there
was a need for DHS to improve its process of assessing the risk
posed by a facility by including economic consequence among the
risk factors, and that DHS was behind in reviewing site
security plans and inspecting facilities to verify compliance.
Following an explosion at a facility in West, Texas in 2013
that never complied with its obligation to submit a Top-Screen
despite having two chemicals of interest on site over the
regulatory thresholds, GAO also recommended that DHS focus on
finding and subjecting to regulation other facilities that had
thus far ignored the mandate to report their existence to
DHS.\19\
---------------------------------------------------------------------------
\13\E.g., Sen. Tom Coburn, Ranking Member, Homeland Security &
Government Affairs Committee, Chemical Insecurity: An Assessment of
Efforts to Secure the Nation's Chemical Facilities from Terrorist
Threats (2014), at http://www.coburn.senate.gov/public/index.cfm/2014/
7/federal-chemical-security-program-in-shambles-new-report-says.
\14\See Government Accountability Office (GAO), DHS is Taking
Action to Better Manage Its Chemical Security Program, but It Is Too
Early to Assess Results, (GAO-12-515T), July 26, 2012, at 9.
\15\See Department of Homeland Security Office of the Inspector
General (DHS OIG), Effectiveness of the Infrastructure Security
Compliance Division's Management Practices to Implement the Chemical
Facility Anti-Terrorism Standards Program, (Report Number OIG-13-55),
March 2013 at 17, 19-20, and 22; and Government Accountability Office
(GAO), Critical Infrastructure Protection: DHS Efforts to Assess
Chemical Security Risk and Gather Feedback on Facility Outreach Can Be
Strengthened, (GAO-13-353), April 2013 at 18.
\16\Id at 9-15.
\17\Memorandum from Penny Anderson, Director, Infrastructure
Security Compliance Division, Office of lnfrastructure Protection and
David WuIf, Deputy Director to NPPD Undersecretary, Rand Beers:
``Challenges Facing ISCD, and the Path Forward.'' November 10, 2011.
\18\See Government Accountability Office (GAO), Critical
Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk
and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO-13-
353), April 2013 at 4.
\19\Id.
---------------------------------------------------------------------------
Since the 2011 memo, DHS's Infrastructure Security
Compliance Division (ISCD), which manages the CFATS program,
has taken steps to address some of these concerns. Among other
things, DHS officials improved policies and training to ensure
that inspections are conducted in a consistent and thorough
fashion; implemented an improved, streamlined Site Security
Plan (SSP) review process, which has enhanced ISCD's ability to
authorize and, as appropriate, approve security plans; and
conducted an extensive three-part review of CFATS's risk
assessment methodology, including a peer review, which is now
being partially implemented.
This legislation is designed to address the challenges that
have been identified, codify the improvements DHS has already
begun making, and authorize additional steps DHS should take to
make the program more effective.
HIGHLIGHTS OF H.R. 4007, AS AMENDED BY THE COMMITTEE
H.R. 4007, as amended by the Committee's substitute
amendment, reauthorizes the Department's CFATS program for a
period of four years, providing much-needed programmatic
stability and certainty for both the Department and regulated
facilities. It achieves this by codifying reforms,
strengthening management practices and whistleblower
protections, simplifying facility reporting and information
sharing practices, and authorizing a new expedited approval
program for lower high-risk facilities to help reduce the
backlog of unapproved facility security plans. Specifically,
the substitute amendment to H.R. 4007\20\ would:
---------------------------------------------------------------------------
\20\The legislation referred to in the body of this section is the
Carper-Coburn substitute amendment to H.R. 4007 as reported by the
Committee. The main differences between H.R. 4007 as reported by this
Committee and the legislation by the same name passed in the House
include strengthened whistleblower protections, the establishment of an
expedited approval program, changes to the Personnel Surety Program,
and a four-year authorization. For a full description of the underlying
bill, see H.R., Rep. No. 113-491, Pt. 1 (2014).
---------------------------------------------------------------------------
1. Authorize the program for a period of four years (the
House-reported version of H.R. 4007 authorized the program for
three years).
2. Permit the submission of simplified facility security
plans through an alternative security program to facilitate
compliance for small businesses and reduce the backlog of plan
approvals at the Department.
3. Create an expedited approval program to enable
facilities in the third and fourth risk tiers to implement
security plans more quickly, without compromising the
Department's ability to ensure they meet the program's security
standards.
4. Streamline the requirement for facilities to seek
background checks on those with access to the facilities by
allowing facilities to meet the requirement in more than just
one way.
5. Direct the Secretary to develop an implementation plan
for outreach to chemical facilities with regulated amounts of
chemicals of interest that have not submitted the required Top-
Screen, in order to reduce the number of facilities not
compliant with CFATS.
6. Appropriately strengthen whistleblower protections by
requiring the Secretary to establish a reporting process and
prohibiting retaliation against whistleblowers.
7. Ensure that sensitive security information provided by
chemical facilities is protected and shared with first
responders in a secure and responsible manner.
8. Ensure DHS is regularly reviewing and updating its risk
assessment model.
9. Require DHS to provide Congress key metrics for better
oversight of program performance.
Four-year authorization
The Committee substitute to H.R. 4007 will provide
stability and predictability for both DHS and regulated
facilities by providing a longer-term authorization than the
CFATS program has had before now. Up until now, Congress has
authorized the program via language in Appropriations bills,
limping from year to year and sometimes month to month.\21\ The
four-year authorization will provide industry stakeholders with
the certainty they need to invest in CFATS compliance
measures.\22\ At the Committee hearing in May, a witness
representing Dow Chemical noted that:
\21\See Pub. L. 109-295, title V, Sec. 550, Oct. 4, 2006, 120 Stat.
1388, as amended by Pub. L. 110-161, div. E, title V, Sec. 534, Dec.
26, 2007, 121 Stat. 2075; Pub. L. 111-83, title V, Sec. 550, Oct. 28,
2009, 123 Stat. 2177; Pub. L. 112-10, div. B, title VI, Sec. 1650, Apr.
15, 2011, 125 Stat. 146; Pub. L. 112-74, div. D, title V, Sec. 540,
Dec. 23, 2011, 125 Stat. 976; Pub. L. 113-6, div. D, title V, Sec. 537,
Mar. 26, 2013, 127 Stat. 373; and Pub. L. 113-76, div. F, title V,
Sec. 536, Jan. 17, 2014, 128 Stat. 275.
\22\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 1 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
Three years is the minimum to really match up with
the capital planning process for industry. If you tell
me today I have got to go do something, I will get the
money next year and probably finish the project the
year after that . . . Three is good, four is
better.\23\
---------------------------------------------------------------------------
\23\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. (May 14, 2014)
(Testimony of Timothy J. Scott on behalf of Dow Chemical Company and
the American Chemistry Council).
Likewise, representatives from the Department of Homeland
Security have noted that long-term Congressional authorization
is needed in order to cement the Department's enforcement
authorities and eliminate confusion regarding authority for the
program. For example, during the government shutdown in October
2013, Infrastructure Security Compliance Division staff were
furloughed and the CFATS program effectively ceased to exist
because the Department's authority to manage the program also
expired.\24\ DHS officials have noted the importance of a long-
term authorization in order to convey clearly the intent of
Congress, and the Department, to maintain a robust chemical
facility security program--an intent that the series of short-
term extensions simply could not convey.\25\ The Committee
believes that a four-year authorization allows the greatest
programmatic stability, affording the Department the ability to
hire qualified personnel, while requiring chemical facilities
to invest in required security measures.
---------------------------------------------------------------------------
\24\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. (May 14, 2014)
(Testimony of David Wulf, Director, National Protection and Programs
Directorate, Department of Homeland Security).
\25\Id.
---------------------------------------------------------------------------
Director David Wulf, of the Infrastructure Security
Compliance Division of the Department, testified that a longer-
term or permanent authorization would enable the Department to
recruit and retain talent, while continuing efforts to improve
the CFATS program.\26\
---------------------------------------------------------------------------
\26\Id.
---------------------------------------------------------------------------
Finally, a long-term Congressional authorization, coupled
with the additional reporting requirements in this Act, would
allow needed Congressional oversight of the program.
Alternative security programs and creation of an expedited approval
program
The legislation also creates two new, alternative options
for review that will help the Department address the backlog of
unapproved site security plans. The CFATS program has received
over 48,000 Top-Screens and has made progress in program goals,
including assigning tiers to covered chemical facilities and
assisting covered facilities in compliance and improving
security. Some 3,000 facilities have also reduced their
holdings of chemicals of interest such that they are no longer
covered by CFATS.\27\ Nevertheless, the program still faces a
significant backlog of site security plan authorizations and
compliance inspections. In its April 2013 report on CFATS, the
Government Accountability Office estimated that it could take
seven to nine years for the program to eliminate the backlog of
reviewing facilities' site security plans and conducting
compliance inspections.\28\ At a May 2014 hearing, DHS
officials testified that they had devoted more resources and
attention to the issues creating the backlog, had already begun
speeding up reviews, and believed they could get through the
backlog in half the time GAO initially assessed.\29\ However,
even accounting for that progress, sixty-one percent of the
approximately 4,100 facilities covered under the CFATS program
at that time\30\ were awaiting authorization of the site
security plans they submitted to DHS; ninety-nine percent had
yet to undergo a compliance inspection.\31\
---------------------------------------------------------------------------
\27\See Department of Homeland Security, CFATS Update August 2014
at http://www.dhs.gov/sites/default/files/publications/
CFATS%20FS_August2014.pdf.
\28\See Government Accountability Office (GAO), Critical
Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk
and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO-13-
353), April 2013 at 18.
\29\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. (May 14, 2014)
(Testimony of David Wulf, Director, National Protection and Programs
Directorate, Department of Homeland Security).
\30\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 3 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
\31\Ibid.
---------------------------------------------------------------------------
While the Committee believes that the Department has made
considerable progress recently in speeding up its review of
site security plans and conducting compliance inspections, it
believes it crucial to expedite these reviews further so that
needed security measures are put in place as soon as
possible.\32\ These facilities and the threats they face can be
complex and securing them in a manner that meets the mandated
performance standards can be time and capital intensive.
Companies do not want to move ahead with changes until they are
certain they know what is required. Thus the backlog in
reviewing applications inhibits facilities from implementing
the investments they want to make to improve security at their
sites, which makes the communities that surround them less
secure.
---------------------------------------------------------------------------
\32\See Department of Homeland Security, CFATS Fact Sheet,
September 2014, http://www.dhs.gov/sites/default/files/publications/
CFATS-FS-September-2014-508.pdf.
---------------------------------------------------------------------------
In response to this problem, the Committee substitute to
H.R. 4007 authorizes two new, optional tracks for covered
facilities to use in submitting security plans. The first, the
alternative security program, allows facilities to implement
security plans developed by industry associations and approved
by DHS. The legislation creating the original authority for
CFATS allowed the Department to approve Alternative Security
Plans (ASPs) that had been ``established by private sector
entities.'' But in 2007 the Department issued an Interim Final
Rule that required that ASPs be approved individually. This
change subverted Congressional intent and largely eliminated
any efficiency the program would have created. The Committee
substitute to H.R. 4007 would restore the program to its
original intent, following the model set by the U.S. Coast
Guard's Maritime Transportation Security Act (MTSA) program.
That program allows approval of ASPs for types of vessels or
facilities carrying certain dangerous chemicals.
Second, it also creates a voluntary expedited approval
program to facilitate compliance for lower-risk companies.
Under that program, which the Committee developed in
consultation with the Department and key stakeholders, DHS
would have the authority to set prescriptive, rather than
performance-based, standards for site security for facilities
assigned to tiers three and four. Facilities electing to
participate in the program would forego the need for an
authorization inspection, but could still be subject to
compliance inspections.
The Committee believes that the expedited approval program
will lessen the potentially disproportionate regulatory burden
that current CFATS regulations impose on smaller chemical
companies, which may lack the compliance infrastructure and
resources of large chemical facilities. It does this by
requiring that the Department establish clear, prescriptive
guidelines these facilities certify they will meet and to which
they will continue to adhere. This obviates the need for an
extensive submission and review process of a facility security
plan, frees DHS resources to focus on the highest risk
facilities, and allows facilities to implement security
measures more quickly. The program still maintains strong
Departmental oversight to ensure facilities are indeed secure.
Under the expedited approval program, the Department may reject
site security plans that are ``facially deficient'' or
obviously insufficient under the guidelines established by the
program. Under the program, the Department also retains the
right to conduct compliance inspections in order to determine
whether facilities have implemented the security measures
outlined in their plans.
The voluntary expedited approval program created under the
bill would require additional work by the Department at the
outset, while it develops prescriptive security measures and
security plan templates. However, it should result in a notable
reduction in the administrative burden on both facilities and
the Department, and help reduce the backlog of site security
plan reviews of lower-risk facilities.
Personnel Surety Program
Consistent with the House bill, the Committee substitute to
H.R. 4007 establishes a functional and efficient Personnel
Surety Program (PSP). As part of regulations promulgated under
the CFATS program\33\ the Department established eighteen
``risk-based performance standards'' (RBPSs) that covered
chemical facilities are required to address. There has long
been disagreement between regulated industry stakeholders and
the Department as to how facilities can satisfy RBPS-12, which
requires covered chemical facilities to take steps to determine
whether persons with access to their facility may have
terrorist ties.\34\
---------------------------------------------------------------------------
\33\6 C.F.R. Part 27.
\34\RBPS-12 provision (iv).
---------------------------------------------------------------------------
Specifically at issue has been the RBPS-12 provision (iv),
which requires facilities to establish ``measures designed to
identify persons with terrorist ties.'' DHS has issued an
interim rule that would establish a Personnel Surety Program
(PSP) that would require facilities (or other entities acting
on a facility's behalf) to submit information on individuals
with access to a covered chemical facility through a DHS
created and managed web portal at least 48 hours prior to such
a person's initial access to the facility.\35\ The Department
stated that this would allow facilities to submit information
regarding covered individuals for DHS to check whether those
individuals are on the FBI Terrorist Screening Database
(TSDB).\36\ The concern raised by regulated entities with
regards to the Department's proposal centers on the fact that a
number of other security screening programs of the Federal
Government, including the Transportation Security
Administration's Transportation Worker Identification
Credential (TWIC),\37\ already check individuals against the
TSDB. However, the Department stated in its proposal that it
would not accept the TWIC or other, similar credentials in lieu
of a submission through the DHS PSP website as described above,
unless the credential could be electronically verified. Since
many individuals who access chemical facilities are already
required to maintain a TWIC or other credential, regulated
stakeholders argue that DHS's requirement is unnecessary and
duplicative. For its part, the Department argues that repeat
vetting directly before accessing a facility is necessary to
truly determine if the individual may pose a threat.
---------------------------------------------------------------------------
\35\79 F.R. 6417.
\36\While the legislation still includes requirements for vetting
personnel at covered chemical facilities against the terrorist
screening database, the Committee has included a clear definition for
the terrorist screening database to help address any concerns or
confusion that the term could be interpreted to include new,
additional, or different databases. The legislation clarifies that the
term terrorist screening database refers to the current database
maintained by the Terrorist Screening Center.
\37\Department of Homeland Security. Transportation Security
Administration, Transportation Worker Identification Credential. August
2014 at http://www.tsa.gov/stakeholders/
transportation-worker-identification-credential-twic%C2%AE.
---------------------------------------------------------------------------
The standards chemical facilities are required to meet
under CFATS are by definition performance based, and not meant
to be prescriptive.\38\ Industry partners argue that DHS's
proposed PSP rule is far more prescriptive than what is
necessary to meet the requirements of RBPS-12. Finally, the
Committee believes the Department should avoid costly
duplication of programs.
---------------------------------------------------------------------------
\38\79 F.R. 6417.
---------------------------------------------------------------------------
To that end, the Committee believes that DHS should
leverage existing infrastructure within DHS and industry to
verify and validate identity, check criminal history, verify
and validate legal authorization to work, and identify
individuals with terrorist ties by utilizing a Federal vetting
program. Additionally, given the intent of the CFATS program to
be a flexible program based on performance, the Committee wants
to ensure that facilities have a full cadre of tools at their
disposal to meet the Risk-Based Performance Standards.
The legislation also clarifies Congressional intent related
to the CFATS program by stating that a facility may satisfy its
obligation under RBPS-12(iv) by relying upon presentation and
visual validation of any credential issued by a Federal
screening program that periodically vets individuals against
the TSDB. The intent of this provision is to ensure that the
Department cannot compel a covered chemical facility that has
already vetted an individual against an alternate Federal
screening program to then also submit information about that
individual directly to the Department, unless that person has
been identified positively against the Terrorist Screening
Database.
Finally, the Personnel Surety Program outlined in this
legislation requires DHS to provide feedback to a participating
owner or operator of a covered chemical facility about an
individual based on vetting the individual against the TSDB, to
the extent that such feedback is necessary for the facility's
compliance with CFATS regulations. Under DHS's proposal, DHS
may refuse to tell facility owners and operators when an
individual with access has come up as a TSDB match. DHS argues
that it wants to avoid interfering with ongoing law enforcement
or intelligence operations that might involve the individual in
question. But, as regulated industry partners point out, the
security of a facility is jeopardized when an owner or operator
unknowingly allows access to a suspected terrorist, creating
security and liability, concerns. H.R. 4007 attempts to strike
a balance between these two concerns by limiting notification
to a facility regarding an individual matching the TSDB only if
that individual presents a threat to the facility's physical
security in such a way as to undermine the facility's efforts
to comply with the CFATS regulations.
Outreach to covered chemical facilities
This legislation improves DHS's ability to address the
issue of ``outlier facilities'' and to identify the universe of
chemical facilities which should be subject to requirements
under CFATS. Outlier facilities are facilities that do not let
DHS know of their existence much less take steps to comply with
the CFATS program despite the fact that they possess enough
chemicals of interest to trigger regulation under the program.
Perhaps the most notable example of such a facility was the
West Fertilizer Company located in West, Texas. That company's
facility caught fire and then exploded on April 17, 2013,
killing fifteen people, injuring hundreds more, and causing an
estimated $100 million in damage. Initial reports indicated a
large amount of anhydrous ammonia as the source of the
explosions; later, authorities determined that the explosions
were caused by ammonium nitrate that was stored at the
facility.\39\ Both anhydrous ammonia and ammonium nitrate are
designated by DHS as ``chemicals of interest,'' and possession
of either above certain threshold amounts is subject to
regulation under the CFATS program.\40\ Through an
investigation following the disaster at West Fertilizer, the
Department determined that the facility had not complied with
the requirement of the CFATS program to submit a Top-Screen to
DHS.\41\ As a result, until the explosion occurred program
officials were unaware the facility existed. The EPA's Risk
Management Program (RMP), however, did have a record of this
facility.
---------------------------------------------------------------------------
\39\See U.S. Chemical Safety Board (CSB), Preliminary Findings of
the U.S. Chemical Safety Board from its Investigation of the West
Fertilizer Explosion and Fire, April 22, 2014 at http://www.csb.gov/
assets/1/19/West_Preliminary_Findings.pdf.
\40\6 CFR Part 27.
\41\Letter from Suzanne Spaulding, Acting Under Secretary, National
Protection and Programs Directorate, Department of Homeland Security,
Hon. Thomas R. Carper, Chairman, Senate Committee on Homeland Security
and Governmental Affairs, dated July 31, 2013.
---------------------------------------------------------------------------
Prior to the West Fertilizer Company disaster, DHS was
taking some actions to identify outlier facilities. DHS relied
on information sharing among state homeland security agencies,
components within the Department, and stakeholders, the
maintenance of a toll-free CFATS Tip Line, and a limited,
regional pilot program allowing CFATS inspectors to review a
database maintained by the Environmental Protection Agency.
However, as the Department acknowledged, these efforts yielded
relatively few identifications of outlier facilities.\42\ In
August 2013, after the West disaster, the President issued an
executive order addressing this issue, calling for a working
group to improve federal, state, and local coordination to
identify facilities subject to CFATS requirements.\43\ And at a
Committee hearing in May, Department officials emphasized the
critical need for continued and improved outreach in order to
identify chemical facilities potentially subject to CFATS
requirements.\44\
---------------------------------------------------------------------------
\42\Id.
\43\EO 13650.
\44\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. 5 (May 14,
2014) (Written testimony of Suzanne Spaulding, Under Secretary, and
Director David Wulf, National Protection and Programs Directorate,
Department of Homeland Security).
---------------------------------------------------------------------------
The Committee substitute to H.R. 4007 establishes and
defines the term ``chemical facilities of interest'' to mean
facilities that hold, or that the Secretary has a reasonable
basis to believe hold, chemicals of interest in excess of the
threshold quantities set under the existing CFATS standards. It
requires the Secretary to consult with other government
agencies, including state and local governments, business
associations, and labor organizations to identify such
facilities, to report to Congress regarding the steps the
Department has taken to identify chemical facilities of
interest and its progress toward achieving that goal, and to
submit an action plan for better identifying and enforcing
compliance among chemical facilities of interest to
Congress.\45\
---------------------------------------------------------------------------
\45\The Committee substitute would allow the Secretary 18 months to
produce such a plan, rather than the 90 days specified in the House
bill.
---------------------------------------------------------------------------
Whistleblower protections
The Committee substitute to H.R. 4007 requires the
Department to establish procedures to allow workers or
contractors to report to the Secretary regarding potential
problems or vulnerabilities at a covered chemical facility.
Further, it protects those individuals who report problems from
termination or other forms of retaliation, though it provides
no protections for individuals who are found to have lied or
misled authorities. The Committee believes that workers can
play an important role in chemical security. Few individuals
know and understand the particular vulnerabilities of a
facility more than those who work there every day. As Anna
Fendley from the United Steelworkers testified at the
Committee's hearing in May 2014, ``[Workers] would be hurt
first and worst in an attack on a facility, and therefore have
the largest stake in ensuring safety.''\46\ The Committee
believes that protecting whistleblowers could potentially help
DHS identify chemical facilities that are covered by CFATS but
are not complying with its requirements. Furthermore, the
Committee believes it is important to protect whistleblowers
from retaliation.
---------------------------------------------------------------------------
\46\``Charting a Path Forward for the Chemical Facilities Anti-
Terrorism Standards Program,'' hearing before the Senate Committee on
Homeland Security and Governmental Affairs, 113th Cong. (May 14, 2014)
(Testimony of Anna Fendley on behalf of the United Steelworkers).
---------------------------------------------------------------------------
Information sharing with first responders
The Committee substitute to H.R. 4007 would allow the
Secretary to disseminate information collected from covered
chemical facilities, including security vulnerability
assessments, site security plans, and other information, to
first responders through any medium or system the Secretary
determines appropriate.\47\ The Committee's change reflects its
intent that this potentially sensitive information be shared in
a secure and effective manner only with those individuals who
possess a need to know, and our belief that mandating that
information be shared via HSIN and HSDN could include too broad
an audience. The Committee believes the Secretary, examining
the sensitivity of the information and the relative needs of
recipients, is in the best position to make a determination.
Based on similar reasoning, the legislation exempts information
gathered from chemical facilities under the authority granted
in the bill from requests under the Freedom of Information Act.
The Committee intends this blanket exemption to preclude the
possibility that members of the public without a need to know,
including potentially bad actors, seeking to access this
information might receive it from the Federal Government
through a FOIA request.\48\
---------------------------------------------------------------------------
\47\In contrast, H.R. 4007 as passed by the House would require the
Secretary to use the Homeland Security Information Network (HSIN) or
the Homeland Secure Data Network (HSDN) to distribute such information.
Though the HSDN reaches a more limited audience and is used only to
share classified information, HSIN is a public-facing web portal that
allows for the sharing of sensitive but not classified information to
federal, state, local, tribal, territorial, international, and private
sector partners.
\48\The Committee does not intend this provision to affect one way
or the other the ability of anyone to access any information about a
chemical facility, either from the company itself, or from the
government, as provided for under any other law or program.
---------------------------------------------------------------------------
Improved risk assessment methodology
Finally, this legislation ensures that the Department fixes
its historically flawed risk assessment and tiering methodology
by requiring DHS to consider all areas of risk in developing
risk assessments in order to more accurately reflect the core
criteria of risk: threat, consequence (including both economic
consequences and fatalities), and vulnerability. The Committee
wants to ensure that all aspects of risk are being considered
when determining whether a facility presents a high enough risk
to be regulated under the CFATS program and into what tier a
facility may be placed. It further instructs the Secretary to
maintain a record of any changes to a facility's tiering status
and why the change was made. In its April 2013 report, GAO
recommended that DHS should enhance its risk assessment
approach to incorporate all elements of risk, and conduct an
independent peer review to ensure the approach is
effective.\49\ That peer review, conducted by the Homeland
Security Studies and Analysis Institute, was published in
September, 2013 and laid out a number of recommendations for
improvement.\50\ This legislation would require the Department
to develop a risk assessment approach and tiering methodology
based on that review and require the Secretary to report to
Congress on the Infrastructure Security Compliance Division's
progress in doing so within 18 months of the bill's enactment.
---------------------------------------------------------------------------
\49\See Government Accountability Office (GAO), Critical
Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk
and Gather Feedback on Facility Outreach Can Be Strengthened, (GAO-13-
353), April 2013 at 9-15.
\50\See Homeland Security Studies and Analysis Institute's Tiering
Methodology Peer Review, Publication Number: RP12-22-02.
---------------------------------------------------------------------------
III. Legislative History
H.R. 4007, the Protecting and Securing Chemical Facilities
from Terrorist Attacks Act of 2014, was introduced by
Representative Meehan on February 6, 2014. The House passed the
bill on July 8, 2014, on a motion to suspend the rules and pass
the bill, as amended, by voice vote. The bill was received in
the Senate on July 9, 2014, and referred to the Homeland
Security and Governmental Affairs Committee.
Prior to the bill's referral, the Committee held a hearing
on May 14, 2014, titled ``Charting a Path Forward for the
Chemical Facilities Anti-Terrorism Standards Program.'' The
purpose of the hearing was to examine the current state of the
CFATS program and the need to reauthorize the program.
Witnesses included two senior DHS officials responsible for
managing the program, representatives from the Government
Accountability Office and Congressional Research Service, an
industry representative, and a labor representative.
The Committee considered H.R. 4007 at a business meeting on
July 30, 2014. Senators Carper and Coburn offered a substitute
amendment that made a number of changes to the bill as passed
by the House. The substitute added provisions permitting the
submission of simplified security plans through the alternative
security program; establishing an expedited approval program to
allow lower high-risk facilities to more quickly implement
security plans; requiring DHS to review and update its risk
assessment model and report key metrics to Congress so that
Congress can better perform oversight of the CFATS program;
requiring sensitive security information to be protected and
shared with first responders; and requiring the Secretary to:
collect and report on program best practices in order to assist
smaller facilities in complying with the program, develop an
implementation plan for outreach to chemical facilities of
interest; establish a program-specific reporting process for
whistleblowers, and work with industry and labor organizations
to improve information sharing.
The committee adopted the Carper-Coburn substitute, as
modified, and ordered the bill, as amended, reported favorably,
both by voice vote. Senators present for both votes were
Senators Carper, Levin, Landrieu, McCaskill, Begich, Baldwin,
Coburn, Johnson, and Ayotte. Senator Baldwin requested to be
recorded as voting ``no'' on the bill.
IV. Section-by-Section Analysis of the Bill, as Reported
Section 1--Short title
This section establishes the title of the legislation as
the ``The Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2014.''\51\
---------------------------------------------------------------------------
\51\Note that the House version was titled, ``The Chemical Facility
Anti-Terrorism Standards Program Authorization and Accountability Act
of 2014.''
---------------------------------------------------------------------------
Section 2--Chemical Facility Anti-Terrorism Standards Program
This section amends the Homeland Security Act of 2002 (6
U.S.C. 101 et seq.), adding at the end a new title, Title XXI--
Chemical Facility Anti-Terrorism Standards.
New section 2101 of the Homeland Security Act of 2002--Definitions
This section defines key terms used in the bill, including
``CFATS regulation,'' and specifies which types of facilities
are considered to be ``covered chemical facilities,'' which
facilities are exempted, and which types of facilities are
considered to be ``chemical facilities of interest.''
This section defines ``chemical facility of interest'' as a
facility that the Secretary has reason to believe holds
threshold quantities of chemicals of interest.
It defines ``covered chemical facility'' as a facility that
the Secretary identifies as a chemical facility of interest,
which is a high-risk facility, as determined by the
Department's risk assessment methodology.
It defines ``excluded facility'' to mean a facility
regulated under the U.S. Coast Guard's Maritime Transportation
Security Act (MTSA) protocol or the Safe Drinking Water Act, a
wastewater treatment works regulated under the Federal Water
Pollution Control Act, a facility owned or operated by the
Department of Defense or the Department of Energy, or a
facility regulated by the Nuclear Regulatory Commission or by a
state that has entered into an agreement with the Nuclear
Regulatory Commission.
It defines ``expedited approval facility'' as a covered
chemical facility for which the owner or operator elects to
submit a site security plan for expedited approval under a new
program authorized in the legislation.
It defines a ``facially deficient'' security plan as a
security plan that does not support a certification that the
security measures in the plan address the security
vulnerability assessment and risk-based performance standards.
New section 2102 of the Homeland Security Act of 2002--Chemical
Facility Anti-Terrorism Standards Program
Subsection (a) requires DHS to establish risk-based
performance standards to ensure the security of chemical
facilities. It charges the Secretary of Homeland Security
(``the Secretary'') with identifying chemical facilities of
interest and covered chemical facilities. It authorizes the
Secretary to require chemical facilities of interest to submit
a Top-Screen. The subsection authorizes the Secretary to
require covered facilities to submit to the Department of
Homeland Security (``DHS'') security vulnerability assessments,
and to develop, submit, and implement site security plans.
(This language largely mirrors the original CFATS authorizing
statute, PL 109-295, the Department of Homeland Security
Appropriations Act of 2007, Sec. 550, hereinafter referred to
as ``Sec. 550'').
Subsection (b), Security Measures, describes the
requirements of a site security plan, stating they should
include security measures that, in combination, appropriately
address the security vulnerability assessment and the risk-
based performance standards for securing the facility.
Subsection (c), Approval or Disapproval of Site Security
Plans, outlines the process for DHS's review of site security
plans and improves the efficiency of the site security plan
approval process by allowing facilities to use an alternative
security program. This subsection charges the Secretary with
evaluating and approving site security plans described under
subsection (a), and specifies that the Secretary may not
require the presence or absence of particular measures.
This subsection further authorizes the Secretary to approve
alternative security programs created by outside entities, such
as the American Chemistry Council, if those programs satisfy
all the requirements of the Risk-Based Performance Standards.
If the requirements of the alternative security program do not
fully meet the requirements of the subsection, the Secretary
may recommend additional security measures to allow the program
to be approved. Further, the subsection allows the Secretary to
accept an already-approved alternative security program without
reevaluating the program.
This subsection further obligates the Secretary to employ
the risk assessment procedures established under this title,
and establishes a ``grandfather clause'' providing that, if the
legislation is enacted, a site security plan already approved
by the Secretary prior to the date of enactment of this Act
need not be reevaluated solely because of enactment of this
Act.
This subsection also creates a new expedited approval
program through which tier 3 and 4 facilities may develop and
submit a site security plan for expedited approval. It requires
that the Secretary first issue prescriptive guidance for such
facilities to meet the risk-based performance standards, and
outlines how facilities may certify that deviations from the
guidance meet or exceed the prescriptive standards. The
subsection requires the Secretary to consult with labor
organizations and Sector Coordinating Councils to develop this
guidance. The subsection establishes deadlines for facilities
to submit and certify plans for expedited approval and for the
Department to review certified plans, provides authority for
the Secretary to enforce compliance under this program, and
provides a process by which facilities can amend site security
plans. It allows the Secretary to suspend and ultimately revoke
a facility's ability to participate in the voluntary expedited
approval program if it submits a facially deficient site
security plan, and to recommend additional security measures if
it suspends a facility's certification. The subsection also
allows DHS to develop prescriptive security plan templates that
meet the risk-based performance standards and tier 3 and 4
facilities can submit as their site security plans. Finally,
the subsection requires that the Secretary fully evaluate the
expedited approval program within 18 months of enactment of the
Act.
Subsection (d), Compliance, requires the Secretary to
conduct audits or inspections of covered chemical facilities,
and would allow nongovernmental personnel to conduct audits or
inspections on behalf of the Department in order to address the
existing backlog. This section also requires the Secretary to
establish a Personnel Surety Program that ensures individuals
with access to covered chemical facilities are vetted against
the Terrorist Screening Database, the central terrorist
watchlist consolidated by the FBI's Terrorist Screening Center.
This subsection defines ``nondepartmental'' to refer to
personnel and entities that are neither employed by nor are
components or other authorities of DHS, and ``nongovernmental''
to refer to personnel or entities that are neither employed by
nor are agencies, departments, or other authorities of the
Federal Government. This subsection would allow the Secretary
to make use of nondepartmental and nongovernmental facility
inspectors in addition to DHS Inspectors, and requires the
Secretary to set high standards and professional qualifications
for both governmental and nongovernmental personnel. This will
help to expedite the rate of inspections and address the
backlog of authorization inspections DHS now faces. This
subsection also makes clear that any duties carried out by a
nongovernmental entity should not be inherently governmental
functions, and that only the Secretary or the Secretary's
designee retains the authority to approve a site security plan.
This subsection clarifies that a facility may utilize any
Federal screening program that periodically vets individuals
against the Terrorist Screening Database in order to comply
with the requirement to vet personnel against the terrorist
watchlist. This subsection also prohibits DHS from collecting
information from covered chemical facilities about an
individual unless that individual has been identified as
presenting a terrorist threat, or is being vetted under the
CFATS program's Personnel Surety Program (PSP). Finally, this
subsection instructs DHS to share any information with a
facility that the facility needs to comply with this section.
The Committee added this requirement to address concerns raised
by industry groups that the Department was not required to
share with a chemical facility information that an individual
identified through the Terrorist Screening Database as
potentially having terrorist ties had accessed the chemical
facility. Under the requirement, the Committee intends for the
Department to determine what information a facility needs in
order to comply.
Subsection (e) outlines the responsibilities of the
Secretary. It ensures that DHS is communicating with state and
local officials as well as other Federal agencies and industry
associations to identify chemical facilities of interest, and
that DHS implements a comprehensive risk assessment and
maintains records documenting the basis for any facility that
experiences a change in risk tiering.
This subsection instructs DHS to communicate with state and
local officials, as well as other Federal agencies and industry
associations, to identify chemical facilities of interest,
which will help to ensure that outlier facilities are known to
the Department. This subsection further ensures that DHS is
taking into account all relevant risk information when
developing its risk assessment standards and corresponding
tiering methodology. It also requires that the Secretary
document the basis for each change in a covered chemical
facility's tier. It also requires the Secretary to provide a
biannual report to Congress detailing specific metrics on the
program's performance in order to aid Congressional evaluation
and oversight of the program.
New section 2103 of the Homeland Security Act of 2002--Protection and
sharing of information
This section ensures that sensitive security information is
protected, and shared with first responders in a secure,
responsible manner in order to prevent loss of life and
property. It ensures that sensitive information regarding a
facility, where disclosure could present a potential risk,
developed under this Act shall not be made available for public
disclosure. However such information may be shared with state
and local government officials for purposes of carrying out
this Act. This section further ensures that first responders
are properly prepared and provided situational awareness when
responding to incidents at CFATS facilities without
compromising the security of the information. This section
allows the Secretary to disseminate information through any
medium or system deemed appropriate by the Secretary. It is the
Committee's intent that proprietary and chemical vulnerability
information shared pursuant to this section continues to be
protected against disclosure to unauthorized individuals and
the public.
New section 2104 of the Homeland Security Act of 2002--Civil
enforcement
This section specifies penalties for noncompliance and sets
the parameters of civil liability.
Subsection (a), Notice of Noncompliance, provides that if a
facility is found to be non-compliant the Secretary must first
present the facility with written notice of non-compliance
before the Department may issue fines or penalties. It further
specifies that in the event of continued non-compliance the
Secretary may assess a civil penalty, order a facility to cease
operations, or both.
Subsection (b), Civil Penalties, provides that civil
penalties may be assessed against a person who violates an
order under this Act. It further provides that any owner of a
chemical facility of interest who fails to comply with or
knowingly submits false information under the Act shall be
liable for a civil penalty.
Subsection (c), Emergency Orders, authorizes the Secretary
to direct a facility to implement emergency security measures,
or cease some or all operations if the Secretary determines
that there is a reasonable likelihood that a violation of the
CFATS regulations could result in death, serious illness,
severe personal injury, or substantial endangerment to the
public.
Subsection (d), Right of Action, clarifies that only the
Secretary (or his or her designee) may bring an action against
the owner or operator of a covered chemical facility to enforce
any of the Act's provision.
New section 2105 of the Homeland Security Act of 2002--Whistleblower
protections
This section clarifies whistleblower protections available
to chemical facility employees and contractors, and requires
these protections be publicly disclosed and advertised. It
requires the Secretary to establish a reporting procedure for
whistleblowers to report problems, deficiencies, or
vulnerabilities related to chemical security at a covered
chemical facility to DHS, and to protect the confidentiality of
an individual making a report. It further requires the
Secretary affirmatively acknowledge receipt of whistleblower
reports, if possible, and take appropriate steps to address any
problems the Department is able to substantiate.
This section also prohibits retaliatory actions against
whistleblowers by owners or operators of a chemical facility.
The section also clarifies that no employee is entitled to the
protection of this section if the employee makes false,
fictitious, or fraudulent statements or representations, and
that disclosures protected by other federal or state laws
remain in place.
New section 2106 of the Homeland Security Act of 2002--Relationship to
other laws
This section states that nothing in this Act supersedes
Federal law governing the manufacture, sale or handling of
chemical substances or mixtures. It also clarifies that States
and political subdivisions may adopt more stringent
requirements with respect to chemical facility security, unless
there is an actual conflict between this section and the law of
that State or subdivision.
New section 2107 of the Homeland Security Act of 2002--CFATS
regulations
This section specifies that the Department can continue to
follow previously-issued regulations, and does not need to
undertake a new rulemaking. This section also stipulates that
the Secretary shall rely on the authority provided in Title XXI
of the Homeland Security Act of 2002 in determining chemicals
of interest and relevant security risks, and determining
compliance with Title XXI.
New section 2108 of the Homeland Security Act of 2002--Small covered
chemical facilities
This section defines a ``small covered chemical facility''
as a facility with 100 employees or fewer. The House bill, in
contrast, defines such a facility as one having 350 or fewer
employees. The Committee believes that its definition more
accurately reflects the size of chemical facilities likely to
require the Departmental compliance assistance mandated under
the legislation. The section also allows the Secretary to
provide assistance and guidance to small covered chemical
facilities in the development of their physical security,
cybersecurity, recordkeeping, and reporting procedures. It
directs the Secretary to report to the authorizing committees
on best practices that may assist small chemical facilities in
meeting their physical security requirements under this title.
New section 2109 of the Homeland Security Act of 2002--Outreach to
chemical facilities of interest
This section directs the Secretary to develop an
implementation plan for outreach to chemical facilities of
interest in order to minimize the number of outliers.
Section 3--Assessment; reports
This section requires the Secretary to commission a third-
party study of vulnerability of covered chemical facilities to
acts of terrorism, and requires that the Secretary report to
Congress on a number of specific aspects of the CFATS program
within 18 months of enactment of this Act. It also provides for
GAO reports assessing the implementation of this Act, including
a review of the expedited approval program not later than three
years after enactment of this Act.
Section 4--Effective date; Conforming repeal
This section states that the Act shall take effect 30 days
after the date of enactment. The section also repeals the
previous authorization language, saying that it is superseded
by this Act.
Section 5--Termination
This section would sunset the program four years after
enactment.
V. Evaluation of Regulatory Impact
Pursuant to the requirement of paragraph 11(b)(1) of rule
XXVI of the Standing Rules of the Senate the Committee has
considered the regulatory impact of this bill. The bill as
amended would extend an existing regulatory program with a
number of changes. As indicated in the Congressional Budget
Office cost estimate for this bill (included below), the bill
as amended should not result in significant additional costs
beyond the current costs of complying with the CFATS program.
VI. Congressional Budget Office Cost Estimate
September 10, 2014.
Hon. Tom Carper,
Chairman, Committee on Homeland Security and Governmental Affairs, U.S.
Senate, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 4007, the
Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Jason
Wheelock.
Sincerely,
Douglas W. Elmendorf.
Enclosure.
H.R. 4007--Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014
H.R. 4007 would extend the Department of Homeland
Security's (DHS's) authority to regulate security at certain
chemical facilities in the United States. Under the Chemical
Facility Anti-Terrorism Standards (CFATS) program, DHS collects
and reviews information from chemical facilities in the United
States to determine which facilities present security risks.
Facilities determined to present a high level of security risk
are then required to develop a Site Security Plan (SSP). DHS in
turn conducts inspections to validate the adequacy of a
facility's SSP and their compliance with it. The program is set
to end on October 4, 2014.
H.R. 4007 would authorize CFATS for an additional four
years and would create an expedited review procedure for
facilities in the lower risk tiers of the CFATS program. Based
on amounts requested for the CFATS in fiscal year 2015 as well
as information from DHS, CBO estimates that continued
implementation of CFATS would require appropriations of $87
million in 2015 and slightly higher amounts in fiscal years
2016 through 2018 after accounting for the effects of
inflation. Assuming appropriation of the estimated amounts, CBO
estimates that implementing H.R. 4007 would result in outlays
of $349 million over the 2015-2019 period.
----------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
------------------------------------------------------------
2015 2016 2017 2018 2019 2015-2019
----------------------------------------------------------------------------------------------------------------
CHANGES IN SPENDING SUBJECT TO APPROPRIATION
Estimated Authorization Level...................... 87 89 92 95 0 363
Estimated Outlays.................................. 45 78 100 103 23 349
----------------------------------------------------------------------------------------------------------------
Enacting H.R. 4007 could result in the collection of
additional civil penalties, which are recorded as revenues and
deposited in the Treasury; therefore, pay-as-you-go procedures
apply. However, CBO estimates that such collections would be
insignificant. Enacting the bill would not affect direct
spending.
H.R. 4007 would extend intergovernmental and private-sector
mandates, as defined in the Unfunded Mandates Reform Act
(UMRA), on owners and operators of public and private
facilities where certain chemicals are present. Current law
requires owners and operators to assess the vulnerability of
their facilities to a terrorist incident and to prepare and
implement facility security plans. This bill would extend, for
four years, the authority of DHS to regulate those facilities
through minimum standards designed to protect facilities from
acts of terrorism and other security risks. The requirement to
meet those standards would be a mandate on public and private
entities.
The bill would impose an additional mandate on public and
private employers by prohibiting them from discharging or
discriminating against employees who report security problems
at a covered chemical facility.
Information from DHS indicates that owners and operators of
chemical facilities already meet the existing security
standards and that they would only need to make small changes
to administrative procedures to comply with the new
whistleblower protections for their employees. Therefore, CBO
estimates that the aggregate additional costs of complying with
the mandates would be small and would fall below the annual
thresholds established in UMRA for intergovernmental and
private-sector mandates ($76 million and $152 million,
respectively, in 2014, adjusted annually for inflation).
On May 30, 2014, CBO transmitted a cost estimate for H.R.
4007 as ordered reported by the House Committee on Homeland
Security on April 30, 2014. The difference in CBO's estimates
reflects differences in the two versions of the bill. The
version reported by the House Committee on Homeland Security
would permanently authorize CFATS and would authorize the
appropriation of $87 million for each of fiscal years 2015
through 2017. The Senate version of H.R. 4007 would extend
CFATS for four years and would not specify an authorization
level for any fiscal year. Based on those differences, CBO
estimates that implementing this version of the bill would cost
approximately $80 million less than the House version over the
2015-2019 period, assuming the appropriation of the estimated
amounts.
The CBO staff contacts for this estimate are Jason Wheelock
(for federal costs), Melissa Merrell (for the intergovernmental
impact), and Paige Piper/Bach (for the private-sector impact).
The estimate was approved by Theresa Gullo, Deputy Assistant
Director for Budget Analysis.
VII. Changes in Existing Statute Made by the Bill, as Reported
In compliance with paragraph 12 of rule XXVI of the
Standing Rules of the Senate, changes in existing law made by
H.R. 4007 as reported are shown as follows (existing law
proposed to be omitted is enclosed in brackets, new matter is
printed in italic, and existing law in which no change is
proposed is shown in roman):
DEPARTMENT OF HOMELAND SECURITY APPROPRIATIONS ACT OF 2007
* * * * * * *
[Sec. 550. (a) No later than six months after the date of
enactment of this Act, the Secretary of Homeland Security shall
issue interim final regulations establishing risk-based
performance standards for security of chemical facilities and
requiring vulnerability assessments and the development and
implementation of site security plans for chemical facilities:
Provided, That such regulations shall apply to chemical
facilities that, in the discretion of the Secretary, present
high levels of security risk: Provided further, That such
regulations shall permit each such facility, in developing and
implementing site security plans, to select layered security
measures that, in combination, appropriately address the
vulnerability assessment and the risk-based performance
standards for security for the facility: Provided further, That
the Secretary may not disapprove a site security plan submitted
under this section based on the presence or absence of a
particular security measure, but the Secretary may disapprove a
site security plan if the plan fails to satisfy the risk-based
performance standards established by this section: Provided
further, That the Secretary may approve alternative security
programs established by private sector entities, Federal,
State, or local authorities, or other applicable laws if the
Secretary determines that the requirements of such programs
meet the requirements of this section and the interim
regulations: Provided further, That the Secretary shall review
and approve each vulnerability assessment and site security
plan required under this section: Provided further, That the
Secretary shall not apply regulations issued pursuant to this
section to facilities regulated pursuant to the Maritime
Transportation Security Act of 2002, Public Law 107-295, as
amended; Public Water Systems, as defined by section 1401 of
the Safe Drinking Water Act, Public Law 93-523, as amended;
Treatment Works as defined in section 212 of the Federal Water
Pollution Control Act, Public Law 92-500, as amended; any
facility owned or operated by the Department of Defense or the
Department of Energy, or any facility subject to regulation by
the Nuclear Regulatory Commission.]
[(b) Interim regulations issued under this section shall
apply until the effective date of interim or final regulations
promulgated under other laws that establish requirements and
standards referred to in subsection (a) and expressly supersede
this section: Provided, That the authority provided by this
section shall terminate three years after the date of enactment
of this Act.]
[(c) Notwithstanding any other provision of law and
subsection (b), information developed under this section,
including vulnerability assessments, site security plans, and
other security related information, records, and documents
shall be given protections from public disclosure consistent
with similar information developed by chemical facilities
subject to regulation under section 70103 of title 46, United
States Code: Provided, That this subsection does not prohibit
the sharing of such information, as the Secretary deems
appropriate, with State and local government officials
possessing the necessary security clearances, including law
enforcement officials and first responders, for the purpose of
carrying out this section, provided that such information may
not be disclosed pursuant to any State or local law: Provided
further, That in any proceeding to enforce this section,
vulnerability assessments, site security plans, and other
information submitted to or obtained by the Secretary under
this section, and related vulnerability or security
information, shall be treated as if the information were
classified material.]
[(d) Any person who violates an order issued under this
section shall be liable for a civil penalty under section
70119(a) of title 46, United States Code: Provided, That
nothing in this section confers upon any person except the
Secretary a right of action against an owner or operator of a
chemical facility to enforce any provision of this section. (e)
The Secretary of Homeland Security shall audit and inspect
chemical facilities for the purposes of determining compliance
with the regulations issued pursuant to this section.]
[(f) Nothing in this section shall be construed to
supersede, amend, alter, or affect any Federal law that
regulates the manufacture, distribution in commerce, use, sale,
other treatment, or disposal of chemical substances or
mixtures.]
[(g) If the Secretary determines that a chemical facility
is not in compliance with this section, the Secretary shall
provide the owner or operator with written notification
(including a clear explanation of deficiencies in the
vulnerability assessment and site security plan) and
opportunity for consultation, and issue an order to comply by
such date as the Secretary determines to be appropriate under
the circumstances: Provided, That if the owner or operator
continues to be in noncompliance, the Secretary may issue an
order for the facility to cease operation, until the owner or
operator complies with the order.]
[(h) This section shall not preclude or deny any right of
any State or political subdivision thereof to adopt or enforce
any regulation, requirement, or standard of performance with
respect to chemical facility security that is more stringent
than a regulation, requirement, or standard of performance
issued under this section, or otherwise impair any right or
jurisdiction of any State with respect to chemical facilities
within that State, unless there is an actual conflict between
this section and the law of that State.]
* * * * * * *
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) * * *
(b) Table of Contents.--The table of contents for this Act
is as follows:
* * * * * * *
TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS
Sec. 2101. Definitions.
Sec. 2102. Chemical Facility Anti-Terrorism Standards Program.
Sec. 2103. Protection and sharing of information.
Sec. 2104. Civil enforcement.
Sec. 2105. Whistleblower protections.
Sec. 2106. Relationship to other laws.
Sec. 2107. CFATS regulations.
Sec. 2108. Small covered chemical facilities.
Sec. 2109. Outreach to chemical facilities of interest.
* * * * * * *
TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS
SEC. 2101. DEFINITIONS.
In this title--
(1) the term ``CFATS regulation'' means--
(A) an existing CFATs regulation; and
(B) any regulation or amendment to an
existing CFATS regulation issued pursuant to
the authority under section 2107;
(2) the term ``chemical facility of interest'' means
a facility that--
(A) holds, or that the Secretary has a
reasonable basis to believe holds, a chemical
of interest, as designated under Appendix A to
part 27 of title 6, Code of Federal
Regulations, or any successor thereto, at a
threshold quantity set pursuant to relevant
risk-related security principles; and
(B) is not an excluded facility;
(3) the term ``covered chemical facility'' means a
facility that--
(A) the Secretary--
(i) identifies as a chemical facility
of interest; and
(ii) based upon review of the
facility's Top-Screen, determines meets
the risk criteria developed under
section 2102(e)(2)(B); and
(B) is not an excluded facility;
(4) the term ``excluded facility'' means--
(A) a facility regulated under the Maritime
Transportation Security Act of 2002 (Public Law
107-295; 116 Stat. 2064);
(B) a public water system, as that term is
defined in section 1401 of the Safe Drinking
Water Act (42 U.S.C. 300f);
(C) a Treatment Works, as that term is
defined in section 212 of the Federal Water
Pollution Control Act (33 U.S.C. 1292);
(D) a facility owned or operated by the
Department of Defense or the Department of
Energy; or
(E) a facility subject to regulation by the
Nuclear Regulatory Commission, or by a State
that has entered into an agreement with the
Nuclear Regulatory Commission under section 274
b. of the Atomic Energy Act of 1954 (42 U.S.C.
2021(b)) to protect against unauthorized access
of any material, activity, or structure
licensed by the Nuclear Regulatory Commission;
(5) the term ``existing CFATS regulation'' means--
(A) a regulation promulgated under section
550 of the Department of Homeland Security
Appropriations Act, 2007 (Public Law 109-295; 6
U.S.C. 121 note) that is in effect on the day
before the date of enactment of the Protecting
and Securing Chemical Facilities from Terrorist
Attacks Act of 2014; and
(B) a Federal Register notice or other
published guidance relating to section 550 of
the Department of Homeland Security
Appropriations Act, 2007 that is in effect on
the day before the date of enactment of the
Protecting and Securing Chemical Facilities
from Terrorist Attacks Act of 2014;
(6) the term ``expedited approval facility'' means a
covered chemical facility for which the owner or
operator elects to submit a site security plan in
accordance with section 2102(c)(4);
(7) the term ``facially deficient'', relating to a
site security plan, means a site security plan that
does not support a certification that the security
measures in the plan address the security vulnerability
assessment and the risk-based performance standards for
security for the facility, based on a review of--
(A) the facility's site security plan;
(B) the facility's Top-Screen;
(C) the facility's security vulnerability
assessment; or
(D) any other information that--
(i) the facility submits to the
Department; or
(ii) the Department obtains from a
public source or other source;
(8) the term ``guidance for expedited approval
facilities'' means the guidance issued under section
2102(c)(4)(B)(i);
(9) the term ``risk assessment'' means the
Secretary's application of relevant risk criteria
identified in section 2102(e)(2)(B);
(10) the term ``terrorist screening database'' means
the terrorist screening database maintained by the
Federal Government Terrorist Screening Center or its
successor;
(11) the term ``tier'' has the meaning given the term
in section 27.105 of title 6, Code of Federal
Regulations, or any successor thereto;
(12) the terms ``tiering'' and ``tiering
methodology'' mean the procedure by which the Secretary
assigns a tier to each covered chemical facility based
on the risk assessment for that covered chemical
facility;
(13) the term ``Top-Screen'' has the meaning given
the term in section 27.105 of title 6, Code of Federal
Regulations, or any successor thereto; and
(14) the term ``vulnerability assessment'' means the
identification of weaknesses in the security of a
chemical facility of interest.
SEC. 2102. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM.
(a) Program Established.--
(1) In general.--There is in the Department a
Chemical Facility Anti-Terrorism Standards Program.
(2) Requirements.--In carrying out the Chemical
Facility Anti-Terrorism Standards Program, the
Secretary shall--
(A) identify--
(i) chemical facilities of interest;
and
(ii) covered chemical facilities;
(B) require each chemical facility of
interest to submit a Top-Screen and any other
information the Secretary determines necessary
to enable the Department to assess the security
risks associated with the facility;
(C) establish risk-based performance
standards designed to address high levels of
security risk at covered chemical facilities;
and
(D) require each covered chemical facility
to--
(i) submit a security vulnerability
assessment; and
(ii) develop, submit, and implement a
site security plan.
(b) Security Measures.--A facility, in developing a site
security plan as required under subsection (a), shall include
security measures that, in combination, appropriately address
the security vulnerability assessment and the risk-based
performance standards for security for the facility.
(c) Approval or Disapproval of Site Security Plans.--
(1) In general.--
(A) Review.--Except as provided in paragraph
(4), the Secretary shall review and approve or
disapprove each site security plan submitted
pursuant to subsection (a).
(B) Bases for disapproval.--The Secretary--
(i) may not disapprove a site
security plan based on the presence or
absence of a particular security
measure; and
(ii) shall disapprove a site security
plan if the plan fails to satisfy the
risk-based performance standards
established pursuant to subsection
(a)(2)(C).
(2) Alternative security programs.--
(A) Authority to approve.--
(i) In general.--The Secretary may
approve an alternative security program
established by a private sector entity
or a Federal, State, or local authority
or under other applicable laws, if the
Secretary determines that the
requirements of the program meet the
requirements under this section.
(ii) Additional security measures.--
If the requirements of an alternative
security program do not meet the
requirements under this section, the
Secretary may recommend additional
security measures to the program that
will enable the Secretary to approve
the program.
(B) Satisfaction of site security plan
requirement.--A covered chemical facility may
satisfy the site security plan requirement
under subsection (a) by adopting an alternative
security program that the Secretary has--
(i) reviewed and approved under
subparagraph (A); and
(ii) determined to be appropriate for
the operations and security concerns of
the covered chemical facility.
(3) Site security plan assessments.--
(A) Risk assessment policies and
procedures.--In approving or disapproving a
site security plan under this subsection, the
Secretary shall employ the risk assessment
policies and procedures developed under this
title.
(B) Previously approved plans.--In the case
of a covered chemical facility for which the
Secretary approved a site security plan before
the date of enactment of the Protecting and
Securing Chemical Facilities from Terrorist
Attacks Act of 2014, the Secretary may not
require the facility to resubmit the site
security plan solely by reason of the enactment
of this title.
(4) Expedited approval program.--
(A) In general.--A covered chemical facility
assigned to tier 3 or 4 may meet the
requirement to develop and submit a site
security plan under subsection (a)(2)(D) by
developing and submitting to the Secretary--
(i) a site security plan and the
certification described in subparagraph
(C); or
(ii) a site security plan in
conformance with a template authorized
under subparagraph (H).
(B) Guidance for expedited approval
facilities.--
(i) In general.--Not later than 180
days after the date of enactment of the
Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall issue
guidance for expedited approval
facilities that identifies specific
security measures that are sufficient
to meet the risk-based performance
standards.
(ii) Material deviation from
guidance.--If a security measure in the
site security plan of an expedited
approval facility materially deviates
from a security measure in the guidance
for expedited approval facilities, the
site security plan shall include an
explanation of how such security
measure meets the risk-based
performance standards.
(iii) Process.--In developing and
issuing, or amending, the guidance for
expedited approval facilities under
this subparagraph and in collecting
information from expedited approval
facilities, the Secretary--
(I) shall consult with--
(aa) Sector
Coordinating Councils
established under
sections 201 and
871(a); and
(bb) appropriate
labor organizations;
and
(II) shall not be subject to
section 553 of title 5, United
States Code, the National
Environmental Policy Act of
1969 (42 U.S.C. 4321 et seq.),
subchapter I of chapter 35 of
title 44, United States Code,
or section 2107(b) of this
title.
(C) Certification.--The owner or operator of
an expedited approval facility shall submit to
the Secretary a certification, signed under
penalty of perjury, that--
(i) the owner or operator is familiar
with the requirements of this title and
part 27 of title 6, Code of Federal
Regulations, or any successor thereto,
and the site security plan being
submitted;
(ii) the site security plan includes
the security measures required by
subsection (b);
(iii)(I) the security measures in the
site security plan do not materially
deviate from the guidance for expedited
approval facilities except where
indicated in the site security plan;
(II) any deviations from the guidance
for expedited approval facilities in
the site security plan meet the risk-
based performance standards for the
tier to which the facility is assigned;
and
(III) the owner or operator has
provided an explanation of how the site
security plan meets the risk-based
performance standards for any material
deviation;
(iv) the owner or operator has
visited, examined, documented, and
verified that the expedited approval
facility meets the criteria set forth
in the site security plan;
(v) the expedited approval facility
has implemented all of the required
performance measures outlined in the
site security plan or set out planned
measures that will be implemented
within a reasonable time period stated
in the site security plan;
(vi) each individual responsible for
implementing the site security plan is
fully aware of the requirements
relevant to the individual's
responsibility contained in the site
security plan and is competent to carry
out those requirements; and
(vii) the owner or operator has
committed, or, in the case of planned
measures will commit, the necessary
resources to fully implement the site
security plan.
(D) Deadline.--
(i) In general.--Not later than 120
days after the date described in clause
(ii), the owner or operator of an
expedited approval facility shall
submit to the Secretary the site
security plan and the certification
described in subparagraph (C).
(ii) Date.--The date described in
this clause is--
(I) for an expedited approval
facility that was assigned to
tier 3 or 4 under existing
CFATS regulations before the
date of enactment of the
Protecting and Securing
Chemical Facilities from
Terrorist Attacks Act of 2014,
the date that is 210 days after
the date of enactment of that
Act; and
(II) for any expedited
approval facility not described
in subclause (I), the later
of--
(aa) the date on
which the expedited
approval facility is
assigned to tier 3 or 4
under subsection
(e)(2)(A); or
(bb) the date that is
210 days after the date
of enactment of the
Protecting and Securing
Chemical Facilities
from Terrorist Attacks
Act of 2014.
(iii) Notice.--An owner or operator
of an expedited approval facility shall
notify the Secretary of the intent of
the owner or operator to certify the
site security plan for the expedited
approval facility not later than 30
days before the date on which the owner
or operator submits the site security
plan and certification described in
subparagraph (C).
(E) Compliance.--
(i) In general.--For an expedited
approval facility submitting a site
security plan and certification in
accordance with subparagraphs (A), (B),
(C), and (D)--
(I) the expedited approval
facility shall comply with all
of the requirements of its site
security plan; and
(II) the Secretary--
(aa) except as
provided in
subparagraph (G), may
not disapprove the site
security plan; and
(bb) may audit and
inspect the expedited
approval facility under
subsection (d) to
verify compliance with
its site security plan.
(ii) Noncompliance.--If the Secretary
determines an expedited approval
facility is not in compliance with the
requirements of the site security plan
or is otherwise in violation of this
title, the Secretary may enforce
compliance in accordance with section
2104.
(F) Amendments to site security plan.--
(i) Requirement.--
(I) In general.--If the owner
or operator of an expedited
approval facility amends a site
security plan submitted under
subparagraph (A), the owner or
operator shall submit the
amended site security plan and
a certification relating to the
amended site security plan that
contains the information
described in subparagraph (C).
(II) Technical amendments.--
For purposes of this clause, an
amendment to a site security
plan includes any technical
amendment to the site security
plan.
(ii) Amendment required.--The owner
or operator of an expedited approval
facility shall amend the site security
plan if--
(I) there is a change in the
design, construction,
operation, or maintenance of
the expedited approval facility
that affects the site security
plan;
(II) the Secretary requires
additional security measures or
suspends a certification and
recommends additional security
measures under subparagraph
(G); or
(III) the owner or operator
receives notice from the
Secretary of a change in
tiering under subsection
(e)(3).
(iii) Deadline.--An amended site
security plan and certification shall
be submitted under clause (i)--
(I) in the case of a change
in design, construction,
operation, or maintenance of
the expedited approval facility
that affects the security plan,
not later than 120 days after
the date on which the change in
design, construction,
operation, or maintenance
occurred;
(II) in the case of the
Secretary requiring additional
security measures or suspending
a certification and
recommending additional
security measures under
subparagraph (G), not later
than 120 days after the date on
which the owner or operator
receives notice of the
requirement for additional
security measures or suspension
of the certification and
recommendation of additional
security measures; and
(III) in the case of a change
in tiering, not later than 120
days after the date on which
the owner or operator receives
notice under subsection (e)(3).
(G) Facially deficient site security plans.--
(i) Prohibition.--Notwithstanding
subparagraph (A) or (E), the Secretary
may suspend the authority of a covered
chemical facility to certify a site
security plan if the Secretary--
(I) determines the certified
site security plan or an
amended site security plan is
facially deficient; and
(II) not later than 100 days
after the date on which the
Secretary receives the site
security plan and
certification, provides the
covered chemical facility with
written notification that the
site security plan is facially
deficient, including a clear
explanation of each deficiency
in the site security plan.
(ii) Additional security measures.--
(I) In general.--If, during
or after a compliance
inspection of an expedited
approval facility, the
Secretary determines that
planned or implemented security
measures in the site security
plan of the facility are
insufficient to meet the risk-
based performance standards
based on misrepresentation,
omission, or an inadequate
description of the site, the
Secretary may--
(aa) require
additional security
measures; or
(bb) suspend the
certification of the
facility.
(II) Recommendation of
additional security measures.--
If the Secretary suspends the
certification of an expedited
approval facility under
subclause (I), the Secretary
shall--
(aa) recommend
specific additional
security measures that,
if made part of the
site security plan by
the facility, would
enable the Secretary to
approve the site
security plan; and
(bb) provide the
facility an opportunity
to submit a new or
modified site security
plan and certification
under subparagraph (A).
(III) Submission; review.--If
an expedited approval facility
determines to submit a new or
modified site security plan and
certification as authorized
under subclause (II)(bb)--
(aa) not later than
90 days after the date
on which the facility
receives
recommendations under
subclause (II)(aa), the
facility shall submit
the new or modified
plan and certification;
and
(bb) not later than
45 days after the date
on which the Secretary
receives the new or
modified plan under
item (aa), the
Secretary shall review
the plan and determine
whether the plan is
facially deficient.
(IV) Determination not to
include additional security
measures.--
(aa) Revocation of
certification.--If an
expedited approval
facility does not agree
to include in its site
security plan specific
additional security
measures recommended by
the Secretary under
subclause (II)(aa), or
does not submit a new
or modified site
security plan in
accordance with
subclause (III), the
Secretary may revoke
the certification of
the facility by issuing
an order under section
2104(a)(1)(B).
(bb) Effect of
revocation.--If the
Secretary revokes the
certification of an
expedited approval
facility under item
(aa) by issuing an
order under section
2104(a)(1)(B)--
(AA) the
order shall
require the
owner or
operator of the
facility to
submit a site
security plan
or alternative
security
program for
review by the
Secretary
review under
subsection
(c)(1); and
(BB) the
facility shall
no longer be
eligible to
certify a site
security plan
under this
paragraph.
(V) Facial deficiency.--If
the Secretary determines that a
new or modified site security
plan submitted by an expedited
approval facility under
subclause (III) is facially
deficient--
(aa) not later than
120 days after the date
of the determination,
the owner or operator
of the facility shall
submit a site security
plan or alternative
security program for
review by the Secretary
under subsection
(c)(1); and
(bb) the facility
shall no longer be
eligible to certify a
site security plan
under this paragraph.
(H) Templates.--
(i) In general.--The Secretary may
develop prescriptive site security plan
templates with specific security
measures to meet the risk-based
performance standards under subsection
(a)(2)(C) for adoption and
certification by a covered chemical
facility assigned to tier 3 or 4 in
lieu of developing and certifying its
own plan.
(ii) Process.--In developing and
issuing, or amending, the site security
plan templates under this subparagraph,
issuing guidance for implementation of
the templates, and in collecting
information from expedited approval
facilities, the Secretary--
(I) shall consult with--
(aa) Sector
Coordinating Councils
established under
sections 201 and
871(a); and
(bb) appropriate
labor organizations;
and
(II) shall not be subject to
section 553 of title 5, United
States Code, the National
Environmental Policy Act of
1969 (42 U.S.C. 4321 et seq.),
subchapter I of chapter 35 of
title 44, United States Code,
or section 2107(b) of this
title.
(iii) Rule of construction.--Nothing
in this subparagraph shall be construed
to prevent a covered chemical facility
from developing and certifying its own
security plan in accordance with
subparagraph (A).
(I) Evaluation.--
(i) In general.--Not later than 18
months after the date of enactment of
the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall take any
appropriate action necessary for a full
evaluation of the expedited approval
program authorized under this
paragraph, including conducting an
appropriate number of inspections, as
authorized under subsection (d), of
expedited approval facilities.
(ii) Report.--Not later than 18
months after the date of enactment of
the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall submit to
the Committee on Homeland Security and
Governmental Affairs of the Senate and
the Committee on Homeland Security of
the House of Representatives a report
that contains--
(I) any costs and
efficiencies associated with
the expedited approval program
authorized under this
paragraph;
(II) the impact of the
expedited approval program on
the backlog for site security
plan approval and authorization
inspections;
(III) an assessment of the
ability of expedited approval
facilities to submit facially
sufficient site security plans;
(IV) an assessment of any
impact of the expedited
approval program on the
security of chemical
facilities; and
(V) a recommendation by the
Secretary on the frequency of
compliance inspections that may
be required for expedited
approval facilities.
(d) Compliance.--
(1) Audits and inspections.--
(A) Definitions.--In this paragraph--
(i) the term ``nondepartmental''--
(I) with respect to
personnel, means personnel that
is not employed by the
Department; and
(II) with respect to an
entity, means an entity that is
not a component or other
authority of the Department;
and
(ii) the term ``nongovernmental''--
(I) with respect to
personnel, means personnel that
is not employed by the Federal
Government; and
(II) with respect to an
entity, means an entity that is
not an agency, department, or
other authority of the Federal
Government.
(B) Authority to conduct audits and
inspections.--The Secretary shall conduct
audits or inspections under this title using--
(i) employees of the Department; or
(ii) nondepartmental or
nongovernmental personnel approved by
the Secretary.
(C) Support personnel.--The Secretary may use
nongovernmental personnel to provide
administrative and logistical services in
support of audits and inspections under this
title.
(D) Reporting structure.--
(i) Nondepartmental and
nongovernmental audits and
inspections.--Any audit or inspection
conducted by an individual employed by
a nondepartmental or nongovernmental
entity shall be assigned in
coordination with a regional supervisor
with responsibility for supervising
inspectors within the Infrastructure
Security Compliance Division of the
Department for the region in which the
audit or inspection is to be conducted.
(ii) Requirement to report.--While an
individual employed by a
nondepartmental or nongovernmental
entity is in the field conducting an
audit or inspection under this
subsection, the individual shall report
to the regional supervisor with
responsibility for supervising
inspectors within the Infrastructure
Security Compliance Division of the
Department for the region in which the
individual is operating.
(iii) Approval.--The authority to
approve a site security plan under
subsection (c) or determine if a
covered chemical facility is in
compliance with an approved site
security plan shall be exercised solely
by the Secretary or a designee of the
Secretary within the Department.
(E) Standards for auditors and inspectors.--
The Secretary shall prescribe standards for the
training and retraining of each individual used
by the Department as an auditor or inspector,
including each individual employed by the
Department and all nondepartmental or
nongovernmental personnel, including--
(i) minimum training requirements for
new auditors and inspectors;
(ii) retraining requirements;
(iii) minimum education and
experience levels;
(iv) the submission of information as
required by the Secretary to enable
determination of whether the auditor or
inspector has a conflict of interest;
(v) the proper certification or
certifications necessary to handle
chemical-terrorism vulnerability
information (as defined in section
27.105 of title 6, Code of Federal
Regulations, or any successor thereto);
(vi) the reporting of any issue of
non-compliance with this section to the
Secretary within 24 hours; and
(vii) any additional qualifications
for fitness of duty as the Secretary
may require.
(F) Conditions for nongovernmental auditors
and inspectors.--If the Secretary arranges for
an audit or inspection under subparagraph (B)
to be carried out by a nongovernmental entity,
the Secretary shall--
(i) prescribe standards for the
qualification of the individuals who
carry out such audits and inspections
that are commensurate with the
standards for similar Government
auditors or inspectors; and
(ii) ensure that any duties carried
out by a nongovernmental entity are not
inherently governmental functions.
(2) Personnel surety.--
(A) Personnel surety program.--For purposes
of this title, the Secretary shall establish
and carry out a Personnel Surety Program that--
(i) does not require an owner or
operator of a covered chemical facility
that voluntarily participates in the
program to submit information about an
individual more than one time;
(ii) provides a participating owner
or operator of a covered chemical
facility with relevant information
about an individual based on vetting
the individual against the terrorist
screening database, to the extent that
such feedback is necessary for the
facility to be in compliance with
regulations promulgated under this
title; and
(iii) provides redress to an
individual--
(I) whose information was
vetted against the terrorist
screening database under the
program; and
(II) who believes that the
personally identifiable
information submitted to the
Department for such vetting by
a covered chemical facility, or
its designated representative,
was inaccurate.
(B) Personnel surety program
implementation.--To the extent that a risk-
based performance standard established under
subsection (a) requires identifying individuals
with ties to terrorism--
(i) a covered chemical facility may
satisfy its obligation under the
standard by using any Federal screening
program that periodically vets
individuals against the terrorist
screening database, or any successor
program, including the Personnel Surety
Program established under subparagraph
(A); and
(ii) the Secretary may not require a
covered chemical facility to submit any
information about an individual unless
the individual--
(I) is to be vetted under the
Personnel Surety Program; or
(II) has been identified as
presenting a terrorism security
risk.
(3) Availability of information.--The Secretary shall
share with the owner or operator of a covered chemical
facility any information that the owner or operator
needs to comply with this section.
(e) Responsibilities of the Secretary.--
(1) Identification of chemical facilities of
interest.--In carrying out this title, the Secretary
shall consult with the heads of other Federal agencies,
States and political subdivisions thereof, relevant
business associations, and public and private labor
organizations to identify all chemical facilities of
interest.
(2) Risk assessment.--
(A) In general.--For purposes of this title,
the Secretary shall develop a security risk
assessment approach and corresponding tiering
methodology for covered chemical facilities
that incorporates the relevant elements of
risk, including threat, vulnerability, and
consequence.
(B) Criteria for determining security risk.--
The criteria for determining the security risk
of terrorism associated with a covered chemical
facility shall take into account--
(i) relevant threat information;
(ii) potential economic consequences
and the potential loss of human life in
the event of the facility being subject
to a terrorist attack, compromise,
infiltration, or exploitation; and
(iii) vulnerability of the facility
to a terrorist attack, compromise,
infiltration, or exploitation.
(3) Changes in tiering.--
(A) Maintenance of records.--The Secretary
shall document the basis for each instance in
which--
(i) tiering for a covered chemical
facility is changed; or
(ii) a covered chemical facility is
determined to no longer be subject to
the requirements under this title.
(B) Required information.--The records
maintained under subparagraph (A) shall include
information on whether and how the Secretary
confirmed the information that was the basis
for the change or determination described in
subparagraph (A).
(4) Semiannual performance reporting.--Not later than
6 months after the date of enactment of the Protecting
and Securing Chemical Facilities from Terrorist Attacks
Act of 2014, and not less frequently than once every 6
months thereafter, the Secretary shall submit to the
Committee on Homeland Security and Governmental Affairs
of the Senate and the Committee on Homeland Security of
the House of Representatives a report that describes,
for the period covered by the report--
(A) the number of covered chemical facilities
in the United States;
(B) the average number of days spent
reviewing site security or an alternative
security program for a covered chemical
facility prior to approval;
(C) the number of covered chemical facilities
inspected;
(D) the average number of covered chemical
facilities inspected per inspector; and
(E) any other information that the Secretary
determines will be helpful to Congress in
evaluating the performance of the Chemical
Facility Anti-Terrorism Standards Program.
SEC. 2103. PROTECTION AND SHARING OF INFORMATION.
(a) In General.--Notwithstanding any other provision of
law, information developed under this title, including
vulnerability assessments, site security plans, and other
security related information, records, and documents shall be
given protections from public disclosure consistent with the
protection of similar information under section 70103(d) of
title 46, United States Code.
(b) Sharing of Information With States and Local
Governments.--Nothing in this section shall be construed to
prohibit the sharing of information developed under this title,
as the Secretary determines appropriate, with State and local
government officials possessing a need to know and the
necessary security clearances, including law enforcement
officials and first responders, for the purpose of carrying out
this title.
(c) Sharing of Information With First Responders.--
(1) Requirement.--The Secretary shall provide to
State, local, and regional fusion centers (as that term
is defined in section 210A(j)(1)) and State and local
government officials, as the Secretary determines
appropriate, such information as is necessary to help
ensure that first responders are properly prepared and
provided with the situational awareness needed to
respond to security incidents at covered chemical
facilities.
(2) Dissemination.--The Secretary shall disseminate
information under paragraph (1) through a medium or
system determined by the Secretary to be appropriate to
ensure the secure and expeditious dissemination of such
information to necessary selected individuals.
(d) Enforcement Proceedings.--In any proceeding to enforce
this section, vulnerability assessments, site security plans,
and other information submitted to or obtained by the Secretary
under this title, and related vulnerability or security
information, shall be treated as if the information were
classified information.
(e) Availability of Information.--Notwithstanding any other
provision of law (including section 552(b)(3) of title 5,
United States Code), section 552 of title 5, United States Code
(commonly known as the Freedom of Information Act') shall not
apply to information protected from public disclosure pursuant
to subsection (a) of this section.
SEC. 2104. CIVIL ENFORCEMENT.
(a) Notice of Noncompliance.--
(1) Notice.--If the Secretary determines that a
covered chemical facility is not in compliance with
this title, the Secretary shall--
(A) provide the owner or operator of the
facility with--
(i) not later than 14 days after date
on which the Secretary makes the
determination, a written notification
of noncompliance that includes a clear
explanation of any deficiency in the
security vulnerability assessment or
site security plan; and
(ii) an opportunity for consultation
with the Secretary or the Secretary's
designee; and
(B) issue to the owner or operator of the
facility an order to comply with this title by
a date specified by the Secretary in the order,
which date shall be not later than 180 days
after the date on which the Secretary issues
the order.
(2) Continued noncompliance.--If an owner or operator
continues to be in noncompliance with this title after
the date specified in an order issued under paragraph
(1)(B), the Secretary may enter an order in accordance
with this section assessing a civil penalty, an order
to cease operations, or both.
(b) Civil Penalties.--
(1) Violations of orders.--Any person who violates an
order issued under this title shall be liable for a
civil penalty under section 70119(a) of title 46,
United States Code.
(2) Non-reporting chemical facilities of interest.--
Any owner of a chemical facility of interest who fails
to comply with, or knowingly submits false information
under, this title or the CFATS regulations shall be
liable for a civil penalty under section 70119(a) of
title 46, United States Code.
(c) Emergency Orders.--
(1) In general.--Notwithstanding subsection (a) or
any site security plan or alternative security program
approved under this title, if the Secretary determines
that there is a reasonable likelihood that a violation
of this title or the CFATS regulations by a chemical
facility could result in death, serious illness, severe
personal injury, or substantial endangerment to the
public, the Secretary may direct the facility,
effective immediately or as soon as practicable, to--
(A) cease some or all operations; or
(B) implement appropriate emergency security
measures.
(2) Limitation on delegation.--The Secretary may not
delegate the authority under paragraph (1) to any
official other than the Under Secretary for the
National Protection and Programs Directorate.
(d) Right of Action.--Nothing in this title confers upon
any person except the Secretary or his or her designee a right
of action against an owner or operator of a covered chemical
facility to enforce any provision of this title.
SEC. 2105. WHISTLEBLOWER PROTECTIONS.
(a) Procedure for Reporting Problems.--
(1) Establishment of a reporting procedure.--Not
later than 180 days after the date of enactment of the
Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2014, the Secretary shall
establish, and provide information to the public
regarding, a procedure under which any employee or
contractor of a chemical facility may submit a report
to the Secretary regarding problems, deficiencies, or
vulnerabilities at a covered chemical facility that are
associated with the risk of a chemical facility
terrorist incident.
(2) Confidentiality.--The Secretary shall keep
confidential the identity of an individual who submits
a report under paragraph (1) and any such report shall
be treated as a record containing protected information
to the extent that the report does not consist of
publicly available information.
(3) Acknowledgment of receipt.--If a report submitted
under paragraph (1) identifies the individual making
the report, the Secretary shall promptly respond to the
individual directly and shall promptly acknowledge
receipt of the report.
(4) Steps to address problems.--The Secretary shall--
(A) review and consider the information
provided in any report submitted under
paragraph (1); and
(B) take appropriate steps under this title
if necessary to address any substantiated
problems, deficiencies, or vulnerabilities
associated with the risk of a chemical facility
terrorist incident identified in the report.
(5) Retaliation prohibited.--
(A) In general.--An owner or operator of a
covered chemical facility or agent thereof may
not discharge an employee or otherwise
discriminate against an employee with respect
to the compensation provided to, or terms,
conditions, or privileges of the employment of,
the employee because the employee (or an
individual acting pursuant to a request of the
employee) submitted a report under paragraph
(1).
(B) Exception.--An employee shall not be
entitled to the protections under this section
if the employee--
(i) knowingly and willfully makes any
false, fictitious, or fraudulent
statement or representation; or
(ii) uses any false writing or
document knowing the writing or
document contains any false,
fictitious, or fraudulent statement or
entry.
(b) Protected Disclosures.--Nothing in this title shall be
construed to limit the right of an individual to make any
disclosure--
(1) protected or authorized under section 2302(b)(8)
or 7211 of title 5, United States Code;
(2) protected under any other Federal or State law
that shields the disclosing individual against
retaliation or discrimination for having made the
disclosure in the public interest; or
(3) to the Special Counsel of an agency, the
inspector general of an agency, or any other employee
designated by the head of an agency to receive
disclosures similar to the disclosures described in
paragraphs (1) and (2).
(c) Publication of Rights.--The Secretary, in partnership
with industry associations and labor organizations, shall make
publicly available both physically and online the rights that
an individual who discloses information, including security-
sensitive information, regarding problems, deficiencies, or
vulnerabilities at a covered chemical facility would have under
Federal whistleblower protection laws or this title.
(d) Protected Information.--All information contained in a
report made under this subsection (a) shall be protected in
accordance with section 2103.
SEC. 2106. RELATIONSHIP TO OTHER LAWS.
(a) Other Federal Laws.--Nothing in this title shall be
construed to supersede, amend, alter, or affect any Federal law
that regulates the manufacture, distribution in commerce, use,
sale, other treatment, or disposal of chemical substances or
mixtures.
(b) States and Political Subdivisions.--This title shall
not preclude or deny any right of any State or political
subdivision thereof to adopt or enforce any regulation,
requirement, or standard of performance with respect to
chemical facility security that is more stringent than a
regulation, requirement, or standard of performance issued
under this section, or otherwise impair any right or
jurisdiction of any State with respect to chemical facilities
within that State, unless there is an actual conflict between
this section and the law of that State.
SEC. 2107. CFATS REGULATIONS.
(a) General Authority.--The Secretary may, in accordance
with chapter 5 of title 5, United States Code, promulgate
regulations or amend existing CFATS regulations to implement
the provisions under this title.
(b) Existing CFATS Regulations.--
(1) In general.--Notwithstanding section 4(b) of the
Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2014, each existing CFATS
regulation shall remain in effect unless the Secretary
amends, consolidates, or repeals the regulation.
(2) Repeal.--Not later than 30 days after the date of
enactment of the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act of 2014, the
Secretary shall repeal any existing CFATS regulation
that the Secretary determines is duplicative of, or
conflicts with, this title.
(c) Authority.--The Secretary shall exclusively rely upon
authority provided under this title in--
(1) determining compliance with this title;
(2) identifying chemicals of interest; and
(3) determining security risk associated with a
chemical facility.
SEC. 2108. SMALL COVERED CHEMICAL FACILITIES.
(a) Definition.--In this section, the term ``small covered
chemical facility'' means a covered chemical facility that--
(1) has fewer than 100 employees employed at the
covered chemical facility; and
(2) is owned and operated by a small business concern
(as defined in section 3 of the Small Business Act (15
U.S.C. 632)).
(b) Assistance to Facilities.--The Secretary may provide
guidance and, as appropriate, tools, methodologies, or computer
software, to assist small covered chemical facilities in
developing the physical security, cybersecurity, recordkeeping,
and reporting procedures required under this title.
(c) Report.--The Secretary shall submit to the Committee on
Homeland Security and Governmental Affairs of the Senate and
the Committee on Homeland Security of the House of
Representatives a report on best practices that may assist
small covered chemical facilities in development of physical
security best practices.
SEC. 2109. OUTREACH TO CHEMICAL FACILITIES OF INTEREST.
Not later than 90 days after the date of enactment of the
Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014, the Secretary shall establish an outreach
implementation plan, in coordination with the heads of other
appropriate Federal and State agencies, relevant business
associations, and public and private labor organizations, to--
(1) identify chemical facilities of interest; and
(2) make available compliance assistance materials
and information on education and training.