Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2018
A BILL
To reauthorize the Chemical Facility Anti-Terrorism Standards Program of the Department of Homeland Security.
2. Definitions
Section 2101 of the Homeland Security Act of 2002 (6 U.S.C. 621) is amended—
in paragraph (2)(A), by striking “, or that the Secretary has a reasonable basis to believe holds,”; and
in paragraph (8), by striking “section 2102(c)(4)(B)(i)” and inserting “section 2102(c)(4) by the Secretary that identifies specific security measures that are sufficient to meet the risk-based performance standards for facilities in tiers 3 and 4 that elect to utilize the expedited approval program”.
3. Risk-based performance standards
Section 2102 of the Homeland Security Act of 2002 (6 U.S.C. 622) is amended—
in subsection (a)—
in paragraph (2)(C), by inserting “, evaluate, and maintain” after “establish”; and
by adding at the end the following:
“(3) Limitation—The risk-based performance standards established under paragraph (2)(C) shall not include any standard relating to cybersecurity.”
in subsection (b)(2)—
by striking “at least” and inserting “not less than”;
by inserting “not less than” before “1 employee representative”; and
by striking “as pertains” and inserting “pertaining”; and
in subsection (c)(3), by striking subparagraph (B) and inserting the following:
“(B) Previously approved plans—The Secretary may not require a covered chemical facility to resubmit a site security plan—
“(i) in the case of a covered chemical facility for which the Secretary approved the site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (Public Law 113–254; 128 Stat. 2898), solely by reason of the enactment of that Act; or
“(ii) in the case of a covered chemical facility for which the Secretary approved the site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2018, solely by reason of the enactment of that Act or any amendment made by that Act.”
4. Expedited approval program
Section 2102(c)(4) of the Homeland Security Act of 2002 (6 U.S.C. 622(c)(4)) is amended—
in subparagraph (A)(i), by striking “subparagraph (C)” and inserting “subparagraph (C)(i)”;
in subparagraph (B)—
in clause (i), by striking “Not later than” and all that follows through “the Secretary shall issue” and inserting “The Secretary shall maintain”; and
by striking clause (iii);
in subparagraph (C)—
in clause (iii), by redesignating subclauses (I) through (III) as items (aa) through (cc), respectively, and adjusting the margins accordingly;
by redesignating clauses (i) through (viii) as subclauses (I) through (VIII), respectively, and adjusting the margins accordingly;
in the matter preceding subclause (I), as so redesignated, by striking “The owner” and inserting the following:
“(i) In general—The owner”
by adding at the end the following:
“(ii) Risk-based performance standards—In submitting a site security plan and certification under subparagraph (A)(i), an owner or operator of an expedited approval facility should consider using the guidance for expedited approval facilities to determine appropriate measures for the site security plan of the expedited approval facility.”
in subparagraph (D)—
in clause (i), by striking “subparagraph (C)” and inserting “subparagraph (C)(i)”; and
in clause (iii)—
by striking “30” and inserting “7”; and
by striking “subparagraph (C)” and inserting “subparagraph (C)(i)”;
in subparagraph (F)(i)(I), by striking “subparagraph (C)” and inserting “subparagraph (C)(i)”; and
by striking subparagraph (I) and inserting the following:
“(I) Notice by the Secretary—The Secretary shall provide notice to each covered chemical facility of the expedited approval program under this paragraph.”
5. CFATS Recognition Program
Section 2102(c) of the Homeland Security Act of 2002 (6 U.S.C. 622(c)) is amended by adding the following at the end:
“(5) CFATS Recognition Program
“(A) Definitions—In this paragraph—
“(i) the term CFATS Recognition Program means the program established under subparagraph (B);
“(ii) the term industry stewardship program means an industry stewardship program that provides regulatory recognition to covered chemical facilities that meet industry best practices;
“(iii) the term participating facility means a covered chemical facility that is a member of an industry stewardship program; and
“(iv) the term sponsor organization means the governing body of an industry stewardship program.
“(B) Establishment
“(i) In general—Not later than 180 days after the date of enactment of this paragraph, the Secretary shall establish a program that shall be known as the CFATS Recognition Program—
“(I) with the goal of leveraging CFATS regulations and industry stewardship programs to further enhance security relating to hazardous chemicals; and
“(II) under which the Secretary shall—
“(aa) establish—
“(AA) eligibility criteria under subparagraph (C)(i) for industry stewardship programs seeking to participate in the CFATS Recognition Program; and
“(BB) performance requirements under subparagraph (C)(ii) for participating facilities; and
“(bb) provide incentives under subparagraph (C)(iii) to encourage participation in the CFATS Recognition Program.
“(ii) Applicability of other laws—During the period before the Secretary has met the deadline under clause (i), in developing and issuing, or amending, the guidance relating to carrying out the CFATS Recognition Program and collecting information from industry stewardship programs, sponsor organizations, and participating facilities, the Secretary shall not be subject to—
“(I) section 553 of title 5, United States Code;
“(II) subchapter I of chapter 35 of title 44, United States Code; or
“(III) section 2107(b) of this Act.
“(C) Eligibility criteria; facility performance requirements; incentives
“(i) Eligibility criteria for industry stewardship programs—Not later than 180 days after the date of enactment of this paragraph, the Secretary shall establish minimum eligibility criteria for industry stewardship programs desiring to be considered by the Secretary for participation in the CFATS Recognition Program that shall include—
“(I) a requirement that any industry stewardship program desiring to participate in the CFATS Recognition Program be governed by an industry association or technical organization that is an entity described in paragraph (3) or (6) of section 501(c) of the Internal Revenue Code of 1986;
“(II) a documented top management commitment to chemical facility security; and
“(III) criteria relating to—
“(aa) program auditing requirements and frequency;
“(bb) security vulnerability assessment requirements and frequency;
“(cc) security measures, including—
“(AA) detection measures;
“(BB) delay measures;
“(CC) response measures; and
“(DD) security management; and
“(dd) reporting required to be done by any industry stewardship program desiring to participate in the CFATS Recognition Program.
“(ii) Performance requirements for participating facilities—Not later than 180 days after the date of enactment of this paragraph, the Secretary shall require that each participating facility—
“(I) submit an acknowledgment by the sponsor organization of the industry steward program, of which the participating facility is a member, that the participating facility is—
“(aa) a member in good standing of the industry stewardship program; and
“(bb) in full compliance with the requirements of the industry stewardship program;
“(II) assess any security vulnerability of the participating facility using a formal recognized methodology—
“(aa) in the initial security vulnerability assessment of the participating facility;
“(bb) not less than every 3 years after the initial security vulnerability assessment of the participating facility; and
“(cc) if there is a significant change to the security measures of the participating facility; and
“(III) develop and maintain a site security plan that—
“(aa) addresses any security vulnerability of the participating facility; and
“(bb) includes security measures, including—
“(AA) detection measures;
“(BB) delay measures;
“(CC) response measures; and
“(DD) security management.
“(iii) Program incentives—Not later than 180 days after the date of enactment of this paragraph, the Secretary shall—
“(I) establish incentives for participation in the CFATS Recognition Program, which shall include—
“(aa) a reduction of the Chemical Facility Anti-Terrorism Standards Program risk tier level at which a participating facility is currently tiered;
“(bb) a reduction in the frequency of compliance inspections;
“(cc) streamlined vulnerability assessment and site security plan processes; and
“(dd) any other regulatory relief as determined appropriate by the Secretary; and
“(II) provide written guidance on any incentive established under subclause (I).
“(D) Implementation
“(i) Applications—An industry stewardship program desiring to participate in the CFATS Recognition Program shall submit an application to the Secretary that contains information relating to—
“(I) the industry stewardship program submitting the application and the sponsor organization of the industry stewardship program;
“(II) each participating facility that is a member of the industry stewardship program; and
“(III) whether the industry stewardship program meets the eligibility requirements under subparagraph (C)(i).
“(ii) Determination
“(I) In general—Not later than 60 days after the date on which the Secretary receives an application submitted under clause (i), the Secretary shall—
“(aa) make a determination as to whether the industry stewardship program is eligible to participate in the CFATS Recognition Program; and
“(bb) notify the industry stewardship program of the determination.
“(II) Notification relating to denial—If the Secretary denies an application submitted under clause (i), in the notification of the determination under subclause (I)(bb), the Secretary shall include—
“(aa) a statement of each reason for the denial; and
“(bb) any action that may be taken by the applicant to qualify the applicant for participation in the CFATS Recognition Program.
“(III) Revised applications—Not later than 60 days after the date on which an applicant receives a notification of denial under subclause (II), the applicant may submit a revised application.
“(E) Evaluation—Not later than 18 months after the date of enactment of this paragraph, the Secretary shall provide a briefing to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committees on Homeland Security and Energy and Commerce of the House of Representatives on the progress in carrying out the CFATS Recognition Program.”
6. Frequency of audits and inspections
Section 2102(d)(1) of the Homeland Security Act of 2002 (6 U.S.C. 622(d)(1)) is amended—
in subparagraph (B), by striking “The Secretary” and inserting “Subject to subparagraph (G), the Secretary”; and
by adding at the end the following:
“(G) Frequency of audits and inspections
“(i) In general—Except as provided in clause (ii), the Secretary may not conduct any audit or inspection under this paragraph of a covered chemical facility more frequently than once every 2 years.
“(ii) CFATS Recognition Program—In the case of a covered chemical facility that participates in the CFATS Recognition Program under subsection (c)(5) and meets compliance, audit, and inspection requirements under that program, the Secretary may not conduct any audit or inspection under this paragraph of that covered chemical facility more frequently than once every 3 years.”
7. Personnel surety program
Section 2102(d)(2)(A) of the Homeland Security Act of 2002 (6 U.S.C. 622(d)(2)(A)) is amended—
in the matter preceding clause (i), by inserting “is mandatory for each owner or operator of a covered chemical facility assigned to tier 1 or 2 and optional for each owner or operator of a covered chemical facility assigned to tier 3 or tier 4 that” after “carry out a Personnel Surety Program that”; and
in clause (ii), by inserting “who will have access to any chemical of interest designated under Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto,” after “about an individual”.
8. Security risk assessment approach and corresponding tiering methodology
Section 2102(e) of the Homeland Security Act of 2002 (6 U.S.C. 622(e)) is amended—
in paragraph (2)(A), by striking “develop” and inserting “maintain”; and
in paragraph (3)—
in subparagraph (B)—
by striking the period at the end and inserting “, including—”; and
by adding at the end the following:
“(i) each input and assumption under the tiering methodology;
“(ii) the rational for each input; and
“(iii) the output of the tiering methodology.”
by adding at the end the following:
“(C) Reports—Not later than 14 days after the Secretary makes a determination that tiering for a covered chemical facility is changed, or that a covered chemical facility is no longer subject to the requirements under this title, the Secretary shall submit to the owner or operator of the covered chemical facility a written report that contains—
“(i) the information described in subparagraphs (A) and (B); and
“(ii) a statement of the criteria under paragraph (2)(B) and how the security risk of terrorism associated with the covered chemical facility was evaluated under those criteria.”
9. Annual performance reporting
Section 2102(e)(4) of the Homeland Security Act of 2002 (6 U.S.C. 622(e)(4)) is amended—
in the paragraph heading, by striking “Semiannual” and inserting “Annual”;
in the matter preceding subparagraph (A)—
by striking “6 months after the date” and inserting “1 year after the date”;
by striking “2014” and inserting “2018”; and
by striking “once every 6 months” and inserting “once each year”;
by striking subparagraph (C);
by redesignating subparagraph (D) as subparagraph (C);
by inserting after subparagraph (C), as so redesignated, the following:
“(D) the effectiveness of the Chemical Facility Anti-Terrorism Standards Program at—
“(i) managing security risks; and
“(ii) developing and using appropriate metrics and analysis capabilities to measure risk reduction, including—
“(I) vulnerability and consequence mitigation indicators; and
“(II) outcome metrics that measure cumulative risk reduction over time; and”
by striking subparagraph (E); and
by redesignating subparagraph (F) as subparagraph (E).
10. CFATS regulations
Section 2107(b) of the Homeland Security Act of 2002 (6 U.S.C. 627(b)) is amended—
in paragraph (1), by inserting “(Public Law 113–254; 128 Stat. 2919)” after “2014”; and
in paragraph (2), by striking “2014” and inserting “2018”.
11. Small covered chemical facilities
Section 2108 of the Homeland Security Act of 2002 (6 U.S.C. 628) is amended—
in subsection (b)—
by striking “tools, methodologies, or computer software” and inserting “tools and methodologies”; and
by striking “cybersecurity,”; and
by striking subsection (c).
12. Explosive materials
In general— Title XXI of the Homeland Security Act of 2002 (6 U.S.C. 621 et seq.) is amended by striking section 2109 (6 U.S.C. 629) and inserting the following:
“2109. Explosive materials
“The Secretary may not designate any explosive material subject to regulation by the Department of Justice under chapter 40 of title 18, United States Code, or by the Bureau of Alcohol, Tobacco, Firearms, and Explosives under part 555 of title 27, Code of Federal Regulations, as a chemical of interest under Appendix A to part 27 of title 6, Code of Federal Regulations.”
Technical and conforming amendment— The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public Law 107–196; 116 Stat. 2135) is amended by striking the item relating to section 2109 and inserting the following:
13. Changes in Appendix A to part 27 of title 6, Code of Federal Regulations
In general— Title XXI of the Homeland Security Act of 2002 (6 U.S.C. 621 et seq.), as amended by section 12 of this Act, is amended by adding at the end the following:
“2110. Changes in Appendix A to part 27 of title 6, Code of Federal Regulations
“(a) Definition—In this section, the term Appendix A means Appendix A to part 27 of title 6, Code of Federal Regulations, or any successor thereto.
“(b) Notice of proposed rulemaking—The Secretary shall publish a notice of proposed rulemaking in the Federal Register relating to any proposed change to Appendix A if the Secretary determines that—
“(1) a chemical should be designated as a chemical of interest under Appendix A;
“(2) a chemical designated as a chemical of interest under Appendix A should not be so designated; or
“(3) a chemical amount, concentration, or threshold quantity described in Appendix A should be modified.”
Technical and conforming amendment— The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public Law 107–196; 116 Stat. 2135) is amended by inserting after the item relating to section 2109 the following:
14. Assessment, report, briefing, and updated retrospective estimate on costs
Definitions— In this section—
the term applicable committee means—
the Committee on Homeland Security and Governmental Affairs of the Senate;
the Committee on Homeland Security of the House of Representatives; and
the Committee on Energy and Commerce of the House of Representatives;
the terms CFATS regulation and covered chemical facility have the meanings given those terms in section 2101 of the Homeland Security Act of 2002 (6 U.S.C. 621);
the term Chemical Facility Anti-Terrorism Standards Program means—
the Chemical Facility Anti-Terrorism Standards Program initially authorized under section 550 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295; 120 Stat. 1355); and
the Chemical Facility Anti-Terrorism Standards Program subsequently authorized under section 2102(a) of the Homeland Security Act of 2002 (6 U.S.C. 622(a));
the term Department means the Department of Homeland Security;
the term inspector means an individual used by the Department as an inspector for purposes of ensuring compliance with title XXI of the Homeland Security Act of 2002 (6 U.S.C. 621 et seq.); and
the term Secretary means the Secretary of Homeland Security.
Third-Party assessment—
In general— Not later than 90 days after the date of enactment of this Act, using amounts appropriated to the Department before the date of enactment of this Act, the Secretary shall commission a third-party study, which shall be completed not later than 1 year after the date on which the third-party study is commissioned, to assess the effectiveness of the Chemical Facility Anti-Terrorism Standards Program in—
managing security risks; and
developing and using appropriate metrics and analysis capabilities to measure risk reduction, including—
vulnerability and consequence mitigation indicators; and
outcome metrics that measure cumulative risk reduction over time.
Briefing and submission of study— Not later than 90 days after the date on which the third-party study described in paragraph (1) is completed, the Secretary shall—
brief each applicable committee on the results of the third-party study; and
submit a copy of the completed third-party study to each applicable committee.
GAO report— Not later than 2 years after the date of enactment of this Act, the Comptroller General of the United States shall submit to each applicable committee a report on inspector training that contains recommendations for improving inspector training, including recommendations relating to—
how the Department selects inspectors;
initial training required for inspectors before the inspectors are selected by the Department to be used to conduct inspections;
qualification standards required to be met by inspectors before they are selected by the Department to be used to conduct inspections;
on-the-job training required for inspectors and how that training is documented;
final qualification and approval standards required to be met by inspectors before the inspectors are initially used by the Department to conduct inspections;
continuing qualification standards required to be met by inspectors while the inspectors are used by the Department to conduct inspections; and
continuous training required for inspectors while the inspectors are used by the Department to conduct inspections.
Annual briefing— Not later than 1 year after the date of enactment of this Act, and each year thereafter for 5 years, the Secretary shall brief each applicable committee on the activities carried out under this section and under title XXI of the Homeland Security Act of 2001 (6 U.S.C. 621 et seq.) that shall include—
detailed information relating to—
as of the date on which the briefing is made—
threats to covered chemical facilities; and
how chemicals of interest are being utilized by bad actors in the threat environment—
in the United States; and
globally;
how CFATS regulations play a role in making the United States safer; and
how the Chemical Facility Anti-Terrorism Standards Program is effectively addressing the threat landscape; and
data, rationale, and metrics on how the Chemical Facility Anti-Terrorism Standards Program effectively reduces risks.
Updated retrospective estimate on costs— Not later than 1 year after the date of enactment of this Act, the Secretary shall complete a retrospective estimate of the costs, including costs to the Government, regulated entities, and the public, of carrying out the Chemical Facility Anti-Terrorism Standards Program during the period beginning on the first day of fiscal year 2006 and ending on the last day of fiscal year 2018.
Repeal— Section 3 of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (Public Law 113–254; 128 Stat. 2917) is repealed.
15. Effective date
This Act, and the amendments made by this Act, shall take effect on the date that is 30 days after the date of enactment of this Act.
16. Termination
The authority provided under title XXI of the Homeland Security Act of 2002 (6 U.S.C. 621 et seq.), as amended by this Act, shall terminate on the date that is 5 years after the date of enactment of this Act.
17. Technical and conforming amendment
The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public Law 107–196; 116 Stat. 2135) is amended, in the item relating to section 2103, by striking the em dash at the end.