---
kind: "section"
citation: "6 U.S.C. § 321m"
title: "6"
title_heading: "Domestic Security"
number: "321m"
heading: "Voluntary private sector preparedness accreditation and certification program"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/321m"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter V — National Emergency Management"
---

# §321m. Voluntary private sector preparedness accreditation and certification program

- (a) **Establishment—**
  - (1) **In general—** The [Secretary](/usc/6/101.md?p=16), acting through the officer designated under [paragraph (2)](#a-2), shall establish and implement the [voluntary](/usc/6/671.md?p=6-A) private sector preparedness accreditation and certification program in accordance with this section.
  - (2) **Designation of officer—** The [Secretary](/usc/6/101.md?p=16) shall designate an officer responsible for the accreditation and certification program under this section. Such officer (hereinafter referred to in this section as the “designated officer”) shall be one of the following:
    - (A) The [Administrator](/usc/6/311.md?p=1), based on consideration of—
      - (i) the expertise of the [Administrator](/usc/6/311.md?p=1) in [emergency management](/usc/6/701.md?p=7) and preparedness in the [United States](/usc/6/101.md?p=19-A); and
      - (ii) the responsibilities of the [Administrator](/usc/6/311.md?p=1) as the principal advisor to the President for all matters relating to [emergency management](/usc/6/701.md?p=7) in the [United States](/usc/6/101.md?p=19-A).
    - (B) The Assistant [Secretary](/usc/6/101.md?p=16) for Infrastructure Protection,[^1] based on consideration of the expertise of the Assistant [Secretary](/usc/6/101.md?p=16) in, and responsibilities for—
      - (i) protection of [critical infrastructure](/usc/6/101.md?p=4);
      - (ii) risk assessment methodologies; and
      - (iii) interacting with the private sector on the issues described in clauses [(i)](#a-2-B-i) and [(ii)](#a-2-B-ii).
    - (C) The Under [Secretary](/usc/6/101.md?p=16) for Science and Technology, based on consideration of the expertise of the Under [Secretary](/usc/6/101.md?p=16) in, and responsibilities associated with, standards.
  - (3) **Coordination—** In carrying out the accreditation and certification program under this section, the designated officer shall coordinate with—
    - (A) the other officers of the [Department](/usc/6/101.md?p=5) referred to in [paragraph (2)](#a-2), using the expertise and responsibilities of such officers; and
    - (B) the Special Assistant to the [Secretary](/usc/6/101.md?p=16) for the Private Sector, based on consideration of the expertise of the Special Assistant in, and responsibilities for, interacting with the private sector.
- (b) **Voluntary private sector preparedness standards; voluntary accreditation and certification program for the private sector—**
  - (1) **Accreditation and certification program—** Not later than 210 days after August 3, 2007, the designated officer shall—
    - (A) begin supporting the development and updating, as necessary, of [voluntary preparedness standards](/usc/6/101.md?p=20) through appropriate organizations that coordinate or facilitate the development and use of [voluntary](/usc/6/671.md?p=6-A) consensus standards and [voluntary](/usc/6/671.md?p=6-A) consensus standards development organizations; and
    - (B) in consultation with representatives of appropriate organizations that coordinate or facilitate the development and use of [voluntary](/usc/6/671.md?p=6-A) consensus standards, appropriate [voluntary](/usc/6/671.md?p=6-A) consensus standards development organizations, each private sector advisory [council](/usc/6/681.md?p=2) created under [section 112(f)(4) of this title](/usc/6/112.md?p=f-4), appropriate representatives of [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), including [emergency management](/usc/6/701.md?p=7) officials, and appropriate private sector advisory groups, such as sector coordinating [councils](/usc/6/681.md?p=2) and information sharing and analysis [centers](/usc/6/681.md?p=1)—
      - (i) develop and promote a program to certify the preparedness of private sector [entities](/usc/6/301c.md?p=2) that voluntarily choose to seek certification under the program; and
      - (ii) implement the program under this subsection through any [entity](/usc/6/301c.md?p=2) with which the designated officer enters into an agreement under [paragraph (3)(A)](#b-3-A), which shall accredit third parties to carry out the certification process under this section.
  - (2) **Program elements—**
    - (A) **In general—**
      - (i) **Program—** The program developed and implemented under this subsection shall assess whether a private sector [entity](/usc/6/301c.md?p=2) complies with [voluntary preparedness standards](/usc/6/101.md?p=20).
      - (ii) **Guidelines—** In developing the program under this subsection, the designated officer shall develop guidelines for the accreditation and certification processes established under this subsection.
    - (B) **Standards—** The designated officer, in consultation with representatives of appropriate organizations that coordinate or facilitate the development and use of [voluntary](/usc/6/671.md?p=6-A) consensus standards, representatives of appropriate [voluntary](/usc/6/671.md?p=6-A) consensus standards development organizations, each private sector advisory [council](/usc/6/681.md?p=2) created under [section 112(f)(4) of this title](/usc/6/112.md?p=f-4), appropriate representatives of [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), including [emergency management](/usc/6/701.md?p=7) officials, and appropriate private sector advisory groups such as sector coordinating [councils](/usc/6/681.md?p=2) and information sharing and analysis [centers](/usc/6/681.md?p=1)—
      - (i) shall adopt one or more appropriate [voluntary preparedness standards](/usc/6/101.md?p=20) that promote preparedness, which may be tailored to address the unique nature of various sectors within the private sector, as necessary and appropriate, that shall be used in the accreditation and certification program under this subsection; and
      - (ii) after the adoption of one or more standards under [clause (i)](#b-2-B-i), may adopt additional [voluntary preparedness standards](/usc/6/101.md?p=20) or modify or discontinue the use of [voluntary preparedness standards](/usc/6/101.md?p=20) for the accreditation and certification program, as necessary and appropriate to promote preparedness.
    - (C) **Submission of recommendations—** In adopting one or more standards under [subparagraph (B)](#b-2-B), the designated officer may receive recommendations from any [entity](/usc/6/301c.md?p=2) described in that subparagraph relating to appropriate [voluntary preparedness standards](/usc/6/101.md?p=20), including appropriate sector specific standards, for adoption in the program.
    - (D) **Small business concerns—** The designated officer and any [entity](/usc/6/301c.md?p=2) with which the designated officer enters into an agreement under [paragraph (3)(A)](#b-3-A) shall establish separate classifications and methods of certification for small business concerns (under the meaning given that term in [section 632 of title 15](/usc/15/632.md)) for the program under this subsection.
    - (E) **Considerations—** In developing and implementing the program under this subsection, the designated officer shall—
      - (i) consider the unique nature of various sectors within the private sector, including preparedness standards, business continuity standards, or best practices, established—
        - (I) under any other provision of Federal law; or
        - (II) by any Sector Risk Management [Agency](/usc/6/311.md?p=2), as defined under [Homeland](/usc/6/101.md?p=1) Security Presidential Directive–7; and
      - (ii) coordinate the program, as appropriate, with—
        - (I) other [Department](/usc/6/101.md?p=5) private sector related programs; and
        - (II) preparedness and business continuity programs in other [Federal agencies](/usc/6/677a.md?p=4).
  - (3) **Accreditation and certification processes—**
    - (A) **Agreement—**
      - (i) **In general—** Not later than 210 days after August 3, 2007, the designated officer shall enter into one or more agreements with a highly qualified nongovernmental [entity](/usc/6/301c.md?p=2) with experience or expertise in coordinating and facilitating the development and use of [voluntary](/usc/6/671.md?p=6-A) consensus standards and in managing or implementing accreditation and certification programs for [voluntary](/usc/6/671.md?p=6-A) consensus standards, or a similarly qualified private sector [entity](/usc/6/301c.md?p=2), to carry out accreditations and oversee the certification process under this subsection. An [entity](/usc/6/301c.md?p=2) entering into an agreement with the designated officer under this clause (hereinafter referred to in this section as a “selected [entity](/usc/6/301c.md?p=2)”) shall not perform certifications under this subsection.
      - (ii) **Contents—** A selected [entity](/usc/6/301c.md?p=2) shall manage the accreditation process and oversee the certification process in accordance with the program established under this subsection and accredit qualified third parties to carry out the certification program established under this subsection.
    - (B) **Procedures and requirements for accreditation and certification—**
      - (i) **In general—** Any selected [entity](/usc/6/301c.md?p=2) shall collaborate to develop procedures and requirements for the accreditation and certification processes under this subsection, in accordance with the program established under this subsection and guidelines developed under [paragraph (2)(A)(ii)](#b-2-A-ii).
      - (ii) **Contents and use—** The procedures and requirements developed under [clause (i)](#b-3-B-i) shall—
        - (I) ensure reasonable uniformity in any accreditation and certification processes if there is more than one selected [entity](/usc/6/301c.md?p=2); and
        - (II) be used by any selected [entity](/usc/6/301c.md?p=2) in conducting accreditations and overseeing the certification process under this subsection.
      - (iii) **Disagreement—** Any disagreement among selected [entities](/usc/6/301c.md?p=2) in developing procedures under [clause (i)](#b-3-B-i) shall be resolved by the designated officer.
    - (C) **Designation—** A selected [entity](/usc/6/301c.md?p=2) may accredit any qualified third party to carry out the certification process under this subsection.
    - (D) **Disadvantaged business involvement—** In accrediting qualified third parties to carry out the certification process under this subsection, a selected [entity](/usc/6/301c.md?p=2) shall ensure, to the extent practicable, that the third parties include qualified small, minority, women-owned, or disadvantaged business concerns when appropriate. The term “disadvantaged business concern” means a small business that is owned and controlled by socially and economically disadvantaged individuals, as defined in [section 124 of title 13](https://uscode.house.gov/view.xhtml?req=(/us/usc/t13/s124)), United States Code of Federal Regulations.
    - (E) **Treatment of other certifications—** At the request of any [entity](/usc/6/301c.md?p=2) seeking certification, any selected [entity](/usc/6/301c.md?p=2) may consider, as appropriate, other relevant certifications acquired by the [entity](/usc/6/301c.md?p=2) seeking certification. If the selected [entity](/usc/6/301c.md?p=2) determines that such other certifications are sufficient to meet the certification requirement or aspects of the certification requirement under this section, the selected [entity](/usc/6/301c.md?p=2) may give credit to the [entity](/usc/6/301c.md?p=2) seeking certification, as appropriate, to avoid unnecessarily duplicative certification requirements.
    - (F) **Third parties—** To be accredited under [subparagraph (C)](#b-3-C), a third party shall—
      - (i) demonstrate that the third party has the ability to certify private sector [entities](/usc/6/301c.md?p=2) in accordance with the procedures and requirements developed under [subparagraph (B)](#b-3-B);
      - (ii) agree to perform certifications in accordance with such procedures and requirements;
      - (iii) agree not to have any beneficial interest in or any direct or indirect control over—
        - (I) a private sector [entity](/usc/6/301c.md?p=2) for which that third party conducts a certification under this subsection; or
        - (II) any organization that provides preparedness consulting services to private sector [entities](/usc/6/301c.md?p=2);
      - (iv) agree not to have any other conflict of interest with respect to any private sector [entity](/usc/6/301c.md?p=2) for which that third party conducts a certification under this subsection;
      - (v) maintain [liability insurance](/usc/6/444.md?p=4-A) coverage at policy limits in accordance with the requirements developed under [subparagraph (B)](#b-3-B); and
      - (vi) enter into an agreement with the selected [entity](/usc/6/301c.md?p=2) accrediting that third party to protect any proprietary information of a private sector [entity](/usc/6/301c.md?p=2) obtained under this subsection.
    - (G) **Monitoring—**
      - (i) **In general—** The designated officer and any selected [entity](/usc/6/301c.md?p=2) shall regularly monitor and inspect the operations of any third party conducting certifications under this subsection to ensure that the third party is complying with the procedures and requirements established under [subparagraph (B)](#b-3-B) and all other applicable requirements.
      - (ii) **Revocation—** If the designated officer or any selected [entity](/usc/6/301c.md?p=2) determines that a third party is not meeting the procedures or requirements established under [subparagraph (B)](#b-3-B), the selected [entity](/usc/6/301c.md?p=2) shall—
        - (I) revoke the accreditation of that third party to conduct certifications under this subsection; and
        - (II) review any certification conducted by that third party, as necessary and appropriate.
  - (4) **Annual review—**
    - (A) **In general—** The designated officer, in consultation with representatives of appropriate organizations that coordinate or facilitate the development and use of [voluntary](/usc/6/671.md?p=6-A) consensus standards, appropriate [voluntary](/usc/6/671.md?p=6-A) consensus standards development organizations, appropriate representatives of [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), including [emergency management](/usc/6/701.md?p=7) officials, and each private sector advisory [council](/usc/6/681.md?p=2) created under [section 112(f)(4) of this title](/usc/6/112.md?p=f-4), shall annually review the [voluntary](/usc/6/671.md?p=6-A) accreditation and certification program established under this subsection to ensure the effectiveness of such program (including the operations and management of such program by any selected [entity](/usc/6/301c.md?p=2) and the selected [entity](/usc/6/301c.md?p=2)’s inclusion of qualified disadvantaged business concerns under [paragraph (3)(D)](#b-3-D)) and make improvements and adjustments to the program as necessary and appropriate.
    - (B) **Review of standards—** Each review under [subparagraph (A)](#b-4-A) shall include an assessment of the [voluntary](/usc/6/671.md?p=6-A) preparedness standard or standards used in the program under this subsection.
  - (5) **Voluntary participation—** Certification under this subsection shall be [voluntary](/usc/6/671.md?p=6-A) for any private sector [entity](/usc/6/301c.md?p=2).
  - (6) **Public listing—** The designated officer shall maintain and make public a listing of any private sector [entity](/usc/6/301c.md?p=2) certified as being in compliance with the program established under this subsection, if that private sector [entity](/usc/6/301c.md?p=2) consents to such listing.
- (c) **Rule of construction—** Nothing in this section may be construed as—
  - (1) a requirement to replace any preparedness, [emergency](/usc/6/701.md?p=6) response, or business continuity standards, requirements, or best practices established—
    - (A) under any other provision of federal law; or
    - (B) by any Sector Risk Management [Agency](/usc/6/311.md?p=2), as those [agencies](/usc/6/311.md?p=2) are defined under [Homeland](/usc/6/101.md?p=1) Security Presidential Directive–7; or
  - (2) exempting any private sector [entity](/usc/6/301c.md?p=2) seeking certification or meeting certification requirements under [subsection (b)](#b) from compliance with all applicable statutes, regulations, directives, policies, and industry codes of practice.

## Footnotes

[^1]: See Change of Name note below.

## Source credit

(Pub. L. 107–296, title V, § 524, as added Pub. L. 110–53, title IX, § 901(a), Aug. 3, 2007, 121 Stat. 365; amended Pub. L. 116–283, div. H, title XC, § 9002(c)(2)(B), Jan. 1, 2021, 134 Stat. 4772.)

## Notes

### Editorial Notes

### Amendments

2021—Subsec. (b)(2)(E)(i)(II). Pub. L. 116–283, § 9002(c)(2)(B)(i), substituted “Sector Risk Management Agency” for “sector-specific agency”.

Subsec. (c)(1)(B). Pub. L. 116–283, § 9002(c)(2)(B)(ii), substituted “Sector Risk Management Agency” for “sector-specific agency”.

### Statutory Notes and Related Subsidiaries

### Change of Name

Reference to Assistant Secretary for Infrastructure Protection deemed to be a reference to Assistant Director for Infrastructure Security, see section 654(a)(3) of this title. Assistant Secretary for Infrastructure Protection serving on the day before Nov. 16, 2018, authorized to continue to serve as Assistant Director for Infrastructure Security on and after such date, see section 2(b)(4) of Pub. L. 115–278, set out as a note under section 654 of this title.

### Deadline for Designation of Officer

Pub. L. 110–53, title IX, § 901(c), Aug. 3, 2007, 121 Stat. 371, provided that: “The Secretary of Homeland Security shall designate the officer as described in section 524 of the Homeland Security Act of 2002 [6 U.S.C. 321m], as added by subsection (a), by not later than 30 days after the date of the enactment of this Act [Aug. 3, 2007].”