Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2020

II 116TH CONGRESS 2D SESSION S. 3416 To reauthorize the Chemical Facility Anti-Terrorism Standards Program of the Department of Homeland Security. IN THE SENATE OF THE UNITED STATES MARCH 5, 2020 Mr. JOHNSON introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To reauthorize the Chemical Facility Anti-Terrorism Stand- ards Program of the Department of Homeland Security. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS; DEFINI- 3 TIONS. 4 (a) SHORT TITLE.—This Act may be cited as the 5 ‘‘Protecting and Securing Chemical Facilities from Ter- 6 rorist Attacks Act of 2020’’. 7 (b) TABLE OF CONTENTS.—The table of contents for 8 this Act is as follows: 9 Sec. 1. Short title; table of contents; definitions. Sec. 2. Definitions. Sec. 3. Chemical Facility Anti-Terrorism Standards Program requirements. VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 2 •S 3416 IS Sec. 4. Purpose. Sec. 5. Employee input regarding security measures. Sec. 6. Strategy to improve cybersecurity and outreach to local emergency re- sponders. Sec. 7. Site security plan assessments. Sec. 8. Expedited approval program. Sec. 9. CFATS recognition program. Sec. 10. Standards for auditors and inspectors. Sec. 11. Personnel surety program. Sec. 12. Security risk assessment approach and corresponding tiering method- ology. Sec. 13. Data collection, recording, and lessons learned. Sec. 14. Semiannual performance reporting. Sec. 15. Responsibilities of the Secretary. Sec. 16. Amendments relating to Appendix A of part 27 of title 6, United States Code. Sec. 17. Informal consultations and assessments. Sec. 18. Protection and sharing of information. Sec. 19. CFATS regulations. Sec. 20. Employee awareness. Sec. 21. Notification relating to the Chemical Facility Anti-Terrorism Stand- ards Program. Sec. 22. Bidirectional information sharing platform. Sec. 23. Updated retrospective estimate on costs. Sec. 24. CFATS security harmonization waiver program. Sec. 25. Implementation plan and report to Congress. Sec. 26. Effective date. Sec. 27. Termination. Sec. 28. Technical and conforming amendment. (c) DEFINITIONS.—In this Act: 1 (1) APPROPRIATE CONGRESSIONAL COMMIT- 2 TEES.—The term ‘‘appropriate congressional com- 3 mittees’’ means— 4 (A) the Committee on Homeland Security 5 and Governmental Affairs of the Senate; 6 (B) the Committee on Homeland Security 7 of the House of Representatives; and 8 (C) the Committee on Energy and Com- 9 merce of the House of Representatives. 10 (2) CHEMICAL FACILITY ANTI-TERRORISM 11 STANDARDS PROGRAM.—The term ‘‘Chemical Facil- 12 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 3 •S 3416 IS ity Anti-Terrorism Standards Program’’ means the 1 Chemical Facility Anti-Terrorism Standards Pro- 2 gram established under section 2102(a) of the 3 Homeland Security Act of 2002 (6 U.S.C. 622(a)). 4 (3) CHEMICAL FACILITY OF INTEREST; CHEM- 5 ICAL OF INTEREST; COVERED CHEMICAL FACIL- 6 ITY.—The terms ‘‘chemical facility of interest’’, 7 ‘‘chemical of interest’’, and ‘‘covered chemical facil- 8 ity’’ have the meanings given those terms in section 9 2101 of the Homeland Security Act of 2002 (6 10 U.S.C. 621), as amended by section 2 of this Act. 11 (4) LESSONS LEARNED.—The term ‘‘lessons 12 learned’’ means the lessons learned, developed, and 13 disseminated by the Secretary under section 14 2103(e)(4) of the Homeland Security Act of 2002, 15 as added by section 13 of this Act. 16 (5) SECRETARY.—The term ‘‘Secretary’’ means 17 the Secretary of Homeland Security. 18 SEC. 2. DEFINITIONS. 19 (a) IN GENERAL.—Section 2101 of the Homeland 20 Security Act of 2002 (6 U.S.C. 621) is amended— 21 (1) in paragraph (2)(A), by striking ‘‘, as des- 22 ignated under Appendix A to part 27 of title 6, Code 23 of Federal Regulations, or any successor thereto,’’; 24 (2) by striking paragraph (14); 25 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 4 •S 3416 IS (3) by redesignating paragraphs (10) through 1 (13) as paragraphs (13) through (16), respectively; 2 (4) by redesignating paragraph (9) as para- 3 graph (11); 4 (5) by redesignating paragraphs (3) through 5 (8) as paragraphs (4) through (9), respectively; 6 (6) by inserting after paragraph (2) the fol- 7 lowing: 8 ‘‘(3) the term ‘chemical of interest’ means a 9 chemical designated as a chemical of interest under 10 Appendix A to part 27 of title 6, Code of Federal 11 Regulations, or any successor thereto;’’; 12 (7) in paragraph (9), as so redesignated, by 13 striking ‘‘section 2102(c)(4)(B)(i)’’ and inserting 14 ‘‘section 2102(c)(4) by the Secretary that identifies 15 specific security measures that are sufficient to meet 16 the risk-based performance standards for facilities in 17 tiers 3 and 4 that elect to utilize the expedited ap- 18 proval program’’; 19 (8) by inserting after paragraph (9), as so re- 20 designated, the following: 21 ‘‘(10) the term ‘hybrid physical-cybersecurity 22 vulnerability’— 23 ‘‘(A) means a vulnerability in the security 24 of a covered chemical facility that relates to the 25 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 5 •S 3416 IS combination of the physical operations and cy- 1 bersecurity operations of the covered chemical 2 facility; and 3 ‘‘(B) includes a vulnerability of a covered 4 chemical facility to— 5 ‘‘(i) a physical threat to a cybersecu- 6 rity operation affecting the chemical of in- 7 terest of the covered chemical facility; or 8 ‘‘(ii) a cybersecurity threat to a phys- 9 ical operation of the covered chemical facil- 10 ity;’’; 11 (9) by inserting after paragraph (11), as so re- 12 designated, the following: 13 ‘‘(12) the term ‘security vulnerability assess- 14 ment’ means an assessment of the vulnerabilities of 15 a covered chemical facility to— 16 ‘‘(A) physical threats; and 17 ‘‘(B) cybersecurity threats relating to— 18 ‘‘(i) the information technology or 19 operational technology of the covered 20 chemical facility; and 21 ‘‘(ii)(I) a chemical of interest; 22 ‘‘(II) an operation involving a chem- 23 ical of interest; or 24 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 6 •S 3416 IS ‘‘(III) a security measure of the cov- 1 ered chemical facility;’’; 2 (10) in paragraph (15), as so redesignated, by 3 inserting ‘‘and’’ after the semicolon; and 4 (11) in paragraph (16), as so redesignated, by 5 striking ‘‘; and’’ and inserting a period. 6 (b) CONFORMING AMENDMENTS.—Title XXI of the 7 Homeland Security Act of 2002 (6 U.S.C. 621 et seq.) 8 is amended— 9 (1) in section 2102(e)(5)(B)(i)(I)(bb) (6 U.S.C. 10 622(e)(5)(B)(i)(I)(bb)), as so redesignated by sec- 11 tion 13 of this Act, by striking ‘‘section 2101(3)’’ 12 and inserting ‘‘section 2101(4)’’; and 13 (2) in section 2103 (6 U.S.C. 623)— 14 (A) in subsection (a), by inserting ‘‘secu- 15 rity’’ before ‘‘vulnerability assessments’’; and 16 (B) in subsection (d), by inserting ‘‘secu- 17 rity’’ before ‘‘vulnerability assessments’’. 18 SEC. 3. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS 19 PROGRAM REQUIREMENTS. 20 Section 2102(a)(2)(C) of the Homeland Security Act 21 of 2002 (6 U.S.C. 622(a)(2)(C)) is amended by inserting 22 ‘‘eliminate or mitigate physical, cybersecurity, and hybrid 23 physical-cybersecurity vulnerabilities in order to’’ before 24 ‘‘address’’. 25 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 7 •S 3416 IS SEC. 4. PURPOSE. 1 Section 2102(a) of the Homeland Security Act of 2 2002 (6 U.S.C. 622(a)) is amended by adding at the end 3 the following: 4 ‘‘(3) PURPOSE.—The purpose of the Chemical 5 Facility Anti-Terrorism Standards Program is to— 6 ‘‘(A) enhance the security of the United 7 States by lowering the security risks posed by 8 chemicals designated under Appendix A to part 9 27 of title 6, United States Code, or any suc- 10 cessor thereto, at covered chemical facilities; 11 and 12 ‘‘(B) prevent the chemicals described in 13 subparagraph (A) from being exploited in ter- 14 rorist attacks.’’. 15 SEC. 5. EMPLOYEE INPUT REGARDING SECURITY MEAS- 16 URES. 17 Section 2102(b) of the Homeland Security Act of 18 2002 (6 U.S.C. 622(b)) is amended by striking paragraph 19 (2) and inserting the following: 20 ‘‘(2) EMPLOYEE INPUT.— 21 ‘‘(A) IN GENERAL.—The security vulner- 22 ability assessment and site security plan of a 23 covered chemical facility shall include input 24 from not less than 1 employee of the covered 25 chemical facility, and, where applicable, 1 em- 26 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 8 •S 3416 IS ployee representative from the bargaining agent 1 at that covered chemical facility, each of whom 2 possesses chemical terrorism vulnerability infor- 3 mation training and, in the determination of 4 the security officer of the covered chemical fa- 5 cility, relevant knowledge, experience, or edu- 6 cation as pertains to matters of site security. 7 ‘‘(B) SCOPE OF EMPLOYEE CONSULTA- 8 TION.—Any recommendation offered by an em- 9 ployee or employee representative under this 10 paragraph— 11 ‘‘(i) shall be limited to the purpose of 12 the development of the security vulner- 13 ability assessment and site security plan of 14 the covered chemical facility as required 15 under this title; and 16 ‘‘(ii) shall not be considered protected 17 information or a protected disclosure under 18 section 2105. 19 ‘‘(C) EMPLOYEE AWARENESS.—The Sec- 20 retary shall produce a poster for display in a re- 21 stricted area of a covered chemical facility that 22 is accessible to employees of the covered chem- 23 ical facility to inform those employees of the 24 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 9 •S 3416 IS consultation requirements under this para- 1 graph.’’. 2 SEC. 6. STRATEGY TO IMPROVE CYBERSECURITY AND OUT- 3 REACH TO LOCAL EMERGENCY RESPONDERS. 4 (a) STRATEGY.—Not later than 1 year after the date 5 of enactment of this Act, and every 2 years thereafter, 6 the Secretary shall issue a strategy that includes the stra- 7 tegic and operational goals and priorities of the Depart- 8 ment of Homeland Security for covered chemical facilities 9 to improve the cybersecurity of covered chemical facilities 10 and the sharing of information with the local emergency 11 manager, the local emergency response provider, and any 12 on site emergency response provider for a covered chemical 13 facility. 14 (b) CONTENTS.—The strategy issued under sub- 15 section (a) shall include— 16 (1) an unclassified assessment of cybersecurity 17 threats relating to— 18 (A) the information technology or oper- 19 ational technology affecting the security risk of 20 a chemical of interest of the covered chemical 21 facility; 22 (B) processes and operations relating to a 23 chemical of interest; and 24 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 10 •S 3416 IS (C) security measures of the covered chem- 1 ical facility relating to a chemical of interest; 2 (2) processes for periodic mitigation of security 3 vulnerabilities, as defined in section 102 of the Cy- 4 bersecurity Information Sharing Act of 2015 (6 5 U.S.C. 1501), to the information technology or oper- 6 ational technology affecting the security risk of a 7 chemical of interest of the covered chemical facility 8 to cybersecurity threats that affect the processes and 9 operations relating to a chemical of interest or the 10 security measures of the covered chemical facility re- 11 lating to a chemical of interest; 12 (3) guidance on further improving outreach to 13 the local emergency manager, the local emergency 14 response provider, and any on site emergency re- 15 sponse provider for a covered chemical facility, which 16 shall include— 17 (A) a statement of the name or title, orga- 18 nizational affiliation, and phone number of a 19 local emergency manager or local emergency re- 20 sponse provider, and any on site emergency re- 21 sponse provider, for the covered chemical facil- 22 ity; 23 (B) the documented policy of the covered 24 chemical facility to coordinate access to the fa- 25 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 11 •S 3416 IS cility with the local emergency manager, local 1 emergency response provider, and any on site 2 emergency response provider described in sub- 3 paragraph (A), for purposes of training and 4 pre-incident planning; and 5 (C) written documentation by the covered 6 chemical facility that the owner or operator has 7 provided the local emergency manager or local 8 emergency response provider with need to know 9 (within the meaning of section 27.400(e) of title 10 6, Code of Federal Regulations, or any suc- 11 cessor thereto) and appropriate chemical-ter- 12 rorism vulnerability information credentials the 13 name and amount of each chemical of interest 14 held, stored, or manufactured at the covered 15 chemical facility. 16 (c) STAKEHOLDER INPUT.—In issuing the strategy 17 issued under subsection (a), the Secretary shall solicit 18 input from covered chemical facilities and local emergency 19 managers, local emergency response providers, and on site 20 emergency response providers for covered chemical facili- 21 ties. 22 SEC. 7. SITE SECURITY PLAN ASSESSMENTS. 23 Section 2102(c)(3) of the Homeland Security Act of 24 2002 (6 U.S.C. 622(c)) is amended— 25 VerDate Sep 11 2014 04:30 Mar 12, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3416.IS S3416 kjohnson on DSK79L0C42PROD with BILLS 12 •S 3416 IS (1) in subparagraph (B), by striking ‘‘2014’’ 1 and inserting ‘‘2020’’; and 2 (2) by adding at the end the following: 3 ‘‘(C) REVIEW OF COMPLIANCE.—In ap- 4 proving or disapproving a site security plan 5 under this subsection, the Secretary shall con- 6 firm that the covered chemical [Text truncated for display. Full text available on Congress.gov.]