Voluntary Private Sector Accreditation and Certification Preparedness Program, 60773-60776 [2010-24673]

Agencies

• Federal Emergency Management Agency
• DEPARTMENT OF HOMELAND SECURITY

[Federal Register Volume 75, Number 190 (Friday, October 1, 2010)]
[Notices]
[Pages 60773-60776]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-24673]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Federal Emergency Management Agency

[Docket ID FEMA-2008-0017]


Voluntary Private Sector Accreditation and Certification 
Preparedness Program

AGENCY: Federal Emergency Management Agency, DHS.

ACTION: Notice of PS-Prep Small Business Preparedness Plan; Request for 
Comment.

-----------------------------------------------------------------------

SUMMARY: The Department of Homeland Security (DHS) announces an initial 
plan to address small business concerns in the Voluntary Private Sector 
Accreditation and Certification Preparedness Program (PS-Prep Program). 
This initial plan identifies the separate classifications and the 
methods of certification available for small businesses under the PS-
Prep Program. The purpose of this notice is to (1) present the plan for 
small business preparedness, and (2) invite public comment on the plan. 
DHS will continue to refine this plan, and will take comments into 
consideration in doing so.
    Instructions: DHS will review any comments received for small 
business considerations or the PS-Prep Program generally and, when 
merited, will publish a Federal Register notice providing the results 
of that review.
    Those interested may submit comments, identified by Docket ID FEMA-
2008-0017, by one of the following methods:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments. (Note: This process 
applies to all government requests for comments--even though as in the 
case of PS-Prep, they may not be for regulatory purposes.)
     Fax: 703-483-2999.
     Mail/Hand Delivery/Courier: Office of Chief Counsel, 
Federal Emergency Management Agency, 500 C Street, SW., Room 840, 
Washington, DC 20472-3100.
    All submissions received must include the agency name and Docket ID 
FEMA-2008-0017. All submissions will be posted, without change, to the 
Federal eRulemaking Portal at https://www.regulations.gov, and will 
include any personal information you provide. Because comments are made 
available to the public, submitters should take caution to not include 
any sensitive, personal information, trade secret, or any commercial or 
financial information which is obtained from any person and which is 
deemed privileged or confidential. Submitters may wish to read the 
Privacy Act notice available on the Privacy Notice link located at the 
bottom of https://www.regulations.gov.
    Docket: For access to the docket to read background documents or 
comments received, go to the Federal eRulemaking Portal at https://www.regulations.gov. Submitted comments may also be inspected at FEMA, 
Office of Chief Counsel, 500 C Street, SW., Room 840, Washington, DC 
20472.

FOR FURTHER INFORMATION CONTACT: Mr. Marcus Pollock, National 
Integration Center, National Preparedness Directorate, Protection and 
National Preparedness, Federal Emergency Management Agency, 500 C 
Street, SW., Washington, DC 20472. Phone: 202-646-2801 or E-mail: FEMA-NIMS@dhs.gov.

SUPPLEMENTARY INFORMATION: 

I. Background

    In the Implementing Recommendations of the 9/11 Commission Act of 
2007, Congress in Public Law 110-53 (the 9/11 Act) mandated DHS to 
establish a voluntary private sector preparedness accreditation and 
certification program. This program, now known as the PS-Prep Program, 
will assess whether a private sector entity voluntarily complies with 
one or more preparedness standards adopted by DHS. It will do so 
through a system of accreditation and certification developed by DHS in 
close coordination with the private sector.
    The 9/11 Act contains a provision, now codified at 6 U.S.C. 
321m(b)(2)(D), which requires the PS-Prep Program to ``establish 
separate classifications and methods of certification for small 
business concerns* * *.'' The definition of ``small business concerns'' 
is found in the Small Business Administration's regulations at 13 CFR 
part 121, published in accordance with Section 3 of the Small Business 
Act (15 U.S.C. 632).
    DHS published a notice in the Federal Register on December 24, 
2008, describing DHS implementation of the PS-Prep Program, requesting 
comment on the PS-Prep Program and the target criteria for selecting 
preparedness standards, and requesting recommendations for standards 
that DHS should consider. See 73 FR 79140. After reviewing the 
responses to the December 2008 notice, DHS published a notice in the 
Federal Register on October 16, 2009, which proposed the adoption of 
three standards for use in the PS-Prep Program and sought public 
comment. See 74 FR 53286. After reviewing comments received, DHS 
published a notice formally adopting those three standards on June 16, 
2010. See 75 FR 34148.
    DHS received additional information and comments about small 
business aspects of the PS-Prep Program through several public meetings 
in Washington, DC, 10 public meetings across the country, and multiple 
meetings with government agencies and organizations interested in 
preparedness and small business. These comments further defined small 
business and provided recommendations regarding appropriate 
considerations for separate classifications and methods for small 
business.

A. DHS Standards Adoption for the PS-Prep Program

    DHS announced formal adoption of the following three standards on 
June 16, 2010 (PS-Prep standards).
    1. ASIS International, ``Organizational Resilience: Security 
Preparedness, and Continuity Management Systems--Requirements with 
Guidance for Use,'' ASIS SPC. 1-2009 (2009 Edition).
    2. British Standards Institution, ``Business Continuity Management 
Part 1: Code of Practice for Business Continuity Management,'' BS 
25999-1: 2006 (2006 Edition); and ``Business Continuity Management Part 
2: Specification for Business Continuity Management,'' BS 25999-2: 2007 
(2007 Edition).
    3. National Fire Protection Association, ``Standard on Disaster/
Emergency Management and Business Continuity Programs,'' NPFA-1600 
(2007 and 2010 Editions).

B. Initiation of the PS-Prep Accreditation and Certification Process

    With the formal adoption of the three PS-Prep standards, the 
American National Standards Institute--American Society for Quality 
(ANSI-ASQ) National Accreditation Board (ANAB), the designated PS-Prep 
accrediting body, will finalize its process for accrediting third-party 
certifying bodies (CBs) for the PS-Prep Program. Businesses may 
voluntarily choose to seek third-party certification through

[[Page 60774]]

CBs accredited by ANAB. See https://www.anab.org/accreditation/preparedness.aspx.

C. Prior Solicitation of Comments Regarding Small Business Aspects

    DHS received information and comments about small business aspects 
of the PS-Prep Program from many sources. These comments further 
reflected the concerns of small businesses and provided suggestions 
regarding appropriate considerations for separate classifications and 
methods of certification for small business.
    Comments and suggestions included the following:
     Include affordable methods for providing support for 
implementing preparedness appropriate for small businesses.
     Provide a developmental model with progressive steps prior 
to third-party certification.
     Provide education, tools, technical assistance, and 
methods for self-assessment as part of a developmental model.
     Build on existing programs which use preparedness 
education and best practices.
     Include outreach and education through multiple sources to 
provide education and technical support that is accessible and 
convenient for small business.
     Include outreach through new and pre-existing networks to 
enhance awareness of the PS-Prep Program, its value, and ways to 
participate.
    The draft Program outlined in this notice addresses, in part, the 
comments, concerns, and suggestions received during PS-Prep outreach 
activities to date.

II. PS-Prep Small Business Preparedness Plan

    Using the size standards found at 13 CFR part 121 and authorized by 
15 U.S.C. 632, the vast majority of the commerce in the United States 
is represented by small businesses. According to the 2007 Economic 
Census, there are approximately 7.6 million establishments with fewer 
than 500 employees, and they employ approximately 96 million employees. 
U.S. society's well-being depends on these businesses for goods and 
services. Should disaster strike, continued access to those services 
and products is an important part of recovery and resilience.
    The resources required to obtain third-party certification to one 
of the DHS-adopted preparedness standards may pose a challenge and 
potential barrier for many small businesses. In the 9/11 Act, Congress 
recognized that differences in scale and resources require different 
strategies to effectively promote and implement preparedness for small 
businesses. Therefore, Congress directed DHS to ``establish separate 
classifications and methods of certification for small business 
concerns * * *.''
    DHS is proposing to use three ``classifications'' of businesses 
when determining eligibility for participation in the two 
``certification methods'' (see below). Small business concerns referred 
to in the PS-Prep Program's authorizing legislation are addressed 
through the creation of these classifications and through the provision 
of an additional, different method of certification, available only for 
small businesses and small not-for-profit concerns. Certification is 
the desired outcome of a formal process by which entities are assessed 
to determine their conformity to one or more of the PS-Prep standards.

A. Classifications of Businesses for PS-Prep

    The three classifications of private sector entities for the PS-
Prep Program are: (1) Small businesses as defined in the Small Business 
Administration's regulations at 13 CFR part 121, published in 
accordance with 15 U.S.C. 632; (2) other non-governmental entities with 
fewer than 500 employees that do not meet the requirements of 13 CFR 
part 121 and 15 U.S.C. 632; and (3) all private sector entities. These 
classifications will be used to distinguish eligibility of entities 
participating in the two methods of certification available under the 
PS-Prep Program.
    For small businesses, 15 U.S.C. 632 provides the criteria for 
establishing size standards and the definitions of terms used 
throughout the Small Business Act. The responsibility of establishing 
size standards is given to the Administrator of the Small Business 
Administration. The Administrator has defined small businesses through 
established numerical definitions, or ``size standards,'' for all for-
profit industries. The complete list of size standards can be found in 
the table at 13 CFR 121.201, or see https://www.sba.gov/contractingopportunities/officials/size/table/.
    Classification (2), as described above, is intended to capture 
those small, not-for-profit entities which fall outside of the for-
profit based definition for small business as found in 15 U.S.C. 632 
and 13 CFR part 121. DHS recognizes that there are small not-for-profit 
entities which may also desire to achieve conformity with a DHS-adopted 
preparedness standard, but which face the same issues of limited 
resources and scale as small businesses. DHS has determined to enable 
these entities to participate in the PS-Prep Program, by creating 
classification (2) for not-for-profit entities with fewer than 500 
employees. DHS's reasoning for choosing these qualifications is based 
on the Small Business Administration's regulations at 13 CFR part 121, 
which identify 500 or fewer employees as a common size for small 
organizations.
    DHS will consider refining classification (2) to include a measure 
of gross receipts. A possible basis for this refinement would be the 
Internal Revenue Service's gross receipts requirements for tax-exempt 
501(c)(3) organizations eligible to file form 990-N (annual gross 
receipts less than or equal to $25,000), or form 990-EZ (annual gross 
receipts between $25,001 and $500,000). Religious and other 
organizations exempt from filing and having fewer than 500 employees 
would still qualify to use the PS-Prep self-certification method. DHS 
seeks comment on this proposed method of defining classification (2).
    Classification (3), all private sector entities, captures any 
private sector entity wishing to participate in the PS-Prep Program. 
Therefore, a small business would qualify for both classification (1) 
and classification (3). However, those entities which do not meet the 
requirements for classifications (1) and (2) would be included only in 
classification (3). The purpose of these classifications is to qualify 
for participation in the two methods of certification available in the 
PS-Prep Program.

B. Methods of Certification for PS-Prep

    There will exist two methods for certification under the PS-Prep 
Program: (1) Self-declaration of conformity, and (2) third-party 
certification. Entities that can be classified as (1) small businesses 
as defined in 13 CFR part 121, published in accordance with 15 U.S.C. 
632, or (2) other non-governmental entities with fewer than 500 
employees, that do not meet requirements of 13 CFR part 121 and 15 
U.S.C. 632, are eligible for both methods of certification. All other 
entities which do not meet the requirements for classifications (1) or 
(2) will be classified as (3), all private sector entities, and are 
only eligible for the third-party certification method.
    Although DHS has at this time identified the two methods of 
certification described herein, other methods will be examined and 
considered. DHS reserves the right to

[[Page 60775]]

add other methods to the PS-Prep Program following future notice and 
opportunity for comment.
    Businesses that successfully conform to any DHS-adopted PS-Prep 
standard, as measured by one of the methods outlined in this notice, 
may receive recognition from DHS. The process for and type of 
recognition that may be provided are still under consideration and more 
information will be provided in subsequent announcements or notices.
1. Self-Declaration of Conformity
    Any private sector entity that is a member of classifications (1) 
or (2) as described above may assess and attest to its conformity to 
one or more of the PS-Prep standards.
    The self-declaration of conformity process will be similar to what 
is sometimes known as a manufacturer's or supplier's declaration of 
conformance. This is based on an accepted industry practice whereby 
manufacturers or suppliers formally declare that their products or 
services conform to relevant standards. DHS proposes that self-
declaration will be based upon the International Organization for 
Standardization/International Electrotechnical Commission (ISO/IEC) 
standard 17050-1, ``Conformity Assessment--Supplier's Declaration 
Assessment--Supplier's declaration of conformity--Part 1: General 
requirements'' and ISO/IEC standard 17050-2, ``Conformity Assessment--
Supplier's declaration of conformity--Part 2: Supporting 
documentation.'' Together, these parts of the standard specify general 
requirements for a supplier's declaration of conformity in cases where 
conformity of an object to a specified requirement must be attested.
    In the United States, ISO/IEC standard 17050-1 and 17050-2 are 
available for the respective fees of $49.00 and $37.00. To purchase, 
search the American National Standards Institute online store, at 
https://webstore.ansi.org/default.aspx. In addition, FEMA will maintain 
a copy of the standard, and make it available upon request for viewing 
in person at FEMA's reading room, located at 500 C Street, SW., Room 
840, Washington, DC 20472. Due to licensing and copyright restrictions, 
however, these documents will be available for review only, not for 
copying.
    DHS is still considering the plan for management and oversight of 
the self-declaration of conformity process, and will provide more 
information through subsequent announcements or notices. DHS will 
consider other processes of self-declaration of conformity. One example 
may be a comprehensive, Web-based self-assessment that could include a 
document review of key business continuity protocols.
2. Third-Party Certification
    Any private sector entity may undertake an independent, third-party 
validation that it conforms to one or more of the PS-Prep standards, 
using a certifying body (CB) that is accredited by ANAB. This is the 
general certification scheme outlined in PS-Prep's authorizing 
legislation. This process is notably more rigorous and measurable than 
self-declaration of conformity. Many CBs have a conformity assessment 
process that tailors to the needs and possible resource constraints of 
small businesses. Under this method, any entity is eligible to seek 
certification from an ANAB-accredited CB. For more information, see the 
prior Federal Register notices referenced above and https://www.anab.org/accreditation/preparedness.aspx.

C. Additional Small Business Support

    DHS recognizes that some small businesses may desire additional 
guidance and assistance to help them in achieving preparedness and to 
prepare for participating in a method of certification. Participation 
in such guidance and support activities is not required to participate 
in the PS-Prep Program. However, small businesses might find it useful 
as they seek conformance to one of the DHS-adopted preparedness 
standards.
    There are a number of public and private entities that provide 
programs and activities that support preparedness. These entities 
include academic institutions, community-based non-profit, and for-
profit institutions that provide education, training, assessment and 
technical assistance to small business. DHS encourages the development 
of tools and programs that will assist small businesses in improving 
preparedness and reaching conformance to an adopted standard. 
Businesses may participate in a variety of preparedness related 
activities such as classroom or web-based courses, technical assistance 
to conduct a hazard and/or vulnerability assessments, or to establish 
governance or planning activities.
    DHS will develop guidance for small businesses based on public 
input from this Federal Register notice and other outreach activities. 
This guidance will assist small businesses in identifying organizations 
that can help them both improve their preparedness and potentially 
become certified to one of the DHS-adopted standards using one of the 
methods outlined herein. This guidance will include attributes that 
these organizations' small business support activities have or should 
have. These attributes will be used by DHS to evaluate organizations 
that provide small business support services. For example, the 
organizations providing support to small businesses should have some or 
all of the elements listed below:
     Demonstrated expertise and experience in preparedness and 
small business concerns.
     A recognized program sponsorship, preferably at a national 
organization level (e.g., American Red Cross, Ready.gov, etc.) or at a 
State or Tribal government level.
     Web-based and/or local delivery mechanisms for 
accessibility to small business at a local level.
     Relevant programs or components that are demonstrated to 
be affordable to small business.
     Intent to develop substantive relationships between its 
program or component tools and elements of PS-Prep standards.
     Administrative mechanisms for tracking participants in 
order to recognize achievement or progress.
    By choosing a support organization with elements like these, small 
businesses should be able to increase their preparedness in an 
affordable manner with the support of a reputable organization that 
uses proven practices.

III. Request for Comment

    This notice describes the plan for implementing separate 
classifications and methods of certification for small businesses. DHS 
intends for the third-party certification method to be formally 
announced in September 2010 and will continue to refine the PS-Prep 
Small Business Preparedness Plan based on public feedback. DHS invites 
comments on the PS-Prep Small Business Preparedness Plan as outlined in 
this notice and, specifically, invites comments regarding the 
following:
     The classifications of businesses in the PS-Prep Program, 
including how they are used to distinguish eligibility for the methods 
of certification outlined in this notice.
     The methods of certification (self-declaration of 
conformity and/or third-party certification).
     The use of the ISO/IEC 17050-Parts 1 and 2 to guide the 
self-declaration of conformity process.
     Recommendations for:
    [cir] Information to include in the guidance for small business 
support activities attributes referenced in

[[Page 60776]]

Section II.C., above, including the types of organizations and programs 
to consider and the attributes that should be considered.
    [cir] Additional approaches to providing support for small business 
education, training, and development.
    [cir] How businesses can be recognized under each method of 
certification.
    [cir] Whether classification (2) as discussed in II.A, above, 
should be based upon the Internal Revenue Service's use of gross 
receipts to determine reporting requirements for tax-exempt 501(c)(3) 
organizations.
    [cir] How to encourage small businesses considering participation 
in self-declaration of conformity to participate in third-party 
certification instead.
    [cir] Recommendations on the use of a limited conformity assessment 
process that would include an off-site document review without an 
accompanying on-site assessment. A limited conformity assessment 
process may potentially reduce some of the costs associated with 
conformity assessment.
    [cir] Recommendations on whether DHS should consider other methods 
of certification for the PS-Prep Program, and what those methods might 
entail.
    [cir] Recommendations on whether the use of this process should be 
associated with either self-declaration or third-party assessment, or 
both.

    Authority:  6 U.S.C. 321m(b)(2)(D).

    Dated: September 24, 2010.
W. Craig Fugate,
Administrator, Federal Emergency Management Agency.
[FR Doc. 2010-24673 Filed 9-30-10; 8:45 am]
BILLING CODE 9111-46-P