[Federal Register Volume 75, Number 190 (Friday, October 1, 2010)]
[Notices]
[Pages 60773-60776]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-24673]
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
Federal Emergency Management Agency
[Docket ID FEMA-2008-0017]
Voluntary Private Sector Accreditation and Certification
Preparedness Program
AGENCY: Federal Emergency Management Agency, DHS.
ACTION: Notice of PS-Prep Small Business Preparedness Plan; Request for
Comment.
-----------------------------------------------------------------------
SUMMARY: The Department of Homeland Security (DHS) announces an initial
plan to address small business concerns in the Voluntary Private Sector
Accreditation and Certification Preparedness Program (PS-Prep Program).
This initial plan identifies the separate classifications and the
methods of certification available for small businesses under the PS-
Prep Program. The purpose of this notice is to (1) present the plan for
small business preparedness, and (2) invite public comment on the plan.
DHS will continue to refine this plan, and will take comments into
consideration in doing so.
Instructions: DHS will review any comments received for small
business considerations or the PS-Prep Program generally and, when
merited, will publish a Federal Register notice providing the results
of that review.
Those interested may submit comments, identified by Docket ID FEMA-
2008-0017, by one of the following methods:
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments. (Note: This process
applies to all government requests for comments--even though as in the
case of PS-Prep, they may not be for regulatory purposes.)
Fax: 703-483-2999.
Mail/Hand Delivery/Courier: Office of Chief Counsel,
Federal Emergency Management Agency, 500 C Street, SW., Room 840,
Washington, DC 20472-3100.
All submissions received must include the agency name and Docket ID
FEMA-2008-0017. All submissions will be posted, without change, to the
Federal eRulemaking Portal at http://www.regulations.gov, and will
include any personal information you provide. Because comments are made
available to the public, submitters should take caution to not include
any sensitive, personal information, trade secret, or any commercial or
financial information which is obtained from any person and which is
deemed privileged or confidential. Submitters may wish to read the
Privacy Act notice available on the Privacy Notice link located at the
bottom of http://www.regulations.gov.
Docket: For access to the docket to read background documents or
comments received, go to the Federal eRulemaking Portal at http://www.regulations.gov. Submitted comments may also be inspected at FEMA,
Office of Chief Counsel, 500 C Street, SW., Room 840, Washington, DC
20472.
FOR FURTHER INFORMATION CONTACT: Mr. Marcus Pollock, National
Integration Center, National Preparedness Directorate, Protection and
National Preparedness, Federal Emergency Management Agency, 500 C
Street, SW., Washington, DC 20472. Phone: 202-646-2801 or E-mail: [email protected].
SUPPLEMENTARY INFORMATION:
I. Background
In the Implementing Recommendations of the 9/11 Commission Act of
2007, Congress in Public Law 110-53 (the 9/11 Act) mandated DHS to
establish a voluntary private sector preparedness accreditation and
certification program. This program, now known as the PS-Prep Program,
will assess whether a private sector entity voluntarily complies with
one or more preparedness standards adopted by DHS. It will do so
through a system of accreditation and certification developed by DHS in
close coordination with the private sector.
The 9/11 Act contains a provision, now codified at 6 U.S.C.
321m(b)(2)(D), which requires the PS-Prep Program to ``establish
separate classifications and methods of certification for small
business concerns* * *.'' The definition of ``small business concerns''
is found in the Small Business Administration's regulations at 13 CFR
part 121, published in accordance with Section 3 of the Small Business
Act (15 U.S.C. 632).
DHS published a notice in the Federal Register on December 24,
2008, describing DHS implementation of the PS-Prep Program, requesting
comment on the PS-Prep Program and the target criteria for selecting
preparedness standards, and requesting recommendations for standards
that DHS should consider. See 73 FR 79140. After reviewing the
responses to the December 2008 notice, DHS published a notice in the
Federal Register on October 16, 2009, which proposed the adoption of
three standards for use in the PS-Prep Program and sought public
comment. See 74 FR 53286. After reviewing comments received, DHS
published a notice formally adopting those three standards on June 16,
2010. See 75 FR 34148.
DHS received additional information and comments about small
business aspects of the PS-Prep Program through several public meetings
in Washington, DC, 10 public meetings across the country, and multiple
meetings with government agencies and organizations interested in
preparedness and small business. These comments further defined small
business and provided recommendations regarding appropriate
considerations for separate classifications and methods for small
business.
A. DHS Standards Adoption for the PS-Prep Program
DHS announced formal adoption of the following three standards on
June 16, 2010 (PS-Prep standards).
1. ASIS International, ``Organizational Resilience: Security
Preparedness, and Continuity Management Systems--Requirements with
Guidance for Use,'' ASIS SPC. 1-2009 (2009 Edition).
2. British Standards Institution, ``Business Continuity Management
Part 1: Code of Practice for Business Continuity Management,'' BS
25999-1: 2006 (2006 Edition); and ``Business Continuity Management Part
2: Specification for Business Continuity Management,'' BS 25999-2: 2007
(2007 Edition).
3. National Fire Protection Association, ``Standard on Disaster/
Emergency Management and Business Continuity Programs,'' NPFA-1600
(2007 and 2010 Editions).
B. Initiation of the PS-Prep Accreditation and Certification Process
With the formal adoption of the three PS-Prep standards, the
American National Standards Institute--American Society for Quality
(ANSI-ASQ) National Accreditation Board (ANAB), the designated PS-Prep
accrediting body, will finalize its process for accrediting third-party
certifying bodies (CBs) for the PS-Prep Program. Businesses may
voluntarily choose to seek third-party certification through
[[Page 60774]]
CBs accredited by ANAB. See http://www.anab.org/accreditation/preparedness.aspx.
C. Prior Solicitation of Comments Regarding Small Business Aspects
DHS received information and comments about small business aspects
of the PS-Prep Program from many sources. These comments further
reflected the concerns of small businesses and provided suggestions
regarding appropriate considerations for separate classifications and
methods of certification for small business.
Comments and suggestions included the following:
Include affordable methods for providing support for
implementing preparedness appropriate for small businesses.
Provide a developmental model with progressive steps prior
to third-party certification.
Provide education, tools, technical assistance, and
methods for self-assessment as part of a developmental model.
Build on existing programs which use preparedness
education and best practices.
Include outreach and education through multiple sources to
provide education and technical support that is accessible and
convenient for small business.
Include outreach through new and pre-existing networks to
enhance awareness of the PS-Prep Program, its value, and ways to
participate.
The draft Program outlined in this notice addresses, in part, the
comments, concerns, and suggestions received during PS-Prep outreach
activities to date.
II. PS-Prep Small Business Preparedness Plan
Using the size standards found at 13 CFR part 121 and authorized by
15 U.S.C. 632, the vast majority of the commerce in the United States
is represented by small businesses. According to the 2007 Economic
Census, there are approximately 7.6 million establishments with fewer
than 500 employees, and they employ approximately 96 million employees.
U.S. society's well-being depends on these businesses for goods and
services. Should disaster strike, continued access to those services
and products is an important part of recovery and resilience.
The resources required to obtain third-party certification to one
of the DHS-adopted preparedness standards may pose a challenge and
potential barrier for many small businesses. In the 9/11 Act, Congress
recognized that differences in scale and resources require different
strategies to effectively promote and implement preparedness for small
businesses. Therefore, Congress directed DHS to ``establish separate
classifications and methods of certification for small business
concerns * * *.''
DHS is proposing to use three ``classifications'' of businesses
when determining eligibility for participation in the two
``certification methods'' (see below). Small business concerns referred
to in the PS-Prep Program's authorizing legislation are addressed
through the creation of these classifications and through the provision
of an additional, different method of certification, available only for
small businesses and small not-for-profit concerns. Certification is
the desired outcome of a formal process by which entities are assessed
to determine their conformity to one or more of the PS-Prep standards.
A. Classifications of Businesses for PS-Prep
The three classifications of private sector entities for the PS-
Prep Program are: (1) Small businesses as defined in the Small Business
Administration's regulations at 13 CFR part 121, published in
accordance with 15 U.S.C. 632; (2) other non-governmental entities with
fewer than 500 employees that do not meet the requirements of 13 CFR
part 121 and 15 U.S.C. 632; and (3) all private sector entities. These
classifications will be used to distinguish eligibility of entities
participating in the two methods of certification available under the
PS-Prep Program.
For small businesses, 15 U.S.C. 632 provides the criteria for
establishing size standards and the definitions of terms used
throughout the Small Business Act. The responsibility of establishing
size standards is given to the Administrator of the Small Business
Administration. The Administrator has defined small businesses through
established numerical definitions, or ``size standards,'' for all for-
profit industries. The complete list of size standards can be found in
the table at 13 CFR 121.201, or see http://www.sba.gov/contractingopportunities/officials/size/table/index.html.
Classification (2), as described above, is intended to capture
those small, not-for-profit entities which fall outside of the for-
profit based definition for small business as found in 15 U.S.C. 632
and 13 CFR part 121. DHS recognizes that there are small not-for-profit
entities which may also desire to achieve conformity with a DHS-adopted
preparedness standard, but which face the same issues of limited
resources and scale as small businesses. DHS has determined to enable
these entities to participate in the PS-Prep Program, by creating
classification (2) for not-for-profit entities with fewer than 500
employees. DHS's reasoning for choosing these qualifications is based
on the Small Business Administration's regulations at 13 CFR part 121,
which identify 500 or fewer employees as a common size for small
organizations.
DHS will consider refining classification (2) to include a measure
of gross receipts. A possible basis for this refinement would be the
Internal Revenue Service's gross receipts requirements for tax-exempt
501(c)(3) organizations eligible to file form 990-N (annual gross
receipts less than or equal to $25,000), or form 990-EZ (annual gross
receipts between $25,001 and $500,000). Religious and other
organizations exempt from filing and having fewer than 500 employees
would still qualify to use the PS-Prep self-certification method. DHS
seeks comment on this proposed method of defining classification (2).
Classification (3), all private sector entities, captures any
private sector entity wishing to participate in the PS-Prep Program.
Therefore, a small business would qualify for both classification (1)
and classification (3). However, those entities which do not meet the
requirements for classifications (1) and (2) would be included only in
classification (3). The purpose of these classifications is to qualify
for participation in the two methods of certification available in the
PS-Prep Program.
B. Methods of Certification for PS-Prep
There will exist two methods for certification under the PS-Prep
Program: (1) Self-declaration of conformity, and (2) third-party
certification. Entities that can be classified as (1) small businesses
as defined in 13 CFR part 121, published in accordance with 15 U.S.C.
632, or (2) other non-governmental entities with fewer than 500
employees, that do not meet requirements of 13 CFR part 121 and 15
U.S.C. 632, are eligible for both methods of certification. All other
entities which do not meet the requirements for classifications (1) or
(2) will be classified as (3), all private sector entities, and are
only eligible for the third-party certification method.
Although DHS has at this time identified the two methods of
certification described herein, other methods will be examined and
considered. DHS reserves the right to
[[Page 60775]]
add other methods to the PS-Prep Program following future notice and
opportunity for comment.
Businesses that successfully conform to any DHS-adopted PS-Prep
standard, as measured by one of the methods outlined in this notice,
may receive recognition from DHS. The process for and type of
recognition that may be provided are still under consideration and more
information will be provided in subsequent announcements or notices.
1. Self-Declaration of Conformity
Any private sector entity that is a member of classifications (1)
or (2) as described above may assess and attest to its conformity to
one or more of the PS-Prep standards.
The self-declaration of conformity process will be similar to what
is sometimes known as a manufacturer's or supplier's declaration of
conformance. This is based on an accepted industry practice whereby
manufacturers or suppliers formally declare that their products or
services conform to relevant standards. DHS proposes that self-
declaration will be based upon the International Organization for
Standardization/International Electrotechnical Commission (ISO/IEC)
standard 17050-1, ``Conformity Assessment--Supplier's Declaration
Assessment--Supplier's declaration of conformity--Part 1: General
requirements'' and ISO/IEC standard 17050-2, ``Conformity Assessment--
Supplier's declaration of conformity--Part 2: Supporting
documentation.'' Together, these parts of the standard specify general
requirements for a supplier's declaration of conformity in cases where
conformity of an object to a specified requirement must be attested.
In the United States, ISO/IEC standard 17050-1 and 17050-2 are
available for the respective fees of $49.00 and $37.00. To purchase,
search the American National Standards Institute online store, at
http://webstore.ansi.org/default.aspx. In addition, FEMA will maintain
a copy of the standard, and make it available upon request for viewing
in person at FEMA's reading room, located at 500 C Street, SW., Room
840, Washington, DC 20472. Due to licensing and copyright restrictions,
however, these documents will be available for review only, not for
copying.
DHS is still considering the plan for management and oversight of
the self-declaration of conformity process, and will provide more
information through subsequent announcements or notices. DHS will
consider other processes of self-declaration of conformity. One example
may be a comprehensive, Web-based self-assessment that could include a
document review of key business continuity protocols.
2. Third-Party Certification
Any private sector entity may undertake an independent, third-party
validation that it conforms to one or more of the PS-Prep standards,
using a certifying body (CB) that is accredited by ANAB. This is the
general certification scheme outlined in PS-Prep's authorizing
legislation. This process is notably more rigorous and measurable than
self-declaration of conformity. Many CBs have a conformity assessment
process that tailors to the needs and possible resource constraints of
small businesses. Under this method, any entity is eligible to seek
certification from an ANAB-accredited CB. For more information, see the
prior Federal Register notices referenced above and http://www.anab.org/accreditation/preparedness.aspx.
C. Additional Small Business Support
DHS recognizes that some small businesses may desire additional
guidance and assistance to help them in achieving preparedness and to
prepare for participating in a method of certification. Participation
in such guidance and support activities is not required to participate
in the PS-Prep Program. However, small businesses might find it useful
as they seek conformance to one of the DHS-adopted preparedness
standards.
There are a number of public and private entities that provide
programs and activities that support preparedness. These entities
include academic institutions, community-based non-profit, and for-
profit institutions that provide education, training, assessment and
technical assistance to small business. DHS encourages the development
of tools and programs that will assist small businesses in improving
preparedness and reaching conformance to an adopted standard.
Businesses may participate in a variety of preparedness related
activities such as classroom or web-based courses, technical assistance
to conduct a hazard and/or vulnerability assessments, or to establish
governance or planning activities.
DHS will develop guidance for small businesses based on public
input from this Federal Register notice and other outreach activities.
This guidance will assist small businesses in identifying organizations
that can help them both improve their preparedness and potentially
become certified to one of the DHS-adopted standards using one of the
methods outlined herein. This guidance will include attributes that
these organizations' small business support activities have or should
have. These attributes will be used by DHS to evaluate organizations
that provide small business support services. For example, the
organizations providing support to small businesses should have some or
all of the elements listed below:
Demonstrated expertise and experience in preparedness and
small business concerns.
A recognized program sponsorship, preferably at a national
organization level (e.g., American Red Cross, Ready.gov, etc.) or at a
State or Tribal government level.
Web-based and/or local delivery mechanisms for
accessibility to small business at a local level.
Relevant programs or components that are demonstrated to
be affordable to small business.
Intent to develop substantive relationships between its
program or component tools and elements of PS-Prep standards.
Administrative mechanisms for tracking participants in
order to recognize achievement or progress.
By choosing a support organization with elements like these, small
businesses should be able to increase their preparedness in an
affordable manner with the support of a reputable organization that
uses proven practices.
III. Request for Comment
This notice describes the plan for implementing separate
classifications and methods of certification for small businesses. DHS
intends for the third-party certification method to be formally
announced in September 2010 and will continue to refine the PS-Prep
Small Business Preparedness Plan based on public feedback. DHS invites
comments on the PS-Prep Small Business Preparedness Plan as outlined in
this notice and, specifically, invites comments regarding the
following:
The classifications of businesses in the PS-Prep Program,
including how they are used to distinguish eligibility for the methods
of certification outlined in this notice.
The methods of certification (self-declaration of
conformity and/or third-party certification).
The use of the ISO/IEC 17050-Parts 1 and 2 to guide the
self-declaration of conformity process.
Recommendations for:
[cir] Information to include in the guidance for small business
support activities attributes referenced in
[[Page 60776]]
Section II.C., above, including the types of organizations and programs
to consider and the attributes that should be considered.
[cir] Additional approaches to providing support for small business
education, training, and development.
[cir] How businesses can be recognized under each method of
certification.
[cir] Whether classification (2) as discussed in II.A, above,
should be based upon the Internal Revenue Service's use of gross
receipts to determine reporting requirements for tax-exempt 501(c)(3)
organizations.
[cir] How to encourage small businesses considering participation
in self-declaration of conformity to participate in third-party
certification instead.
[cir] Recommendations on the use of a limited conformity assessment
process that would include an off-site document review without an
accompanying on-site assessment. A limited conformity assessment
process may potentially reduce some of the costs associated with
conformity assessment.
[cir] Recommendations on whether DHS should consider other methods
of certification for the PS-Prep Program, and what those methods might
entail.
[cir] Recommendations on whether the use of this process should be
associated with either self-declaration or third-party assessment, or
both.
Authority: 6 U.S.C. 321m(b)(2)(D).
Dated: September 24, 2010.
W. Craig Fugate,
Administrator, Federal Emergency Management Agency.
[FR Doc. 2010-24673 Filed 9-30-10; 8:45 am]
BILLING CODE 9111-46-P