6 U.S.C. § 321m — Voluntary private sector preparedness accreditation and certification program

(a) Establishment. (1) In general. The Secretary must create and run a voluntary program that lets private-sector businesses become accredited and certified for disaster preparedness. An officer picked by the Secretary runs the program. (2) Designation of officer. The Secretary must pick one of three officials to run the program: the Administrator (FEMA), chosen for expertise in emergency management and the role as the President's main emergency-management adviser; the Assistant Secretary for Infrastructure Protection, chosen for expertise in protecting critical infrastructure, risk-assessment methods, and working with the private sector; or the Under Secretary for Science and Technology, chosen for expertise in standards. (3) Coordination. Whichever official is picked (the "designated officer") must coordinate with the other two officials named above, using their expertise, and with the Special Assistant to the Secretary for the Private Sector, who has expertise working with private businesses. (b) Voluntary standards; accreditation and certification program. (1) Accreditation and certification program. By March 1, 2008 (210 days after August 3, 2007), the designated officer must start supporting the creation and updating of voluntary preparedness standards through organizations that develop consensus standards. Working with standards organizations, the private-sector advisory councils set up under section 112(f)(4), state and local emergency officials, and private groups like sector coordinating councils, the officer must also develop and promote a program that certifies businesses that choose to seek certification, and put that program into action through an outside entity chosen under paragraph (3) — that entity will then accredit third parties to actually do the certifying. (2) Program elements. The program checks whether a business follows the voluntary preparedness standards, and the designated officer must write guidelines for how accreditation and certification work. Working with the same standards organizations, advisory councils, and government and private-sector representatives listed above, the officer must adopt one or more voluntary preparedness standards — which can be tailored to different industries — for use in the program, and may later add, change, or drop standards as needed. The officer may accept recommendations for standards, including industry-specific ones, from these groups. The officer and the outside accrediting entity must create separate certification categories and methods for small businesses (as defined in 15 U.S.C. § 632). In building the program, the officer must consider standards and best practices that already exist under other federal laws or that were set by a Sector Risk Management Agency (as defined under Homeland Security Presidential Directive-7), and must coordinate the program with other Department of Homeland Security private-sector programs and with similar programs at other federal agencies. (3) Accreditation and certification processes. By March 1, 2008, the designated officer must sign an agreement with one or more qualified outside nonprofit or private organizations — called "selected entities" — that have experience developing consensus standards and running accreditation and certification programs. A selected entity manages accreditation and oversees certification but may not itself certify businesses; instead, it accredits qualified third parties to do the certifying. If there is more than one selected entity, they must work together to create procedures and requirements for accreditation and certification that are reasonably consistent with each other, and the designated officer resolves any disagreements between them. A selected entity may accredit any qualified third party to do certifications, and must try, as much as practical, to include qualified small, minority-owned, women-owned, or otherwise disadvantaged businesses among those accredited third parties — a "disadvantaged business concern" is a small business owned and controlled by people who are socially and economically disadvantaged, as defined by federal regulation. If a business seeking certification already holds other relevant certifications, the selected entity may give it credit for those, so the business does not have to duplicate work. To become accredited, a third party must show it can certify businesses under the established procedures, agree to follow those procedures, agree it has no ownership stake or control over any business it certifies or over any firm that sells preparedness consulting, agree it has no other conflict of interest, carry the required liability insurance, and agree to protect any confidential information it learns about a business during certification. The designated officer and the selected entities must regularly monitor and inspect third parties to make sure they are following the rules; if a third party is not, the selected entity must revoke its accreditation and review any certifications that third party already issued. (4) Annual review. Each year, the designated officer, working with the same standards organizations, advisory councils, and government representatives, must review the whole program — including how well the selected entities are managing it and including disadvantaged businesses — and make improvements as needed. Each review must also assess the preparedness standards themselves. (5) Voluntary participation. No business is ever required to get certified under this program. (6) Public listing. The designated officer must keep and publish a list of businesses that have been certified, but only for businesses that agree to be listed. (c) Rule of construction. Nothing in this section requires replacing any preparedness, emergency-response, or business-continuity standards that already exist under other federal law or that were set by a Sector Risk Management Agency. And getting certified — or trying to — does not excuse a business from following every other law, regulation, directive, policy, or industry code that applies to it.