2010-24673. Voluntary Private Sector Accreditation and Certification Preparedness Program

AGENCY:

Federal Emergency Management Agency, DHS.

ACTION:

Notice of PS-Prep Small Business Preparedness Plan; Request for Comment.

SUMMARY:

The Department of Homeland Security (DHS) announces an initial plan to address small business concerns in the Voluntary Private Sector Accreditation and Certification Preparedness Program (PS-Prep Program). This initial plan identifies the separate classifications and the methods of certification available for small businesses under the PS-Prep Program. The purpose of this notice is to (1) present the plan for small business preparedness, and (2) invite public comment on the plan. DHS will continue to refine this plan, and will take comments into consideration in doing so.

Instructions: DHS will review any comments received for small business considerations or the PS-Prep Program generally and, when merited, will publish a Federal Register notice providing the results of that review.

Those interested may submit comments, identified by Docket ID FEMA-2008-0017, by one of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. (Note: This process applies to all government requests for comments—even though as in the case of PS-Prep, they may not be for regulatory purposes.)
• Fax: [phone].
• Mail/Hand Delivery/Courier: Office of Chief Counsel, Federal Emergency Management Agency, 500 C Street, SW., Room 840, Washington, DC 20472-3100.

All submissions received must include the agency name and Docket ID FEMA-2008-0017. All submissions will be posted, without change, to the Federal eRulemaking Portal at http://www.regulations.gov,, and will include any personal information you provide. Because comments are made available to the public, submitters should take caution to not include any sensitive, personal information, trade secret, or any commercial or financial information which is obtained from any person and which is deemed privileged or confidential. Submitters may wish to read the Privacy Act notice available on the Privacy Notice link located at the bottom of http://www.regulations.gov.

Docket: For access to the docket to read background documents or comments received, go to the Federal eRulemaking Portal at http://www.regulations.gov. Submitted comments may also be inspected at FEMA, Office of Chief Counsel, 500 C Street, SW., Room 840, Washington, DC 20472.

FOR FURTHER INFORMATION CONTACT:

Mr. Marcus Pollock, National Integration Center, National Preparedness Directorate, Protection and National Preparedness, Federal Emergency Management Agency, 500 C Street, SW., Washington, DC 20472. Phone: [phone] or E-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background

In the Implementing Recommendations of the 9/11 Commission Act of 2007, Congress in Public Law 110-53 (the 9/11 Act) mandated DHS to establish a voluntary private sector preparedness accreditation and certification program. This program, now known as the PS-Prep Program, will assess whether a private sector entity voluntarily complies with one or more preparedness standards adopted by DHS. It will do so through a system of accreditation and certification developed by DHS in close coordination with the private sector.

The 9/11 Act contains a provision, now codified at 6 U.S.C. 321m(b)(2)(D), which requires the PS-Prep Program to “establish separate classifications and methods of certification for small business concerns* * *.” The definition of “small business concerns” is found in the Small Business Administration's regulations at 13 CFR part 121, published in accordance with Section 3 of the Small Business Act (15 U.S.C. 632).

DHS published a notice in the Federal Register on December 24, 2008, describing DHS implementation of the PS-Prep Program, requesting comment on the PS-Prep Program and the target criteria for selecting preparedness standards, and requesting recommendations for standards that DHS should consider. See 73 FR 79140. After reviewing the responses to the December 2008 notice, DHS published a notice in the Federal Register on October 16, 2009, which proposed the adoption of three standards for use in the PS-Prep Program and sought public comment. See 74 FR 53286. After reviewing comments received, DHS published a notice formally adopting those three standards on June 16, 2010. See 75 FR 34148.

DHS received additional information and comments about small business aspects of the PS-Prep Program through several public meetings in Washington, DC, 10 public meetings across the country, and multiple meetings with government agencies and organizations interested in preparedness and small business. These comments further defined small business and provided recommendations regarding appropriate considerations for separate classifications and methods for small business.

A. DHS Standards Adoption for the PS-Prep Program

DHS announced formal adoption of the following three standards on June 16, 2010 (PS-Prep standards).

1. ASIS International, “Organizational Resilience: Security Preparedness, and Continuity Management Systems—Requirements with Guidance for Use,” ASIS SPC. 1-2009 (2009 Edition).

2. British Standards Institution, “Business Continuity Management Part 1: Code of Practice for Business Continuity Management,” BS 25999-1: 2006 (2006 Edition); and “Business Continuity Management Part 2: Specification for Business Continuity Management,” BS 25999-2: 2007 (2007 Edition).

3. National Fire Protection Association, “Standard on Disaster/Emergency Management and Business Continuity Programs,” NPFA-1600 (2007 and 2010 Editions).

B. Initiation of the PS-Prep Accreditation and Certification Process

With the formal adoption of the three PS-Prep standards, the American National Standards Institute—American Society for Quality (ANSI-ASQ) National Accreditation Board (ANAB), the designated PS-Prep accrediting body, will finalize its process for accrediting third-party certifying bodies (CBs) for the PS-Prep Program. Businesses may voluntarily choose to seek third-party certification through CBs accredited by ANAB. See http://www.anab.org/​accreditation/​preparedness.aspx.

C. Prior Solicitation of Comments Regarding Small Business Aspects

DHS received information and comments about small business aspects of the PS-Prep Program from many sources. These comments further reflected the concerns of small businesses and provided suggestions regarding appropriate considerations for separate classifications and methods of certification for small business.

Comments and suggestions included the following:

• Include affordable methods for providing support for implementing preparedness appropriate for small businesses.
• Provide a developmental model with progressive steps prior to third-party certification.
• Provide education, tools, technical assistance, and methods for self-assessment as part of a developmental model.
• Build on existing programs which use preparedness education and best practices.
• Include outreach and education through multiple sources to provide education and technical support that is accessible and convenient for small business.
• Include outreach through new and pre-existing networks to enhance awareness of the PS-Prep Program, its value, and ways to participate.

The draft Program outlined in this notice addresses, in part, the comments, concerns, and suggestions received during PS-Prep outreach activities to date.

II. PS-Prep Small Business Preparedness Plan

Using the size standards found at 13 CFR part 121 and authorized by 15 U.S.C. 632, the vast majority of the commerce in the United States is represented by small businesses. According to the 2007 Economic Census, there are approximately 7.6 million establishments with fewer than 500 employees, and they employ approximately 96 million employees. U.S. society's well-being depends on these businesses for goods and services. Should disaster strike, continued access to those services and products is an important part of recovery and resilience.

The resources required to obtain third-party certification to one of the DHS-adopted preparedness standards may pose a challenge and potential barrier for many small businesses. In the 9/11 Act, Congress recognized that differences in scale and resources require different strategies to effectively promote and implement preparedness for small businesses. Therefore, Congress directed DHS to “establish separate classifications and methods of certification for small business concerns * * *.”

DHS is proposing to use three “classifications” of businesses when determining eligibility for participation in the two “certification methods” (see below). Small business concerns referred to in the PS-Prep Program's authorizing legislation are addressed through the creation of these classifications and through the provision of an additional, different method of certification, available only for small businesses and small not-for-profit concerns. Certification is the desired outcome of a formal process by which entities are assessed to determine their conformity to one or more of the PS-Prep standards.

A. Classifications of Businesses for PS-Prep

The three classifications of private sector entities for the PS-Prep Program are: (1) Small businesses as defined in the Small Business Administration's regulations at 13 CFR part 121, published in accordance with 15 U.S.C. 632; (2) other non-governmental entities with fewer than 500 employees that do not meet the requirements of 13 CFR part 121 and 15 U.S.C. 632; and (3) all private sector entities. These classifications will be used to distinguish eligibility of entities participating in the two methods of certification available under the PS-Prep Program.

For small businesses, 15 U.S.C. 632 provides the criteria for establishing size standards and the definitions of terms used throughout the Small Business Act. The responsibility of establishing size standards is given to the Administrator of the Small Business Administration. The Administrator has defined small businesses through established numerical definitions, or “size standards,” for all for-profit industries. The complete list of size standards can be found in the table at 13 CFR 121.201, or see http://www.sba.gov/​contractingopportunities/​officials/​size/​table/​index.html.

Classification (2), as described above, is intended to capture those small, not-for-profit entities which fall outside of the for-profit based definition for small business as found in 15 U.S.C. 632 and 13 CFR part 121. DHS recognizes that there are small not-for-profit entities which may also desire to achieve conformity with a DHS-adopted preparedness standard, but which face the same issues of limited resources and scale as small businesses. DHS has determined to enable these entities to participate in the PS-Prep Program, by creating classification (2) for not-for-profit entities with fewer than 500 employees. DHS's reasoning for choosing these qualifications is based on the Small Business Administration's regulations at 13 CFR part 121, which identify 500 or fewer employees as a common size for small organizations.

DHS will consider refining classification (2) to include a measure of gross receipts. A possible basis for this refinement would be the Internal Revenue Service's gross receipts requirements for tax-exempt 501(c)(3) organizations eligible to file form 990-N (annual gross receipts less than or equal to $25,000), or form 990-EZ (annual gross receipts between $25,001 and $500,000). Religious and other organizations exempt from filing and having fewer than 500 employees would still qualify to use the PS-Prep self-certification method. DHS seeks comment on this proposed method of defining classification (2).

Classification (3), all private sector entities, captures any private sector entity wishing to participate in the PS-Prep Program. Therefore, a small business would qualify for both classification (1) and classification (3). However, those entities which do not meet the requirements for classifications (1) and (2) would be included only in classification (3). The purpose of these classifications is to qualify for participation in the two methods of certification available in the PS-Prep Program.

B. Methods of Certification for PS-Prep

There will exist two methods for certification under the PS-Prep Program: (1) Self-declaration of conformity, and (2) third-party certification. Entities that can be classified as (1) small businesses as defined in 13 CFR part 121, published in accordance with 15 U.S.C. 632, or (2) other non-governmental entities with fewer than 500 employees, that do not meet requirements of 13 CFR part 121 and 15 U.S.C. 632, are eligible for both methods of certification. All other entities which do not meet the requirements for classifications (1) or (2) will be classified as (3), all private sector entities, and are only eligible for the third-party certification method.

Although DHS has at this time identified the two methods of certification described herein, other methods will be examined and considered. DHS reserves the right to add other methods to the PS-Prep Program following future notice and opportunity for comment.

Businesses that successfully conform to any DHS-adopted PS-Prep standard, as measured by one of the methods outlined in this notice, may receive recognition from DHS. The process for and type of recognition that may be provided are still under consideration and more information will be provided in subsequent announcements or notices.

1. Self-Declaration of Conformity

Any private sector entity that is a member of classifications (1) or (2) as described above may assess and attest to its conformity to one or more of the PS-Prep standards.

The self-declaration of conformity process will be similar to what is sometimes known as a manufacturer's or supplier's declaration of conformance. This is based on an accepted industry practice whereby manufacturers or suppliers formally declare that their products or services conform to relevant standards. DHS proposes that self-declaration will be based upon the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) standard 17050-1, “Conformity Assessment—Supplier's Declaration Assessment—Supplier's declaration of conformity—Part 1: General requirements” and ISO/IEC standard 17050-2, “Conformity Assessment—Supplier's declaration of conformity—Part 2: Supporting documentation.” Together, these parts of the standard specify general requirements for a supplier's declaration of conformity in cases where conformity of an object to a specified requirement must be attested.

In the United States, ISO/IEC standard 17050-1 and 17050-2 are available for the respective fees of $49.00 and $37.00. To purchase, search the American National Standards Institute online store, at http://webstore.ansi.org/​default.aspx. In addition, FEMA will maintain a copy of the standard, and make it available upon request for viewing in person at FEMA's reading room, located at 500 C Street, SW., Room 840, Washington, DC 20472. Due to licensing and copyright restrictions, however, these documents will be available for review only, not for copying.

DHS is still considering the plan for management and oversight of the self-declaration of conformity process, and will provide more information through subsequent announcements or notices. DHS will consider other processes of self-declaration of conformity. One example may be a comprehensive, Web-based self-assessment that could include a document review of key business continuity protocols.

2. Third-Party Certification

Any private sector entity may undertake an independent, third-party validation that it conforms to one or more of the PS-Prep standards, using a certifying body (CB) that is accredited by ANAB. This is the general certification scheme outlined in PS-Prep's authorizing legislation. This process is notably more rigorous and measurable than self-declaration of conformity. Many CBs have a conformity assessment process that tailors to the needs and possible resource constraints of small businesses. Under this method, any entity is eligible to seek certification from an ANAB-accredited CB. For more information, see the prior Federal Register notices referenced above and http://www.anab.org/​accreditation/​preparedness.aspx.

C. Additional Small Business Support

DHS recognizes that some small businesses may desire additional guidance and assistance to help them in achieving preparedness and to prepare for participating in a method of certification. Participation in such guidance and support activities is not required to participate in the PS-Prep Program. However, small businesses might find it useful as they seek conformance to one of the DHS-adopted preparedness standards.

There are a number of public and private entities that provide programs and activities that support preparedness. These entities include academic institutions, community-based non-profit, and for-profit institutions that provide education, training, assessment and technical assistance to small business. DHS encourages the development of tools and programs that will assist small businesses in improving preparedness and reaching conformance to an adopted standard. Businesses may participate in a variety of preparedness related activities such as classroom or web-based courses, technical assistance to conduct a hazard and/or vulnerability assessments, or to establish governance or planning activities.

DHS will develop guidance for small businesses based on public input from this Federal Register notice and other outreach activities. This guidance will assist small businesses in identifying organizations that can help them both improve their preparedness and potentially become certified to one of the DHS-adopted standards using one of the methods outlined herein. This guidance will include attributes that these organizations' small business support activities have or should have. These attributes will be used by DHS to evaluate organizations that provide small business support services. For example, the organizations providing support to small businesses should have some or all of the elements listed below:

• Demonstrated expertise and experience in preparedness and small business concerns.
• A recognized program sponsorship, preferably at a national organization level (e.g., American Red Cross, Ready.gov, etc.) or at a State or Tribal government level.
• Web-based and/or local delivery mechanisms for accessibility to small business at a local level.
• Relevant programs or components that are demonstrated to be affordable to small business.
• Intent to develop substantive relationships between its program or component tools and elements of PS-Prep standards.
• Administrative mechanisms for tracking participants in order to recognize achievement or progress.

By choosing a support organization with elements like these, small businesses should be able to increase their preparedness in an affordable manner with the support of a reputable organization that uses proven practices.

III. Request for Comment

This notice describes the plan for implementing separate classifications and methods of certification for small businesses. DHS intends for the third-party certification method to be formally announced in September 2010 and will continue to refine the PS-Prep Small Business Preparedness Plan based on public feedback. DHS invites comments on the PS-Prep Small Business Preparedness Plan as outlined in this notice and, specifically, invites comments regarding the following:

• The classifications of businesses in the PS-Prep Program, including how they are used to distinguish eligibility for the methods of certification outlined in this notice.
• The methods of certification (self-declaration of conformity and/or third-party certification).
• The use of the ISO/IEC 17050-Parts 1 and 2 to guide the self-declaration of conformity process.
• Recommendations for:

○ Information to include in the guidance for small business support activities attributes referenced in Section II.C., above, including the types of organizations and programs to consider and the attributes that should be considered.

○ Additional approaches to providing support for small business education, training, and development.

○ How businesses can be recognized under each method of certification.

○ Whether classification (2) as discussed in II.A, above, should be based upon the Internal Revenue Service's use of gross receipts to determine reporting requirements for tax-exempt 501(c)(3) organizations.

○ How to encourage small businesses considering participation in self-declaration of conformity to participate in third-party certification instead.

○ Recommendations on the use of a limited conformity assessment process that would include an off-site document review without an accompanying on-site assessment. A limited conformity assessment process may potentially reduce some of the costs associated with conformity assessment.

○ Recommendations on whether DHS should consider other methods of certification for the PS-Prep Program, and what those methods might entail.

○ Recommendations on whether the use of this process should be associated with either self-declaration or third-party assessment, or both.

Authority: 6 U.S.C. 321m(b)(2)(D).

Dated: September 24, 2010.

W. Craig Fugate,

Administrator, Federal Emergency Management Agency.