§624. Civil enforcement

(a) Notice of noncompliance

(1) Notice

If the Secretary determines that a covered chemical facility is not in compliance with this subchapter, the Secretary shall—

(A) provide the owner or operator of the facility with—

(i) not later than 14 days after date ¹ on which the Secretary makes the determination, a written notification of noncompliance that includes a clear explanation of any deficiency in the security vulnerability assessment or site security plan; and

(ii) an opportunity for consultation with the Secretary or the Secretary's designee; and

(B) issue to the owner or operator of the facility an order to comply with this subchapter by a date specified by the Secretary in the order, which date shall be not later than 180 days after the date on which the Secretary issues the order.

(2) Continued noncompliance

If an owner or operator remains noncompliant after the procedures outlined in paragraph (1) have been executed, or demonstrates repeated violations of this subchapter, the Secretary may enter an order in accordance with this section assessing a civil penalty, an order to cease operations, or both.

(b) Civil penalties

(1) Violations of orders

Any person who violates an order issued under this subchapter shall be liable for a civil penalty under section 70119(a) of title 46.

(2) Non-reporting chemical facilities of interest

Any owner of a chemical facility of interest who fails to comply with, or knowingly submits false information under, this subchapter or the CFATS regulations shall be liable for a civil penalty under section 70119(a) of title 46.

(c) Emergency orders

(1) In general

Notwithstanding subsection (a) or any site security plan or alternative security program approved under this subchapter, if the Secretary determines that there is an imminent threat of death, serious illness, or severe personal injury, due to a violation of this subchapter or the risk of a terrorist incident that may affect a chemical facility of interest, the Secretary—

(A) shall consult with the facility, if practicable, on steps to mitigate the risk; and

(B) may order the facility, without notice or opportunity for a hearing, effective immediately or as soon as practicable, to—

(i) implement appropriate emergency security measures; or

(ii) cease or reduce some or all operations, in accordance with safe shutdown procedures, if the Secretary determines that such a cessation or reduction of operations is the most appropriate means to address the risk.

(2) Limitation on delegation

The Secretary may not delegate the authority under paragraph (1) to any official other than the Director of the Cybersecurity and Infrastructure Security Agency.

(3) Limitation on authority

The Secretary may exercise the authority under this subsection only to the extent necessary to abate the imminent threat determination under paragraph (1).

(4) Due process for facility owner or operator

(A) Written orders

An order issued by the Secretary under paragraph (1) shall be in the form of a written emergency order that—

(i) describes the violation or risk that creates the imminent threat;

(ii) states the security measures or order issued or imposed; and

(iii) describes the standards and procedures for obtaining relief from the order.

(B) Opportunity for review

After issuing an order under paragraph (1) with respect to a chemical facility of interest, the Secretary shall provide for review of the order under section 554 of title 5 if a petition for review is filed not later than 20 days after the date on which the Secretary issues the order.

(C) Expiration of effectiveness of order

If a petition for review of an order is filed under subparagraph (B) and the review under that paragraph ² is not completed by the last day of the 30-day period beginning on the date on which the petition is filed, the order shall vacate automatically at the end of that period unless the Secretary determines, in writing, that the imminent threat providing a basis for the order continues to exist.

(d) Right of action

Nothing in this subchapter confers upon any person except the Secretary or his or her designee a right of action against an owner or operator of a covered chemical facility to enforce any provision of this subchapter.

(Pub. L. 107–296, title XXI, §2104, as added Pub. L. 113–254, §2(a), Dec. 18, 2014, 128 Stat. 2912; amended Pub. L. 115–278, §2(g)(8)(B), Nov. 16, 2018, 132 Stat. 4180; Pub. L. 117–263, div. G, title LXXI, §7143(c)(4), Dec. 23, 2022, 136 Stat. 3663.)

Termination of Section

For termination of section by section 5 of Pub. L. 113–254, see Effective and Termination Dates note below.

Editorial Notes

Amendments

2022—Subsec. (c)(2). Pub. L. 117–263 substituted "Director of the Cybersecurity and Infrastructure Security Agency" for "Director of Cybersecurity and Infrastructure Security".

2018—Subsec. (c)(2). Pub. L. 115–278 substituted "Director of Cybersecurity and Infrastructure Security" for "Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department appointed under section 113(a)(1)(H) of this title".

Statutory Notes and Related Subsidiaries

Effective and Termination Dates

Section effective on the date that is 30 days after Dec. 18, 2014, and authority provided under this section to terminate on July 27, 2023, see sections 4(a) and 5 of Pub. L. 113–254, set out as notes under section 621 of this title.

Rule of Construction

Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out in a note under section 650 of this title.

¹ So in original. Probably should be preceded by "the".

² So in original. Probably should be "that subparagraph".