Although activity on the DHS (Department of Homeland Security) Private Sector Preparedness (PS-Prep) initiative appeared to have lagged a bit following the last stakeholder meeting in November 2009, efforts were stepped up following the April 2010 Gulf oil spill. British Petroleum’s apparent lack of disaster preparedness prompted the chairmen of both the Senate Homeland Security & Governmental Affairs Committee and the House Committee on Homeland Security to jointly nudge DHS and the Federal Emergency Management Agency (FEMA) to move faster on the development of more effective controls and improved standards of operation for private-sector businesses – more specifically, on development and implementation of the PS-Prep standards.
Prior to 15 July 2010, there were no DHS-adopted standards by which U.S. businesses and other private sector entities could develop and properly assess their preparedness for all hazards – preparedness that could, among other things: (a) reduce the impact of all hazards; (b) protect employees; and (c) help ensure business recovery following a crisis. The private sector includes companies, facilities, hospitals, stadiums, businesses, universities, and non-profit organizations — which collectively own and are responsible for an estimated 85 percent of the nation’s critical infrastructure and other material resources. Those resources are vital to disaster preparedness and response capabilities and to enhancing the nation’s readiness and resiliency capabilities. It is therefore critical to homeland security that the private sector be well versed on how to prevent, endure, and mitigate crisis situations.
In 2004, the 9/11 Commission recognized the need for private sector preparedness standards, and endorsed the use of NFPA (National Fire Protection Association) 1600 as the National Preparedness Standard. Three years later, though, in 2007, Congress recognized that not all of the 9/11 Commission recommendations were being met, and for that reason mandated that DHS develop and implement a voluntary program of accreditation and certification of private entities – using preparedness standards adopted by DHS.
Relevant Standards, Consensus Approval, Timely Certification
The purpose of the new program would be to enhance nationwide disaster response and recovery capabilities by encouraging and facilitating private sector preparedness. Public Law 110-553 was passed, entitled Implementing Recommendations of the 9/11 Commission Act. Title IX of that Act established The Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) – which, among other things, creates a partnership between DHS and the private sector that can be used to reach consensus on preparedness standards relevant to all stakeholders.
The PS-Prep program involves several parts, including: (1) the solicitation, development, and consensus approval of private sector standards by government and private sector stakeholders: (2) the development and DHS approval of a system for certifying private sector conformity to approved standards; and (3) implementation of the standards by the private sector, and of the certification program by accredited certifiers.
In July 2008, DHS selected the ANSI-ASQ National Accreditation Board (ANAB) as a sole-source accreditation body to support, develop, and oversee implementation of the voluntary Private Sector Preparedness Certification Program, which is based on ANAB’s unique experience as the U.S. accrediting body for the voluntary certification programs for quality and environmental management systems which in turn are based, respectively, on the ISO (International Standards Organization) 9001 and 14001.
An Extended But Deliberately Reiterative Process
Six months later, in December 2008, the DHS’s target criteria for private sector preparedness standards were published in the Federal Register as Notice 73 FR 79140. In that notice, DHS introduced the PS-Prep program and, as required by law, solicited preparedness standards from stakeholders, and also requested their comments on implementation of the program.
DHS then engaged with its private sector partners through a series of additional Federal Register notices, public meetings, and other initiatives, gathering stakeholder comments and incorporating them into all aspects of the PS-Prep initiative. Since the December 2008 Federal Register notice, DHS also has engaged the public on programmatic issues through yet another series of Federal Register Notices, public meetings and other interactions with private sector firms, associations, and other entities. In all, 25 preparedness standards were submitted, 21 of them by the private sector, for consideration as the final standards recommended for DHS adoption. Finally, in October 2009, DHS announced – also via the Federal Register – its intent to adopt three of the PS-Prep standards that had been submitted, each comprehensively dealing with preparedness in a fashion that was both relative and realistic to most private sector entities. That announcement was followed by another series of regional public meetings, and public comments from stakeholders on the three standards were incorporated into the final documents.
Eight months later – more specifically, on 15 June 2010, with the Gulf oil spill debacle pressuring completion of the initiative – FEMA announced that the three PS-Prep standards had been approved for use by the private sector for disaster preparedness and recovery. The three standards are:
- ASIS International SPC.1-2009 Organizational Resilience: Security Preparedness, and Continuity Management System – Requirements with Guidance for use (2009 Edition). This standard is available at no cost.
- British Standards Institution (BSI) 25999 (2007 Edition) – Business Continuity Management (BS 25999:2006-1 Code of practice for business continuity management, and BS 25999: 2007-2 Specification for business continuity management). Both parts of this BSI standard are available for $19.99 each.
- National Fire Protection Association 1600 – Standard on Disaster/Emergency Management and Business Continuity Programs, 2007 and 2010 editions. This standard also is available at no cost.
With the PS-Prep standards now approved, ANAB plans, over the next several months, to manage the accreditation of third party certification organizations to carry out PS-Prep certifications in accordance with accepted procedures of the program, and is already prepared to accept confirmation from certification bodies to participate in the program.
Meanwhile, ANAB has worked closely with DHS and FEMA over the last two years to develop accreditation procedures, recommended by a Committee of Experts formed by ANAB, for the PS-Prep program, and expects to complete that task sometime next month. Certification will serve as confirmation that an accredited third party certification organization has validated a private sector entity’s conformity to one or more of the three approved preparedness standards listed above. Private sector entities that choose to use these standards may apply for certification – and, once certified, will undergo periodic reassessment and auditing to ensure their continued conformity. DHS will publish a list of all PS-Prep certified private sector entities that ask to be listed. FEMA Administrator Craig Fugate is the Designated Officer of the PS-Prep program and serves as Chair of the Private Sector Preparedness Coordinating Council. He and the council members are responsible for monitoring the effectiveness of the accreditation and certification program on an ongoing basis.
Note: Although three PS-Prep standards have been selected and are DHS-approved, FEMA continues to solicit comments on the new PS-Prep initiative. Comments may be submitted to http://www.regulations.gov or FEMA-POLICY@dhs.gov in Docket FEMA-2008-0017. For additional information, stakeholders are encouraged to visit http://www.fema/gov/privatesectorpreparedness/.
Diana Hopkins is the creator of the consulting firm “Solutions for Standards” (www.solutionsforstandards.com). She is a 12-year veteran of AOAC INTERNATIONAL and former senior director of AOAC Standards Development. Most of her work since the 2001 terrorist attacks has focused on standards development in the fields of homeland security and emergency management. In addition to being an advocate of ethics and quality in standards development, Hopkins is also a certified first responder and a recognized expert in technical administration, governance, and process development and improvement.