Authorizes the Secretary of Homeland Security to designate any chemical substance as a substance of concern and establish the threshold quantity for each such substance after considering the potential extent of death, injury, and serious adverse effects that could result from a chemical facility terrorist incident.

Directs the Secretary to: (1) maintain a list of covered chemical facilities that are of sufficient security risk; (2) assign each covered facility to one of four risk-based tiers; (3) establish standards and procedures for security vulnerability assessments and site security plans; (4) require each facility owner or operator to submit and, once approved, to implement such an assessment and plan; and (5) establish risk-based chemical security performance standards for site security plans.

Permits the Secretary, under specified circumstances, to: (1) accept an alternate security program submitted by the owner or operator of the facility; (2) conduct facility security inspections; and (3) obtain access to and copy records.

Requires: (1) the timely sharing of threat information; and (2) the Secretary to provide information to the public regarding a process by which individuals may report problems, deficiencies, or vulnerabilities at a covered facility associated with the risk of a terrorist incident. Establishes whistleblower protections for facility employees who report violations.

Establishes in the Department of Homeland Security (DHS) an Office of Chemical Facility Security.

Authorizes civil actions by individuals alleging violations of this Act.

Authorizes the Secretary of Homeland Security (DHS) to designate any chemical substance as a substance of concern and establish the threshold quantity for each such substance after considering the potential extent of death, injury, and serious adverse effects that could result from a chemical facility terrorist incident.

Directs the Secretary to: (1) maintain a list of covered chemical facilities that are of sufficient security risk; (2) assign each covered facility to one of four risk-based tiers; (3) establish standards and procedures for security vulnerability assessments and site security plans; (4) require each facility owner or operator to submit and, once approved, implement such an assessment and plan; (5) establish risk-based chemical security performance standards for site security plans; (6) establish modified or separate standards, protocols, and procedures for security vulnerability assessments and site security plans for covered chemical facilities that are also academic laboratories; and (7) establish a program to award grants to eligible entities to provide for training and education of specified chemical facility employees (covered individuals), first responders, and emergency response providers.

Permits the Secretary, under specified circumstances, to: (1) accept an alternate security program submitted by the owner or operator of the facility; (2) conduct facility security inspections; and (3) obtain access to and copy records.

Requires: (1) the timely sharing of threat information; and (2) the Secretary to provide information to the public regarding a process by which individuals may report problems, deficiencies, or vulnerabilities at a covered facility associated with the risk of a terrorist incident. Establishes whistleblower protections for facility employees who report violations. Provides penalties for violations of whistleblower protections.

Sets forth provisions that: (1) preclude preemption of states' rights to adopt or enforce more stringent regulations or standards; and (2) prohibit the public disclosure of protected information, subject to specified limitations.

Requires the owner or operator of a covered chemical facility to include in the site security plan an assessment of methods to reduce the consequences of a terrorist attack on that facility.

Directs the Secretary to report to the House Homeland Security Committee regarding exempting small business concerns from security requirements.

Establishes in the Department of Homeland Security (DHS) an Office of Chemical Facility Security.

Directs the Secretary to issue regulations to require covered chemical facilities to conduct appropriate security background checks and ensure appropriate credentials for unescorted visitors and chemical facility personnel. Requires an owner or operator of a facility who finds that a covered individual is not legally authorized to work in the United States to cease to employ that individual, subject to a specified redress process.

Authorizes civil actions by any individuals alleging violations of this Act.

Requires annual (and after four years, biennial) reports to Congress on progress in achieving compliance with this Act. Authorizes appropriations.

Directs the Secretary to establish a notification system that provides any individual the ability to report a suspected security deficiency or noncompliance with this Act, including by telephonic and Internet-based means. Requires the Secretary and the Inspector General for DHS, respectively, to take specified actions to address deficiencies and to report to specified congressional committees.

Requires the Secretary to review the designation of sodium fluoroacetate as a substance of concern.

Authorizes the Secretary of Homeland Security (DHS) to designate any chemical substance as a substance of concern and establish the threshold quantity for each such substance after considering the potential extent of death, injury, and serious adverse effects that could result from a chemical facility terrorist incident.

Directs the Secretary to: (1) maintain a list of covered chemical facilities that are of sufficient security risk; (2) assign each covered facility to one of four risk-based tiers; (3) establish standards and procedures for security vulnerability assessments and site security plans; (4) require each facility owner or operator to submit and, once approved, implement such an assessment and plan; (5) establish risk-based chemical security performance standards for site security plans; and (6) establish a program to award grants to eligible entities to provide for training and education of specified chemical facility employees (covered individuals), first responders, and emergency response providers.

Permits the Secretary, under specified circumstances, to: (1) accept an alternate security program submitted by the owner or operator of the facility; (2) conduct facility security inspections; and (3) obtain access to and copy records. Provides that a covered facility that has had its facility security plan approved under maritime transportation security plan provisions shall not be required to update or amend such plan to meet the requirements of this Act.

Establishes a presumption that grants will be awarded using competitive procedures based on merit (otherwise requires the Secretary to report to Congress explaining why competitive procedures were not used). Prohibits the use of appropriated funds for congressional earmarks.

Directs the Secretary to offer non-supervisory employees the opportunity to confidentially communicate information relevant to the employer's compliance with this Act. Requires an employee representative of each certified or recognized bargaining agent at the covered facility to be given the opportunity to accompany the Secretary during a physical inspection of such facility for the purpose of aiding in such inspection, if representatives of the owner or operator of the facility will also be accompanying the Secretary on such inspection.

Requires: (1) the timely sharing of threat information; and (2) the Secretary to provide information to the public regarding a process by which individuals may report problems, deficiencies, or vulnerabilities at a covered facility associated with the risk of a terrorist incident. Establishes whistleblower protections for facility employees who report violations.

Sets forth provisions that preclude preemption of states' rights to adopt or enforce more stringent regulations or standards.

Directs the Secretary to prescribe regulations, and authorizes the Secretary to issue orders, as necessary to prohibit the unauthorized disclosure of protected information, subject to specified requirements and penalties.

Requires the owner or operator of a covered chemical facility to include in the site security plan an assessment of methods to reduce the consequences of a terrorist attack on that facility. Directs the Secretary to report to specified committees assessing the potential effects of compliance on small covered chemical facilities.

Establishes in DHS an Office of Chemical Facility Security, to be headed by a Director, who shall be responsible for carrying out the responsibilities of the Secretary under this title. Directs the Secretary to: (1) designate a point of contact for the Administrator of the Environmental Protection Agency (EPA), and the head of any other agency designated by the Secretary, with respect to the requirements of this title; and (2) inform state emergency response commissions appointed pursuant to the Emergency Planning and Community Right-To-Know Act of 1986, local emergency planning committees appointed pursuant to that Act, and any other entity designated by the Secretary of the findings of the Office so such commissions and committees may update emergency planning and training procedures.

Directs the Secretary to issue regulations to require covered chemical facilities to conduct appropriate security background checks and ensure appropriate credentials for unescorted visitors and chemical facility personnel. Requires the regulations to provide that it shall be a misrepresentation to attribute an adverse employment decision, including removal or suspension, to such regulations unless the owner or operator finds, after opportunity for appropriate redress under specified processes, that the individual falls within specified categories, such as being: (1) convicted of a permanent disqualifying criminal offense; (2) determined by the Secretary to be on the consolidated terrorist watchlist; or (3) determined, as a result of the security background check, not to be legally authorized to work in the United States. Establishes a reconsideration process.

Authorizes civil actions by any individuals alleging violations of this Act.

Directs the Secretary to establish a notification system, which shall provide any individual the ability to report a suspected security deficiency or suspected noncompliance with this title. Requires the Inspector General to report annually to specified congressional committees.

Requires annual (and after four years, biennial) reports to Congress on progress in achieving compliance with this Act. Authorizes appropriations.

Authorizes the Secretary to continue to carry out the Chemical Facility Anti-Terrorism Standards prescribed pursuant to the Department of Homeland Security Appropriations Act, 2007 until final rules prescribed under this Act take effect, subject to specified requirements.

Directs the Secretary to review the designation of sodium fluoroacetate as a substance of concern.

Title II: Drinking Water Security - Drinking Water System Security Act of 2009 - Amends the Safe Drinking Water Act to revise and expand requirements for assessments by covered water systems of their vulnerability to intentional acts of sabotage. Defines "covered water system" as a public water system that is a community water system serving a population greater than 3,300 or that presents a security risk requiring the issuance of regulations.

Directs the Administrator of EPA to issue regulations to: (1) establish tiered, risk-based performance standards for the security of covered water systems and requirements and deadlines for such systems to conduct and update vulnerability assessments; (2) develop site security and emergency response plans for such systems; and (3) provide annual training to system employees and contractor employees. Sets forth matters such regulations must address, including the vulnerability of a water system to intentional acts, levels of risk, and the role of employees in developing site security and emergency risk plans. Requires the Administrator to review and approve the vulnerability assessments and site security plans of covered water systems.

Authorizes the Administrator to: (1) designate any chemical substance as a substance of concern in issuing water system security standards; and (2) award grants to assist states in implementing regulations promulgated under this Act and for assessing and implementing methods to reduce the consequences of a release of a substance of concern.

Prohibits disclosure of protected information relating to the security of covered water systems. Exempts such information from Freedom of Information disclosure requirements. Imposes criminal penalties for unauthorized disclosure of protected information.

(Sec. 203) Directs the Administrator to study and report to Congress on the threat to drinking water posed by an intentional act of contamination and the vulnerability of public water systems, including fire hydrants, to such threat.

Title III: Wastewater Treatment Works Security - Wastewater Treatment Works Security Act of 2009 - Amends the Federal Water Pollution Control Act (commonly known as the Clean Water Act) to require each owner or operator of a treatment works that has a treatment capacity of at least 2.5 million gallons per day or, in the discretion of the Administrator, that presents a security risk making coverage appropriate, to: (1) conduct and update a vulnerability assessment of its treatment works; (2) develop, periodically update, and implement a site security plan; and (3) develop and revise an emergency response plan for the treatment works.

Directs the Administrator of EPA, by December 31, 2010, to issue regulations establishing: (1) risk-based performance standards for the security of such a treatment works; and (2) specified requirements and deadlines, including for the conduct and submission of a vulnerability assessment, development and implementation of a site security plan, development of an emergency response plan, and provision of annual training to employees of the treatment works on implementing such plans.

Requires the Administrator to: (1) provide for four risk-based tiers applicable to treatment works, taking into consideration a works' size and proximity to large population centers and the potential impacts of intentional acts on critical infrastructure, public health or safety, or the environment; (2) assign each covered treatment works to one of such tiers; (3) establish risk-based performance standards for site security plans and emergency response plans that are increasingly more stringent based on the level of risk associated with the risk-based tier assignment; (4) require a treatment works that possesses a substance of concern in excess of the release threshold quantity set by the Administrator to include in its site security plan an assessment of methods to reduce the consequences of a chemical release from an intentional act, a statement of whether the owner or operator has implemented or plans to implement such a method, and an explanation of the reasons for any decision not to implement any such method; and (5) determine whether to require the treatment works to implement such method. Sets forth provisions regarding compliance and enforcement.

Authorizes the Administrator to designate any chemical substance as a substance of concern for purposes of this title. Requires the Administrator, at the time a substance is so designated, to establish a threshold quantity for the release or theft of such substance, taking into account its toxicity, reactivity, volatility, dispersability, combustability, and flammability and the amount that is known or may be reasonably anticipated to cause, death, injury, or serious adverse impacts to human health or the environment.

Sets forth provisions regarding certification of emergency response plans, maintenance of records, audits and inspections, and public disclosure of protected information.

Authorizes the Administrator to make grants to a state, municipality, or intermunicipal or interstate agency to conduct a vulnerability assessment of a publicly owned treatment works, to implement specified security enhancements, and to provide for security-related training of treatment works employees and training for emergency response providers.

Authorizes appropriations.

Amends the Homeland Security Act of 2002 (HSA) to require the Secretary, acting through the Administrator of the Federal Emergency Management Agency (FEMA) in coordination with the Under Secretary for National Protection and Programs, to: (1) establish a voluntary chemical security training program to enhance the capabilities of high-risk chemical facilities to prevent, prepare for, respond to, mitigate against, and recover from threatened or actual acts of terrorism, natural disasters, and other man-made disasters; and (2) develop a voluntary chemical security exercise program to offer voluntary testing and evaluation of the capabilities of the federal government, state governments, commercial personnel and management, governmental and nongovernmental emergency response providers, and the private sector to prevent, prepare for, mitigate against, respond to, and recover from acts of terrorism, natural disasters, and other emergencies at chemical facilities.

Directs the Secretary, acting through the Assistant Secretary for Infrastructure Protection in coordination with the Under Secretary for Science and Technology, to establish a voluntary technical assistance program to provide nonbinding assistance or recommendations to the owner of a covered chemical facility to: (1) reduce the risk or consequences associated with a successful terrorist attack on the facility; and (2) aid in compliance with the performance standards applicable to the facility under CFATS. Provides that the decision to participate or to implement any assistance or recommendations provided by the Secretary shall be at the sole discretion of the owner or operator.

Requires the Secretary, upon request, to advise such owner or operator of the overall effect that implementing all categories of assistance or recommendations provided by the Secretary would have on the Secretary's determination regarding: (1) the placement of the facility in a risk-based tier under CFATS, or (2) whether the facility would no longer present a high level of security risk. Provides that no act or failure to act by the owner or operator relating to assistance or a recommendation provided by the Secretary shall be interpreted or applied to create any liability or cause of action for compensation that may result from a terrorist act or incident at the facility, with an exception for intervening acts or omissions.

Directs the Secretary to develop a repository for information and data on best practices and cost-effective technologies for implementing CFATS and the voluntary technical assistance program. Provides for the protection of information that may reveal: (1) vulnerabilities or other details of the security capabilities of a covered facility that may be exploited by terrorists, and (2) trade secrets or commercial or financial information that is not customarily in the public domain.

Directs the Secretary, by October 4, 2013, in coordination with a nine-member Chemical Facility Security Advisory Board established by this Act, to submit a report regarding lessons learned from the voluntary technical assistance program.