January 2024 NASF Policy Update
- NASF Action Ahead on Major EPA Regulatory Push in 2024 – Finishing industry burdens could exceed over a billion in future costs and liabilities if certain rules are finalized. NASF will be fully engaged with policy makers this election year.
- NASF Government Affairs PFAS Webinars – The association’s Public Policy team on January 15th provided guidance to members from across the nation on the new survey, and more advice and assistance is available.
- Pentagon Proposes Cybersecurity Maturity Model Certification (CMMC) Program Rule: NASF Review Underway – A proposed rule published in the Federal Register on December 26, 2023 establishes a revamped CMMC 2.0 program and defines requirements for the program and for each CMMC level.
- EPA Issues More Stringent Guidance for Soil Cleanup Screening Levels: Potential Impacts Ahead for Certain Surface Finishing Operations – The new screening levels could drive investigation and/or cleanup at hundreds of thousands of new parcels.
Please see more details on these topics below:
NASF Action Ahead on Major EPA Regulatory Push in 2024
With a wide-ranging regulatory agenda set in December 2023 and funds still in the pipeline from Biden initiatives passed by Congress, EPA this year will be rushing to meet deadlines to complete far-reaching regulations and distribute billions of dollars by the end of 2024. The agency is working to implement protections on air, climate, and water by late summer before they may be in danger of reversal next year should Republicans win back full control of Congress and the White House.
EPA Deputy Administrator Janet McCabe noted the agency’s work is “hard, tiring, and rewarding” in a widely-circulated note to EPA staff, and advised that “2024 is also going to be a big year for our regulatory programs – from rules that address climate pollution, to those that protect our precious rivers, lakes coastlines, and wetlands, to those that ensure the air we breathe, the water we drink, and the land we rely upon is safe and healthy. I want each rule writer, regulatory development team member, economist, scientist, biologist, and public health officer to know that Administrator Regan and I have got your back as you make your way through your work this year. We have an important job to do, and I am confident that together we will deliver.”
The finishing industry could be subject to new regulatory burdens and future liability exceeding a billion dollars if EPA finalized some of its most significant rulemakings, including:
- the PFAS Superfund remediation listing regulation,
- the PFAS drinking water standard,
- several chemicals management rules, and
- the wastewater discharge rule for metal finishing and electroplating.
NASF will continue working with EPA officials on these and other policy decisions and providing members with critical updates in the coming year. If you have any questions or would like more information, please contact Jeff Hannapel or Christian Richter with NASF at jhannapel@thepolicygroup.com or crichter@thepolicygroup.com.
NASF Government Affairs Webinars: Providing Guidance to Members on EPA’s Survey for the PFAS Wastewater Discharge Rule
Since late December, finishing facilities across the nation began receiving federal EPA’s industry survey that will inform the agency’s surface finishing PFAS wastewater discharge rule. The survey includes an extensive set of information requests regarding facility operations and processes, facility uses of PFAS, PFAS discharge data, water discharge permits, and company financial information. The submission of accurate responses to the survey that are representative of the industry will be critical, as the information from the survey will help to shape the rule to address – in some form – PFAS wastewater discharges from finishing.On January 15, NASF held a webinar for members to provide some guidance on responding to the survey. The program prompted wide participation from association members across the country. The guidance included, among other topics:
- general considerations for the survey,
- a brief summary of the “off ramps” for the survey,
- clarifications on the type of information that EPA is requesting and EPA’s rationale for requesting it,
- the process for protecting some of the responses as confidential business information (CBI), the survey submission deadline, and
- how to request an extension.
In addition, The Policy Group answered questions from participants as part of the webinar and in the days following. The webinar is available on the NASF website in the members-only area.
NASF is planning some additional webinars on the survey and details regarding the upcoming webinars will be provided soon. If you have any questions or would like additional information on the survey, the new wastewater discharge rule for PFAS, or upcoming webinars on the survey, please contact Jeff Hannapel or Christian Richter with NASF at jhannapel@thepolicygroup.com or cichter@thepolicygroup.com.
Pentagon Proposes Cybersecurity Maturity Model Certification (CMMC) Program Rule: NASF Review Underway
The Cybersecurity Maturity Model Certification (CMMC) Program is the Department of Defense’s (DOD) process of ensuring that contractors are adequately protecting sensitive information under DOD contracts. It requires DOD contractors to certify that they are compliant with cybersecurity requirements for protecting sensitive information. DOD has been making efforts to increase cybersecurity protections, including when it announced in November 2021 “CMMC 2.0” that established a program structure with three key factors: 1) tiered levels of security, 2) assessment requirements, and 3) implementation through contracts.
A proposed rule published in the Federal Register on December 26, 2023 establishes a revamped CMMC 2.0 program and defines requirements for the program and for each CMMC level. Surface finishing operations conducting business with DOD and its contractors have been in the process of implementing CMMC requirements at significant cost for some and will be impacted by this rule.
A copy of the proposed rule is available at the following link: https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program.
Tier LevelsThe proposed rule preserves the three tier levels that were introduced in CMMC 2.0.
- CMMC Level 1 – includes 15 requirements listed in the Federal Acquisition Regulation (FAR) and would apply to contractors who store, process, or transmit Federal Contract Information (FCI).
- CMMC Level 2 – includes 110 requirements from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Rev. 2 and would apply broadly to contractors who store, process, or transmit Controlled Unclassified information (CUI).
- CMMC Level 3 – includes 24 requirements from NIST SP 800-172 and full implementation of NIST SP 800-171 and would apply to a small group of contractors who store, process, or transmit high-value CUI.
AssessmentsThe proposed rule includes a mixture of self-assessments and third-party assessments depending on the nature of the data.
- CMMC Level 1 assessments will be self-assessments that require contractors to verify their own compliance with the applicable security controls and submit their assessments to DOD annually.
- CMMC Level 2 assessments will be either self-assessments or a certification assessment performed by a third-party assessment organization that must be completed every three years. The proposed rule does not specify how DOD will determine which type of assessment will be required.
- CMMC Level 3 assessments will be certification assessments performed by the Defense Industrial Base Cybersecurity Assessment Center every three years.
Certifications and Plan of Action and Milestones (POA&M)An assessment may result in a Final Certification or a Conditional Certification, depending on whether the contractor has implemented all of the required security controls. The proposed rule allows for some flexibility with the limited use of a Plan of Action and Milestones (POA&M) for certain requirements and for a limited time where some controls are not yet implemented.
For example, POA&Ms are not permitted for Level 1 assessments but can be used for some Level 2 and 3 assessments. If a POA&M exists after an assessment, the contractor will be granted a Conditional Certification and have 180 days to fully implement all of the security controls listed in the POA&M. Failure to implement the security controls in the POA&M will result in penalties or loss of the DOD contract.
Implementation TimelineThe proposed rule includes a four-phase implementation plan.
- Phase One – begins on the effective date of the final CMMC rule and includes a CMMC Level 1 or CMMC Level 2 self-assessment as a condition for contract award.
- Phase Two – begins six months after Phase One and includes CMMC Level 2 certification assessments for contract awards.
- Phase Three – begins one year after Phase Two and introduces CMMC Level 3 certification assessments.
- Phase Four – full implementation of CMMC requirements begins on October 1, 2026.
Comment Deadline and Preparing for the RuleComments on the proposed rule are due on February 26, 2024. NASF will continue to review and evaluate the proposed rule and plans to submit comments. Because the final rule is not expected to look dramatically different from the proposed rule, surface finishing operations subject to these requirements should consider continuing their efforts toward full compliance with the CMMC requirements.
If you have any questions or would like more information regarding the CMMC proposed rule or compliance efforts, please contact Jeff Hannapel or Christian Richter with NASF at jhannapel@thepolicygroup.com or crichter@thepolicygroup.com.
EPA Issues More Stringent Guidance for Soil Cleanup Screening Levels: Potential Impacts Ahead for Certain Surface Finishing Operations
EPA issued new guidance on recommended screening levels for cleaning up lead-contaminated soil at federal Superfund cleanup sites and Resource Conservation and Recovery Act (RCRA) corrective action facilities. Specifically, EPA lowered the screening level for lead in soil at residential properties from 400 parts per million (ppm) to 200 ppm.
For remedial actions, if there are other sources of lead exposure, such as lead in air and water, EPA recommends screening level as 100 ppm. EPA notes that the guidance’s new thresholds should apply to both existing and new sites. This action is expected to drive evaluation and cleanup at a “significant number” of residential properties.
The new screening levels could drive investigation and/or cleanup at hundreds of thousands of new parcels. EPA’s Office of Superfund Remediation and Technology Innovation estimate that this could result in approximately 500,000 parcels (an order of magnitude estimate) needing investigation and/or cleanup.
New Screening Level to Drive More Stringent Cleanup Levels at More Sites
In the new guidance the agency emphasizes that screening levels are not cleanup levels, and are used in the early stages of investigating a release to determine if the level of contamination is high enough to warrant further investigation. Nonetheless, the new screening level will drive substantially more stringent cleanup levels at significantly more sites.
EPA requests that its own regional office work collaboratively with state, tribal, and public health agencies to prioritize addressing sites, considering factors such as current levels of exposure and communities with increased risk. Consistent with national policy, EPA will make resource decisions for residential lead sites in a manner that balances resources across all Superfund sites. Because many of the communities at highest risk are in urban areas, it could have an impact on all industry sectors, including surface finishing operations.
NASF will continue to monitor this issue and its potential impacts on the surface finishing industry. If you have any questions or would like more information, please contact Jeff Hannapel or Christian Richter with NASF at jhannapel@thepolicygroup.com or crichter@thepolicygroup.com.
NASF 1000
The NASF 1000 program was established to ensure that the surface finishing industry would have resources to effectively address regulatory, legislative and legal actions impacting the industry, NASF members and their workplaces. All funds from the NASF 1000 program are used exclusively to support specific projects and initiatives that fall outside the association’s day-to-day public policy activities. The commitment to this program is one of the most vital contributions made in support of surface finishing and directly shapes the future of the industry.
The sustained commitment from industry leaders has helped the NASF remain strong and credible in informing regulatory decisions across the nation. Specific projects funded through the NASF 1000 make a measurable difference in how the industry navigates emerging challenges, communicates credibly with policy makers, and advocates for a strong science base for rules or standards that affect surface finishing.
Please consider supporting the NASF 1000 program. If you have any questions or would like additional information regarding the NASF 1000 program or the broad array of NASF public policy activities, please contact Jeff Hannapel with NASF at jhannapel@thepolicygroup.com.
New England Chapter of NASF is an official chapter of