; (3) the technical feasibility, costs, avoided costs (including liabilities), personnel implications, savings, and applicability of implementing each method to reduce the consequences of a terrorist attack; (4) any other information that the owner or operator of the covered chemical facility considered in conducting the assessment; (5) the design of computing systems and development of plans, exercises, and drills to re-engage computing systems used in the processing, transport, storage of chemicals that are designed as a “risk” by the Secretary using protocols for trusted recovery under the worse case conditions; and (6) the conduct of tests of facilities should include blue hat, red hat, and white hat hackers to validate the security measures instituted to address cyber based threats. (c) Implementation (1) Implementation (A) In general The owner or operator of a covered chemical facility that is assigned to tier 1 or tier 2 because of the potential extent and likelihood of death, injury, or serious adverse effects to human health, the environment, critical infrastructure, public health, homeland security, national security, or the national economy from a release of a substance of concern at the covered chemical facility shall implement methods to reduce the consequences of a terrorist attack on the covered chemical facility if the Director of the Office of Chemical Facility Security determines, using the assessment conducted under subsection (b), that the implementation of the methods at the covered chemical facility— (i) (I) would significantly reduce the risk of death, injury, or serious adverse effects to human health resulting from a chemical facility terrorist incident; and (II) would not— (aa) increase the interim storage of a substance of concern outside the covered chemical facility