Drinking Water System Security Act of 2009

Requires the Administrator to provide covered water systems with baseline information about probable threats to disrupt the safe and reliable supply of water, cause a release of a substance of concern at the covered water system, or steal, misuse, or misappropriate a substance of concern.

Requires a covered water system under this Act to: (1) describe in its site security plan an assessment of methods to reduce the consequences of a chemical release from an intentional act and the roles and responsibilities of employees in responding to an intentional act of sabotage; (2) submit its vulnerability assessment and site security plan to the Administrator for review; (3) correct any deficiency found in its assessment or plan; (4) prepare or revise its emergency response plan to incorporate the results of the most current vulnerability assessment and site security plan; and (5) maintain an updated copy of its vulnerability assessment, site security plan, and emergency response plan.

Requires the Administrator to: (1) audit and inspect covered water systems to determine compliance with this Act; (2) offer nonsupervisory employees of any system the opportunity to share information, on a confidential basis, about a system's compliance; and (3) take enforcement action, as appropriate, against states that fail to implement methods to reduce the consequences of a chemical release from an intentional act at a covered water system.

Prohibits disclosure of protected information relating to the security of covered water systems. Exempts such information from Freedom of Information disclosure requirements. Imposes criminal penalties for unauthorized disclosure of protected information.

Exempts public water systems subject to this Act from regulation under certain DHS chemical facility anti-terrorism standards.

Allows states or local governments to impose security standards for drinking water systems that are more stringent than standards under this Act.

Imposes a civil penalty of up to $25,000 per day on a covered water system that violates any requirement of this Act.

Requires the Administrator to submit a report every three years to the House Committee on Energy and Commerce and the Senate Committee on Environment and Public Works on progress in achieving compliance under this Act. Requires such report to be made publicly available.

Authorizes the Administrator to award grants to, or enter into cooperative agreements with: (1) states to implement this Act; (2) nonprofit organizations to provide research, training, and technical assistance to covered water systems; and (3) covered water systems to assist them in preparing and updating vulnerability assessments, site security plans, and emergency response plans and in assessing and implementing methods to reduce the consequences of the release of a substance of concern from an intentional act. Assigns priority for awarding grants to water systems that have the greatest need or pose the greatest security risk.

Directs the Administrator to award grants to nonprofit organizations for training and education of employees and first responders who would respond to an intentional act of sabotage at a covered water system.

Authorizes appropriations for FY2011 for administrative costs and to implement methods to reduce the consequences of a chemical release from an intentional act at covered water systems, and for FY2012-FY2015 generally. Prohibits funding for basic security enhancements from including expenditures for personnel costs or monitoring, operation, or maintenance of facilities, equipment, or systems.

Requires the Administrator: (1) to promulgate final regulations within two years after the enactment of this Act; and (2) in consultation with the DHS Secretary, to study and report to Congress on the threat of contamination of drinking water being distributed through public water systems, including fire main systems.