In the October 2016 final determination, DOE concluded that energy conservation standards for unvented heaters would result in negligible energy savings. 81 FR 71325, 71327 (Oct. 17, 2016). DOE also explained that the test procedure for unvented heaters in Appendix G, includes a calculation of annual energy consumption based on a single assignment of active mode hours for unvented heaters that are used as the primary heating source for the home. Id. at 81 FR 71328. For unvented heaters that are not used as the primary heating source for the home, there are no provisions for calculating either the energy efficiency or annual energy consumption. Id. DOE further explained that pursuant to 42 U.S.C. 6295(o)(3), DOE is prohibited from prescribing a new or amended standard for a covered consumer product if a test procedure has not been prescribed for that consumer product, and as such, DOE could not consider standards for these products at that time. Id.

In the October 2016 final determination, DOE found that few changes to the industry and product offerings had occurred since the April 2010 final rule, and, therefore, the conclusions presented in that final rule were still valid. 81 FR 71325, 71327-71328 (Oct. 17, 2016). For the October 2016 final determination, DOE reviewed the vented heater market, including product literature and product listings in the DOE Compliance Certification Management System (“CCMS”) database and the Air-Conditioning, Heating, and Refrigeration Institute (“AHRI”) product directory. 4 Id. at 81 FR 71327. DOE found that the number of models offered in each of the vented heater product classes had decreased overall since the April 2010 final rule, and the agency concluded that this finding supported the notion that the vented heater market was shrinking and that product lines were mainly maintained as replacements for existing vented heater units, and that new product lines generally were not being developed. Id.

For the October 2016 final determination DOE also examined available technologies used to improve the efficiency of vented heaters. DOE analyzed products on the market at the time through product teardowns and engaged in manufacturer interviews to obtain further information in support of its analysis. 81 FR 71325, 71327 (Oct. 17, 2016). Most of the technology options on the market and evaluated for the October 2016 final determination ( i.e., improved heat exchanger, induced draft, electronic ignition, and a two-speed blower for gas wall fan type vented heaters) were those considered as part of the vented heater rulemaking analysis for the April 2010 final rule. Id. DOE determined that the technology options available for vented heaters were likely to have limited potential for achieving energy savings. 5 Id. Furthermore, DOE concluded that the costs of technology options would likely be similar or higher than in the previous rulemaking analysis due to reduced shipments and, therefore, reduced purchasing power of vented heater manufacturers. Id. DOE also evaluated condensing technology for gas wall fan type vented heaters, which had become available after the April 2010 final rule, and, therefore, was not evaluated as part of that rulemaking. Id. DOE concluded that this technology option would not be economically justified when analyzed for the Nation as a whole due to the significant increase in initial product cost for products using this technology and the potential for severe manufacturer impacts due to the necessary capital conversion costs if an energy conservation standard were adopted at this level. Id. at 81 FR 71327-71328.

DOE acknowledged that the vented heater industry had seen further consolidation since the April 2010 final rule, with the total number of manufacturers declining from six to four. Id. at 81 FR 71328. Furthermore, according to manufacturers, 6 shipments further decreased since the April 2010 final rule, and, therefore, it would be more difficult for manufacturers to recover capital expenditures resulting from increased standards. Id. DOE acknowledged that vented heater units continue to be produced primarily as replacements and that the market is small, and expected that shipments would continue to decrease and amended standards would likely accelerate the trend of declining shipments. Id. Moreover, DOE anticipated that small business impacts resulting from amended standards could be significant, as two of the four remaining manufacturers subject to vented heater standards were small businesses. Id.

DOE concluded in the October 2016 final determination that due to the lack of advancement in the vented heater industry since the April 2010 final rule in terms of product offerings, available technology options and associated costs, and declining shipment volumes, amending the vented heater energy conservation standards would impose a substantial burden on manufacturers of vented heaters, particularly to small manufacturers. 81 FR 71325, 71328 (Oct. 17, 2016). DOE noted that it had rejected higher TSLs for vented heaters in the April 2010 final rule due to significant impacts on industry profitability, risks of accelerated industry consolidation, and the likelihood that small manufacturers would experience disproportionate impacts that could lead them to discontinue product lines or exit the market altogether, and the Department stated that the market and the manufacturers' circumstances at the time were similar to when DOE evaluated amended energy conservation standards for vented heaters for the April 2010 final rule. Id. at 81 FR 71328-71329. Accordingly, DOE concluded that amended energy conservation standards for vented heaters were not economically justified at any level above the current standard levels because benefits of more-stringent standards would not outweigh the burdens, and the Department determined not to amend the vented heater energy conservation standards. Id. at 81 FR 71329.

In the October 2016 final determination, DOE also considered whether to establish energy conservation standards for standby mode and off mode electrical energy use, noting that fossil fuel energy use in standby mode and off mode is already included in the AFUE metric and that electric standby mode and off mode energy use is small in comparison to fossil fuel energy use. Id. Given that the standards for vented heaters were not amended, DOE concluded it was not required under EPCA to adopt amended standards which include standby mode and off mode energy use, and due to the relatively small potential for energy savings, DOE declined to do so. Id.

On February 26, 2019, DOE published a request for information (“RFI”) (“February 2019 RFI”) to solicit information from the public to help DOE determine whether amended standards for DHE would result in significant energy savings and whether such standards would be technologically feasible and economically justified. 84 FR 6095.

On December 1, 2020, DOE published a notice of proposed determination (“NOPD”) (“December 2020 NOPD”) to not amend its energy conservation standards for DHE. 85 FR 77017. DOE estimated that for gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters, potential site energy savings at due to more-stringent standards at the maximum technologically feasible (“max-tech”) TSL would be 0.13 quadrillion Btus (“quads”), a reduction of 6 percent in site energy use. Thus, DOE tentatively concluded in the December 2020 NOPD that more-stringent standards for DHE would not save a significant amount of energy. Id. at 85 FR 77037. Additionally, for these product classes, DOE tentatively determined that the potential benefits from amended standards would be outweighed by burdens on manufacturers, thereby tentatively concluding that amended standards would not be economically justified. Id. at 85 FR 77038. Further, DOE tentatively concluded in the December 2020 NOPD that more-stringent standards for gas floor vented heaters were not technologically feasible, and that amended standards for these products are not needed. Id. In this final determination, DOE finalizes its proposed determination from the December 2020 NOPD.

DOE developed this final determination after a review of the DHE market, including product literature and product listings in the DOE CCMS database and the AHRI product directory. DOE also considered written comments, data, and information from interested parties that represent a variety of interests. In response to the December 2020 NOPD, DOE received seven substantive comments from interested parties, which are listed in Table III.1 of this document. DOE also received comments from three stakeholders during a webinar held on January 25, 2021 which discussed the analysis presented in the December 2020 NOPD. This notice addresses issues raised by these commenters.

A parenthetical reference at the end of a comment quotation or paraphrase provides the location of the item in the public docket. 7

When evaluating and establishing new or amended energy conservation standards, DOE divides covered products into product classes (or types) based on a specified level of energy used or by capacity or other performance-related features that justify differing standards. (42 U.S.C. 6295(q)) In making a determination whether a performance-related feature justifies a different standard, DOE must consider such factors as the utility of the feature to the consumer and other factors DOE determines are appropriate. Id. The scope of coverage is discussed in further detail in section III.A.1 of this document. The product classes for this final determination are discussed in further detail in section III.A.2 of this document.

This final determination covers those products that meet the definitions of “direct heating equipment,” which is defined as vented home heating equipment and unvented home heating equipment. 10 CFR 430.2. “Home heating equipment, not including furnaces” likewise means vented home heating equipment and unvented home heating equipment. Id. The existing energy conservation standards at 10 CFR 430.32(i)(2) apply only to product classes of vented home heating equipment. There are no existing energy conservation standards for unvented home heating equipment.

Unvented heaters are those products that meet the definition for “unvented home heating equipment,” as codified at 10 CFR 430.2. Under that provision, “Unvented home heating equipment” means a class of home heating equipment, not including furnaces, used for the purpose of furnishing heat to a space proximate to such heater directly from the heater and without duct connections and includes electric heaters and unvented gas and oil heaters. DOE further defines the various sub-types of unvented heaters at 10 CFR 430.2 as follows:

DOE received no recommended changes to the unvented heater definitions in response to the December 2020 NOPD and is not amending these definitions in this final determination.

Vented heaters are those products that meet the definitions for “vented home heating equipment,” as codified at 10 CFR 430.2. Under that provision, “vented home heating equipment” or “vented heater” means a class of home heating equipment, not including furnaces, designed to furnish warmed air to the living space of a residence, directly from the device, without duct connections (except that boots not to exceed 10 inches beyond the casing may be permitted) and includes: Vented wall furnace, vented floor furnace, and vented room heater. DOE further defines the various sub-types of vented heaters at 10 CFR 430.2 as follows:

DOE received no recommended changes to the vented heater definitions in response to the December 2020 NOPD and is not amending these definitions in this final determination.

In general, when evaluating and establishing energy conservation standards, DOE divides the covered product into classes (or types) based on the level of energy used, the capacity, or other performance-related feature that justifies a different standard. (42 U.S.C. 6295(q)) In making a determination whether capacity or another performance-related feature justifies a different standard, DOE must consider such factors as the utility of the feature to the consumer and other factors DOE deems appropriate. Id.

For vented heaters, the current energy conservation standards specified in 10 CFR 430.32(i)(2) are based on 11 product classes divided by DHE type ( i.e., gas wall, gas floor, or gas room), heat circulation type ( i.e., fan type or gravity type), and input capacity. Table III.2 lists the current product classes for vented heaters.

In response to the December 2020 NOPD, NEEA stated that gas wall gravity type vented heaters do not provide a unique consumer utility and therefore do not warrant a separate product class from gas wall fan type vented heaters. (NEEA, No. 20 at p. 2) NEEA further stated that although some gas wall gravity type vented heaters do not require electricity, while all gas wall fan type vented heaters do, this is not a distinguishing factor since some gas wall gravity type vented heater models require electricity to operate. (NEEA, No. 20 at p. 2) Gas wall fan and gravity type vented heaters are separated into different product classes in the current energy conservation standards. As discussed, EPCA requires DOE to consider product classes when prescribing energy conservation standards. (42 U.S.C. 6295(q)) Because DOE is not prescribing new or amended standards for DHE, it is not amending the product classes for these products.

In comments to the December 2020 final rule, the Joint Advocates and NEEA referenced DOE's prior analysis of hearth products and recommended the elimination of standing pilot lights. (Joint Advocates, No. 16 at p. 1; NEEA, No. 20 at p. 2) DOE clarifies that while hearth heaters are direct heating equipment per the definition in 10 CFR 430.2, such products were not considered in the context of this determination and such products are not subject to the standards for direct heating equipment at 10 CFR 430.32(i).

In the NOPR that preceded the April 2010 final rule, DOE proposed that its test procedures for vented DHE ( i.e., Appendix O) be applied to establish the efficiencies of vented gas hearth DHE. 74 FR 65852, 65861 (Dec. 11, 2009; “December 2009 NOPR”). DOE described vented hearth products as including gas-fired products such as fireplaces, fireplace inserts, stoves, and log sets that typically include aesthetic features such as a yellow flame, and stated that consumers typically purchase these products to add aesthetic qualities and ambiance to a room, and the products also provide space heating. 74 FR 65852, 65866. DOE stated that “vented hearth products” meet DOE's definition of “vented home heating equipment,” because they are designed to furnish warmed air to the living space of a residence without duct connections. Id. DOE proposed to establish standards for such products. Id.

In the April 2010 final rule DOE concluded that vented hearth products as described December 2009 NOPR meet the definition of “vented home heating equipment.” 75 FR 20112, 20128. DOE also adopted a definition of “vented hearth heater” different from that proposed in that, among other changes, removed explicit reference to fireplace heaters and included a maximum capacity threshold to distinguish vented hearth heaters from purely decorative heaters excluded from DOE's regulations. 75 FR 20112, 20130.

Following the April 2010 final rule, the Hearth, Patio & Barbecue Association (“HPBA”) challenged DOE in the United States Court of Appeals for the District of Columbia Circuit (“D.C. Circuit”) to invalidate the April 2010 final rule and an amendment to that rule published on November 18, 2011 (76 FR 71836; “November 2011 final rule”)  8 as those rules pertained to vented gas hearth products. Hearth, Patio & Barbecue Association v. Department of Energy, et al., No. 10-1113 (D.C. Cir. filed July 1, 2010). On February 8, 2013, the Court ruled that DOE had improperly covered decorative fireplaces in the definition of “vented hearth heater” as established in the April 2010 final rule and amended in the November 2011 final rule. Hearth, Patio & Barbecue Association v. Department of Energy, et al., 706 F.3d 499 (D.C. Cir. 2013). The Court held that the phrase “vented hearth heater” did not encompass decorative fireplaces as that term is traditionally understood, vacated the entire statutory definition of “vented hearth heater” and remanded for DOE to interpret the challenged provisions consistent with the court's opinion. Id. at 509. On July 29, 2014, DOE published a final rule amending the relevant portions of its regulation to reflect the Court's decision to vacate the regulatory definition of “vented hearth heater” (and by implication, the associated energy conservation standards). 79 FR 43927.

On December 31, 2013, DOE published a proposed determination of coverage for hearth products. 78 FR 79638 (“December 2013 NOPD”). DOE stated that hearth products are gas-fired equipment that provide space heating and/or provide an aesthetic appeal to the living space. 78 FR 79638, 79639. DOE also stated vented hearth heaters are no longer covered products as a result of the Court ruling. On February 9, 2015, DOE published a NOPR proposing energy conservation standards for hearth products. 80 FR 7082. This NOPR covered both vented and unvented (vent-less) hearth products. Id. at 80 FR 7088-7089. On March 31, 2017, DOE withdrew the December 2013 NOPD  9 in the bi-annual publication of the DOE Regulatory Agenda. 10 On further consideration, DOE believes that it was overly broad in its discussing the Court's holding in the context of hearth heaters. Given that hearth heaters (vented or unvented) provide space heating and classifying hearth heaters as vented or unvented (as applicable) home heating equipment would be consistent with the Court's opinion. See 706 F.3d 499, 505. As discussed, currently there are not energy conservation standards for such products and such products were not considered in the analysis of whether the existing standards for vented and unvented home heating equipment should be amended. To the extent DOE considers energy conservation standards for hearth heaters, it intends to do so in a separate rulemaking.

As stated previously, in determining that amended standards are not needed, DOE must consider whether amended standards would result in significant conservation of energy, are technologically feasible, and are cost-effective as described in 42 U.S.C. 6295(o)(2)(B)(i)(II). (42 U.S.C. 6295(m)(1)(A) and 42 U.S.C. 6295(n)(2)). An evaluation of cost-effectiveness under 42 U.S.C. 6295(o)(2)(B)(i)(II) requires that DOE consider savings in operating costs throughout the estimated average life of the covered products in the type (or class) compared to any increase in the price, initial charges, or maintenance expenses for the covered products that are likely to result from the standard. (42 U.S.C. 6295(n)(2) and 42 U.S.C. 6295(o)(2)(B)(i)(II)) Before potential energy savings and cost-effectiveness of amended standards can be estimated, available and working prototype technologies with the potential to improve energy efficiency must first be evaluated. Accordingly, DOE generally starts with this technology evaluation.

In evaluating potential amendments to energy conservation standards, DOE first conducts a market and technology assessment to survey the products currently available on the market and identify technology options (including prototype technologies) that could improve the efficiency of the products or equipment that are the subject of the rulemaking. DOE then conducts a screening analysis for the technologies identified, and, as a first step, determines which of those means for improving efficiency are technologically feasible. DOE considers technologies incorporated in commercially-available products or in working prototypes to be technologically feasible. 10 CFR part 430, subpart C, appendix A, sections 6(a)(3)(iii)(A) and 7(b)(1) (“Process Rule”).

After DOE has determined that particular technology options are technologically feasible, it further evaluates each technology option in light of the following additional screening criteria: (1) Practicability to manufacture, install, and service; (2) adverse impacts on product utility or availability; (3) adverse impacts on health or safety, and (4) unique-pathway proprietary technologies. Sections 6(a)(3)(iii)(B)-(E) and 7(b)(2)-(5) of the Process Rule. The technology options identified for this final determination are essentially those technologies identified and considered for the October 2016 final determination. See sections III.B.3.b. and III.B.3.c. of this document for additional discussion.

EPCA requires that in proposing to adopt an amended or new energy conservation standard, or proposing no amendment or no new standard for a type (or class) of covered product, DOE must determine the maximum improvement in energy efficiency or maximum reduction in energy use that is technologically feasible for each type (or class) of covered product. (42 U.S.C. 6295(p)(1)) Accordingly, DOE determined the max-tech improvements in energy efficiency for vented heaters, using the design parameters for the most efficient products available on the market or in working prototypes. See section III.B.3.d. of this document for further discussion.

To adopt any new or amended standards for a covered product, DOE must determine that such action would result in significant energy savings. (42 U.S.C. 6295(o)(3)(B)) Although the term “significant” is not defined in the EPCA, the U.S. Court of Appeals, for the District of Columbia Circuit in Natural Resources Defense Council v. Herrington, 768 F.2d 1355, 1373 (D.C. Cir. 1985), opined that Congress intended “significant” energy savings in the context of EPCA to be savings that were not “genuinely trivial.”

The significance of energy savings offered by a new or amended energy conservation standard cannot be determined without knowledge of the specific circumstances surrounding a given rulemaking. For example, the United States has now rejoined the Paris Agreement and will exert leadership in confronting the climate crisis. 11 Additionally, some covered products and equipment have most of their energy consumption occur during periods of peak energy demand. The impacts of these products on the energy infrastructure can be more pronounced than products with relatively constant demand. In evaluating the significance of energy savings, DOE considers differences in primary energy and FFC effects for different covered products and equipment when determining whether energy savings are significant. Primary energy and FFC effects include the energy consumed in electricity production (depending on load shape), in distribution and transmission, and in extracting, processing, and transporting primary fuels ( i.e., coal, natural gas, petroleum fuels), and thus present a more complete picture of the impacts of energy conservation standards. Accordingly, DOE evaluates the significance of energy savings on a case-by-case basis.

Under EPCA's 6-year-lookback review provision for existing energy conservation standards at 42 U.S.C. 6295(m)(1), cost-effectiveness of potential amended standards is a relevant consideration both where DOE proposes to adopt such standards, as well as where it does not. In considering cost-effectiveness when making a determination of whether existing energy conservation standards do not need to be amended, DOE considers the savings in operating costs throughout the estimated average life of the covered product compared to any increase in the price of, or in the initial charges for, or maintenance expenses of, the covered product that are likely to result from a standard. (42 U.S.C. 6295(m)(1)(A)( referencing 42 U.S.C. 6295(n)(2))) Additionally, any new or amended energy conservation standard prescribed by the Secretary for any type (or class) of covered product shall be designed to achieve the maximum improvement in energy efficiency which the Secretary determines is technologically feasible and economically justified. (42 U.S.C. 6295(o)(2)(A)) Cost-effectiveness is one of the factors that DOE must ultimately consider under 42 U.S.C. 6295(o)(2)(B) to support a finding of economic justification, if it is determined that amended standards are appropriate under the applicable statutory criteria. (42 U.S.C. 6295(o)(2)(B)(i)(II))

In determining cost effectiveness of potential amended standards for DHE, DOE considered the life-cycle cost (“LCC”) and payback period (“PBP”) analyses that estimate the costs and benefits to users from the standards. The LCC is the sum of the initial price of equipment (including its installation) and the operating expense (including energy, maintenance, and repair expenditures) discounted over the lifetime of the equipment. The LCC analysis requires a variety of inputs, such as equipment prices, equipment energy consumption, energy prices, maintenance and repair costs, equipment lifetime, and discount rates appropriate for consumers. To account for uncertainty and variability in specific inputs ( e.g., equipment lifetime and discount rate), DOE uses a distribution of values, with probabilities attached to each value.

The PBP is the estimated amount of time (in years) it takes consumers to recover the increased purchase cost (including installation) of more-efficient equipment through lower operating costs. DOE calculates the PBP by dividing the change in total installation cost due to a more-stringent standard by the change in annual operating cost for the year that standards are assumed to take effect.

To further inform DOE's consideration of the cost-effectiveness of potential amended standards, DOE may also consider the NPV of total costs and benefits estimated as part of the national impact analysis (NIA). The inputs for determining the NPV of the total costs and benefits experienced by consumers are: (1) Total annual installed cost, (2) total annual operating costs (energy costs and repair and maintenance costs), and (3) a discount factor to calculate the present value of costs and savings.

For the determination in this document, DOE considered the LCC and PBP analyses from the April 2010 final rule, as well as the evaluation in the October 2016 final determination, and information gathered on the current market and technologies.

As stated previously, pursuant to EPCA, if DOE does not issue a notification of determination that energy conservation standards for DHE do not need to be amended, DOE must issue a NOPR that includes new proposed standards. (42 U.S.C. 6295(m)(1)(B)) The new proposed standards in any such NOPR must be based on the criteria established under 42 U.S.C. 6295(o). (42 U.S.C. 6295(m)(1)(B)) The criteria in 42 U.S.C. 6295(o) require that standards be designed to achieve the maximum improvement in energy efficiency, which the Secretary determines is technologically feasible and economically justified. (42 U.S.C. 6295(o)(2)(A)) In deciding whether a proposed standard is economically justified, DOE must determine whether the benefits of the standard exceed its burdens. (42 U.S.C. 6295(o)(2)(B)(i)) DOE must make this determination after receiving comments on the proposed standard, and by considering, to the greatest extent practicable, the following seven statutory factors:

As discussed in the October 2016 final determination, DOE found that amended standards for vented heaters would not be economically justified under the considerations of the seven factors prescribed in EPCA. 81 FR 71325, 71328-71329 (Oct. 17, 2016). For the determination in this document, DOE has considered the previous evaluation of amended standards in the October 2016 final determination.

In response to the December 2020 NOPD, the Joint Advocates and NEEA stated that the technology to eliminate standing pilot lights ( i.e., electronic ignition) is readily available and low cost and urged DOE to consider standards specifically for unvented gas heaters that would ban standing pilot lights. (Joint Advocates, No. 16 at p. 1-2; NEEA, No. 20 at p. 2) The Joint Advocates further stated that in the technical support document (TSD) for the hearth products NOPR that DOE published on February 9, 2015, DOE found that electronic ignition systems operate an average of 3.94 hours per year at an estimated 50 W, could be manufactured at an incremental price of approximately $80 and have a PBP and LCC savings of 2.9 years and $327, respectively. (Joint Advocates, No. 16 at p. 1-2; see also chapter 8 of the TSD to the February 2015 NOPR (80 FR 7082 (Feb. 9, 2015))) NEEA also referenced the February 2015 NOPR for hearth products stating that eliminating standing pilots could save an average of $165 over the life of the product. 80 FR 7082, 7084. (NEEA, No. 20 at p. 2)

The CA IOUs and Joint Advocates stated that Appendix G, which does not require the energy consumption of the standing pilot light to be measured if there are instructions for turning the pilot light off when the heater is not in use, may not account for actual consumer behavior and stated that DOE did not provide evidence to support the assumption that consumers will follow the instructions in manufacturer-provided literature and urged DOE to conduct further research. (CA IOUs, No. 17 at p. 3; Joint Advocates, No. 16 at p. 1) The Joint Advocates stated that in the February 2015 NOPR for hearth products DOE analysis showed that 40 percent of the consumers of hearth products leave standing pilot lights on all year and that the average operating hours for standing pilot lights is close to 4,000 hours per year. (Joint Advocates, No. 16 at p. 1)

Section 2.3.1 of Appendix G states that measurement of the pilot light input rate is not required for unvented heaters where the pilot light is designed to be turned off by the user when the heater is not in use ( i.e., for units where turning the control to the OFF position will shut off the gas supply to the burner(s) and the pilot light) and instruction to turn off the unit is provided on the heater near the gas control value ( e.g., by label). Section 2.3.1 of Appendix G requires for unvented heaters with a pilot light that is not designed to be turned off when not in use, or that does not include an instruction to do so, the pilot light input rate must be measured, but is not used in the calculation of rated output in section 3.4 of Appendix G. As explained in the final rule published December 17, 2012, that addressed standby and off mode energy use for unvented heaters, these provisions exclude from the standby mode and off mode requirements a standing pilot light if there are means to disconnect the electric or gas power source when not in use and instructions to do so are clearly visible. 77 FR 74559, 74563 (“December 2012 final rule”). DOE explained that the exclusion is identical to that applicable to manually-controlled vented heaters  12 and that DOE believes this exclusion should also apply to unvented heaters so equipped. Id.

The discussion in the December 2012 final rule and the reference to a comparable application for manually-controlled vented heaters indicates that the exclusion in section 2.3.1 of Appendix G was to exclude manually-controlled heaters ( i.e., without thermostats) in which the burner and pilot light are turned off when the consumer turns the unit off. As a manually-controlled heater operates only when heat is desired by the consumer, all energy use is useful to the consumer. However, the exclusion in section 2.3.1 of Appendix G is more broadly written than the similar exclusion in section 3.5.2 of Appendix O for manually-controlled vented heaters and applies to products that operate with a thermostat or that are manually-controlled. Further, DOE has found that there are manually-controlled unvented gas heaters on the market  13 that have both a fully off mode ( i.e., turning the unit off will turn off the gas to the burner and pilot light) and a mode in which the pilot stays on when heat from the burner is not desired. Such products meet the exclusion criteria in section 2.3.1 of Appendix G but also may not be turned fully off by a consumer when heat is not desired. DOE agrees that amendments to Appendix G to limit the exclusion to unvented heaters that are controlled with a thermostat or manually-controlled unvented heaters with both a fully off mode and a pilot on mode may be appropriate. DOE intends to address this issue further in the ongoing test procedure rulemaking for unvented heaters. 14

There may be the potential for energy savings if consumer behavior regarding the operation of the standing pilot lights for unvented heaters is examined further. However, the values stated by the Joint Advocates cannot be used directly as hearth products, as defined in the February 2015 NOPR, but may be used differently than unvented heaters. At the time of this analysis, DOE has not received information regarding consumer behavior for unvented heaters, but will continue to evaluate in subsequent rulemakings.

The Joint Gas Utilities stated that unvented gas heaters are required by the consensus safety standard ANSI Z21.11.1, “Gas-Fired Room Heaters V: Vented Room Heaters,” to incorporate an oxygen depletion safety (ODS) system that also acts as a burner ignition system and stated that because of this requirement in the safety standard, prohibition of standing pilot lights would essentially prohibit manufacturing unvented gas heaters. (Joint Gas Utilities, No. 15 at p. 4) DOE found that CSA/ANSI Z21.11.2-2019 (ANSI Z21.1.2-2019), “Gas-Fired Room Heaters, Volume II, Unvented Room Heaters” covers unvented gas heaters and that while section 4.9 of ANSI Z21.11.2-2019 does specify that an ODS system be equipped at the point of manufacture, it does not require that a standing pilot light be used in the ODS system. Further, DOE has found that unvented heaters exist on the market  15 with ODS systems and without standing pilot lights.

AHAM supported DOE's assessment from the December 2020 NOPD which stipulated that for unvented heaters any heat losses are lost to the living space and, therefore, unvented heaters are nearly 100 percent efficient. (AHAM, No. 19 at p. 2) Flux Tailor urged DOE to reconsider its blanket assumption that all unvented heaters are 100 percent efficient, suggesting that, depending on type of convection technology and other factors, the heater's real capacity to heat a given space may vary significantly and ultimately effect overall energy consumption. (Flux Tailor, No. 21 at p. 21)

Section 3.1 of Appendix G contains a calculation for annual energy consumption for primary electric heaters. This calculation uses the national average heating load hours ( i.e., 2,080 hours). Appendix G does not provide for calculating the annual energy consumption of supplementary electric heaters or unvented gas or oil heaters. To account for potential variation in a unit's “real” heating capacity, as suggested by Flux Tailor, an annual energy consumption calculation would need to be developed for all unvented heaters that addressed the heating load hours based on quantity of heat a unit provides to a given space. As this would necessitate amendment to the test procedure, Flux Tailor's comment is more appropriately addressed in the ongoing test procedure rulemaking. 16

As stated in section III.A.3., this final determination does not consider unvented hearth heaters. To the extent DOE will consider energy conservation standards for unvented hearth heaters it would do so in a separate rulemaking.

Models on the Market

DOE has conducted a review of the vented heater market, including product literature and product listings in the CCMS database and AHRI product directory. DOE has concluded that the number of models offered in each of the vented heater product classes has continued to decrease overall since the October 2016 final determination, as shown in Table III.3 of this document. The model counts presented in Table III.3 of this document are counts of individual model numbers, as opposed to basic model numbers. A basic model can have multiple individual model numbers certified under it. The model counts from previous rulemakings were individual model numbers, so for consistency of comparison, the model counts for 2021 that are presented in Table III.3 of this document are also in terms of individual model number. DOE acknowledges that, although changes in model counts and shipments sometimes correlate, changes to available model counts do not necessarily indicate a change in the number of units sold. For example, a model could be taken off of the market, but more units of another model could be sold, thereby resulting in roughly the same amount of sales as before the first model was taken off the market. Shipments of vented heaters are discussed is section III.B.3.g of this document.

In response to the February 2019 RFI, AHRI confirmed that there are fewer models in the AHRI Directory now than there were at the time of the October 2016 final determination. (AHRI, No. 6 at p. 4)

In response to the December 2020 NOPD, the Joint Gas Utilities supported DOE's tentative conclusion that new DHE product lines are generally not being developed, the market for DHE is declining, and most product lines function mainly to replace existing units. (Joint Gas Utilities, No. 15 at p. 3) AHAM and AHRI stated that DHE products have not seen significant technological advancement since 2016 ( i.e., when the October 2016 final determination was published) and that products on the market today are approximately the same as those available in 2016. (AHAM, No. 19 at p. 2; AHRI, No. 18 at p. 2) DOE has also found that the products available on the market today are approximately the same as those available in 2016, as discussed in section III.B.3.d, and that the market for DHE is declining, as discussed in section III.B.3.g. of this document.

In the December 2020 NOPD, DOE noted that the number of manufacturers producing vented heaters increased in the CCMS database from four to five between the October 2016 final determination and the December 2020 NOPD. 85 FR 77017, 77028-77029 (Dec. 1, 2020). This new manufacturer mainly produces hearth products (which are not subject to this final determination) but also manufactures two gas wall gravity type vented heaters with input rate and AFUE values that are comparable to the input rate and AFUE values of other models available on the market, and that are similar in design. Since the publication of the December 2020 NOPD, one manufacturer acquired another manufacturer's vented heater brand, resulting in four manufacturers producing vented heaters. 18

In the February 2019 RFI and December 2020 NOPD, DOE listed the technology options considered in the previous rulemakings to increase AFUE and requested comment on these options and any other technology options that would be relevant to vented heaters. 84 FR 6095, 6099 (Feb. 26, 2019); 85 FR 77017, 77029 (Dec. 1, 2020). Specifically, DOE identified the technologies in the following Table III.4 for improving the efficiency of vented heaters.

As stated in the December 2020 NOPD, DOE found that the available range of input rates and AFUE values of vented heater products available on the market have stayed largely the same since the October 2016 final determination. 85 FR 77017, 77029 (Dec. 1, 2020). DOE further stated that differences in the available input rate and AFUE were mostly due to models being taken off the market as opposed to new models being added and that this indicates that the technology options currently available are similar to those examined in both the April 2010 final rule and October 2016 final determination. Id. DOE did not identify any additional technologies, and there were not any comments suggesting additional technology options for vented heaters that were not previously considered. Therefore, DOE used the technology options in Table III.4 of this document for its review of potential amended vented heater energy conservation standard levels in this document.

In the February 2019 RFI, DOE identified and explained why four of the technologies on its initial list had been previously screened out: (1) Increased heat transfer coefficient (practicability to manufacture, install, and service); (2) power burner (practicability to manufacture, install, and service); (3) condensing pulse combustion (technological feasibility); and (4) improved fan or blower motor efficiency (practicability to manufacture, install, and service). 84 FR 6095, 6099-6100 (Feb. 26, 2019). DOE also noted that it only considers potential efficiency levels achieved through the use of proprietary designs in the engineering analysis if they are not part of a unique pathway to achieve the efficiency level ( i.e., if there are other non-proprietary technologies capable of achieving the same efficiency level). 84 FR 6095, 6099 (Feb. 26, 2019). In the December 2020 NOPD, DOE maintained the tentative screening approach presented in the February 2019 RFI. 85 FR 77017, 77029 (Dec. 1, 2020). DOE did not receive comments on the screening analysis in response to the December 2020 NOPD.

In evaluating potential technology options for this final determination, DOE maintained the list from the February 2019 RFI and December 2020 NOPD, as discussed in section III.B.3.b. of this document. In addition, DOE did not find that any of the technology options should be screened out from consideration as options for improving the AFUE of vented heaters other than the four previously screened-out.

For the April 2010 final rule, DOE determined technology options by efficiency level for each of the vented heater product classes. These technology options are found in section 5.7 of the April 2010 final rule TSD  19 and are reproduced in Table III.5 of this document. The representative input rate ranges from the April 2010 final rule are: >42,000 Btu/h for gas wall fan type vented heaters, >27,000 Btu/h and ≤46,000 Btu/h for gas wall gravity type vented heaters, >37,000 Btu/h for gas floor vented heaters, and >27,000 Btu/h and ≤46,000 Btu/h for gas room vented heaters. 75 FR 20112, 20114 (April 16, 2010).

DOE reviewed the technology options available in the current vented heater market for the representative input rate ranges from the April 2010 final rule. The available efficiency levels and associated technologies are shown in Table III.6 of this document.

The maximum available efficiency level is the highest efficiency model currently available on the market for that class. The max-tech efficiency level represents the theoretical maximum possible efficiency if all available design options are incorporated in a model. In some cases, models at the max-tech efficiency level are not commercially available because, although the level is technically achievable, manufacturers have determined that it is not economically feasible (either for the manufacturer to produce or for consumers to purchase). However, DOE seeks to determine the max-tech level for purposes of its analyses. The current maximum available efficiencies for the 11 existing product classes are included in Table III.7, along with the maximum available efficiencies from the April 2010 final rule and those evaluated for the October 2016 final determination.

In the April 2010 final rule, DOE determined max-tech efficiency levels using the technology options available at that time. For gas wall fan type vented heaters with an input rate over 42,000 Btu/h, DOE identified a max-tech efficiency level design with induced draft combustion and electronic ignition, resulting in an AFUE of 80 percent. For gas wall gravity type vented heaters with an input rate over 27,000 Btu/h and up to 46,000 Btu/h, DOE identified 70 percent AFUE as a theoretical max-tech level, which was achievable with an improved heat exchanger design and electronic ignition. For gas floor vented heaters with an input rate over 37,000 Btu/h, DOE identified the max-tech efficiency level as 58 percent AFUE, which DOE stated could be reached using a standing pilot light and an improved heat exchanger design. For gas room vented heaters with an input rate over 27,000 Btu/h and up to 46,000 Btu/h, DOE identified a theoretical max-tech efficiency level of 83 percent AFUE, which manufacturers could achieve using an electronic ignition and a multiple heat exchanger design. 75 FR 20112, 20145-20146 (April 16, 2010).

In the October 2016 final determination, DOE noted that condensing gas wall fan type vented heater models with input rates at or below 42,000 Btu/h had become available, and DOE considered this the max-tech level for all gas wall fan type vented heaters. Based on information obtained during manufacturer interviews and a manufacturer production cost developed through a teardown analysis performed for the proposed determination, DOE determined that condensing technology was not economically justified for gas wall fan type vented heaters at that time. 81 FR 21276, 21280 (April 11, 2016); 81 FR 71325, 71328-71329 (Oct. 17, 2016).

Since the October 2016 final determination, the highest efficiency condensing gas wall fan type vented heater, with an input rate at or below 42,000 Btu/h, available on the market has been rerated ( e.g., the same model number has been rated with at least two different AFUE values between the October 2016 final determination and this NOPD) from an AFUE of 92 percent to an AFUE of 90 percent, which is the only condensing AFUE level on the market. The maximum available AFUE for gas wall gravity type vented heaters, with an input rate over 27,000 Btu/h and up to 46,000 Btu/h, increased to 70 percent, which is the max-tech level analyzed in the April 2010 final rule. In total, the maximum available AFUE decreased for two input rate ranges and increased for one input rate range. All other input rate ranges have the same maximum available AFUE as in the October 2016 final determination.

In response to the December 2020 NOPD, NEEA urged DOE to consider condensing technology as a technology option and analyze the maximum levels technologically feasible, not just those available. (NEEA, No. 150 at p. 2) The CA IOUs recommended DOE conduct an updated analysis to reconsider the max-tech levels for all DHE products rather than rely on max-tech levels from the analysis conducted for the April 2010 final rule. (CA IOUs, No. 17 at p. 1) The CA IOUs also stated that without a thorough engineering analysis of gas wall fan type vented heaters, the December 2020 NOPD gives insufficient justification that the AFUE level attained by the few condensing products on the market can be considered max-tech and that if DOE were to apply a different max-tech level for condensing technology, the energy savings threshold to initiate a new rulemaking could be met. (CA IOUs, No. 17 at p. 2) For gas wall gravity type and gas room vented heaters, CA IOUs asserted that the absence of any condensing efficiency level products on the market does not relieve DOE of the obligation to explore condensing tech as max-tech for these categories. (CA IOUs, No. 17 at p. 2)

DOE has included condensing technology in the list of technology options for the entirety of the analysis conducted for this final determination. Gas wall fan type vented heaters could have a theoretical AFUE above the level analyzed in the October 2016 final determination and December 2020 NOPD as max-tech and this theoretical level results in increased energy savings. 81 FR 71325, 71327 (Oct. 17, 2016); 85 FR 77017, 77030 (Dec. 1, 2020). As discussed in section III.B.1.a, in screening for technologies that are technologically feasible, DOE considers technologies incorporated in commercial products or in working prototypes. 10 CFR part 430 subpart C appendix A section 6(c)(3)(i). DOE did not identify gas wall gravity type and gas room vented heaters with condensing technologies on the market or as prototypes that incorporated condensing technology, that achieved an AFUE higher than that considered.

As discussed in the following sections, DOE has determined that energy conservation standards do not need to be amended based on the continued likelihood that amending the vented heater energy conservation standards would impose a substantial burden on manufacturers of vented heaters, particularly to small manufacturers. For gas wall gravity type, gas floor, and gas room vented heaters, the technologies available on the market produce AFUE values that are well below near-condensing operation, suggesting significant redesign would be required to incorporate condensing technology, likely resulting in increasing potential costs to manufacturers. Given that an energy conservation standard that required use of condensing technology would further exacerbate the estimated impacts of amended standards as determined in the prior determinations, DOE did not include condensing technology in its engineering analysis beyond that considered in the prior engineering analysis conducted for the October 2016 final determination. 81 FR 71325, 71327-71328 (Oct. 17, 2016).

In response to the December 2020 NOPD, CA IOUs stated that DOE has not presented information to suggest that electronic ignition could not be included in gas floor vented heaters, and encouraged DOE to complete a thorough analysis that appropriately considers electronic ignition technology. (CA IOUs, No. 17 at p. 3) As stated, DOE has determined that standards do not need to be amended based on the continued likelihood that amending the vented heater energy conservation standards would impose a substantial burden on manufacturers of vented heaters, particularly to small manufacturers. As discussed in sections III.B.3.g and III.B.3.i, vented heater shipments have declined since the April 2010 final rule and one of the two manufacturers of gas floor vented heaters is a small business while it is unclear whether the other manufacturer remains a small business after acquiring another small business manufacturer's gas floor vented heater brand. Gas floor vented heaters are also the smallest product class by model count. As such, DOE did not include electronic ignition in its engineering analysis.

The Joint Advocates asserted that some models of vented heaters meet the current energy conservation standards but still have standing pilot lights, and that pilot lights left burning year-round can consume 6.8 MMBtu of fuel per year, which would account for around 25 percent of total annual gas consumption for vented heaters. (Joint Advocates, No. 16 at p. 1) DOE has identified vented heaters on the market with standing pilot lights that meet the current energy conservation standards. The energy conservation standards established in the April 2010 final rule were set at a level attainable by units that use standing pilot lights as evidenced by the technology options listed for each efficiency level in chapter 5 of the TSD for the April 2010 final rule.

After establishing the efficiency levels in the April 2010 final rule, DOE estimated the manufacturer production cost (MPC) of attaining each efficiency level based on the technology options identified for that level. The MPC takes into account the costs for material, labor, depreciation, and overhead. These values were developed based on product teardowns that generated bills of materials for all components and manufacturing processes required to manufacture vented heaters at a given efficiency level for each product class. DOE uses these bills of material, along with information on material and component prices, costs for labor, depreciation, and overhead to derive the MPC. In development of the April 2010 final rule, manufacturer interviews were conducted to verify the accuracy of the inputs to DOE's analysis of MPCs ( e.g., material prices, labor rates) and the resulting MPCs. 75 FR 20112, 20147-20148 (April 16, 2010). As discussed in section II.B.3.b., after the April 2010 final rule and before October 2016 final determination, a condensing gas was fan type vented heater came on the market. In a NOPD which preceded the October 2016 final determination, DOE stated that the MPC for a condensing gas wall fan type vented heater had a 23 percent higher incremental cost than a unit at 80 percent AFUE ( i.e., the max-tech efficiency level evaluated in the April 2010 final rule). 81 FR 21276, 21280 (April 11, 2016) (April 2016 NOPD). DOE received feedback during manufacturer interviews which indicated that condensing models are significantly more expensive to manufacture than non-condensing models and to confirm these statements, DOE performed a product teardown of a condensing model. Id.

DOE reviewed its April 2010 final rule and October 2016 final determination engineering analyses to determine whether the results are still valid in the context of the current market. As the market conditions for manufacturers remains substantially the same as the previous rulemakings ( i.e., production volumes remain similar or slightly lower than previously projected, while material prices and labor rates are also similar), DOE has determined that the engineering analysis performed during the April 2010 final rule and October 2016 final determination are still valid for estimating MPC. DOE also reviewed retail prices for models currently available on the market and found that the current retail prices are comparable to those published in chapter 8, section 8.2.3.5 of the April 2010 final rule TSD, when adjusted for inflation. Because DOE has not found distribution channels or mark-ups to have changed since the April 2010 final rule, the similarity of the predicted retail prices in the April 2010 final rule analysis to those of current products indicates that the MPC are likely to be unchanged from the April 2010 final rule analysis.

Table III.8 presents the average energy consumption, from section 7.3.6 of the April 2010 final rule TSD, for each vented heater product class and efficiency level. DOE has concluded that the current average energy consumption for these vented heaters is comparable to the estimates developed for the April 2010 final rule and relied on in the October 2016 final determination, as the technology options at each efficiency level have not changed substantially.

The Joint Advocates stated that in the February 2015 NOPR for hearth products, DOE analysis showed that 40 percent of the consumers of hearth products leave standing pilot lights on all year and that the average operating hours for standing pilot lights is close to 4,000 hours per year. ( Id. ) CA IOUs asserted that vented heaters are not often used in an on/off configuration and that intermittent heating use during shoulder seasons will also lead to wasted energy if the standing pilot light is burning the whole time but the heater is only used during small portions of the day. (CA IOUs, No. 21 at p. 20)

DOE notes that the estimates developed for the April 2010 final rule assumes that 100 percent of consumers have the pilot on year-round, so the impact of pilot use is considered in this analysis. DOE believes that the fraction of vented heaters that have standing pilot on during the non-heating season is likely much higher than for hearth products, but likely not 100 percent. Therefore, the April 2010 final rule analysis likely overestimates the potential energy savings from electronic ignition since a fraction of consumers might turn the standing pilot off during the non-heating season. DOE also notes that standing pilot energy use during the shoulder season could offset some time that the main burner would be on, which is not considered in the April 2010 final rule analysis, and could offset some of the energy savings as well.

LCC is the total consumer expense over the life of an appliance, including the total installed cost and operating costs (including energy expenditures, maintenance, and repair). DOE discounts future operating costs to the time of purchase, and sums them over the lifetime of the product.

The total installed cost is determined by combining the installation cost with the equipment price. The equipment price is determined using the MPC and applying a manufacturer mark-up, a wholesaler mark-up, a mechanical contractor mark-up, and sales tax. 20 As presented in section III.B.3.d. of this document, DOE has determined that the MPC has not changed significantly since the April 2010 final rule. DOE has also concluded that the average mark-ups, sales taxes, and installation costs are comparable to the estimates developed for the April 2010 final rule. Therefore, the total installed costs for the products and efficiency levels that are still on the market and were evaluated during the April 2010 final rule are estimated to have remained approximately the same given that the analyzed technology options have not changed. As discussed in section II.B.3.b., condensing gas wall fan type vented heaters came on the market between the April 2010 final rule and October 2016 final determination. DOE additionally estimates that the total installed cost for the 90-percent AFUE gas wall fan type vented heater would be considerably higher compared to lower efficiency gas wall fan type vented heaters, since there are considerable development and production costs (as discussed in section III.B.3.d. of this document), as well as additional installation costs.

The annual operating cost is determined by the energy consumption of vented heaters, the energy prices of the fuel used, and any repair and maintenance costs that would be required. DOE has determined that the energy consumption (as discussed in section III.B.3.e. of this document) and repair and maintenance costs associated with each efficiency level have not changed significantly from that in the April 2010 final rule for the vented heaters that are still on the market, as the technology options have not changed. DOE additionally estimates that the average energy consumption for the 90-percent AFUE gas wall fan type vented heater would be proportionally lower compared to the 80-percent AFUE gas wall fan type vented heaters, and repair and maintenance costs would be higher than for the 80-percent AFUE gas wall fan type vented heaters. To assess the impact of energy prices, DOE compared the April 2010 final rule's average energy prices for 2013 ( i.e., the starting year in the analysis) to a likely starting year if DOE performed a revised analysis in a new rulemaking. The April 2010 final rule used Energy Information Administration's (EIA) Annual Energy Outlook ( AEO ) 2010 energy price trends. 21 To assess the impact of updated energy price estimates, DOE used EIA's AEO 2021 energy price trends to estimate the energy prices in 2027, 22 the expected compliance year for the updated analysis. 23 Both the natural gas and propane prices projected in 2027 are lower ($10.99/MMBtu in 2019$ and $21.11/MMBtu in 2020$, respectively) compared to the 2013 natural gas and propane prices used in the April 2010 final rule ($13.47/MMBtu in 2019$ and $33.12/MMBtu in 2020$, respectively). 24 Additionally, the 30-year trends are comparable in the two AEO editions. Due to comparable energy use and lower energy prices, DOE has determined that the annual operating cost of vented heaters has either decreased or not changed significantly from that estimated in the April 2010 final rule.

As vented heaters have not significantly changed since the April 2010 final rule, DOE has determined that the product lifetime has remained largely the same. DOE has also determined that residential discount rates have not changed significantly from those in the April 2010 final rule.

Because the total installed costs are estimated not to have changed significantly, and operating costs are estimated to be comparable, DOE has determined that the LCC savings for each efficiency level of vented heaters are similar to the estimates in the April 2010 final rule. Further, DOE has determined that the relative comparisons between each efficiency level for each product class remain unchanged and that the conclusions from the April 2010 final rule and October 2016 final determination are still applicable.

The PBP is the amount of time it takes the consumer, in a typical case, to recover the estimated higher purchase expense of more energy-efficient products through lower operating costs. Numerically, the PBP is the ratio of the increase in purchase expense ( i.e., due to a more energy-efficient design) to the decrease in annual operating expenditures. This type of calculation is known as a “simple” payback period, because it does not take into account changes in operating expense over time or the time value of money ( i.e., the calculation is done at an effective discount rate of zero percent). Payback periods are expressed in years. Payback periods greater than the life of the product indicate that the increased total installed cost is not recovered by the reduced operating expenses.

As previously stated, DOE has estimated that the total installed costs have not changed significantly, and operating costs are comparable to the April 2010 final rule results. Therefore, DOE has determined that the “simple” payback period for each efficiency level of vented heaters is similar to the “simple” payback period results from the April 2010 final rule. Further, DOE has determined that the relative comparisons between each efficiency level for each product class remain unchanged and that the conclusions from the April 2010 final rule and October 2016 final determination are still applicable.

In response to the December 2020 NOPD, the Joint Gas Utilities stated their support for DOE's tentative determination in the December 2020 NOPD that amended energy conservation standards are not cost-effective on an energy price basis, based on the LCC and PBP analyses. (Joint Gas Utilities, No. 15 at p. 3) For gas wall gravity type vented heaters that do not have electricity, NEEA requested that DOE consider the costs of bringing an electrical connection to the unit and adding a circulation fan in its LCC analysis to determine whether updated standards would be cost-effective. (NEEA, No. 20 at p. 2) Flux Tailor suggested that DOE also consider projected electricity prices in its analysis as they may well increase in the future, even if natural gas prices are predicted to decrease. (Flux Tailor, No. 21 at p. 42)

In chapter 8 section 8.2.3.4 of the TSD for the April 2010 final rule, DOE stated that it included an additional installation cost for the design options that require electricity. Therefore, the cost of adding an electrical connection is already accounted for in the LCC analysis for the product classes that do not use electricity at the baseline and have higher efficiency levels which use electricity. DOE disagrees that adding an aftermarket circulation fan to a gas wall gravity type vented heater should be considered in the LCC analysis. The addition of an external fan would help circulate heated air throughout the space but does not help with the heat exchange process and therefore would not have a noticeable effect on the efficiency of the gas wall gravity type vented heater as measured by appendix O. Further, adding an internal circulation fan to a gas wall gravity type vented heater would make the unit a gas wall fan type vented heater and would therefore not be covered by the gas wall gravity type vented heater product class and the energy conservation standards. DOE agrees with Flux Tailor and uses projected electricity prices in its LCC analysis.

In the February 2019 RFI, DOE stated that from the April 2010 final rule, the Department has included vented heater historical shipment data from AHRI for gas wall vented heaters from 1990 to 1998 and from 2000 to 2006, for gas floor vented heaters from 1990 to 2007, and for gas room vented heaters from 1990 to 2005. DOE also has limited disaggregated shipments for fan type and gravity type gas wall vented heaters and by input capacity. DOE requested comment on the annual sales data ( i.e., number of shipments) for each vented heater product class from 2008-2018. 84 FR 6095, 6104-6105 (Feb. 26, 2019). In 2016, AHRI presented data showing the percentage change in total shipments for the years 2010-2015 compared with the total shipments over the period 2001-2006, estimating that gas wall vented heater (including both fan and gravity type units) shipments were 21 percent less, that direct vent gas wall vented heater (a form of gas wall vented heater) shipments were 31 percent less, and that gas room vented heater shipments were 44 percent less. 25 AHRI did not have an active statistics program for gas floor vented heaters and was attempting to collect annual shipments information for recent years through a special data collection.

In response to the December 2020 NOPD, AHRI stated that it was conducting a special data collection to gather shipment data for each vented heater product class from 2016-2018, and that these data will be provided to DOE at a later date. (AHRI, No. 6 at p. 4) At this time, AHRI has not submitted data for the 2016-2018 time period.

In response to the December 2020 NOPD, the CA IOUs urged DOE to find new sources of data for the shipment analysis, noting that, because of the Great Recession, relying on pre-2010 shipment data for DHE market forecasting may not be prudent. (CA IOUs, No. 17 at p. 3) CA IOUs also commented that AHRI is conducting a special data collection of shipments for vented heater products from 2016-2018 and encouraged DOE to delay any final determination until additional shipments data from the DHE industry is received and analyzed. (CA IOUs, No. 17 at p. 3)

As stated in the December 2020 NOPD, AHRI provided the percent change in total shipments for the vented heater market for the years of 2010 through 2015 as compared to 2001 through 2006 and showed a reduction in shipments for gas wall vented heaters and gas room vented heaters. 85 FR 77017, 77034 (Dec. 1, 2020). Also, as stated in the December 2020 NOPD, these shipments are lower than the projected shipments from the April 2010 final rule indicating that the decline in vented heater shipments has been faster than expected. Id. at 77038. DOE has not received shipments data more recent than 2015, however, the alignment of April 2010 final rule shipment projections and the actual shipment data received from AHRI for 2010 through 2015 along with the reduction in model counts since 2015 (see section III.B.3) suggest that the number of shipments have continued to decline for the vented heater market. Therefore, DOE has determined the shipments data relied on for its prior determination are appropriate for the present determination.

As explained in sections III.B.3.d. through III.B.3.g. of this document, the technology options, energy use, and shipments for DHE have not changed significantly since the April 2010 final rule and October 2016 final determination. Accordingly, the national energy savings are expected to be largely the same as the national energy savings projected in the April 2010 final rule. In the April 2010 final rule, DOE estimated that the max-tech TSL (TSL 6) would result in an additional 0.13 quads of site energy savings over 30 years, as compared to the adopted TSL ( i.e., the current standard levels). 26 The site energy savings from the max-tech TSL represent approximately a six-percent reduction compared to the total 30-year site energy consumption, as compared to the current standard levels. 27

The April 2010 final rule did not contemplate or include a TSL with specific provisions for a condensing gas wall fan type vented heater. DOE identified one manufacturer of condensing gas fan type vented heaters which produces two models at 90-percent AFUE.

As stated in section II.B.3.b. of this document, in the NOPR that preceded the April 2010 final rule, DOE proposed to amend standards for vented heaters to TSL 3. 74 FR 65852, 65973 (Dec. 11, 2009). In response to that proposal, DOE received several comments expressing concerns that:

• Shipments of vented heaters were low, and, therefore, potential energy savings were low;

• Low shipments would make it difficult for manufacturers to recoup the costs to comply with amended standards;

• Product offerings may be limited as a response to amended standards;

• Manufacturers may exit the industry as a result of amended standards;

• Employment may be negatively impacted due to reduced product lines and insufficient return on investment. 75 FR 20112, 20218 (April 16, 2010).

In the April 2010 final rule, DOE additionally found that the industry had gone through considerable consolidation due to decreased shipments, that product lines were primarily maintained to provide replacement products, and that some small business manufacturers could be disproportionately affected by a more-stringent standard. 75 FR 20112, 20199, and 20218 (April 16, 2010). As mentioned in section III.B.3.g. of this document, the April 2010 final rule presented a trend of declining annual shipments throughout the 30-year analysis period. As discussed in section II.B.2.b. of this document, DOE ultimately adopted standards at TSL 2 for vented heaters, which was one TSL below the proposed level. In rejecting proposed TSL 3, DOE concluded that the benefits of higher potential standard levels would be outweighed by the economic burden on some consumers, the large capital conversion costs that could result in a large reduction in INPV for the manufacturers of vented heaters, and the potential for small business manufacturers of vented heaters to reduce their product offerings or to be forced to exit the market completely, thereby reducing competition in the vented heater market. 75 FR 20112, 20218-20219 (April 16, 2010).

In the April 2016 proposed determination that preceded the October 2016 final determination, DOE tentatively determined that the conclusions presented in the April 2010 final rule were still valid. 81 FR 21276, 21281 (April 11, 2016). Further, DOE has found that the number of models offered in each of the vented heater product classes decreased in the time between the April 2010 final rule and the October 2016 final determination, which indicated that the vented heater market was shrinking and product lines were mainly maintained as replacements for current vented heater products. 81 FR 71325, 71327 (Oct. 17, 2016).

In the October 2016 final determination, DOE noted that the number of manufacturers declined from six to four, indicating consolidation in the vented heater industry. 81 FR 71325, 71328 (Oct. 17, 2016).

In DOE's most recent review of the market, a total of four manufacturers were identified within the vented heater industry. At least two of those four manufacturers are domestic small businesses. In the December 2020 NOPD, DOE had previously identified five manufacturers, four of which were domestic small businesses. 85 FR 77017, 77028 (Dec. 1, 2020). Between the publication of the December 2020 NOPD and this final determination one small business manufacturer purchased the other small business manufacturer's vented heater brand. It is unclear at this time whether the combined business remains below the SBA's headcount threshold of 500 people to be considered a small business.

In the February 2019 RFI, DOE requested comment on annual sales data for each vented heater product class from 2008-2018. 84 FR 6095, 6105 (Feb. 26, 2019). DOE did not receive any comment or information regarding the number and classification of manufacturers presented in the February 2019 RFI and December 2020 NOPD and, therefore, considers its previous analysis of industry shipments to still be valid. DOE also did not receive any comments or data suggesting that DOE's analysis of the DHE market in the April 2016 NOPD was inaccurate. AHRI supported DOE's tentative conclusion that if new or amended standards were proposed, DHE manufacturers would need to undergo significant design upgrades to existing products that would not be economically supported by current sales volumes. (AHRI, No. 18 at p. 1) Because the market conditions are substantially the same as when DOE considered manufacturer impacts for the April 2010 final rule and October 2016 final determination, DOE concludes that manufacturers would likely face similar impacts under more-stringent standards as those previously discussed.

In response to the December 2020 NOPD, AHAM, AHRI, the Joint Gas Utilities, and Ms. Spotswood supported DOE's tentative determination not to amend standards. (AHAM, No. 19 at p. 1; AHRI, No. 18 at p. 1; Joint Gas Utilities, No. 15 at p. 3; Ms. Spotswood, No. 14 at p. 1) The CA IOUs urged DOE to set aside its tentative conclusion not to amend DHE standards, gather additional and more current technical/market data, and conduct a thorough energy savings, market, and technical analysis before proceeding. (CA IOUs, No. 17 at p. 4)

After carefully considering the comments on the February 2019 RFI and the December 2020 NOPD, along with the available data and information, DOE has determined that energy conservation standards for DHE do not need to be amended, for the reasons explained in the paragraphs immediately following. As discussed in the preceding sections, DOE's review of the current DHE market indicates that the technology options, product cost, and energy use have not changed significantly since the October 2016 final determination. As such, the conclusions found in the April 2010 final rule and October 2016 final determination are still valid.

As discussed in sections II.B.2.a. and II.B.3.a. of this document, the efficiency inherent with unvented electric heaters provides negligible opportunity for energy savings, because any heat loss of the product is transferred to the conditioned space and not wasted. Therefore, consistent with previous rulemakings in which it has addressed unvented electric heaters, DOE has determined that energy conservation standards for unvented electric heaters are not needed.

As discussed in section III.B.2 of this document, there may be potential for energy savings for unvented gas and oil heaters subject to potential test procedure amendments to Appendix G that would require the measurement of standing pilot light energy use in unvented heaters that are thermostatically-controlled. As stated, further analysis is required to fully understand consumer behavior regarding actual operation of unvented heaters. In particular, the extent to which consumers turn the standing pilot light off during the non-heating season requires further investigation. Given the lack of adequate information on consumer behavior and test procedure provisions that would capture the related energy savings, DOE has determined not to establish energy conservation standards for unvented gas and oil heaters at this time.

For vented heaters, DOE analyzed each product class—gas wall fan type, gas wall gravity type, gas floor, and gas room—separately in the market and evaluated: Technology assessment (sections III.B.3.a. and III.B.3.b. of this document), the screening analysis (section III.B.3.c. of this document), the engineering analysis (section III.B.3.d. of this document), the LCC and PBP analysis (section III.B.3.f. of this document), the shipments analysis (section III.B.3.g. of this document), all vented heaters together in the energy use analysis (section III.B.3.e. of this document), the national energy savings analysis (section III.B.3.h. of this document), and the manufacturer impact analysis (section III.B.3.i. of this document) when making a determination of whether amended standards are justified under EPCA.

EPCA mandates that DOE consider whether amended energy conservation standards for vented heaters would be technologically feasible. (42 U.S.C. 6295(m)(1)(A) and 42 U.S.C. 6295(n)(2)(B)) For gas floor vented heaters, as discussed in section III.B.3.d. of this document, the maximum available efficiency level on the market is at the baseline efficiency level ( i.e., the current standard). Since there are no models available on the market above baseline and DOE is unaware of any prototype designs that have demonstrated higher efficiencies for gas floor vented heaters, DOE concludes that more stringent standards for gas floor vented heaters are not technologically feasible.

DOE has determined that there are technology options that would improve the efficiency of gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters. These technology options are being used in commercially available gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters and, therefore, are technologically feasible. ( See section III.B.3.b. of this document for further information.) Hence, DOE has determined that amended energy conservation standards for gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters are technologically feasible.

As the next step in the agency's analysis, EPCA requires DOE to then consider whether amended energy conservation standards for gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters would be cost-effective through an evaluation of the savings in operating costs throughout the estimated average life of the covered product compared to any increase in the price of, or in the initial charges for, or maintenance expenses of the covered products which are likely to result from the amended standard. (42 U.S.C. 6295(m)(1)(A), 42 U.S.C. 6295(n)(2)(C), and 42 U.S.C. 6295(o)(2)(B)(i)(II)) As discussed in sections II.B.2.b and III.B.3.f. of this document, DOE determined that the LCC and PBP analyses of TSL 3, the TSL immediately above the level adopted as a Federal standard (and which was proposed in the October 2009 NOPR and rejected in the April 2010 final rule), as evaluated in the April 2010 final rule, indicated that initial costs to some consumers outweighed the consumer benefits. 75 FR 20112, 20218-20219 (April 16, 2010); 81 FR 71325, 71327 (Oct. 17, 2016) DOE's full determination in the April 2010 final rule was also based on the impact to manufacturers as discussed in section III.B.3.i. and section III.C.2.d. of this document. DOE has determined that the LCC and PBP analyses conducted for the April 2010 final rule remain generally applicable.

As discussed in section III.B.3.e. of this document, DOE has determined it appropriate to base its energy savings analysis on the estimates developed during the April 2010 final rule and October 2016 final determination. Based on its analysis, DOE estimated that for gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters, potential site energy savings from more-stringent standards at the max-tech level would be 0.13 quads.

As previously discussed, DOE is required to publish either a notification of a determination that standards for vented heaters do not need to be amended, or a NOPR including new proposed standards. (42 U.S.C. 6295(m)(1) and 42 U.S.C. 6295(m)(3)(B)) If DOE publishes a NOPR including new proposed standards, the proposed standards must be designed to achieve the maximum improvement in energy efficiency, which DOE determines is technologically feasible and economically justified. (42 U.S.C. 6295(m)(1)(B); 42 U.S.C. 6295(o)(2)(A)). In determining whether new proposed standards would be economically justified, DOE must determine whether the benefits of the standards exceed their burdens by considering, to the greatest extent practicable, the seven statutory criteria previously discussed. (42 U.S.C. 6295(o)(2)(B)(i))

For gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters, DOE considered the findings of the April 2010 final rule and the October 2016 final determination, in addition to comments received in response to the February 2019 RFI and December 2020 NOPD. As discussed in section III.B.3.g. of this document, the number of vented heater shipments were projected to decline in the April 2010 final rule, and comments received during the rulemaking that resulted in the October 2016 final determination indicated that shipments have indeed continued to decline since the previous analysis was conducted. Further, DOE stated in the April 2016 NOPD which preceded the October 2016 final determination that shipments were in fact lower than projected in the April 2010 final rule, indicating that the decline has been faster than expected. 81 FR 21276, 21281 (April 11, 2016) This supports the notion that the vented heater market is continuing to shrink, that product lines are mainly maintained as replacements for existing vented heaters units, and that new product lines generally are not being developed. In addition, the one new manufacturer of vented heaters that has entered the market since the October 2016 final determination only produces two models, neither of which have AFUE values outside of the range offered by other manufacturers, or any other characteristics that make them unique from other products already on the market and one small business manufacturer has left the market. As discussed in sections III.B.3.a. and III.B.3.d. of this document, DOE found that the available AFUE values have largely stayed the same or decreased, with more-efficient products being taken off the market or rerated to lower AFUE values.

As discussed in section III.B.3.f. of this document, an examination of how the inputs to the LCC and PBP analysis have changed since the April 2010 final rule indicates that the LCC and PBP results from the April 2010 final rule would be comparable today. As discussed in section III.B.3.i. of this document, DOE did not receive any comments or data in response to the February 2019 RFI or December 2020 NOPD that suggested a change in the historical trends within this industry.

In the April 2010 final rule, DOE rejected higher standards, finding that capital conversion costs would lead to a large reduction in INPV and that small businesses would be disproportionately impacted, which would outweigh any benefits from higher standard levels. 75 FR 20112, 20217-20218 (April 16, 2010) Upon reviewing the current market for vented heaters, DOE has determined that its prior determination regarding the impact on INPV remains valid ( i.e., standard levels above the current Federal energy conservation standard would require manufacturers to make significant capital investments of the magnitude initially projected in the April 2010 final rule). As shipments for vented heaters have continued to decrease, manufacturers would be required to make investments to update model lines and manufacturing facilities with fewer shipments over which to spread the cost. This would lead to even more difficulty in recovering their investment than was projected in the April 2010 final rule.

In addition, DOE has determined that its conclusions regarding small business impacts from the April 2010 final rule and the October 2016 final determination are still valid concerns ( i.e., small businesses would likely reduce product offerings or leave the vented heater market entirely if the standard were to be set above the level adopted in that rulemaking). Two of the four identified manufacturers of gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters are small businesses.

EPCA requires DOE to incorporate standby mode and off mode energy use into a single amended or new standard (if feasible) or prescribe a separate standard for standby mode and off mode energy consumption in any final rule establishing or revising a standard for a covered product, adopted after July 1, 2010. (42 U.S.C. 6295(gg)(3)(A)-(B)) Because DOE is not amending standards for DHE in this rule, DOE is not required to adopt amended standards that include standby and off mode energy use. DOE notes that fossil fuel energy use in standby mode and off mode is already included in the AFUE metric, and DOE anticipates that electric standby and off mode energy use is small in comparison to fossil fuel energy use.

For gas floor vented heaters, DOE concludes that more-stringent standards for gas floor vented heaters are not technologically feasible. As such, DOE also concludes that there is no conservation of energy possible from including gas floor vented heaters. Therefore, DOE has determined that amended standards for gas floor vented heaters are not needed.

DOE has determined that, for gas wall fan type vented heaters, gas wall gravity type vented heaters, and gas room vented heaters, the potential benefits from amended standards would be outweighed by burdens on manufacturers. As such, DOE has determined that new proposed standards would not be economically justified. Therefore, DOE has determined that amended standards for gas wall fan type vented heaters, gas wall gravity type heaters, and gas room vented heaters are not justified at this time.

The Office of Management and Budget (OMB) has determined that this final determination does not constitute a “significant regulatory action” under section 3(f) of Executive Order (E.O.) 12866, “Regulatory Planning and Review,” 58 FR 51735 (Oct. 4, 1993). Accordingly, this action was not subject to review under E.O. 12866 by the Office of Information and Regulatory Affairs (OIRA) at OMB.

The Regulatory Flexibility Act (5 U.S.C. 601 et seq. ) requires preparation of an initial regulatory flexibility analysis (IRFA) for any rule that by law must be proposed for public comment, unless the agency certifies that the rule, if promulgated, will not have a significant economic impact on a substantial number of small entities. As required by E.O. 13272, “Proper Consideration of Small Entities in Agency Rulemaking,” 67 FR 53461 (August 16, 2002), DOE published procedures and policies on February 19, 2003, to ensure that the potential impacts of its rules on small entities are properly considered during the DOE rulemaking process. 68 FR 7990 DOE has made its procedures and policies available on the Office of the General Counsel's website ( www.energy.gov/gc/office-general-counsel ).

DOE reviewed this final determination under the provisions of the Regulatory Flexibility Act and the policies and procedures published on February 19, 2003. DOE is proposing to not amend standards for DHE. On the basis of the foregoing, DOE certifies that the final determination will not have a “significant economic impact on a substantial number of small entities.” Accordingly, DOE has not prepared an FRFA for this final determination. DOE will transmit this certification and supporting statement of factual basis to the Chief Counsel for Advocacy of the Small Business Administration for review under 5 U.S.C. 605(b).

This final determination, which determines that amended energy conservation standards for DHE are not justified, would impose no new informational or recordkeeping requirements. Accordingly, OMB clearance is not required under the Paperwork Reduction Act. (44 U.S.C. 3501 et seq. )

Pursuant to the National Environmental Policy Act (NEPA) of 1969, DOE has analyzed this proposed action in accordance with NEPA and DOE's NEPA implementing regulations (10 CFR part 1021). DOE has determined that this rule qualifies for categorical exclusion under 10 CFR part 1021, subpart D, appendix A5 because it is an interpretive rulemaking that does not change the environmental effect of the rule and meets the requirements for application of a CX. See 10 CFR 1021.410. Therefore, DOE has determined that promulgation of this rule is not a major Federal action significantly affecting the quality of the human environment within the meaning of NEPA, and does not require an EA or EIS.

E.O. 13132, “Federalism,” 64 FR 43255 (August 10, 1999), imposes certain requirements on Federal agencies formulating and implementing policies or regulations that preempt State law or that have federalism implications. E.O. 13132 requires agencies to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and to carefully assess the necessity for such actions. E.O. 13132 also requires agencies to have an accountable process to ensure meaningful and timely input by State and local officials in the development of regulatory policies that have federalism implications. On March 14, 2000, DOE published a statement of policy describing the intergovernmental consultation process it will follow in the development of such regulations. 65 FR 13735 DOE has examined this final determination and has determined that it would not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. EPCA governs and prescribes Federal preemption of State regulations as to energy conservation for the products that are the subject of this final determination. States can petition DOE for exemption from such preemption to the extent, and based on criteria, set forth in EPCA. (42 U.S.C. 6297) As this final determination would not amend the standards for DHE, there is no impact on the policymaking discretion of the States. Therefore, no action is required by E.O. 13132.

Regarding the review of existing regulations and the promulgation of new regulations, section 3(a) of E.O. 12988, “Civil Justice Reform,” imposes on Federal agencies the general duty to adhere to the following requirements: (1) Eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; (3) provide a clear legal standard for affected conduct rather than a general standard, and (4) promote simplification and burden reduction. 61 FR 4729 (Feb. 7, 1996). Regarding the review required by section 3(a), section 3(b) of E.O. 12988 specifically requires that Executive agencies make every reasonable effort to ensure that the regulation: (1) Clearly specifies the preemptive effect, if any; (2) clearly specifies any effect on existing Federal law or regulation; (3) provides a clear legal standard for affected conduct while promoting simplification and burden reduction; (4) specifies the retroactive effect, if any; (5) adequately defines key terms, and (6) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of E.O. 12988 requires Executive agencies to review regulations in light of applicable standards in section 3(a) and section 3(b) to determine whether they are met or it is unreasonable to meet one or more of them. DOE has completed the required review and determined that, to the extent permitted by law, this final determination meets the relevant standards of E.O. 12988.

Title II of the Unfunded Mandates Reform Act of 1995 (UMRA) requires each Federal agency to assess the effects of Federal regulatory actions on State, local, and Tribal governments and the private sector. Public Law 104-4, sec. 201 (codified at 2 U.S.C. 1531). For a proposed regulatory action likely to result in a rule that may cause the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector of $100 million or more in any one year (adjusted annually for inflation), section 202 of UMRA requires a Federal agency to publish a written statement that estimates the resulting costs, benefits, and other effects on the national economy. (2 U.S.C. 1532(a), (b)) The UMRA also requires a Federal agency to develop an effective process to permit timely input by elected officers of State, local, and Tribal governments on a proposed “significant intergovernmental mandate,” and requires an agency plan for giving notice and opportunity for timely input to potentially affected small governments before establishing any requirements that might significantly or uniquely affect them. On March 18, 1997, DOE published a policy statement on its process for intergovernmental consultation under UMRA. 62 FR 12820. DOE's policy statement is also available at: www.energy.gov/sites/prod/files/gcprod/documents/umra_97.pdf.

DOE examined this final determination according to UMRA and its policy statement and determined that the final determination does not contain a Federal intergovernmental mandate, nor is it expected to require expenditures of $100 million or more in any one year. As a result, the analytical requirements of UMRA do not apply.

Section 654 of the Treasury and General Government Appropriations Act, 1999 (Pub. L. 105-277) requires Federal agencies to issue a Family Policymaking Assessment for any rule that may affect family well-being. This final determination would not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has concluded that it is not necessary to prepare a Family Policymaking Assessment.

Pursuant to E.O. 12630, “Governmental Actions and Interference with Constitutionally Protected Property Rights,” 53 FR 8859 (March 18, 1988), DOE has determined that this final determination would not result in any takings that might require compensation under the Fifth Amendment to the U.S. Constitution.

Section 515 of the Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516, note) provides for Federal agencies to review most disseminations of information to the public under information quality guidelines established by each agency pursuant to general guidelines issued by OMB. OMB's guidelines were published at 67 FR 8452 (Feb. 22, 2002), and DOE's guidelines were published at 67 FR 62446 (Oct. 7, 2002). DOE has reviewed this final determination under the OMB and DOE guidelines and has concluded that it is consistent with applicable policies in those guidelines.

E.O. 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 22, 2001), requires Federal agencies to prepare and submit to OIRA at OMB, a Statement of Energy Effects for any proposed significant energy action. A “significant energy action” is defined as any action by an agency that promulgates or is expected to lead to promulgation of a final rule, and that: (1) Is a significant regulatory action under E.O. 12866, or any successor Executive Order; and (2) is likely to have a significant adverse effect on the supply, distribution, or use of energy, or (3) is designated by the Administrator of OIRA as a significant energy action. For any proposed significant energy action, the agency must give a detailed statement of any adverse effects on energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution and use.

This final determination, which does not amend the energy conservation standards for DHE, is not a significant regulatory action under E.O. 12866. Moreover, it will not have a significant adverse effect on the supply, distribution, or use of energy, nor has it been designated as a significant energy action by the Administrator at OIRA. Therefore, it is not a significant energy action, and accordingly, DOE has not prepared a Statement of Energy Effects.

On December 16, 2004, OMB, in consultation with the Office of Science and Technology Policy (OSTP), issued its Final Information Quality Bulletin for Peer Review (the Bulletin). 70 FR 2664 (Jan. 14, 2005). The Bulletin establishes that certain scientific information shall be peer reviewed by qualified specialists before it is disseminated by the Federal Government, including influential scientific information related to agency regulatory actions. The purpose of the bulletin is to enhance the quality and credibility of the Government's scientific information. Under the Bulletin, the energy conservation standards rulemaking analyses are “influential scientific information,” which the Bulletin defines as “scientific information the agency reasonably can determine will have, or does have, a clear and substantial impact on important public policies or private sector decisions.” Id. at 70 FR 2667.

In response to OMB's Bulletin, DOE conducted formal peer reviews of the energy conservation standards development process and the analyses that are typically used and has prepared a peer review report pertaining to the energy conservation standards rulemaking analyses. 28 Generation of this report involved a rigorous, formal, and documented evaluation using objective criteria and qualified and independent reviewers to make a judgment as to the technical/scientific/business merit, the actual or anticipated results, and the productivity and management effectiveness of programs and/or projects. DOE has determined that the peer-reviewed analytical process continues to reflect current practice, and the Department followed that process for considering amended energy conservation standards in the case of the present action.

The Secretary of Energy has approved publication of this final determination.

This document of the Department of Energy was signed on November 17, 2021, by Kelly J. Speakes-Backman, Principal Deputy Assistant Secretary for Energy Efficiency and Renewable Energy, pursuant to delegated authority from the Secretary of Energy. That document with the original signature and date is maintained by DOE. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DOE Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of the Department of Energy. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

In the NPR, the agencies generally incorporated the principal definition employed by NIST to define “computer-security incident” as an occurrence that:

• Results in actual or potential harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits; or

• Constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

Although commenters generally supported the agencies' use of a standard industry term rather than a new, and potentially inconsistent, term and definition, they suggested revisions to more closely tailor the definition to the purposes of the rule. For example, many commenters recommended that the definition focus on incidents that result in actual, rather than potential, harm to an information system. Commenters were concerned that the tracking and notification of incidents that could potentially harm a banking organization would create an undue regulatory burden, possibly result in over-notification, and overlook the fact that many potential incidents can be effectively remediated. In addition, various commenters recommended deleting the second prong of the proposed definition, reasoning that violations of internal policies and procedures would be unlikely ever to result in incidents significant enough to warrant prompt notification; however, some commenters supported keeping actual violations of applicable security policies. Commenters also suggested introducing materiality thresholds or excluding non-security related outages or incidents. One commenter objected to narrowing the definition to “actual” harm and supported broadening the definition to include incidents causing “serious,” but not necessarily “imminent,” harm. Another commenter stated that the standard for determining whether an incident rises to the level to trigger mandated notices should be based on its impact to banking organizations or the financial system and be agnostic as to cause. One commenter stated that the definition should expressly exclude scheduled outages. The same commenter suggested that the term computer-security incident be changed to encompass two types of outages and align more with the NIST definition of cybersecurity incident to provide greater uniformity and clarity about what constitutes an incident and a reportable incident. Another commenter also suggested substituting the term cybersecurity incident from NIST in lieu of computer-security incident. A commenter also suggested narrowing the term “incident” to exclude non-malicious data communications incidents or those occurring outside of the regulated entity's own network.

While the agencies continue to recognize that there is value in adopting an existing, standard definition, the agencies agree that the NIST definition does not wholly align with the purposes of the rule. The agencies have therefore narrowed the final rule's definition of “computer-security incident,” as suggested by the foregoing comments. Specifically, the final rule defines “computer-security incident” as an occurrence that results in actual harm to an information system or the information contained within it. 32 Furthermore, the agencies have removed the second prong of the proposed computer-security incident definition relating to violations of internal policies or procedures. These changes narrow the focus of the final rule to those incidents most likely to materially and adversely affect banking organizations, while still retaining general consistency with the NIST definition. 33

The NPR defined a “notification incident” as a computer-security incident that a banking organization believes in good faith could materially disrupt, degrade, or impair—

• The ability of the banking organization to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;

• Any business line of a banking organization, including associated operations, services, functions and support, and would result in a material loss of revenue, profit, or franchise value; or

• Those operations of a banking organization, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

Commenters addressed several aspects of the proposed definition. First, multiple commenters observed that the term “could” in the phrase “could . . . disrupt, degrade, or impair” was imprecise and overbroad. Multiple commenters suggested substituting the phrase “could” with “reasonably likely to or will” materially disrupt certain business lines or operations or “has resulted in or will result in” material disruptions to certain business lines or operations in its place. Some commenters also suggested that “notification incident” should be narrowed even further to incidents that actually materially disrupt or degrade. 34

The agencies also received a number of comments on the NPR's “believes in good faith” language. Various commenters expressed support for the phrase, with at least one noting that the more subjective “good faith” standard gave some flexibility to an organization that might honestly, albeit mistakenly, conclude that an occurrence did not rise to the level of a notification incident and thereby fail to provide notice. 35 Other commenters suggested that “believe in good faith” was too subjective and stated that the final rule should substitute a clearer term, such as “determined.”  36 And one commenter suggested that the agencies change the “in good faith” belief notification standard to apply to critical, not significant, incidents.

In addition, commenters suggested that the final rule should specifically exclude from the notification requirement incidents where the impact is limited to certain types of computer systems ( e.g., compromises to a bank's marketing or personnel systems) or otherwise provide specific exclusions ( e.g., any incident lasting less than 48 hours), because they would be very unlikely to cause the kinds of harm that the agencies would regard as warranting notification. Another commenter suggested that the agencies include a requirement that a notification incident involve an information system operated by, or on behalf of, a banking organization, because it would be unduly burdensome and potentially unrealistic for covered entities to be responsible for systems operated by third parties, whereas another commenter believed the term “notification incident” should be revised to include incidents occurring at third-party service provider information systems and the sub-contractors (fourth-party providers) of those third-party service providers that collect banking-related information. One commenter recommended that the agencies use the same definition of notification incident for bank service providers and banking organizations, whereas another commenter stated that only “notification incidents” should be reported under the rule to ensure that high volumes of less significant or easily remediated occurrences and incidents that do not result in actual harm are not reported. In addition, one commenter stated that banking organizations should not be required to publicly disclose core business lines and critical operations to avoid inviting attacks. Another commenter supported the definition and suggested that the definition of notification incident be expanded to include events that involve infiltration of third-party systems that collect banking related information, such as password managers or browsers. Another commenter requested that the agencies clarify that voluntary reporting of incidents falling outside of the scope of the definition is permitted, and that the rule also distinguish between mandatory reporting of notification incidents and nondisruptive events that could be reported through an alternative, voluntary mechanism and timeline.

Following analysis and careful consideration of the various comments, the agencies are finalizing the definition largely as proposed, with modifications to address a number of commenters' concerns to clarify the rule and make it easier to administer.

The definition of “notification incident” includes language that is consistent with the “core business line” and “critical operation” definitions included in the Resolution Planning Rule issued by the Board and FDIC under section 165(d) of the Dodd-Frank Act. 37 In particular, the second prong of the notification incident definition identifies incidents that impact core business lines, and the third prong identifies incidents that impact critical operations. Banking organizations subject to the Resolution Planning Rule may use the “core business lines” and “critical operations” identified in their resolution plans  38 to identify notification incidents under the second and third prongs of the final rule.

The final rule does not require banking organizations that are not subject to the Resolution Planning Rule to identify “core business lines” or “critical operations,” or to develop procedures to determine whether they engage in any operations, the failure or discontinuance of which would pose a threat to the financial stability of the United States. However, all banking organizations must have a sufficient understanding of their lines of business to be able to determine which business lines would, upon failure, result in a material loss of revenue, profit, or franchise value to the banking organization, so that they can meet their notification obligations.

Commenters also requested that the agencies clarify that the material loss of revenue, profit, or franchise value addressed by the second prong of the definition should be evaluated on an enterprise-wide basis. The agencies agree; a banking organization should evaluate whether the loss is material to the organization as a whole.

The agencies have concluded that there is substantial benefit to receiving notification of both computer-security incidents that have materially disrupted or degraded, and incidents that are reasonably likely to materially disrupt or degrade, a banking organization. Accordingly, the agencies are not narrowing the definition of “notification incident” to only include computer-security incidents that have resulted in a material disruption or degradation in the final rule.

However, the agencies are narrowing the scope of covered computer-security incidents by substituting the phrase “reasonably likely to” in place of “could.” The agencies agree that the term “could” encompasses more, and more speculative, incidents than the agencies intended in promulgating the rule. Accordingly, and in keeping with commenters' suggestions, the agencies have substituted the term “reasonably likely to” in place of “could.” Under the “reasonably likely” standard, a banking organization will be required to notify its primary Federal regulator when it has suffered a computer-security incident that has a reasonable likelihood of materially disrupting or degrading the banking organization or its operations, but at the same time would not be required to make such a notification for adverse outcomes that are merely possible, or within imagination. The “reasonably likely” standard for notification is clearer and more in line with the agencies' intentions for the rule. Finally, the agencies believe that banking organizations are well-positioned to assess the likelihood that a computer-security incident will result in the significant adverse effects described in the definition.

Some commenters also observed that the term “impair” was redundant of “disrupt” and “degrade;” that it was not a term defined by NIST; and that it should be removed. The agencies agree the term would be redundant with “disrupt or degrade,” and have removed the term “impair” from the definition.

After considering the comments carefully, the agencies are replacing the “good faith belief” standard with a banking organization's determination. The agencies agree with commenters who criticized the proposed “believes in good faith” standard as too subjective and imprecise. Accordingly, the agencies have removed the good faith language from the definition of “notification incident” and have substituted a determination standard in the final notification requirement.

Finally, the agencies decline to exclude particular incidents or incidents that impact certain types of computer systems from the notification requirements. The agencies believe that the focus on the material adverse effects of a computer-security incident is a simpler and clearer way to ensure that they receive notification of the most significant computer-security incidents.

The NPR included a non-exhaustive list of incidents that would be considered notification incidents under the proposed rule and the agencies invited comment on specific examples of computer-security incidents that should or should not constitute notification incidents. The agencies received a few general comments about the list of incidents.

One commenter suggested that the agencies include additional details in the illustrative examples that would identify the type of information systems that would not require incident notification and another suggested more broadly that the final rule include illustrative examples of both incidents that would and would not be subject to the final rule. The agencies believe that the criteria set forth in the notification incident definition make clear that the focus of the rule is on incidents that materially and adversely impact a banking organization rather than on specific types of information systems. The agencies recognize that many banking organizations manage computer-security incidents every day that would not require notification under the final rule and have focused on illustrative examples of the type of incidents that would require notification.

One commenter suggested that the example discussing a ransom malware attack that encrypts a banking organization's core system is “duplicative of various federal and state breach notification laws.” The agencies continue to conclude that any incident of ransom malware that disrupts a banking organization's ability to carry out banking operations meets the definition of a notification incident, and as such, have retained this example, notwithstanding any potential overlap between the final rule and other Federal and state requirements for incident reporting. 39

Another commenter suggested that some of the examples provided were “inconsistent with” the term computer-security incident, as incidents such as failed system upgrades or unrecoverable system failures are not technically computer-security incidents. The agencies disagree with this comment and believe that the commenter is reading the definition of computer-security incident too narrowly to focus on malicious incidents.

The agencies believe the examples in the proposed rule provide an appropriate perspective on the critical nature of the type of incidents that banking organizations should consider notification incidents. Having received only general comments and no specific new examples of notification incidents that should be included in the list, the agencies are retaining the illustrative examples provided in the NPR with some minor edits. 40

The following is a non-exhaustive list of incidents that generally are considered “notification incidents” under the final rule:

1. Large-scale distributed denial of service attacks that disrupt customer account access for an extended period of time ( e.g., more than 4 hours);

2. A bank service provider that is used by a banking organization for its core banking platform to operate business applications is experiencing widespread system outages and recovery time is undeterminable;

3. A failed system upgrade or change that results in widespread user outages for customers and banking organization employees;

4. An unrecoverable system failure that results in activation of a banking organization's business continuity or disaster recovery plan;

5. A computer hacking incident that disables banking operations for an extended period of time;

6. Malware on a banking organization's network that poses an imminent threat to the banking organization's core business lines or critical operations or that requires the banking organization to disengage any compromised products or information systems that support the banking organization's core business lines or critical operations from internet-based network connections; and

7. A ransom malware attack that encrypts a core banking system or backup data.

While the agencies have included these illustrative examples to help clarify the scope of notification incidents, the final rule requires banking organizations to consider, on a case-by-case basis, whether any significant computer-security incidents they experience constitute notification incidents for purposes of notifying the appropriate agency. If a banking organization is in doubt as to whether it is experiencing a notification incident for purposes of notifying its primary Federal regulator, the agencies encourage it to contact its regulator. The agencies recognize that a banking organization may file a notification, from time to time, upon a mistaken determination that a notification incident has occurred, and the agencies generally do not expect to take supervisory action in such situations.

The proposed rule would have required banking organizations to provide the mandated notification to the agencies as soon as possible and no later than 36 hours. The agencies asked whether this timeframe should be modified, and if so, how.

One commenter suggested that the agencies eliminate the “as soon as possible” requirement and simply require notification within 36 hours, which would eliminate an apparent tension between the permission for an organization to take a reasonable amount of time to determine that it has experienced a notification incident and the requirement for immediate reporting. Some commenters supported the 36-hour timeframe as an appropriate balance between the potential burden on institutions and the agencies' need for prompt information. 41 However, other commenters expressed concerns, viewing the 36-hour timeframe as too short to allow a banking organization to fully understand a computer-security incident and to provide a complete assessment of the situation. Commenters noted that the 36-hour timeframe is only workable when it commences after a banking organization determines that a notification incident has occurred. In this regard, two commenters requested that the agencies expressly articulate in the final rule the explanation included in the NPR that the 36-hour timeframe commences at the point when a banking organization has determined that a notification incident has occurred.Several commenters suggested that the agencies consider a 72-hour window to provide banking organizations with additional time to assess potential incidents and to align the proposed rule with other regulatory requirements such as the New York State Department of Financial Services' (NYDFS) cybersecurity event notification requirement, 42 or the European Union's General Data Protection Regulation (GDPR), 43 both of which require covered entities to report relevant cyber-related incidents within 72 hours. 44 A few commenters suggested that the notification timeframe should be increased to 48 hours, with one suggesting that any timeline align with business day processing, and another observing that community banks “need the additional 12 hours to evaluate the situation and implement an appropriate incident response plan.” One commenter suggested that the notification timeframe be extended to a minimum of five business days for banks under $20 billion in assets in order to “provide banks adequate time to work with vendors and their core processors to provide accurate notifications.” Another commenter observed that, “for a 36-hour notification timeframe to be potentially workable and achievable, it is imperative that the scope of the notification requirement be tailored.”

The agencies continue to believe that 36 hours is the appropriate timeframe, given the simplicity of the notification requirement and the severity of incidents captured by the definition of “notification incident.”  45 In developing the NPR and final rule, the agencies reviewed a number of existing security incident reporting requirements cited by the commenters and found that many of them involved detailed, prescriptive reporting requirements, often mandating that specific information be reported and including filing instructions. For example, the NYDFS rule requires that covered entities submit an annual statement certifying their compliance with the rule and keep all documents supporting their certification for five years, among other things. In contrast, the final rule sets forth no specific content or format for the simple notification it requires. The final rule is designed to ensure that the appropriate agency receives timely notice of significant emergent incidents, while providing flexibility to the banking organization to determine the content of the notification. Such a limited notification requirement will alert the agencies to such incidents without unduly burdening banking organizations with detailed reporting requirements, especially when certain information may not yet be known to the banking organizations.

In addition, changes to the definitions of “computer-security incident” and “notification incident” described above narrow the range, and reduce the speculative or uncertain nature of, incidents subject to the notification requirement.

The narrowed scope of notification incidents, however, makes it even more important for the agencies to receive notice as soon as possible. Additionally, the agencies recognize that a banking organization may be working expeditiously to resolve the notification incident—either directly or through a bank service provider—at the time it would be expected to notify its primary Federal regulator. The agencies believe, however, that 36 hours is a reasonable amount of time after a banking organization has determined that a notification incident has occurred to notify its primary Federal regulator, as it does not require an assessment or analysis.

The agencies do not expect that a banking organization would typically be able to determine that a notification incident has occurred immediately upon becoming aware of a computer-security incident. Rather, the agencies anticipate that a banking organization would take a reasonable amount of time to determine that it has experienced a notification incident. For example, some notification incidents may occur outside of normal business hours. Only once the banking organization has made such a determination would the 36-hour timeframe begin.

Accordingly, the agencies have determined that the final rule will retain the requirement that banking organizations provide notice as soon as possible and no later than 36 hours. The agencies note, however, that even within the 36-hour notification window, banking organizations' notification practices should take into account their criticality to the sector in which they operate and provide services. An effective practice of banking organizations that provide sector-critical services is to provide same-day notification to their primary Federal regulator of a notification incident. The agencies encourage this practice to continue among these banking organizations.

The proposed rule would have required a banking organization to notify the appropriate agency of a notification incident through any form of written or oral communication, including through any technological means, to a designated point of contact identified by the agency.

The agencies requested comments on how banking organizations should provide notifications to the agencies and sought comment on whether they should “adopt a process of joint notification” where multiple banking organization affiliates have differing notification obligations. Further, the agencies requested feedback on how such a joint notification should be done and why.

A substantial number of commenters responded to various aspects of these questions. While specific suggestions varied, a consistent theme was a desire for efficient and flexible options for providing notice, with some commenters observing that a notification incident could also affect normal communication channels. Other commenters made recommendations to enhance notification efficiency, such as suggesting the use of automated electronic notifications. Two commenters suggested that, consistent with the agencies' statement in the NPR, the rule should explicitly state that no specific information is required and that the rule does not prescribe any particular reporting form.

The agencies have concluded that email and telephone are the best methods currently available for effective notification. Recognizing, however, that agency processes may evolve and technology will likely change (and improve) available communication options over time, the agencies have also built flexibility into the final rule by stating that the agencies may prescribe other similar methods pursuant to which notice may be provided. The agencies believe that this approach balances the need for banking organizations to have some flexibility, including if a communication channel is impacted by the incident, with the agencies' need to ensure that they actually receive the notifications.

The agencies also sought comments on whether centralized points of contact, regional offices, or banking organization-specific supervisory teams would be better suited to receive these notifications. The comments from banking organizations and bank service providers differed on this issue.

Some banking organizations suggested that the process should remain “flexible” and that the rule provide that the notification requirement could be “satisfied by any of several methods,” including providing the notification to the banking organization's on-site or supervisory teams, appropriate regional offices, or an agency-designated point of contact. Other commenters, including bank service providers, suggested creating a joint notification process, or centralized portal or point of contact for all agencies to receive all such notifications directly. The agencies believe that the provision of notice can often be efficiently and effectively achieved by communicating with the appropriate agency supervisory office or other designated agency contacts, which may include designated supervisory staff, call centers, incident response teams, and other contacts to be designated by the respective agency.

The agencies also received several comments requesting further instruction and guidance on the method and manner of the required notifications. Several other commenters requested additional guidance on what a notice must contain and the scope of information that should be provided, and even requested certain specific exclusions.

The notification requirement is intended to serve as an early alert to a banking organization's primary Federal regulator about a notification incident. The agencies anticipate that banking organizations will share general information about what is known at the time of the incident. No specific information is required in the notification other than that a notification incident has occurred. The final rule does not prescribe any form or template. A simple notice can be provided to the appropriate agency supervisory office, or other designated point of contact, through email, telephone, or other similar method that the agency may prescribe. The notifications, and any information related to the incident, would be subject to the agencies' confidentiality rules. 46

Accordingly, the agencies revised the NPR language. The final rule provides that a banking organization would notify the appropriate agency-designated point of contact through email, telephone, or other similar methods that the agency may prescribe.

Commenters generally supported the idea of only notifying affected customers although some commenters suggested that all banking organization customers should be notified. 47 One commenter specifically suggested that bank service provider notifications should only go to banking organizations that are “directly impacted by the incident when a bank service provider has made a determination that the incident will or is reasonably likely to materially impact the services provided to the banking organization.” The agencies agree with the “materiality” aspect of this comment and the focus on “reasonably likely” impacts. Accordingly, the agencies are revising the final rule to include the phrase “materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade.” This change is also responsive to comments that requested the agencies further harmonize the bank service provider notification requirement with the banking organization notification requirement.

The final rule does not require a bank service provider to assess whether the incident rises to the level of a notification incident for a banking organization customer, which remains the responsibility of the banking organization. The agencies anticipate that bank service providers would make a best effort to share general information about what is known at the time. If, after receiving notice from a bank service provider, the banking organization determines that a notification incident has occurred, the banking organization is required to notify its primary Federal regulator in accordance with this final rule. The agencies generally will not cite a banking organization because a bank service provider fails to comply with its notification requirement.

Another commenter described the potential for confusion that could ensue if a bank service provider were to notify all customers, when only some of them were affected by the computer-security incident. They advised that such an overly broad notification to all customers could “cause the banking organization customers and the bank service provider to respond to questions and concerns from banking organization customers [who were] not affected by the computer-security incident.” The agencies agree with these commenters and are retaining in the final rule the requirement that notice be provided only to “each affected banking organization customer.”

Another commenter noted that the final rule needs to account for the distinction between cloud-based services versus on-premises services and a shared-responsibility service delivery model. Under the final rule, the agencies would require bank service providers to continue to provide a banking organization customer with prompt notification of material incidents regardless of current contract language and irrespective of the chosen service delivery model. Even under a shared service model, a bank service provider will still need to provide notice to banking organization customers if the bank service provider has determined it has experienced a computer-security incident that has materially disrupted or degraded, or is likely to materially disrupt or degrade, covered services provided to such banking organization customer for four or more hours. Given the purposes of the rule, the agencies believe this is a reasonable requirement and are adopting it in the final rule.

Whether the covered services are being provided through a software-as-a- service (SaaS) arrangement, or through some other service delivery method, a bank service provider must provide notification to banking organizations in accordance with the standard in the final rule. The banking organization must then independently determine if a notification incident has occurred.

Finally, in response to concerns expressed by commenters, the agencies are revising the final rule to specifically exclude scheduled maintenance, testing, or software updates previously communicated to a banking organization customer. This new exception should reduce over- and unnecessary notification. If, however, the scheduled maintenance, testing, or software update exceeds the parameters communicated to the banking organization customer and meets the notification standard set forth in the rule, this exception does not apply.

Several commenters favored immediate notifications. Others were concerned that immediate notifications may result in over- and inaccurate notification. For example, some commenters objected to the requirement that a bank service provider must “immediately” notify affected banking organizations  48 and recommended that the notification occur “as soon as practicable,” within the first four hours of the occurrence of a computer-security incident, or in a “timely” manner (or a similar standard) after a service disruption to prevent over-reporting and provide time for bank service providers to assess the severity of an incident. 49 One commenter noted that an immediate notification standard may be appropriate but only after the bank service provider determines that a notification incident has occurred, while other commenters stated that immediate notification was appropriate. Another commenter expressed concern that immediate notice may leave no time lapse “between when a computer-security incident occurred and when notification has to happen.” While expressing similar sentiments, some commenters suggested substituting the term “timely,” or “promptly” and “without undue delay,” in place of the “immediate” requirement. Another commenter suggested that different reporting obligations should be permitted contingent upon the location of the incident (on-premise services vs. cloud services). The same commenter suggested modifying the “good faith” standard to instead require “prompt” notification where a bank service provider obtains actual knowledge of an incident that impacts services for more than four hours.

Other commenters drew distinctions between security incidents and service disruptions. One commenter observed that “[u]nlike a `computer-security incident' which requires time to identify and evaluate, a disruption in service is instantaneously apparent and bank service providers can immediately notify banking organizations of the disruption in service.” For similar reasons, another commenter suggested bifurcation of service provider notifications: “one immediate notice timeline if the incident affects the security of the banking organization's systems and a second, longer time period for disruption.”

In response to these comments, the agencies are revising the rule to provide that a bank service provider must notify affected banking organization customers “as soon as possible” when it “determines” it has experienced an incident that meets the standard in the rule. Use of the term “determined” allows the bank service provider time to examine the nature of the incident and assess the materiality of the disruption or degradation of covered services. Additionally, the “four or more hours” threshold should reduce notifications concerning less material incidents. Once the bank service provider has made this determination, it must provide notice “as soon as possible.”

Some commenters recommended revising the proposed rule to “allow for service providers to satisfy their notification requirement by providing notification to their banking customer consistent with any requirements and by any methods set forth in their contract with that customer, so long as the method reasonably ensures that the banking organization receives the notification.” While the agencies believe it is reasonable to assume that providing notification to customers following a determination that a material incident has occurred should be consistent with many existing contractual provisions, the agencies conclude that an independent regulatory requirement is appropriate to ensure that banking organizations receive consistent and timely notification of the most significant computer-security incidents affecting covered services.

Other comments suggested that a 36- or 72-hour notification timeframe would be reasonable. For the reasons expressed above, the agencies disagree that bank service providers could (or should) wait this long to alert banking organization customers about a material disruption or degradation in covered services. Accordingly, the final rule requires bank service providers to provide notice as soon as possible when the bank service provider has determined it has experienced a notification incident.

Some commenters stated that the requirement in the proposal to notify two individuals at each affected banking organization of an incident was appropriate. One commenter suggested that a third notification be sent to a banking organization's general email or telephone number. Several commenters recommended the agencies allow the notification through general channels accessible by multiple employees at affected banking organizations, and one commenter suggested that “significant” bank service providers should directly notify the agencies. Other commenters asserted that requiring bank service providers to notify two contacts at each banking organization customer would be overly prescriptive and burdensome. 50 Instead, these commenters recommended that bank service providers should work with their banking organizations to designate a central point of contact, but bank service providers should not be required to ensure that a contact at the banking organization receive the notification. 51

Regarding existing provisions in contracts, a commenter contended that “contractual provisions with bank service providers commonly provide specific notice methods and generally provide notice to two or more banking organization employees.” This is consistent with the agencies' understandings of existing agreements based on their broad-based review of bank service provider agreements, which was reflected in the language of the proposed rule.

As an alternative to the approach in the proposed rule, a few commenters suggested that the rule should “instead focus on outcomes—ensuring that the appropriate individuals or entities at banking organizations receive timely notice.” Another commenter suggested that “banking organizations should have a central point of contact that would be accessible by more than one person to ensure that notifications to the banking organization are timely received and acted upon.” This approach was echoed by another banking industry commenter, who suggested that “notification through a medium or channel that is accessed by and available to multiple banking organization employees” should be allowed to meet the NPR's notification requirement. Some commenters suggested using automated notifications or centralized notification portals to streamline the notification process.

After consideration of the comments, the agencies are revising the final rule to keep the notification process simple and flexible. Rather than requiring bank service providers to notify two individuals at each affected banking organization customer, which may not be effective for every banking organization or bank service provider, the final rule requires bank service providers to notify “at least one bank-designated point of contact at each affected banking organization customer.” The final rule states that a banking organization-designated point of contact is an email, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer.

The agencies determined effective notice will be best achieved if banking organizations and bank service providers work collaboratively to designate a method of communication that is feasible for both parties and reasonably designed to ensure that banking organizations actually receive the notice in a timely manner. The final rule also provides flexibility for banking organizations and bank service providers to determine the appropriate designated point of contact, and if a banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer (CEO) and Chief Information Officer (CIO) of the banking organization customer, or two individuals of comparable responsibilities, through any reasonable means.

Several commenters observed that contracts between banking organizations and bank service providers routinely include incident notification provisions. 52 But other commenters noted that current contractual provisions may not align with the proposed rule's notification requirements and, as such, would need to be amended or revised, which may take time to complete.

Commenters generally stated that while contracts between banking organizations and bank service providers already have negotiated notice provisions, such contracts would need to be amended to ensure compliance with the rule. In that regard, commenters expressed the view that the proposed rule should be revised to allow for bank service providers to satisfy their notification requirement by providing notification to their banking organization customer consistent with any requirements and by any methods set forth in their contract with that customer, so long as the method reasonably ensures that the banking organization customer receives the notification. Facilitating compliance with the rule in this manner would prevent banking organizations from having to incur the costs to amend existing contracts. Other commenters expressed perceived challenges with renegotiating contracts to comply with the rule and commenters stated that they should not be faulted for a bank service provider's failure to notify. One commenter expressed concern that community banks may hold little power in these negotiations and recommended extending the compliance date of the rule for community banks. Relatedly, a commenter argued that if FMUs are required to provide mandated notices to their banking organization customers, the rule should require banking organization customers to identify and update their contacts for mandated notices to their bank service providers, rather than placing the burden on bank service providers to request and seek updates to these contacts. Commenters also urged the agencies to accept the notification methods specified in these contracts and clarify contract expectations. A few commenters requested that the agencies provide specific contract expectations and to consider conducting a review of contracts to confirm the notice provisions were adequate.

The agencies believe many contracts already address such notices to banking organizations. Typically, existing bank service provider agreements that support operations that are critical to a banking organization customer require notification to the customer as soon as possible in the event of a material incident during the normal course of business. If such notification provisions satisfy the requirements of the final rule, then notification under the contractual provisions will satisfy a bank service provider's obligation under the rule as well. The agencies note that existing notification procedures may include some redundancy with the final rule. However, the agencies are requiring notice in the final rule to ensure that a notification occurs in the event of a material computer-security incident. As a result, the agencies are not incorporating these recommendations. The agencies also note that the notification requirement created by this rule is independent of any contractual provisions, and therefore, bank service providers must comply even where their contractual obligations differ from the notification requirement in this rule. The agencies anticipate that banking organizations and bank service providers will work collaboratively to designate a method of communication that is feasible for both parties and reasonably designed to ensure that banking organizations actually receive the notice in a timely manner, for purposes of complying with the rule.

This final rule is not expected to add significant burden on bank service providers. The agencies' experiences with conducting bank service provider contract reviews during examinations indicate that many of these contracts include incident-reporting provisions. The agencies also observe that there are effective automated systems for notification currently.

In addition, for banking organizations that have not already designated individuals to be notified under contractual obligations, the agencies do not believe that requiring bank service providers to notify banking organization CEOs and CIOs would create significant burden. In these circumstances, the agencies believe that bank service providers can easily obtain contact information for banking organization CEOs and CIOs.

In the NPR, the agencies sought feedback on a number of related topics, which are addressed separately in the sections that follow.

The agencies requested comments about the potential burden the rule would impose on small bank service providers and about circumstances when a banking organization customer would not be aware of a material disruption in services unless they were notified. There were limited comments on this question.

A few commenters noted that banking organizations are often contacted by their customers shortly after an incident and service outage occurs. Despite indirect knowledge or suspicions about potential service outages or limitations, banking organizations should still be notified of material incidents by their bank service providers.

Merely identifying the fact of an outage or service interruption would not help banking organization customers understand the extent of such an outage or service interruption. Receiving notification from a bank service provider would enable a banking organization customer to evaluate the impact of the computer-security incident on its operations to determine whether it is experiencing a notification incident. If a banking organization is experiencing a notification incident and notifies its primary Federal regulator, the regulator then may evaluate and assist, as appropriate.

The agencies invited comment on the methodology used to estimate the number of notification incidents that may be subject to the proposed rule each year. Several commenters provided general comments suggesting the agencies may have underestimated the burden associated with the proposed rule; however, only one trade association commenter provided specific observations on the methodology used to estimate the number of incidents subject to the rule. This commenter suggested that the agencies should “seek additional comments on the estimated costs and benefits of the proposed rule.”

The agencies also received comments related to the costs associated with complying with the rule. A commenter asserted, without further detail, that the proposed costs of compliance were underestimated. This commenter suggested that the agencies gather more information and data to adequately assess the regulatory impact of the proposal. Regarding estimating the number of notification incidents per year that would be reported under the proposed rule, one commenter suggested the agencies already have this information. Another commenter asserted that the rule would result in significant costs in standing up internal processes and procedures to comply with a new Federal regulatory mandate, resulting in ongoing cost and burden.

The agencies have addressed the costs of this rule in the Impact Analysis section below. Moreover, the methodology used to determine the number of incidents subject to the rule reflects the agencies' experience that computer-security incidents that rise to the level of notification incidents are rare. The agencies also believe that the final rule largely formalizes a process that already exists, reflecting the collaborative and open communication that exists between banking organizations and the agencies.

As discussed in more detail in the Impact Analysis section, the agencies reviewed available supervisory data and a subset of Suspicious Activity Report (SAR) data involving cyber incidents targeting banking organizations to develop an estimate of the number of notification incidents that may occur annually. The agencies specifically recognized that an analysis of SAR filings would not capture the full scope of incidents addressed by this rule. However, the agencies also considered supervisory data, which includes the voluntary notification banking organizations already provide, to inform their estimate of the frequency of notification incidents. Based on this assessment, the agencies continue to believe that the estimated 150 notification incidents annually set forth in the Impact Analysis is reasonable. The agencies are not seeking additional comments on the estimated costs and benefits of the rule.

One commenter suggested the agencies should acknowledge the importance of voluntary information sharing within an “expanding notice schema,” and rely upon voluntary disclosures for non-disruptive events. Another suggested the rule should “distinguish between existing, voluntary information-sharing between banking organizations” and the final rule's required incident notification disclosures.

The focus and purpose of this final rule is to ensure that the agencies receive prompt notice of notification incidents, which we have defined to include only the most significant incidents affecting banking organizations. The final rule does not solicit notifications on non-disruptive events and differs from and does not prevent traditional supervisory information sharing. However, the agencies agree that voluntary information sharing is critically important and encourage banking organizations and bank service providers to continue sharing information about incidents not covered by this rule.

One commenter suggested incorporating “existing terms and definitions of discrete, rare, disruptive events” such as “Prompt Corrective Action (PCA) capital category definitions, or the invocation of Sheltered Harbor protocols.”  53 The agencies decline to follow this recommendation. The agencies have used definitions in the final rule that are broadly consistent with NIST terminology, which is widely used across various industry segments.

The agencies received several comments regarding the agencies' collection and use of notification incident information from banking organizations. One commenter urged the agencies to develop procedures, subject to notice and comment, that would be taken upon receipt of a banking organization's incident notification information and any subsequently gathered information related to the incident. Commenters also urged the agencies to clarify information sharing practices and protocols relating to notification incident reports, expressing concerns with confidentiality and data security. One commenter suggested that notification incident reports should be shared with banking organization-specific supervisory teams. Commenters stated that any information submitted should be subject to the agencies' confidentiality rules and that the agencies should explain how the information would be protected.

One commenter suggested the agencies establish a “mechanism to rescind” notifications in situations where “initial determinations overestimate[d] the severity or significance of an event.” No formal rescission mechanism is required. The agencies recognize that a banking organization or bank service provider may provide notice, from time to time, upon a mistaken determination that such notice is necessary. A banking organization or bank service provider may update its original notification if it later determines that its initial assessments were incorrect or overcautious.

Other commenters discussed the need to obtain or retain copies of the notifications for recordkeeping purposes. The rule does not impose any recordkeeping requirements.

Another commenter suggested the agencies should indicate how information that the agencies obtain under this rule would remain protected and confidential. Additionally, they requested confirmation that the information provided would be considered exempt from Freedom of Information Act (FOIA) requests. As the agencies noted in the proposal, the notification, and any information provided by a banking organization related to the incident, would be subject to the agencies' confidentiality rules, which provide protections for confidential, proprietary, examination/supervisory, and sensitive personally identifiable information. 54 However, the agencies must respond to individual FOIA requests on a case-by-case basis.

One commenter suggested the agencies implement only a “single definition for a notification incident that applies to both bank service providers and banking organizations.” The agencies believe that this would be unworkable; the two notification requirements serve different purposes. Accordingly, the agencies declined to implement a single definition. However, the agencies have sought to harmonize the two notification standards where feasible.

The final rule provides that affiliated banking organizations each have separate and independent notification obligations. Each banking organization needs to make an assessment of whether it has suffered a notification incident about which it must notify its primary Federal regulator. Subsidiaries of banking organizations that are not themselves banking organizations do not have notification requirements under this final rule. If a computer-security incident were to occur at a non-banking organization subsidiary of a banking organization, the parent banking organization would need to assess whether the incident was a notification incident for it, and if so, it would be required to notify its primary Federal regulator.

Some commenters suggested the agencies underestimated the impact of the NPR to bank service providers. As noted in the NPR, the agencies do not know the precise number of bank service providers that will be affected by the final rule's notification requirement. However, the agencies conservatively assumed the entire population of bank service providers who have self-selected the North American Industry Classification System (NAICS) industry “Computer System Design and Related Services” (NAICS industry code 5415) as their primary business activity to be the estimated number of bank service providers. It seems unlikely that all such code 5415-designated firms are bank service providers. Even though there may be some bank service providers that do not self-identify under NAICS code 5415, the agencies believe the number of incidents involving bank service providers will be generally consistent with original NPR findings. The agencies acknowledge that these bank service providers will be impacted by the final rule.

Covered banking organizations under the final rule include all depository institutions, holding companies, and certain other financial entities that are supervised by one or more of the agencies. According to recent Call Report and other data, the agencies supervise approximately 5,000 depository institutions along with a number of holding companies and other financial services entities that are covered under the final rule. 55

In addition, the final rule requires bank service providers to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours. This requirement would enable a banking organization to promptly respond to an incident, determine whether it must notify its primary Federal regulator that a notification incident has occurred, and take other appropriate measures related to the incident.

The agencies believe that prompt notification of reportable incidents is likely to provide the following benefits to banking organizations and the financial industry as a whole. Notification may help the relevant agencies determine whether the incident is isolated or is one of many similar incidents at multiple banking organizations. If the notification incident is isolated to a single banking organization, the primary Federal regulator may be able to facilitate requests for assistance on behalf of the affected organization to minimize the impact of the incident. This benefit may be greater for small banking organizations with more limited resources. If the notification incident is one of many similar incidents occurring at multiple banking organizations, the agencies could also alert other banking organizations of the threat, recommend measures to better manage or prevent the recurrence of similar incidents, or otherwise help coordinate incident response.

The prompt notification about incidents could also enable Federal regulators to respond faster to potential liquidity events that may result from such incidents. If a notification incident prevents banking organizations from fulfilling financial obligations in a timely manner, it might reduce confidence in the banking organization and precipitate the rapid withdrawal of demand deposits or short-term financing from such organizations. 56 57 The agencies believe that a faster regulatory response could mitigate, or entirely prevent, these adverse liquidity events, thereby enhancing the resilience of the banking system against notification incidents.

Receiving information on notification incidents at multiple banking organizations would also enable regulators to conduct empirical analyses to improve related guidance, adjust supervisory programs to enhance resilience against such incidents, and provide information to the industry to help banking organizations reduce the risk of future computer-security incidents.

The agencies do not have sufficient information available to quantify the potential benefits of the final rule because the benefits depend on the probability, breadth, and severity of future notification incidents, and the specifics of those incidents, among other things. These data limitations notwithstanding, and considering that banking organizations face a heightened risk of disruptive and destructive attacks, which have been increasing in frequency and severity in recent years, the agencies expect that the final rule would have clear prudential benefits.

The final rule requires banking organizations to notify their primary Federal regulator as soon as possible, and no later than 36 hours, after a banking organization has determined that a notification incident has occurred. The agencies reviewed available supervisory data and SARs involving cyber events against banking organizations in 2019 and 2020 to estimate the number of notification incidents expected to be reported annually. This calculation relied on descriptive criteria ( e.g., ransomware, trojan, zero day, etc.) that may be indicative of the type of material computer-security incident that would meet the notification incident reporting criteria. Based on this review, the agencies estimate that approximately 150 notification incidents occurred annually, 58 but acknowledge that the number of such incidents could increase in the future. Comments received by the agencies on the NPR did not provide more accurate estimates or suggest a different estimation methodology. Therefore, the agencies continue to use the same methodology.

The agencies believe that the regulatory burden associated with the notification requirement would be small because the majority of communications associated with the determination of the notification incident would occur regardless of the final rule. 59 In particular, the agencies estimate that, in the event of a notification incident, an affected banking organization may incur up to three hours of labor cost to coordinate internal communications, consult with its bank service provider, if appropriate, and notify the banking organization's primary Federal regulator. This process may include discussion of the incident among staff of the banking organization, such as the Chief Information Officer, Chief Information Security Officer, a senior legal or compliance officer; and staff of a bank service provider, as appropriate; and liaison with senior management of the banking organization.

The final rule also requires a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours. The agencies do not have data on the exact number of affected bank service providers nor the frequency of incidents that would require bank service providers to notify their banking organization customers. However, as described in the NPR, the agencies believe that, in the event of an incident, the affected bank service provider may incur up to three hours of labor cost to coordinate internal communications and notify its affected banking organization customers. Commenters did not provide other estimates, and the agencies believe that the additional compliance costs would be small for individual affected bank service providers. 60 Post-notification activities, such as providing technical support to affected bank organization customers when managing and resolving the impact of a computer-security incident, are beyond the scope of the notification requirement.

Overall, the agencies expect the benefits of the final rule to outweigh its small costs.

The agencies received comments asserting that some banking organizations and bank service providers may need to revise their contracts in order to implement the final rule. Furthermore, some bank service providers may incur costs to adjust internal processes and procedures to comply with the final rule. The agencies believe that these costs are likely to be small, transitory, and affect only a small number of covered entities.

Other comments received in response to the proposed rule suggested that the proposed rule's definitions might result in more notifications than estimated in the proposed rule. The final rule narrows the notification requirements, as discussed above.

The agencies are adopting these computer-security incident notification requirements after considering comments received on the NPR and evaluating alternative options for notification requirements. The agencies considered a number of alternative approaches, including leaving the current regulations unchanged and establishing a voluntary notification framework as suggested by one commenter. The agencies concluded that these approaches would not have achieved the objectives of the rule. However, the agencies refined the criteria for notification to focus attention on the most significant incidents and appropriately minimize regulatory burden.

Additionally, the agencies considered defining the notification requirement for bank service providers even more narrowly, as suggested by some commenters. However, the agencies ultimately determined that the notification requirement in this rule is appropriate due to the increasingly significant role that bank service providers play in the banking industry.

The agencies have provided an effective date of April 1, 2022, and a compliance date of May 1, 2022, in response to commenters that recommended that the agencies provide additional time to implement the rule.

Certain provisions of the final rule contain “collections of information” within the meaning of the Paperwork Reduction Act (PRA) of 1995 (44 U.S.C. 3501-3521). In accordance with the requirements of the PRA, the agencies may not conduct or sponsor, and the respondent is not required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The agencies have requested and OMB has assigned to the agencies the respective control numbers shown. The information collections contained in the final rule have been submitted to OMB for review and approval by the OCC and FDIC under section 3507(d) of the PRA (44 U.S.C. 3507(d)) and section 1320.11 of OMB's implementing regulations (5 CFR part 1320). The Board reviewed the final rule under the authority delegated to the Board by OMB, and has approved these collections of information.

The final rule contains a reporting requirement that is subject to the PRA. The reporting requirement is found in §§ 53.3 (OCC), 225.302 (Board), and 304.23 (FDIC) of the final rule. A banking organization is required to notify its primary Federal bank regulatory agency of the occurrence of a “notification incident” at the banking organization (§§ 53.3 (OCC), 225.302 (Board), and 304.23 (FDIC)).

The final rule also contains a disclosure requirement that is subject to the PRA. The disclosure requirement is found in §§ 53.4 (OCC), 225.303 (Board), and 304.24 (FDIC), which requires a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours.

The agencies received one PRA-related comment, which agreed that collections of information have practical utility.

The agencies have a continuing interest in the public's opinions of information collections. At any time, commenters may submit comments regarding the burden estimate, or any other aspect of this collection of information, including suggestions for reducing the burden, to the addresses listed in the ADDRESSES caption in the NPR. All comments will become a matter of public record. A copy of the comments may also be submitted to the OMB desk officer for the agencies: By mail to U.S. Office of Management and Budget, 725 17th Street NW, #10235, Washington, DC 20503; by facsimile to (202) 395-5806; or by email to: oira_submission@omb.eop.gov, Attention, Federal Banking Agency Desk Officer.

Title of Information Collection: Computer-Security Incident Notification.

OMB Control Number: OCC 1557-0350; Board 7100-NEW; FDIC 3064-0214.

Frequency of Response: On occasion; event-generated. 61

Affected Public: Businesses or other for-profit.

Respondents:

OCC: National banks, Federal savings associations, Federal branches and agencies, and bank service providers.

Board: All state member banks (as defined in 12 CFR 208.2(g)), bank holding companies (as defined in 12 U.S.C. 1841), savings and loan holding companies (as defined in 12 U.S.C. 1467a), foreign banking organizations (as defined in 12 CFR 211.21(o)), foreign banks that do not operate an insured branch, state branch or state agency of a foreign bank (as defined in 12 U.S.C. 3101(b)(11) and (12)), Edge or agreement corporations (as defined in 12 CFR 211.1(c)(2) and (3)), and bank service providers.

FDIC: All insured state nonmember banks, insured state-licensed branches of foreign banks, insured State savings associations, and bank service providers.

Number of Respondents:   62

OCC: Reporting—22; Disclosure—802.

FDIC: Reporting—96; Disclosure—802.

Board: Reporting—32; Disclosure—802.

Estimated Hours per Response:

Reporting—Sections 53.3 (OCC), 225.302 (Board), and 304.23 (FDIC): 3 hours.

Disclosure—Sections 53.4 (OCC), 225.303 (Board), and 304.24 (FDIC): 3 hours.

Estimated Total Annual Burden:

OCC: Reporting—66 hours; Disclosure—2,406 hours.

FDIC: Reporting—288 hours; Disclosure—2,406 hours.

Board: Reporting—96 hours; Disclosure—2,406 hours.

Abstract: The final rule establishes notification requirements for banking organizations upon the occurrence of a “computer-security incident” that rises to the level of a “notification incident.”

A “notification incident” is defined as a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's—

• Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;

• Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or

• Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

A “computer-security incident” is defined as is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.

The final rule requires a banking organization to notify its primary Federal banking regulator upon the occurrence of a “notification incident” at the banking organization. The agencies recognize that the final rule imposes a limited amount of burden, beyond what is usual and customary, on banking organizations in the event of a computer-security incident even if it does not rise to the level of a notification incident, as banking organizations will need to determine whether the relevant thresholds for notification are met. Therefore, the agencies' estimated burden per notification incident takes into account the burden associated with such incidents.

The final rule also requires a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours.

OCC: The Regulatory Flexibility Act (RFA), 5 U.S.C. 601 et seq., requires an agency, in connection with a final rule, to prepare a Final Regulatory Flexibility Analysis describing the impact of the rule on small entities (defined by the Small Business Administration (SBA)) for purposes of the RFA to include commercial banks and savings institutions with total assets of $600 million or less and trust companies with total assets of $41.5 million or less) or to certify that the final rule will not have a significant economic impact on a substantial number of small entities. The OCC currently supervises approximately 669 small entities.

Because the final rule impacts all OCC-supervised institutions, as well as all bank service providers, it will impact a substantial number of small entities. However, the expected costs of the final rule will be de minimis. Many banks already have internal policies for responding to security incidents, which include processes for notifying their primary regulator and other stakeholders of incidents within the scope of the final rule. Additionally, while the OCC believes bank service provider contracts may already include these provisions, if current contracts do not include these provisions, then the OCC does not expect the implementation of these provisions to impose a material burden on bank service providers. Therefore, the OCC certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

Board: The Regulatory Flexibility Act (RFA) generally requires an agency, in connection with a final rule, to prepare and make available for public comment a final regulatory flexibility analysis that describes the impact of the rule on small entities. 63 However, a regulatory flexibility analysis is not required if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. For the reasons described below, the Board certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

As discussed in the SUPPLEMENTARY INFORMATION section, the agencies are requiring a banking organization to notify its primary Federal regulator as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. The final rule will establish a notification requirement, which would support the safety and soundness of entities supervised by the agencies. The final rule requires a bank service provider, as defined in the rule, to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours.

The Board's rule applies to state-chartered banks that are members of the Federal Reserve System, bank holding companies, savings and loan holding companies, U.S. operations of foreign banking organizations, and Edge and agreement corporations (collectively, “Board-regulated entities”). As described in the Impact Analysis section, requirements under the final rule will apply to all Board-regulated entities. Under regulations issued by the SBA, a small entity includes a depository institution, bank holding company, or savings and loan holding company with total assets of $600 million or less and trust companies with total receipts of $41.5 million or less. 64 According to Call Reports and other Board reports, there were approximately 451 state member banks, 2,380 bank holding companies, 92 savings and loan holding companies, and 16 Edge and agreement corporations that are small entities. 65 In addition, the final rule affects all bank service providers that provide services subject to the BSCA. 66 The Board is unable to estimate the number of bank service providers that are small due to the varying types of banking organizations that may enter into outsourcing arrangements with bank service providers.

The final rule will require all banking organizations to notify the appropriate Board-designated point of contact about a notification incident through email, telephone, or other similar methods that the Board may prescribe. The Board must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. The agencies estimate that, upon occurrence of a notification incident, an affected banking organization may incur compliance costs of up to three hours of staff time to coordinate internal communications, consult with its bank service provider, if appropriate, and notify the banking organization's primary Federal regulator. As described in the Impact Analysis section above, this requirement is estimated to affect a relatively small number of Board-regulated entities. The agencies believe that any compliance costs associated with the notice requirement would be de minimis, because the communications that led to the determination of the notification incident would have occurred regardless of the final rule.

The final rule will also require a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours. As described in the Impact Analysis section above, the agencies believe that any compliance costs associated with the implementation of this requirement would be de minimis for each affected bank service provider. There are no other recordkeeping, reporting, or compliance requirements associated with the final rule.

For the reasons stated above, the Board certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

FDIC: The RFA generally requires an agency, in connection with a final rule, to prepare and make available for public comment a final regulatory flexibility analysis that describes the impact of the rule on small entities. 67 However, a regulatory flexibility analysis is not required if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. The SBA has defined “small entities” to include banking organizations with total assets of less than or equal to $600 million. 68 Generally, the FDIC considers a significant effect to be a quantified effect in excess of 5 percent of total annual salaries and benefits per institution, or 2.5 percent of total noninterest expenses. The FDIC believes that effects in excess of these thresholds typically represent significant effects for FDIC-supervised institutions. For the reasons described below, the FDIC certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

As described in the Impact Analysis section, the final rule is expected to affect all institutions supervised by the FDIC. According to recent Call Reports, the FDIC supervises 3,215 insured depository institutions (FDIC-supervised IDIs). 69 Of these, 2,333 FDIC-supervised IDIs would be considered small entities for the purposes of RFA. 70 These small entities hold approximately $510 billion in assets, accounting for 13 percent of total assets held by FDIC-supervised institutions. In addition, the final rule affects all bank service providers that provide services subject to the BSCA. 71 The FDIC is unable to estimate the number of affected bank service providers that are small. For purposes of this certification, the FDIC assumes, as an upper limit, that all affected bank service providers are small.

The final rule requires a banking organization to notify the appropriate FDIC supervisory office, or an FDIC-designated point of contact, about a notification incident through email, telephone, or other similar methods that the FDIC may prescribe. The FDIC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. As described in the Impact Analysis section above, this requirement is estimated to affect a relatively small number of FDIC-supervised institutions and impose a compliance cost of up to three hours per incident. The agencies believe that the regulatory burden of such a requirement would be de minimis in nature, since the internal communications that led to the determination of the notification incident would have occurred regardless of the final rule. 72

In addition, the final rule will require a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours. As described in the Impact Analysis section above, the agencies believe that any additional compliance costs would be de minimis for each affected bank service provider.

Therefore, the FDIC certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

Under section 302(a) of the Riegle Community Development and Regulatory Improvement Act (RCDRIA), 73 in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions (IDIs), each Federal banking agency must consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. In addition, section 302(b) of RCDRIA requires new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on IDIs generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form. 74 The agencies have determined that the final rule would impose additional reporting, disclosure, or other new requirements on IDIs, and are making this final rule effective in accordance with the requirements of the RCDRIA.

For purposes of the Congressional Review Act (CRA), the Office of Management and Budget (OMB) makes a determination as to whether a final rule constitutes a “major rule.”  75 If a rule is deemed a “major rule” by the OMB, the CRA generally provides that the rule may not take effect until at least 60 days following its publication. 76 The Congressional Review Act defines a “major rule” as any rule that the Administrator of the Office of Information and Regulatory Affairs of the OMB finds has resulted in or is likely to result in—(A) an annual effect on the economy of $100,000,000 or more; (B) a major increase in costs or prices for consumers, individual industries, Federal, State, or Local government agencies or geographic regions, or (C) significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based enterprises to compete with foreign-based enterprises in domestic and export markets. 77

The agencies will submit the final rule to the OMB for this major rule determination. As required by the Congressional Review Act, the agencies will also submit the final rule and other appropriate reports to Congress and the Government Accountability Office for review.

Section 722 of the Gramm-Leach-Bliley Act  78 requires the Federal banking agencies to use plain language in all proposed and final rulemakings published in the Federal Register after January 1, 2000. The agencies invited comment regarding the use of plain language, but did not receive any comments on this topic.

The OCC analyzed the final rule under the factors set forth in the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1532). Under this analysis, the OCC considered whether the final rule includes a Federal mandate that may result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year, adjusted for inflation (currently $158 million). As noted in the OCC's RFA discussion, the OCC expects that the costs associated with the final rule, if any, will be de minimis and, thus, has determined that this final rule will not result in expenditures by State, local, and Tribal governments, or the private sector, of $158 million or more in any one year. Accordingly, the OCC has not prepared a written statement to accompany this final rule.

For the reasons stated in the Common Preamble and under the authority of 12 U.S.C. 1, 93a, 161, 481, 1463, 1464, 1861-1867, and 3102, the Office of the Comptroller of the Currency amends chapter I of title 12, Code of Federal Regulations, as follows:

For the reasons stated in the Common Preamble and under the authority of 12 U.S.C. 321-338a, 1467a(g), 1818(b), 1844(b), 1861-1867, and 3101 et seq., the Board amends chapter II of title 12, Code of Federal Regulations, as follows:

For the reasons stated in the Common Preamble, and under the authority of 12 U.S.C. 1463, 1811, 1813, 1817, 1819, and 1861-1867, the FDIC amends 12 CFR part 304 as follows:

In consideration of the foregoing, the Federal Aviation Administration amends 14 CFR part 71 as follows: