[Federal Register Volume 84, Number 26 (Thursday, February 7, 2019)]
[Notices]
[Pages 2558-2564]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-01378]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

[Docket No. DHS-2018-0068]


Chemical Security Assessment Tool (CSAT)

AGENCY: Infrastructure Security Division (ISD), Cybersecurity and 
Infrastructure Security Agency (CISA), Department of Homeland Security 
(DHS).

ACTION: 60-Day notice and request for comments; Revision of Information 
Collection.

-----------------------------------------------------------------------

SUMMARY: DHS CISA ISD will submit the following Information Collection 
Request (ICR) to the Office of Management and Budget (OMB) for review 
and clearance in accordance with the Paperwork Reduction Act of 1995. 
This notice solicits comments on the information collection during a 
60-day public comment period prior to the submission of this ICR to 
OMB. The submission proposes to renew the information collection for an 
additional three years and update the burden estimates associated with 
collecting information in the Chemical Security Assessment Tool (CSAT) 
for the Chemical Facility Anti-Terrorism Standards (CFATS).

DATES: Comments are encouraged and will be accepted until April 8, 
2019.

ADDRESSES: You may send comments, identified by docket number through 
the Federal eRulemaking Portal: http://www.regulations.gov. Follow the 
instructions for sending comments.
    Instructions: All submissions received must include the agency name 
``CISA'' and docket number DHS-2018-0068. All comments received will be 
posted without change to http://www.regulations.gov, including any 
personal information provided.
    Comments that include trade secrets, confidential commercial or 
financial information, Chemical-terrorism

[[Page 2559]]

Vulnerability Information (CVI),\1\ Sensitive Security Information 
(SSI),\2\ or Protected Critical Infrastructure Information (PCII) \3\ 
should not be submitted to the public docket. Comments containing trade 
secrets, confidential commercial or financial information, CVI, SSI, or 
PCII should be appropriately marked and packaged in accordance with 
applicable requirements and submitted by mail to the DHS/CISA/
Infrastructure Security Division, CFATS Program Manager at CISA, 245 
Murray Lane SW, Mail Stop 0610, Arlington, VA 20528-0610. Comments must 
be identified by docket number DHS-2018-0068.
---------------------------------------------------------------------------

    \1\ For more information about CVI see 6 CFR 27.400 and the CVI 
Procedural Manual at www.dhs.gov/publication/safeguarding-cvi-manual.
    \2\ For more information about SSI see 49 CFR part 1520 and the 
SSI Program web page at www.tsa.gov/for-industry/sensitive-security-information.
    \3\ For more information about PCII see 6 CFR part 29 and the 
PCII Program web page at www.dhs.gov/pcii-program.

FOR FURTHER INFORMATION CONTACT: For specific questions related to 
collection activities, please contact Craig Conklin, 703-235-5263, 
_____________________________________-
[email protected].

SUPPLEMENTARY INFORMATION: The CFATS Program identifies and regulates 
the security of high-risk chemical facilities using a risk-based 
approach. Congress initially authorized the CFATS Program under Section 
550 of the Department of Homeland Security Appropriations Act of 2007, 
Public Law 109-295 (2006) and reauthorized it under the Protecting and 
Securing Chemical Facilities from Terrorist Attacks Act of 2014, as 
amended.\4\ The Department implemented the CFATS Program through 
rulemaking and issued an Interim Final Rule (IFR) on April 9, 2007 and 
a final rule on November 20, 2007. See 72 FR 17688 and 72 FR 65396.
---------------------------------------------------------------------------

    \4\ The CFATS Act of 2014 codified the CFATS program into the 
Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended 
by H.R. 251, 116th Cong. (2019) (enacted).
---------------------------------------------------------------------------

    CISA \5\ collects the core regulatory data necessary to implement 
CFATS through the Chemical Security Assessment Tool (CSAT) covered 
under this collection. For more information about CFATS and CSAT, 
please visit www.dhs.gov/chemicalsecurity. This information collection 
(OMB Control No. 1670-0007) will expire on July 31, 2019.\6\
---------------------------------------------------------------------------

    \5\ Pursuant to the Cybersecurity and Infrastructure Security 
Agency Act of 2018, the National Protection and Program Directorate 
(NPPD) was re-designated as CISA. See 6 U.S.C. 652.
    \6\ The currently approved version of this information 
collection (OMB Control No. 1670-0007) can be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.
---------------------------------------------------------------------------

    In an effort to reduce burden, the most recently approved version 
of this information collection proposed a significantly revised version 
of the Top-Screen instrument and other instruments in this package 
(``CSAT 2.0'').\7\ CISA began implementing CSAT 2.0 in October 2016 and 
concluded this effort in September 2018. As part of the implementation, 
the Department required all chemical facilities of interest that had 
chemical holdings at or above the screening threshold quantities on 
Appendix A of the CFATS regulation to complete the Top-Screen, even if 
the facility had previously completed a Top-Screen and been determined 
not to be high-risk. The Top-Screen submissions were then analyzed by 
the Department using an enhanced methodology designed to more 
accurately and appropriately tier high-risk chemical facilities. After 
completing this process, certain chemical facilities received a new or 
revised tier and were required to submit a new or revised Security 
Vulnerability Assessment (SVA) and Site Security Plan (SSP).
---------------------------------------------------------------------------

    \7\ The previous 60-Day notice and request for comments to 
revise Information Collection 1670-0007 was published in the Federal 
Register on November 18, 2015 at 80 FR 72086 and may be viewed at 
https://www.federalregister.gov/d/2015-29457.
---------------------------------------------------------------------------

    Because the CSAT 2.0 implementation was a one-time requirement for 
all chemical facilities of interest, CISA believes using the most 
recent data on the number of respondents collected between FY17 and 
FY18 to estimate future burden requirements is generally inappropriate. 
In most cases, relying on this data would result in substantial over 
estimation of the burden for the instruments in this collection. 
However, in some cases CISA believes using the most recent data 
available accurately reflects the future burden for specific 
instruments. CISA indicates in this notice when it is using the data 
collected during the implementation of CSAT 2.0 for future burden 
estimates and when it is relying on other assumptions.
    Below, CISA estimates the burden to respondents for the: (1) Top-
Screen, (2) Security Vulnerability Assessment (SVA) and ASP submitted 
in lieu of an SVA, (3) SSP and ASP submitted in lieu of an SSP, (4) 
CFATS Help Desk, (5) CSAT User Registration, and (6) Identification of 
Facilities and Assets at Risk.\8\
---------------------------------------------------------------------------

    \8\ Throughout this analysis, CISA presents rounded hourly time 
burden estimates and hourly compensation rates to assist in 
reproducing the results. However, CISA's actual calculations use 
unrounded figures; consequently, some reproduced results may not 
exactly match the reported results.
---------------------------------------------------------------------------

1. CISA's Methodology in Estimating the Burden for the Top-Screen

Number of Respondents

    The current information collection estimated that 1,000 first-time 
respondents will submit a Top-Screen annually. For this ICR, CISA 
estimates the annual number of respondents will be 2,332, which is 
based on the average number of Top-Screen submissions prior to the 
implementation of CSAT 2.0 (i.e., between FY14 and FY16). CISA believes 
using the timeframe immediately prior to the implementation of CSAT 2.0 
is more representative of the anticipated number of respondents because 
the implementation of CSAT 2.0 temporarily resulted in an above-average 
number of Top-Screens during FY17 and FY18. The estimate of 2,332 is 
the sum of the average number of 759 first-time Top-Screen submissions 
and the average number of 1,573 Top-Screen resubmissions per year.
    In the current information collection, CISA accounted for 
resubmissions using a different methodology than described above.\9\ 
CISA is now counting each resubmission as a separate respondent and 
therefore, the average number of responses per respondent decreased 
from 1.5 to 1. CISA determined that this methodology would result in a 
more accurate annual burden because the time per respondent for a first 
time submission is different than for a resubmission.
---------------------------------------------------------------------------

    \9\ In the current information collection, CISA estimated that 
the average number of Top-Screens submissions was 1.5. This would 
imply that on average, 50 percent of respondents would submit two 
Top Screens per year, with all others submitting once.
---------------------------------------------------------------------------

Estimated Time per Respondent

    In the current information collection, the estimated time per 
respondent to prepare and submit a Top-Screen is 6 hours.\10\ In 
October 2016, CISA implemented CSAT 2.0, which reduced the amount of 
time a respondent needs to be logged into CSAT to complete and submit a 
Top-Screen.
---------------------------------------------------------------------------

    \10\ 6 hours is composed of 1.2 hours logged into CSAT and 4 
hours for every hour logged into CSAT (i.e., 6 hours = [1.2 hours 
logged into CSAT + (1.2 hours x 4) for preparation]).
---------------------------------------------------------------------------

    Using the data collected since the implementation of CSAT 2.0 
(i.e., between FY17 and FY19), CISA determined that on average 
respondents who submitted initial Top-Screens were logged into the Top-
Screen application for 0.50 hours (30 minutes) and the median duration 
respondents were logged in for resubmitted Top-Screens was 0.08 hours 
(5 minutes). CISA calculated the average amount of time

[[Page 2560]]

respondents were logged into the Top-Screen application weighted by the 
number of respondents that submitted first-time Top-Screens and Top-
Screen resubmissions between FY14 and FY16, which was 0.22 hours (13 
minutes) [ = (759 first-time submissions x 0.50 hours + 1,573 
resubmissions x 0.08 hours) / 2,332 total submissions].
    For this ICR, CISA maintains its assumption, based on previous 
public comments on this information collection, that for every hour a 
respondent is logged into the Top-Screen application, the respondent 
spends an average of 4 hours in preparation.\11\ Therefore, CISA's 
estimated time per respondent to submit a Top-Screen is 1.09 hours [ = 
0.22 hours logged into CSAT + (0.22 hours x 4) for preparation].
---------------------------------------------------------------------------

    \11\ CISA's adoption of the assumption that for every hour a 
respondent is logged into the Top-Screen application, SVA/ASP 
application, and SSP/ASP application, the respondent spends an 
average of 4 hours in preparation is described in the 30-day notice 
the Department published for this information collection in March 
2013 at 78 FR 16694, which may be viewed at https://www.federalregister.gov/d/2013-06095.
---------------------------------------------------------------------------

    CISA no longer accounts for the burden related to collecting 
supporting documentation for Top-Screens because this burden is already 
accounted for under a separate information collection.\12\
---------------------------------------------------------------------------

    \12\ Under Information Collection 1670-0014, CISA collects 
supporting documentation from facilities under the ``Request for 
Redetermination'' instrument. Additional information about 
Information Collection 1670-0014 may be found at https://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201704-1670-001.
---------------------------------------------------------------------------

Annual Burden Hours

    The annual burden hours for the Top-Screen is 2,553 hours [ = 2,332 
respondents x 1 response per respondent x 1.09 hours per response].

Total Annual Burden Cost

    The 2007 CFATS Regulatory Assessment \13\ assumes that Site 
Security Officers (SSOs) are responsible for submitting Top-Screens. 
For this ICR, CISA maintains this assumption.
---------------------------------------------------------------------------

    \13\ The 2007 Regulatory Assessment was published to docket DHS-
2006-0073 on April 1, 2007 and may be viewed at https://www.regulations.gov/document?D=DHS-2006-0073-0116.
---------------------------------------------------------------------------

    The SSO's average hourly compensation rate of $79.69 is based on an 
average hourly wage rate of $54.41 \14\ with a benefits multiplier of 
1.4647.\15\ Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 2,553 hours by the average hourly 
compensation rate of SSOs. The total annual burden cost for the Top-
Screen is $203,450 [ = 2,553 annual burden hours x $79.69 per hour].
---------------------------------------------------------------------------

    \14\ Bureau of Labor Statistics (BLS). Occupational Employment 
Statistics. May 2017. Managers, All Others (SOC 11-9199). https://www.bls.gov/oes/2017/may/oes119199.htm.
    \15\ BLS. Employer Costs for Employee Compensation--December 
2017. Table 1. Employer Costs per Hour Worked for Employee 
Compensation and Costs as a Percent of Total Compensation: Civilian 
Workers, by Major Occupational and Industry Group, December 2017. 
https://www.bls.gov/news.release/archives/ecec_03202018.pdf. The 
compensation factor (1.4647) is estimated by dividing total 
compensation ($35.87) by wages and salaries ($24.49).
---------------------------------------------------------------------------

Total Burden Cost (Capital/Startup)

    CISA provides access to CSAT free of charge and CISA assumes that 
each respondent already has access to the internet for basic business 
needs.
    The current information collection estimated a one-time capital/
startup cost would be incurred by 36,930 respondents required to submit 
a new Top-Screen following the implementation of CSAT 2.0. CISA 
proposes to remove this one-time cost from this ICR because CSAT 2.0 
has been fully implemented. Therefore, CISA estimates that no capital/
startup costs are associated with this instrument.

Total Recordkeeping Burden

    A respondent that has submitted a Top-Screen may or may not be 
determined by CISA to present a high level of security risk. Only 
respondents that present a high level of security risk are required to 
keep records mandated by CFATS.
    For respondents that are determined to present a high level of 
security risk, the Top-Screen recordkeeping burden is accounted for 
within the recordkeeping burden estimate for the ``Site Security Plan 
(SSP) and Alternative Security Program (ASP) submitted in lieu of an 
SSP'' instrument discussed later in this notice in subsection 3, 
hereafter, referred to as the ``SSP/ASP.'' The recordkeeping burden 
estimate for the SSP/ASP instrument accounts for all records 
respondents are required to maintain under CFATS because CISA assumes 
that respondents maintain their Top-Screen records in the same manners, 
formats, and locations as they maintain their other required records. 
Therefore, CISA estimates that no recordkeeping burden is associated 
with this instrument.

2. CISA's Methodology in Estimating the Burden for the Security 
Vulnerability Assessment (SVA) & Alternative Security Program (ASP) 
Submitted In Lieu of an SVA

Number of Respondents

    The current information collection estimated that each year 211 
respondents would complete an SVA or ASP in lieu of an SVA, hereafter, 
referred to as an ``SVA/ASP.'' For this ICR, CISA estimates that the 
annual number of respondents will be 1,683, which is based on the 
average number of SVA/ASP submission prior to the implementation of 
CSAT 2.0 (i.e., between FY14 and FY16). CISA believes using the 
timeframe immediately prior to the implementation of CSAT 2.0 is more 
representative of the anticipated number of respondents because the 
implementation of CSAT 2.0 temporarily resulted in an above-average 
number of SVAs/ASPs between FY17 and FY18. This consists of an average 
of 215 first-time SVA/ASPs and 1,468 resubmitted SVA/ASPs per year.
    In the current information collection, CISA accounted for 
resubmissions using a different methodology than described above.\16\ 
CISA is now counting each resubmission as a separate respondent and 
therefore, the average number of responses per respondent decreased 
from 1.5 to 1. CISA determined that this methodology would result in a 
more accurate annual burden because the time per respondent for a first 
time submission is different than for a resubmission.\17\
---------------------------------------------------------------------------

    \16\ In the current information collection, CISA estimated that 
the average number of SVA/ASP submissions was 1.5. This would imply 
that on average, 50 percent of respondents would submit two SVAs/
ASPs per year, with all others submitting once.
    \17\ Historically, CISA estimated the expected number of SVAs/
ASPs using an historical tiering determination rate that was derived 
by multiplying: (a) The estimated number of Top-Screens, by (2) the 
percentage of Top-Screens that resulted in a determination by CISA 
that an SVA/ASP must be submitted by a respondent (i.e., a covered 
chemical facility).
---------------------------------------------------------------------------

Estimated Time per Respondent

    The current information collection estimated the time per 
respondent for preparing and submitting an SVA/ASP to be 2.65 
hours.\18\ As mentioned previously in this notice CISA implemented CSAT 
2.0, which among other improvements projected a reduction of 90 percent 
in the amount

[[Page 2561]]

of time a respondent spends logged into the CSAT SVA/ASP application.
---------------------------------------------------------------------------

    \18\ 2.65 hours is composed of 10% of 5.3 hours logged into CSAT 
and 4 hours for every hour logged into CSAT (i.e., 2.65 hours = 
[(0.10 x 5.3 hours logged into CSAT) + (0.10 x 5.3 hours logged into 
CSAT x 4) for preparation]).
---------------------------------------------------------------------------

    Using the data collected since the implementation of CSAT 2.0 
(i.e., between FY17 and FY19), CISA determined that the median duration 
respondents were logged into the CSAT SVA/ASP application for an 
initial SVA/ASP and an SVA/ASP resubmission was 0.80 hours (48 minutes) 
and 0.17 hours (10 minutes), respectively. CISA calculated the average 
amount of time respondents were logged into the SVA/ASP application 
weighted by the number of respondents that submitted first-time SVAs/
ASPs and SVA/ASP resubmissions between FY14 and FY16, which was 0.25 
hours (15 minutes) [ = (215 first-time submissions x 0.80 hours + 1,468 
resubmissions x 0.17 hours) / 1,683 total submissions].
    For this ICR, CISA maintains its assumption, based on previous 
public comments on this information collection, that for every hour a 
respondent is logged into the SVA/ASP application, the respondent 
spends an average of 4 hours in preparation. Therefore, CISA's 
estimated time per respondent to prepare and submit an SVA/ASP is 1.24 
hours [ = 0.25 hours logged into CSAT + (0.25 hours x 4) for 
preparation].
    CISA no longer accounts for the burden related to collecting 
supporting documentation for SVAs/ASPs, because the standard business 
processes associated with the SVA/ASP instrument do not include the 
collection of additional documentation.

Annual Burden Hours

    The annual burden hours for an SVA/ASP is 2,083 hours [ = 1,683 
respondents x 1 response per respondent x 1.24 hours per response].

Total Annual Burden Cost

    The 2007 CFATS Regulatory Assessment assumes that SSOs will be 
responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this 
assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 2,083 hours by the average hourly 
compensation rate of SSOs. The total annual burden cost for the SVA/ASP 
is $166,028 [ = 2,083 annual burden hours x $79.69 per hour].

Total Burden Cost (Capital/Startup)

    CISA provides access to CSAT free of charge and CISA assumes that 
each respondent already has access to the internet for basic business 
needs. Therefore, CISA estimates that there are no capital/startup 
costs for this instrument.

Total Recordkeeping Burden

    For respondents that are determined by CISA to present a high level 
of security risk, the SVA/ASP recordkeeping burden is accounted for 
within the recordkeeping burden estimate for the SSP/ASP discussed 
below in Subsection 3 of this section. Therefore, CISA estimates that 
no recordkeeping burden is associated with this instrument.

3. CISA's Methodology in Estimating the Burden for the Site Security 
Plan (SSP) & Alternative Security Program (ASP) Submitted In Lieu of an 
SSP

Number of Respondents

    The current information collection estimated 211 SSP/ASP 
respondents. For this ICR, the Department maintains the assumption that 
all respondents to the SVA/ASP will be a respondent of the SSP/ASP. 
Therefore, CISA estimates that the annual number of respondents will be 
1,683, which is based on the average number of all respondents to the 
SVA/ASP. This number breaks down to, on average, 215 initial 
submissions and 1,468 resubmissions.

Estimated Time per Respondent

    The current information collection estimated the time per 
respondent for preparing and submitting an SSP/ASP to be 18.75 
hours.\19\ As mentioned previously in this notice CISA implemented CSAT 
2.0, which among other improvements projected a reduction of 70 percent 
in the amount of time a respondent spends logged into the CSAT SSP/ASP 
application. Using the data collected since the implementation of CSAT 
2.0 (i.e., between FY17 and FY19), CISA determined that the median 
duration respondents were logged into the SSP/ASP application for 
initial and resubmitted SSPs/ASPs was 2.10 hours (126 minutes) and 0.32 
hours (19 minutes), respectively. CISA calculated the average amount of 
time respondents were logged into the SSP/ASP application weighted by 
the number of respondents that submitted first-time SSPs/ASPs and SSP/
ASP resubmissions between FY14 and FY16, which was 0.54 hours (33 
minutes) [ = (215 first-time submissions x 2.10 hours + 1,468 
resubmissions x 0.32 hours) / 1,683 total submissions].
---------------------------------------------------------------------------

    \19\ 18.75 hours is composed of 30% of 12.5 hours logged into 
CSAT and 4 hours for every hour logged into CSAT (i.e., 18.75 hours 
= [(0.30 x 12.5 hours logged into CSAT) + (0.30 x 12.5 hours logged 
into CSAT x 4) for preparation]).
---------------------------------------------------------------------------

    For this ICR, CISA maintains its assumption, based on previous 
public comments on this information collection, that for every hour a 
respondent is logged into the SSP/ASP application, the respondent 
spends an average of 4 hours in preparation. Therefore, CISA's 
estimated time per respondent to prepare and submit an SSP/ASP is 2.72 
hours [ = 0.54 hours logged into CSAT + (0.54 hours x 4) for 
preparation].
    CISA no longer accounts for the burden related to collecting 
supporting documentation for SSPs/ASPs, because the standard business 
processes associated with the SSP/ASP instrument do not include the 
collection of additional documentation.

Annual Burden Hours

    The annual burden hours for SSPs/ASPs is 4,582 hours [ = 1,683 
respondents x 1 response per respondent x 2.72 hours per response].

Total Annual Burden Cost

    The 2007 CFATS Regulatory Assessment assumes that SSOs will be 
responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this 
assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 4,582 hours by the average hourly 
compensation rate of SSOs. The total annual burden cost for the SSPs/
ASPs is $365,141 [ = 4,582 annual burden hours x $79.69 per hour].

Total Burden Cost (Capital/Startup)

    CISA provides access to CSAT free of charge and CISA assumes that 
each respondent already has access to the internet for basic business 
needs. Therefore, CISA estimates that there are no capital/startup 
costs.

Total Recordkeeping Burden

    The current information collection estimated a recordkeeping burden 
of approximately $440,000. CISA maintained the methodology and 
assumptions described in the current information collection, but 
increased the current estimate to account for: (1) The increase in the 
number of initial SSP/ASP respondents from 211 to 215, (2) updating the 
hourly compensation rates to 2017 dollars, and (3) inflating the 
capital/startup costs by an inflation factor of 1.03.\20\ Therefore, 
CISA's

[[Page 2562]]

estimated recordkeeping burden will be $516,825.
---------------------------------------------------------------------------

    \20\ CISA inflated the capital/startup costs from the current 
information collection to 2017 dollars using an inflation factor of 
1.03. The inflation factor was calculated by dividing the Gross 
Domestic Product (GDP) implicit price deflator index from 2017 
(103.02) by the index from 2015 (100). (Federal Reserve Economic 
Data. GDP Implicit Price Deflator in United States, Index 2015=100, 
Annual, Not Seasonally Adjusted. https://fred.stlouisfed.org/series/GDPDEF).
---------------------------------------------------------------------------

    For this ICR, CISA maintains its approach of accounting for the 
entire recordkeeping burden imposed on covered chemical facilities 
under CFATS within the SSP/ASP instrument, because: (1) Only covered 
chemical facilities are required to maintain records; (2) no changes to 
the recordkeeping requirements have occurred since the approval of the 
current information collection; and (3) CISA's historical assumption 
that respondents maintain any other required records in the same 
manners, formats, and locations as they maintain their SSP/ASP records.

4. CISA'S Methodology in Estimating the Burden for the CFATS Help Desk

Number of Respondents

    The current information collection estimated that CISA receives 
15,000 requests annually for CFATS Help Desk support (i.e., 15,000 
respondents via phone calls, emails, and web-based help request forms). 
CISA has determined that maintaining the current estimate would be more 
accurate than relying on the number of requests for CFATS Help Desk 
support received between FY17 and FY18 because the implementation of 
CSAT 2.0 temporarily resulted in an above-average number of CFATS Help 
Desk requests.\21\ CISA evaluated historical data to determine if the 
estimated number of CFATS Help Desk requests (i.e., 15,000) was still 
appropriate. Between FY14 and FY16, the average annual number of CFATS 
Help Desk requests was 14,881. Therefore, CISA believes that the 
existing estimate of 15,000 respondents continues to be a reasonable 
estimate of future CFATS Help Desk requests.
---------------------------------------------------------------------------

    \21\ On average, between FY17 and FY19, there were 31,212 calls 
and emails per year (i.e., 22,369 calls and 8,843 emails per year) 
to the CFATS Helpdesk, most of which were in response to CSAT 2.0 
implementation.
---------------------------------------------------------------------------

Estimated Time per Respondent

    CISA evaluated historical data to determine if the estimated time 
per respondent of 0.17 hours (10 minutes) was still appropriate. Since 
the implementation of CSAT 2.0 (i.e., between FY17 and FY18) the 
average duration for a CFATS Help Desk call was 6 minutes and 48 
seconds, which represented a slight decrease in the actual duration 
reported by CISA in previous years. CISA does not have any information 
on the average amount of time it took respondents to type and send 
emails to the CFATS Help Desk.
    Therefore, CISA has maintained the estimated time per respondent of 
0.17 hours (10 minutes).

Annual Burden Hours

    The average annual burden hours for the CFATS Help Desk will be 
2,500 hours [ = 15,000 respondents x 0.17 hours per respondent].

Total Annual Burden Cost

    The 2007 CFATS Regulatory Assessment assumes that SSOs will be 
responsible for contacting the CFATS Help Desk. For this ICR, CISA 
maintains this assumption. Therefore, to estimate the total annual 
burden, CISA multiplied the annual burden of 2,500 hours by the average 
hourly compensation rate of SSOs. The total annual burden for the CFATS 
Help Desk is $199,233 [ = 2,500 annual burden hours x $79.69 per hour].

Total Burden Cost (Capital/Startup)

    Contacting the CFATS Help Desk is free and CISA assumes that each 
respondent already has a phone or access to the internet for basic 
business needs. Therefore, CISA estimates that there are no capital/
startup costs.

Total Recordkeeping Burden

    There is no recordkeeping burden for this instrument.

5. CISA'S Methodology in Estimating the Burden for the CSAT User 
Registration

Number of Respondents

    The current information collection estimated 1,000 respondents 
would complete the user registration process annually. For this ICR, 
CISA maintains this estimate.
    Historically, CISA's estimate in the current information collection 
was primarily based on the number of individuals expected to register 
as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of 
the CSAT User Registration instrument in the current information 
collection was intended to allow for the creation of additional CSAT 
user roles such as the Administrator and Personnel Surety (PS) 
Submitter user roles. Because the estimate has always been very 
conservative, for example, between FY14 and FY16 the average annual 
number of individuals registered was 604. Thus CISA believes that 
maintaining the current estimate of 1,000 respondents annually is a 
reasonable estimate that reflects the user registration activity for 
all types of CSAT users.

Estimated Time per Respondent

    In the current information collection, the estimated time per 
respondent is 2 hours. In this ICR, CISA increases the estimated time 
per respondent to 2.5 hours. The revised estimate is based on two 
factors: (1) Following the implementation of CSAT 2.0 (i.e., between 
FY16 and FY18), the actual time needed to complete the CSAT User 
Registration process was approximately 0.5 hours (30 minutes); and (2) 
CISA expects that CSAT Authorizers need additional time to manage the 
CSAT user accounts for which they are responsible.
    The ongoing management of the CSAT user accounts includes 
activities such as, but not limited to: (1) Assigning Submitters and 
Preparers to facilities; (2) updating the facilities with which a 
Submitter or Preparer is associated as his or her duties change; (3) 
creating groups \22\ to support the CFATS Personnel Surety (PS) 
Program; (4) assigning PS Submitters to groups; and (5) updating the PS 
Submitters' access to groups as their duties change. Furthermore, in 
response to comments submitted to CISA for information collection (OMB 
Control No. 1670-0029),\23\ CISA clarified that certain burdens were 
accounted for under this information collection (i.e., OMB Control No. 
1670-0007).\24\
---------------------------------------------------------------------------

    \22\ ``Groups'' is a technical term used by CISA to describe how 
a covered chemical facility may manage the access to records about 
affected individuals in the CSAT Personnel Surety application. CISA 
describes the term ``groups'' and provides additional information 
about how to create and manage groups in section 9.5 of the CSAT 
User Manual, which may be viewed at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.
    \23\ 1670-0029 was approved by OMB in August 2015. The approved 
information collection may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201312-1670-001.
    \24\ CISA's summary of the comments and its response to those 
comments are contained within the 30-day notice for the CFATS 
Personnel Surety Program at 83 FR 28249. The 30-day notice was 
published in the Federal Register on July 18, 2018 at 83 FR 28244 
and may be viewed at https://www.federalregister.gov/d/2018-12523.
---------------------------------------------------------------------------

    For this ICR, CISA is applying the assumption based on previous 
public comments on this information collection (i.e., OMB Control No. 
1670-0007) that for every hour a respondent is logged into the CSAT 
application, the respondent spends an average of 4 hours in preparation 
(e.g., coordinating with CFATS-facility stakeholders, including Human 
Resources, Procurement, or Contract Administration to explain the PS 
Program requirements and determine how best to gather the data from 
different populations). Therefore, CISA's estimated time per respondent 
is

[[Page 2563]]

2.5 hours [ = 0.50 hours logged into CSAT + (0.50 hours x 4) for 
preparation].

Annual Burden Hours

    The annual burden estimate for CSAT User Registration is 2,500 
hours [ = 1,000 respondents x 1 response per respondent x 2.5 hours per 
respondent].

Total Annual Burden Cost

    The 2007 CFATS Regulatory Assessment assumes that SSOs will be 
responsible for CSAT User Registration. For this ICR, CISA maintains 
this assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 2,500 hours by the average hourly 
compensation rate of SSOs. The total annual burden for CFATS User 
Registration is $199,233 [ = 2,500 annual burden hours x $79.69 per 
hour].

Total Burden Cost (Capital/Startup)

    The current information collection estimated that a one-time 
capital cost would be incurred by 24,630 respondents required to submit 
a CSAT User Registration as part of the CSAT 2.0 implementation. These 
capital costs were one-time costs and have been removed from this 
information collection.
    CISA provides access to CSAT free of charge and CISA assumes that 
each respondent already has access to the internet for basic business 
needs. Therefore, for this ICR CISA estimates that there are no 
capital/startup costs for this instrument.

Total Recordkeeping Burden

    There is no recordkeeping burden for this instrument.

6. CISA'S Methodology in Estimating the Burden for Identification of 
Additional Facilities and Assets at Risk

Number of Respondents

    The current information collection estimated that each year 211 
respondents would respond to this instrument. For this ICR, CISA 
estimates that the annual number of respondents will be 845, because 
CISA only requests this information from covered chemical facilities 
that undergo compliance inspections and ship chemicals of interest 
(COI). CISA completes approximately 1,920 compliance inspections per 
year. Of these, approximately 44 percent of the covered chemical 
facilities inspected ship COI. Therefore, CISA estimates 845 
respondents for this instrument [ = 1,920 facilities inspected x 44 
percent of facilities ship COI].

Estimated Time per Respondent

    In the current information collection, the estimated time per 
respondent is 0.17 hours (10 minutes). In this ICR, CISA maintains this 
estimate.

Annual Burden Hours

    The annual burden estimate is 140.83 hours [ = 845 respondents x 1 
response per respondent x 0.17 hours per respondent].

Total Annual Burden Cost

    CISA assumes that SSOs will be responsible for providing this 
information. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 140.83 hours by the average hourly 
compensation rate of SSOs. The total annual burden for the 
Identification of Additional Facilities and Assets at Risk is $11,223 [ 
= 140.83 annual burden hours x $79.69 per hour].

Total Burden Cost (Capital/Startup)

    In the current information collection, CISA estimated a one-time 
capital cost would be incurred by 3,000 respondents as a result of the 
CSAT 2.0 implementation. These capital costs were one-time costs for 
respondents and therefore have been removed from this information 
collection.

Total Recordkeeping Burden

    There is no recordkeeping burden for this instrument.

Public Participation

    OMB is particularly interested in comments that:
    1. Evaluate whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility;
    2. Evaluate the accuracy of the agency's estimate of the burden of 
the proposed collection of information, including the validity of the 
methodology and assumptions used;
    3. Enhance the quality, utility, and clarity of the information to 
be collected; and
    4. Minimize the burden of the collection of information on those 
who are to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques, 
or other forms of information technology (e.g., permitting electronic 
submissions of responses).

Analysis

Title of Collection: Chemical Security Assessment Tool
OMB Control Number: 1670-0007
Instrument: Top-Screen
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 2,332 respondents (estimate)
Estimated Time per Respondent: 1.09 hours
Total Annual Burden Hours: 2,553 hours
Total Annual Burden Cost: $203,450
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0

Instrument: Security Vulnerability Assessment and Alternative Security 
Program submitted in lieu of a Security Vulnerability Assessment
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,683 respondents (estimate)
Estimated Time per Respondent: 1.24 hours
Total Annual Burden Hours: 2,083 hours
Total Annual Burden Cost: $166,028
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0

Instrument: Site Security Plan and Alternative Security Program 
submitted in lieu of a Site Security Plan
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,683 respondents (estimate)
Estimated Time per Respondent: 2.72 hours
Total Annual Burden Hours: 4,582 hours
Total Annual Burden Cost: $365,141
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $516,825

Instrument: CFATS Help Desk
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 15,000 respondents (estimate)
Estimated Time per Respondent: 0.17 hours
Total Annual Burden Hours: 2,500 hours
Total Annual Burden Cost: $199,233
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0

Instrument: User Registration
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,000 respondents (estimate)

[[Page 2564]]

Estimated Time per Respondent: 2.5 hours
Total Annual Burden Hours: 2,500 hours
Total Annual Burden Cost: $199,233
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0

Instrument: Identification of Facilities and Assets at Risk
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 845 respondents (estimate)
Estimated Time per Respondent: 0.17 hours
Total Annual Burden Hours: 140.83 hours
Total Annual Burden Cost: $11,223
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0

Scott Libby,
Deputy Chief Information Officer.
[FR Doc. 2019-01378 Filed 2-6-19; 8:45 am]
 BILLING CODE 9110-9P-P