[Federal Register Volume 84, Number 26 (Thursday, February 7, 2019)]
[Notices]
[Pages 2558-2564]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-01378]
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
[Docket No. DHS-2018-0068]
Chemical Security Assessment Tool (CSAT)
AGENCY: Infrastructure Security Division (ISD), Cybersecurity and
Infrastructure Security Agency (CISA), Department of Homeland Security
(DHS).
ACTION: 60-Day notice and request for comments; Revision of Information
Collection.
-----------------------------------------------------------------------
SUMMARY: DHS CISA ISD will submit the following Information Collection
Request (ICR) to the Office of Management and Budget (OMB) for review
and clearance in accordance with the Paperwork Reduction Act of 1995.
This notice solicits comments on the information collection during a
60-day public comment period prior to the submission of this ICR to
OMB. The submission proposes to renew the information collection for an
additional three years and update the burden estimates associated with
collecting information in the Chemical Security Assessment Tool (CSAT)
for the Chemical Facility Anti-Terrorism Standards (CFATS).
DATES: Comments are encouraged and will be accepted until April 8,
2019.
ADDRESSES: You may send comments, identified by docket number through
the Federal eRulemaking Portal: http://www.regulations.gov. Follow the
instructions for sending comments.
Instructions: All submissions received must include the agency name
``CISA'' and docket number DHS-2018-0068. All comments received will be
posted without change to http://www.regulations.gov, including any
personal information provided.
Comments that include trade secrets, confidential commercial or
financial information, Chemical-terrorism
[[Page 2559]]
Vulnerability Information (CVI),\1\ Sensitive Security Information
(SSI),\2\ or Protected Critical Infrastructure Information (PCII) \3\
should not be submitted to the public docket. Comments containing trade
secrets, confidential commercial or financial information, CVI, SSI, or
PCII should be appropriately marked and packaged in accordance with
applicable requirements and submitted by mail to the DHS/CISA/
Infrastructure Security Division, CFATS Program Manager at CISA, 245
Murray Lane SW, Mail Stop 0610, Arlington, VA 20528-0610. Comments must
be identified by docket number DHS-2018-0068.
---------------------------------------------------------------------------
\1\ For more information about CVI see 6 CFR 27.400 and the CVI
Procedural Manual at www.dhs.gov/publication/safeguarding-cvi-manual.
\2\ For more information about SSI see 49 CFR part 1520 and the
SSI Program web page at www.tsa.gov/for-industry/sensitive-security-information.
\3\ For more information about PCII see 6 CFR part 29 and the
PCII Program web page at www.dhs.gov/pcii-program.
FOR FURTHER INFORMATION CONTACT: For specific questions related to
collection activities, please contact Craig Conklin, 703-235-5263,
_____________________________________-
[email protected].
SUPPLEMENTARY INFORMATION: The CFATS Program identifies and regulates
the security of high-risk chemical facilities using a risk-based
approach. Congress initially authorized the CFATS Program under Section
550 of the Department of Homeland Security Appropriations Act of 2007,
Public Law 109-295 (2006) and reauthorized it under the Protecting and
Securing Chemical Facilities from Terrorist Attacks Act of 2014, as
amended.\4\ The Department implemented the CFATS Program through
rulemaking and issued an Interim Final Rule (IFR) on April 9, 2007 and
a final rule on November 20, 2007. See 72 FR 17688 and 72 FR 65396.
---------------------------------------------------------------------------
\4\ The CFATS Act of 2014 codified the CFATS program into the
Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended
by H.R. 251, 116th Cong. (2019) (enacted).
---------------------------------------------------------------------------
CISA \5\ collects the core regulatory data necessary to implement
CFATS through the Chemical Security Assessment Tool (CSAT) covered
under this collection. For more information about CFATS and CSAT,
please visit www.dhs.gov/chemicalsecurity. This information collection
(OMB Control No. 1670-0007) will expire on July 31, 2019.\6\
---------------------------------------------------------------------------
\5\ Pursuant to the Cybersecurity and Infrastructure Security
Agency Act of 2018, the National Protection and Program Directorate
(NPPD) was re-designated as CISA. See 6 U.S.C. 652.
\6\ The currently approved version of this information
collection (OMB Control No. 1670-0007) can be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.
---------------------------------------------------------------------------
In an effort to reduce burden, the most recently approved version
of this information collection proposed a significantly revised version
of the Top-Screen instrument and other instruments in this package
(``CSAT 2.0'').\7\ CISA began implementing CSAT 2.0 in October 2016 and
concluded this effort in September 2018. As part of the implementation,
the Department required all chemical facilities of interest that had
chemical holdings at or above the screening threshold quantities on
Appendix A of the CFATS regulation to complete the Top-Screen, even if
the facility had previously completed a Top-Screen and been determined
not to be high-risk. The Top-Screen submissions were then analyzed by
the Department using an enhanced methodology designed to more
accurately and appropriately tier high-risk chemical facilities. After
completing this process, certain chemical facilities received a new or
revised tier and were required to submit a new or revised Security
Vulnerability Assessment (SVA) and Site Security Plan (SSP).
---------------------------------------------------------------------------
\7\ The previous 60-Day notice and request for comments to
revise Information Collection 1670-0007 was published in the Federal
Register on November 18, 2015 at 80 FR 72086 and may be viewed at
https://www.federalregister.gov/d/2015-29457.
---------------------------------------------------------------------------
Because the CSAT 2.0 implementation was a one-time requirement for
all chemical facilities of interest, CISA believes using the most
recent data on the number of respondents collected between FY17 and
FY18 to estimate future burden requirements is generally inappropriate.
In most cases, relying on this data would result in substantial over
estimation of the burden for the instruments in this collection.
However, in some cases CISA believes using the most recent data
available accurately reflects the future burden for specific
instruments. CISA indicates in this notice when it is using the data
collected during the implementation of CSAT 2.0 for future burden
estimates and when it is relying on other assumptions.
Below, CISA estimates the burden to respondents for the: (1) Top-
Screen, (2) Security Vulnerability Assessment (SVA) and ASP submitted
in lieu of an SVA, (3) SSP and ASP submitted in lieu of an SSP, (4)
CFATS Help Desk, (5) CSAT User Registration, and (6) Identification of
Facilities and Assets at Risk.\8\
---------------------------------------------------------------------------
\8\ Throughout this analysis, CISA presents rounded hourly time
burden estimates and hourly compensation rates to assist in
reproducing the results. However, CISA's actual calculations use
unrounded figures; consequently, some reproduced results may not
exactly match the reported results.
---------------------------------------------------------------------------
1. CISA's Methodology in Estimating the Burden for the Top-Screen
Number of Respondents
The current information collection estimated that 1,000 first-time
respondents will submit a Top-Screen annually. For this ICR, CISA
estimates the annual number of respondents will be 2,332, which is
based on the average number of Top-Screen submissions prior to the
implementation of CSAT 2.0 (i.e., between FY14 and FY16). CISA believes
using the timeframe immediately prior to the implementation of CSAT 2.0
is more representative of the anticipated number of respondents because
the implementation of CSAT 2.0 temporarily resulted in an above-average
number of Top-Screens during FY17 and FY18. The estimate of 2,332 is
the sum of the average number of 759 first-time Top-Screen submissions
and the average number of 1,573 Top-Screen resubmissions per year.
In the current information collection, CISA accounted for
resubmissions using a different methodology than described above.\9\
CISA is now counting each resubmission as a separate respondent and
therefore, the average number of responses per respondent decreased
from 1.5 to 1. CISA determined that this methodology would result in a
more accurate annual burden because the time per respondent for a first
time submission is different than for a resubmission.
---------------------------------------------------------------------------
\9\ In the current information collection, CISA estimated that
the average number of Top-Screens submissions was 1.5. This would
imply that on average, 50 percent of respondents would submit two
Top Screens per year, with all others submitting once.
---------------------------------------------------------------------------
Estimated Time per Respondent
In the current information collection, the estimated time per
respondent to prepare and submit a Top-Screen is 6 hours.\10\ In
October 2016, CISA implemented CSAT 2.0, which reduced the amount of
time a respondent needs to be logged into CSAT to complete and submit a
Top-Screen.
---------------------------------------------------------------------------
\10\ 6 hours is composed of 1.2 hours logged into CSAT and 4
hours for every hour logged into CSAT (i.e., 6 hours = [1.2 hours
logged into CSAT + (1.2 hours x 4) for preparation]).
---------------------------------------------------------------------------
Using the data collected since the implementation of CSAT 2.0
(i.e., between FY17 and FY19), CISA determined that on average
respondents who submitted initial Top-Screens were logged into the Top-
Screen application for 0.50 hours (30 minutes) and the median duration
respondents were logged in for resubmitted Top-Screens was 0.08 hours
(5 minutes). CISA calculated the average amount of time
[[Page 2560]]
respondents were logged into the Top-Screen application weighted by the
number of respondents that submitted first-time Top-Screens and Top-
Screen resubmissions between FY14 and FY16, which was 0.22 hours (13
minutes) [ = (759 first-time submissions x 0.50 hours + 1,573
resubmissions x 0.08 hours) / 2,332 total submissions].
For this ICR, CISA maintains its assumption, based on previous
public comments on this information collection, that for every hour a
respondent is logged into the Top-Screen application, the respondent
spends an average of 4 hours in preparation.\11\ Therefore, CISA's
estimated time per respondent to submit a Top-Screen is 1.09 hours [ =
0.22 hours logged into CSAT + (0.22 hours x 4) for preparation].
---------------------------------------------------------------------------
\11\ CISA's adoption of the assumption that for every hour a
respondent is logged into the Top-Screen application, SVA/ASP
application, and SSP/ASP application, the respondent spends an
average of 4 hours in preparation is described in the 30-day notice
the Department published for this information collection in March
2013 at 78 FR 16694, which may be viewed at https://www.federalregister.gov/d/2013-06095.
---------------------------------------------------------------------------
CISA no longer accounts for the burden related to collecting
supporting documentation for Top-Screens because this burden is already
accounted for under a separate information collection.\12\
---------------------------------------------------------------------------
\12\ Under Information Collection 1670-0014, CISA collects
supporting documentation from facilities under the ``Request for
Redetermination'' instrument. Additional information about
Information Collection 1670-0014 may be found at https://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201704-1670-001.
---------------------------------------------------------------------------
Annual Burden Hours
The annual burden hours for the Top-Screen is 2,553 hours [ = 2,332
respondents x 1 response per respondent x 1.09 hours per response].
Total Annual Burden Cost
The 2007 CFATS Regulatory Assessment \13\ assumes that Site
Security Officers (SSOs) are responsible for submitting Top-Screens.
For this ICR, CISA maintains this assumption.
---------------------------------------------------------------------------
\13\ The 2007 Regulatory Assessment was published to docket DHS-
2006-0073 on April 1, 2007 and may be viewed at https://www.regulations.gov/document?D=DHS-2006-0073-0116.
---------------------------------------------------------------------------
The SSO's average hourly compensation rate of $79.69 is based on an
average hourly wage rate of $54.41 \14\ with a benefits multiplier of
1.4647.\15\ Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 2,553 hours by the average hourly
compensation rate of SSOs. The total annual burden cost for the Top-
Screen is $203,450 [ = 2,553 annual burden hours x $79.69 per hour].
---------------------------------------------------------------------------
\14\ Bureau of Labor Statistics (BLS). Occupational Employment
Statistics. May 2017. Managers, All Others (SOC 11-9199). https://www.bls.gov/oes/2017/may/oes119199.htm.
\15\ BLS. Employer Costs for Employee Compensation--December
2017. Table 1. Employer Costs per Hour Worked for Employee
Compensation and Costs as a Percent of Total Compensation: Civilian
Workers, by Major Occupational and Industry Group, December 2017.
https://www.bls.gov/news.release/archives/ecec_03202018.pdf. The
compensation factor (1.4647) is estimated by dividing total
compensation ($35.87) by wages and salaries ($24.49).
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup)
CISA provides access to CSAT free of charge and CISA assumes that
each respondent already has access to the internet for basic business
needs.
The current information collection estimated a one-time capital/
startup cost would be incurred by 36,930 respondents required to submit
a new Top-Screen following the implementation of CSAT 2.0. CISA
proposes to remove this one-time cost from this ICR because CSAT 2.0
has been fully implemented. Therefore, CISA estimates that no capital/
startup costs are associated with this instrument.
Total Recordkeeping Burden
A respondent that has submitted a Top-Screen may or may not be
determined by CISA to present a high level of security risk. Only
respondents that present a high level of security risk are required to
keep records mandated by CFATS.
For respondents that are determined to present a high level of
security risk, the Top-Screen recordkeeping burden is accounted for
within the recordkeeping burden estimate for the ``Site Security Plan
(SSP) and Alternative Security Program (ASP) submitted in lieu of an
SSP'' instrument discussed later in this notice in subsection 3,
hereafter, referred to as the ``SSP/ASP.'' The recordkeeping burden
estimate for the SSP/ASP instrument accounts for all records
respondents are required to maintain under CFATS because CISA assumes
that respondents maintain their Top-Screen records in the same manners,
formats, and locations as they maintain their other required records.
Therefore, CISA estimates that no recordkeeping burden is associated
with this instrument.
2. CISA's Methodology in Estimating the Burden for the Security
Vulnerability Assessment (SVA) & Alternative Security Program (ASP)
Submitted In Lieu of an SVA
Number of Respondents
The current information collection estimated that each year 211
respondents would complete an SVA or ASP in lieu of an SVA, hereafter,
referred to as an ``SVA/ASP.'' For this ICR, CISA estimates that the
annual number of respondents will be 1,683, which is based on the
average number of SVA/ASP submission prior to the implementation of
CSAT 2.0 (i.e., between FY14 and FY16). CISA believes using the
timeframe immediately prior to the implementation of CSAT 2.0 is more
representative of the anticipated number of respondents because the
implementation of CSAT 2.0 temporarily resulted in an above-average
number of SVAs/ASPs between FY17 and FY18. This consists of an average
of 215 first-time SVA/ASPs and 1,468 resubmitted SVA/ASPs per year.
In the current information collection, CISA accounted for
resubmissions using a different methodology than described above.\16\
CISA is now counting each resubmission as a separate respondent and
therefore, the average number of responses per respondent decreased
from 1.5 to 1. CISA determined that this methodology would result in a
more accurate annual burden because the time per respondent for a first
time submission is different than for a resubmission.\17\
---------------------------------------------------------------------------
\16\ In the current information collection, CISA estimated that
the average number of SVA/ASP submissions was 1.5. This would imply
that on average, 50 percent of respondents would submit two SVAs/
ASPs per year, with all others submitting once.
\17\ Historically, CISA estimated the expected number of SVAs/
ASPs using an historical tiering determination rate that was derived
by multiplying: (a) The estimated number of Top-Screens, by (2) the
percentage of Top-Screens that resulted in a determination by CISA
that an SVA/ASP must be submitted by a respondent (i.e., a covered
chemical facility).
---------------------------------------------------------------------------
Estimated Time per Respondent
The current information collection estimated the time per
respondent for preparing and submitting an SVA/ASP to be 2.65
hours.\18\ As mentioned previously in this notice CISA implemented CSAT
2.0, which among other improvements projected a reduction of 90 percent
in the amount
[[Page 2561]]
of time a respondent spends logged into the CSAT SVA/ASP application.
---------------------------------------------------------------------------
\18\ 2.65 hours is composed of 10% of 5.3 hours logged into CSAT
and 4 hours for every hour logged into CSAT (i.e., 2.65 hours =
[(0.10 x 5.3 hours logged into CSAT) + (0.10 x 5.3 hours logged into
CSAT x 4) for preparation]).
---------------------------------------------------------------------------
Using the data collected since the implementation of CSAT 2.0
(i.e., between FY17 and FY19), CISA determined that the median duration
respondents were logged into the CSAT SVA/ASP application for an
initial SVA/ASP and an SVA/ASP resubmission was 0.80 hours (48 minutes)
and 0.17 hours (10 minutes), respectively. CISA calculated the average
amount of time respondents were logged into the SVA/ASP application
weighted by the number of respondents that submitted first-time SVAs/
ASPs and SVA/ASP resubmissions between FY14 and FY16, which was 0.25
hours (15 minutes) [ = (215 first-time submissions x 0.80 hours + 1,468
resubmissions x 0.17 hours) / 1,683 total submissions].
For this ICR, CISA maintains its assumption, based on previous
public comments on this information collection, that for every hour a
respondent is logged into the SVA/ASP application, the respondent
spends an average of 4 hours in preparation. Therefore, CISA's
estimated time per respondent to prepare and submit an SVA/ASP is 1.24
hours [ = 0.25 hours logged into CSAT + (0.25 hours x 4) for
preparation].
CISA no longer accounts for the burden related to collecting
supporting documentation for SVAs/ASPs, because the standard business
processes associated with the SVA/ASP instrument do not include the
collection of additional documentation.
Annual Burden Hours
The annual burden hours for an SVA/ASP is 2,083 hours [ = 1,683
respondents x 1 response per respondent x 1.24 hours per response].
Total Annual Burden Cost
The 2007 CFATS Regulatory Assessment assumes that SSOs will be
responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this
assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 2,083 hours by the average hourly
compensation rate of SSOs. The total annual burden cost for the SVA/ASP
is $166,028 [ = 2,083 annual burden hours x $79.69 per hour].
Total Burden Cost (Capital/Startup)
CISA provides access to CSAT free of charge and CISA assumes that
each respondent already has access to the internet for basic business
needs. Therefore, CISA estimates that there are no capital/startup
costs for this instrument.
Total Recordkeeping Burden
For respondents that are determined by CISA to present a high level
of security risk, the SVA/ASP recordkeeping burden is accounted for
within the recordkeeping burden estimate for the SSP/ASP discussed
below in Subsection 3 of this section. Therefore, CISA estimates that
no recordkeeping burden is associated with this instrument.
3. CISA's Methodology in Estimating the Burden for the Site Security
Plan (SSP) & Alternative Security Program (ASP) Submitted In Lieu of an
SSP
Number of Respondents
The current information collection estimated 211 SSP/ASP
respondents. For this ICR, the Department maintains the assumption that
all respondents to the SVA/ASP will be a respondent of the SSP/ASP.
Therefore, CISA estimates that the annual number of respondents will be
1,683, which is based on the average number of all respondents to the
SVA/ASP. This number breaks down to, on average, 215 initial
submissions and 1,468 resubmissions.
Estimated Time per Respondent
The current information collection estimated the time per
respondent for preparing and submitting an SSP/ASP to be 18.75
hours.\19\ As mentioned previously in this notice CISA implemented CSAT
2.0, which among other improvements projected a reduction of 70 percent
in the amount of time a respondent spends logged into the CSAT SSP/ASP
application. Using the data collected since the implementation of CSAT
2.0 (i.e., between FY17 and FY19), CISA determined that the median
duration respondents were logged into the SSP/ASP application for
initial and resubmitted SSPs/ASPs was 2.10 hours (126 minutes) and 0.32
hours (19 minutes), respectively. CISA calculated the average amount of
time respondents were logged into the SSP/ASP application weighted by
the number of respondents that submitted first-time SSPs/ASPs and SSP/
ASP resubmissions between FY14 and FY16, which was 0.54 hours (33
minutes) [ = (215 first-time submissions x 2.10 hours + 1,468
resubmissions x 0.32 hours) / 1,683 total submissions].
---------------------------------------------------------------------------
\19\ 18.75 hours is composed of 30% of 12.5 hours logged into
CSAT and 4 hours for every hour logged into CSAT (i.e., 18.75 hours
= [(0.30 x 12.5 hours logged into CSAT) + (0.30 x 12.5 hours logged
into CSAT x 4) for preparation]).
---------------------------------------------------------------------------
For this ICR, CISA maintains its assumption, based on previous
public comments on this information collection, that for every hour a
respondent is logged into the SSP/ASP application, the respondent
spends an average of 4 hours in preparation. Therefore, CISA's
estimated time per respondent to prepare and submit an SSP/ASP is 2.72
hours [ = 0.54 hours logged into CSAT + (0.54 hours x 4) for
preparation].
CISA no longer accounts for the burden related to collecting
supporting documentation for SSPs/ASPs, because the standard business
processes associated with the SSP/ASP instrument do not include the
collection of additional documentation.
Annual Burden Hours
The annual burden hours for SSPs/ASPs is 4,582 hours [ = 1,683
respondents x 1 response per respondent x 2.72 hours per response].
Total Annual Burden Cost
The 2007 CFATS Regulatory Assessment assumes that SSOs will be
responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this
assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 4,582 hours by the average hourly
compensation rate of SSOs. The total annual burden cost for the SSPs/
ASPs is $365,141 [ = 4,582 annual burden hours x $79.69 per hour].
Total Burden Cost (Capital/Startup)
CISA provides access to CSAT free of charge and CISA assumes that
each respondent already has access to the internet for basic business
needs. Therefore, CISA estimates that there are no capital/startup
costs.
Total Recordkeeping Burden
The current information collection estimated a recordkeeping burden
of approximately $440,000. CISA maintained the methodology and
assumptions described in the current information collection, but
increased the current estimate to account for: (1) The increase in the
number of initial SSP/ASP respondents from 211 to 215, (2) updating the
hourly compensation rates to 2017 dollars, and (3) inflating the
capital/startup costs by an inflation factor of 1.03.\20\ Therefore,
CISA's
[[Page 2562]]
estimated recordkeeping burden will be $516,825.
---------------------------------------------------------------------------
\20\ CISA inflated the capital/startup costs from the current
information collection to 2017 dollars using an inflation factor of
1.03. The inflation factor was calculated by dividing the Gross
Domestic Product (GDP) implicit price deflator index from 2017
(103.02) by the index from 2015 (100). (Federal Reserve Economic
Data. GDP Implicit Price Deflator in United States, Index 2015=100,
Annual, Not Seasonally Adjusted. https://fred.stlouisfed.org/series/GDPDEF).
---------------------------------------------------------------------------
For this ICR, CISA maintains its approach of accounting for the
entire recordkeeping burden imposed on covered chemical facilities
under CFATS within the SSP/ASP instrument, because: (1) Only covered
chemical facilities are required to maintain records; (2) no changes to
the recordkeeping requirements have occurred since the approval of the
current information collection; and (3) CISA's historical assumption
that respondents maintain any other required records in the same
manners, formats, and locations as they maintain their SSP/ASP records.
4. CISA'S Methodology in Estimating the Burden for the CFATS Help Desk
Number of Respondents
The current information collection estimated that CISA receives
15,000 requests annually for CFATS Help Desk support (i.e., 15,000
respondents via phone calls, emails, and web-based help request forms).
CISA has determined that maintaining the current estimate would be more
accurate than relying on the number of requests for CFATS Help Desk
support received between FY17 and FY18 because the implementation of
CSAT 2.0 temporarily resulted in an above-average number of CFATS Help
Desk requests.\21\ CISA evaluated historical data to determine if the
estimated number of CFATS Help Desk requests (i.e., 15,000) was still
appropriate. Between FY14 and FY16, the average annual number of CFATS
Help Desk requests was 14,881. Therefore, CISA believes that the
existing estimate of 15,000 respondents continues to be a reasonable
estimate of future CFATS Help Desk requests.
---------------------------------------------------------------------------
\21\ On average, between FY17 and FY19, there were 31,212 calls
and emails per year (i.e., 22,369 calls and 8,843 emails per year)
to the CFATS Helpdesk, most of which were in response to CSAT 2.0
implementation.
---------------------------------------------------------------------------
Estimated Time per Respondent
CISA evaluated historical data to determine if the estimated time
per respondent of 0.17 hours (10 minutes) was still appropriate. Since
the implementation of CSAT 2.0 (i.e., between FY17 and FY18) the
average duration for a CFATS Help Desk call was 6 minutes and 48
seconds, which represented a slight decrease in the actual duration
reported by CISA in previous years. CISA does not have any information
on the average amount of time it took respondents to type and send
emails to the CFATS Help Desk.
Therefore, CISA has maintained the estimated time per respondent of
0.17 hours (10 minutes).
Annual Burden Hours
The average annual burden hours for the CFATS Help Desk will be
2,500 hours [ = 15,000 respondents x 0.17 hours per respondent].
Total Annual Burden Cost
The 2007 CFATS Regulatory Assessment assumes that SSOs will be
responsible for contacting the CFATS Help Desk. For this ICR, CISA
maintains this assumption. Therefore, to estimate the total annual
burden, CISA multiplied the annual burden of 2,500 hours by the average
hourly compensation rate of SSOs. The total annual burden for the CFATS
Help Desk is $199,233 [ = 2,500 annual burden hours x $79.69 per hour].
Total Burden Cost (Capital/Startup)
Contacting the CFATS Help Desk is free and CISA assumes that each
respondent already has a phone or access to the internet for basic
business needs. Therefore, CISA estimates that there are no capital/
startup costs.
Total Recordkeeping Burden
There is no recordkeeping burden for this instrument.
5. CISA'S Methodology in Estimating the Burden for the CSAT User
Registration
Number of Respondents
The current information collection estimated 1,000 respondents
would complete the user registration process annually. For this ICR,
CISA maintains this estimate.
Historically, CISA's estimate in the current information collection
was primarily based on the number of individuals expected to register
as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of
the CSAT User Registration instrument in the current information
collection was intended to allow for the creation of additional CSAT
user roles such as the Administrator and Personnel Surety (PS)
Submitter user roles. Because the estimate has always been very
conservative, for example, between FY14 and FY16 the average annual
number of individuals registered was 604. Thus CISA believes that
maintaining the current estimate of 1,000 respondents annually is a
reasonable estimate that reflects the user registration activity for
all types of CSAT users.
Estimated Time per Respondent
In the current information collection, the estimated time per
respondent is 2 hours. In this ICR, CISA increases the estimated time
per respondent to 2.5 hours. The revised estimate is based on two
factors: (1) Following the implementation of CSAT 2.0 (i.e., between
FY16 and FY18), the actual time needed to complete the CSAT User
Registration process was approximately 0.5 hours (30 minutes); and (2)
CISA expects that CSAT Authorizers need additional time to manage the
CSAT user accounts for which they are responsible.
The ongoing management of the CSAT user accounts includes
activities such as, but not limited to: (1) Assigning Submitters and
Preparers to facilities; (2) updating the facilities with which a
Submitter or Preparer is associated as his or her duties change; (3)
creating groups \22\ to support the CFATS Personnel Surety (PS)
Program; (4) assigning PS Submitters to groups; and (5) updating the PS
Submitters' access to groups as their duties change. Furthermore, in
response to comments submitted to CISA for information collection (OMB
Control No. 1670-0029),\23\ CISA clarified that certain burdens were
accounted for under this information collection (i.e., OMB Control No.
1670-0007).\24\
---------------------------------------------------------------------------
\22\ ``Groups'' is a technical term used by CISA to describe how
a covered chemical facility may manage the access to records about
affected individuals in the CSAT Personnel Surety application. CISA
describes the term ``groups'' and provides additional information
about how to create and manage groups in section 9.5 of the CSAT
User Manual, which may be viewed at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.
\23\ 1670-0029 was approved by OMB in August 2015. The approved
information collection may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201312-1670-001.
\24\ CISA's summary of the comments and its response to those
comments are contained within the 30-day notice for the CFATS
Personnel Surety Program at 83 FR 28249. The 30-day notice was
published in the Federal Register on July 18, 2018 at 83 FR 28244
and may be viewed at https://www.federalregister.gov/d/2018-12523.
---------------------------------------------------------------------------
For this ICR, CISA is applying the assumption based on previous
public comments on this information collection (i.e., OMB Control No.
1670-0007) that for every hour a respondent is logged into the CSAT
application, the respondent spends an average of 4 hours in preparation
(e.g., coordinating with CFATS-facility stakeholders, including Human
Resources, Procurement, or Contract Administration to explain the PS
Program requirements and determine how best to gather the data from
different populations). Therefore, CISA's estimated time per respondent
is
[[Page 2563]]
2.5 hours [ = 0.50 hours logged into CSAT + (0.50 hours x 4) for
preparation].
Annual Burden Hours
The annual burden estimate for CSAT User Registration is 2,500
hours [ = 1,000 respondents x 1 response per respondent x 2.5 hours per
respondent].
Total Annual Burden Cost
The 2007 CFATS Regulatory Assessment assumes that SSOs will be
responsible for CSAT User Registration. For this ICR, CISA maintains
this assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 2,500 hours by the average hourly
compensation rate of SSOs. The total annual burden for CFATS User
Registration is $199,233 [ = 2,500 annual burden hours x $79.69 per
hour].
Total Burden Cost (Capital/Startup)
The current information collection estimated that a one-time
capital cost would be incurred by 24,630 respondents required to submit
a CSAT User Registration as part of the CSAT 2.0 implementation. These
capital costs were one-time costs and have been removed from this
information collection.
CISA provides access to CSAT free of charge and CISA assumes that
each respondent already has access to the internet for basic business
needs. Therefore, for this ICR CISA estimates that there are no
capital/startup costs for this instrument.
Total Recordkeeping Burden
There is no recordkeeping burden for this instrument.
6. CISA'S Methodology in Estimating the Burden for Identification of
Additional Facilities and Assets at Risk
Number of Respondents
The current information collection estimated that each year 211
respondents would respond to this instrument. For this ICR, CISA
estimates that the annual number of respondents will be 845, because
CISA only requests this information from covered chemical facilities
that undergo compliance inspections and ship chemicals of interest
(COI). CISA completes approximately 1,920 compliance inspections per
year. Of these, approximately 44 percent of the covered chemical
facilities inspected ship COI. Therefore, CISA estimates 845
respondents for this instrument [ = 1,920 facilities inspected x 44
percent of facilities ship COI].
Estimated Time per Respondent
In the current information collection, the estimated time per
respondent is 0.17 hours (10 minutes). In this ICR, CISA maintains this
estimate.
Annual Burden Hours
The annual burden estimate is 140.83 hours [ = 845 respondents x 1
response per respondent x 0.17 hours per respondent].
Total Annual Burden Cost
CISA assumes that SSOs will be responsible for providing this
information. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 140.83 hours by the average hourly
compensation rate of SSOs. The total annual burden for the
Identification of Additional Facilities and Assets at Risk is $11,223 [
= 140.83 annual burden hours x $79.69 per hour].
Total Burden Cost (Capital/Startup)
In the current information collection, CISA estimated a one-time
capital cost would be incurred by 3,000 respondents as a result of the
CSAT 2.0 implementation. These capital costs were one-time costs for
respondents and therefore have been removed from this information
collection.
Total Recordkeeping Burden
There is no recordkeeping burden for this instrument.
Public Participation
OMB is particularly interested in comments that:
1. Evaluate whether the proposed collection of information is
necessary for the proper performance of the functions of the agency,
including whether the information will have practical utility;
2. Evaluate the accuracy of the agency's estimate of the burden of
the proposed collection of information, including the validity of the
methodology and assumptions used;
3. Enhance the quality, utility, and clarity of the information to
be collected; and
4. Minimize the burden of the collection of information on those
who are to respond, including through the use of appropriate automated,
electronic, mechanical, or other technological collection techniques,
or other forms of information technology (e.g., permitting electronic
submissions of responses).
Analysis
Title of Collection: Chemical Security Assessment Tool
OMB Control Number: 1670-0007
Instrument: Top-Screen
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 2,332 respondents (estimate)
Estimated Time per Respondent: 1.09 hours
Total Annual Burden Hours: 2,553 hours
Total Annual Burden Cost: $203,450
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: Security Vulnerability Assessment and Alternative Security
Program submitted in lieu of a Security Vulnerability Assessment
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,683 respondents (estimate)
Estimated Time per Respondent: 1.24 hours
Total Annual Burden Hours: 2,083 hours
Total Annual Burden Cost: $166,028
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: Site Security Plan and Alternative Security Program
submitted in lieu of a Site Security Plan
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,683 respondents (estimate)
Estimated Time per Respondent: 2.72 hours
Total Annual Burden Hours: 4,582 hours
Total Annual Burden Cost: $365,141
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $516,825
Instrument: CFATS Help Desk
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 15,000 respondents (estimate)
Estimated Time per Respondent: 0.17 hours
Total Annual Burden Hours: 2,500 hours
Total Annual Burden Cost: $199,233
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: User Registration
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 1,000 respondents (estimate)
[[Page 2564]]
Estimated Time per Respondent: 2.5 hours
Total Annual Burden Hours: 2,500 hours
Total Annual Burden Cost: $199,233
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: Identification of Facilities and Assets at Risk
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 845 respondents (estimate)
Estimated Time per Respondent: 0.17 hours
Total Annual Burden Hours: 140.83 hours
Total Annual Burden Cost: $11,223
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Scott Libby,
Deputy Chief Information Officer.
[FR Doc. 2019-01378 Filed 2-6-19; 8:45 am]
BILLING CODE 9110-9P-P