[Federal Register Volume 87, Number 247 (Tuesday, December 27, 2022)]
[Notices]
[Pages 79337-79341]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-28076]
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
[Docket No. CISA-2022-0018]
Request To Revise and Extend the Chemical Security Assessment
Tool (CSAT) Information Collection Under the Paperwork Reduction Act
AGENCY: Cybersecurity and Infrastructure Security Agency, DHS.
ACTION: 60-Day notice and request for comments.
-----------------------------------------------------------------------
SUMMARY: The Infrastructure Security Division (ISD) within the
Cybersecurity and Infrastructure Security Agency (CISA) will submit the
following Information Collection Request (ICR) to the Office of
Management and Budget (OMB) for review and clearance in accordance with
the Paperwork Reduction Act of 1995. This notice solicits comments on
the information collection during a 60-day public comment period prior
to the submission of this ICR to OMB. The submission proposes to revise
the information collection for an additional three years and update the
burden estimates associated with collecting information in the Chemical
Security Assessment Tool (CSAT) for the Chemical Facility Anti-
Terrorism Standards (CFATS) Program.
DATES: Comments are due by February 27, 2023.
ADDRESSES: You may send comments, identified by docket number through
the Federal eRulemaking Portal: http://www.regulations.gov. Follow the
instructions for sending comments.
Instructions: All submissions received must include the agency name
``CISA'' and docket number CISA-2022-0018. All comments received will
be posted without change to http://www.regulations.gov, including any
personal information provided.
Comments that include protected information such as trade secrets,
confidential commercial or financial information, Chemical-terrorism
Vulnerability Information (CVI),\1\ Sensitive Security Information
(SSI),\2\ or Protected Critical Infrastructure Information (PCII) \3\
should not be submitted to the public docket. Comments containing
protected information should be appropriately marked and packaged in
accordance with all applicable requirements and submission must be
coordinated with the point of contact for this notice provided in FOR
FURTHER INFORMATION CONTACT section.
---------------------------------------------------------------------------
\1\ For more information about CVI see 6 CFR 27.400 and the CVI
Procedural Manual at www.dhs.gov/publication/safeguarding-cvi-manual.
\2\ For more information about SSI see 49 CFR part 1520 and the
SSI Program web page at www.tsa.gov/for-industry/sensitive-security-information.
\3\ For more information about PCII see 6 CFR part 29 and the
PCII Program web page at www.dhs.gov/pcii-program.
FOR FURTHER INFORMATION CONTACT: Ryan Donaghy, 703-603-5000,
_____________________________________-
[email protected].
SUPPLEMENTARY INFORMATION: The CFATS Program identifies chemical
facilities of interest and regulates the security of high-risk chemical
facilities through a risk-based approach. The CFATS Program is
authorized under the Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2014 or ``CFATS Act of 2014.\4\
---------------------------------------------------------------------------
\4\ The CFATS Act of 2014 codified the CFATS program into the
Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended
by Public Law 116-135, Sec. 16007 (2020).
---------------------------------------------------------------------------
CISA collects the core regulatory data necessary to implement CFATS
through the Chemical Security Assessment Tool (CSAT) covered under this
collection. For more information about CFATS and CSAT, please visit
www.dhs.gov/chemicalsecurity. This information collection (OMB Control
No. 1670-0007) will expire on July 31, 2023.\5\
---------------------------------------------------------------------------
\5\ The currently approved version of this information
collection (OMB Control No. 1670-0007) can be viewed athttps://
www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201905-1670-001.
---------------------------------------------------------------------------
Below, CISA estimates the burden to respondents for the: (1) Top-
Screen, (2) Security Vulnerability Assessment (SVA) and Alternative
Security Program (ASP) submitted in lieu of an SVA, (3) Site Security
Plan (SSP) and ASP submitted in lieu of an SSP, (4) CFATS Help Desk,
(5) CSAT User Registration, and (6) Identification of Facilities and
Assets at Risk.\6\
---------------------------------------------------------------------------
\6\ Throughout this analysis, CISA presents rounded hourly time
burden estimates and hourly compensation rates to assist in
reproducing the results. However, CISA's actual calculations use
unrounded figures; consequently, some reproduced results may not
exactly match the reported results.
---------------------------------------------------------------------------
1. CISA'S Methodology in Estimating the Burden for the Top-Screen
Number of Respondents: The current information collection estimated
that 2,332 respondents will submit a Top-Screen annually. For this ICR,
CISA estimates the annual number of respondents will be 3,817.
The estimate of 3,817 is the sum of the average number of 887
first-time Top-Screen submissions and the average number of 2,930 Top-
Screen resubmissions received per year between Calendar Year (calendar
year)19 and CY21 (887 first time submissions + 2,930 resubmissions =
3,817).
Estimated Time per Respondent: In the current information
collection, the estimated time per respondent to prepare and submit a
Top-Screen is 1.09 hours. For this ICR, CISA estimates the time per
respondent to prepare and submit a Top-Screen will be 2.04 hours.
Using the data collected between CY19 and CY21, CISA obtained the
estimate of 2.04 hours by first determining the average amount of time
respondents were logged into the Top-Screen application (0.408 hours or
24.5 minutes). CISA calculated this figure by
[[Page 79338]]
using the time logged in the application for initial Top-Screens (.50
hours) and Top-Screen resubmission (.38 hours) weighted by the number
of respondents that submitted first-time Top-Screens and Top-Screen
resubmissions [(887 first-time submissions x 0.50 hours per first time
submission) + (2,930 resubmissions x 0.38 hours per resubmission) /
3,817 total submissions = 0.408 hours].
CISA maintains its assumption, based on previous public comments on
this information collection, that for every hour a respondent is logged
into the Top-Screen application, the respondent spends an average of 4
hours in preparation.\7\ Therefore, based on the 0.408 hours average
log in time for the Top-Screen application and the 4 hours of average
preparation time, CISA calculates that between CY19 and CY21, the
burden per respondent to submit a Top-Screen was 2.04 hours [0.408
hours logged into CSAT + (0.408 hours x 4) for preparation = 2.04
hours].
---------------------------------------------------------------------------
\7\ CISA's adoption of the assumption that for every hour a
respondent is logged into the Top-Screen application, SVA/ASP
application, and SSP/ASP application, the respondent spends an
average of 4 hours in preparation is described in the 30-day notice
the Department published for this information collection in March
2013 at 78 FR 16694, which may be viewed at https://www.federalregister.gov/d/2013-06095.
---------------------------------------------------------------------------
Annual Burden Hours: The annual burden hours for the Top-Screen is
7,785 hours (3,817 respondents x 1 response per respondent x 2.04 hours
per response = 7,785 hours).
Total Annual Burden Cost: CISA assumes that Site Security Officers
(SSOs) are responsible for submitting Top-Screens. For this ICR, CISA
maintains this assumption.
To estimate the total annual burden, CISA multiplied the annual
burden of 7,785 hours by the average hourly total compensation rate of
SSOs of $90.41 \8\ per hour. Therefore, the total annual burden cost
for the Top-Screen is $703,829 (i.e., 7,785 hours multiplied by $90.41
per hour).
---------------------------------------------------------------------------
\8\ Mean hourly wage was obtained from U.S. Department of Labor,
BLS; May 2021 Occupational Employment and Wage Statistics, OES
Managers, All Other. (Occupational Code 11-9199). Retrieved from
https://www.bls.gov/oes/2021/may/oes_nat.htm. of $62.36 times the
wage rate benefit multiplier of 1.4499 (to account for fringe
benefits) equaling $90.4141. The benefits multiplier is estimated by
dividing total compensation of $40.35 by salaries and wages of
$27.83, based on Employer Cost for Employee Compensation, December
2021, released March 18, 2022 (https://www.bls.gov/news.release/archives/ecec_03182022.pdf).
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): CISA provides access to CSAT
free of charge and CISA assumes that each respondent already has access
to the internet for basic business needs. Therefore, CISA estimates
that no capital/startup costs are associated with this instrument.
Total Recordkeeping Burden A respondent that has submitted a Top-
Screen may or may not be determined by CISA to present a high level of
security risk. Only respondents that present a high level of security
risk are required to keep records mandated by CFATS (i.e., facilities
that tier into the CFATS program).
For respondents that are determined to present a high level of
security risk, the Top-Screen recordkeeping burden is accounted for
within the recordkeeping burden estimate for the ``Site Security Plan
(SSP) and Alternative Security Program (ASP) submitted in lieu of an
SSP'' instrument discussed later in this notice in subsection 3,
hereafter, referred to as the ``SSP/ASP.'' The recordkeeping burden
estimate for the SSP/ASP instrument accounts for all records
respondents are required to maintain under CFATS because CISA assumes
that respondents maintain their Top-Screen records in the same manners,
formats, and locations as they maintain their other required records.
Therefore, CISA estimates that no recordkeeping burden is associated
with this instrument.
2. CISA'S Methodology in Estimating the Burden for the Security
Vulnerability Assessment (SVA) & Alternative Security Program (ASP)
Submitted in Lieu of an SVA
Number of Respondents: The current information collection estimated
that each year 1,683 respondents would complete an SVA or ASP in lieu
of an SVA, hereafter, referred to as an ``SVA/ASP.'' For this ICR, CISA
estimates that the annual number of respondents will be 2,328, which is
based on sum of the average number of SVA/ASP submissions and
resubmissions between CY19 and CY21. This consists of an average of 209
first-time SVA/ASPs and 2,119 resubmitted SVA/ASPs per year.
Estimated Time per Respondent: The current information collection
estimated the time per respondent for preparing and submitting an SVA/
ASP to be 1.24 hours. For this ICR, CISA estimates the time per
respondent for preparing and submitting an SVA/ASP will be 1.4136
hours.
Using the data collected between CY19 and CY 21, CISA obtained the
estimate of 1.4136 hours by first determining the median amount of time
respondents were logged into the SVA/ASP application (0.28 hours or 17
minutes). CISA calculated the average amount of time respondents were
logged into the SVA/ASP application by using the median duration
respondents were logged into the CSAT SVA/ASP application for an
initial SVA/ASP (0.783 hours or 47 minutes) and an SVA/ASP resubmission
(0.233 hours or 14 minutes) weighted by the number of respondents that
submitted first-time SVAs/ASPs and SVA/ASP resubmissions between CY19
and CY21 which was 0.28 hours \9\ [(209 first-time submissions x 0.783
hours) + (2,119 resubmissions x 0.233 hours) / 2,328 total submissions
= 0.28 hours].
---------------------------------------------------------------------------
\9\ 0.28271 hours.
---------------------------------------------------------------------------
CISA maintains its assumption, based on previous public comments on
this information collection, that for every hour a respondent is logged
into the SVA/ASP application, the respondent spends an average of 4
hours in preparation. Therefore, based on the 0.28 hours average log in
time for the CSAT SVA/ASP application and the 4 hours of average
preparation time, CISA calculates that between CY19 and CY21, the
burden per respondent to prepare and submit an SVA/ASP was 1.4136 hours
\10\ [ 0.28 hours logged into CSAT + (0.28 hours x 4) for preparation].
---------------------------------------------------------------------------
\10\ 1.4136 hours = 0.2827 hours + 1.1308 hours.
---------------------------------------------------------------------------
Annual Burden Hours: The annual burden hours for an SVA/ASP is
3,291 hours \11\ (2,328 respondents x 1 response per respondent x
1.4136 hours per response = 3,291 hours).
---------------------------------------------------------------------------
\11\ 3,290.75 hours.
---------------------------------------------------------------------------
Total Annual Burden Cost: CISA assumes that SSOs will be
responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this
assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 3,291 hours by the average hourly total
compensation rate of SSOs of $90.41 per hour.\12\ Therefore, the total
annual burden cost for the SVA/ASP is $297,530 (i.e., 3,291 hours
multiplied by $90.41 per hour).
---------------------------------------------------------------------------
\12\ $90.4142 is the hourly labor costs, including wages and
benefits.
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): CISA provides access to CSAT
free of charge and CISA assumes that each respondent already has access
to the internet for basic business needs. Therefore, CISA estimates
that there are no capital/startup costs for this instrument.
Total Recordkeeping Burden: For respondents that are determined by
CISA to present a high level of security risk, the SVA/ASP
recordkeeping burden is accounted for within the recordkeeping burden
estimate for the SSP/ASP discussed below in Subsection 3 of this
section. Therefore, CISA estimates that no recordkeeping burden is
associated with this instrument.
[[Page 79339]]
3. CISA'S Methodology in Estimating the Burden for the Site Security
Plan (SSP) & Alternative Security Program (ASP) Submitted in Lieu of an
SSP
Number of Respondents: The current information collection estimated
1,683 SSP/ASP respondents. For this ICR, the Department maintains the
assumption that all respondents to the SVA/ASP will be a respondent of
the SSP/ASP. Therefore, CISA estimates that the annual number of
respondents will be 2,328, which is based on the average number of all
respondents to the SVA/ASP. This number breaks down to, on average, 209
initial submissions and 2,119 resubmissions per year.
Estimated Time per Respondent: The current information collection
estimated the time per respondent for preparing and submitting an SSP/
ASP to be 2.72 hours. For this ICR, CISA estimates the time per
respondent for preparing and submitting an SSP/ASP will be 7.845 hours.
CISA intends to make a revision to the SSP/ASP instrument to
collect facility internet Protocol (IP) address(es) and Domain Name
System (DNS) information. The collection of IP address(es) and DNS
information supports the development of a facility's SSP in accordance
with 6 U.S.C. 622 (a)(2)(D)(ii) and 6 CFR 27.225(a)(4). In addition,
CISA may potentially use this information to integrate with other data
within the U.S. Government, conduct related analysis, and provide
warnings about cyber threats affecting chemical facilities. CISA
expects that answering these questions will not meaningfully increase
the estimated SSP/ASP completion time.
Using the data collected between CY 19 and CY 21, CISA obtained the
estimate of 7.845 hours by first determining the average amount of time
respondent were logged into the SSP/ASP application (1.5689 hours or 94
minutes). CISA calculated the average amount of time respondents were
logged into the SSP/ASP application by using the median duration
respondents were logged into the SSP/ASP application for an initial
SSP/ASP (4.63 hours or 278 minutes) and an SSP/ASP resubmission (1.27
hours or 76 minutes) weighted by the number of respondents that
submitted first-time SSPs/ASPs and SSP/ASP resubmissions between CY19
and CY21, which was 1.5689 hours (94 minutes) [ (209 first-time
submissions x 4.6333 hours) + (2,119 resubmissions x 1.2666 hours) /
2,328 total submissions = 1.5689 hours].
CISA maintains its assumption, based on previous public comments on
this information collection, that for every hour a respondent is logged
into the SSP/ASP application, the respondent spends an average of 4
hours in preparation. Therefore, based on the 1.57 hours average log in
time for the CSAT SSA/ASP application and the 4 hours of average
preparation time, CISA calculates that between CY19 and CY21, the
burden per respondent to prepare and submit an SSP/ASP was 7.845 hours
[1.5689 hours logged into CSAT + (1.5689 hours x 4) for preparation].
Annual Burden Hours: The annual burden hours for SSPs/ASPs is
18,262 hours (2,328 respondents x 1 response per respondent x 7.845
hours per response).
Total Annual Burden Cost: CISA assumes that SSOs will be
responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this
assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 18,262 hours by the average hourly
total compensation rate of SSOs of $90.41 per hour \13\. Therefore, the
total annual burden cost for the SVA/ASP is $ 1,651,158 (i.e., 18,262
hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------
\13\ $90.4142 is the hourly labor costs, including wages and
benefits.
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): CISA provides access to CSAT
free of charge and CISA assumes that each respondent already has access
to the internet for basic business needs. Therefore, CISA estimates
that there are no capital/startup costs.
Total Recordkeeping Burden: The current information collection
estimated a recordkeeping burden of approximately $516,825. For this
information collection, CISA estimates a recordkeeping burden of
$556,040. CISA maintained the methodology and assumptions described in
the current information collection but increased the current estimate
to account for updating the hourly compensation rates \14\ to $44.18
and inflating the 2017 ICR renewal capital/startup costs by an
inflation factor \15\ of 1.09.
---------------------------------------------------------------------------
\14\ Mean hourly wage was obtained from U.S. Department of
Labor, BLS; May 2021 Occupational Employment and Wage Statistics,
OES First-Line Supervisors of Office and Administrative Support
Workers, (Occupational Code 43-1011). Retrieved from https://www.bls.gov/oes/2021/may/oes_nat.htm. of $30.47 times the wage rate
benefit multiplier of 1.4499 (to account for fringe benefits)
equaling $44.177. The benefits multiplier is estimated by dividing
total compensation of $40.35 by salaries and wages of $27.83, based
on Employer Cost for Employee Compensation, December 2021, released
March 18, 2022 (https://www.bls.gov/news.release/archives/ecec_03182022.pdf).
\15\ Federal Reserve Bank of St. Louis, Federal Reserve Economic
Data, GDP factor from 2017 to 2021 dollars was 1.0975 = 113.0664/
103.02 https://fred.stlouisfed.org/series/USAGDPDEFAISMEI.
---------------------------------------------------------------------------
For this ICR, CISA maintains its approach of accounting for the
entire recordkeeping burden imposed on covered chemical facilities
under CFATS within the SSP/ASP instrument, because: (1) only covered
chemical facilities are required to maintain records; (2) no changes to
the recordkeeping requirements have occurred since the approval of the
current information collection; and (3) CISA's historical assumption
that respondents maintain any other required records in the same
manners, formats, and locations as they maintain their SSP/ASP records.
4. CISA'S Methodology in Estimating the Burden for the CFATS Help Desk
Number of Respondents The current information collection estimated
that CISA receives 15,000 requests annually for CFATS Help Desk support
(i.e., 15,000 respondents via phone calls, emails, and web-based help
request forms). CISA is proposing to lower this estimate to 12,000
respondents.
CISA evaluated historical data to determine if the estimated number
of CFATS Help Desk requests (i.e., 15,000) was still appropriate.
Between CY19 and CY21, the average annual number of CFATS Help Desk
requests was 11,819. Therefore, CISA believes that lowering the
existing estimate of 15,000 respondents to 12,000 is appropriate.
Estimated Time per Respondent: The current estimated time per
respondent for the CFATS Help Desk is 0.17 hours (10 minutes). CISA is
proposing to lower this estimate to 0.1167 hours (7 minutes).
CISA evaluated historical data to determine if the estimated time
per respondent of 0.17 hours (10 minutes) was still appropriate.
Between CY19 and CY21, the average duration for a CFATS Help Desk call
was approximately 7 minutes (6 minutes and 46 seconds), which is a
slight decrease from the average duration for a CFATS Help Desk call
reported by CISA in previous years. CISA does not have any information
on the average amount of time it took respondents to type and send
emails to the CFATS Help Desk.
Because the average duration for a CFATS Help Desk call remains
below the current estimate of 0.17 hours, CISA believes that it is
appropriate to lower the estimate for this information collection to
0.1167 hours.
Annual Burden Hours: The average annual burden hours for the CFATS
Help Desk will be 1,400 hours [12,000 respondents x 0.1167 hours per
respondent = 1,400 hours].
Total Annual Burden Cost: CISA assumes that SSOs will be
responsible for contacting the CFATS Help Desk. For this ICR, CISA
maintains this
[[Page 79340]]
assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 1,400 hours by the average hourly total
compensation rate of SSOs of $90.41 per hour.\16\ Therefore, the total
annual burden cost for the CFATS Help Desk is $126,580 (i.e., 1,400
hours multiplied by $90.41 per hour.
---------------------------------------------------------------------------
\16\ $90.4142 is the hourly labor costs, including wages and
benefits.
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): Contacting the CFATS Help Desk
is free and CISA assumes that each respondent already has a phone or
access to the internet for basic business needs. Therefore, CISA
estimates that there are no capital/startup costs.
Total Recordkeeping Burden: There is no recordkeeping burden for
this instrument.
5. CISA's Methodology in Estimating the Burden for the CSAT User
Registration
Number of Respondents: The current information collection estimated
1,000 respondents would complete the user registration process
annually. For this ICR, CISA maintains this estimate.
Historically, CISA's estimate in the current information collection
was primarily based on the number of individuals expected to register
as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of
the CSAT User Registration instrument in the current information
collection was intended to allow for the creation of additional CSAT
user roles such as the Administrator and Personnel Surety (PS)
Submitter user roles. Because the estimate has always been very
conservative, for example, between CY19 and CY21 the average annual
number of individuals registered was 540. Thus, CISA believes that
maintaining the current estimate of 1,000 respondents annually is a
reasonable estimate that reflects the user registration activity for
all types of CSAT users.
Estimated Time per Respondent: In the current information
collection, the estimated time per respondent is 2.5 hours. CISA
proposes to maintain the current estimate.
This estimate is based on two factors: (1) the actual time needed
to complete the CSAT User Registration process continues to be
approximately 0.5 hours (30 minutes); and (2) CISA expects that CSAT
Authorizers need additional time to manage the CSAT user accounts for
which they are responsible.
The ongoing management of the CSAT user accounts includes
activities such as, but not limited to: (1) assigning Submitters and
Preparers to facilities; (2) updating the facilities with which a
Submitter or Preparer is associated as his or her duties change; (3)
creating groups \17\ to support the CFATS Personnel Surety (PS)
Program; (4) assigning PS Submitters to groups; and (5) updating the PS
Submitters' access to groups as their duties change.
---------------------------------------------------------------------------
\17\ ``Groups'' is a technical term used by CISA to describe how
a covered chemical facility may manage the access to records about
affected individuals in the CSAT Personnel Surety application. CISA
describes the term ``groups'' and provides additional information
about how to create and manage groups in section 9.5 of the CSAT
User Manual, which may be viewed at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.
---------------------------------------------------------------------------
CISA intends to revise the user registration instrument to collect
facility Employer Identification Numbers (EIN). The collection of EIN
information will allow CISA to identify chemical facilities of
interest, in accordance with 6 U.S.C. 622(a)(2)(A)(i), within datasets
that are in the possession of the Federal Government. CISA expects that
answering these questions will not meaningfully increase the estimated
time per respondent.
For this ICR, CISA is applying the assumption based on previous
public comments on this information collection (i.e., OMB Control No.
1670-0007) that for every hour a respondent is logged into the CSAT
application, the respondent spends an average of 4 hours in preparation
(e.g., coordinating with CFATS-facility stakeholders, including Human
Resources, Procurement, or Contract Administration to explain the PS
Program requirements and determine how best to gather the data from
different populations). Therefore, CISA's estimated time per respondent
is 2.5 hours [ 0.50 hours logged into CSAT + (0.50 hours x 4) for
preparation = 2.5 hours].
Annual Burden Hours: The annual burden estimate for CSAT User
Registration is 2,500 hours [ 1,000 respondents x 1 response per
respondent x 2.5 hours per respondent = 2,500 hours].
Total Annual Burden Cost: CISA assumes that SSOs will be
responsible for CSAT User Registration. For this ICR, CISA maintains
this assumption. Therefore, to estimate the total annual burden, CISA
multiplied the annual burden of 2,500 hours by the average hourly total
compensation rate of SSOs of $90.41 per hour.\18\ Therefore, the total
annual burden cost for the CSAT User Registration is $226,035 (i.e.,
2,500 hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------
\18\ $90.4142 is the total compensation per hour, including
wages and benefits.
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): CISA provides access to CSAT
free of charge and CISA assumes that each respondent already has access
to the internet for basic business needs. Therefore, for this ICR CISA
estimates that there are no capital/startup costs for this instrument.
Total Recordkeeping Burden: There is no recordkeeping burden for
this instrument.
6. CISA'S Methodology in Estimating the Burden for Identification of
Additional Facilities and Assets at Risk
Number of Respondents. The current information collection estimated
that each year 3,426 respondents would respond to this instrument. For
this ICR, CISA estimates the number of respondents will be 2,252.
This instrument is composed of two sections titled ``Identification
of Facilities'' and a second section titled ``Assets at Risk.'' The
first section collects information on a voluntary basis when a facility
ships and/or receives Chemicals of Interest (COI). The second section
collects information on a voluntary basis when the facility identifies
a cyber system. The estimate of 2,252 respondents is based upon the sum
of 439 respondents for the first section of this instrument and 1,813
respondents for the second section of this instrument.
CISA estimated 439 respondents for the first section of the
instrument by using data on the number of compliance inspection
conducted between CY 2019 and CY 2021. Between CY19 and CY21, CISA
completed an average of 1,021 compliance inspections per year. Of these
inspections, approximately 43 percent of the covered chemical
facilities inspected ship COI. Therefore, because CISA only requests
this information from covered chemical facilities that undergo
compliance inspections and ship COI, CISA estimates 439 respondents for
the first section of the instrument [ 1,021 facilities inspected x 43
percent of facilities ship COI = 439].
With respect to the second section of the instrument (``Assets at
Risk''), if a covered chemical facility has identified a cyber-related
system in their SVA or SSP, CISA may request the information covered
under this section of the instrument during interactions that occur
during: (1) Compliance Assistance Visits, (2) Authorization
Inspections, and (3) Compliance Inspections.\19\
[[Page 79341]]
Between CY 2019 and CY 2021, CISA has performed 5,438 of these
interactions at facilities and asked questions about assets at risk.
Therefore, CISA estimates 1,813 respondents \20\ for the second section
of the instrument by annualizing the number of interactions described
above (i.e., 1,813 = [5438 respondents divided by a 3-year time-
period]).
---------------------------------------------------------------------------
\19\ This information is not covered under the SSP because the
information is not subsequently submitted through the CSAT SSP but
rather documented by an inspector or other appropriate employee of
CISA.
\20\ 1,812.67 = (5438 / 3).
---------------------------------------------------------------------------
Estimated Time per Respondent: In the current information
collection, the estimated time per respondent is 0.17 hours (10
minutes). In this ICR, CISA maintains this estimate.
Annual Burden Hours: The annual burden estimate is 375 hours [
2,252 respondents x 1 response per respondent x 0.17 hours per
respondent].
Total Annual Burden Cost: CISA assumes that SSOs will be
responsible for providing this information. Therefore, to estimate the
total annual burden, CISA multiplied the annual burden of 375 hours by
the average hourly total compensation rate of SSOs of $90.41 \21\ per
hour. Therefore, the total annual burden cost for this instrument is
$33,931 (375 hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------
\21\ $90.4142 is the total compensation per hour, including
wages and benefits.
---------------------------------------------------------------------------
Total Burden Cost (Capital/Startup): CISA estimates that there are
no capital/startup costs for this instrument.
Total Recordkeeping Burden: There is no recordkeeping burden for
this instrument.
Public Participation: OMB is particularly interested in comments
that:
1. Evaluate whether the proposed collection of information is
necessary for the proper performance of the functions of the agency,
including whether the information will have practical utility;
2. Evaluate the accuracy of the agency's estimate of the burden of
the proposed collection of information, including the validity of the
methodology and assumptions used;
3. Enhance the quality, utility, and clarity of the information to
be collected; and
4. Minimize the burden of the collection of information on those
who are to respond, including through the use of appropriate automated,
electronic, mechanical, or other technological collection techniques,
or other forms of information technology (e.g., permitting electronic
submissions of responses).
Analysis
Title of Collection: Chemical Security Assessment Tool
OMB Control Number: 1670-0007
Instrument: Top-Screen
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 3,817 respondents (estimate)
Estimated Time per Respondent: 2.04 hours
Total Annual Burden Hours: 7,785 hours
Total Annual Burden Cost: $703,829
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: Security Vulnerability Assessment and Alternative
Security Program submitted in lieu of a Security Vulnerability
Assessment
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit
Number of Respondents: 2,328 respondents (estimate)
Estimated Time per Respondent: 1.4136 hours
Total Annual Burden Hours: 3,291 hours
Total Annual Burden Cost: $297,530
Total Annual Burden Cost (capital/startup): $0
Total Recordkeeping Burden: $0
Instrument: Site Security Plan and Alternative Security Program
submitted in lieu of a Site Security Plan.
Frequency: ``On occasion'' and ``Other''
Affected Public: Business or other for-profit.
Number of Respondents: 2,328 (estimate).
Estimated Time per Respondent: 7.845 hours.
Total Annual Burden Hours: 18,262 hours.
Total Annual Burden Cost: $1,651,158.
Total Annual Burden Cost (capital/startup): $0.
Total Recordkeeping Burden: $556,040.
Instrument: CFATS Help Desk
Frequency: ``On occasion'' and ``Other''.
Affected Public: Business or other for-profit.
Number of Respondents: 12,000 respondents (estimate).
Estimated Time per Respondent: 0.1167 hours.
Total Annual Burden Hours: 1,400 hours.
Total Annual Burden Cost: $126,580.
Total Annual Burden Cost (capital/startup): $0.
Total Recordkeeping Burden: $0.
Instrument: User Registration.
Frequency: ``On occasion'' and ``Other''.
Affected Public: Business or other for-profit.
Number of Respondents: 1,000 respondents (estimate).
Estimated Time per Respondent: 2.5 hours.
Total Annual Burden Hours: 2,500 hours.
Total Annual Burden Cost: $226,035.
Total Annual Burden Cost (capital/startup): $0.
Total Recordkeeping Burden: $0.
Instrument: Identification of Facilities and Assets at Risk.
Frequency: ``On occasion'' and ``Other''.
Affected Public: Business or other for-profit.
Number of Respondents: 2,252 respondents (estimate).
Estimated Time per Respondent: 0.17 hours.
Total Annual Burden Hours: 375 hours.
Total Annual Burden Cost: $33,931.
Total Annual Burden Cost (capital/startup): $0.
Total Recordkeeping Burden: $0.
Robert Costello,
Chief Information Officer, Department of Homeland Security,
Cybersecurity and Infrastructure Security Agency.
[FR Doc. 2022-28076 Filed 12-23-22; 8:45 am]
BILLING CODE 9110-9P-P