Chemical Facility Anti-Terrorism Standards Personnel Surety Program, 28244-28251 [2018-12523]

Agencies

• DEPARTMENT OF HOMELAND SECURITY

[Federal Register Volume 83, Number 117 (Monday, June 18, 2018)]
[Notices]
[Pages 28244-28251]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-12523]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY


Chemical Facility Anti-Terrorism Standards Personnel Surety 
Program

AGENCY: National Protection and Programs Directorate (NPPD), Department 
of Homeland Security (DHS).

ACTION: 30-Day notice and request for comments; revision of information 
collection request: 1670-0029.

-----------------------------------------------------------------------

SUMMARY: The DHS NPPD Office of Infrastructure Protection (IP), 
Infrastructure Security Compliance Division (ISCD) will submit the 
following information collection request (ICR) to the Office of 
Management and Budget (OMB) for review and clearance in accordance with 
the Paperwork Reduction Act of 1995. NPPD previously published this 
ICR, in the Federal Register on December 27, 2017, for a 60-day public 
comment period.
    In this notice NPPD is responding to seven commenters that 
submitted comments in response to the 60-day notice previously 
published for this ICR and soliciting public comment concerning this 
ICR for an additional 30 days.

DATES: Comments are encouraged and will be accepted until July 18, 
2018.

ADDRESSES: Interested persons are invited to submit written comments on 
the proposed information collection to the Office of Information and 
Regulatory Affairs, OMB. Comments should be addressed to OMB Desk 
Officer, Department of Homeland Security, National Protection and 
Programs Directorate and sent via electronic mail to 
[email protected]. All submissions must include the words 
``Department of Homeland Security'' and the OMB Control Number 1670-
0029.
    Comments submitted in response to this notice may be made available 
to the public through relevant websites. For this reason, please do not 
include in your comments information of a confidential nature, such as 
sensitive personal information or proprietary information. Please note 
that responses to this public comment request containing any routine 
notice about the confidentiality of the communication will be treated 
as public comments that may be made available to the public 
notwithstanding the inclusion of the routine notice.
    Comments that include trade secrets, confidential commercial or 
financial information, Chemical-terrorism Vulnerability Information 
(CVI), Sensitive Security Information (SSI), or Protected Critical 
Infrastructure Information (PCII) should not be submitted to the public 
regulatory docket. Please submit such comments separately from other 
comments in response to this notice. Comments containing trade secrets, 
confidential commercial or financial information, CVI, SSI, or PCII 
should be appropriately marked and packaged in

[[Page 28245]]

accordance with applicable requirements and submitted by mail to the 
DHS/NPPD/IP/ISCD CFATS Program Manager at the Department of Homeland 
Security, 245 Murray Lane SW, Mail Stop 0610, Arlington, VA 20528-0610. 
Comments must be identified by OMB Control Number 1670-0029. The 
Department will forward all comments received by the submission 
deadline to the OMB Desk Officer.

FOR FURTHER INFORMATION CONTACT: Questions and requests for additional 
information may be directed to Amy Graydon or the CFATS Program Manager 
via email at [email protected] or telephone at (866) 323-2957.

SUPPLEMENTARY INFORMATION: On December 18, 2014, the President signed 
into law the Protecting and Securing Chemical Facilities from Terrorist 
Attacks Act of 2014, Public Law 113-254 (CFATS Act of 2014) providing 
long-term authorization for the Chemical Facility Anti-Terrorism 
Standards (CFATS) program. The CFATS Act of 2014 codified the 
Department's authority to implement the CFATS program into the Homeland 
Security Act of 2002. See 6 U.S.C. 621 et. seq.
    Section 550 of the Department of Homeland Security Appropriations 
Act of 2007, Public Law 109-295 (2006) (``Section 550''), provided (and 
the CFATS Act of 2014 continues to provide) the Department with the 
authority to identify and regulate the security of high-risk chemical 
facilities using a risk-based approach. On April 9, 2007, the 
Department issued the CFATS Interim Final Rule (IFR), implementing this 
statutory mandate. See 72 FR 17688.
    Section 550 required (and the CFATS Act of 2014 continues to 
require) that the Department establish risk-based performance standards 
(RBPS) for high-risk chemical facilities. Through the CFATS 
regulations, the Department promulgated 18 RBPS. Each chemical facility 
that has been finally determined by the Department to be high-risk must 
submit, for Department approval, a Site Security Plan (SSP) or an 
Alternative Security Program (ASP), whichever the high-risk chemical 
facility chooses, that satisfies each applicable RBPS. RBPS 12 requires 
high-risk chemical facilities to perform appropriate background checks 
on and ensure appropriate credentials for facility personnel, and, as 
appropriate, unescorted visitors with access to restricted areas or 
critical assets. RBPS 12(iv) specifically requires high-risk chemical 
facility to implement measures designed to identify people with 
terrorist ties. For the purposes of the CFATS Personnel Surety Program 
(PSP), `people' in RBPS 12(iv) is in reference to affected individuals 
(i.e., facility personnel or unescorted visitors with or seeking access 
to restricted areas or critical assets at high-risk chemical 
facilities).
    Identifying affected individuals who have terrorist ties is an 
inherently governmental function and requires the use of information 
held in government-maintained databases that are unavailable to high-
risk chemical facilities. See 72 FR 17688, 17709 (April 9, 2007). Thus, 
under RBPS 12(iv), the Department and high-risk chemical facilities 
must work together to satisfy the ``terrorist ties'' aspect of the 
Personnel Surety performance standard.
    In accordance with the Homeland Security Act of 2002, as amended by 
the CFATS Act of 2014, the following options are available to enable 
high-risk chemical facilities to facilitate the vetting of affected 
individuals for terrorist ties:
    Option 1. High-risk chemical facilities may submit certain 
information about affected individuals, which the Department will use 
to vet those individuals for terrorist ties. Specifically, the 
identifying information about affected individuals will be compared 
against identifying information of known or suspected terrorists 
contained in the Federal Government's consolidated and integrated 
terrorist watch list, the Terrorist Screening Database (TSDB), which is 
maintained by the Department of Justice (DOJ) Federal Bureau of 
Investigation (FBI) in the Terrorist Screening Center (TSC).\1\
---------------------------------------------------------------------------

    \1\ For more information about the TSDB, see DOJ/FBI-019 
Terrorist Screening Records System, last published in full as 77 FR 
26580 (May 25, 2017).
---------------------------------------------------------------------------

    Option 2. High-risk chemical facilities may submit information 
about affected individuals who already possess certain credentials or 
documentation that rely on security threat assessments conducted by the 
Department. This will enable the Department to verify the continuing 
validity of these credentials or documentation.
    Option 3. High-risk chemical facilities may comply with RBPS 12(iv) 
without submitting to the Department information about affected 
individuals who possess Transportation Worker Identification 
Credentials (TWICs), if a high-risk chemical facility electronically 
verifies and validates the affected individual's TWICs through the use 
of TWIC readers (or other technology that is periodically updated using 
the Canceled Card List).
    Option 4. High-risk chemical facilities may visually verify certain 
credentials or documents that are issued by a Federal screening program 
that periodically vets enrolled individuals against the TSDB. The 
Department continues to believe that visual verification has 
significant security limitations and, accordingly, encourages high-risk 
chemical facilities choosing this option to identify in their SSPs the 
means by which they plan to address these limitations.
    In addition to the options described above for satisfying RBPS 
12(iv), a high-risk chemical facility is welcome to propose alternative 
or supplemental options in its SSP that are not described in this 
document. The Department will assess the adequacy of such alternative 
or supplemental options on a facility-by-facility basis in the course 
of evaluating each facility's SSP.
    Under Option 3 and Option 4, a high-risk chemical facility would 
not need to submit information about an affected individual to the 
Department. These Options are only mentioned in this notice for 
informational purposes, and there will be no analysis of Option 3 and 
Option 4 in this information collection request.
    This information collection request does not propose changes to who 
qualifies as an affected individual. There are certain groups of 
persons that the Department does not consider to be affected 
individuals, such as (1) Federal officials that gain unescorted access 
to restricted areas or critical assets as part of their official 
duties; (2) state and local law enforcement officials that gain 
unescorted access to restricted areas or critical assets as part of 
their official duties; and (3) emergency responders at the state or 
local level that gain unescorted access to restricted areas or critical 
assets during emergency situations.
    OMB is particularly interested in comments that:
    1. Evaluate whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility;
    2. Evaluate the accuracy of the agency's estimate of the burden of 
the proposed collection of information, including the validity of the 
methodology and assumptions used;
    3. Enhance the quality, utility, and clarity of the information to 
be collected; and
    4. Minimize the burden of the collection of information on those 
who are to respond, including through the use of appropriate automated,

[[Page 28246]]

electronic, mechanical, or other technological collection techniques or 
other forms of information technology, e.g., permitting electronic 
submissions of responses.
    The current information collection for the CFATS PSP (IC 1670-0029) 
will expire on August 31, 2018.\2\
---------------------------------------------------------------------------

    \2\ The current information collection for CFATS Personnel 
Surety Program may be found at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201312-1670-001.
---------------------------------------------------------------------------

Summary of Proposed Revisions to the Information Collection

    The Department is seeking a revision to the CFATS PSP Information 
Collection to: (1) Obtain approval to collect information about 
affected individuals from all high-risk chemical facilities rather than 
only Tier 1 and Tier 2 high-risk chemical facilities; (2) update the 
estimated number of annual respondents from 195,000 to 72,607 based on 
historical information collected since the Department implemented the 
CFATS PSP; and (3) update the estimated time per respondent from 0.58 
hours to 0.1667 hours based upon historical data collected by the 
Department since the implantation of the CFATS PSP.

Collection at All High-Risk Chemical Facilities

    In response to multiple comments on the current ICR, the Department 
agreed to a ``phased implementation'' of the CFATS PSP to Tier 1 and 
Tier 2 high-risk chemical facilities. Based on lessons learned and the 
near completion of the implementation at Tier 1 and Tier 2 high-risk 
chemical facilities, the Department now seeks to close a security gap 
by implementing CFATS PSP at all high-risk chemical facilities. As 
implemented at Tier 1 and Tier 2 high-risk chemical facilities, the 
Department will roll out the CFATS PSP in a ``phased implementation'' 
to Tier 3 and Tier 4 high-risk chemical facilities.

Updates to Burden Estimate Based on Historical Information

    The Department implemented the CFATS PSP in December 2015. Since 
implementation, the Department has evaluated many of the assumptions it 
used when estimating the burden estimate of this Information 
Collection. As a result, several of the assumptions can be revised 
using actual data rather than assumptions. The burden methodology and 
revised estimates are described in, ``The Department's Methodology in 
Estimating the Burden for CFATS PSP Information Collection.''

Information Collected About Affected Individuals

    This information collection request does not propose changes to the 
information collected on affected individuals.

Option 1: Collecting Information To Conduct Direct Vetting

    If high-risk chemical facilities select Option 1 to satisfy RBPS 
12(iv) for an affected individual, the following information about the 
affected individual would be submitted to the Department:
     For U.S. Persons (U.S. citizens and nationals, as well as 
U.S. lawful permanent residents):
    [cir] Full Name;
    [cir] Date of Birth; and
    [cir] Citizenship or Gender.
     For Non-U.S. Persons:
    [cir] Full Name;
    [cir] Date of Birth;
    [cir] Citizenship; and
    [cir] Passport information and/or alien registration number.
    To reduce the likelihood of false positives in matching against 
records in the Federal Government's consolidated and integrated 
terrorist watchlist, high-risk chemical facilities would also be able 
to submit the following optional information about an affected 
individual to the Department:
     Aliases;
     Gender (for Non-U.S. Persons);
     Place of Birth; and/or
     Redress Number.\3\
---------------------------------------------------------------------------

    \3\ For more information about Redress Numbers, please go to 
https://www.dhs.gov/one-stop-travelers-redress-process#1.
---------------------------------------------------------------------------

    High-risk chemical facilities have the option to create and use the 
following field(s) to collect and store additional information to 
assist with the management of an affected individual's records. Any 
information collected in this field will not be used to support vetting 
activities.
     User Defined Field(s)
    Table 1 summarizes the biographic data that would be submitted to 
the Department under Option 1.

  Table 1--Required and Optional Data for an Affected Individual Under
                                Option 1
------------------------------------------------------------------------
Data elements submitted to the                           For a non-U.S.
          department              For a U.S. person          person
------------------------------------------------------------------------
Full Name.....................  Required.............
Date of Birth.................  Required.............
Gender........................  Must provide.........  Optional.
Citizenship...................  Citizenship or Gender  Required.
Passport Information and/or     N/A..................  Required.
 Alien Registration Number.
Aliases.......................  Optional.............
Place of Birth................  Optional.............
Redress number................  Optional.............
User Defined Field(s).........  Optional (Not used
                                 for vetting
                                 purposes).
------------------------------------------------------------------------

Option 2: Collecting Information To Use Vetting Conducted Under Other 
DHS Programs

    In lieu of submitting information to the Department under Option 1 
for vetting of terrorist ties, high-risk chemical facilities also have 
the option, where appropriate, to submit information to the Department 
to electronically verify that an affected individual is currently 
enrolled in another DHS program that vets for terrorist ties.
    To verify an affected individual's enrollment in one of these 
programs under Option 2, the Department would collect the following 
information about the affected individual:
     Full Name;
     Date of Birth; and
     Program-specific information or credential information, 
such as unique number or issuing entity (e.g., state for Commercial 
Driver's License [CDL] associated with an Hazardous Material 
Endorsement [HME]).
    To reduce the likelihood of false positives, high-risk chemical 
facilities may also submit the following optional

[[Page 28247]]

information about an affected individual to the Department:
     Aliases;
     Gender;
     Place of Birth; and/or
     Citizenship.
    High-risk chemical facilities have the option to create and use the 
following field(s) to collect and store additional information to 
assist with the management of an affected individual's records. Any 
information collected in this field will not be used to support vetting 
activities.
     User Defined Field(s)
    Table 2 summarizes the biographic data that would be submitted to 
the Department under Option 2.

  Table 2--Required and Optional Data for an Affected Individual Under
                                Option 2
------------------------------------------------------------------------
 
------------------------------------------------------------------------
                Data Elements Submitted to the Department
------------------------------------------------------------------------
Full Name.....................................  Required.
Date of Birth.................................  Required.
Program-specific information or credential      Required.
 information, such as expiration date, unique
 number, or issuing entity.
Aliases.......................................  Optional.
Gender........................................  Optional.
Place of Birth................................  Optional.
Citizenship...................................  Optional.
User Defined Field(s).........................  Optional (Not used for
                                                 vetting purposes).
------------------------------------------------------------------------

Other Information Collected

    The Department may also contact a high-risk chemical facility or 
its designees to request additional information (e.g., visa 
information) pertaining to an affected individual in order to clarify 
suspected data errors or resolve potential matches (e.g., an affected 
individual has a common name). Such requests will not imply, and should 
not be construed to indicate, that an affected individual's information 
has been confirmed as a match to a record of an individual with 
terrorist ties.
    The Department may also collect information provided by individuals 
or high-risk chemical facilities in support of any adjudication 
requests under Subpart C of the CFATS regulation,\4\ or in support of 
any other redress requests.\5\
---------------------------------------------------------------------------

    \4\ See 6 CFR 27.300-345.
    \5\ More information about access, correction, and redress 
requests under the Freedom of Information Act and the Privacy Act 
can be found in Section 7.0 of the Privacy Impact Assessment for the 
CFATS Personnel Surety Program, dated May 4, 2011, and available at 
https://www.dhs.gov/privacy-documents-national-protection-and-programs-directorate-nppd.
---------------------------------------------------------------------------

Responses to Comments Submitted During 60-Day Comment Period

    The Department solicited comments on four questions:
    (1) Evaluate whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility;
    (2) Evaluate the accuracy of the agency's estimate of the burden of 
the proposed collection of information, including the validity of the 
methodology and assumptions used;
    (3) Enhance the quality, utility, and clarity of the information to 
be collected; and
    (4) Minimize the burden of the collection of information on those 
who are to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques or 
other forms of information technology, e.g., permitting electronic 
submissions of responses.
    In response to the 60-Day Notice that solicited comments about the 
CFATS PSP ICR, the Department received twenty-seven comments from seven 
commenters. The seven commenters were all industry association.

Comments Related to Whether the Proposed Collection of Information Is 
Necessary for the Proper Performance of the Function of the Agency, 
Including Whether the Information Will Have Practical Utility

    Comment: Four commenters suggested that the Department conduct 
further assessments on the PSP:

    One commenter suggested that the Department ``should not expand 
the program until it can see the successes and failures it has with 
Tier 1 and Tier 2 facilities.'' Further, the commenter suggested a 
``formal assessment, in conjunction with the Department of Justice 
and the Federal Bureau of Investigation, on the benefits and 
positive outcomes of running PSP-gained information through the TSDB 
[Terrorist Screening Database]'' be conducted. The commenter also 
suggested that such a review could evaluate the effectiveness of the 
CFATS PSP and opportunities ``to make it more effective.''
    A second commenter encouraged the Department to ``examine the 
effectiveness of such screening before proceeding to subject the 
bulk of CFATS regulated facilities to these additional measures.'' 
The second commenter suggested the Department conduct a 
comprehensive evaluation, similar to the comprehensive evaluation 
the Transportation Security Administration (TSA) is conducting with 
respect to the Transportation Worker Identification Credentials 
(TWIC) Program,\6\ before determining whether to expand the CFATS 
PSP to Tier 3 and Tier 4 covered chemical facilities.
---------------------------------------------------------------------------

    \6\ See Section 1(b)(3) of Public Law 114-278, which may be 
viewed at https://www.congress.gov/bill/114th-congress/house-bill/710/text/pl?overview=closed.
---------------------------------------------------------------------------

    A third commenter referenced an ongoing Government 
Accountability Office (GAO) assessment of the CFATS program and 
speculated that the GAO assessment might review the implementation 
of the CFATS PSP. The commenter suggested that the Department could 
benefit from considering the results of the GAO assessment with 
respect ``to tailoring implementation of PSP for Tier 3 and 4 
facilities.'' The commenter also suggested that if the GAO 
assessment does not include a review of the CFATS PSP, the 
Department should undertake such an analysis. In conclusion, the 
same commenter suggested that the Department not expand the CFATS 
PSP to Tier 3 and Tier 4 covered chemical facilities until such an 
analysis has been conducted and the results used to inform the CFATS 
PSP ICR.
    A fourth commenter requested that the Department allow a third-
party review of the CFATS PSP after a suitable period of time has 
passed to determine if the program adds value to the security of the 
nation.

    Response: The Department does not believe that additional analysis 
is needed prior to OMB approving the collection of information 
concerning affected individuals from all covered chemical facilities. 
The Department has closely reviewed how Tier 1 and Tier 2 covered 
chemicals facilities have implemented the check for terrorist ties. 
Tier 1 and Tier 2 covered chemical facilities have varied by size, 
complexity, security issue, and location.

[[Page 28248]]

    Additionally, vetting for terrorist ties for all four tiers of 
covered facilities is required by CFATS. Members of the public 
commented on the CFATS rulemaking in 2007 before the regulation was 
finalized, and DHS considered all public comments (including comments 
about terrorist ties vetting and background checks) in coming to the 
reasoned decision to vet affected individuals for terrorist ties at all 
tiered facilities as part of the program. DHS disagrees that a 
modification to the program to eliminate this requirement for Tiers 3 
and 4 or to indefinitely delay its rollout in order to conduct 
additional analysis would be appropriate. Preventing terrorist access 
to high-risk chemical facilities' restricted areas and critical assets 
is a core purpose of CFATS, and failure to conduct terrorist ties 
checks may allow terrorist to gain access.
    Comment: One commenter reiterated its continued objection to the 
inclusion of railroad employees is within the scope of CFATS because 
the commenter claims that inclusion of railroad employees lacks a risk-
based justification.
    Response: Under CFATS, the Department regulates covered chemical 
facilities that present a high risk from terrorist attack. Effectively 
regulating chemical facility security involves assessing whether 
terrorists have access to facilities, and terrorists seeking access 
might not be limited to facility employees. To help reduce risk to 
high-risk facilities, the Department requires covered chemical 
facilities to conduct a check for terrorist ties on affected 
individuals (e.g., facility personnel and unescorted visitors) with or 
seeking access to restricted areas and critical assets. A covered 
chemical facility has the discretion to decide if they want to escort 
railroad employees as visitors, identify railroad employees as affected 
individuals, or treat them in some other way consistent with CFATS 
requirements. Identifying railroad employees as affected individuals 
would require a covered chemical facility to ensure that those 
personnel are screened for terrorist ties pursuant to 6 CFR 
27.230(a)(12).
    In ensuring affected individuals are screened for terrorist ties, 
the facility has the discretion to choose from four options for vetting 
affected individuals or propose alternatives or supplemental options in 
its SSP or ASP (See 82 FR 61312, 61316).\7\
---------------------------------------------------------------------------

    \7\ The Department described the options for screening for 
terrorist ties on page 82 FR 61313 of its 60-day notice which may be 
viewed at https://www.federalregister.gov/d/2017-27519/page-61313.
---------------------------------------------------------------------------

    Comment: One commenter highlighted the Department of Transportation 
(DOT) requirement at 49 CFR 172.802(a)(1) which states, ``Personnel 
security. Measures to confirm information provided by job applicants 
hired for positions that involve access to and handling of the 
hazardous materials covered by the security plan. . . .'' The commenter 
suggested that railroad employees having undergone such a background 
check and demonstrated their reliability by being stewards of the 
chemical during transit, should ``not suddenly seem suspect simply by 
crossing a fence line at a covered chemical facility.''
    Response: It is the Department's understanding that the sort of 
background checks discussed by the commenter do not include checks for 
terrorist ties. Checks for terrorist ties are required under CFATS (6 
CFR 27.230(a)(12)).

Comments Related to the Accuracy of the Agency's Estimate of the Burden 
of the Proposed Collection of Information, Including the Validity of 
the Methodology and Assumptions Used

    Comment: One commenter recognizes the assumptions that release 
facilities may have more affected individuals than theft and diversion 
facilities, that there are an average of 106 employees per facility, 
and that the time it takes to vet an affected individual may be valid, 
but states, ``it is not clear upon what information they [the 
assumptions] are based.''
    Response: The Department based the assumptions on historical data 
collected by the Department since the implementation of the CFATS PSP. 
Specifically, for the difference between release and theft and 
diversion facilities, the Department recognizes that high-risk chemical 
facilities for release security issues may take a facility-wide 
approach rather than an asset-based approach in defining their 
restricted areas, which may result in a higher number of affected 
individuals than theft and diversion facilities. Therefore, the 
Department reviewed the number of release sites to ensure the estimated 
number of respondents for the Tier 3 and Tier 4 high-risk chemical 
facilities were comparable to the historical data received by the 
Department since the implementation of the CFATS PSP. The Department 
found that the release security issues for Tier 1 and Tier 2 high-risk 
chemical facilities made up 38 percent of the total Tier 1 and Tier 2 
high-risk chemical facility population. For Tier 3 and Tier 4 high-risk 
chemical facilities, the release security issue made up 25 percent of 
the total Tier 3 and Tier 4 high-risk chemical facility population. 
Based on these findings, the Department is satisfied that the Tier 1 
and Tier 2 high-risk chemical facility historical data provided a valid 
representation of what the Department can expect from Tier 3 and Tier 4 
high-risk chemical facilities.
    Specifically for the 106 employees, the Department estimates that 
under this collection there are (a) 200 Tier 1 and Tier 2 high-risk 
chemical facilities that did submit or will have to submit information 
about affected individuals under the current ICR, and (b) 3,700 Tier 3 
and Tier 4 high-risk chemical facilities that will submit for the first 
time under this new collection. Historically, each Authorizer 
submitted, on average, 180 initial respondents, with each Authorizer 
responsible for 1.7 high-risk chemical facilities. Dividing 180 
affected individuals per Authorizer by 1.7 high-risk chemical 
facilities results in an average of 106 initial respondents submitted 
per high-risk chemical facility.
    The Department's estimate per respondent (affected individual) is 
based on industry feedback and historical data collected on their use 
of the CFATS PSP application. The Department has estimated the time per 
respondent to be 5 minutes per submission of a record about an affected 
individual. Since this estimate is based on current submissions from 
Tier 1 and Tier 2 high-risk chemical facilities, the Department has 
chosen an estimate of 10 minutes per record to provide a more 
conservative estimate.
    Comment: Two commenters expressed concern that the ICR did not 
appear to account for the burden associated with part-time or seasonal 
employees or contractors that qualify as affected individuals.
    Response: The Department's estimate of the number of affected 
individuals in the 60-day notice was based on actual data submitted by 
covered chemical facilities at which seasonal and part-time employees 
(to include contractors) are considered affected individuals. Thus, the 
Department concludes that the historical data relied upon in the 60-day 
notice incorporates seasonal and part-time employees.
    Comment: Three commenters felt the personal identifiable 
information collection is not ``usual and customary'':

    One commenter disagreed with the Department's decision to invoke 
5 CFR 1320.3(b)(2) to exclude ``certain activities and costs related 
to the PSP data collection process.'' The commenter suggested that 
two assumptions made by the Department are not accurate. 
Specifically, that (a) the Department's assumption that facilities

[[Page 28249]]

already possess the information necessary to submit under Option 1 
or Option 2 of the CFATS PSP; and (b) the Department's assumption 
that additional data collection is not required and there is no 
further burden imposed by this Information Collection beyond 
submitting the information to the Department under Option 1 or 
Option 2.
    A second commenter also objected to the exclusion of ``the time 
needed for a site security officer to manage data collection, 
submissions, and tracking'' under 5 CFR 1320.3(b)(2) which is 
similar to some of the examples provided by the first commenter.
    A third commenter expressed concern similar in nature that the 
estimated time per respondent does not appear to account for 
acquiring the necessary personal information to compare against the 
TSDB.

    Response: The Department evaluated each of the examples provided by 
the commenters. The Department's evaluation of the examples provided by 
the commenters are below:

    i. The Department considered whether the CFATS PSP ICR should be 
revised to account for the burden associated with coordinating with 
CFATS-facility stakeholders, including Human Resources, Procurement, 
and/or Contract Administration to explain the PSP requirements and 
determine how best to gather the data from different populations 
(e.g., employees and resident and non-resident contractors). One 
commenter clarified elsewhere in its comments that the coordination 
included creating separate groups \8\ and ``PSP Submitter [user] 
accounts for each contract company, which may include hundreds of 
different contract companies in cases where a large facility is 
tiered for a release security issue.'' After considering the 
comment, the Department did not revise the CFATS PSP ICR because 
this burden is properly accounted for under a separate and different 
ICR. The establishment of Chemical Security Assessment Tool (CSAT) 
accounts, such as a PSP Submitter, and the assignment of such 
accounts to ``groups'' is covered under Information Collection 1670-
0007.\9\
---------------------------------------------------------------------------

    \8\ The term ``groups'' is a technical term used by the 
Department to describe how a covered chemical facility may manage 
the access to records about affected individuals in the CSAT 
Personnel Surety application. The Department describes ``groups'' 
and provides additional information about how to create and manage 
``groups in section 9.5 of the CSAT User Manual which may be viewed 
at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.
    \9\ Information Collection 1670-0007 was approved by OMB on July 
14, 2016. The Notice of Action and Information Collection 1670-0007 
may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.
---------------------------------------------------------------------------

    ii. The Department considered whether the CFATS PSP ICR should 
be revised to account for the burden associated with ``developing 
and providing communications, Privacy Act notices, and data 
collection forms to affected individuals.'' After considering the 
comment, the Department did not revise the CFATS PSP ICR because, as 
described earlier in this notice, this burden is already accounted 
for in the 10 minutes per respondent burden estimate.
    iii. The Department considered whether the CFATS PSP ICR should 
be revised to account for the burden associated with ``ensuring that 
all affected individuals provide the necessary [personally 
identifiable information] PII--and following up with those that do 
not.'' After considering the comment, the Department did not revise 
the CFATS PSP ICR. The collection of data from affected individuals 
by a covered chemical facility or its designees is excluded under 5 
CFR 1320.3(b)(2).
    iv. The Department considered whether the CFATS PSP ICR should 
be revised to account for the burden associated with ``training 
personnel to use the CSAT PSP application.'' After considering the 
comment, the Department did not revise the CFATS PSP ICR because the 
burden is properly accounted for under Information Collection 1670-
0007.
    v. The Department considered whether the CFATS PSP ICR should be 
revised to account for the burden associated with ``ensuring change 
management (e.g., once the initial data is gathered and uploaded, 
the facility still must account for new hires and new contractors--
and further incorporate this into the facility access process).'' 
After considering the comment, the Department did not revise the 
CFATS PSP ICR because the burden is already accounted for in this 
ICR (See 82 FR 61312, 61316).\10\ The Department laid out the 
expectations to submit both existing affected individuals as well as 
new affected individuals in the ICR notices associated with the 
current Information Collection and in the CFATS PSP Implementation 
Notice. The clear expectation for covered chemical facilities to 
submit new affected individuals is therefore inherently a part of 
the actual historical data upon which the Department relied in the 
60-day notice.
---------------------------------------------------------------------------

    \10\ The Department described its assumptions, to include 
updates and corrections, about the estimated time per respondent on 
page 82 FR 61316 of its 60-day notice which may be viewed at https://www.federalregister.gov/d/2017-27519/page-61316.

    Comment: One commenter suggested that the CFATS PSP is being 
implemented on a facility-by-facility basis rather than a company-wide 
basis, which encourages duplicative processes for information 
collection and vetting and dramatically increases the burdens on 
railroads serving more than one company location.
    Response: The Department has designed the CFATS Program as a whole, 
and the CFATS PSP in particular, to allow for a company-wide approach. 
This has been mentioned in previous notices \11\ and can be found in 
current program guidance and resources.\12\ Some companies have opted 
to implement a company-wide approach to the PSP while others have not. 
The design of the CFATS PSP and this ICR allows each company with 
multiple covered chemical facilities to choose for itself whether or 
not, or to what degree, to adopt a company-wide approach under CFATS.
---------------------------------------------------------------------------

    \11\ The possibility of a company-wide approach is mentioned in: 
(1) The CFATS PSP 30-Day notice and request for comments published 
on February 3, 2014 at 79 FR 6422 that may be viewed at https://www.federalregister.gov/d/2014-02082/page-6422, and (2) the CFATS 
PSP 60-Day notice and request for comments published on March 22, 
2013 at 78 FR 17684 that may be viewed at https://www.federalregister.gov/d/2013-06184/page-17684.
    \12\ The Department describes the potential for a company-wide 
approach in CFATS PSPImplementation Notice published on December 18, 
2015 at 80 FR 79064 that may be viewed at https://www.federalregister.gov/d/2015-31625/page-79064.
---------------------------------------------------------------------------

    Comment: One commenter expressed concern that the estimated time 
per respondent of five minutes ``does not appear to include the 
additional time necessary to notify employees of the PSP requirement, 
obtain consent . . .''
    Response: As previously discussed, the Department did not revise 
the CFATS PSP ICR because this burden is already accounted for in the 
10 minutes per respondent burden estimate.
    Comment: One commenter is concerned with the time it takes 
Authorizer to create CSAT accounts for contractors.
    Response: The Department accounts for the burden related to the 
creation of CSAT accounts for contractors under Information Collection 
1670-0007.\13\
---------------------------------------------------------------------------

    \13\ Information Collection 1670-0007 was approved by OMB on 
July 14, 2016. The Notice of Action and Information Collection 1670-
0007 may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.
---------------------------------------------------------------------------

Comments Related to the Quality, Utility, and Clarity of the 
Information To Be Collected

    The Department did not receive any comments related to the quality, 
utility, and clarity of the information to be collected.

Comments Related To Minimizing the Burden of the Collection of the 
Information on Those Who Are To Respond, Including Through the Use of 
Appropriate Automated, Electronic Mechanical, or Other Technological 
Collection Techniques or Other Forms of Information Technology, e.g., 
Permitting Electronic Submissions of Responses

    Comment: Two commenters suggested that the Department use a 
flexible approach in the rollout:
    One commenter requested a phased roll out of the CFATS PSP to Tier 
3 and Tier 4 covered chemical facilities.
    A second commenter ``appreciate[d] that DHS is proposing to roll 
out these requirements in a phased method . . .'' The same commenter 
also encouraged the Department to consider a ``site's various risk 
factors, including location, number of employees, types and

[[Page 28250]]

volumes of chemicals of interest, and likely offsite incident 
consequences'' when planning the phased-in approach.
    Response: The Department agrees that a flexible approach is 
appropriate for the rollout of the PSP to Tier 3 and Tier 4 covered 
chemical facilities. If approved, the Department plans to implement the 
CFATS PSP in a phased manner to Tier 3 and Tier 4 covered chemical 
facilities over a three year period. Similar to the successful and 
recent retiering effort, the Department plans to consider the number of 
facilities assigned to a single Authorizer when notifying facilities to 
implement the PSP, as not to overwhelm a single Authorizer. The 
Department will also allow the flexibility for Authorizers, if desired, 
to complete the process for their facilities before notification by the 
Department.
    Comment: One commenter suggested that the Department has downplayed 
the use of ``existing options'' that could lessen the burdens on third-
party service providers, such as railroads, that employ affected 
individuals as defined by the covered chemical facility. The commenter 
suggested that one such ``existing option'' is real-time video 
monitoring as a means of escort.
    Response: The Department has explicitly mentioned in multiple 
notices associated with this Information Collection (see 79 FR 6418, 
6420) and in CFATS PSP resources the possibility of innovative 
escorting alternatives such as video monitoring. The Department has 
also worked with facilities to identify other alternatives for a 
covered chemical facility to limit who is an affected individual. 
Furthermore, the Department provided the following guidance to covered 
chemical facilities in the CFATS PSP Implementation Notice: \14\
---------------------------------------------------------------------------

    \14\ This specific text from the CFATS Personnel Surety Program 
Implementation Notice may be found on 80 FR 79060 and can be viewed 
at https://www.federalregister.gov/d/2015-31625/page-79060.
---------------------------------------------------------------------------

    ``A high-risk chemical facility will have flexibility to tailor its 
implementation of the CFATS Personnel Surety Program to fit its 
individual circumstances and, in this regard, to best balance who 
qualifies as an affected individual, unique security issues, costs, and 
burden. For example, a high-risk chemical facility may, in its Site 
Security Plan:
     Restrict the numbers and types of persons allowed to 
access its restricted areas and critical assets, thus limiting the 
number of persons who will need to be checked for terrorist ties.
     Define its restricted areas and critical assets, thus 
potentially limiting the number of persons who will need to be checked 
for terrorist ties.
     Choose to escort visitors accessing restricted areas and 
critical assets in lieu of performing terrorist ties background checks 
under the CFATS Personnel Surety Program. The high-risk chemical 
facility may propose in its SSP traditional escorting solutions and/or 
innovative escorting alternatives such as video monitoring (which may 
reduce facility security costs), as appropriate, to address the unique 
security risks present at the facility [emphasis added].''
    Comment: One commenter urged the Department to not include 
additional pre-conditions to the CFATS PSP that would preclude covered 
chemical facilities from leveraging the background checks performed in 
compliance with the Bureau of Alcohol, Tobacco, Firearms, and 
Explosives (ATF) Employee Possessor Program under Option 4.
    Response: The Department has not modified the CFATS PSP to preclude 
a covered chemical facility from the potential of leveraging the 
vetting conducted by ATF under Option 4 for affected individuals who 
possess a Federal explosives license/permit.
    Comment: One commenter requested that the Department modify CSAT to 
allow designated employees such as human resource professionals the 
ability to upload and edit information about affected individuals 
without having to access CVI.
    Response: The Department currently provides the ability to restrict 
human resource professionals from accessing CVI in CSAT. If a user is 
designated as only a Personnel Surety Submitter and is not assigned any 
other facility roles, they are not able to access the CVI 
documentation.

Other Comments Submitted in Response to the Information Collection 
Request

    Comment: One commenter suggested that compliance with the CFATS PSP 
exposes railroad employee PII and exacerbates cyber-security risk.
    Response: The Department disagrees with the commenter that the 
CFATS PSP exposes PII and exacerbates cyber security risk. If (1) a 
covered chemical facility opts to identify the employee of a third-
party service provider as an affected individual, and (2) a covered 
chemical facility opts to implement Option 1 or Option 2 in their SSP 
or ASP then the Department has designed the CSAT Personnel Surety 
Program Application to allow third-party companies, such as a railroad, 
to be granted access to the CSAT Personnel Surety Application for the 
express purpose of submitting information about affected individuals 
directly to the Department.
    If a covered chemical facility opts to implement Option 3 or Option 
4, information about affected individuals is not submitted to the 
Department. Option 3 allows high-risk chemical facilities to comply 
with the PSP by electronically verifying and validating the affected 
individual's TWICs through the use of TWIC readers. Option 4 provides 
high-risk chemical facilities with the option to visually verify 
certain credentials or documents that are issued by a Federal screening 
program that periodically vets enrolled individuals against the TSDB.
    Comment: One commenter suggested that the Department ``has 
encouraged covered chemical facilities to collect information that 
exceeds the legal requirements.''
    Response: The Department outlined in the ICR all data elements and 
identified the ones that are required for a submission under Option 1 
or Option 2. While the minimum data is sufficient, it is the considered 
judgement of the Department that additional information reduces the 
likelihood of false positives in matching against records in the 
federal government's consolidated and integrated terrorist watchlist. 
Although helpful in reducing false positives, this additional 
information is optional.
    Comment: Two commenters made suggestions as it relates to the 
consistency of inspections:
    One commenter requested that the Department ``work with facilities 
that have already been inspected to make sure inspections are being 
handled in a consistent fashion.''
    A second commenter reported that there are ``many regional 
inconsistencies in how inspectors conduct inspections within a 
region.''
    Response: Although this comment is outside the scope of the 
information collect request, DHS agrees and continues to work to ensure 
inspection consistency across the country.
    Comment: One industry association commented that any updates to the 
CFATS regulation should be flexible and tangible for facility 
compliance.
    Response: This information collection request does not modify 
existing regulations.
    Comment: One commenter suggested that a contradiction exists 
between the CFATS PSP and the railroads compliance with DOT 
regulations.
    Response: The Department disagrees with the commenter. If a covered 
chemical facility opts to identify a railroad employee as an affected 
individual, the performance of railroads

[[Page 28251]]

with respect to complying with DOT regulations, does not materially 
alter the fact that a railroad employee is an affected individual. 
Covered chemical facilities must ensure that affected individuals have 
appropriate background checks performed, to include a check for 
terrorist ties. This ICR allows covered chemical facilities, and their 
service providers that employ affected individuals, an opportunity to 
enable a check for terrorist ties to be performed against the TSDB.
    Comment: One commenter stated that the CFATS PSP, as currently 
designed, ``does not take into consideration that Tier 3 and 4 
facilities present a comparatively lower risk profile than Tier 1 and 2 
sites.'' The commenter suggested that the Department acknowledge the 
lower risk profile of Tier 3 and Tier 4 covered chemical facilities and 
not require them to comply with 6 CFR 27.230(a)(12)(iv). The commenter 
requested that Tier 3 and Tier 4 covered chemical facilities still be 
allowed to voluntarily participate.
    Response: The Department believes that 6 CFR 27.230(a)(12)(iv) 
mitigates the risk of an individual with terrorist ties having insider 
access. Terrorist insiders could cause significant harm to the United 
States through access to any tiered chemical facility. To achieve the 
anti-terrorism objective of CFATS, it is necessary to mitigate this 
risk by conducting terrorist ties checks at all covered facilities. 
RBPS 12 accordingly requires terrorist ties checks for facilities of 
all four tiers.
    Comment: One commenter questioned the effectiveness of the CFATS 
PSP if ``absent a clear national security, homeland security, or law 
enforcement rationale . . . DHS does not follow-up with the company to 
alert it of the possible threat.'' The commenter further stated that 
the ``value of conducting TSDB screening is questionable if an 
identified bad actor is permitted continued access to [chemicals of 
interest] unbeknownst to the facility, which is in the best position to 
ensure that the person is not afforded that opportunity.''
    Response: The Department's design of the CFATS Program is intended 
to promote and enhance the security of high-risk chemical facilities; 
the PSP is one element of the larger CFATS Program. To prevent a 
significant threat to a facility or loss of life, a high-risk chemical 
facility will be contacted where appropriate and in accordance with 
federal law and policy, and per law enforcement and intelligence 
requirements.

The Department's Methodology in Estimating the Burden for the CFATS PSP

    This 30-day notice relies on the analysis and resulting burden 
estimates in the 60-day notice for this instrument.

Analysis

Title: Chemical Facility Anti-Terrorism Standards (CFATS) Personnel 
Surety Program.
OMB Number: 1670-0029.
Instrument: CFATS Personnel Surety Program.
Frequency: ``Other.''
Affected Public: Business or other for-profit.
Number of Annual Respondents: 72,607 respondents (estimate).
Estimated Time per Respondent: 0.1667 hours (10 minutes).
Total Annual Burden Hours: 12,101 hours.
Total Annual Burden Cost (capital/startup): $1,719,409.
Total Annual Burden Cost: $955,191.
Total Recordkeeping Burden: $0.

David Epperson,
Chief Information Officer.
[FR Doc. 2018-12523 Filed 6-15-18; 8:45 am]
 BILLING CODE 9110-9P-P