Request To Revise and Extend the Chemical Security Assessment Tool (CSAT) Information Collection Under the Paperwork Reduction Act, 79337-79341 [2022-28076]

Download as PDF Federal Register / Vol. 87, No. 247 / Tuesday, December 27, 2022 / Notices and distribution and dissemination of flood insurance rate maps and risk data; and (b) performance metrics and milestones required to effectively and efficiently map flood risk areas in the United States; (2) mapping standards and guidelines for (a) flood insurance rate maps, and (b) data accuracy, data quality, data currency, and data eligibility; (3) how to maintain, on an ongoing basis, flood insurance rate maps and flood risk identification; (4) procedures for delegating mapping activities to State and local mapping partners; and (5) (a) methods for improving interagency and intergovernmental coordination on flood mapping and flood risk determination, and (b) a funding strategy to leverage and coordinate budgets and expenditures across Federal agencies. Furthermore, the TMAC is required to submit an annual report to the FEMA Administrator that contains: (1) a description of the activities of the Council; (2) an evaluation of the status and performance of flood insurance rate maps and mapping activities to revise and update Flood Insurance Rate Maps; and (3) a summary of recommendations made by the Council to the FEMA Administrator. Agenda: The purpose of this meeting is for the TMAC members to discuss and vote on the content of the 2023 TMAC Annual Report Outline. Any related materials will be available upon request prior to the meeting to provide the public an opportunity to review the materials. The full agenda and related meeting materials will be available upon request by Tuesday, January 17, 2023. To receive a copy of any relevant materials, please send the request to: FEMA-TMAC@fema.dhs.gov (Attn: Brian Koper). Michael M. Grimm, Assistant Administrator for Risk Management, Federal Emergency Management Agency. [FR Doc. 2022–28140 Filed 12–23–22; 8:45 am] BILLING CODE 9110–12–P DEPARTMENT OF HOMELAND SECURITY TKELLEY on DSK125TN23PROD with NOTICES [Docket No. CISA–2022–0018] Request To Revise and Extend the Chemical Security Assessment Tool (CSAT) Information Collection Under the Paperwork Reduction Act Cybersecurity and Infrastructure Security Agency, DHS. ACTION: 60-Day notice and request for comments. AGENCY: VerDate Sep<11>2014 22:43 Dec 23, 2022 Jkt 259001 The Infrastructure Security Division (ISD) within the Cybersecurity and Infrastructure Security Agency (CISA) will submit the following Information Collection Request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995. This notice solicits comments on the information collection during a 60-day public comment period prior to the submission of this ICR to OMB. The submission proposes to revise the information collection for an additional three years and update the burden estimates associated with collecting information in the Chemical Security Assessment Tool (CSAT) for the Chemical Facility Anti-Terrorism Standards (CFATS) Program. DATES: Comments are due by February 27, 2023. ADDRESSES: You may send comments, identified by docket number through the Federal eRulemaking Portal: https:// www.regulations.gov. Follow the instructions for sending comments. Instructions: All submissions received must include the agency name ‘‘CISA’’ and docket number CISA–2022–0018. All comments received will be posted without change to https:// www.regulations.gov, including any personal information provided. Comments that include protected information such as trade secrets, confidential commercial or financial information, Chemical-terrorism Vulnerability Information (CVI),1 Sensitive Security Information (SSI),2 or Protected Critical Infrastructure Information (PCII) 3 should not be submitted to the public docket. Comments containing protected information should be appropriately marked and packaged in accordance with all applicable requirements and submission must be coordinated with the point of contact for this notice provided in FOR FURTHER INFORMATION CONTACT section. FOR FURTHER INFORMATION CONTACT: Ryan Donaghy, 703–603–5000, CISARegulations@cisa.dhs.gov. SUPPLEMENTARY INFORMATION: The CFATS Program identifies chemical facilities of interest and regulates the security of high-risk chemical facilities SUMMARY: 1 For more information about CVI see 6 CFR 27.400 and the CVI Procedural Manual at www.dhs.gov/publication/safeguarding-cvi-manual. 2 For more information about SSI see 49 CFR part 1520 and the SSI Program web page at www.tsa.gov/ for-industry/sensitive-security-information. 3 For more information about PCII see 6 CFR part 29 and the PCII Program web page at www.dhs.gov/ pcii-program. PO 00000 Frm 00065 Fmt 4703 Sfmt 4703 79337 through a risk-based approach. The CFATS Program is authorized under the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 or ‘‘CFATS Act of 2014.4 CISA collects the core regulatory data necessary to implement CFATS through the Chemical Security Assessment Tool (CSAT) covered under this collection. For more information about CFATS and CSAT, please visit www.dhs.gov/ chemicalsecurity. This information collection (OMB Control No. 1670– 0007) will expire on July 31, 2023.5 Below, CISA estimates the burden to respondents for the: (1) Top-Screen, (2) Security Vulnerability Assessment (SVA) and Alternative Security Program (ASP) submitted in lieu of an SVA, (3) Site Security Plan (SSP) and ASP submitted in lieu of an SSP, (4) CFATS Help Desk, (5) CSAT User Registration, and (6) Identification of Facilities and Assets at Risk.6 1. CISA’S Methodology in Estimating the Burden for the Top–Screen Number of Respondents: The current information collection estimated that 2,332 respondents will submit a TopScreen annually. For this ICR, CISA estimates the annual number of respondents will be 3,817. The estimate of 3,817 is the sum of the average number of 887 first-time Top-Screen submissions and the average number of 2,930 Top-Screen resubmissions received per year between Calendar Year (calendar year)19 and CY21 (887 first time submissions + 2,930 resubmissions = 3,817). Estimated Time per Respondent: In the current information collection, the estimated time per respondent to prepare and submit a Top-Screen is 1.09 hours. For this ICR, CISA estimates the time per respondent to prepare and submit a Top-Screen will be 2.04 hours. Using the data collected between CY19 and CY21, CISA obtained the estimate of 2.04 hours by first determining the average amount of time respondents were logged into the TopScreen application (0.408 hours or 24.5 minutes). CISA calculated this figure by 4 The CFATS Act of 2014 codified the CFATS program into the Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended by Public Law 116–135, Sec. 16007 (2020). 5 The currently approved version of this information collection (OMB Control No. 1670– 0007) can be viewed athttps://www.reginfo.gov/ public/do/PRAViewICR?ref_nbr=201905-1670-001. 6 Throughout this analysis, CISA presents rounded hourly time burden estimates and hourly compensation rates to assist in reproducing the results. However, CISA’s actual calculations use unrounded figures; consequently, some reproduced results may not exactly match the reported results. E:\FR\FM\27DEN1.SGM 27DEN1 79338 Federal Register / Vol. 87, No. 247 / Tuesday, December 27, 2022 / Notices TKELLEY on DSK125TN23PROD with NOTICES using the time logged in the application for initial Top-Screens (.50 hours) and Top-Screen resubmission (.38 hours) weighted by the number of respondents that submitted first-time Top-Screens and Top-Screen resubmissions [(887 first-time submissions × 0.50 hours per first time submission) + (2,930 resubmissions × 0.38 hours per resubmission) ÷ 3,817 total submissions = 0.408 hours]. CISA maintains its assumption, based on previous public comments on this information collection, that for every hour a respondent is logged into the Top-Screen application, the respondent spends an average of 4 hours in preparation.7 Therefore, based on the 0.408 hours average log in time for the Top-Screen application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to submit a Top-Screen was 2.04 hours [0.408 hours logged into CSAT + (0.408 hours × 4) for preparation = 2.04 hours]. Annual Burden Hours: The annual burden hours for the Top-Screen is 7,785 hours (3,817 respondents × 1 response per respondent × 2.04 hours per response = 7,785 hours). Total Annual Burden Cost: CISA assumes that Site Security Officers (SSOs) are responsible for submitting Top-Screens. For this ICR, CISA maintains this assumption. To estimate the total annual burden, CISA multiplied the annual burden of 7,785 hours by the average hourly total compensation rate of SSOs of $90.41 8 per hour. Therefore, the total annual burden cost for the Top-Screen is $703,829 (i.e., 7,785 hours multiplied by $90.41 per hour). Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that no 7 CISA’s adoption of the assumption that for every hour a respondent is logged into the Top-Screen application, SVA/ASP application, and SSP/ASP application, the respondent spends an average of 4 hours in preparation is described in the 30-day notice the Department published for this information collection in March 2013 at 78 FR 16694, which may be viewed at https:// www.federalregister.gov/d/2013-06095. 8 Mean hourly wage was obtained from U.S. Department of Labor, BLS; May 2021 Occupational Employment and Wage Statistics, OES Managers, All Other. (Occupational Code 11–9199). Retrieved from https://www.bls.gov/oes/2021/may/oes_ nat.htm. of $62.36 times the wage rate benefit multiplier of 1.4499 (to account for fringe benefits) equaling $90.4141. The benefits multiplier is estimated by dividing total compensation of $40.35 by salaries and wages of $27.83, based on Employer Cost for Employee Compensation, December 2021, released March 18, 2022 (https://www.bls.gov/ news.release/archives/ecec_03182022.pdf). VerDate Sep<11>2014 22:43 Dec 23, 2022 Jkt 259001 capital/startup costs are associated with this instrument. Total Recordkeeping Burden A respondent that has submitted a TopScreen may or may not be determined by CISA to present a high level of security risk. Only respondents that present a high level of security risk are required to keep records mandated by CFATS (i.e., facilities that tier into the CFATS program). For respondents that are determined to present a high level of security risk, the Top-Screen recordkeeping burden is accounted for within the recordkeeping burden estimate for the ‘‘Site Security Plan (SSP) and Alternative Security Program (ASP) submitted in lieu of an SSP’’ instrument discussed later in this notice in subsection 3, hereafter, referred to as the ‘‘SSP/ASP.’’ The recordkeeping burden estimate for the SSP/ASP instrument accounts for all records respondents are required to maintain under CFATS because CISA assumes that respondents maintain their Top-Screen records in the same manners, formats, and locations as they maintain their other required records. Therefore, CISA estimates that no recordkeeping burden is associated with this instrument. 2. CISA’S Methodology in Estimating the Burden for the Security Vulnerability Assessment (SVA) & Alternative Security Program (ASP) Submitted in Lieu of an SVA Number of Respondents: The current information collection estimated that each year 1,683 respondents would complete an SVA or ASP in lieu of an SVA, hereafter, referred to as an ‘‘SVA/ ASP.’’ For this ICR, CISA estimates that the annual number of respondents will be 2,328, which is based on sum of the average number of SVA/ASP submissions and resubmissions between CY19 and CY21. This consists of an average of 209 first-time SVA/ASPs and 2,119 resubmitted SVA/ASPs per year. Estimated Time per Respondent: The current information collection estimated the time per respondent for preparing and submitting an SVA/ASP to be 1.24 hours. For this ICR, CISA estimates the time per respondent for preparing and submitting an SVA/ASP will be 1.4136 hours. Using the data collected between CY19 and CY 21, CISA obtained the estimate of 1.4136 hours by first determining the median amount of time respondents were logged into the SVA/ ASP application (0.28 hours or 17 minutes). CISA calculated the average amount of time respondents were logged into the SVA/ASP application by using the median duration respondents were PO 00000 Frm 00066 Fmt 4703 Sfmt 4703 logged into the CSAT SVA/ASP application for an initial SVA/ASP (0.783 hours or 47 minutes) and an SVA/ASP resubmission (0.233 hours or 14 minutes) weighted by the number of respondents that submitted first-time SVAs/ASPs and SVA/ASP resubmissions between CY19 and CY21 which was 0.28 hours 9 [(209 first-time submissions × 0.783 hours) + (2,119 resubmissions × 0.233 hours) ÷ 2,328 total submissions = 0.28 hours]. CISA maintains its assumption, based on previous public comments on this information collection, that for every hour a respondent is logged into the SVA/ASP application, the respondent spends an average of 4 hours in preparation. Therefore, based on the 0.28 hours average log in time for the CSAT SVA/ASP application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to prepare and submit an SVA/ASP was 1.4136 hours 10 [ 0.28 hours logged into CSAT + (0.28 hours × 4) for preparation]. Annual Burden Hours: The annual burden hours for an SVA/ASP is 3,291 hours 11 (2,328 respondents × 1 response per respondent × 1.4136 hours per response = 3,291 hours). Total Annual Burden Cost: CISA assumes that SSOs will be responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 3,291 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.12 Therefore, the total annual burden cost for the SVA/ASP is $297,530 (i.e., 3,291 hours multiplied by $90.41 per hour). Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs for this instrument. Total Recordkeeping Burden: For respondents that are determined by CISA to present a high level of security risk, the SVA/ASP recordkeeping burden is accounted for within the recordkeeping burden estimate for the SSP/ASP discussed below in Subsection 3 of this section. Therefore, CISA estimates that no recordkeeping burden is associated with this instrument. 9 0.28271 hours. hours = 0.2827 hours + 1.1308 hours. 11 3,290.75 hours. 12 $90.4142 is the hourly labor costs, including wages and benefits. 10 1.4136 E:\FR\FM\27DEN1.SGM 27DEN1 Federal Register / Vol. 87, No. 247 / Tuesday, December 27, 2022 / Notices TKELLEY on DSK125TN23PROD with NOTICES 3. CISA’S Methodology in Estimating the Burden for the Site Security Plan (SSP) & Alternative Security Program (ASP) Submitted in Lieu of an SSP Number of Respondents: The current information collection estimated 1,683 SSP/ASP respondents. For this ICR, the Department maintains the assumption that all respondents to the SVA/ASP will be a respondent of the SSP/ASP. Therefore, CISA estimates that the annual number of respondents will be 2,328, which is based on the average number of all respondents to the SVA/ ASP. This number breaks down to, on average, 209 initial submissions and 2,119 resubmissions per year. Estimated Time per Respondent: The current information collection estimated the time per respondent for preparing and submitting an SSP/ASP to be 2.72 hours. For this ICR, CISA estimates the time per respondent for preparing and submitting an SSP/ASP will be 7.845 hours. CISA intends to make a revision to the SSP/ASP instrument to collect facility internet Protocol (IP) address(es) and Domain Name System (DNS) information. The collection of IP address(es) and DNS information supports the development of a facility’s SSP in accordance with 6 U.S.C. 622 (a)(2)(D)(ii) and 6 CFR 27.225(a)(4). In addition, CISA may potentially use this information to integrate with other data within the U.S. Government, conduct related analysis, and provide warnings about cyber threats affecting chemical facilities. CISA expects that answering these questions will not meaningfully increase the estimated SSP/ASP completion time. Using the data collected between CY 19 and CY 21, CISA obtained the estimate of 7.845 hours by first determining the average amount of time respondent were logged into the SSP/ ASP application (1.5689 hours or 94 minutes). CISA calculated the average amount of time respondents were logged into the SSP/ASP application by using the median duration respondents were logged into the SSP/ASP application for an initial SSP/ASP (4.63 hours or 278 minutes) and an SSP/ASP resubmission (1.27 hours or 76 minutes) weighted by the number of respondents that submitted first-time SSPs/ASPs and SSP/ASP resubmissions between CY19 and CY21, which was 1.5689 hours (94 minutes) [ (209 first-time submissions × 4.6333 hours) + (2,119 resubmissions × 1.2666 hours) ÷ 2,328 total submissions = 1.5689 hours]. CISA maintains its assumption, based on previous public comments on this information collection, that for every VerDate Sep<11>2014 22:43 Dec 23, 2022 Jkt 259001 hour a respondent is logged into the SSP/ASP application, the respondent spends an average of 4 hours in preparation. Therefore, based on the 1.57 hours average log in time for the CSAT SSA/ASP application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to prepare and submit an SSP/ASP was 7.845 hours [1.5689 hours logged into CSAT + (1.5689 hours × 4) for preparation]. Annual Burden Hours: The annual burden hours for SSPs/ASPs is 18,262 hours (2,328 respondents × 1 response per respondent × 7.845 hours per response). Total Annual Burden Cost: CISA assumes that SSOs will be responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 18,262 hours by the average hourly total compensation rate of SSOs of $90.41 per hour 13. Therefore, the total annual burden cost for the SVA/ ASP is $ 1,651,158 (i.e., 18,262 hours multiplied by $90.41 per hour). Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs. Total Recordkeeping Burden: The current information collection estimated a recordkeeping burden of approximately $516,825. For this information collection, CISA estimates a recordkeeping burden of $556,040. CISA maintained the methodology and assumptions described in the current information collection but increased the current estimate to account for updating the hourly compensation rates 14 to $44.18 and inflating the 2017 ICR renewal capital/startup costs by an inflation factor 15 of 1.09. For this ICR, CISA maintains its approach of accounting for the entire 13 $90.4142 is the hourly labor costs, including wages and benefits. 14 Mean hourly wage was obtained from U.S. Department of Labor, BLS; May 2021 Occupational Employment and Wage Statistics, OES First-Line Supervisors of Office and Administrative Support Workers, (Occupational Code 43–1011). Retrieved from https://www.bls.gov/oes/2021/may/oes_ nat.htm. of $30.47 times the wage rate benefit multiplier of 1.4499 (to account for fringe benefits) equaling $44.177. The benefits multiplier is estimated by dividing total compensation of $40.35 by salaries and wages of $27.83, based on Employer Cost for Employee Compensation, December 2021, released March 18, 2022 (https://www.bls.gov/ news.release/archives/ecec_03182022.pdf). 15 Federal Reserve Bank of St. Louis, Federal Reserve Economic Data, GDP factor from 2017 to 2021 dollars was 1.0975 = 113.0664÷103.02 https:// fred.stlouisfed.org/series/USAGDPDEFAISMEI. PO 00000 Frm 00067 Fmt 4703 Sfmt 4703 79339 recordkeeping burden imposed on covered chemical facilities under CFATS within the SSP/ASP instrument, because: (1) only covered chemical facilities are required to maintain records; (2) no changes to the recordkeeping requirements have occurred since the approval of the current information collection; and (3) CISA’s historical assumption that respondents maintain any other required records in the same manners, formats, and locations as they maintain their SSP/ASP records. 4. CISA’S Methodology in Estimating the Burden for the CFATS Help Desk Number of Respondents The current information collection estimated that CISA receives 15,000 requests annually for CFATS Help Desk support (i.e., 15,000 respondents via phone calls, emails, and web-based help request forms). CISA is proposing to lower this estimate to 12,000 respondents. CISA evaluated historical data to determine if the estimated number of CFATS Help Desk requests (i.e., 15,000) was still appropriate. Between CY19 and CY21, the average annual number of CFATS Help Desk requests was 11,819. Therefore, CISA believes that lowering the existing estimate of 15,000 respondents to 12,000 is appropriate. Estimated Time per Respondent: The current estimated time per respondent for the CFATS Help Desk is 0.17 hours (10 minutes). CISA is proposing to lower this estimate to 0.1167 hours (7 minutes). CISA evaluated historical data to determine if the estimated time per respondent of 0.17 hours (10 minutes) was still appropriate. Between CY19 and CY21, the average duration for a CFATS Help Desk call was approximately 7 minutes (6 minutes and 46 seconds), which is a slight decrease from the average duration for a CFATS Help Desk call reported by CISA in previous years. CISA does not have any information on the average amount of time it took respondents to type and send emails to the CFATS Help Desk. Because the average duration for a CFATS Help Desk call remains below the current estimate of 0.17 hours, CISA believes that it is appropriate to lower the estimate for this information collection to 0.1167 hours. Annual Burden Hours: The average annual burden hours for the CFATS Help Desk will be 1,400 hours [12,000 respondents × 0.1167 hours per respondent = 1,400 hours]. Total Annual Burden Cost: CISA assumes that SSOs will be responsible for contacting the CFATS Help Desk. For this ICR, CISA maintains this E:\FR\FM\27DEN1.SGM 27DEN1 79340 Federal Register / Vol. 87, No. 247 / Tuesday, December 27, 2022 / Notices TKELLEY on DSK125TN23PROD with NOTICES assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 1,400 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.16 Therefore, the total annual burden cost for the CFATS Help Desk is $126,580 (i.e., 1,400 hours multiplied by $90.41 per hour. Total Burden Cost (Capital/Startup): Contacting the CFATS Help Desk is free and CISA assumes that each respondent already has a phone or access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs. Total Recordkeeping Burden: There is no recordkeeping burden for this instrument. 5. CISA’s Methodology in Estimating the Burden for the CSAT User Registration Number of Respondents: The current information collection estimated 1,000 respondents would complete the user registration process annually. For this ICR, CISA maintains this estimate. Historically, CISA’s estimate in the current information collection was primarily based on the number of individuals expected to register as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of the CSAT User Registration instrument in the current information collection was intended to allow for the creation of additional CSAT user roles such as the Administrator and Personnel Surety (PS) Submitter user roles. Because the estimate has always been very conservative, for example, between CY19 and CY21 the average annual number of individuals registered was 540. Thus, CISA believes that maintaining the current estimate of 1,000 respondents annually is a reasonable estimate that reflects the user registration activity for all types of CSAT users. Estimated Time per Respondent: In the current information collection, the estimated time per respondent is 2.5 hours. CISA proposes to maintain the current estimate. This estimate is based on two factors: (1) the actual time needed to complete the CSAT User Registration process continues to be approximately 0.5 hours (30 minutes); and (2) CISA expects that CSAT Authorizers need additional time to manage the CSAT user accounts for which they are responsible. The ongoing management of the CSAT user accounts includes activities such as, but not limited to: (1) assigning 16 $90.4142 is the hourly labor costs, including wages and benefits. VerDate Sep<11>2014 22:43 Dec 23, 2022 Jkt 259001 Submitters and Preparers to facilities; (2) updating the facilities with which a Submitter or Preparer is associated as his or her duties change; (3) creating groups 17 to support the CFATS Personnel Surety (PS) Program; (4) assigning PS Submitters to groups; and (5) updating the PS Submitters’ access to groups as their duties change. CISA intends to revise the user registration instrument to collect facility Employer Identification Numbers (EIN). The collection of EIN information will allow CISA to identify chemical facilities of interest, in accordance with 6 U.S.C. 622(a)(2)(A)(i), within datasets that are in the possession of the Federal Government. CISA expects that answering these questions will not meaningfully increase the estimated time per respondent. For this ICR, CISA is applying the assumption based on previous public comments on this information collection (i.e., OMB Control No. 1670– 0007) that for every hour a respondent is logged into the CSAT application, the respondent spends an average of 4 hours in preparation (e.g., coordinating with CFATS-facility stakeholders, including Human Resources, Procurement, or Contract Administration to explain the PS Program requirements and determine how best to gather the data from different populations). Therefore, CISA’s estimated time per respondent is 2.5 hours [ 0.50 hours logged into CSAT + (0.50 hours × 4) for preparation = 2.5 hours]. Annual Burden Hours: The annual burden estimate for CSAT User Registration is 2,500 hours [ 1,000 respondents × 1 response per respondent × 2.5 hours per respondent = 2,500 hours]. Total Annual Burden Cost: CISA assumes that SSOs will be responsible for CSAT User Registration. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 2,500 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.18 Therefore, the total annual burden cost for the CSAT User Registration is $226,035 (i.e., 2,500 hours multiplied by $90.41 per hour). 17 ‘‘Groups’’ is a technical term used by CISA to describe how a covered chemical facility may manage the access to records about affected individuals in the CSAT Personnel Surety application. CISA describes the term ‘‘groups’’ and provides additional information about how to create and manage groups in section 9.5 of the CSAT User Manual, which may be viewed at https:// www.dhs.gov/sites/default/files/publications/csatportal-user-manual-508-2.pdf. 18 $90.4142 is the total compensation per hour, including wages and benefits. PO 00000 Frm 00068 Fmt 4703 Sfmt 4703 Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, for this ICR CISA estimates that there are no capital/startup costs for this instrument. Total Recordkeeping Burden: There is no recordkeeping burden for this instrument. 6. CISA’S Methodology in Estimating the Burden for Identification of Additional Facilities and Assets at Risk Number of Respondents. The current information collection estimated that each year 3,426 respondents would respond to this instrument. For this ICR, CISA estimates the number of respondents will be 2,252. This instrument is composed of two sections titled ‘‘Identification of Facilities’’ and a second section titled ‘‘Assets at Risk.’’ The first section collects information on a voluntary basis when a facility ships and/or receives Chemicals of Interest (COI). The second section collects information on a voluntary basis when the facility identifies a cyber system. The estimate of 2,252 respondents is based upon the sum of 439 respondents for the first section of this instrument and 1,813 respondents for the second section of this instrument. CISA estimated 439 respondents for the first section of the instrument by using data on the number of compliance inspection conducted between CY 2019 and CY 2021. Between CY19 and CY21, CISA completed an average of 1,021 compliance inspections per year. Of these inspections, approximately 43 percent of the covered chemical facilities inspected ship COI. Therefore, because CISA only requests this information from covered chemical facilities that undergo compliance inspections and ship COI, CISA estimates 439 respondents for the first section of the instrument [ 1,021 facilities inspected × 43 percent of facilities ship COI = 439]. With respect to the second section of the instrument (‘‘Assets at Risk’’), if a covered chemical facility has identified a cyber-related system in their SVA or SSP, CISA may request the information covered under this section of the instrument during interactions that occur during: (1) Compliance Assistance Visits, (2) Authorization Inspections, and (3) Compliance Inspections.19 19 This information is not covered under the SSP because the information is not subsequently submitted through the CSAT SSP but rather documented by an inspector or other appropriate employee of CISA. E:\FR\FM\27DEN1.SGM 27DEN1 TKELLEY on DSK125TN23PROD with NOTICES Federal Register / Vol. 87, No. 247 / Tuesday, December 27, 2022 / Notices Between CY 2019 and CY 2021, CISA has performed 5,438 of these interactions at facilities and asked questions about assets at risk. Therefore, CISA estimates 1,813 respondents 20 for the second section of the instrument by annualizing the number of interactions described above (i.e., 1,813 = [5438 respondents divided by a 3-year timeperiod]). Estimated Time per Respondent: In the current information collection, the estimated time per respondent is 0.17 hours (10 minutes). In this ICR, CISA maintains this estimate. Annual Burden Hours: The annual burden estimate is 375 hours [ 2,252 respondents × 1 response per respondent × 0.17 hours per respondent]. Total Annual Burden Cost: CISA assumes that SSOs will be responsible for providing this information. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 375 hours by the average hourly total compensation rate of SSOs of $90.41 21 per hour. Therefore, the total annual burden cost for this instrument is $33,931 (375 hours multiplied by $90.41 per hour). Total Burden Cost (Capital/Startup): CISA estimates that there are no capital/ startup costs for this instrument. Total Recordkeeping Burden: There is no recordkeeping burden for this instrument. Public Participation: OMB is particularly interested in comments that: 1. Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; 2. Evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; 3. Enhance the quality, utility, and clarity of the information to be collected; and 4. Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques, or other forms of information technology (e.g., permitting electronic submissions of responses). = (5438 ÷ 3). is the total compensation per hour, including wages and benefits. 20 1,812.67 21 $90.4142 VerDate Sep<11>2014 22:43 Dec 23, 2022 Jkt 259001 Analysis Title of Collection: Chemical Security Assessment Tool OMB Control Number: 1670–0007 Instrument: Top-Screen Frequency: ‘‘On occasion’’ and ‘‘Other’’ Affected Public: Business or other forprofit Number of Respondents: 3,817 respondents (estimate) Estimated Time per Respondent: 2.04 hours Total Annual Burden Hours: 7,785 hours Total Annual Burden Cost: $703,829 Total Annual Burden Cost (capital/ startup): $0 Total Recordkeeping Burden: $0 Instrument: Security Vulnerability Assessment and Alternative Security Program submitted in lieu of a Security Vulnerability Assessment Frequency: ‘‘On occasion’’ and ‘‘Other’’ Affected Public: Business or other forprofit Number of Respondents: 2,328 respondents (estimate) Estimated Time per Respondent: 1.4136 hours Total Annual Burden Hours: 3,291 hours Total Annual Burden Cost: $297,530 Total Annual Burden Cost (capital/ startup): $0 Total Recordkeeping Burden: $0 Instrument: Site Security Plan and Alternative Security Program submitted in lieu of a Site Security Plan. Frequency: ‘‘On occasion’’ and ‘‘Other’’ Affected Public: Business or other forprofit. Number of Respondents: 2,328 (estimate). Estimated Time per Respondent: 7.845 hours. Total Annual Burden Hours: 18,262 hours. Total Annual Burden Cost: $1,651,158. Total Annual Burden Cost (capital/ startup): $0. Total Recordkeeping Burden: $556,040. Instrument: CFATS Help Desk Frequency: ‘‘On occasion’’ and ‘‘Other’’. Affected Public: Business or other forprofit. Number of Respondents: 12,000 respondents (estimate). Estimated Time per Respondent: 0.1167 hours. Total Annual Burden Hours: 1,400 hours. PO 00000 Frm 00069 Fmt 4703 Sfmt 4703 79341 Total Annual Burden Cost: $126,580. Total Annual Burden Cost (capital/ startup): $0. Total Recordkeeping Burden: $0. Instrument: User Registration. Frequency: ‘‘On occasion’’ and ‘‘Other’’. Affected Public: Business or other forprofit. Number of Respondents: 1,000 respondents (estimate). Estimated Time per Respondent: 2.5 hours. Total Annual Burden Hours: 2,500 hours. Total Annual Burden Cost: $226,035. Total Annual Burden Cost (capital/ startup): $0. Total Recordkeeping Burden: $0. Instrument: Identification of Facilities and Assets at Risk. Frequency: ‘‘On occasion’’ and ‘‘Other’’. Affected Public: Business or other forprofit. Number of Respondents: 2,252 respondents (estimate). Estimated Time per Respondent: 0.17 hours. Total Annual Burden Hours: 375 hours. Total Annual Burden Cost: $33,931. Total Annual Burden Cost (capital/ startup): $0. Total Recordkeeping Burden: $0. Robert Costello, Chief Information Officer, Department of Homeland Security, Cybersecurity and Infrastructure Security Agency. [FR Doc. 2022–28076 Filed 12–23–22; 8:45 am] BILLING CODE 9110–9P–P DEPARTMENT OF HOMELAND SECURITY [Docket No. CISA–2022–0011] Agency Information Collection Activities: Nationwide Cyber Security Review (NCSR) Assessment Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS). ACTION: 30-Day notice and request for comments; Reinstatement Without Change, OMB Control Number: DHS– 1670–0040. AGENCY: The Joint Cyber Defense Collaborative (JCDC) within Cybersecurity and Infrastructure Security Agency (CISA) will submit the following information collection request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork SUMMARY: E:\FR\FM\27DEN1.SGM 27DEN1

Agencies

[Federal Register Volume 87, Number 247 (Tuesday, December 27, 2022)]
[Notices]
[Pages 79337-79341]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-28076]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

[Docket No. CISA-2022-0018]


Request To Revise and Extend the Chemical Security Assessment 
Tool (CSAT) Information Collection Under the Paperwork Reduction Act

AGENCY: Cybersecurity and Infrastructure Security Agency, DHS.

ACTION: 60-Day notice and request for comments.

-----------------------------------------------------------------------

SUMMARY: The Infrastructure Security Division (ISD) within the 
Cybersecurity and Infrastructure Security Agency (CISA) will submit the 
following Information Collection Request (ICR) to the Office of 
Management and Budget (OMB) for review and clearance in accordance with 
the Paperwork Reduction Act of 1995. This notice solicits comments on 
the information collection during a 60-day public comment period prior 
to the submission of this ICR to OMB. The submission proposes to revise 
the information collection for an additional three years and update the 
burden estimates associated with collecting information in the Chemical 
Security Assessment Tool (CSAT) for the Chemical Facility Anti-
Terrorism Standards (CFATS) Program.

DATES: Comments are due by February 27, 2023.

ADDRESSES: You may send comments, identified by docket number through 
the Federal eRulemaking Portal: https://www.regulations.gov. Follow the 
instructions for sending comments.
    Instructions: All submissions received must include the agency name 
``CISA'' and docket number CISA-2022-0018. All comments received will 
be posted without change to https://www.regulations.gov, including any 
personal information provided.
    Comments that include protected information such as trade secrets, 
confidential commercial or financial information, Chemical-terrorism 
Vulnerability Information (CVI),\1\ Sensitive Security Information 
(SSI),\2\ or Protected Critical Infrastructure Information (PCII) \3\ 
should not be submitted to the public docket. Comments containing 
protected information should be appropriately marked and packaged in 
accordance with all applicable requirements and submission must be 
coordinated with the point of contact for this notice provided in FOR 
FURTHER INFORMATION CONTACT section.
---------------------------------------------------------------------------

    \1\ For more information about CVI see 6 CFR 27.400 and the CVI 
Procedural Manual at www.dhs.gov/publication/safeguarding-cvi-manual.
    \2\ For more information about SSI see 49 CFR part 1520 and the 
SSI Program web page at www.tsa.gov/for-industry/sensitive-security-information.
    \3\ For more information about PCII see 6 CFR part 29 and the 
PCII Program web page at www.dhs.gov/pcii-program.

FOR FURTHER INFORMATION CONTACT: Ryan Donaghy, 703-603-5000, 
_____________________________________-
[email protected].

SUPPLEMENTARY INFORMATION: The CFATS Program identifies chemical 
facilities of interest and regulates the security of high-risk chemical 
facilities through a risk-based approach. The CFATS Program is 
authorized under the Protecting and Securing Chemical Facilities from 
Terrorist Attacks Act of 2014 or ``CFATS Act of 2014.\4\
---------------------------------------------------------------------------

    \4\ The CFATS Act of 2014 codified the CFATS program into the 
Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended 
by Public Law 116-135, Sec. 16007 (2020).
---------------------------------------------------------------------------

    CISA collects the core regulatory data necessary to implement CFATS 
through the Chemical Security Assessment Tool (CSAT) covered under this 
collection. For more information about CFATS and CSAT, please visit 
www.dhs.gov/chemicalsecurity. This information collection (OMB Control 
No. 1670-0007) will expire on July 31, 2023.\5\
---------------------------------------------------------------------------

    \5\ The currently approved version of this information 
collection (OMB Control No. 1670-0007) can be viewed athttps://
www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201905-1670-001.
---------------------------------------------------------------------------

    Below, CISA estimates the burden to respondents for the: (1) Top-
Screen, (2) Security Vulnerability Assessment (SVA) and Alternative 
Security Program (ASP) submitted in lieu of an SVA, (3) Site Security 
Plan (SSP) and ASP submitted in lieu of an SSP, (4) CFATS Help Desk, 
(5) CSAT User Registration, and (6) Identification of Facilities and 
Assets at Risk.\6\
---------------------------------------------------------------------------

    \6\ Throughout this analysis, CISA presents rounded hourly time 
burden estimates and hourly compensation rates to assist in 
reproducing the results. However, CISA's actual calculations use 
unrounded figures; consequently, some reproduced results may not 
exactly match the reported results.
---------------------------------------------------------------------------

1. CISA'S Methodology in Estimating the Burden for the Top-Screen

    Number of Respondents: The current information collection estimated 
that 2,332 respondents will submit a Top-Screen annually. For this ICR, 
CISA estimates the annual number of respondents will be 3,817.
    The estimate of 3,817 is the sum of the average number of 887 
first-time Top-Screen submissions and the average number of 2,930 Top-
Screen resubmissions received per year between Calendar Year (calendar 
year)19 and CY21 (887 first time submissions + 2,930 resubmissions = 
3,817).
    Estimated Time per Respondent: In the current information 
collection, the estimated time per respondent to prepare and submit a 
Top-Screen is 1.09 hours. For this ICR, CISA estimates the time per 
respondent to prepare and submit a Top-Screen will be 2.04 hours.
    Using the data collected between CY19 and CY21, CISA obtained the 
estimate of 2.04 hours by first determining the average amount of time 
respondents were logged into the Top-Screen application (0.408 hours or 
24.5 minutes). CISA calculated this figure by

[[Page 79338]]

using the time logged in the application for initial Top-Screens (.50 
hours) and Top-Screen resubmission (.38 hours) weighted by the number 
of respondents that submitted first-time Top-Screens and Top-Screen 
resubmissions [(887 first-time submissions x 0.50 hours per first time 
submission) + (2,930 resubmissions x 0.38 hours per resubmission) / 
3,817 total submissions = 0.408 hours].
    CISA maintains its assumption, based on previous public comments on 
this information collection, that for every hour a respondent is logged 
into the Top-Screen application, the respondent spends an average of 4 
hours in preparation.\7\ Therefore, based on the 0.408 hours average 
log in time for the Top-Screen application and the 4 hours of average 
preparation time, CISA calculates that between CY19 and CY21, the 
burden per respondent to submit a Top-Screen was 2.04 hours [0.408 
hours logged into CSAT + (0.408 hours x 4) for preparation = 2.04 
hours].
---------------------------------------------------------------------------

    \7\ CISA's adoption of the assumption that for every hour a 
respondent is logged into the Top-Screen application, SVA/ASP 
application, and SSP/ASP application, the respondent spends an 
average of 4 hours in preparation is described in the 30-day notice 
the Department published for this information collection in March 
2013 at 78 FR 16694, which may be viewed at https://www.federalregister.gov/d/2013-06095.
---------------------------------------------------------------------------

    Annual Burden Hours: The annual burden hours for the Top-Screen is 
7,785 hours (3,817 respondents x 1 response per respondent x 2.04 hours 
per response = 7,785 hours).
    Total Annual Burden Cost: CISA assumes that Site Security Officers 
(SSOs) are responsible for submitting Top-Screens. For this ICR, CISA 
maintains this assumption.
    To estimate the total annual burden, CISA multiplied the annual 
burden of 7,785 hours by the average hourly total compensation rate of 
SSOs of $90.41 \8\ per hour. Therefore, the total annual burden cost 
for the Top-Screen is $703,829 (i.e., 7,785 hours multiplied by $90.41 
per hour).
---------------------------------------------------------------------------

    \8\ Mean hourly wage was obtained from U.S. Department of Labor, 
BLS; May 2021 Occupational Employment and Wage Statistics, OES 
Managers, All Other. (Occupational Code 11-9199). Retrieved from 
https://www.bls.gov/oes/2021/may/oes_nat.htm. of $62.36 times the 
wage rate benefit multiplier of 1.4499 (to account for fringe 
benefits) equaling $90.4141. The benefits multiplier is estimated by 
dividing total compensation of $40.35 by salaries and wages of 
$27.83, based on Employer Cost for Employee Compensation, December 
2021, released March 18, 2022 (https://www.bls.gov/news.release/archives/ecec_03182022.pdf).
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): CISA provides access to CSAT 
free of charge and CISA assumes that each respondent already has access 
to the internet for basic business needs. Therefore, CISA estimates 
that no capital/startup costs are associated with this instrument.
    Total Recordkeeping Burden A respondent that has submitted a Top-
Screen may or may not be determined by CISA to present a high level of 
security risk. Only respondents that present a high level of security 
risk are required to keep records mandated by CFATS (i.e., facilities 
that tier into the CFATS program).
    For respondents that are determined to present a high level of 
security risk, the Top-Screen recordkeeping burden is accounted for 
within the recordkeeping burden estimate for the ``Site Security Plan 
(SSP) and Alternative Security Program (ASP) submitted in lieu of an 
SSP'' instrument discussed later in this notice in subsection 3, 
hereafter, referred to as the ``SSP/ASP.'' The recordkeeping burden 
estimate for the SSP/ASP instrument accounts for all records 
respondents are required to maintain under CFATS because CISA assumes 
that respondents maintain their Top-Screen records in the same manners, 
formats, and locations as they maintain their other required records. 
Therefore, CISA estimates that no recordkeeping burden is associated 
with this instrument.

2. CISA'S Methodology in Estimating the Burden for the Security 
Vulnerability Assessment (SVA) & Alternative Security Program (ASP) 
Submitted in Lieu of an SVA

    Number of Respondents: The current information collection estimated 
that each year 1,683 respondents would complete an SVA or ASP in lieu 
of an SVA, hereafter, referred to as an ``SVA/ASP.'' For this ICR, CISA 
estimates that the annual number of respondents will be 2,328, which is 
based on sum of the average number of SVA/ASP submissions and 
resubmissions between CY19 and CY21. This consists of an average of 209 
first-time SVA/ASPs and 2,119 resubmitted SVA/ASPs per year.
    Estimated Time per Respondent: The current information collection 
estimated the time per respondent for preparing and submitting an SVA/
ASP to be 1.24 hours. For this ICR, CISA estimates the time per 
respondent for preparing and submitting an SVA/ASP will be 1.4136 
hours.
    Using the data collected between CY19 and CY 21, CISA obtained the 
estimate of 1.4136 hours by first determining the median amount of time 
respondents were logged into the SVA/ASP application (0.28 hours or 17 
minutes). CISA calculated the average amount of time respondents were 
logged into the SVA/ASP application by using the median duration 
respondents were logged into the CSAT SVA/ASP application for an 
initial SVA/ASP (0.783 hours or 47 minutes) and an SVA/ASP resubmission 
(0.233 hours or 14 minutes) weighted by the number of respondents that 
submitted first-time SVAs/ASPs and SVA/ASP resubmissions between CY19 
and CY21 which was 0.28 hours \9\ [(209 first-time submissions x 0.783 
hours) + (2,119 resubmissions x 0.233 hours) / 2,328 total submissions 
= 0.28 hours].
---------------------------------------------------------------------------

    \9\ 0.28271 hours.
---------------------------------------------------------------------------

    CISA maintains its assumption, based on previous public comments on 
this information collection, that for every hour a respondent is logged 
into the SVA/ASP application, the respondent spends an average of 4 
hours in preparation. Therefore, based on the 0.28 hours average log in 
time for the CSAT SVA/ASP application and the 4 hours of average 
preparation time, CISA calculates that between CY19 and CY21, the 
burden per respondent to prepare and submit an SVA/ASP was 1.4136 hours 
\10\ [ 0.28 hours logged into CSAT + (0.28 hours x 4) for preparation].
---------------------------------------------------------------------------

    \10\ 1.4136 hours = 0.2827 hours + 1.1308 hours.
---------------------------------------------------------------------------

    Annual Burden Hours: The annual burden hours for an SVA/ASP is 
3,291 hours \11\ (2,328 respondents x 1 response per respondent x 
1.4136 hours per response = 3,291 hours).
---------------------------------------------------------------------------

    \11\ 3,290.75 hours.
---------------------------------------------------------------------------

    Total Annual Burden Cost: CISA assumes that SSOs will be 
responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this 
assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 3,291 hours by the average hourly total 
compensation rate of SSOs of $90.41 per hour.\12\ Therefore, the total 
annual burden cost for the SVA/ASP is $297,530 (i.e., 3,291 hours 
multiplied by $90.41 per hour).
---------------------------------------------------------------------------

    \12\ $90.4142 is the hourly labor costs, including wages and 
benefits.
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): CISA provides access to CSAT 
free of charge and CISA assumes that each respondent already has access 
to the internet for basic business needs. Therefore, CISA estimates 
that there are no capital/startup costs for this instrument.
    Total Recordkeeping Burden: For respondents that are determined by 
CISA to present a high level of security risk, the SVA/ASP 
recordkeeping burden is accounted for within the recordkeeping burden 
estimate for the SSP/ASP discussed below in Subsection 3 of this 
section. Therefore, CISA estimates that no recordkeeping burden is 
associated with this instrument.

[[Page 79339]]

3. CISA'S Methodology in Estimating the Burden for the Site Security 
Plan (SSP) & Alternative Security Program (ASP) Submitted in Lieu of an 
SSP

    Number of Respondents: The current information collection estimated 
1,683 SSP/ASP respondents. For this ICR, the Department maintains the 
assumption that all respondents to the SVA/ASP will be a respondent of 
the SSP/ASP. Therefore, CISA estimates that the annual number of 
respondents will be 2,328, which is based on the average number of all 
respondents to the SVA/ASP. This number breaks down to, on average, 209 
initial submissions and 2,119 resubmissions per year.
    Estimated Time per Respondent: The current information collection 
estimated the time per respondent for preparing and submitting an SSP/
ASP to be 2.72 hours. For this ICR, CISA estimates the time per 
respondent for preparing and submitting an SSP/ASP will be 7.845 hours.
    CISA intends to make a revision to the SSP/ASP instrument to 
collect facility internet Protocol (IP) address(es) and Domain Name 
System (DNS) information. The collection of IP address(es) and DNS 
information supports the development of a facility's SSP in accordance 
with 6 U.S.C. 622 (a)(2)(D)(ii) and 6 CFR 27.225(a)(4). In addition, 
CISA may potentially use this information to integrate with other data 
within the U.S. Government, conduct related analysis, and provide 
warnings about cyber threats affecting chemical facilities. CISA 
expects that answering these questions will not meaningfully increase 
the estimated SSP/ASP completion time.
    Using the data collected between CY 19 and CY 21, CISA obtained the 
estimate of 7.845 hours by first determining the average amount of time 
respondent were logged into the SSP/ASP application (1.5689 hours or 94 
minutes). CISA calculated the average amount of time respondents were 
logged into the SSP/ASP application by using the median duration 
respondents were logged into the SSP/ASP application for an initial 
SSP/ASP (4.63 hours or 278 minutes) and an SSP/ASP resubmission (1.27 
hours or 76 minutes) weighted by the number of respondents that 
submitted first-time SSPs/ASPs and SSP/ASP resubmissions between CY19 
and CY21, which was 1.5689 hours (94 minutes) [ (209 first-time 
submissions x 4.6333 hours) + (2,119 resubmissions x 1.2666 hours) / 
2,328 total submissions = 1.5689 hours].
    CISA maintains its assumption, based on previous public comments on 
this information collection, that for every hour a respondent is logged 
into the SSP/ASP application, the respondent spends an average of 4 
hours in preparation. Therefore, based on the 1.57 hours average log in 
time for the CSAT SSA/ASP application and the 4 hours of average 
preparation time, CISA calculates that between CY19 and CY21, the 
burden per respondent to prepare and submit an SSP/ASP was 7.845 hours 
[1.5689 hours logged into CSAT + (1.5689 hours x 4) for preparation].
    Annual Burden Hours: The annual burden hours for SSPs/ASPs is 
18,262 hours (2,328 respondents x 1 response per respondent x 7.845 
hours per response).
    Total Annual Burden Cost: CISA assumes that SSOs will be 
responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this 
assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 18,262 hours by the average hourly 
total compensation rate of SSOs of $90.41 per hour \13\. Therefore, the 
total annual burden cost for the SVA/ASP is $ 1,651,158 (i.e., 18,262 
hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------

    \13\ $90.4142 is the hourly labor costs, including wages and 
benefits.
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): CISA provides access to CSAT 
free of charge and CISA assumes that each respondent already has access 
to the internet for basic business needs. Therefore, CISA estimates 
that there are no capital/startup costs.
    Total Recordkeeping Burden: The current information collection 
estimated a recordkeeping burden of approximately $516,825. For this 
information collection, CISA estimates a recordkeeping burden of 
$556,040. CISA maintained the methodology and assumptions described in 
the current information collection but increased the current estimate 
to account for updating the hourly compensation rates \14\ to $44.18 
and inflating the 2017 ICR renewal capital/startup costs by an 
inflation factor \15\ of 1.09.
---------------------------------------------------------------------------

    \14\ Mean hourly wage was obtained from U.S. Department of 
Labor, BLS; May 2021 Occupational Employment and Wage Statistics, 
OES First-Line Supervisors of Office and Administrative Support 
Workers, (Occupational Code 43-1011). Retrieved from https://www.bls.gov/oes/2021/may/oes_nat.htm. of $30.47 times the wage rate 
benefit multiplier of 1.4499 (to account for fringe benefits) 
equaling $44.177. The benefits multiplier is estimated by dividing 
total compensation of $40.35 by salaries and wages of $27.83, based 
on Employer Cost for Employee Compensation, December 2021, released 
March 18, 2022 (https://www.bls.gov/news.release/archives/ecec_03182022.pdf).
    \15\ Federal Reserve Bank of St. Louis, Federal Reserve Economic 
Data, GDP factor from 2017 to 2021 dollars was 1.0975 = 113.0664/
103.02 https://fred.stlouisfed.org/series/USAGDPDEFAISMEI.
---------------------------------------------------------------------------

    For this ICR, CISA maintains its approach of accounting for the 
entire recordkeeping burden imposed on covered chemical facilities 
under CFATS within the SSP/ASP instrument, because: (1) only covered 
chemical facilities are required to maintain records; (2) no changes to 
the recordkeeping requirements have occurred since the approval of the 
current information collection; and (3) CISA's historical assumption 
that respondents maintain any other required records in the same 
manners, formats, and locations as they maintain their SSP/ASP records.

4. CISA'S Methodology in Estimating the Burden for the CFATS Help Desk

    Number of Respondents The current information collection estimated 
that CISA receives 15,000 requests annually for CFATS Help Desk support 
(i.e., 15,000 respondents via phone calls, emails, and web-based help 
request forms). CISA is proposing to lower this estimate to 12,000 
respondents.
    CISA evaluated historical data to determine if the estimated number 
of CFATS Help Desk requests (i.e., 15,000) was still appropriate. 
Between CY19 and CY21, the average annual number of CFATS Help Desk 
requests was 11,819. Therefore, CISA believes that lowering the 
existing estimate of 15,000 respondents to 12,000 is appropriate.
    Estimated Time per Respondent: The current estimated time per 
respondent for the CFATS Help Desk is 0.17 hours (10 minutes). CISA is 
proposing to lower this estimate to 0.1167 hours (7 minutes).
    CISA evaluated historical data to determine if the estimated time 
per respondent of 0.17 hours (10 minutes) was still appropriate. 
Between CY19 and CY21, the average duration for a CFATS Help Desk call 
was approximately 7 minutes (6 minutes and 46 seconds), which is a 
slight decrease from the average duration for a CFATS Help Desk call 
reported by CISA in previous years. CISA does not have any information 
on the average amount of time it took respondents to type and send 
emails to the CFATS Help Desk.
    Because the average duration for a CFATS Help Desk call remains 
below the current estimate of 0.17 hours, CISA believes that it is 
appropriate to lower the estimate for this information collection to 
0.1167 hours.
    Annual Burden Hours: The average annual burden hours for the CFATS 
Help Desk will be 1,400 hours [12,000 respondents x 0.1167 hours per 
respondent = 1,400 hours].
    Total Annual Burden Cost: CISA assumes that SSOs will be 
responsible for contacting the CFATS Help Desk. For this ICR, CISA 
maintains this

[[Page 79340]]

assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 1,400 hours by the average hourly total 
compensation rate of SSOs of $90.41 per hour.\16\ Therefore, the total 
annual burden cost for the CFATS Help Desk is $126,580 (i.e., 1,400 
hours multiplied by $90.41 per hour.
---------------------------------------------------------------------------

    \16\ $90.4142 is the hourly labor costs, including wages and 
benefits.
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): Contacting the CFATS Help Desk 
is free and CISA assumes that each respondent already has a phone or 
access to the internet for basic business needs. Therefore, CISA 
estimates that there are no capital/startup costs.
    Total Recordkeeping Burden: There is no recordkeeping burden for 
this instrument.

5. CISA's Methodology in Estimating the Burden for the CSAT User 
Registration

    Number of Respondents: The current information collection estimated 
1,000 respondents would complete the user registration process 
annually. For this ICR, CISA maintains this estimate.
    Historically, CISA's estimate in the current information collection 
was primarily based on the number of individuals expected to register 
as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of 
the CSAT User Registration instrument in the current information 
collection was intended to allow for the creation of additional CSAT 
user roles such as the Administrator and Personnel Surety (PS) 
Submitter user roles. Because the estimate has always been very 
conservative, for example, between CY19 and CY21 the average annual 
number of individuals registered was 540. Thus, CISA believes that 
maintaining the current estimate of 1,000 respondents annually is a 
reasonable estimate that reflects the user registration activity for 
all types of CSAT users.
    Estimated Time per Respondent: In the current information 
collection, the estimated time per respondent is 2.5 hours. CISA 
proposes to maintain the current estimate.
    This estimate is based on two factors: (1) the actual time needed 
to complete the CSAT User Registration process continues to be 
approximately 0.5 hours (30 minutes); and (2) CISA expects that CSAT 
Authorizers need additional time to manage the CSAT user accounts for 
which they are responsible.
    The ongoing management of the CSAT user accounts includes 
activities such as, but not limited to: (1) assigning Submitters and 
Preparers to facilities; (2) updating the facilities with which a 
Submitter or Preparer is associated as his or her duties change; (3) 
creating groups \17\ to support the CFATS Personnel Surety (PS) 
Program; (4) assigning PS Submitters to groups; and (5) updating the PS 
Submitters' access to groups as their duties change.
---------------------------------------------------------------------------

    \17\ ``Groups'' is a technical term used by CISA to describe how 
a covered chemical facility may manage the access to records about 
affected individuals in the CSAT Personnel Surety application. CISA 
describes the term ``groups'' and provides additional information 
about how to create and manage groups in section 9.5 of the CSAT 
User Manual, which may be viewed at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.
---------------------------------------------------------------------------

    CISA intends to revise the user registration instrument to collect 
facility Employer Identification Numbers (EIN). The collection of EIN 
information will allow CISA to identify chemical facilities of 
interest, in accordance with 6 U.S.C. 622(a)(2)(A)(i), within datasets 
that are in the possession of the Federal Government. CISA expects that 
answering these questions will not meaningfully increase the estimated 
time per respondent.
    For this ICR, CISA is applying the assumption based on previous 
public comments on this information collection (i.e., OMB Control No. 
1670-0007) that for every hour a respondent is logged into the CSAT 
application, the respondent spends an average of 4 hours in preparation 
(e.g., coordinating with CFATS-facility stakeholders, including Human 
Resources, Procurement, or Contract Administration to explain the PS 
Program requirements and determine how best to gather the data from 
different populations). Therefore, CISA's estimated time per respondent 
is 2.5 hours [ 0.50 hours logged into CSAT + (0.50 hours x 4) for 
preparation = 2.5 hours].
    Annual Burden Hours: The annual burden estimate for CSAT User 
Registration is 2,500 hours [ 1,000 respondents x 1 response per 
respondent x 2.5 hours per respondent = 2,500 hours].
    Total Annual Burden Cost: CISA assumes that SSOs will be 
responsible for CSAT User Registration. For this ICR, CISA maintains 
this assumption. Therefore, to estimate the total annual burden, CISA 
multiplied the annual burden of 2,500 hours by the average hourly total 
compensation rate of SSOs of $90.41 per hour.\18\ Therefore, the total 
annual burden cost for the CSAT User Registration is $226,035 (i.e., 
2,500 hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------

    \18\ $90.4142 is the total compensation per hour, including 
wages and benefits.
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): CISA provides access to CSAT 
free of charge and CISA assumes that each respondent already has access 
to the internet for basic business needs. Therefore, for this ICR CISA 
estimates that there are no capital/startup costs for this instrument.
    Total Recordkeeping Burden: There is no recordkeeping burden for 
this instrument.

6. CISA'S Methodology in Estimating the Burden for Identification of 
Additional Facilities and Assets at Risk

    Number of Respondents. The current information collection estimated 
that each year 3,426 respondents would respond to this instrument. For 
this ICR, CISA estimates the number of respondents will be 2,252.
    This instrument is composed of two sections titled ``Identification 
of Facilities'' and a second section titled ``Assets at Risk.'' The 
first section collects information on a voluntary basis when a facility 
ships and/or receives Chemicals of Interest (COI). The second section 
collects information on a voluntary basis when the facility identifies 
a cyber system. The estimate of 2,252 respondents is based upon the sum 
of 439 respondents for the first section of this instrument and 1,813 
respondents for the second section of this instrument.
    CISA estimated 439 respondents for the first section of the 
instrument by using data on the number of compliance inspection 
conducted between CY 2019 and CY 2021. Between CY19 and CY21, CISA 
completed an average of 1,021 compliance inspections per year. Of these 
inspections, approximately 43 percent of the covered chemical 
facilities inspected ship COI. Therefore, because CISA only requests 
this information from covered chemical facilities that undergo 
compliance inspections and ship COI, CISA estimates 439 respondents for 
the first section of the instrument [ 1,021 facilities inspected x 43 
percent of facilities ship COI = 439].
    With respect to the second section of the instrument (``Assets at 
Risk''), if a covered chemical facility has identified a cyber-related 
system in their SVA or SSP, CISA may request the information covered 
under this section of the instrument during interactions that occur 
during: (1) Compliance Assistance Visits, (2) Authorization 
Inspections, and (3) Compliance Inspections.\19\

[[Page 79341]]

Between CY 2019 and CY 2021, CISA has performed 5,438 of these 
interactions at facilities and asked questions about assets at risk. 
Therefore, CISA estimates 1,813 respondents \20\ for the second section 
of the instrument by annualizing the number of interactions described 
above (i.e., 1,813 = [5438 respondents divided by a 3-year time-
period]).
---------------------------------------------------------------------------

    \19\ This information is not covered under the SSP because the 
information is not subsequently submitted through the CSAT SSP but 
rather documented by an inspector or other appropriate employee of 
CISA.
    \20\ 1,812.67 = (5438 / 3).
---------------------------------------------------------------------------

    Estimated Time per Respondent: In the current information 
collection, the estimated time per respondent is 0.17 hours (10 
minutes). In this ICR, CISA maintains this estimate.
    Annual Burden Hours: The annual burden estimate is 375 hours [ 
2,252 respondents x 1 response per respondent x 0.17 hours per 
respondent].
    Total Annual Burden Cost: CISA assumes that SSOs will be 
responsible for providing this information. Therefore, to estimate the 
total annual burden, CISA multiplied the annual burden of 375 hours by 
the average hourly total compensation rate of SSOs of $90.41 \21\ per 
hour. Therefore, the total annual burden cost for this instrument is 
$33,931 (375 hours multiplied by $90.41 per hour).
---------------------------------------------------------------------------

    \21\ $90.4142 is the total compensation per hour, including 
wages and benefits.
---------------------------------------------------------------------------

    Total Burden Cost (Capital/Startup): CISA estimates that there are 
no capital/startup costs for this instrument.
    Total Recordkeeping Burden: There is no recordkeeping burden for 
this instrument.
    Public Participation: OMB is particularly interested in comments 
that:
    1. Evaluate whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility;
    2. Evaluate the accuracy of the agency's estimate of the burden of 
the proposed collection of information, including the validity of the 
methodology and assumptions used;
    3. Enhance the quality, utility, and clarity of the information to 
be collected; and
    4. Minimize the burden of the collection of information on those 
who are to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques, 
or other forms of information technology (e.g., permitting electronic 
submissions of responses).

Analysis

    Title of Collection: Chemical Security Assessment Tool
    OMB Control Number: 1670-0007
    Instrument: Top-Screen
    Frequency: ``On occasion'' and ``Other''
    Affected Public: Business or other for-profit
    Number of Respondents: 3,817 respondents (estimate)
    Estimated Time per Respondent: 2.04 hours
    Total Annual Burden Hours: 7,785 hours
    Total Annual Burden Cost: $703,829
    Total Annual Burden Cost (capital/startup): $0

    Total Recordkeeping Burden: $0
    Instrument: Security Vulnerability Assessment and Alternative 
Security Program submitted in lieu of a Security Vulnerability 
Assessment
    Frequency: ``On occasion'' and ``Other''
    Affected Public: Business or other for-profit
    Number of Respondents: 2,328 respondents (estimate)
    Estimated Time per Respondent: 1.4136 hours
    Total Annual Burden Hours: 3,291 hours
    Total Annual Burden Cost: $297,530
    Total Annual Burden Cost (capital/startup): $0
    Total Recordkeeping Burden: $0

    Instrument: Site Security Plan and Alternative Security Program 
submitted in lieu of a Site Security Plan.
    Frequency: ``On occasion'' and ``Other''
    Affected Public: Business or other for-profit.
    Number of Respondents: 2,328 (estimate).
    Estimated Time per Respondent: 7.845 hours.
    Total Annual Burden Hours: 18,262 hours.
    Total Annual Burden Cost: $1,651,158.
    Total Annual Burden Cost (capital/startup): $0.
    Total Recordkeeping Burden: $556,040.

    Instrument: CFATS Help Desk
    Frequency: ``On occasion'' and ``Other''.
    Affected Public: Business or other for-profit.
    Number of Respondents: 12,000 respondents (estimate).
    Estimated Time per Respondent: 0.1167 hours.
    Total Annual Burden Hours: 1,400 hours.
    Total Annual Burden Cost: $126,580.
    Total Annual Burden Cost (capital/startup): $0.
    Total Recordkeeping Burden: $0.

    Instrument: User Registration.
    Frequency: ``On occasion'' and ``Other''.
    Affected Public: Business or other for-profit.
    Number of Respondents: 1,000 respondents (estimate).
    Estimated Time per Respondent: 2.5 hours.
    Total Annual Burden Hours: 2,500 hours.
    Total Annual Burden Cost: $226,035.
    Total Annual Burden Cost (capital/startup): $0.
    Total Recordkeeping Burden: $0.

    Instrument: Identification of Facilities and Assets at Risk.
    Frequency: ``On occasion'' and ``Other''.
    Affected Public: Business or other for-profit.
    Number of Respondents: 2,252 respondents (estimate).
    Estimated Time per Respondent: 0.17 hours.
    Total Annual Burden Hours: 375 hours.
    Total Annual Burden Cost: $33,931.
    Total Annual Burden Cost (capital/startup): $0.
    Total Recordkeeping Burden: $0.

Robert Costello,
Chief Information Officer, Department of Homeland Security, 
Cybersecurity and Infrastructure Security Agency.
[FR Doc. 2022-28076 Filed 12-23-22; 8:45 am]
BILLING CODE 9110-9P-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.