2022-28076. Request To Revise and Extend the Chemical Security Assessment Tool (CSAT) Information Collection Under the Paperwork Reduction Act

AGENCY:

Cybersecurity and Infrastructure Security Agency, DHS.

ACTION:

60-Day notice and request for comments.

SUMMARY:

The Infrastructure Security Division (ISD) within the Cybersecurity and Infrastructure Security Agency (CISA) will submit the following Information Collection Request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995. This notice solicits comments on the information collection during a 60-day public comment period prior to the submission of this ICR to OMB. The submission proposes to revise the information collection for an additional three years and update the burden estimates associated with collecting information in the Chemical Security Assessment Tool (CSAT) for the Chemical Facility Anti-Terrorism Standards (CFATS) Program.

DATES:

Comments are due by February 27, 2023.

ADDRESSES:

You may send comments, identified by docket number through the Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for sending comments.

Instructions: All submissions received must include the agency name “CISA” and docket number CISA-2022-0018. All comments received will be posted without change to http://www.regulations.gov, including any personal information provided.

Comments that include protected information such as trade secrets, confidential commercial or financial information, Chemical-terrorism Vulnerability Information (CVI),^[1] Sensitive Security Information (SSI),^[2] or Protected Critical Infrastructure Information (PCII) ^[3] should not be submitted to the public docket. Comments containing protected information should be appropriately marked and packaged in accordance with all applicable requirements and submission must be coordinated with the point of contact for this notice provided in FOR FURTHER INFORMATION CONTACT section.

FOR FURTHER INFORMATION CONTACT:

Ryan Donaghy, 703-603-5000, [e-mail].

SUPPLEMENTARY INFORMATION:

The CFATS Program identifies chemical facilities of interest and regulates the security of high-risk chemical facilities through a risk-based approach. The CFATS Program is authorized under the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 or “CFATS Act of 2014.^[4]

CISA collects the core regulatory data necessary to implement CFATS through the Chemical Security Assessment Tool (CSAT) covered under this collection. For more information about CFATS and CSAT, please visit www.dhs.gov/​chemicalsecurity. This information collection (OMB Control No. 1670-0007) will expire on July 31, 2023.^[5]

Below, CISA estimates the burden to respondents for the: (1) Top-Screen, (2) Security Vulnerability Assessment (SVA) and Alternative Security Program (ASP) submitted in lieu of an SVA, (3) Site Security Plan (SSP) and ASP submitted in lieu of an SSP, (4) CFATS Help Desk, (5) CSAT User Registration, and (6) Identification of Facilities and Assets at Risk.^[6]

1. CISA'S Methodology in Estimating the Burden for the Top-Screen

Number of Respondents: The current information collection estimated that 2,332 respondents will submit a Top-Screen annually. For this ICR, CISA estimates the annual number of respondents will be 3,817.

The estimate of 3,817 is the sum of the average number of 887 first-time Top-Screen submissions and the average number of 2,930 Top-Screen resubmissions received per year between Calendar Year (calendar year)19 and CY21 (887 first time submissions + 2,930 resubmissions = 3,817).

Estimated Time per Respondent: In the current information collection, the estimated time per respondent to prepare and submit a Top-Screen is 1.09 hours. For this ICR, CISA estimates the time per respondent to prepare and submit a Top-Screen will be 2.04 hours.

Using the data collected between CY19 and CY21, CISA obtained the estimate of 2.04 hours by first determining the average amount of time respondents were logged into the Top-Screen application (0.408 hours or 24.5 minutes). CISA calculated this figure by using the time logged in the application for initial Top-Screens (.50 hours) and Top-Screen resubmission (.38 hours) weighted by the number of respondents that submitted first-time Top-Screens and Top-Screen resubmissions [(887 first-time submissions × 0.50 hours per first time submission) + (2,930 resubmissions × 0.38 hours per resubmission) ÷ 3,817 total submissions = 0.408 hours].

CISA maintains its assumption, based on previous public comments on this information collection, that for every hour a respondent is logged into the Top-Screen application, the respondent spends an average of 4 hours in preparation.^[7] Therefore, based on the 0.408 hours average log in time for the Top-Screen application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to submit a Top-Screen was 2.04 hours [0.408 hours logged into CSAT + (0.408 hours × 4) for preparation = 2.04 hours].

Annual Burden Hours: The annual burden hours for the Top-Screen is 7,785 hours (3,817 respondents × 1 response per respondent × 2.04 hours per response = 7,785 hours).

Total Annual Burden Cost: CISA assumes that Site Security Officers (SSOs) are responsible for submitting Top-Screens. For this ICR, CISA maintains this assumption.

To estimate the total annual burden, CISA multiplied the annual burden of 7,785 hours by the average hourly total compensation rate of SSOs of $90.41 ^[8] per hour. Therefore, the total annual burden cost for the Top-Screen is $703,829 ( i.e., 7,785 hours multiplied by $90.41 per hour).

Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that no capital/startup costs are associated with this instrument.

Total Recordkeeping Burden A respondent that has submitted a Top-Screen may or may not be determined by CISA to present a high level of security risk. Only respondents that present a high level of security risk are required to keep records mandated by CFATS ( i.e., facilities that tier into the CFATS program).

For respondents that are determined to present a high level of security risk, the Top-Screen recordkeeping burden is accounted for within the recordkeeping burden estimate for the “Site Security Plan (SSP) and Alternative Security Program (ASP) submitted in lieu of an SSP” instrument discussed later in this notice in subsection 3, hereafter, referred to as the “SSP/ASP.” The recordkeeping burden estimate for the SSP/ASP instrument accounts for all records respondents are required to maintain under CFATS because CISA assumes that respondents maintain their Top-Screen records in the same manners, formats, and locations as they maintain their other required records. Therefore, CISA estimates that no recordkeeping burden is associated with this instrument.

2. CISA'S Methodology in Estimating the Burden for the Security Vulnerability Assessment (SVA) & Alternative Security Program (ASP) Submitted in Lieu of an SVA

Number of Respondents: The current information collection estimated that each year 1,683 respondents would complete an SVA or ASP in lieu of an SVA, hereafter, referred to as an “SVA/ASP.” For this ICR, CISA estimates that the annual number of respondents will be 2,328, which is based on sum of the average number of SVA/ASP submissions and resubmissions between CY19 and CY21. This consists of an average of 209 first-time SVA/ASPs and 2,119 resubmitted SVA/ASPs per year.

Estimated Time per Respondent: The current information collection estimated the time per respondent for preparing and submitting an SVA/ASP to be 1.24 hours. For this ICR, CISA estimates the time per respondent for preparing and submitting an SVA/ASP will be 1.4136 hours.

Using the data collected between CY19 and CY 21, CISA obtained the estimate of 1.4136 hours by first determining the median amount of time respondents were logged into the SVA/ASP application (0.28 hours or 17 minutes). CISA calculated the average amount of time respondents were logged into the SVA/ASP application by using the median duration respondents were logged into the CSAT SVA/ASP application for an initial SVA/ASP (0.783 hours or 47 minutes) and an SVA/ASP resubmission (0.233 hours or 14 minutes) weighted by the number of respondents that submitted first-time SVAs/ASPs and SVA/ASP resubmissions between CY19 and CY21 which was 0.28 hours ^[9] [(209 first-time submissions × 0.783 hours) + (2,119 resubmissions × 0.233 hours) ÷ 2,328 total submissions = 0.28 hours].

CISA maintains its assumption, based on previous public comments on this information collection, that for every hour a respondent is logged into the SVA/ASP application, the respondent spends an average of 4 hours in preparation. Therefore, based on the 0.28 hours average log in time for the CSAT SVA/ASP application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to prepare and submit an SVA/ASP was 1.4136 hours ^[10] [ 0.28 hours logged into CSAT + (0.28 hours × 4) for preparation].

Annual Burden Hours : The annual burden hours for an SVA/ASP is 3,291 hours ^[11] (2,328 respondents × 1 response per respondent × 1.4136 hours per response = 3,291 hours).

Total Annual Burden Cost : CISA assumes that SSOs will be responsible for submitting SVAs/ASPs. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 3,291 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.^[12] Therefore, the total annual burden cost for the SVA/ASP is $297,530 ( i.e., 3,291 hours multiplied by $90.41 per hour).

Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs for this instrument.

Total Recordkeeping Burden: For respondents that are determined by CISA to present a high level of security risk, the SVA/ASP recordkeeping burden is accounted for within the recordkeeping burden estimate for the SSP/ASP discussed below in Subsection 3 of this section. Therefore, CISA estimates that no recordkeeping burden is associated with this instrument.

3. CISA'S Methodology in Estimating the Burden for the Site Security Plan (SSP) & Alternative Security Program (ASP) Submitted in Lieu of an SSP

Number of Respondents: The current information collection estimated 1,683 SSP/ASP respondents. For this ICR, the Department maintains the assumption that all respondents to the SVA/ASP will be a respondent of the SSP/ASP. Therefore, CISA estimates that the annual number of respondents will be 2,328, which is based on the average number of all respondents to the SVA/ASP. This number breaks down to, on average, 209 initial submissions and 2,119 resubmissions per year.

Estimated Time per Respondent: The current information collection estimated the time per respondent for preparing and submitting an SSP/ASP to be 2.72 hours. For this ICR, CISA estimates the time per respondent for preparing and submitting an SSP/ASP will be 7.845 hours.

CISA intends to make a revision to the SSP/ASP instrument to collect facility internet Protocol (IP) address(es) and Domain Name System (DNS) information. The collection of IP address(es) and DNS information supports the development of a facility's SSP in accordance with 6 U.S.C. 622 (a)(2)(D)(ii) and 6 CFR 27.225(a)(4). In addition, CISA may potentially use this information to integrate with other data within the U.S. Government, conduct related analysis, and provide warnings about cyber threats affecting chemical facilities. CISA expects that answering these questions will not meaningfully increase the estimated SSP/ASP completion time.

Using the data collected between CY 19 and CY 21, CISA obtained the estimate of 7.845 hours by first determining the average amount of time respondent were logged into the SSP/ASP application (1.5689 hours or 94 minutes). CISA calculated the average amount of time respondents were logged into the SSP/ASP application by using the median duration respondents were logged into the SSP/ASP application for an initial SSP/ASP (4.63 hours or 278 minutes) and an SSP/ASP resubmission (1.27 hours or 76 minutes) weighted by the number of respondents that submitted first-time SSPs/ASPs and SSP/ASP resubmissions between CY19 and CY21, which was 1.5689 hours (94 minutes) [ (209 first-time submissions × 4.6333 hours) + (2,119 resubmissions × 1.2666 hours) ÷ 2,328 total submissions = 1.5689 hours].

CISA maintains its assumption, based on previous public comments on this information collection, that for every hour a respondent is logged into the SSP/ASP application, the respondent spends an average of 4 hours in preparation. Therefore, based on the 1.57 hours average log in time for the CSAT SSA/ASP application and the 4 hours of average preparation time, CISA calculates that between CY19 and CY21, the burden per respondent to prepare and submit an SSP/ASP was 7.845 hours [1.5689 hours logged into CSAT + (1.5689 hours × 4) for preparation].

Annual Burden Hours: The annual burden hours for SSPs/ASPs is 18,262 hours (2,328 respondents × 1 response per respondent × 7.845 hours per response).

Total Annual Burden Cost : CISA assumes that SSOs will be responsible for submitting SSPs/ASPs. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 18,262 hours by the average hourly total compensation rate of SSOs of $90.41 per hour ^[13] . Therefore, the total annual burden cost for the SVA/ASP is $ 1,651,158 ( i.e., 18,262 hours multiplied by $90.41 per hour).

Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs.

Total Recordkeeping Burden : The current information collection estimated a recordkeeping burden of approximately $516,825. For this information collection, CISA estimates a recordkeeping burden of $556,040. CISA maintained the methodology and assumptions described in the current information collection but increased the current estimate to account for updating the hourly compensation rates ^[14] to $44.18 and inflating the 2017 ICR renewal capital/startup costs by an inflation factor ^[15] of 1.09.

For this ICR, CISA maintains its approach of accounting for the entire recordkeeping burden imposed on covered chemical facilities under CFATS within the SSP/ASP instrument, because: (1) only covered chemical facilities are required to maintain records; (2) no changes to the recordkeeping requirements have occurred since the approval of the current information collection; and (3) CISA's historical assumption that respondents maintain any other required records in the same manners, formats, and locations as they maintain their SSP/ASP records.

4. CISA'S Methodology in Estimating the Burden for the CFATS Help Desk

Number of Respondents The current information collection estimated that CISA receives 15,000 requests annually for CFATS Help Desk support ( i.e., 15,000 respondents via phone calls, emails, and web-based help request forms). CISA is proposing to lower this estimate to 12,000 respondents.

CISA evaluated historical data to determine if the estimated number of CFATS Help Desk requests ( i.e., 15,000) was still appropriate. Between CY19 and CY21, the average annual number of CFATS Help Desk requests was 11,819. Therefore, CISA believes that lowering the existing estimate of 15,000 respondents to 12,000 is appropriate.

Estimated Time per Respondent: The current estimated time per respondent for the CFATS Help Desk is 0.17 hours (10 minutes). CISA is proposing to lower this estimate to 0.1167 hours (7 minutes).

CISA evaluated historical data to determine if the estimated time per respondent of 0.17 hours (10 minutes) was still appropriate. Between CY19 and CY21, the average duration for a CFATS Help Desk call was approximately 7 minutes (6 minutes and 46 seconds), which is a slight decrease from the average duration for a CFATS Help Desk call reported by CISA in previous years. CISA does not have any information on the average amount of time it took respondents to type and send emails to the CFATS Help Desk.

Because the average duration for a CFATS Help Desk call remains below the current estimate of 0.17 hours, CISA believes that it is appropriate to lower the estimate for this information collection to 0.1167 hours.

Annual Burden Hours: The average annual burden hours for the CFATS Help Desk will be 1,400 hours [12,000 respondents × 0.1167 hours per respondent = 1,400 hours].

Total Annual Burden Cost: CISA assumes that SSOs will be responsible for contacting the CFATS Help Desk. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 1,400 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.^[16] Therefore, the total annual burden cost for the CFATS Help Desk is $126,580 ( i.e., 1,400 hours multiplied by $90.41 per hour.

Total Burden Cost (Capital/Startup): Contacting the CFATS Help Desk is free and CISA assumes that each respondent already has a phone or access to the internet for basic business needs. Therefore, CISA estimates that there are no capital/startup costs.

Total Recordkeeping Burden: There is no recordkeeping burden for this instrument.

5. CISA's Methodology in Estimating the Burden for the CSAT User Registration

Number of Respondents: The current information collection estimated 1,000 respondents would complete the user registration process annually. For this ICR, CISA maintains this estimate.

Historically, CISA's estimate in the current information collection was primarily based on the number of individuals expected to register as a CSAT Authorizer, Submitter, and/or Preparer. However, the scope of the CSAT User Registration instrument in the current information collection was intended to allow for the creation of additional CSAT user roles such as the Administrator and Personnel Surety (PS) Submitter user roles. Because the estimate has always been very conservative, for example, between CY19 and CY21 the average annual number of individuals registered was 540. Thus, CISA believes that maintaining the current estimate of 1,000 respondents annually is a reasonable estimate that reflects the user registration activity for all types of CSAT users.

Estimated Time per Respondent: In the current information collection, the estimated time per respondent is 2.5 hours. CISA proposes to maintain the current estimate.

This estimate is based on two factors: (1) the actual time needed to complete the CSAT User Registration process continues to be approximately 0.5 hours (30 minutes); and (2) CISA expects that CSAT Authorizers need additional time to manage the CSAT user accounts for which they are responsible.

The ongoing management of the CSAT user accounts includes activities such as, but not limited to: (1) assigning Submitters and Preparers to facilities; (2) updating the facilities with which a Submitter or Preparer is associated as his or her duties change; (3) creating groups ^[17] to support the CFATS Personnel Surety (PS) Program; (4) assigning PS Submitters to groups; and (5) updating the PS Submitters' access to groups as their duties change.

CISA intends to revise the user registration instrument to collect facility Employer Identification Numbers (EIN). The collection of EIN information will allow CISA to identify chemical facilities of interest, in accordance with 6 U.S.C. 622(a)(2)(A)(i), within datasets that are in the possession of the Federal Government. CISA expects that answering these questions will not meaningfully increase the estimated time per respondent.

For this ICR, CISA is applying the assumption based on previous public comments on this information collection ( i.e., OMB Control No. 1670-0007) that for every hour a respondent is logged into the CSAT application, the respondent spends an average of 4 hours in preparation ( e.g., coordinating with CFATS-facility stakeholders, including Human Resources, Procurement, or Contract Administration to explain the PS Program requirements and determine how best to gather the data from different populations). Therefore, CISA's estimated time per respondent is 2.5 hours [ 0.50 hours logged into CSAT + (0.50 hours × 4) for preparation = 2.5 hours].

Annual Burden Hours: The annual burden estimate for CSAT User Registration is 2,500 hours [ 1,000 respondents × 1 response per respondent × 2.5 hours per respondent = 2,500 hours].

Total Annual Burden Cost : CISA assumes that SSOs will be responsible for CSAT User Registration. For this ICR, CISA maintains this assumption. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 2,500 hours by the average hourly total compensation rate of SSOs of $90.41 per hour.^[18] Therefore, the total annual burden cost for the CSAT User Registration is $226,035 ( i.e., 2,500 hours multiplied by $90.41 per hour).

Total Burden Cost (Capital/Startup): CISA provides access to CSAT free of charge and CISA assumes that each respondent already has access to the internet for basic business needs. Therefore, for this ICR CISA estimates that there are no capital/startup costs for this instrument.

Total Recordkeeping Burden: There is no recordkeeping burden for this instrument.

6. CISA'S Methodology in Estimating the Burden for Identification of Additional Facilities and Assets at Risk

Number of Respondents. The current information collection estimated that each year 3,426 respondents would respond to this instrument. For this ICR, CISA estimates the number of respondents will be 2,252.

This instrument is composed of two sections titled “Identification of Facilities” and a second section titled “Assets at Risk.” The first section collects information on a voluntary basis when a facility ships and/or receives Chemicals of Interest (COI). The second section collects information on a voluntary basis when the facility identifies a cyber system. The estimate of 2,252 respondents is based upon the sum of 439 respondents for the first section of this instrument and 1,813 respondents for the second section of this instrument.

CISA estimated 439 respondents for the first section of the instrument by using data on the number of compliance inspection conducted between CY 2019 and CY 2021. Between CY19 and CY21, CISA completed an average of 1,021 compliance inspections per year. Of these inspections, approximately 43 percent of the covered chemical facilities inspected ship COI. Therefore, because CISA only requests this information from covered chemical facilities that undergo compliance inspections and ship COI, CISA estimates 439 respondents for the first section of the instrument [ 1,021 facilities inspected × 43 percent of facilities ship COI = 439].

With respect to the second section of the instrument (“Assets at Risk”), if a covered chemical facility has identified a cyber-related system in their SVA or SSP, CISA may request the information covered under this section of the instrument during interactions that occur during: (1) Compliance Assistance Visits, (2) Authorization Inspections, and (3) Compliance Inspections.^[19] Between CY 2019 and CY 2021, CISA has performed 5,438 of these interactions at facilities and asked questions about assets at risk. Therefore, CISA estimates 1,813 respondents ^[20] for the second section of the instrument by annualizing the number of interactions described above ( i.e., 1,813 = [5438 respondents divided by a 3-year time-period]).

Estimated Time per Respondent: In the current information collection, the estimated time per respondent is 0.17 hours (10 minutes). In this ICR, CISA maintains this estimate.

Annual Burden Hours: The annual burden estimate is 375 hours [ 2,252 respondents × 1 response per respondent × 0.17 hours per respondent].

Total Annual Burden Cost : CISA assumes that SSOs will be responsible for providing this information. Therefore, to estimate the total annual burden, CISA multiplied the annual burden of 375 hours by the average hourly total compensation rate of SSOs of $90.41 ^[21] per hour. Therefore, the total annual burden cost for this instrument is $33,931 (375 hours multiplied by $90.41 per hour).

Total Burden Cost (Capital/Startup): CISA estimates that there are no capital/startup costs for this instrument.

Total Recordkeeping Burden: There is no recordkeeping burden for this instrument.

Public Participation: OMB is particularly interested in comments that:

1. Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;

2. Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;

3. Enhance the quality, utility, and clarity of the information to be collected; and

4. Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques, or other forms of information technology ( e.g., permitting electronic submissions of responses).

Analysis

Title of Collection: Chemical Security Assessment Tool

OMB Control Number: 1670-0007

Instrument: Top-Screen

Frequency: “On occasion” and “Other”

Affected Public: Business or other for-profit

Number of Respondents: 3,817 respondents (estimate)

Estimated Time per Respondent: 2.04 hours

Total Annual Burden Hours: 7,785 hours

Total Annual Burden Cost: $703,829

Total Annual Burden Cost (capital/startup): $0

Total Recordkeeping Burden: $0

Instrument: Security Vulnerability Assessment and Alternative Security Program submitted in lieu of a Security Vulnerability Assessment

Frequency: “On occasion” and “Other”

Affected Public: Business or other for-profit

Number of Respondents: 2,328 respondents (estimate)

Estimated Time per Respondent: 1.4136 hours

Total Annual Burden Hours: 3,291 hours

Total Annual Burden Cost: $297,530

Total Annual Burden Cost (capital/startup): $0

Total Recordkeeping Burden: $0

Instrument: Site Security Plan and Alternative Security Program submitted in lieu of a Site Security Plan.

Frequency: “On occasion” and “Other”

Affected Public: Business or other for-profit.

Number of Respondents: 2,328 (estimate).

Estimated Time per Respondent: 7.845 hours.

Total Annual Burden Hours: 18,262 hours.

Total Annual Burden Cost: $1,651,158.

Total Annual Burden Cost (capital/startup): $0.

Total Recordkeeping Burden: $556,040.

Instrument: CFATS Help Desk

Frequency: “On occasion” and “Other”.

Affected Public: Business or other for-profit.

Number of Respondents: 12,000 respondents (estimate).

Estimated Time per Respondent: 0.1167 hours.

Total Annual Burden Hours: 1,400 hours.

Total Annual Burden Cost: $126,580.

Total Annual Burden Cost (capital/startup): $0.

Total Recordkeeping Burden: $0.

Instrument: User Registration.

Frequency: “On occasion” and “Other”.

Affected Public: Business or other for-profit.

Number of Respondents: 1,000 respondents (estimate).

Estimated Time per Respondent: 2.5 hours.

Total Annual Burden Hours: 2,500 hours.

Total Annual Burden Cost: $226,035.

Total Annual Burden Cost (capital/startup): $0.

Total Recordkeeping Burden: $0.

Instrument: Identification of Facilities and Assets at Risk.

Frequency: “On occasion” and “Other”.

Affected Public: Business or other for-profit.

Number of Respondents: 2,252 respondents (estimate).

Estimated Time per Respondent: 0.17 hours.

Total Annual Burden Hours: 375 hours.

Total Annual Burden Cost: $33,931.

Total Annual Burden Cost (capital/startup): $0.

Total Recordkeeping Burden: $0.

Robert Costello,

Chief Information Officer, Department of Homeland Security, Cybersecurity and Infrastructure Security Agency.

Footnotes

1.  For more information about CVI see 6 CFR 27.400 and the CVI Procedural Manual at www.dhs.gov/​publication/​safeguarding-cvi-manual.

2.  For more information about SSI see 49 CFR part 1520 and the SSI Program web page at www.tsa.gov/​for-industry/​sensitive-security-information.

3.  For more information about PCII see 6 CFR part 29 and the PCII Program web page at www.dhs.gov/​pcii-program.

4.  The CFATS Act of 2014 codified the CFATS program into the Homeland Security Act of 2002. See 6 U.S.C. 621 et seq., as amended by Public Law 116-135, Sec. 16007 (2020).

5.  The currently approved version of this information collection (OMB Control No. 1670-0007) can be viewed at https://www.reginfo.gov/​public/​do/​PRAViewICR?​ref_​nbr=​201905-1670-001.

6.  Throughout this analysis, CISA presents rounded hourly time burden estimates and hourly compensation rates to assist in reproducing the results. However, CISA's actual calculations use unrounded figures; consequently, some reproduced results may not exactly match the reported results.

7.  CISA's adoption of the assumption that for every hour a respondent is logged into the Top-Screen application, SVA/ASP application, and SSP/ASP application, the respondent spends an average of 4 hours in preparation is described in the 30-day notice the Department published for this information collection in March 2013 at 78 FR 16694, which may be viewed at https://www.federalregister.gov/​d/​2013-06095.

8.  Mean hourly wage was obtained from U.S. Department of Labor, BLS; May 2021 Occupational Employment and Wage Statistics, OES Managers, All Other. (Occupational Code 11-9199). Retrieved from https://www.bls.gov/​oes/​2021/​may/​oes_​nat.htm. of $62.36 times the wage rate benefit multiplier of 1.4499 (to account for fringe benefits) equaling $90.4141. The benefits multiplier is estimated by dividing total compensation of $40.35 by salaries and wages of $27.83, based on Employer Cost for Employee Compensation, December 2021, released March 18, 2022 ( https://www.bls.gov/​news.release/​archives/​ecec_​03182022.pdf).

9.  0.28271 hours.

10.  1.4136 hours = 0.2827 hours + 1.1308 hours.

11.  3,290.75 hours.

12.  $90.4142 is the hourly labor costs, including wages and benefits.

13.  $90.4142 is the hourly labor costs, including wages and benefits.

14.  Mean hourly wage was obtained from U.S. Department of Labor, BLS; May 2021 Occupational Employment and Wage Statistics, OES First-Line Supervisors of Office and Administrative Support Workers, (Occupational Code 43-1011). Retrieved from https://www.bls.gov/​oes/​2021/​may/​oes_​nat.htm. of $30.47 times the wage rate benefit multiplier of 1.4499 (to account for fringe benefits) equaling $44.177. The benefits multiplier is estimated by dividing total compensation of $40.35 by salaries and wages of $27.83, based on Employer Cost for Employee Compensation, December 2021, released March 18, 2022 ( https://www.bls.gov/​news.release/​archives/​ecec_​03182022.pdf).

15.  Federal Reserve Bank of St. Louis, Federal Reserve Economic Data, GDP factor from 2017 to 2021 dollars was 1.0975 = 113.0664÷103.02 https://fred.stlouisfed.org/​series/​USAGDPDEFAISMEI.

16.  $90.4142 is the hourly labor costs, including wages and benefits.

17.  “Groups” is a technical term used by CISA to describe how a covered chemical facility may manage the access to records about affected individuals in the CSAT Personnel Surety application. CISA describes the term “groups” and provides additional information about how to create and manage groups in section 9.5 of the CSAT User Manual, which may be viewed at https://www.dhs.gov/​sites/​default/​files/​publications/​csat-portal-user-manual-508-2.pdf.

18.  $90.4142 is the total compensation per hour, including wages and benefits.

19.  This information is not covered under the SSP because the information is not subsequently submitted through the CSAT SSP but rather documented by an inspector or other appropriate employee of CISA.

20.  1,812.67 = (5438 ÷ 3).

21.  $90.4142 is the total compensation per hour, including wages and benefits.