2018-12523. Chemical Facility Anti-Terrorism Standards Personnel Surety Program

AGENCY:

National Protection and Programs Directorate (NPPD), Department of Homeland Security (DHS).

ACTION:

30-Day notice and request for comments; revision of information collection request: 1670-0029.

SUMMARY:

The DHS NPPD Office of Infrastructure Protection (IP), Infrastructure Security Compliance Division (ISCD) will submit the following information collection request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995. NPPD previously published this ICR, in the Federal Register on December 27, 2017, for a 60-day public comment period.

In this notice NPPD is responding to seven commenters that submitted comments in response to the 60-day notice previously published for this ICR and soliciting public comment concerning this ICR for an additional 30 days.

DATES:

Comments are encouraged and will be accepted until July 18, 2018.

ADDRESSES:

Interested persons are invited to submit written comments on the proposed information collection to the Office of Information and Regulatory Affairs, OMB. Comments should be addressed to OMB Desk Officer, Department of Homeland Security, National Protection and Programs Directorate and sent via electronic mail to [e-mail]. All submissions must include the words “Department of Homeland Security” and the OMB Control Number 1670-0029.

Comments submitted in response to this notice may be made available to the public through relevant websites. For this reason, please do not include in your comments information of a confidential nature, such as sensitive personal information or proprietary information. Please note that responses to this public comment request containing any routine notice about the confidentiality of the communication will be treated as public comments that may be made available to the public notwithstanding the inclusion of the routine notice.

Comments that include trade secrets, confidential commercial or financial information, Chemical-terrorism Vulnerability Information (CVI), Sensitive Security Information (SSI), or Protected Critical Infrastructure Information (PCII) should not be submitted to the public regulatory docket. Please submit such comments separately from other comments in response to this notice. Comments containing trade secrets, confidential commercial or financial information, CVI, SSI, or PCII should be appropriately marked and packaged in accordance with applicable requirements and submitted by mail to the DHS/NPPD/IP/ISCD CFATS Program Manager at the Department of Homeland Security, 245 Murray Lane SW, Mail Stop 0610, Arlington, VA 20528-0610. Comments must be identified by OMB Control Number 1670-0029. The Department will forward all comments received by the submission deadline to the OMB Desk Officer.

FOR FURTHER INFORMATION CONTACT:

Questions and requests for additional information may be directed to Amy Graydon or the CFATS Program Manager via email at [e-mail] or telephone at [phone].

SUPPLEMENTARY INFORMATION:

On December 18, 2014, the President signed into law the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, Public Law 113-254 (CFATS Act of 2014) providing long-term authorization for the Chemical Facility Anti-Terrorism Standards (CFATS) program. The CFATS Act of 2014 codified the Department's authority to implement the CFATS program into the Homeland Security Act of 2002. See 6 U.S.C. 621 et. seq.

Section 550 of the Department of Homeland Security Appropriations Act of 2007, Public Law 109-295 (2006) (“Section 550”), provided (and the CFATS Act of 2014 continues to provide) the Department with the authority to identify and regulate the security of high-risk chemical facilities using a risk-based approach. On April 9, 2007, the Department issued the CFATS Interim Final Rule (IFR), implementing this statutory mandate. See 72 FR 17688.

Section 550 required (and the CFATS Act of 2014 continues to require) that the Department establish risk-based performance standards (RBPS) for high-risk chemical facilities. Through the CFATS regulations, the Department promulgated 18 RBPS. Each chemical facility that has been finally determined by the Department to be high-risk must submit, for Department approval, a Site Security Plan (SSP) or an Alternative Security Program (ASP), whichever the high-risk chemical facility chooses, that satisfies each applicable RBPS. RBPS 12 requires high-risk chemical facilities to perform appropriate background checks on and ensure appropriate credentials for facility personnel, and, as appropriate, unescorted visitors with access to restricted areas or critical assets. RBPS 12(iv) specifically requires high-risk chemical facility to implement measures designed to identify people with terrorist ties. For the purposes of the CFATS Personnel Surety Program (PSP), `people' in RBPS 12(iv) is in reference to affected individuals (i.e., facility personnel or unescorted visitors with or seeking access to restricted areas or critical assets at high-risk chemical facilities).

Identifying affected individuals who have terrorist ties is an inherently governmental function and requires the use of information held in government-maintained databases that are unavailable to high-risk chemical facilities. See 72 FR 17688, 17709 (April 9, 2007). Thus, under RBPS 12(iv), the Department and high-risk chemical facilities must work together to satisfy the “terrorist ties” aspect of the Personnel Surety performance standard.

In accordance with the Homeland Security Act of 2002, as amended by the CFATS Act of 2014, the following options are available to enable high-risk chemical facilities to facilitate the vetting of affected individuals for terrorist ties:

Option 1. High-risk chemical facilities may submit certain information about affected individuals, which the Department will use to vet those individuals for terrorist ties. Specifically, the identifying information about affected individuals will be compared against identifying information of known or suspected terrorists contained in the Federal Government's consolidated and integrated terrorist watch list, the Terrorist Screening Database (TSDB), which is maintained by the Department of Justice (DOJ) Federal Bureau of Investigation (FBI) in the Terrorist Screening Center (TSC).^[1]

Option 2. High-risk chemical facilities may submit information about affected individuals who already possess certain credentials or documentation that rely on security threat assessments conducted by the Department. This will enable the Department to verify the continuing validity of these credentials or documentation.

Option 3. High-risk chemical facilities may comply with RBPS 12(iv) without submitting to the Department information about affected individuals who possess Transportation Worker Identification Credentials (TWICs), if a high-risk chemical facility electronically verifies and validates the affected individual's TWICs through the use of TWIC readers (or other technology that is periodically updated using the Canceled Card List).

Option 4. High-risk chemical facilities may visually verify certain credentials or documents that are issued by a Federal screening program that periodically vets enrolled individuals against the TSDB. The Department continues to believe that visual verification has significant security limitations and, accordingly, encourages high-risk chemical facilities choosing this option to identify in their SSPs the means by which they plan to address these limitations.

In addition to the options described above for satisfying RBPS 12(iv), a high-risk chemical facility is welcome to propose alternative or supplemental options in its SSP that are not described in this document. The Department will assess the adequacy of such alternative or supplemental options on a facility-by-facility basis in the course of evaluating each facility's SSP.

Under Option 3 and Option 4, a high-risk chemical facility would not need to submit information about an affected individual to the Department. These Options are only mentioned in this notice for informational purposes, and there will be no analysis of Option 3 and Option 4 in this information collection request.

This information collection request does not propose changes to who qualifies as an affected individual. There are certain groups of persons that the Department does not consider to be affected individuals, such as (1) Federal officials that gain unescorted access to restricted areas or critical assets as part of their official duties; (2) state and local law enforcement officials that gain unescorted access to restricted areas or critical assets as part of their official duties; and (3) emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations.

OMB is particularly interested in comments that:

1. Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;

2. Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;

3. Enhance the quality, utility, and clarity of the information to be collected; and

4. Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submissions of responses.

The current information collection for the CFATS PSP (IC 1670-0029) will expire on August 31, 2018.^[2]

Summary of Proposed Revisions to the Information Collection

The Department is seeking a revision to the CFATS PSP Information Collection to: (1) Obtain approval to collect information about affected individuals from all high-risk chemical facilities rather than only Tier 1 and Tier 2 high-risk chemical facilities; (2) update the estimated number of annual respondents from 195,000 to 72,607 based on historical information collected since the Department implemented the CFATS PSP; and (3) update the estimated time per respondent from 0.58 hours to 0.1667 hours based upon historical data collected by the Department since the implantation of the CFATS PSP.

Collection at All High-Risk Chemical Facilities

In response to multiple comments on the current ICR, the Department agreed to a “phased implementation” of the CFATS PSP to Tier 1 and Tier 2 high-risk chemical facilities. Based on lessons learned and the near completion of the implementation at Tier 1 and Tier 2 high-risk chemical facilities, the Department now seeks to close a security gap by implementing CFATS PSP at all high-risk chemical facilities. As implemented at Tier 1 and Tier 2 high-risk chemical facilities, the Department will roll out the CFATS PSP in a “phased implementation” to Tier 3 and Tier 4 high-risk chemical facilities.

Updates to Burden Estimate Based on Historical Information

The Department implemented the CFATS PSP in December 2015. Since implementation, the Department has evaluated many of the assumptions it used when estimating the burden estimate of this Information Collection. As a result, several of the assumptions can be revised using actual data rather than assumptions. The burden methodology and revised estimates are described in, “The Department's Methodology in Estimating the Burden for CFATS PSP Information Collection.”

Information Collected About Affected Individuals

This information collection request does not propose changes to the information collected on affected individuals.

Option 1: Collecting Information To Conduct Direct Vetting

If high-risk chemical facilities select Option 1 to satisfy RBPS 12(iv) for an affected individual, the following information about the affected individual would be submitted to the Department:

• For U.S. Persons (U.S. citizens and nationals, as well as U.S. lawful permanent residents):

○ Full Name;

○ Date of Birth; and

○ Citizenship or Gender.

• For Non-U.S. Persons:

○ Full Name;

○ Date of Birth;

○ Citizenship; and

○ Passport information and/or alien registration number.

To reduce the likelihood of false positives in matching against records in the Federal Government's consolidated and integrated terrorist watchlist, high-risk chemical facilities would also be able to submit the following optional information about an affected individual to the Department:

• Aliases;
• Gender (for Non-U.S. Persons);
• Place of Birth; and/or
• Redress Number.^[3]

High-risk chemical facilities have the option to create and use the following field(s) to collect and store additional information to assist with the management of an affected individual's records. Any information collected in this field will not be used to support vetting activities.

• User Defined Field(s)

Table 1 summarizes the biographic data that would be submitted to the Department under Option 1.

Table 1—Required and Optional Data for an Affected Individual Under Option 1

Data elements submitted to the department	For a U.S. person	For a non-U.S. person
Full Name	Required
Date of Birth	Required
Gender	Must provide	Optional.
Citizenship	Citizenship or Gender	Required.
Passport Information and/or Alien Registration Number	N/A	Required.
Aliases	Optional
Place of Birth	Optional
Redress number	Optional
User Defined Field(s)	Optional (Not used for vetting purposes)

Option 2: Collecting Information To Use Vetting Conducted Under Other DHS Programs

In lieu of submitting information to the Department under Option 1 for vetting of terrorist ties, high-risk chemical facilities also have the option, where appropriate, to submit information to the Department to electronically verify that an affected individual is currently enrolled in another DHS program that vets for terrorist ties.

To verify an affected individual's enrollment in one of these programs under Option 2, the Department would collect the following information about the affected individual:

• Full Name;
• Date of Birth; and
• Program-specific information or credential information, such as unique number or issuing entity (e.g., state for Commercial Driver's License [CDL] associated with an Hazardous Material Endorsement [HME]).

To reduce the likelihood of false positives, high-risk chemical facilities may also submit the following optional information about an affected individual to the Department:

• Aliases;
• Gender;
• Place of Birth; and/or
• Citizenship.

High-risk chemical facilities have the option to create and use the following field(s) to collect and store additional information to assist with the management of an affected individual's records. Any information collected in this field will not be used to support vetting activities.

• User Defined Field(s)

Table 2 summarizes the biographic data that would be submitted to the Department under Option 2.

Table 2—Required and Optional Data for an Affected Individual Under Option 2

Data Elements Submitted to the Department
Full Name	Required.
Date of Birth	Required.
Program-specific information or credential information, such as expiration date, unique number, or issuing entity	Required.
Aliases	Optional.
Gender	Optional.
Place of Birth	Optional.
Citizenship	Optional.
User Defined Field(s)	Optional (Not used for vetting purposes).

Other Information Collected

The Department may also contact a high-risk chemical facility or its designees to request additional information (e.g., visa information) pertaining to an affected individual in order to clarify suspected data errors or resolve potential matches (e.g., an affected individual has a common name). Such requests will not imply, and should not be construed to indicate, that an affected individual's information has been confirmed as a match to a record of an individual with terrorist ties.

The Department may also collect information provided by individuals or high-risk chemical facilities in support of any adjudication requests under Subpart C of the CFATS regulation,^[4] or in support of any other redress requests.^[5]

Responses to Comments Submitted During 60-Day Comment Period

The Department solicited comments on four questions:

(1) Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;

(2) Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;

(3) Enhance the quality, utility, and clarity of the information to be collected; and

(4) Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submissions of responses.

In response to the 60-Day Notice that solicited comments about the CFATS PSP ICR, the Department received twenty-seven comments from seven commenters. The seven commenters were all industry association.

Comments Related to Whether the Proposed Collection of Information Is Necessary for the Proper Performance of the Function of the Agency, Including Whether the Information Will Have Practical Utility

Comment: Four commenters suggested that the Department conduct further assessments on the PSP:

One commenter suggested that the Department “should not expand the program until it can see the successes and failures it has with Tier 1 and Tier 2 facilities.” Further, the commenter suggested a “formal assessment, in conjunction with the Department of Justice and the Federal Bureau of Investigation, on the benefits and positive outcomes of running PSP-gained information through the TSDB [Terrorist Screening Database]” be conducted. The commenter also suggested that such a review could evaluate the effectiveness of the CFATS PSP and opportunities “to make it more effective.”

A second commenter encouraged the Department to “examine the effectiveness of such screening before proceeding to subject the bulk of CFATS regulated facilities to these additional measures.” The second commenter suggested the Department conduct a comprehensive evaluation, similar to the comprehensive evaluation the Transportation Security Administration (TSA) is conducting with respect to the Transportation Worker Identification Credentials (TWIC) Program,^[6] before determining whether to expand the CFATS PSP to Tier 3 and Tier 4 covered chemical facilities.

A third commenter referenced an ongoing Government Accountability Office (GAO) assessment of the CFATS program and speculated that the GAO assessment might review the implementation of the CFATS PSP. The commenter suggested that the Department could benefit from considering the results of the GAO assessment with respect “to tailoring implementation of PSP for Tier 3 and 4 facilities.” The commenter also suggested that if the GAO assessment does not include a review of the CFATS PSP, the Department should undertake such an analysis. In conclusion, the same commenter suggested that the Department not expand the CFATS PSP to Tier 3 and Tier 4 covered chemical facilities until such an analysis has been conducted and the results used to inform the CFATS PSP ICR.

A fourth commenter requested that the Department allow a third-party review of the CFATS PSP after a suitable period of time has passed to determine if the program adds value to the security of the nation.

Response: The Department does not believe that additional analysis is needed prior to OMB approving the collection of information concerning affected individuals from all covered chemical facilities. The Department has closely reviewed how Tier 1 and Tier 2 covered chemicals facilities have implemented the check for terrorist ties. Tier 1 and Tier 2 covered chemical facilities have varied by size, complexity, security issue, and location.

Additionally, vetting for terrorist ties for all four tiers of covered facilities is required by CFATS. Members of the public commented on the CFATS rulemaking in 2007 before the regulation was finalized, and DHS considered all public comments (including comments about terrorist ties vetting and background checks) in coming to the reasoned decision to vet affected individuals for terrorist ties at all tiered facilities as part of the program. DHS disagrees that a modification to the program to eliminate this requirement for Tiers 3 and 4 or to indefinitely delay its rollout in order to conduct additional analysis would be appropriate. Preventing terrorist access to high-risk chemical facilities' restricted areas and critical assets is a core purpose of CFATS, and failure to conduct terrorist ties checks may allow terrorist to gain access.

Comment: One commenter reiterated its continued objection to the inclusion of railroad employees is within the scope of CFATS because the commenter claims that inclusion of railroad employees lacks a risk-based justification.

Response: Under CFATS, the Department regulates covered chemical facilities that present a high risk from terrorist attack. Effectively regulating chemical facility security involves assessing whether terrorists have access to facilities, and terrorists seeking access might not be limited to facility employees. To help reduce risk to high-risk facilities, the Department requires covered chemical facilities to conduct a check for terrorist ties on affected individuals (e.g., facility personnel and unescorted visitors) with or seeking access to restricted areas and critical assets. A covered chemical facility has the discretion to decide if they want to escort railroad employees as visitors, identify railroad employees as affected individuals, or treat them in some other way consistent with CFATS requirements. Identifying railroad employees as affected individuals would require a covered chemical facility to ensure that those personnel are screened for terrorist ties pursuant to 6 CFR 27.230(a)(12).

In ensuring affected individuals are screened for terrorist ties, the facility has the discretion to choose from four options for vetting affected individuals or propose alternatives or supplemental options in its SSP or ASP (See 82 FR 61312, 61316).^[7]

Comment: One commenter highlighted the Department of Transportation (DOT) requirement at 49 CFR 172.802(a)(1) which states, “Personnel security. Measures to confirm information provided by job applicants hired for positions that involve access to and handling of the hazardous materials covered by the security plan. . . .” The commenter suggested that railroad employees having undergone such a background check and demonstrated their reliability by being stewards of the chemical during transit, should “not suddenly seem suspect simply by crossing a fence line at a covered chemical facility.”

Response: It is the Department's understanding that the sort of background checks discussed by the commenter do not include checks for terrorist ties. Checks for terrorist ties are required under CFATS (6 CFR 27.230(a)(12)).

Comments Related to the Accuracy of the Agency's Estimate of the Burden of the Proposed Collection of Information, Including the Validity of the Methodology and Assumptions Used

Comment: One commenter recognizes the assumptions that release facilities may have more affected individuals than theft and diversion facilities, that there are an average of 106 employees per facility, and that the time it takes to vet an affected individual may be valid, but states, “it is not clear upon what information they [the assumptions] are based.”

Response: The Department based the assumptions on historical data collected by the Department since the implementation of the CFATS PSP. Specifically, for the difference between release and theft and diversion facilities, the Department recognizes that high-risk chemical facilities for release security issues may take a facility-wide approach rather than an asset-based approach in defining their restricted areas, which may result in a higher number of affected individuals than theft and diversion facilities. Therefore, the Department reviewed the number of release sites to ensure the estimated number of respondents for the Tier 3 and Tier 4 high-risk chemical facilities were comparable to the historical data received by the Department since the implementation of the CFATS PSP. The Department found that the release security issues for Tier 1 and Tier 2 high-risk chemical facilities made up 38 percent of the total Tier 1 and Tier 2 high-risk chemical facility population. For Tier 3 and Tier 4 high-risk chemical facilities, the release security issue made up 25 percent of the total Tier 3 and Tier 4 high-risk chemical facility population. Based on these findings, the Department is satisfied that the Tier 1 and Tier 2 high-risk chemical facility historical data provided a valid representation of what the Department can expect from Tier 3 and Tier 4 high-risk chemical facilities.

Specifically for the 106 employees, the Department estimates that under this collection there are (a) 200 Tier 1 and Tier 2 high-risk chemical facilities that did submit or will have to submit information about affected individuals under the current ICR, and (b) 3,700 Tier 3 and Tier 4 high-risk chemical facilities that will submit for the first time under this new collection. Historically, each Authorizer submitted, on average, 180 initial respondents, with each Authorizer responsible for 1.7 high-risk chemical facilities. Dividing 180 affected individuals per Authorizer by 1.7 high-risk chemical facilities results in an average of 106 initial respondents submitted per high-risk chemical facility.

The Department's estimate per respondent (affected individual) is based on industry feedback and historical data collected on their use of the CFATS PSP application. The Department has estimated the time per respondent to be 5 minutes per submission of a record about an affected individual. Since this estimate is based on current submissions from Tier 1 and Tier 2 high-risk chemical facilities, the Department has chosen an estimate of 10 minutes per record to provide a more conservative estimate.

Comment: Two commenters expressed concern that the ICR did not appear to account for the burden associated with part-time or seasonal employees or contractors that qualify as affected individuals.

Response: The Department's estimate of the number of affected individuals in the 60-day notice was based on actual data submitted by covered chemical facilities at which seasonal and part-time employees (to include contractors) are considered affected individuals. Thus, the Department concludes that the historical data relied upon in the 60-day notice incorporates seasonal and part-time employees.

Comment: Three commenters felt the personal identifiable information collection is not “usual and customary”:

One commenter disagreed with the Department's decision to invoke 5 CFR 1320.3(b)(2) to exclude “certain activities and costs related to the PSP data collection process.” The commenter suggested that two assumptions made by the Department are not accurate. Specifically, that (a) the Department's assumption that facilities already possess the information necessary to submit under Option 1 or Option 2 of the CFATS PSP; and (b) the Department's assumption that additional data collection is not required and there is no further burden imposed by this Information Collection beyond submitting the information to the Department under Option 1 or Option 2.

A second commenter also objected to the exclusion of “the time needed for a site security officer to manage data collection, submissions, and tracking” under 5 CFR 1320.3(b)(2) which is similar to some of the examples provided by the first commenter.

A third commenter expressed concern similar in nature that the estimated time per respondent does not appear to account for acquiring the necessary personal information to compare against the TSDB.

Response: The Department evaluated each of the examples provided by the commenters. The Department's evaluation of the examples provided by the commenters are below:

i. The Department considered whether the CFATS PSP ICR should be revised to account for the burden associated with coordinating with CFATS-facility stakeholders, including Human Resources, Procurement, and/or Contract Administration to explain the PSP requirements and determine how best to gather the data from different populations (e.g., employees and resident and non-resident contractors). One commenter clarified elsewhere in its comments that the coordination included creating separate groups ^[8] and “PSP Submitter [user] accounts for each contract company, which may include hundreds of different contract companies in cases where a large facility is tiered for a release security issue.” After considering the comment, the Department did not revise the CFATS PSP ICR because this burden is properly accounted for under a separate and different ICR. The establishment of Chemical Security Assessment Tool (CSAT) accounts, such as a PSP Submitter, and the assignment of such accounts to “groups” is covered under Information Collection 1670-0007.^[9]

ii. The Department considered whether the CFATS PSP ICR should be revised to account for the burden associated with “developing and providing communications, Privacy Act notices, and data collection forms to affected individuals.” After considering the comment, the Department did not revise the CFATS PSP ICR because, as described earlier in this notice, this burden is already accounted for in the 10 minutes per respondent burden estimate.

iii. The Department considered whether the CFATS PSP ICR should be revised to account for the burden associated with “ensuring that all affected individuals provide the necessary [personally identifiable information] PII—and following up with those that do not.” After considering the comment, the Department did not revise the CFATS PSP ICR. The collection of data from affected individuals by a covered chemical facility or its designees is excluded under 5 CFR 1320.3(b)(2).

iv. The Department considered whether the CFATS PSP ICR should be revised to account for the burden associated with “training personnel to use the CSAT PSP application.” After considering the comment, the Department did not revise the CFATS PSP ICR because the burden is properly accounted for under Information Collection 1670-0007.

v. The Department considered whether the CFATS PSP ICR should be revised to account for the burden associated with “ensuring change management (e.g., once the initial data is gathered and uploaded, the facility still must account for new hires and new contractors—and further incorporate this into the facility access process).” After considering the comment, the Department did not revise the CFATS PSP ICR because the burden is already accounted for in this ICR (See 82 FR 61312, 61316).^[10] The Department laid out the expectations to submit both existing affected individuals as well as new affected individuals in the ICR notices associated with the current Information Collection and in the CFATS PSP Implementation Notice. The clear expectation for covered chemical facilities to submit new affected individuals is therefore inherently a part of the actual historical data upon which the Department relied in the 60-day notice.

Comment: One commenter suggested that the CFATS PSP is being implemented on a facility-by-facility basis rather than a company-wide basis, which encourages duplicative processes for information collection and vetting and dramatically increases the burdens on railroads serving more than one company location.

Response: The Department has designed the CFATS Program as a whole, and the CFATS PSP in particular, to allow for a company-wide approach. This has been mentioned in previous notices ^[11] and can be found in current program guidance and resources.^[12] Some companies have opted to implement a company-wide approach to the PSP while others have not. The design of the CFATS PSP and this ICR allows each company with multiple covered chemical facilities to choose for itself whether or not, or to what degree, to adopt a company-wide approach under CFATS.

Comment: One commenter expressed concern that the estimated time per respondent of five minutes “does not appear to include the additional time necessary to notify employees of the PSP requirement, obtain consent . . .”

Response: As previously discussed, the Department did not revise the CFATS PSP ICR because this burden is already accounted for in the 10 minutes per respondent burden estimate.

Comment: One commenter is concerned with the time it takes Authorizer to create CSAT accounts for contractors.

Response: The Department accounts for the burden related to the creation of CSAT accounts for contractors under Information Collection 1670-0007.^[13]

Comments Related to the Quality, Utility, and Clarity of the Information To Be Collected

The Department did not receive any comments related to the quality, utility, and clarity of the information to be collected.

Comments Related To Minimizing the Burden of the Collection of the Information on Those Who Are To Respond, Including Through the Use of Appropriate Automated, Electronic Mechanical, or Other Technological Collection Techniques or Other Forms of Information Technology, e.g., Permitting Electronic Submissions of Responses

Comment: Two commenters suggested that the Department use a flexible approach in the rollout:

One commenter requested a phased roll out of the CFATS PSP to Tier 3 and Tier 4 covered chemical facilities.

A second commenter “appreciate[d] that DHS is proposing to roll out these requirements in a phased method . . .” The same commenter also encouraged the Department to consider a “site's various risk factors, including location, number of employees, types and volumes of chemicals of interest, and likely offsite incident consequences” when planning the phased-in approach.

Response: The Department agrees that a flexible approach is appropriate for the rollout of the PSP to Tier 3 and Tier 4 covered chemical facilities. If approved, the Department plans to implement the CFATS PSP in a phased manner to Tier 3 and Tier 4 covered chemical facilities over a three year period. Similar to the successful and recent retiering effort, the Department plans to consider the number of facilities assigned to a single Authorizer when notifying facilities to implement the PSP, as not to overwhelm a single Authorizer. The Department will also allow the flexibility for Authorizers, if desired, to complete the process for their facilities before notification by the Department.

Comment: One commenter suggested that the Department has downplayed the use of “existing options” that could lessen the burdens on third-party service providers, such as railroads, that employ affected individuals as defined by the covered chemical facility. The commenter suggested that one such “existing option” is real-time video monitoring as a means of escort.

Response: The Department has explicitly mentioned in multiple notices associated with this Information Collection (see 79 FR 6418, 6420) and in CFATS PSP resources the possibility of innovative escorting alternatives such as video monitoring. The Department has also worked with facilities to identify other alternatives for a covered chemical facility to limit who is an affected individual. Furthermore, the Department provided the following guidance to covered chemical facilities in the CFATS PSP Implementation Notice: ^[14]

“A high-risk chemical facility will have flexibility to tailor its implementation of the CFATS Personnel Surety Program to fit its individual circumstances and, in this regard, to best balance who qualifies as an affected individual, unique security issues, costs, and burden. For example, a high-risk chemical facility may, in its Site Security Plan:

• Restrict the numbers and types of persons allowed to access its restricted areas and critical assets, thus limiting the number of persons who will need to be checked for terrorist ties.
• Define its restricted areas and critical assets, thus potentially limiting the number of persons who will need to be checked for terrorist ties.
• Choose to escort visitors accessing restricted areas and critical assets in lieu of performing terrorist ties background checks under the CFATS Personnel Surety Program. The high-risk chemical facility may propose in its SSP traditional escorting solutions and/or innovative escorting alternatives such as video monitoring (which may reduce facility security costs), as appropriate, to address the unique security risks present at the facility [emphasis added].”

Comment: One commenter urged the Department to not include additional pre-conditions to the CFATS PSP that would preclude covered chemical facilities from leveraging the background checks performed in compliance with the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) Employee Possessor Program under Option 4.

Response: The Department has not modified the CFATS PSP to preclude a covered chemical facility from the potential of leveraging the vetting conducted by ATF under Option 4 for affected individuals who possess a Federal explosives license/permit.

Comment: One commenter requested that the Department modify CSAT to allow designated employees such as human resource professionals the ability to upload and edit information about affected individuals without having to access CVI.

Response: The Department currently provides the ability to restrict human resource professionals from accessing CVI in CSAT. If a user is designated as only a Personnel Surety Submitter and is not assigned any other facility roles, they are not able to access the CVI documentation.

Other Comments Submitted in Response to the Information Collection Request

Comment: One commenter suggested that compliance with the CFATS PSP exposes railroad employee PII and exacerbates cyber-security risk.

Response: The Department disagrees with the commenter that the CFATS PSP exposes PII and exacerbates cyber security risk. If (1) a covered chemical facility opts to identify the employee of a third-party service provider as an affected individual, and (2) a covered chemical facility opts to implement Option 1 or Option 2 in their SSP or ASP then the Department has designed the CSAT Personnel Surety Program Application to allow third-party companies, such as a railroad, to be granted access to the CSAT Personnel Surety Application for the express purpose of submitting information about affected individuals directly to the Department.

If a covered chemical facility opts to implement Option 3 or Option 4, information about affected individuals is not submitted to the Department. Option 3 allows high-risk chemical facilities to comply with the PSP by electronically verifying and validating the affected individual's TWICs through the use of TWIC readers. Option 4 provides high-risk chemical facilities with the option to visually verify certain credentials or documents that are issued by a Federal screening program that periodically vets enrolled individuals against the TSDB.

Comment: One commenter suggested that the Department “has encouraged covered chemical facilities to collect information that exceeds the legal requirements.”

Response: The Department outlined in the ICR all data elements and identified the ones that are required for a submission under Option 1 or Option 2. While the minimum data is sufficient, it is the considered judgement of the Department that additional information reduces the likelihood of false positives in matching against records in the federal government's consolidated and integrated terrorist watchlist. Although helpful in reducing false positives, this additional information is optional.

Comment: Two commenters made suggestions as it relates to the consistency of inspections:

One commenter requested that the Department “work with facilities that have already been inspected to make sure inspections are being handled in a consistent fashion.”

A second commenter reported that there are “many regional inconsistencies in how inspectors conduct inspections within a region.”

Response: Although this comment is outside the scope of the information collect request, DHS agrees and continues to work to ensure inspection consistency across the country.

Comment: One industry association commented that any updates to the CFATS regulation should be flexible and tangible for facility compliance.

Response: This information collection request does not modify existing regulations.

Comment: One commenter suggested that a contradiction exists between the CFATS PSP and the railroads compliance with DOT regulations.

Response: The Department disagrees with the commenter. If a covered chemical facility opts to identify a railroad employee as an affected individual, the performance of railroads with respect to complying with DOT regulations, does not materially alter the fact that a railroad employee is an affected individual. Covered chemical facilities must ensure that affected individuals have appropriate background checks performed, to include a check for terrorist ties. This ICR allows covered chemical facilities, and their service providers that employ affected individuals, an opportunity to enable a check for terrorist ties to be performed against the TSDB.

Comment: One commenter stated that the CFATS PSP, as currently designed, “does not take into consideration that Tier 3 and 4 facilities present a comparatively lower risk profile than Tier 1 and 2 sites.” The commenter suggested that the Department acknowledge the lower risk profile of Tier 3 and Tier 4 covered chemical facilities and not require them to comply with 6 CFR 27.230(a)(12)(iv). The commenter requested that Tier 3 and Tier 4 covered chemical facilities still be allowed to voluntarily participate.

Response: The Department believes that 6 CFR 27.230(a)(12)(iv) mitigates the risk of an individual with terrorist ties having insider access. Terrorist insiders could cause significant harm to the United States through access to any tiered chemical facility. To achieve the anti-terrorism objective of CFATS, it is necessary to mitigate this risk by conducting terrorist ties checks at all covered facilities. RBPS 12 accordingly requires terrorist ties checks for facilities of all four tiers.

Comment: One commenter questioned the effectiveness of the CFATS PSP if “absent a clear national security, homeland security, or law enforcement rationale . . . DHS does not follow-up with the company to alert it of the possible threat.” The commenter further stated that the “value of conducting TSDB screening is questionable if an identified bad actor is permitted continued access to [chemicals of interest] unbeknownst to the facility, which is in the best position to ensure that the person is not afforded that opportunity.”

Response: The Department's design of the CFATS Program is intended to promote and enhance the security of high-risk chemical facilities; the PSP is one element of the larger CFATS Program. To prevent a significant threat to a facility or loss of life, a high-risk chemical facility will be contacted where appropriate and in accordance with federal law and policy, and per law enforcement and intelligence requirements.

The Department's Methodology in Estimating the Burden for the CFATS PSP

This 30-day notice relies on the analysis and resulting burden estimates in the 60-day notice for this instrument.

Analysis

Title: Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety Program.

OMB Number: 1670-0029.

Instrument: CFATS Personnel Surety Program.

Frequency: “Other.”

Affected Public: Business or other for-profit.

Number of Annual Respondents: 72,607 respondents (estimate).

Estimated Time per Respondent: 0.1667 hours (10 minutes).

Total Annual Burden Hours: 12,101 hours.

Total Annual Burden Cost (capital/startup): $1,719,409.

Total Annual Burden Cost: $955,191.

Total Recordkeeping Burden: $0.

David Epperson,

Chief Information Officer.

Footnotes

1.  For more information about the TSDB, see DOJ/FBI-019 Terrorist Screening Records System, last published in full as 77 FR 26580 (May 25, 2017).

2.  The current information collection for CFATS Personnel Surety Program may be found at https://www.reginfo.gov/​public/​do/​PRAViewICR?​ref_​nbr=​201312-1670-001.

3.  For more information about Redress Numbers, please go to http://www.dhs.gov/​one-stop-travelers-redress-process#1.

4.  See 6 CFR 27.300-345.

5.  More information about access, correction, and redress requests under the Freedom of Information Act and the Privacy Act can be found in Section 7.0 of the Privacy Impact Assessment for the CFATS Personnel Surety Program, dated May 4, 2011, and available at http://www.dhs.gov/​privacy-documents-national-protection-and-programs-directorate-nppd.

6.  See Section 1(b)(3) of Public Law 114-278, which may be viewed at https://www.congress.gov/​bill/​114th-congress/​house-bill/​710/​text/​pl?​overview=​closed.

7.  The Department described the options for screening for terrorist ties on page 82 FR 61313 of its 60-day notice which may be viewed at https://www.federalregister.gov/​d/​2017-27519/​page-61313.

8.  The term “groups” is a technical term used by the Department to describe how a covered chemical facility may manage the access to records about affected individuals in the CSAT Personnel Surety application. The Department describes “groups” and provides additional information about how to create and manage “groups in section 9.5 of the CSAT User Manual which may be viewed at https://www.dhs.gov/​sites/​default/​files/​publications/​csat-portal-user-manual-508-2.pdf.

9.  Information Collection 1670-0007 was approved by OMB on July 14, 2016. The Notice of Action and Information Collection 1670-0007 may be viewed at https://www.reginfo.gov/​public/​do/​PRAViewICR?​ref_​nbr=​201604-1670-001.

10.  The Department described its assumptions, to include updates and corrections, about the estimated time per respondent on page 82 FR 61316 of its 60-day notice which may be viewed at https://www.federalregister.gov/​d/​2017-27519/​page-61316.

11.  The possibility of a company-wide approach is mentioned in: (1) The CFATS PSP 30-Day notice and request for comments published on February 3, 2014 at 79 FR 6422 that may be viewed at https://www.federalregister.gov/​d/​2014-02082/​page-6422,, and (2) the CFATS PSP 60-Day notice and request for comments published on March 22, 2013 at 78 FR 17684 that may be viewed at https://www.federalregister.gov/​d/​2013-06184/​page-17684.

12.  The Department describes the potential for a company-wide approach in CFATS PSPImplementation Notice published on December 18, 2015 at 80 FR 79064 that may be viewed at https://www.federalregister.gov/​d/​2015-31625/​page-79064.

13.  Information Collection 1670-0007 was approved by OMB on July 14, 2016. The Notice of Action and Information Collection 1670-0007 may be viewed at https://www.reginfo.gov/​public/​do/​PRAViewICR?​ref_​nbr=​201604-1670-001.

14.  This specific text from the CFATS Personnel Surety Program Implementation Notice may be found on 80 FR 79060 and can be viewed at https://www.federalregister.gov/​d/​2015-31625/​page-79060.