05-15771. New Emergency Agency Information Collection Activity Under OMB Review: Department of Homeland Security-Vulnerability Identification Self-Assessment Tool-Transportation (DHS-VISAT-T)

AGENCY:

Transportation Security Administration, DHS.

ACTION:

Notice of emergency clearance request.

SUMMARY:

This notice announces that the Transportation Security Administration (TSA) has forwarded the new Information Collection Request (ICR) abstracted below to the Office of Management and Budget (OMB) for emergency processing and approval under the Paperwork Reduction Act. The ICR describes the nature of the information collection and its expected burden.

DATES:

Send your comments by September 9, 2005. A comment to OMB is most effective if OMB receives it within 30 days of publication.

ADDRESSES:

Comments may be faxed to the Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: DHS-TSA Desk Officer, at [phone].

FOR FURTHER INFORMATION CONTACT:

Katrina Wawer, Information Collection Specialist, Office of Transportation Security Policy, TSA-9, Transportation Security Administration, 601 South 12th Street, Arlington, VA 22202-4220; telephone [phone]; facsimile [phone].

SUPPLEMENTARY INFORMATION:

Comments Invited

In accordance with the Paperwork Reduction Act of 1995, (44 U.S.C. 3501 et seq.), an agency may not conduct or sponsor, and a person is not required to respond to a collection of information, unless it displays a valid OMB control number. Therefore, in preparation for OMB review and approval of the following information collection, TSA is soliciting comments to—

(1) Evaluate whether the proposed information requirement is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;

(2) Evaluate the accuracy of the agency's estimate of the burden;

(3) Enhance the quality, utility, and clarity of the information to be collected; and

(4) Minimize the burden of the collection of information on those who are to respond, including using appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology.

Information Collection Requirement

Title: Department of Homeland Security—Vulnerability Identification Self-Assessment Tool—Transportation (DHS-VISAT-T).

Type of Request: Emergency processing request of new collection.

OMB Control Number: Not yet assigned.

Forms(s): N/A.

Affected Public: Owners and operators within the transportation sector. The affected modes of transportation include Aviation, Rail, Pipelines, Highway and Bridges, and Mass Transit.

Abstract: After its inception, TSA faced the challenge of securing all of the different modes within the transportation sector. A methodology was required in order to support inter- and intra-modal analysis and decision-making. Millions of assets exist within the transportation sector, ranging from over 500,000 highway-bridges to over 19,000 general aviation airports. Given this population of assets, it became apparent that a mechanism was needed to solicit data from the asset owners/operators. TSA needs this data, such as the assets' security measures currently deployed, along with a high-level assessment of system security effectiveness, in order to prioritize resources.

In response to this need, TSA's Office of Threat Assessment and Risk Management (OTRM) developed the Department of Homeland Security—Vulnerability Identification Self-Assessment Tool—Transportation (DHS-VISAT-T), formerly called the TSA Self-Assessment Risk Module (TSARM), as a means to gather security-related data. TSA designed this tool to be flexible to support the unique characteristics of each transportation mode, while still providing a common framework from which analysis and trends can be identified. DHS-VISAT-T represents the U.S. Government's first self-assessment tool that provides the following features:

• The tool is provided to users at no cost;
• The tool is voluntary;
• The tool is Web-based, easily accessible; and
• All ratings are determined by the user.

The self-assessment tool contains two sections. In the first section of the tool, users answer a series of questions divided into seven countermeasure categories to develop a comprehensive picture of the asset's security system posture. The countermeasure categories include:

• Plans, Policies, and Procedures;
• Security Training;
• Access Control;
• Physical Security Assets;
• Security Technologies and Equipment;
• Communications Security; and
• Information Security.

The second section of the tool focuses on the prevention and the mitigation of a base array of threat scenarios developed for different categories of assets. Users rate their asset in terms of target attractiveness (from a terrorist's perspective) and several consequence categories that describe health and well-being, economic consequences, and symbolic value of the asset. Users first list the asset's baseline security countermeasures that apply for each of the threat scenarios, and then rate the effectiveness of the countermeasures in detecting and/or preventing the terrorist's actions against each threat scenario. Descriptive guidance for the effectiveness rating is provided for each of the countermeasure categories. The performance-based effectiveness ratings describe the asset's ability to thwart the threat.

After the tool is applied considering baseline countermeasures, users apply the tool two additional times to assess the impact of adding new countermeasures or enhancing existing countermeasures. The first additional assessment assumes a general increase in the national threat level (orange). The second additional assessment assumes that the asset is known to be a specific target (red). The intent is that the enhanced countermeasures will increase the security effectiveness compared to the baseline effectiveness ratings.

Upon completion of the tool assessment, users receive a report that summarizes their inputs. They may then use this report to develop a security plan or to identify areas of potential vulnerability. Users have the option to submit the completed assessment to DHS. If submitted, DHS reviews the assessment for consistency and provides feedback to the users.

Number of Respondents: Of the possible 3,002,450 respondents, TSA expects that approximately 10 percent, or 300,245, will use the tool.

Issued in Arlington, Virginia, on August 3, 2005.

Lisa S. Dean,

Privacy Officer.