Federal Register Vol. 80, No.211,

Purpose of This Regulatory Action: On December 19, 2014, all of the Federal award-making agencies published a joint Interim Final Rule (IFR) in the Federal Register, implementing the Office of Management and Budget's (OMB) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal awards (Uniform Guidance). The purpose of this action is to adopt the Uniform Guidance in 2 CFR part 200, except for 2 CFR 200.102(a), CFR 200.207(a). This adoption gives regulatory effect to the OMB guidance and supplements that guidance, as needed, for the Department. The authority to amend chapter XXXIV of title 2 of the Code of Federal Regulations and subtitle A and chapters I, II, III, IV, V, and VI of title 34 of the Code of Federal Regulations is 20 U.S.C. 1221e-3, 3474, and 2 CFR part 200, unless otherwise noted.

Summary of the Major Provisions of This Regulatory Action: This rule allows the Department to incorporate into regulation and thus bring into effect the Uniform Guidance as required by OMB and reduces administrative burden and risk of waste, fraud, and abuse for the funds awarded by the Department through grants and cooperative agreements.

Costs and Benefits: The Secretary believes that these regulations do not impose significant costs on entities that would receive assistance through Department of Education programs. The benefits of the regulations far outweigh any potential costs incurred by entities. The benefits of the amendments in these regulations include eliminating duplicative and conflicting guidance contained in eight previously separate sets of OMB guidance documents; streamlining reporting requirements; reducing burden for entities that have never received an indirect cost rate; and setting standard business processes using data definitions to reduce administrative burden on non-Federal entities that conduct business with multiple federal agencies.

On December 19, 2014, the Secretary published an IFR for these amendments in the Federal Register (79 FR 75871).

Except for minor editorial and technical revisions, there are no differences between the IFR and these final regulations.

The Secretary makes two amendments to the interim final regulations to correct errors made in the adoption of the Uniform Guidance. First, in amending § 75.135 to reference the Uniform Guidance, the Department failed to amend paragraph (b) of that section to reference the correct requirement in part 200. Second, in amending 34 CFR part 75, the Department inadvertently removed § 75.263 when we should have just revised the cross references in that section to refer to the appropriate citation in the Uniform Guidance. These two errors are corrected in these final regulations.

Public Comment: In response to our invitation in the IFR, one party submitted comments directed at the Department's proposed adoption of the interim final regulations in 2 CFR part 200. Generally, we do not address technical and other minor changes raised by the comments.

Analysis of Comments and Changes: An analysis of the comments follows.

Comment: The commenter requested clarification on whether or not the Department would grant local educational agencies (LEAs) a one-year grace period for implementing the procurement standards in 2 CFR 200.317 through 200.326. The commenter also sought clarity on the specific date that the procurement standards would go into effect for LEAs after the grace period.

Discussion: The Uniform Guidance regulations, as adopted by the Department, 79 FR 75872 (December 19, 2014) authorize all non-Federal entities (including LEAs) to delay implementation of the procurement requirements in 2 CFR 200.318 through 200.326 for one fiscal year after the regulations would otherwise apply to a grant. A recent technical amendment to the Uniform Guidance expanded that grace period to two years. See 80 FR 54407 (September 10, 2015). As such, each LEA will have the option of delaying implementation of the procurement standards until the end of its second fiscal year that begins after the effective date of the Uniform Guidance (December 26, 2014). For LEAs with a fiscal year that ends on June 30, 2015 that decide to defer implementation for the full two years, the LEA's new procurement standards would not have to be effective until July 1, 2017.

Changes: None.

Comment: The commenter requested clarification of the phrase “tangible personal benefit” in 2 CFR 200.318(c)(1).

Discussion: The phrase “tangible personal benefit” is new language added to the general conflict of interest section of the general procurement standards that existed previously under the Education Department General Administrative Regulations (EDGAR) 34 CFR 80.36(b)(3) and OMB Circular A-102. The language was expanded from just “financial or other interest in” to also include “or a tangible personal benefit from” a firm considered for a contract from a grantee. This new language stresses the importance of ensuring that employees who select, award, and administer contracts supported by a Federal award are free from any real or apparent conflict of interest, including financial interests and other non-financial benefits that result in a personal benefit for the employee (such as improved employment opportunities, business referrals, political influence, etc.).

Changes: None.

Comment: The commenter expressed concern regarding the conflict of interest rules in 2 CFR 200.319(a), specifically with regard to vendors with specialized expertise that may collaborate with grant applicants, because these vendors would be excluded from competing for a contract (if the applicant is awarded a grant) due to their organizational conflict of interest. The commenter requested that the Department issue guidance allowing vendors to provide minimal input to applicants, such as LEAs, for the purpose of informing a Request for Proposal (RFP) and to not prohibit these vendors from competing for the RFP because of a conflict of interest.

Discussion: The Department understands that an LEA may need to inform itself about the capacity and capability of potential contractors in order to prepare an RFP. In the course of doing so, an LEA may contact a number of vendors to collect information necessary for developing the RFP, as long as the LEA poses its request for information broadly so that any potential vendor has an opportunity to provide input. Soliciting input from one or two vendors would create, in most cases, an unfair competitive advantage constituting an organizational conflict of interest.

Changes: None.

Comment: The commenter raised concerns with regard to the prohibition of using “brand name” instead of “an equal” product in order to avoid restrictive competition under 2 CFR 200.319(a)(6). Specifically, the commenter noted that in some cases, a school may have already invested in a particular technology infrastructure or selected a particular instructional framework and it would be impractical or impossible to switch to another product or instructional approach. The commenter requested that the Department issue guidance to clarify when specifying a “brand name” might be appropriate and not considered a restriction on competition under 2 CFR 200.319(a)(6).

Discussion: The new procurement requirements in the Uniform Guidance do not require an LEA to abandon a technology or instructional approach just because a similar technology or instructional approach would cost less. The Department also understands that in some limited situations, specifying a “brand name” may not restrict competition under 2 CFR 200.319(a)(6). If an LEA has already invested in a particular infrastructure or instructional framework, specifying a “brand name” compatible with the infrastructure or framework may be appropriate. However, the procurement regulations are designed to ensure competition so the selected proposal is most advantageous to the program, with price and other factors considered. Thus, the LEA needs to compete to find the lowest cost supplier of the technology or instructional approach (other factors) desired by the LEA. The Department will consider developing additional guidance on this issue.

Changes: None.

Comment: The commenter noted two instances in which it believes that procurement by noncompetitive proposals (sole sourcing) should be allowed under 2 CFR 200.320(f)(1) where “the item is available only from a single source.” The first situation involves instances where an LEA has an existing technology infrastructure or instructional framework and requires specific hardware or software; the second situation involves instances where schools engage in pilot trials for educational technologies or instructional strategies or materials and want to “scale up” the piloted product.

Discussion: Generally, procurement by noncompetitive proposals is procurement through solicitation of a proposal from only one source. The use of this procurement method is permitted under very limited circumstances, but one basis for an authorized sole source contract is when the item is available only from a single source (2 CFR 200.320(f)(1)). If particular software or hardware is required because of an LEA's existing technology infrastructure or instructional framework and the hardware or software is truly only available from one source, noncompetitive procurement may be appropriate. The LEA must maintain records documenting the rationale for why sole sourcing was used (2 CFR 200.318(i)). If the desired software or hardware is available from more than one vendor, the LEA must use a competitive process, as described in 2 CFR 200.320(d).

LEAs that engage in pilot trials of educational technologies or instructional materials that then wish to “scale up” are not exempted from competitive procurement. Procurement transactions must be conducted in a manner providing full and open competition, as described in 2 CFR 200.319. If an LEA wants to experiment with a new educational technology or instructional strategy or material, it may do so without violating conflict of interest requirements by holding an open procurement competition, identifying the specifications for the technology, strategy, or material and stating the initial contract would be for a pilot of that product with an option to “scale up” the product if the pilot proves successful.

Changes: None.

Comment: The commenter raised concerns regarding the cost and efficiency of competitive bidding required under 2 CFR 200.320, noting that it would be more cost effective for the LEA to perform a cost analysis rather than use a Request for Proposal (RFP) process. The commenter encouraged the Department to allow for instances when the small purchase procedures could be used for procurements that exceed the Simplified Acquisition Threshold, including when the item is a commercially available product.

Discussion: The Department has allowed for limited instances when small purchase procedures may be used for procurements that exceed the simplified acquisition threshold. These limited instances are specified in a section in EDGAR that was established in 2013, 34 CFR 75.135, which authorizes discretionary grant applicants to use the informal small purchase procedures to procure evaluation service providers and providers of any other service that is essential to the grant, provided that the service provider is identified in the grant application. The service provider must be needed to meet a statutory, regulatory, or priority requirement related to the competition. See the final rulemaking document, published at 78 FR 49352, August 13, 2013, for a fuller discussion of the requirements in § 75.135. These limited exceptions do not include allowing the use of small purchase procedures just because an item is a commercial (off the self) product and not one that is custom-built based on unique specifications.

Changes: None.

Comment: The commenter sought clarification from the Department on whether or not price comparison under 2 CFR 200.323 could be considered a form of price competition, such that a non-federal entity would not be required to negotiated price as a separate element.

Discussion: Price comparison is not a form of price competition that would exempt a non-federal entity from negotiating profit as a separate element of the price.

Changes: None.

Comment: The commenter sought clarification on the definition of “procurement” for determining whether or not the transaction meets the small purchase or simplified acquisition threshold.

Discussion: The word “procurement” is used consistently throughout the Uniform Guidance and the Department does not intend to use that term differently in its implementation of the Uniform Guidance. The simplified acquisition threshold is the “dollar amount below which a non-Federal entity may purchase property or services using small purchase methods” (2 CFR 200.88). If a non-Federal entity seeks to acquire property or services that have an anticipated dollar value exceeding the simplified acquisition threshold, the non-Federal entity must use a competitive process and cannot use small purchase procedures unless the procurement meets the requirements of 34 CFR 75.135. Procurement actions must not be split into separate procurements to avoid competition thresholds.

Changes: None.

After consideration of all the comments regarding the IFR, the Secretary makes no changes to the regulations adopting the Uniform Guidance that were published on December 19, 2014 except for the two technical amendments discussed earlier in this preamble.

Under Executive Order 12866, the Secretary must determine whether this regulatory action is “significant” and, therefore, subject to the requirements of the Executive order and subject to review by the Office of Management and Budget (OMB). Section 3(f) of Executive Order 12866 defines a “significant regulatory action” as an action likely to result in a rule that may—

(1) Have an annual effect on the economy of $100 million or more, or adversely affect a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities in a material way (also referred to as an “economically significant” rule);

(2) Create serious inconsistency or otherwise interfere with an action taken or planned by another agency;

(3) Materially alter the budgetary impacts of entitlement grants, user fees, or loan programs or the rights and obligations of recipients thereof; or

(4) Raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles stated in the Executive order.

This final regulatory action is not a significant regulatory action subject to review by OMB under section 3(f) of Executive Order 12866.

We have also reviewed these regulations under Executive Order 13563, which supplements and explicitly reaffirms the principles, structures, and definitions governing regulatory review established in Executive Order 12866. To the extent permitted by law, Executive Order 13563 requires that an agency—

(1) Propose or adopt regulations only on a reasoned determination that their benefits justify their costs (recognizing that some benefits and costs are difficult to quantify);

(2) Tailor its regulations to impose the least burden on society, consistent with obtaining regulatory objectives and taking into account—among other things and to the extent practicable—the costs of cumulative regulations;

(3) In choosing among alternative regulatory approaches, select those approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity);

(4) To the extent feasible, specify performance objectives, rather than the behavior or manner of compliance a regulated entity must adopt; and

(5) Identify and assess available alternatives to direct regulation, including economic incentives—such as user fees or marketable permits—to encourage the desired behavior, or provide information that enables the public to make choices.

Executive Order 13563 also requires an agency “to use the best available techniques to quantify anticipated present and future benefits and costs as accurately as possible.” The Office of Information and Regulatory Affairs of OMB has emphasized that these techniques may include “identifying changing future compliance costs that might result from technological innovation or anticipated behavioral changes.”

We are issuing these final regulations only on a reasoned determination that their benefits justify their costs. In choosing among alternative regulatory approaches, we selected those approaches that maximize net benefits. Based on the analysis that follows, the Department believes that these final regulations are consistent with the principles in Executive Order 13563.

We also have determined that this regulatory action does not unduly interfere with State, local, or tribal governments in the exercise of their governmental functions.

In accordance with both Executive orders, the Department has assessed the potential costs and benefits, both quantitative and qualitative, of this regulatory action. The potential costs associated with this regulatory action are those resulting from statutory requirements and those we have determined as necessary for administering the Department's programs and activities.

These regulations do not contain any information collection requirements.

These regulations are subject to the requirements of Executive Order 12372 and the regulations in 34 CFR part 79. One of the objectives of the Executive order is to foster an intergovernmental partnership and a strengthened federalism. The Executive order relies on processes developed by State and local governments for coordination and review of proposed Federal financial assistance.

This document provides early notification of our specific plans and actions for these regulations.

In the IFR we requested comments on whether the proposed regulations would require transmission of information that any other agency or authority of the United States gathers or makes available.

Based on the response to the IFR and on our review, we have determined that these final regulations do not require transmission of information that any other agency or authority of the United States gathers or makes available.

Accessible Format: Individuals with disabilities can obtain this document in an accessible format (e.g., braille, large print, audiotape, or compact disc) on request to the contact person listed under FOR FURTHER INFORMATION CONTACT.

Electronic Access to This Document: The official version of this document is the document published in the Federal Register. Free Internet access to the official edition of the Federal Register and the Code of Federal Regulations is available via the Federal Digital System at: www.thefederalregister.org/fdsys. At this site you can view this document, as well as all other documents of this Department published in the Federal Register, in text or Adobe Portable Document Format (PDF). To use PDF you must have Adobe Acrobat Reader, which is available free at the site.

You may also access documents of the Department published in the Federal Register by using the article search feature at: www.federalregister.gov. Specifically, through the advanced search feature at this site, you can limit your search to documents published by the Department.

For the reasons discussed in the preamble, and under the authority of 5 U.S.C. 301 and the authorities listed below, the interim rule amending chapter XXXIV of 2 CFR and subtitle A and chapter I of title 34 of the Code of Federal Regulations, which was published at 79 FR 75871 on December 19, 2014, is adopted as a final rule with the following changes:

On July 9, 2008, in SECY-08-0099, “Final Rulemaking—Power Reactor Security Requirements” (Agencywide Documents Access and Management System (ADAMS) Accession No. ML081650474), the NRC staff recommended the Commission approve a final rule amending the NRC's Power Reactor Security Requirements. The NRC staff also recommended removing sections in the Power Reactor Security Requirements rule on new and revised security notification requirements in § 73.71 and appendix G of part 73 of title 10 of the Code of Federal Regulations (10 CFR), “Reportable Safeguards Events,” and placing them in a new proposed enhanced weapons rulemaking. In SRM-SECY-08-099, dated December 17, 2008 (ADAMS Accession No. ML083520252), the Commission approved the Power Reactor Security final rule and the bifurcation of the security notification requirements in § 73.71 and appendix G to 10 CFR part 73 to the new proposed enhanced weapons rule.

On June 27, 2010, in SECY-10-0085, “Proposed Rule: Enhanced Weapons, Firearms Background Checks and Security Event Notifications” (ADAMS Accession No. ML101110121), the NRC staff recommended delegating to the Office of the Executive Director for Operations the authority to issue new cyber security notification changes in the proposed enhanced weapons rule for publication in the Federal Register, as well as issue draft implementing guidance on the proposed rule. On October 19, 2010, in SRM-SECY-10-0085, “Proposed Rule: Enhanced Weapons, Firearms Background Checks and Security Event Notifications” (ADAMS Accession No. ML102920342), the Commission directed the NRC staff to publish a proposed rule implementing requirements for enhanced weapons, revised physical security event notifications, and adding new cyber security event notifications. This proposed rule was published in the Federal Register for comment on February 3, 2011 (76 FR 6199). The public was provided a total of 180 days to review and comment on the proposed rule and associated guidance.

In SECY-12-0125, “Interim Actions to Execute Commission Preemption Authority Under Section 161A of the Atomic Energy Act of 1954, as Amended,” dated September 20, 2012 (ADAMS Accession No. ML12171A089), the NRC staff reported their discussions with the U.S. Department of Justice on the need to revise the Firearms Guidelines to limit the firearms background check requirement to only licensees that apply for preemption authority. Subsequently in SRM—SECY-12-0125, dated November 12, 2012 (ADAMS Accession No. ML12326A653), the Commission directed the NRC staff to revise the Firearms Guidelines accordingly, and publish a supplemental proposed enhanced weapons rule for public comment as soon as possible.

On December 20, 2013, in COMSECY-13-0031, “Bifurcation of the Enhanced Weapons, Firearms Background Checks, and Security Event Notifications Rule” (ADAMS Accession No. ML13280A366), the NRC staff informed the Commission of its plan to bifurcate the cyber security event notifications from the Enhanced Weapons rule due to delays resulting from the Firearms Guidelines revision. The bifurcation would allow the NRC staff to prepare a separate final rule for cyber security event notifications, therefore avoiding any further delay associated with the aforementioned Firearms Guidelines revision. In addition, this action would supplement the existing cyber security requirements (i.e., § 73.54, “Protection of Digital Computer and Communication Systems and Networks”) included in the 2009 power reactor security rule (76 FR 6199; February 3, 2011).

As part of the 2011 proposed enhanced weapons rule, the NRC received comments on the proposed cyber security event notification requirements. Changes between the proposed rule and this final cyber security event notifications rule reflect those public comments. Additionally, Draft Regulatory Guide (DG)-5019, Revision 1, “Reporting and Recording Safeguards Events” (ADAMS Accession No. ML100830413), was published for public comment on February 3, 2011 (76 FR 6085). The portions of the DG related to cyber security event notifications were also separated out from the original draft guide, and are now included in a new final regulatory guide (RG) (RG 5.83, “Cyber Security Event Notifications,” ADAMS Accession No. ML14269A388). Changes between DG-5019, Revision 1, and RG 5.83 reflect public comment. This approach (i.e., publish draft guidance with proposed rules and final guidance with final rules) is consistent with the agency's efforts to incorporate enhancements in the rulemaking process to address Cumulative Effects of Regulation (CER), as approved by SRM—SECY-0032, “Consideration of the Cumulative Effects of Regulation in the Rulemaking Process,” dated October 11, 2011 (ADAMS Accession No. ML112840466).

The NRC is adding cyber security event notification requirements for nuclear power reactor facilities. These additions are necessary because cyber security event notification requirements were not included in the NRC's final rule that added § 73.54, “Protection of Digital Computer and Communication Systems and Networks,” to the NRC's regulations (74 FR 13926; March 27, 2009). Section 73.54 requires power reactor licensees to establish and maintain a cyber security program that provides high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in § 73.1. Cyber security event notification requirements will contribute to the NRC's analysis of the reliability and effectiveness of licensees' cyber security programs and play an important role in the continuing effort to protect digital computer and communication systems and networks associated with: Safety-related and important-to-safety functions; security functions; emergency preparedness functions, to include offsite communications; and support systems and equipment which, if compromised, would adversely impact safety, security, and emergency preparedness (SSEP) functions. Notifications conducted and written reports generated by licensees will be used by the NRC to respond to emergencies, monitor ongoing events, assess trends and patterns, identify precursors of more significant events, and inform other NRC licensees of cyber security-related events, enabling them to take preemptive actions, if necessary (e.g., increase their security posture). In addition, timely notifications assist the NRC in achieving its strategic communications mission by informing the U.S. Department of Homeland Security (DHS) and Federal intelligence and law enforcement agencies of cyber security-related events that could: (1) Endanger public health and safety or the common defense and security, (2) provide information for threat-assessment processes, or (3) generate public or media inquiries.

The terrorist attacks of September, 11, 2001, demonstrated that adversaries were capable of simultaneously attacking multiple sectors of critical infrastructure. After those attacks, the NRC issued several Security Orders, as well as the Design Basis Threat (DBT) final rule (72 FR 12705; March 19, 2007) and the Power Reactor Security final rule (74 FR 13926; March 27, 2009). These Orders and final rules were steps taken by the NRC to ensure adequate protection of the public health and safety and common defense and security. The DBT final rule, in § 73.1, “Purpose and Scope,” describes in general terms the types of attacks licensees must protect against in order to prevent radiological sabotage and to prevent theft or diversion of strategic special nuclear material. An adversary attribute included under the DBT for radiological sabotage is a cyber attack, which is a type of attack that adversaries could remotely launch against multiple targets (i.e., nuclear power reactors) simultaneously. The Power Reactor Security final rule included specific requirements to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks (§ 73.54). The addition of cyber security event notification requirements supplements § 73.54 by enabling the timely notifications of potential and/or imminent cyber attacks directed against licensees. This allows for more timely assessment and dissemination of threat information, and improves the NRC's ability to respond and take the actions necessary to mitigate the adverse impacts of cyber attacks directed against licensees.

Separating the cyber security event notification requirements from the Power Reactor Security proposed rule narrowed the applicability to licensees subject to the requirements of § 73.54, which applies to operating nuclear power plants after the effective date of the final cyber security rule. Under the original proposed rule published on October 26, 2006 (71 FR 62664), cyber security event notifications were included with other event notifications (physical security, enhanced weapons, etc.) requiring a broader range of applicability (e.g., Fuel Cycle Facilities).

The NRC considered other options for licensees to report cyber attacks to the NRC. The NRC considered taking no additional regulatory actions and relying upon the continuation of voluntary reporting initiatives currently in place through security advisories. These voluntary reporting initiatives have allowed the NRC to identify certain cyber security-related events that might have had a negative impact upon licensees (e.g., vendor software updates containing malware) as well as provided licensees with threat information that assist them in protecting against cyber security-related threats. However, the security advisories are not mandatory requirements and do not provide timeliness requirements (one-hour, four-hour, eight-hour), which can be instrumental in the NRC's ability to respond to cyber security-related events, to evaluate cyber security-related activities for threat implications, and to accomplish the agency's strategic communications mission.

As part of its comprehensive assessment of the NRC's cyber security event notification regulations and guidance development for this rule, the NRC staff held two meetings with internal and external stakeholders.

On June 1, 2011, staff held a public meeting to discuss the proposed Enhanced Weapons, Firearms Background Checks, and Security Event Notifications rulemaking, which included the cyber security event notification requirements. The meeting was in workshop format, and was held at the NRC Headquarters in Rockville, Maryland; it was attended by more than 50 people. Additional individuals remotely participated in the meeting through audio teleconferencing and webinar. Presenters at the meeting included NRC staff, the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Federal Bureau of Investigations (FBI). Since the NRC was not accepting public comments, the meeting was not transcribed; however, a meeting summary and the handouts from the meeting are available in ADAMS under Accession No. ML111720007.

The NRC staff also met with internal and external stakeholders on July 31, 2014. This public meeting was to discuss the draft final rule implementation date for the cyber security event notification requirements. The public meeting was held at the NRC Headquarters in Rockville, Maryland, and it was attended by six individuals in person and eight individuals remotely through audio teleconferencing and webinar. The NRC staff presented the current status of the draft final cyber security event notifications rule and the draft final implementation date. The NRC transcribed the meeting in order to capture public input on the draft final implementation date. The feedback from this meeting, as well as all the previous interactions, informed the NRC's schedule for the implementation of the new cyber security event notification requirements. The meeting summary, handouts, and a transcript of the meeting are available in ADAMS under Accession No. ML14240A404.

The proposed rule was published in the Federal Register on February 3, 2011 (76 FR 6199), and the public comment period closed on August 4, 2011. On the same day the NRC also published a separate notice requesting comment on DG-5019, Revision 1, “Reporting and Recording Safeguards Events.” The NRC received a total of 14 submittals on the proposed rule and draft guidance relating to enhanced weapons, firearms background checks and security event notifications (which included cyber security event notifications). The majority of comments came from the Nuclear Energy Institute (NEI) on behalf of the nuclear power reactor licensees.

The proposed enhanced weapons rule was published February 03, 2011 (76 FR 6199), and the public comment period closed on August 04, 2011. On the same day the NRC also published a separate notice requesting comment on DG-5019, Revision 1, “Reporting and Recording Safeguards Events.”

The NRC received 14 submittals on the proposed rule and draft guidance. The NRC also received one comment on the proposed implementation date during the July 31, 2014, public meeting. Comments specific to cyber security event notifications in the proposed enhanced weapons rule and DG-5019, Revision 1, were identified and are addressed in this final rule. The comments specific to the proposed rule on Enhanced Weapons, Firearms Background Checks, and Security Event Notifications (76 FR 6200) are not addressed in this final rule and will be addressed in a subsequent rulemaking. In addition, certain event notification comments in the proposed rule that were generic (e.g., comments referring to four-hour notifications in general) are addressed for cyber security events in this final rule. The submittals containing comments specific to cyber security event notifications were consolidated into a single document (ADAMS Accession No. ML14226A596) that assigns the comment designators (e.g., NEI-155) used in this final rule. In the proposed rule and draft guidance, the cyber security event notifications aligned with physical security event notifications with a focus on compensated and uncompensated events. However, based on public comments, the final rule and regulatory guidance now aligns more closely with § 73.54 with a focus on adverse impacts to SSEP functions.

Comment 1: One commenter stated that neither § 73.71 nor appendix G to 10 CFR part 73 contains an effective date for cyber security reporting requirements, and recommended that the reporting requirements align with the date the cyber security plan becomes effective. [NEI-155]

Response: The NRC disagrees with this comment. Notification of a cyber security event is necessary to assist the NRC in assessing and evaluating issues with potential cyber security-related implications in a timely manner, determining the significance and credibility of the identified issue(s), and providing recommendations and/or courses of action to NRC management. Currently, licensees are reporting certain cyber security events voluntarily to the NRC. However, because this is done voluntarily there could be certain cyber security events that may not be reported to the NRC in a timely manner or reported at all. The cyber security event notifications final rule removes the voluntary aspects of reporting certain cyber security events, provides regulatory stability, and ensures the NRC is notified in a timely manner.

Prompt notification of a cyber attack could be vital to the NRC's ability to take immediate action in response to a cyber attack and, if necessary, to notify other NRC licensees, Government agencies, and critical infrastructure facilities, to defend against a multiple sector (e.g., energy, financial, etc.) cyber attack. Like the attacks of September 2001, a cyber attack has the capability to be launched against multiple targets simultaneously or spread quickly throughout multiple sectors of critical infrastructure. In light of these potential consequences, the NRC does not want to delay the implementation of the cyber security event notification final rule to match the effective date of each licensee's cyber security plan (i.e., Milestone 8) because those cyber security plans may not be fully effective for several years.

The final rule will become effective 30 days after publication in the Federal Register. The compliance date will be 180 days after publication (consistent with the implementation schedule described in the proposed rule) to allow licensees time to revise their event notification procedures and train personnel on event notifications specific to cyber security (i.e., identification, reporting). The cyber security event notification final rule is consistent with existing notification processes (i.e., §§ 50.72 and 73.71) and aligns closely with § 73.54 (e.g., adverse impacts to SSEP functions) as well as current voluntary reporting activities associated with cyber security requiring less time for implementation. In addition, the cyber security event notification final rule complements the implementation of Milestones 1 through 7. For example, the identification of critical systems and critical digital assets (Milestone 2), the implementation of a deterministic one-way device (Milestone 3), and access controls for portable media devices (Milestone 4) are all programs that when properly implemented and maintained, should identify and mitigate adverse impacts to SSEP functions. The cyber security event notification final rule requires licenses to notify the NRC when a cyber attack caused or could have caused an adverse impact to SSEP functions. These factors, along with the importance of the NRC strategic communications mission of informing the DHS and Federal intelligence and law enforcement agencies of cyber security-related events that could: 1) Endanger public health and safety or the common defense and security, 2) provide information for threat-assessment processes, or 3) generate public or media inquiries, support the need for the 180-day implementation schedule.

Comment 2: One commenter indicated that critical digital assets (CDAs) that are not part of a target set should not have the same sensitivity as those CDAs that are contained within a target set. [NEI-156]

Response: The NRC disagrees with this comment. The NRC staff has recognized that a graded approach to controls required for CDAs is warranted based on the ability to detect and mitigate the consequences of a cyber attack. However, the cyber security event notification requirements focus on events that have or could have an adverse impact to SSEP functions, and thereby incorporates consideration of protections that prevent successful cyber attacks. Therefore, the notification requirements cover all CDAs and critical systems within the scope of § 73.54, which includes: Safety-related and important-to-safety functions; security functions; emergency preparedness functions, including offsite communications; and support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Comment 3: Two commenters recommended that the four-hour notification events should be incorporated into the eight-hour notification events, therefore eliminating the four-hour notification events. One commenter specifically recommended that suspicious events be moved from four-hour to eight-hour notifications. [NEI-17, 161, Hardin-2]

Response: The NRC agrees in part, with this comment. The NRC agrees that suspicious cyber security events (i.e., activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack) should be moved from four-hour notifications to eight-hour notifications. However, notifications with a local, State, or other Federal agency is consistent with existing NRC regulations at § 50.72(b)(2)(xi). In addition, unsuccessful cyber attacks has been clarified to align more closely with § 73.54 and addresses cyber attacks that could have caused an adverse impact to SSEP functions and remains a four-hour notification so the NRC can conduct additional notifications as appropriate (e.g., other NRC licensees, Federal law enforcement agencies, the intelligence community) to mitigate the effects of a widespread cyber attack, or use as part of the National threat assessment process. Furthermore, unauthorized operation and tampering events have been clarified to address suspected or actual cyber attacks initiated by personnel with physical or electronic access and were moved in the final rule to four-hour notifications due to the implications of an internal threat. Accordingly, the NRC has revised the rule language and associated guidance consistent with this approach to address the broader recommendation of aligning more closely with § 73.54.

Comment 4: One commenter suggested adding the word “significant” in front of cyber security events. [NEI-167]

Response: The NRC disagrees with this comment. Prefacing the phrase “cyber security events” with “significant” does not add clarity to the rule. The NRC is requiring only those cyber security events associated with actual or potential adverse impacts to be reported. The NRC has changed the rule text and associated guidance to align more closely with § 73.54 and distinguishes cyber security events by whether an adverse impact has occurred (or not) to SSEP functions as a result of a cyber attack.

Comment 5: One commenter suggested removing the requirement in appendix G of 10 CFR part 73 regarding the recording of events in a safeguards event log. The commenter suggested licensees use the corrective action program instead of using a separate log. [NEI-18, 194, 202]

Response: The NRC agrees with this comment. The cyber security plan for each licensee describes the use of the corrective action program to track, trend, correct, and prevent recurrence of cyber security failures and deficiencies. Therefore, the cyber security event notification rule text (§ 73.77) has been revised to require licensees to use their corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in their cyber security program. Regulatory Guide 5.83 has also been revised to reflect this change.

Comment 6: The NRC received a comment regarding the use of the term “compensatory” in the context of cyber security, stating that the term is unclear, and is not defined in the two cyber security plan (CSP) templates, Appendix A of RG 5.71, and Appendix A of NEI 08-09. [NEI-153, 165]

Response: The NRC agrees with this comment. The term “compensatory” is not defined in either CSP template or in other NRC guidance related to cyber security. Based on public comments, the NRC has developed a different approach for determining cyber security event notifications, one that is based on whether the cyber attack caused an adverse impact (or not) to SSEP functions. The final rule and RG 5.83 have been revised to reflect this new approach.

Comment 7: The NRC received one comment pertaining to use of the term “uncompensated” in the context of cyber security, stating that the term is unclear, and is not defined within the CSP. In addition, one of the commenters also stated that the term “failure” in the context of cyber security required clarification. [NEI-164, 207]

Response: The NRC agrees with this comment. The terms “uncompensated” and “failure” have been removed from the final rule language. Based on public comments, the NRC has developed a different approach for determining cyber security event notifications, one that is based on whether the cyber attack or event caused an adverse impact (or not) to SSEP functions. Regulatory Guide 5.83 has been revised to reflect this new approach.

Comment 8: One commenter proposed changes to the rule language, paragraph I.(h)(1) in appendix G of 10 CFR part 73, adding the terms “credible,” “malicious,” and “radiological sabotage” to add clarity. The commenter recommended rewriting the event to add in part, “a credible threat to commit or cause a malicious act to modify, destroy, or compromise any systems, networks, or equipment that falls within the scope of 10 CFR 73.54 of this part where a compromise of these systems has resulted or could result in radiological sabotage.” [NEI-157, 206]

Response: The NRC disagrees with this comment. Based on public comments, the NRC developed a different approach for determining cyber security event notifications, one that is based on whether a cyber attack caused an adverse impact (or not) to SSEP functions. This approach aligns more closely with § 73.54 and the terms “credible,” “malicious,” and “radiological sabotage” are not needed to provide clarity under this approach. Regulatory Guide 5.83 has been revised to reflect this new approach.

Comment 9: One commenter proposed revising the proposed rule language in paragraph I.(h)(2) in appendix G of 10 CFR part 73 to include language regarding the defense-in-depth protective strategies required by § 73.54(c)(2). [NEI-158]

Response: The NRC agrees with this comment. The NRC evaluated the proposed rule language and determined that items to be reported under this section are duplicative. Based on public comments, the NRC developed a different approach for determining cyber security event notifications, one based on whether the cyber attack caused an adverse impact (or not) to SSEP functions. Regulatory Guide 5.83 has been revised to reflect this approach.

Comment 10: One commenter proposed language to paragraph I.(c)(1) in appendix G of 10 CFR part 73 to report only instances of suspicious or surveillance activity or attempts to access systems, networks, or equipment that is within the scope of § 73.54. Additionally, the commenter recommended deleting proposed language that would include reporting of additional types of events like potential tampering or potential destruction of networks, systems, or equipment. [NEI-159]

Response: The NRC disagrees with this comment. The commenter's reference to paragraph I.(c)(1) in appendix G of 10 CFR part 73 appears to be misquoted. The changes proposed by the commenter would amend paragraph II.(c)(1) in appendix G. The NRC believes that surveillance activities are captured within activities that indicate intelligence gathering or pre-operational planning and should be reported, and has made appropriate changes to this final rule. The NRC has clarified and relocated this requirement to the eight-hour notifications, now designated as § 73.77(a)(3). Additionally, the NRC moved the reporting of potential tampering, or potential destruction of networks, systems or equipment from this requirement and they are now captured under § 73.77(a)(1), (a)(2)(i), and (a)(2)(ii) of this final rule.

Comment 11: One commenter indicated that paragraph I.(c)(2) in appendix G of 10 CFR part 73 in the proposed rule text should be completely removed because it duplicates other proposed rule text. [NEI-160]

Response: The NRC agrees in part, with this comment. The commenter's reference to paragraph I.(c)(2) in appendix G of 10 CFR part 73 appears to be misquoted. The changes proposed by the commenter would amend paragraph II.(c)(2) in appendix G. The final rule text has been revised to remove all duplicative language and is aligned more closely with the requirements in § 73.54 (i.e., adverse impacts to SSEP functions). This revised requirement is designated as § 73.77(a)(2)(i). Regulatory Guide 5.83 has been revised to reflect this change.

Comment 12: One commenter proposed changes to paragraph III in appendix G of 10 CFR part 73 to clarify the language under eight-hour reportable events to be consistent with § 73.54(c)(1), which implements security controls to protect CDAs and critical systems from cyber attacks. [NEI-162]

Response: The NRC agrees in part, with this comment. Based on public comments, the NRC developed an approach that aligns more closely with § 73.54. The implementation of security controls to protect CDAs from cyber attacks as described in § 73.54(c)(1) is designed to prevent adverse impacts to SSEP functions. Therefore, in the final rule, a cyber attack that adversely impacted SSEP functions requires notification within one hour after discovery, and cyber attacks that could have caused an adverse impact to SSEP functions requires notification within four hours after discovery due to the potential consequences of these events. Regulatory Guide 5.83 has been revised to reflect this new approach.

Comment 13: One commenter recommended adding “that would” to a proposed 24-hour recordable event provision in paragraph IV.(a)(2) in appendix G of 10 CFR part 73. Specifically, the commenter recommended that the proposed appendix G provision regarding compensated security events state in part as follows:

Response: The NRC disagrees with this comment. Adding the words, “that would” to the rule text changes the context of the type of events that are required to be recorded. However, based on other public comments, the NRC re-evaluated the 24-hour recordable events for cyber security event notifications and developed an approach that aligns more closely with the CSP requirements. Under this approach, as reflected in the new § 73.77(b)(1) provision being added as part of this final rule, licensees will be required to use their corrective action program to record vulnerabilities, weaknesses, failures, and deficiencies in their cyber security program within twenty-four hours of their discovery. Regulatory Guide 5.83 has been updated to reflect this change.

Comment 14: One commenter recommended revising the proposed rule language to align exactly with the rule language in § 73.54(a)(2), which discusses protecting digital assets from cyber attacks that would adversely impact the operations of SSEP functions. Specifically, the commenter notes that the reporting rule text uses the word “could” instead of “would.” [NEI-168]

Response: The NRC agrees in part, with this comment. The NRC agrees that the reporting rule text should align more closely with § 73.54. However, the NRC disagrees with changing the word “could” to “would,” because these words are correctly used in their respective rules. Section 73.54 addresses hypothetical future cyber attacks that must be protected against, while this rule describes notifications that licensees are required to issue after an event has already occurred. Further, there are different types of cyber attacks that licensees are required to report. One type of attack required to be reported is a cyber attack that adversely impacted SSEP functions. This type of attack is to be reported within one-hour after discovery. Another type required to be reported is a cyber attack that could have caused an adverse impact to SSEP functions; this type of attack is to be reported within four-hours after discovery. The NRC has revised RG 5.83 to reflect this new approach that aligns more closely with § 73.54 regarding adverse impacts to SSEP functions.

Comment 15: One commenter proposed deleting the requirement in paragraph II.(c)(2) in appendix G of 10 CFR part 73 because the commenter believes it is duplicated in paragraph I.(h)(2) in appendix G. [NEI-169]

Response: The NRC agrees that the proposed paragraph II.(c)(2) in appendix G of 10 CFR part 73 is similar to paragraph I.(h)(2) in appendix G; therefore, the NRC has revised the final rule to make it clear exactly what types of cyber attacks are reported to the NRC. Specifically, the final rule language reflects a different approach for determining cyber security event notifications, eliminates duplicative requirements, and provides clarity based on whether the attack caused an adverse impact (or not) to SSEP functions. Regulatory Guide 5.83 has been revised to reflect this new approach.

Comment 16: One commenter proposed rule language in paragraph I.(h)(2) in appendix G of 10 CFR part 73 that would change events that “could” allow unauthorized or undetected access into systems, networks, or equipment to events that “would” allow unauthorized or undetected access into systems, networks, or equipment. [NEI-170]

Response: The NRC disagrees with this comment, but has, for other reasons, revised the requirement in the final rule. The objective of this reporting requirement is not to have licensees confirm with the NRC that a cyber attack has occurred. Rather, the objective is to report conditions in which such an attack could have occurred. The NRC continues to believe that licensees should report events or circumstances that could have resulted in undetected or compromised conditions at the facility. However, the NRC staff evaluated the language in the proposed rule and determined that items reported under this section were duplicative and therefore removed this requirement from the final rule text. Regulatory Guide 5.83 was revised to reflect this change.

Comment 17: One commenter recommended four and eight-hour notifications be consolidated into “within 24-hours” to mitigate event reporting violations. [B&W-30]

Response: The NRC disagrees with this comment. The four and eight-hour notifications include cyber attacks and activities (i.e., precursors to an attack) where the timeliness of information allows the NRC to conduct additional notifications (to DHS, other NRC licensees), assists the Federal Government and/or other NRC licensees to take mitigative measures to prevent a widespread cyber attack, and allows the NRC to respond to public and/or media inquiries. In addition, notifications to a local, State or other Federal agency is consistent with existing NRC regulations at § 50.72(b)(2)(xi).

Comment 18: One commenter recommended clarification on cyber security event notification requirements regarding exclusion of licensees not subject to § 73.54. [NFS-11, 12]

Response: The NRC agrees with this comment. The final rule text was revised and clarified to only apply to licensees subject to the provisions of § 73.54.

Comment 19: One commenter recommended that “one-hour notifications” should be related to a specific threat or attempted threat to the facility, and events that do not pose an actual threat should be “eight-hour notifications.” [NEI-22, 33]

Response: The NRC disagrees with this comment. Based on public comments, the NRC developed a different approach for determining cyber security event notifications, one that is based on whether a cyber attack caused an adverse impact (or not) to SSEP functions. Cyber attacks that adversely impacted SSEP functions are now one-hour notifications. Cyber attacks that could have caused an adverse impact to SSEP functions are now four-hour notifications, and activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack are now eight-hour notifications.

Comment 20: One commenter recommended adding the word “malevolent” to proposed requirements describing an unauthorized operation or tampering event to rule out human error events. [NEI-31, 48]

Response: The NRC disagrees with this comment. The word “malevolent” is unnecessary because, under the new approach, notification of such events is not based on the intent of the act, but based on the potential consequences of the event (i.e., adverse impact (or not) to SSEP functions). No change has been made to the final rule based on this comment.

Comment 21: One commenter recommended clarifying requirements regarding law enforcement interactions. The commenter recommended that notifications that could result in public or media inquiries should not duplicate notifications made under other NRC regulations such as § 50.72(b)(2)(xi). [NEI-35]

Response: The NRC agrees with this comment. The final rule has been revised to eliminate duplication of notifications made under other NRC regulations. Regulatory Guide 5.83 has been revised to reflect this change.

Comment 22: One commenter recommended clarification regarding retraction of reports determined later to be invalid. The commenter stated that the notification may not be invalid, but later be determined it does not meet the threshold of a one-, four-, or eight-hour notification (i.e., recordable event). [NEI-40]

Response: The NRC agrees with this comment. The final rule and RG 5.83 have been revised to clarify that retraction of reports can include valid reports which later do not meet the threshold of a one-, four-, or eight-hour notification.

Comment 23: One commenter recommended adding the term “malicious intent” to each of the eight-hour reportable events regarding unauthorized operation or tampering events. [NEI-53, 112]

Response: The NRC disagrees with this comment. The term “malicious intent” is unnecessary because, under the new approach, notification of such events is not based on the intent of the act, but based on the potential consequences of the event (i.e., adverse impact (or not) to SSEP functions).

Comment 24: One commenter recommended that cyber attack reporting needs to be synchronized with NEI 08-09 and RG 5.71 to ensure reporting criteria are well-defined. [NEI-69]

Response: The NRC agrees with this comment. The final rule reflects an approach that aligns more closely with § 73.54 and RG 5.71 and provides additional clarity on cyber security event notification criteria (i.e., adverse impact to SSEP functions). Regulatory Guide 5.83 has also been revised to reflect this new approach.

Comment 25: One commenter recommended deleting the requirements and guidance for written follow-up reports on several reporting events (four and eight-hour notifications). [NEI-117]

Response: The NRC disagrees with this comment. Submission of written follow-up reports is consistent with existing NRC regulations and provides the NRC with information that may not have been available at the time of the notification.

Comment 26: One commenter recommended that the final rule require licensees to notify their local FBI Joint Terrorism Task Force (JTTF) of suspicious events as contained in voluntary guidance documents and eliminate or reduce the timeliness of reporting such events to the NRC. [Hardin-3]

Response: The NRC disagrees with this comment. The reporting of events to the FBI JTTF is voluntary and as such, does not have a timeliness requirement. This final rule requires notification to the NRC within a stated time for activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack. Notifications of activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack will be evaluated and forwarded as appropriate by the NRC to federal law enforcement agencies and the intelligence community as part of the National threat assessment process.

Comment 1: One commenter proposed removing the terms such as “could,” “likelihood,” and “likely to” from DG-5019. [NEI-21, 166]

Response: The NRC disagrees with this comment. The use of the terms “could,” “likelihood,” and “likely to” within DG-5019 is consistent with existing NRC reporting guidelines (NUREG-1022, “Event Report Guidelines for 10 CFR 50.72 and 50.73” (ADAMS Accession No. ML13032A220)).

Comment 2: One commenter proposed revising section 2.3.2, item r, of DG-5019 to include, “Confirmed cyber attacks on computer systems that adversely affected safety, security, and emergency preparedness systems are reportable” instead of, “may adversely affect” and removing item aa of section 2.3.2 due to redundancy. [NEI-171]

Response: The NRC agrees with this comment. The staff evaluated both items in section 2.3.2 of DG-5019 and revised RG 5.83 to reflect the proposed changes.

Comment 3: One commenter proposed revising section 2.3.2, item bb.(2), of DG-5019 to include the word “cyber” before security program and security measures. [NEI-172]

Response: The NRC agrees with this comment, yet has, for other reasons removed this material from the final guidance. The final guidance reflects changes made to the final rule that aligns more closely with § 73.54 (i.e., adverse impacts to SSEP functions), and in the process, the NRC staff determined that item bb.(4) was no longer required.

Comment 4: One commenter proposed revising section 2.3.2, item bb.(3), of DG-5019 to state that events caused inadvertently by an individual and not resulting in a threat to facility security, would be a recordable event, and events caused by a cyber attack resulting in an adverse impact to SSEP functions would be a one-hour reportable event. [NEI-173]

Response: The NRC agrees with this comment. The item was revised in RG 5.83 to distinguish recordable inadvertent non-threatening events from those cyber attacks causing adverse impacts, which are one-hour notifications.

Comment 5: One commenter recommended moving section 2.3.2, item bb.(4) from (one-hour notification examples) to section 2.6.2 (eight-hour notification examples) in DG-5019 regarding attempts by unauthorized persons. [NEI-174]

Response: The NRC disagrees with this comment, yet has, for other reasons, removed this material from the final guidance. The final guidance reflects changes made to the final rule that aligns more closely with § 73.54 (i.e., adverse impacts to SSEP functions), and in the process, staff determined that item bb.(4) was no longer required.

Comment 6: One commenter recommended moving section 2.3.2, item bb.(5), (one-hour notification examples) to section 2.6.2 (eight-hour notification examples) in DG-5019 regarding cyber attacks thwarted by security controls. [NEI-175]

Response: The NRC disagrees with this comment, yet has, for other reasons, removed this material from the final guidance. The final guidance reflects changes made to the final rule that aligns more closely with § 73.54 (i.e., adverse impacts to SSEP functions), and in the process, staff determined that item bb.(5) was no longer required.

Comment 7: One commenter proposed removing the terms “unauthorized software” and “firmware” from section 2.3.2, item cc, because of redundancy with the term malware. [NEI-176]

Response: The NRC disagrees with this comment, but for other reasons, the guidance has been revised. There is a difference between malware, and unauthorized software, or firmware, and therefore there is no redundancy. However, the staff re-evaluated the language and determined the example is not consistent with § 73.54 and RG 5.71. Therefore, the example was not included in RG 5.83.

Comment 8: One commenter proposed changes to section 2.3.2, item dd, of DG-5019 where the result was changed from compromising the CDA to an adverse impact to SSEP functions. [NEI-177]

Response: The NRC agrees with the proposed changes to the item; however, due to changes in the final rule language, this item was clarified and moved to a four-hour notification example within RG 5.83.

Comment 9: One commenter recommended removing section 2.3.2, item ee, of DG-5019, because there are no NRC regulations covering “sensitive cyber security data.” [NEI-178]

Response: The NRC agrees with this comment. The item has been removed from RG 5.83.

Comment 10: One commenter recommended clarifying section 2.3.2, item ff, of DG-5019, and proposed the term “cyber intrusion detection capability” instead of the term “cyber intrusion detection system.” [NEI-179]

Response: The NRC disagrees with this comment, yet has, for other reasons, removed this material from the final guidance. The item was not included in RG 5.83 because it was not consistent with § 73.54 and RG 5.71.

Comment 11: One commenter recommended section 2.3.2, item hh, of DG-5019 be revised to be consistent with § 73.54(a)(2) by removing the term uncompensated. [NEI-181]

Response: The NRC disagrees with this comment, yet has, for other reasons, removed this material from the final guidance. The staff reviewed the item and determined it was not consistent with 10 CFR 73.54 and RG 5.71 and removed it from RG 5.83.

Comment 12: The NRC received several comments regarding redundant material within section 2.3.2., item hh, of DG-5019. [NEI-180, 182, 185]

Response: The NRC agrees with this comment. Staff removed items gg, ii and ll from section 2.3.2 in RG 5.83 because they were redundant with item hh regarding unauthorized access to CDAs.

Comment 13: One commenter recommended moving section 2.3.2, item jj, of DG-5019 from the one-hour notification examples to the four-hour notification examples in section 2.5.2 regarding discovery of falsified identification badges. [NEI-183]

Response: The NRC agrees in part with this comment, that the item should be moved. However, under the new approach, this item is consistent with eight-hour notifications (i.e., activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack) and was moved in final guidance to the eight-hour notification examples.

Comment 14: One commenter recommended revising section 2.3.2, item kk, of DG-5019 replacing the term “could” with “would.” [NEI-184]

Response: The NRC disagrees with this comment, yet has, for other reasons, removed this material from the final guidance. The NRC staff re-evaluated this item, determined it was not consistent with the final rule, and deleted it from RG 5.83.

Comment 15: One commenter recommended removing section 2.3.2, item mm, of DG-5019 because it duplicates 2.3.2, item y, regarding safeguards reporting requirements. [NEI-186]

Response: The NRC agrees with this comment. The item has been removed from RG 5.83.

Comment 16: One commenter recommended removing section 2.3.2, item nn, of DG-5019 because there are no NRC requirements for maintaining cyber security response personnel staffing levels. [NEI-187]

Response: The NRC agrees with this comment. The item has been removed from RG 5.83.

Comment 17: One commenter recommended revising section 2.3.2, item oo, of DG-5019 to change the phrase, “could increase the likelihood of an attempted attack” to the phrase, “would result in an attack.” [NEI-188]

Response: The NRC disagrees with this comment, yet has, for other reasons, revised this material in the final guidance. This item has been revised in RG 5.83 to include any event that allows unauthorized or undetected access to a CDA that could be exploited in an attack to be reported within four hours of discovery.

Comment 18: One commenter recommended adding new examples to sections 2.3.2 and 2.5.2 of DG-5019. One example, (section 2.3.2) involved discovery of unauthorized user IDs and unauthorized configurations to cyber controls (e.g., firewall port opening, etc.). The other example (section 2.5.2) involved unauthorized attempts to probe CDAs including the use of social engineering techniques. [NEI-189, 190]

Response: The NRC agrees with the examples provided, and based on final rule text changes (cyber attacks initiated by personnel with physical or electronic access and activities that may indicate pre-operational planning), these items were included in RG 5.83.

Comment 19: One commenter recommended revising section 2.5.2, item kk, of DG-5019 to include the word cyber before the term security controls. [NEI-191]

Response: The NRC agrees with this comment. The item was revised in RG 5.83 to include the word cyber before security controls.

Comment 20: One commenter recommended removing section 2.5.2, item mm, of DG-5019 because it is redundant to section 2.5.2, item kk. [NEI-192]

Response: The NRC agrees with this comment. The item has been removed from RG 5.83.

Comment 21: One commenter recommended revising section 2.5.2, item oo, of DG-5019 to add Levels 3 and 4 to the description so the item is consistent with the definition provided in the glossary for a CDA. [NEI-193]

Response: The NRC disagrees with this comment, but for other reasons has revised the final guidance. The definition of a CDA in RG 5.83 was revised for consistency with the definition provided in RG 5.71.

Comment 22: One commenter recommended revising section 2.5.2, item qq, of DG-5019 or removing it altogether because reporting the high number of malware attempts on lower security level networks that do not have the degree of protection of CDAs would be burdensome on the NRC and the licensee. [NEI-195]

Response: The NRC agrees with this comment. Based on final rule text changes, this item was revised in RG 5.83 narrowing the scope to attacks discovered or manifested on a CDA, critical system or protected network reducing the number of potential notifications on the licensee and the NRC.

Comment 23: One commenter recommended revising section 2.5.2, item rr, of DG-5019 to clarify the term “cyber systems.” [NEI-196]

Response: The NRC agrees with this comment. In RG 5.83 this item was revised for consistency with RG 5.71 and uses the terms “critical systems” and “CDAs.”

Comment 24: One commenter recommended removing the 15-minute reference in section 2.5.2, item ss, of DG-5019. [NEI-197]

Response: The NRC agrees with this comment. The final rule text does not contain any 15-minute notifications related to cyber security, and therefore, this item was revised in the final guidance to a four-hour notification example.

Comment 25: One commenter recommended revising or removing the paragraph before section 2.6.2, item h, in DG-5019 regarding cyber security events that interrupt or degrade the facility's SSEP functions. [NEI-198]

Response: The NRC agrees with this comment, yet has, for other reasons removed this material from the final guidance. The final guidance reflects changes made to the final rule that aligns more closely with § 73.54 (i.e., adverse impacts to SSEP functions), and in the process, staff determined that this item was no longer required.

Comment 26: One commenter recommended revising section 2.6.2, item I, of DG-5019. The commenter recommended removing the term “failed” because a CDA could fail for non-malicious reasons and not be the result of a cyber attack or unauthorized activity. [NEI-199]

Response: The NRC agrees with this comment. There are many reasons a critical digital asset can fail that are not related to unauthorized activity or cyber attacks. Regulatory Guide 5.83 has been revised to reflect this change.

Comment 27: One commenter recommended revising section 5.3, item n, of DG-5019 because the term “compensated” is not defined. [NEI-200]

Response: The NRC agrees with this comment. This item was removed from RG 5.83.

Comment 28: One commenter recommended clarifying section 5.3, item o, of DG-5019 regarding individuals who are incorrectly authorized access to a CDA. [NEI-201]

Response: The NRC agrees with this comment. This item was removed from RG 5.83.

Comment 29: One commenter recommending adding items to section 5.3 of DG-5019 to include examples of cyber events that are compensated as proposed by paragraph IV.(a) in appendix G of 10 CFR part 73. [NEI-203]

Response: The NRC disagrees with this comment. The final rule language reflects a different approach, one based on whether the cyber attack or event caused an adverse impact (or not) to SSEP functions, instead of whether the cyber attack or event was compensated or uncompensated. Regulatory Guide 5.83 has been revised to reflect this new approach.

Comment 30: One commenter recommended changes to the definitions provided in the glossary of DG-5019. The commenter proposed changing “cyber attack” to be consistent with the definition provided in NEI 08-09 and changing “CDA” to only include digital computer, communication systems, and networks that fall within level 3 or 4 boundaries as well as a general comment that all definitions in the glossary be synchronized with code requirements and regulatory guides. [NEI-138, 204, 205]

Response: The NRC agrees in part with this comment. The definitions of cyber attack and CDA in RG 5.83 have been revised to synchronize with the definitions in RG 5.71, not NEI 08-09.

Comment 31: Two commenters proposed a definition of the term “discovery time of” in DG-5019. The commenters suggested discovery occurs after initial notifications are made and a determination made that the event meets applicable reporting requirements. [NEI-19, B&W-29]

Response: The NRC disagrees with this comment. Internal notifications and gathering information to make a determination as to whether it meets applicable reporting requirements could take several hours, or even days, depending on the amount of information needed to reach a conclusion. The time to report an event is upon recognition; the licensee can withdraw a report (based on subsequent analysis of the circumstances) without prejudice to its security performance indicators. No changes have been made to the guidance.

Comment 32: One commenter stated that the cyber security plan templates published by the NRC and NEI do not contain guidance for licensees to differentiate between events that are recordable versus reportable. [NEI-20, 154]

Response: The NRC agrees with this comment. Neither cyber security plan template issued by the NRC or NEI contains guidance for licensees on which events are recordable or reportable. However, DG-5019 provided guidance to licensees on events that are reportable and recordable related to cyber security event notifications. Consistent with Commission policy, the NRC is publishing with this final rule, final guidance, RG 5.83, “Cyber Security Event Notifications,” which provides guidance to licensees on an acceptable method for meeting regulatory requirements. The final guidance has been revised to provide examples that differentiate between events that are reportable and recordable.

Comment 33: One commenter recommended revisions to NRC Form 366. The commenter recommended the NRC specify the type of content licensees should include in the abstract section of the form. [NEI-44, 118]

Response: The NRC disagrees with this comment. The NRC's Form 366 will not be revised. Regulatory Guide 5.83 will provide the specific type of content that should be included in the abstract section of NRC's Form 366.

Comment 34: One commenter recommended clarifying the guidance regarding elicitation of information from facility personnel relating to security or safe operation of the facility. The commenter suggested adding the phrase “non-routine” regarding the elicitation of information to distinguish general public or media inquiries from elicitations that could be indicative of suspicious activity. [NEI-52, 95, 99]

Response: The NRC agrees with this comment. Regulatory Guide 5.83 has been revised to provide a distinction between common inquiries (e.g., public and media inquiries) and uncommon inquiries (e.g., activities that may indicate intelligence gathering or pre-operational planning related to a cyber attack).

Comment 35: One commenter recommended clarifying the examples of one-hour notifications and including “real life” examples. [NEI-71]

Response: The NRC agrees with this comment. The NRC staff reviewed previous “real life” examples and included them in final guidance. In addition, the new approach for one-hour notifications (i.e., adverse impacts to SSEP functions) provides additional clarity.

Comment 36: One commenter recommended changes to the examples involving the compromise of CDAs. The commenter stated that section 2.3.2 of DG-5019, items (aa) and (bb) were duplicative, and that two supporting examples (4 and 5) were not within the scope of one-hour notifications (i.e., adverse impact to SSEP functions). [NEI-94]

Response: The NRC agrees with this comment. Regulatory Guide 5.83 has been revised to delete one of the duplicate items and to remove the two supporting examples from the remaining item.

Comment 37: One commenter recommended moving an example related to unauthorized attempts to steal business secrets or sensitive information to the cyber security event notification examples. [NEI-100]

Response: The NRC disagrees with this comment. The final rule reflects an approach that aligns more closely with § 73.54 and RG 5.71, and provides clarity to cyber security event notification criteria. Unauthorized attempts to access business and trade sensitive information is outside the scope of § 73.54, and no changes to the rule or RG 5.83 were made based on this comment

Comment 38: One commenter recommended clarifying the example regarding unsubstantiated cyber threats related to harassment, including threats that could represent tests of response capabilities. The commenter stated the example was confusing and too broad in scope. [NEI-111]

Response: The NRC agrees with this comment. The NRC has revised the example to clarify the scope of the cyber attacks to be reported (i.e., a cyber attack that could have caused an adverse impact to SSEP functions).

Comment 39: One commenter requested NRC clarify the guidance on unplanned missed cyber vulnerability assessments. [NEI-131]

Response: The NRC agrees with this comment. Regulatory Guide 5.83 was revised to clarify the treatment of missed cyber vulnerability assessments. The CSP states the periodicity that cyber vulnerability assessments are performed (quarterly). If a cyber vulnerability assessment exceeds the periodicity specified in the CSP, it would be considered a 24-hour recordable event.

Comment 1: One commenter raised a concern that by issuing the Cyber Security Event Notifications (CSEN) final rulemaking now it may delay full implementation of § 73.54 because of the impact on resources. The commenter stated that licensees may have to divert some resources from implementing the cyber security program to implementing the CSEN requirements.

Response: The NRC agrees in part with this comment. The NRC staff recognizes that this rule will have an impact on licensee resources (similar skillsets required for CSEN and cyber security program implementation). The NRC staff acknowledges this and is conducting CER related activities in an effort to minimize the impact (e.g., conducting a public meeting on the implementation date during final rulemaking, issuing final guidance with the final rule). In addition, the CSEN final rule is consistent with existing notification processes (i.e., §§ 50.72 and 73.71) and aligns closely with § 73.54 and the current voluntary reporting initiatives thereby reducing the level of impact on implementation. However, the CSEN final rule removes the voluntary aspect of reporting certain cyber security events and provides regulatory stability and ensures the NRC is notified in a timely manner while maintaining its strategic communications mission outlined in the framework of the National Infrastructure Protection Plan developed by the DHS (see http://www.dhs.gov/sites/default/files/publications/National-Infrastructure-Protection-Plan-2013-508.pdf). Prompt notification of a cyber attack could be vital to the NRC's ability to take immediate action in response to a cyber attack and, if necessary, to notify other NRC licensees, Government agencies, and critical infrastructure facilities, to defend against a multiple sector cyber attack. A cyber attack has the capability to be launched against multiple targets simultaneously or spread quickly throughout multiple sectors of critical infrastructure; therefore, the NRC has not changed the 180-day implementation schedule.

The following section-by-section analysis discusses the final revisions to the NRC's regulations regarding cyber security, and explains how the final rule differs from the language in the proposed rule. This final rule adds a new section (§ 73.77) to 10 CFR part 73 and revises three existing sections (§§ 73.8, 73.22, and 73.54) to make conforming changes.

The NRC is amending § 73.8 to add § 73.77 to paragraph (b) that provides the approved information collection requirements contained in 10 CFR part 73 under control number 3150-0002. In addition, the NRC is amending § 73.8 to add § 73.77 to paragraph (c)(1) that provides that NRC Form 366 is approved under control number 3150-0104.

The NRC is amending § 73.22(f)(3) to add the sentence, “Cyber security event notifications required to be reported pursuant to § 73.77 are considered to be extraordinary conditions” to the end of the paragraph.

The NRC is amending § 73.54 to add a new paragraph (d)(4) that reads, “Conduct cyber security event notifications in accordance with the provisions of § 73.77.” This new requirement guides the licensee to the correct 10 CFR part 73 section for conducting cyber security event notifications.

The NRC has moved cyber security event notifications requirements that were proposed to be added to § 73.71 and appendix G to a newly created section (§ 73.77) within 10 CFR part 73.

Section 73.77(a)(1) requires licensees to notify the NRC within one-hour after discovery of a cyber attack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications); or that compromised support systems and equipment resulting in adverse impacts to safety, security, or emergency preparedness functions within the scope of § 73.54. This requirement differs from the proposed rule language, it has been revised to more closely align with § 73.54 and to remove the term “uncompensated cyber security events” because it was unclear and not defined within the CSP.

Section 73.77(a)(2) requires licensees to notify the NRC within four-hours.

Section 73.77(a)(2)(i) after discovery of a cyber attack that could have caused an adverse impact to safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications); or that could have compromised support systems and equipment, which if compromised, could have adversely impacted safety, security, or emergency preparedness functions within the scope of § 73.54. This requirement differs from the proposed rule; it has been revised to more closely align with § 73.54. In addition, the final rule distinguishes between four-hour and eight-hour notifications.

Section 73.77(a)(2)(ii) after discovery of a suspected or actual cyber attack initiated by personnel with physical or electronic access to digital computer and communication systems and networks within the scope of § 73.54. This requirement differs from the proposed rule; it has been revised to capture cyber attacks (e.g., tampering) that may not have any impact on SSEP functions, but may indicate an internal threat.

Section 73.77(a)(2)(iii) after notification of a local, State, or other Federal agency (e.g., local law enforcement, FBI, etc.) of an event related to implementation of their cyber security program. The final rule includes other types of agencies besides law enforcement (e.g., DHS, etc.) to maintain consistency with existing NRC reporting requirements (e.g., § 50.72).

Section 73.77(a)(3) requires licensees to notify the NRC within eight-hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyber attack against digital computer and communication systems and networks within the scope of § 73.54. Requirements for “suspicious cyber events” have been revised and moved from four-hour notifications in the proposed rule to eight-hour notifications in the final rule. This requirement now captures activities that are associated with precursors to a cyber attack (e.g., activities related to intelligence gathering or pre-operational planning).

Section 73.77(b) requires licensees to record certain cyber security events in their site corrective action program (CAP) within 24-hours of their discovery. The proposed rule required licensees to use a Safeguards Event Log; to prevent duplication of effort, the final rule requires licensees to use their site CAP.

Section 73.77(b)(1) requires licensees to use their site CAP to record vulnerabilities, weaknesses, failures, and deficiencies in their § 73.54 cyber security program. This requirement has been revised to align with NRC physical protection program requirements in § 73.55(b)(10) regarding the use of the site CAP to track, trend, correct, and prevent recurrence of failures and deficiencies.

Section 73.77(b)(2) requires licensees to record notifications made under paragraph (a) of § 73.77.

Section 73.77(c) provides the process for conducting cyber security event notifications.

Section 73.77(c)(1) has been revised from the proposed rule to include the Emergency Notification System (ENS) as the primary means for conducting notifications, instead of any available telephone system. Using the ENS is consistent with existing NRC regulations for conducting notifications (e.g., § 50.72).

Section 73.77(c)(3) in the final rule was revised to remove a reference to paragraph III in appendix A of 10 CFR part 73 that provided instructions on requesting a transfer to a secure phone. The current appendix A in 10 CFR part 73 does not contain a paragraph III and conforming changes to appendix A are not part of this final rule. Section 73.77(c)(3) was revised to reference appendix A and request transfer to a secure phone.

Sections 73.7(c)(6), “Declaration of emergencies,” and 73.77(c)(7), “Elimination of duplication,” were moved in the final rule from the “Written Security Follow-up Reports” section into the “Notification Process” section because they contain notification-specific information. In addition, due to the narrowed scope of this final rule, the proposed rule referenced several sections of the NRC's regulations (e.g., § 70.50) that are not being revised by this final rule.

Section 73.77(d), “Written security follow-up reports,” establishes the necessary regulatory framework to facilitate consistent application of Commission requirements for written security follow-up reports for cyber security event notifications.

Under the Regulatory Flexibility Act (5 U.S.C. 605(b)), the NRC certifies that this rule does not have a significant economic impact on a substantial number of small entities. This final rule affects only the licensing and operation of nuclear power plants. The companies that own these plants do not fall within the scope of the definition of “small entities” set forth in the Regulatory Flexibility Act or the size standards established by the NRC (10 CFR 2.810).

The NRC has prepared a final regulatory analysis for this final rule. The analysis examines the costs and benefits of the alternatives considered by the NRC. The regulatory analysis is available as indicated in Section XVII., “Availability of Documents,” of this document.

The final rule imposing new cyber security event notifications affects information collection and reporting requirements and is not considered to be a backfit, as presented in the charter for NRC's Committee to Review Generic Requirements. Therefore, a backfit analysis has not been completed for any of the provisions of this final rule.

While the proposed rule was issued prior to the formal CER requirements promulgated by SRM-SECY-0032, the intent of CER was still met. For example, the draft guidance was issued for comment concurrent with the proposed rule, a public meeting was conducted during the development of the proposed rule, a public meeting on implementation was conducted during the final rule stage, and the final guidance will be issued with the final rule.

The NRC staff engaged external stakeholders at public meetings and by soliciting public comments on the proposed rule and draft guidance documents. A public meeting was held at NRC Headquarters on June 1, 2011, to discuss the proposed rule, the draft implementation plan, and draft guidance.

In addition, on July 31, 2014, a public meeting was held at the NRC Headquarters on the draft final implementation plan for the final rule (a type of meeting specifically contemplated by the NRC's CER effort). Prompt notification of a cyber attack is vital to the NRC's ability to take immediate action in response to a cyber attack, which contributes to protecting the public health and safety or the common defense and security. The NRC's strategic communications mission and the feedback from the public meetings informed the staff's recommended schedule for the final implementation date in the CSEN final rule.

A fundamental CER process improvement is to publish the final guidance with the final rule so as to support effective implementation. This final rulemaking accomplishes this by ensuring that final guidance is complete and available concurrent with this final rule publication in the Federal Register.

The Plain Writing Act of 2010 (Pub. L. 111-274) requires Federal agencies to write documents in a clear, concise, and well-organized manner. The NRC has written this document to be consistent with the Plain Writing Act as well as the Presidential Memorandum, “Plain Language in Government Writing,” published June 10, 1998 (63 FR 31883).

The NRC has determined that this final rule is the type of action described in 10 CFR 51.22(c)(3)(iii). Therefore, neither an environmental impact statement nor environmental assessment has been prepared for this final rule.

This final rule contains new or amended information collection requirements that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). These requirements were approved by the Office of Management and Budget (OMB), approval number 3150-0230 and 3150-0104.

The burden to the public for these information collections is estimated to average 39.4 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the information collection. Send comments on any aspect of these information collections, including suggestions for reducing the burden, to the Freedom of Information Act, Privacy, and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by email to [email protected] and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0230 and 3150-0104), Office of Management and Budget, Washington, DC 20503 or by email to [email protected].

The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number.

In accordance with the Congressional Review Act of 1996 (5 U.S.C. 801-808), the NRC has determined that this action is not a major rule and has verified this determination with the Office of Information and Regulatory Affairs of OMB.

For the purposes of Section 223 of the Atomic Energy Act of 1954, as amended (AEA), the NRC is issuing this final rule that would amend §§ 73.8, 73.22, and 73.54, and add § 73.77 under one or more of Sections 161b, 161i, or 161o of the AEA. Willful violations of the rule would be subject to criminal enforcement. Criminal penalties as they apply to regulations in 10 CFR part 73 are discussed in § 73.81(a).

Under the “Policy Statement on Adequacy and Compatibility of Agreement State Programs,” approved by the Commission on June 20, 1997, and published in the Federal Register (62 FR 46517; September 3, 1997), this rule is classified as compatibility “NRC.” Compatibility is not required for Category “NRC” regulations. The NRC program elements in this category are those that relate directly to areas of regulation reserved to the NRC by the AEA or the provisions of 10 CFR, and although an Agreement State may not adopt program elements reserved to the NRC, it may wish to inform its licensees of certain requirements via a mechanism that is consistent with a particular State's administrative procedure laws, but does not confer regulatory authority on the State.

The NRC is issuing implementation guidance for this rule, RG 5.83, “Cyber Security Event Notifications” (Docket ID NRC-2014-0036). The guidance is available in ADAMS under Accession No. ML14269A388. Regulatory Guide 5.83 is intended to describe a proposed method that the NRC staff considers acceptable for use in complying with the NRC's regulations on cyber security event notifications. Because the regulatory analysis for the final rule provides sufficient explanation for the rule and the implementing guidance, a separate regulatory analysis was not prepared for the regulatory guide.

The documents identified in the following table are available to interested persons through the following methods, as indicated.

For the reasons set out in the preamble and under the authority of the Atomic Energy Act of 1954, as amended; the Energy Reorganization Act of 1974, as amended; and 5 U.S.C. 552 and 553, the NRC is adopting the following amendments to 10 CFR part 73.

The Farm Credit Administration (FCA or our) amended our regulations related to mergers and consolidations of Farm Credit System banks and associations to clarify the merger review and approval process and incorporate existing practices in the regulations. In accordance with 12 U.S.C. 2252, the effective date of the final rule is no earlier than 30 days from the date of publication in the Federal Register during which either or both Houses of Congress are in session. Based on the records of the sessions of Congress, the effective date of the regulations is November 2, 2015.

The Commission issued the Energy Labeling Rule (“Rule”) in 1979,1 pursuant to the Energy Policy and Conservation Act of 1975 (EPCA).2 The Rule requires energy labeling for major home appliances and other consumer products to help consumers compare competing models. When first published, the Rule applied to eight product categories: Refrigerators, refrigerator-freezers, freezers, dishwashers, water heaters, clothes washers, room air conditioners, and furnaces. The Commission subsequently expanded the Rule's coverage to include central air conditioners, heat pumps, plumbing products, lighting products, ceiling fans, and televisions.3

1. In this final rule, the Federal Energy Regulatory Commission (Commission) amends its regulations at 18 CFR 284.12 to incorporate by reference the latest version (Version 3.0) of seven business practice standards applicable to interstate natural gas pipelines adopted by the Wholesale Gas Quadrant (WGQ) of the North American Energy Standards Board (NAESB). Interstate natural gas pipelines are required to implement these standards April 1, 2016.

2. The NAESB WGQ Version 3.0 package of standards includes standards governing coordination of the scheduling processes of interstate natural gas pipelines and public utilities that the Commission incorporated by reference in Docket No. RM14-2-000.1 These updated business practice standards will replace the earlier version of these business practice standards that previously were incorporated by reference. The standards also revise the codes used to identify receipt and delivery locations in the Index of Customers. In addition, for consistency with the revisions to the Index of Customers, the Commission is also amending its regulations at 18 CFR 157.14, 157.18, 260.8, and 284.13 to have receipt and delivery point information in various interstate natural gas pipeline filings and postings use the same location point names as provided for in the NAESB WGQ Version 3.0 Standards. Finally, we also are making conforming changes to 18 CFR 284.126.

I. Background

In accordance with section 513(f)(1) of the Federal Food, Drug, and Cosmetic Act (the FD&C Act) (21 U.S.C. 360c(f)(1)), devices that were not in commercial distribution before May 28, 1976 (the date of enactment of the Medical Device Amendments of 1976), generally referred to as postamendments devices, are classified automatically by statute into class III without any FDA rulemaking process. These devices remain in class III and require premarket approval, unless and until the device is classified or reclassified into class I or II, or FDA issues an order finding the device to be substantially equivalent, in accordance with section 513(i) of the FD&C Act, to a predicate device that does not require premarket approval. The Agency determines whether new devices are substantially equivalent to predicate devices by means of premarket notification procedures in section 510(k) of the FD&C Act (21 U.S.C. 360(k)) and part 807 (21 CFR part 807) of the regulations.

Section 513(f)(2) of the FD&C Act, as amended by section 607 of the Food and Drug Administration Safety and Innovation Act (Pub. L. 112-144), provides two procedures by which a person may request FDA to classify a device under the criteria set forth in section 513(a)(1). Under the first procedure, the person submits a premarket notification under section 510(k) of the FD&C Act for a device that has not previously been classified and, within 30 days of receiving an order classifying the device into class III under section 513(f)(1) of the FD&C Act, the person requests a classification under section 513(f)(2). Under the second procedure, rather than first submitting a premarket notification under section 510(k) of the FD&C Act and then a request for classification under the first procedure, the person determines that there is no legally marketed device upon which to base a determination of substantial equivalence and requests a classification under section 513(f)(2) of the FD&C Act. If the person submits a request to classify the device under this second procedure, FDA may decline to undertake the classification request if FDA identifies a legally marketed device that could provide a reasonable basis for review of substantial equivalence with the device or if FDA determines that the device submitted is not of “low-moderate risk” or that general controls would be inadequate to control the risks and special controls to mitigate the risks cannot be developed.

In response to a request to classify a device under either procedure provided by section 513(f)(2) of the FD&C Act, FDA will classify the device by written order within 120 days. This classification will be the initial classification of the device.

In accordance with section 513(f)(1) of the FD&C Act, FDA issued an order on January 03, 2013 automatically classifying the xTAG® Gastrointestinal Pathogen Panel (GPP) in class III, because it was not substantially equivalent to a device that was introduced or delivered for introduction into interstate commerce for commercial distribution before May 28, 1976, nor to a device that was subsequently reclassified into class I or class II. On January 10, 2013, Luminex Molecular Diagnostics, submitted a request for de novo classification of the xTAG® GPP under section 513(f)(2) of the FD&C Act.

In accordance with section 513(f)(2) of the FD&C Act, FDA reviewed the request for de novo classification in order to classify the device under the criteria for classification set forth in section 513(a)(1) of the FD&C Act. FDA classifies devices into class II if general controls by themselves are insufficient to provide reasonable assurance of safety and effectiveness, but there is sufficient information to establish special controls to provide reasonable assurance of the safety and effectiveness of the device for its intended use. After review of the information submitted in the request, FDA determined that the device can be classified into class II with the establishment of special controls. FDA believes these special controls will provide reasonable assurance of the safety and effectiveness of the device.

Therefore, on January 14, 2013, FDA issued an order to the requestor classifying the device into class II. FDA is codifying the classification of the device by adding 21 CFR 866.3990 (§ 866.3990).

Following the effective date of this final classification administrative order, any firm submitting a premarket notification (510(k)) for a gastrointestinal microorganism multiplex nucleic acid-based assay will need to comply with the special controls named in this final administrative order.

The device is assigned the generic name gastrointestinal microorganism multiplex nucleic acid-based assay, and it is identified as a qualitative in vitro diagnostic device intended to simultaneously detect and identify multiple gastrointestinal microbial nucleic acids extracted from human stool specimens. The device detects specific nucleic acid sequences for organism identification as well as for determining the presence of toxin genes. The detection and identification of a specific gastrointestinal microbial nucleic acid from individuals exhibiting signs and symptoms of gastrointestinal infection aids in the diagnosis of gastrointestinal infection when used in conjunction with clinical evaluation and other laboratory findings. A gastrointestinal microorganism multiplex nucleic acid-based assay also aids in the detection and identification of acute gastroenteritis in the context of outbreaks.

FDA has identified the following risks to health associated with this type of device and the measures required to mitigate these risks in table 1:

FDA believes that the measures set forth in the special controls guideline entitled “Class II Special Controls Guideline: Gastrointestinal Microorganism Multiplex Nucleic Acid-Based Assays for Detection and Identification of Microorganisms and Toxin Genes from Human Stool Specimens” are necessary, in addition to general controls, to mitigate the risks to health described in table 1.

A gastrointestinal microorganism multiplex nucleic acid-based assay is a prescription device. Section 510(m) of the FD&C Act provides that FDA may exempt a class II device from the premarket notification requirements under section 510(k) of the FD&C Act if FDA determines that premarket notification is not necessary to provide reasonable assurance of the safety and effectiveness of the device. For this type of device, FDA has determined that premarket notification is necessary to provide reasonable assurance of the safety and effectiveness of the device. Therefore, this type of device is not exempt from premarket notification requirements. Persons who intend to market this type of device must submit to FDA a premarket notification, prior to marketing the device, which contains information about the gastrointestinal microorganism multiplex nucleic acid-based assay they intend to market.

We have determined under 21 CFR 25.34(b) that this action is of type that does not individually or cumulatively have a significant effect on the human environment. Therefore, neither an environmental assessment nor an environmental impact statement is required.

This final administrative order establishes special controls that refer to previously approved collections of information found in other FDA regulations. These collections of information are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). The collections of information in 21 CFR part 807, subpart E, regarding premarket notification submissions have been approved under OMB control number 0910-0120; the collections of information in 21 CFR part 820 regarding quality systems have been approved under OMB control number 0910-0073; and the collections of information in 21 CFR parts 801 and 809 regarding labeling have been approved under OMB control number 0910-0485.

Therefore, under the Federal Food, Drug, and Cosmetic Act and under authority delegated to the Commissioner of Food and Drugs, 21 CFR part 866 is amended as follows:

Why is the Department promulgating this rule?

Currently, 22 CFR 41.113 provides for the placement of a stamp in a visa holder's passport. The Department is amending paragraphs (a) and (c) to reflect the current practice of issuing machine-readable visas on adhesive foils that are affixed to passports, and the planned future practice of issuing such visas as electronic visas. An electronic visas is a machine readable tamper-resistant visa format, as required by 8 U.S.C. 1732, in that the U.S. Customs and Border Protection officers at the port of entry are expected to scan the machine readable zone of the visa holder's passport to verify the biometrics and identity of the individual and to authenticate the visa's validity by accessing information stored in the Department's electronic records database.

Conforming changes and minor nonsubstative edits were made to paragraphs (b) and (d) through (h). Paragraph (i) was revised to remove visa review and file retention instructions that are internal Department procedures addressed in Volume 9 of the Foreign Affairs Manual. See http://www.state.gov/m/a/dir/regs/fam/.

This regulation amends certain “rules of agency organization, procedure, or practice”, which are not subject to the notice-and-comment rulemaking procedures set forth in 5 U.S.C. 553. See 5 U.S.C. 553(b). Therefore, the Department is issuing this amendment as a final rule.

Because this final rule is exempt from notice and comment rulemaking under 5 U.S.C. 553, it is exempt from the regulatory flexibility analysis requirements set forth by the Regulatory Flexibility Act (5 U.S.C. 603 and 604). Nonetheless, consistent with the Regulatory Flexibility Act (5 U.S.C. 605(b)), the Department certifies that this rule will not have a significant economic impact on a substantial number of small entities. This regulates individual aliens who seek consideration for nonimmigrant visas and does not affect any small entities, as defined in 5 U.S.C. 601(6).

Section 202 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532, generally requires agencies to prepare a statement before proposing any rule that may result in an annual expenditure of $100 million or more by State, local, or tribal governments, or by the private sector. This rule will not result in any such expenditure, nor will it significantly or uniquely affect small governments.

This rule is not a major rule as defined by 5 U.S.C. 804. The Department is aware of no monetary effect on the economy that would result from this rulemaking, nor will there be any increase in costs or prices; or any effect on competition, employment, investment, productivity, innovation, or the ability of United States-based companies to compete with foreign-based companies in domestic and import markets.

The Department of State has reviewed this rule to ensure its consistency with the regulatory philosophy and principles set forth in Executive Orders 12866 and 13563, and has determined that the benefits of this regulation, i.e., ensuring compliance with a Congressional mandate, outweigh any cost. The Department does not consider this rule to be a economically significant rulemaking action.

This regulation will not have substantial direct effects on the States, on the relationship between the national government and the States, or the distribution of power and responsibilities among the various levels of government. The rule will not have federalism implications warranting the application of Executive Orders 12372 and 13132.

The Department has reviewed the regulation in light of sections 3(a) and 3(b)(2) of Executive Order 12988 to eliminate ambiguity, minimize litigation, establish clear legal standards, and reduce burden.

The Department of State has determined that this rulemaking will not have tribal implications, will not impose substantial direct compliance costs on Indian tribal governments, and will not preempt tribal law. Accordingly, the requirements of Executive Order 13175 do not apply to this rulemaking.

This rule does not impose or revise information collection requirements under the provisions of the Paperwork Reduction Act, 44 U.S.C. Chapter 35.

For the reasons stated in the preamble, the Department of State amends 22 CFR Part 41 as follows:

The Norfolk and Portsmouth Belt Line Railroad Company, who owns and operates the Belt Line Railroad Bridge, has requested a temporary deviation from the current operating regulations to facilitate a tie replacement project on the bridge. The bridge is a vertical lift draw bridge and has a vertical clearance in the closed position of 6 feet above mean high water.

The current operating schedule is set out in 33 CFR 117.997(a). Under this temporary deviation, the bridge will remain in the closed-to-navigation position from 11 a.m. to 7 p.m., except for scheduled daily openings at 2 p.m. and 5 p.m., from October 29, 2015 through November 5, 2015. During this temporary deviation, the bridge will operate per 33 CFR 117.997(a) from 7 p.m. to 11 a.m. The South Branch of the Elizabeth River is used by a variety of vessels including deep draft ocean-going vessels, U.S. government vessels, small commercial vessels, recreational vessels and tug and barge traffic. The Coast Guard has carefully coordinated the restrictions with commercial and recreational waterway users.

Vessels able to pass through the bridge in the closed position may do so at anytime. The bridge will be able to open for emergencies and there is no alternate route for vessels unable to pass through the bridge in the closed position. The Coast Guard will also inform the users of the waterways through our Local and Broadcast Notice to Mariners of the change in operating schedule for the bridge so that vessels can arrange their transits to minimize any impacts caused by this temporary deviation.

In accordance with 33 CFR 117.35(e), the drawbridge must return to its regular operating schedule immediately at the end of the effective period of this temporary deviation. This deviation from the operating regulations is authorized under 33 CFR 117.35.

In the evening of October 26, 2015, the Coast Guard was notified that a 60 foot motorized vessel was taking on water in the vicinity of the Port St. Lucie Inlet. Over the next several hours attempts to refloat the vessel were unsuccessful and the grounded vessel settled on the bottom. Local, state, and federal agencies are now engaged in emergency salvage operations.

The Coast Guard is issuing this temporary rule without prior notice and opportunity to comment pursuant to authority under section 4(a) of the Administrative Procedure Act (APA) (5 U.S.C. 553(b)). This provision authorizes an agency to issue a rule without prior notice and opportunity to comment when the agency for good cause finds that those procedures are “impracticable, unnecessary, or contrary to the public interest.” Under 5 U.S.C. 553(b)(B), the Coast Guard finds that good cause exists for not publishing a notice of proposed rulemaking (NPRM) with respect to this rule because this rule is being established in response to an ongoing emergency situation. Delay in publishing this rule would be impracticable because the grounded vessel poses an immediate risk public safety. In addition, any delay in the publishing of this rule would be contrary to public interest. This rule is needed immediately in order to ensure safety of life on the navigable waters surrounding this ongoing emergency situation.

We are issuing this rule, and under 5 U.S.C. 553(d)(3), the Coast Guard finds that good cause exists for making it effective less than 30 days after publication in the Federal Register. For the same reasons discussed above, delay in issuing this rule would be both impracticable and contrary to public interest. The rule is in response to an emergent safety issue and is needed in order to ensure safety of life in the area around this emergency situation.

The Coast Guard is issuing this rule under authority in 33 U.S.C. 1231. The Captain of the Port Miami (COTP) has determined that potential hazards associated with the grounded vessel will be a safety concern for anyone within a 100-yard radius of the vessel and equipment engaged in salvage operations. This rule is needed to protect personnel, vessels, and the marine environment in the navigable waters within the safety zone while emergency salvage operations take place.

This rule establishes a safety zone from October 27, 2015 through November 15, 2015. COTP may cease enforcement of the zone if emergency salvage operations end before November 15, 2015. The safety zone will cover all navigable waters within 100 yards of vessels and machinery being used by personnel to conduct emergency salvage operations. The duration of the zone is intended to protect personnel, vessels, and the marine environment in these navigable waters while emergency salvage operations are conducted. No vessel or person will be permitted to enter the safety zone without obtaining permission from the COTP or a designated representative.

We developed this rule after considering numerous statutes and executive orders (E.O.s) related to rulemaking. Below we summarize our analyses based on a number of these statutes and E.O.s, and we discuss First Amendment rights of protestors.

E.O.s 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits. E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has not been designated a “significant regulatory action,” under E.O. 12866. Accordingly, it has not been reviewed by the Office of Management and Budget.

This regulatory action determination is based on the size, location, and duration. Vessel traffic will be able to safely transit around this safety zone which will impact a small designated area of the Atlantic Ocean for a limited duration during emergency salvage operations. Moreover, the Coast Guard will issue Broadcast Notice to Mariners via VHF-FM marine channel 16 about the zone and the rule allows vessels to seek permission to enter the zone.

The Regulatory Flexibility Act of 1980, 5 U.S.C. 601-612, as amended, requires Federal agencies to consider the potential impact of regulations on small entities during rulemaking. The term “small entities” comprises small businesses, not-for-profit organizations that are independently owned and operated and are not dominant in their fields, and governmental jurisdictions with populations of less than 50,000. The Coast Guard certifies under 5 U.S.C. 605(b) that this rule will not have a significant economic impact on a substantial number of small entities.

While some owners or operators of vessels intending to transit the safety zone may be small entities, for the reasons stated in section V.A above, this rule will not have a significant economic impact on any vessel owner or operator.

Under section 213(a) of the Small Business Regulatory Enforcement Fairness Act of 1996 (Pub. L. 104-121), we want to assist small entities in understanding this rule. If the rule would affect your small business, organization, or governmental jurisdiction and you have questions concerning its provisions or options for compliance, please contact the person listed in the FOR FURTHER INFORMATION CONTACT section.

Small businesses may send comments on the actions of Federal employees who enforce, or otherwise determine compliance with, Federal regulations to the Small Business and Agriculture Regulatory Enforcement Ombudsman and the Regional Small Business Regulatory Fairness Boards. The Ombudsman evaluates these actions annually and rates each agency's responsiveness to small business. If you wish to comment on actions by employees of the Coast Guard, call 1-888-REG-FAIR (1-888-734-3247). The Coast Guard will not retaliate against small entities that question or complain about this rule or any policy or action of the Coast Guard.

This rule will not call for a new collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520).

A rule has implications for federalism under E.O. 13132, Federalism, if it has a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. We have analyzed this rule under that Order and have determined that it is consistent with the fundamental federalism principles and preemption requirements described in E.O. 13132.

Also, this rule does not have tribal implications under E.O. 13175, Consultation and Coordination with Indian Tribal Governments, because it does not have a substantial direct effect on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes. If you believe this rule has implications for federalism or Indian tribes, please contact the person listed in the FOR FURTHER INFORMATION CONTACT section above.

The Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1531-1538) requires Federal agencies to assess the effects of their discretionary regulatory actions. In particular, the Act addresses actions that may result in the expenditure by a State, local, or tribal government, in the aggregate, or by the private sector of $100,000,000 (adjusted for inflation) or more in any one year. Though this rule will not result in such an expenditure, we do discuss the effects of this rule elsewhere in this preamble.

We have analyzed this rule under Department of Homeland Security Management Directive 023-01 and Commandant Instruction M16475.lD, which guide the Coast Guard in complying with the National Environmental Policy Act of 1969 (42 U.S.C. 4321-4370f), and have determined that this action is one of a category of actions that do not individually or cumulatively have a significant effect on the human environment. This rule involves an emergency safety zone implemented to protect persons and vessels in the vicinity of a grounded vessel. It is categorically excluded from further review under paragraph 34(g) of Figure 2-1 of the Commandant Instruction. We seek any comments or information that may lead to the discovery of a significant environmental impact from this rule.

The Coast Guard respects the First Amendment rights of protesters. Protesters are asked to contact the person listed in the FOR FURTHER INFORMATION CONTACT section to coordinate protest activities so that your message can be received without jeopardizing the safety or security of people, places or vessels.

For the reasons discussed in the preamble, the Coast Guard amends 33 CFR part 165 as follows:

Throughout this document, the terms “we,” “us,” or “our” refer to EPA. This section provides additional information by addressing the following:

On August 14, 2015, (80 FR 48791), EPA published a notice of proposed rulemaking (NPR) for the State of Iowa. The NPR proposed approval of Iowa's submission that provides the basic elements specified in section 110(a)(2) of the CAA necessary to implement, maintain, and enforce the 2008 Pb NAAQS. The NPR also proposed approval of a supplemental revision to include article 1, section 2 of the Iowa Constitution, and portions of the Iowa Code and the Iowa Administrative Code to codify the relevant state laws as applied to conflict of interest requirements of Sections 110(a)(2)(E) and 128 of the CAA.

On November 4, 2011, EPA received a SIP submission from the state of Iowa that addressed the infrastructure elements specified in section 110(a)(2) for the 2008 Pb NAAQS. The submission addressed the following infrastructure elements of section 110(a)(2): (A), (B), (C), (D), (E), (F), (G), (H), (J), (K), (L), and (M). On May 11, 2015, EPA received a supplemental SIP submission from the state of Iowa to include article 1, section 2 of the Iowa Constitution, and portions of the Iowa code and the Iowa Administrative Code to codify the relevant state laws as applied to conflict of interest requirements of Section 128 of the CAA. The rationale for EPA's proposed action to approve the SIP submissions for specific requirements of section 110(a)(2) of the CAA, and the submission for conflict of interest provisions are explained in the NPR and will not be restated here.

During the public comment period for the NPR one comment was received. The commenter stated that EPA cannot approve the Prevention of Significant Deterioration provisions unless the Particulate Matter (PM2.5) increments have been approved in the SIP. The PM2.5 increments, found at 567 Iowa Administrative Code, Chapter 33.3(3), were approved by EPA into the Iowa SIP on March 14, 2014. 79 FR 14402.

EPA is approving Iowa's November 4, 2011, submission addressing the requirements of the CAA sections 110(a)(1) and (2) as applicable to the 2008 Pb NAAQS. Specifically, EPA approves the following infrastructure elements: 110(a)(2)(A), (B), (C), (D), (E), (F), (G), (H), (J), (K), (L), and (M) which are necessary to implement, maintain, and enforce the 2008 Pb NAAQS, as a revision to the Iowa SIP. EPA is also approving Iowa's May 11, 2015, submission to include article 1, section 2 of the Iowa Constitution, and portions of the Iowa code and the Iowa Administrative Code to codify the relevant state laws as applied to conflict of interest requirements of Sections 110(a)(2)(E) and 128 of the CAA.

In this rule, EPA is finalizing regulatory text that includes incorporation by reference. In accordance with requirements of 1 CFR 51.5, EPA is finalizing the incorporation by reference of the Iowa nonregulatory SIP provision described in the amendments to 40 CFR part 52 set forth below. EPA has made, and will continue to make, these documents generally available electronically through www.regulations.gov and/or in hard copy at the appropriate EPA office (see the ADDRESSES section of this preamble for more information).

Under the CAA the Administrator is required to approve a SIP submission that complies with the provisions of the Act and applicable Federal regulations. 42 U.S.C. 7410(k); 40 CFR 52.02(a). Thus, in reviewing SIP submissions, EPA's role is to approve state choices, provided that they meet the criteria of the CAA. Accordingly, this action merely approves state law as meeting Federal requirements and does not impose additional requirements beyond those imposed by state law. For that reason, this action:

• Is not a significant regulatory action subject to review by the Office of Management and Budget under Executive Orders 12866 (58 FR 51735, October 4, 1993) and 13563 (76 FR 3821, January 21, 2011);

• Does not impose an information collection burden under the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq.);

• Is certified as not having a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601 et seq.);

• Does not contain any unfunded mandate or significantly or uniquely affect small governments, as described in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4);

• Does not have Federalism implications as specified in Executive Order 13132 (64 FR 43255, August 10, 1999);

• Is not an economically significant regulatory action based on health or safety risks subject to Executive Order 13045 (62 FR 19885, April 23, 1997);

• Is not a significant regulatory action subject to Executive Order 13211 (66 FR 28355, May 22, 2001);

• Is not subject to requirements of Section 12(d) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note) because application of those requirements would be inconsistent with the Clean Air Act; and

• Does not provide EPA with the discretionary authority to address, as appropriate, disproportionate human health or environmental effects, using practicable and legally permissible methods, under Executive Order 12898 (59 FR 7629, February 16, 1994).

The SIP is not approved to apply on any Indian reservation land or in any other area where EPA or an Indian tribe has demonstrated that a tribe has jurisdiction. In those areas of Indian country, the rule does not have tribal implications and will not impose substantial direct costs on tribal governments or preempt tribal law as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).

The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the Small Business Regulatory Enforcement Fairness Act of 1996, generally provides that before a rule may take effect, the agency promulgating the rule must submit a rule report, which includes a copy of the rule, to each House of the Congress and to the Comptroller General of the United States. EPA will submit a report containing this action and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States prior to publication of the rule in the Federal Register. A major rule cannot take effect until 60 days after it is published in the Federal Register. This action is not a “major rule” as defined by 5 U.S.C. 804(2).

Under section 307(b)(1) of the CAA, petitions for judicial review of this action must be filed in the United States Court of Appeals for the appropriate circuit by January 4, 2016. Filing a petition for reconsideration by the Administrator of this final rule does not affect the finality of this action for the purposes of judicial review nor does it extend the time within which a petition for judicial review may be filed, and shall not postpone the effectiveness of such rule or action. This action may not be challenged later in proceedings to enforce its requirements. (See section 307(b)(2)).

For the reasons stated in the preamble, EPA amends 40 CFR part 52 as set forth below:

Chapter I, title 40 of the Code of Federal Regulations is amended as follows:

This is a summary of the Commission's First Order on Reconsideration, FCC 15-67, adopted on June 11, 2015 and released on June 12, 2015. The full text of this document is available for public inspection and copying during regular business hours in the FCC Reference Center, Federal Communications Commission, 445 12th Street SW., Room CY-A257, Washington, DC 20554. The complete text may be purchased from the Commission's copy contractor, 445 12th Street SW., Room CY-B402, Washington, DC 20554. This document will also be available via ECFS at http://fjallfoss.fcc.gov/ecfs/. Documents will be available electronically in ASCII, Microsoft Word, and/or Adobe Acrobat. Alternative formats are available for people with disabilities (Braille, large print, electronic files, audio format) by sending an email to [email protected] or calling the Commission's Consumer and Governmental Affairs Bureau at (202) 418-0530 (voice), (202) 418-0432 (TTY).

The First Order on Reconsideration contains new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (“PRA”), Public Law 104-13. It will be submitted to the Office of Management and Budget (“OMB”) for review under section 3507(d) of the PRA. The Commission, as part of its continuing effort to reduce paperwork burdens, will invite the general public to comment on the information collection requirements contained in this First Order on Reconsideration as required by the PRA in a separate published Federal Register notice.

In addition, the Commission notes that pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4), we previously sought specific comment on how the Commission might further reduce the information collection burden for small business concerns with fewer than 25 employees. We have assessed the effects of the policies adopted in this First Order on Reconsideration with regard to information collection burdens on small business concerns, and find that these policies will benefit many companies with fewer than 25 employees by providing them with options for voluntarily relinquishing broadcast spectrum usage rights and by streamlining the pre-auction application process. In addition, we have described impacts that might affect small businesses, which includes most businesses with fewer than 25 employees, in the Supplemental FRFA.

1. Broadcasters will have the unique financial opportunity in the broadcast television spectrum incentive auction to voluntarily return some or all of their licensed spectrum usage rights in exchange for incentive payments. One of broadcasters' bid options will be to relinquish rights in order to share a channel with another licensee. The Commission established rules governing channel sharing agreements (“CSAs”) in the Incentive Auction Report & Order, 79 FR 48442 (August 15, 2014) (“IA R&O”) and the preceding Channel Sharing Report & Order, 77 FR 30423 (May 23, 2012) (“Channel Sharing R&O”). In this First Order on Reconsideration, we refine those rules to provide greater flexibility and certainty regarding CSAs. Among other things, we modify our rules to allow broadcasters that relinquish rights in the incentive auction in order to channel share to enter into CSAs after the auction and, whether they enter into CSAs before or after the auction, to determine the length of their agreements. In the companion Notice of Proposed Rulemaking (“NPRM”), 80 FR 40957, July 14, 2015, we tentatively conclude that we should authorize channel sharing by full power and Class A stations outside the incentive auction context, including “second generation” agreements in which one or both entities were parties to an auction-related CSA whose term has expired or that has otherwise been terminated. By providing greater flexibility and certainty regarding CSAs, our objective is to encourage voluntary participation by broadcasters in the incentive auction.

2. Congress authorized the Commission to conduct the incentive auction to help meet the Nation's growing spectrum needs. Section 1452(a)(2) of the Spectrum Act provides for three bid options that will be available to eligible full power and Class A broadcast television licensees in the auction, including relinquishment of “usage rights in order to share a television channel with another licensee” (“channel sharing bid”). Section 1452(a)(4) provides that a licensee that voluntarily relinquishes usage rights in order to channel share and that possessed carriage rights on November 30, 2010 “shall have, at its shared location, the carriage rights . . . that would apply to such station at such location if it were not sharing a channel.” In the Channel Sharing R&O, the Commission established rules authorizing channel sharing in connection with the incentive auction.

3. The Commission addressed a variety of further issues related to channel sharing in the IA R&O. The Commission concluded that applicants that participate in the auction in order to share a channel must provide information concerning their Channel Sharing Agreements (“CSAs”) prior to the auction, as part of their pre-auction applications, and must submit a copy of the executed CSA with their applications. With respect to licensing, the Commission determined that, following the auction, a licensee that enters into a CSA as the result of a winning reverse auction bid will be issued a new license indicating the station's “shared” status and specifying the station's designated shared operating frequency. The Commission also decided that shared channels will be designated permanently as shared in the Table of Allotments, absent a future rulemaking proceeding to redesignate the channel for non-shared use.

4. The Expanding Opportunities for Broadcasters Coalition (“EOBC”) filed a Petition for Reconsideration of our channel sharing decisions in the IA R&O, urging the Commission to “(1) clarify that parties to broadcast CSAs are free to negotiate for common contractual rights; (2) permit broadcasters to enter into CSAs either before or after the incentive auction; (3) ensure that parties to CSAs have the flexibility to choose whether those agreements are permanent or for a fixed term; and (4) clarify that the Commission will never force a broadcaster to accept a channel sharing partner.”

5. The National Cable & Telecommunications Association (“NCTA”) filed an opposition arguing that extending carriage rights to broadcasters that enter into post-auction CSAs would contravene the Spectrum Act. NCTA argues that this would cause uncertainty in the post-auction broadcaster transition process; confer greater cable carriage rights than Congress intended; lead to customer confusion; and might leave MVPDs unreimbursed. CTIA supports all of EOBC's requests, as do Fox, Ion Media, Tribune, and Univision.

6. We grant the EOBC Petition, with the exceptions noted below. In addition to addressing each of EOBC's above-stated requests for reconsideration below, we modify and clarify the pre- and post-auction CSA filing requirements that apply before and after the auction and address the scope of CSA review by Commission staff.

7. In the IA R&O, we noted that channel sharing agreements for contingent rights must not violate the reversionary interest rule, which precludes a seller from retaining an interest in the license it sells, and prohibits a licensee from granting a third party an automatic reversionary interest, such as a security interest, in its license.

8. EOBC asks the Commission to clarify that the act of entering into a CSA, in and of itself, does not trigger the reversionary interest rule and that parties to CSAs may bargain for common contractual rights consistent with existing Commission rules and policies. We received no opposition to EOBC's request. In its “Opposition and Reply,” CTIA joins and supports all of EOBC's reconsideration requests regarding channel sharing. Fox, Ion Media, Tribune, and Univision, who filed a reply comment in response to the Incentive Auction Comment PN, agree with this position.

9. We grant EOBC's request. We clarify that parties to a CSA may grant each other options, puts, calls, rights of first refusal, and other common contingent interests, subject to all applicable Commission rules and policies, including the media ownership rules, without committing a per se violation of the reversionary interest rule. The reversionary interest rule does not necessarily apply to a CSA, because a CSA does not involve the transfer of a license from one sharing partner to another. In addition, CSA provisions for contingent interests in the licenses involved in a CSA would not violate the reversionary interest rule absent grant of a prohibited security interest. We recognize that contracting for these common contingent rights will enable sharing parties to eliminate some of the uncertainty regarding the identity of their sharing partners in the event that one sharing party decides to sell its license. Moreover, we share EOBC's concern that, without the ability to bargain for these rights, broadcasters may not avail themselves of this bid option in the auction.

10. Under the rules adopted in the IA R&O, a reverse auction bidder interested in channel sharing must submit an executed copy of the CSA with its pre-auction application, as well as certifications under penalty of perjury that it can meet its community of license requirements from the proposed sharer's site (or that it has identified a new community of license that meets the same, or a higher, allotment priority as its current community; or the next highest priority if no community meets the same or higher priority); that the CSA is consistent with all relevant Commission rules and policies; and that the applicant accepts any risk that the implementation of the CSA may not be feasible for any reason.

11. EOBC requests that the Commission modify its rules to allow a winning license relinquishment bidder to execute a CSA after bidding in the auction is complete. Fox, Ion Media, Tribune, and Univision, who filed a reply comment in response to the Incentive Auction Comment PN, agree with this position. EOBC argues that the carriage rights of parties to such post-auction CSAs would be protected under the Spectrum Act. CTIA agrees. NCTA, however, asserts that grant of EOBC's request would (1) introduce additional uncertainty into the post-auction transition process; (2) confer greater cable carriage rights than Congress intended; (3) lead to customer confusion; and (4) risk leaving cable operators unreimbursed for mandatory carriage of sharee stations.

12. We grant EOBC's request, subject to the conditions set forth herein. Specifically, we modify our rules to allow winning bidders that relinquish their spectrum usage rights to enter into CSAs after the completion of the incentive auction, provided that they (1) indicate in their pre-auction applications that they have a present intent to find a channel sharing partner after the auction, and (2) execute and implement their CSAs by the date on which they would otherwise be required to relinquish their licenses. Parties to post-auction CSAs will be entitled to the same carriage rights as parties to pre-auction CSAs. We emphasize, however, that the exception to the rule prohibiting certain communications before and during the incentive auction will apply only to parties to pre-auction CSAs.

13. Subject to these conditions, we agree with EOBC that pre- and post-auction CSAs are the same for purposes of the Spectrum Act. We also agree with EOBC that providing this flexibility will encourage broadcasters to consider the channel sharing bid option by enabling them to participate in the auction even if they do not find a channel sharing partner before the auction begins. Indeed, as EOBC notes, parties may be able to negotiate CSAs more readily after the auction is complete, when fewer variables remain unknown. This action also may help to preserve independent voices by enabling licensees to continue broadcasting after they voluntarily relinquish rights in the incentive auction. As stated above, broadcasters that do not submit executed CSAs with their pre-auction applications will be ineligible for the exception to the prohibited communications rule. Accordingly, there will be no need for the staff to review a CSA prior to the auction to verify that the applicant qualifies for the exception.

14. In order to enter into a post-auction CSA, we will require that a license relinquishment bidder indicate in its pre-auction application its present intent to find a channel sharing partner after the auction. As we noted in the Channel Sharing R&O, “the Spectrum Act does not set a date restriction on the execution of channel sharing arrangements.” It guarantees carriage rights, however, only for “a licensee that voluntarily relinquishes rights in order to channel share.” To fall within the scope of this guarantee, we conclude that a licensee availing itself of the flexibility we provide here must express a present intent to channel share in its pre-auction application. We recognize that a successful bidder's interest in a post-auction CSA may depend on the outcome of the auction, and that its ability to execute a CSA with a sharing partner will not be entirely within its control. A successful bidder's expression of present intent, therefore, will not bind it to seek out a channel sharing partner or enter into a post-auction CSA.

15. In addition, post-auction CSAs must be executed and implemented (i.e., operations commenced on the shared channel) by the date on which the channel sharee otherwise would be required to relinquish its license. Pursuant to the IA R&O, a winning license relinquishment bidder must cease operations within three months after receiving its share of auction proceeds. We conclude that a post-auction CSA must be executed and implemented by the license relinquishment deadline. In this regard, we disagree with EOBC that licensees should have up to twelve months after that relinquishment deadline to enter into a CSA. EOBC's reliance on section 312(g) of the Communications Act, which provides that a broadcast license automatically expires if the station fails to broadcast for a consecutive 12-month period, is misplaced: A broadcaster holds a license during the statutory 12-month period, whereas a winning license relinquishment bidder will no longer hold a license after the license relinquishment deadline.

16. This requirement addresses NCTA's concern that allowing auction participants to enter into post-auction CSAs would introduce additional uncertainty into the post-auction transition process. As NCTA notes, “[u]nder the current rules, sharing stations must notify the Commission of their intent to share prior to the auction and must file their application for license for the shared channel within three months after receiving auction proceeds.” Under our ruling here, sharee stations likewise will have to execute and implement their post-auction CSAs by the time they have to relinquish their licenses, and thus they will be on the same notification timeline as those stations that entered into pre-auction CSAs. We believe that this timeframe also will provide adequate time for parties to post-auction CSAs to comply with the consumer and MVPD notice requirements laid out in the IA R&O.

17. Finally, we find that the reimbursement process set out in the IA R&O, coupled with the requirements we adopt herein, will enable MVPDs to obtain reimbursement for their reasonable costs associated with mandatory carriage of stations that enter into post-auction CSAs. NCTA argues that, if CSAs are not “in sync” with the deadline for submitting reimbursement estimates, MVPDs might not have notice of a carriage obligation by the deadline, impacting their ability to recover reasonable expenses related to carrying the sharee stations from their new locations. We direct the Media Bureau, in the Channel Reassignment PN to be released following the completion of the incentive auction, to identify those winning bidders that are eligible to channel share, either because they submitted an executed pre-auction CSA or expressed a present intent to enter into a post-auction CSA. Accordingly, the Channel Reassignment PN will provide MVPDs with notice of the identity of successful bidders who have executed pre-auction CSAs, as well as those who may enter post-auction CSAs, prior to the deadline for submitting estimated reimbursement costs, enabling MVPDs to account for these potential costs in their initial cost estimates. In addition, if necessary, MVPDs may update their estimates after the initial three-month deadline if necessary in order to account for post-auction CSAs.

18. Under the rules adopted in the IA R&O, CSAs are permanent in nature: CSAs may be amended, and rights under a CSA may be assigned or transferred subject to Commission approval, but “shared channels permanently will be designated as shared in the Table of Allotments, absent a future rulemaking proceeding to redesignate the channel for non-shared use,” and “CSAs may not contain any provision that would seek to dissolve or modify the shared nature of the channel[.]” EOBC argues that we should “permit broadcasters to choose the length of their agreements.” “Once an agreement is terminated,” suggests EOBC, “the host or sharer station could either find another channel sharing partner or notify the agency that it is no longer a shared station and that its license should be modified accordingly. The host station would then have the right to utilize the full capacity of its 6 MHz channel. The sharee station(s), meanwhile, could either relinquish their licenses or find a new partner, subject to the one-year time limit to resume transmissions under section 312(g) of the Communications Act.” CTIA supports this approach, as do Fox, Ion Media, Tribune, and Univision. EOBC further argues that we should authorize “second generation” CSAs subject to the same rights and restrictions as CSAs entered into in connection with the incentive auction.

19. We modify our rules to provide flexibility for broadcasters to determine the length of their CSAs. Specifically, we will permit broadcasters to choose the length of their channel sharing agreements. We agree that allowing term-limited CSAs will encourage channel sharing bids in the incentive auction by allowing parties to end the channel sharing relationship if they choose while still having the opportunity to continue operating. We also agree with EOBC that providing such flexibility is appropriate to meet broadcasters' individualized programming and economic needs. Consistent with our decision, as discussed below, we will not permanently designate channels as “shared” in the Table of Allotments. Instead, a channel's shared status will be indicated on a sharing station's license.

20. However, our decision to allow term-limited CSAs raises the question of whether to authorize CSAs by full power and Class A stations outside the incentive auction context. In the companion Notice of Proposed Rulemaking, we tentatively conclude that we should allow future CSAs outside the incentive auction context, and we invite comment on issues attendant to that proposal.

21. Under the rules adopted in the IA R&O, if a channel sharing station's license is terminated due to voluntary relinquishment, revocation, failure to renew, or any other circumstance, the remaining channel sharing station or stations will continue to have rights to their portion(s) of the shared channel, and the rights to the terminated portion of the shared channel will revert to the Commission for reassignment. The Commission further stated that shared channels “permanently will be designated as shared in the Table of Allotments, absent a future rulemaking proceeding to redesignate the channel for non-shared use.”

22. EOBC argues that “[e]ven the possibility that the FCC could appoint a successor sharing partner will be troublesome to most broadcasters considering the channel sharing option.” Instead, EOBC argues that channel sharing parties should have “the option to reclaim the spectrum rights (but not the licenses) previously held by the departing party . . . Thus, if a sharee station relinquishes its spectrum, the host station could either find a new channel sharing partner . . . or resume use of the full six megahertz channel. If the host station relinquishes its spectrum, meanwhile, the sharee station(s) would have the option to assume the previously shared channel, subject to the technical parameters of the existing allotment.” CTIA agrees that, if a sharing station relinquishes its license, then the right to use the relinquished portion of the shared spectrum should return to the remaining sharing partner(s). Similarly, Fox, Ion Media, Tribute, and Univision agree that “upon expiration or termination of a CSA sharing stations should have the flexibility either to utilize the full capacity of their shared channel or to enter into a channel sharing arrangement with a new partner (or partners).” No parties opposed this request.

23. We grant EOBC's request, and modify our rules to allow parties to develop CSA terms that address what happens in the event that a sharing party's license is terminated for any reason, rather than providing that the terminated spectrum usage rights revert to the Commission for reassignment. Our decisions here do not affect the right of a channel sharing party to assign or transfer its license consistent with the IA R&O.

24. We agree with EOBC that, as business partners, channel sharers should “have the ability to choose partners that satisfy their own criteria.” The Commission will not select a sharing partner. To accommodate this flexibility, we will not permanently designate channels as “shared” in the Table of Allotments, and a channel's shared status will be indicated on the station license. In the event that a sharing partner relinquishes its license, its spectrum usage rights (but not its license) may revert to the remaining sharing partners if the partners so agree. Where only one sharing partner remains, it may apply to change its license to non-shared status using FCC Form 2100 Schedule B (formerly FCC Form 302) or F (formerly FCC Form 302-CA). If a full power station that is sharing with a Class A station relinquishes its license, then the Class A station would continue to operate under the rules governing Class A stations.

25. In order to provide additional certainty to broadcasters interested in the channel sharing bid option, and in light of our decision to allow post-auction CSAs, we modify and clarify our procedures for submission and review of both pre-auction and post-auction CSAs. At the outset, we emphasize that we will not question parties' business judgment in drafting CSAs.

26. If a licensee submits an executed CSA before the auction along with its auction application, we will accept for purposes of determining eligibility to participate the applicant's certification that the CSA complies with our channel sharing operating rules. We will not review the CSA itself at the pre-auction stage for compliance with our operating rules. We will review the CSA at the pre-auction stage solely to confirm that the parties qualify for the channel sharing exception to the rule prohibiting certain communication adopted in the IA R&O.

27. Post-auction, we will review CSAs submitted before or after the auction by successful bidders to determine whether the CSAs meet the requirements the Commission has adopted to ensure compliance with our CSA operating rules and policies. Although in the IA R&O we reserved the right to review the CSA and require modification of any CSAs that do not comply with our CSA operating rules and policies, we clarify that such review will occur after the auction. To allow time for such review, we modify our rules to require that, at least 60 days prior to the date by which it must implement the CSA, the channel sharee file a minor change application for a construction permit specifying the same technical facilities as the sharer station, and include a copy of the CSA with its application. This requirement will be the same regardless of whether the parties execute their CSA before or after the auction. Following grant of the construction permit and initiation of shared operations, both the sharee and sharer must file a license application. We emphasize again that the Commission does not involve itself in private contractual agreements, and we do not intend during our review of the CSA to substitute our judgment for that of the parties with respect to the terms of the agreement. Thus, we will limit our post-auction review to confirming that the CSA contains the required provisions and that any terms beyond those related to sharing of bitstream and related technical facilities comport with our general rules and policies regarding licensee agreements. We also reiterate that any application for a construction permit or modified license filed in accordance with the requirements established here or in the IA R&O will not trigger the filing of competing applications.

28. Under the rules adopted in the IA R&O, all parties to a CSA submitted with a reverse auction application may communicate with each other about their bids and bidding strategies. The Commission adopted this exception to the rule generally prohibiting such communications in order to encourage channel sharing relationships, allowing potential channel sharers to fully engage as various options are presented during the auction process. In light of the risk of agreements to reduce competition in response to auction conditions, however, the exception is limited to CSAs executed prior to the reverse auction application filing deadline and submitted with the reverse auction application. We note that a CSA may have more than two parties (if, for instance, three stations propose to share the same channel), and all parties to a pre-auction CSA may communicate during the auction. Commenters have proposed that we also allow stations to enter into multiple contingent CSAs. We will address this issue in a forthcoming decision.

29. As required by the Regulatory Flexibility Act of 1980, as amended (“RFA”), an Initial Regulatory Flexibility Analysis (“IRFA”) was incorporated in the Notice of Proposed Rule Making (“Notice”). The Commission sought written public comment on the proposals in the Notice, including comment on the IRFA. The Commission subsequently incorporated a Final Regulatory Flexibility Analysis (“FRFA”) in the Report and Order. This Supplemental FRFA conforms to the RFA and incorporates by reference the FRFA in the IA R&O. It reflects changes to the Commission's rules arising from the First Order on Reconsideration prepared in response to the Petition for Reconsideration filed by the Expanding Opportunities for Broadcasters Coalition (“EOBC”).

30. This First Order on Reconsideration affirms the Commission's commitment to making the channel sharing reverse auction bid option attractive to television broadcasters. In the Channel Sharing R&O, the Commission established rules authorizing channel sharing in connection with the incentive auction. The Commission addressed a variety of further issues related to channel sharing in the IA R&O in order to complete the framework for incentive auction-related channel sharing. In this First Order on Reconsideration, the Commission generally grants the EOBC Petition, finding that modifying its original determination will increase broadcasters' flexibility to use the channel sharing bid option, will make the option more attractive and will provide an improved ability of the Commission to monitor compliance of CSAs with our rules.

31. Specifically, in the First Order on Reconsideration, the Commission grants in part the EOBC petition for reconsideration by: Clarifying that the reversionary interest rule does not apply to CSAs; allowing parties the flexibility to enter into term-limited CSAs and to execute a CSAs post-auction; and modifying the rules to allow the spectrum usage rights of a sharing party whose license is terminated to revert to the remaining sharing parties rather than having the rights revert to the Commission for reassignment. The Order also clarifies that at the pre- auction stage Commission staff will only review CSAs to determine whether the bidder qualifies for the anti-collusion rule exception. To allow review for compliance with Commission rules, the Order requires that a channel sharee file a construction permit application, including a copy of the CSA, after the auction. Most notably, the flexibility granted herein will make it easier for entities such as small businesses and non-commercial education stations to avail themselves of the opportunity to channel share as part of the incentive auction.

32. No commenters directly responded to the IRFA in the Notice. Because a number of commenters raised concerns about the impact on small businesses of various auction design issues, the FRFA in the IA R&O addressed those concerns. The EOBC Petition addressed herein, and associated pleadings, did not raise any concerns with the FRFA.

33. Pursuant to the Small Business Jobs Act of 2010, the Commission is required to respond to any comments filed by the Chief Counsel for Advocacy of the Small Business Administration (SBA), and to provide a detailed statement of any change made to the proposed rules as a result of those comments. The Chief Counsel did not file any comments in response to the rules adopted in this proceeding.

34. The RFA directs the Commission to provide a description of and, where feasible, an estimate of the number of small entities that will be affected by the adopted rules, if adopted. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” small organization,” and “small government jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. A small business concern is one which: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA.

35. As noted, we incorporated a FRFA into the IA R&O. In that analysis, the Commission described in detail the various small business entities that may be affected by the final rules, including television broadcast entities. This First Order on Reconsideration amends the final rules adopted in the IA R&O affecting television broadcasting. This Supplemental FRFA incorporates by reference the description and estimate of the number of television broadcasting small entities from the IRFA in the Notice of Proposed Rulemaking accompanying this First Order on Reconsideration.

36. In section D of the FRFA incorporated into the IA R&O, the Commission described in detail the projected recording, recordkeeping, reporting and other compliance requirements for small entities arising from the rules adopted in the IA R&O. This Supplemental FRFA incorporates by reference the requirements described in section D of the FRFA. In this First Order on Reconsideration, however, the Commission adds and modifies rules adopted in the IA R&O. It adds the requirement that in order to take advantage of the flexibility adopted in this First Order on Reconsideration to enter into a channel sharing agreement post-auction, a license relinquishment bidder must indicate its intent to enter a post auction channel sharing agreement on its pre-auction application. The First Order on Reconsideration also requires channel sharee stations to file an application for construction permit, including a copy of the executed channel sharing agreement. Commercial stations must pay the fee associated with this filing. (Non-commercial entities are fee exempt.) In addition, it require CSAs to include a provision regarding the reversion of spectrum usage rights to remaining channel sharing partners in the event that one party has its license terminated. Finally, to take advantage of the new rule allowing the last remaining licensee to a channel sharing agreement to have its license revert to non-shared status, that last remaining licensee must file a license application requesting this reversion.

37. The RFA requires an agency to describe any significant alternatives that it has considered in developing its approach, which may include the following four alternatives (among others): “(1) The establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance and reporting requirements under the rule for such small entities; (3) the use of performance rather than design standards; and (4) an exemption from coverage of the rule, or any part thereof, for such small entities.”

38. The reporting, recordkeeping, and other compliance requirements resulting from the First Order on Reconsideration will apply to all entities in the same manner. The Commission believes that applying the same rules equally to all entities in this context promotes fairness. The Commission does not believe that the costs and/or administrative burdens associated with the rules, including the payment of a construction permit filing fee by commercial broadcasters who are reverse auction winners and who will channel share, will unduly burden small entities. (Non-commercial broadcasters are exempt from such filing fees.) The construction permit itself will contain the same information included in the construction permit and license information of the channel sharer station and therefore can be copied without additional engineering work. The submission of the executed channel sharing agreement does not add cost as the rules already require execution of a channel sharing agreement between sharing parties.

39. While these new rules require additional filings for those reverse auction winning bidders that channel share, they give bidders, including broadcast television entities meeting the definition of small businesses, the increased flexibility to enter into post auction CSAs, to limit the term of their CSAs rather than make them permanent, and to request reversion of spectrum usage rights in the event of the termination of the license of a broadcaster with whom they share spectrum. Lastly, the requirement that a channel sharee file a construction permit including a copy of the channel sharing agreement will streamline the pre-auction application process.

40. None.

41. The Commission will send a copy of this First Order on Reconsideration in a report to be sent to Congress and the Government Accountability Office pursuant to the Congressional Review Act, see 5 U.S.C. 801(a)(1)(A).

42. The Commission will send a copy of this First Order on Reconsideration, including this Supplemental FRFA, to the Chief Counsel for Advocacy of the Small Business Administration.

43. This document contains new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (“PRA”), Public Law 104-13. It will be submitted to the Office of Management and Budget (“OMB”) for review under section 3507(d) of the PRA. OMB, the general public, and other Federal agencies will be invited to comment on the new or modified information collection requirements contained in this proceeding in a separate published Federal Register notice. In addition, we note that pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4), we previously sought specific comment on how the Commission might further reduce the information collection burden for small business concerns with fewer than 25 employees.

44. We have assessed the effects of the policies adopted in this First Order on Reconsideration with regard to information collection burdens on small business concerns, and find that these policies will benefit many companies with fewer than 25 employees by providing them with options for voluntarily relinquishing broadcast spectrum usage rights and by streamlining the pre-auction application process. In addition, we have described impacts that might affect small businesses, which includes most businesses with fewer than 25 employees, in the Supplemental FRFA in Appendix B.

45. Accordingly, IT IS ORDERED that, pursuant to the authority contained in sections 1, 4, 301, 303, 307, 308, 309, 310, 316, 319, and 405 of the Communications Act of 1934, as amended, and sections 6402 and 6403 of Middle Class Tax Relief and Job Creation Act of 2012, Pub. L. 112-96, 126 Stat. 156, 47 U.S.C. 151, 154, 301, 303, 307, 308, 309, 310, 316, 319, 405, 1404, and 1452, this FIRST ORDER ON RECONSIDERATION is ADOPTED and parts 1 and 73 of Commission's rules are AMENDED as set forth in the Appendix A of the First Order on Reconsideration.

46. IT IS FURTHER ORDERED that the rules adopted herein will become effective December 2, 2015, except for sections 1.2204(c)(4) and 73.3700(b)(1), which contain new or modified information collection requirements that require approval by the OMB under the PRA and WILL BECOME EFFECTIVE after the Commission publishes a notice in the Federal Register announcing such approval and the relevant effective date.

47. IT IS FURTHER ORDERED that, that pursuant to sections 4(i), and 405 of the Communications Act of 1934, as amended, 47 U.S.C. 154(i) and 405, and section 1.429 of the Commission's rules, 47 CFR 1.429, the Petition for Reconsideration filed by the Expanding Opportunities for Broadcasters Coalition IS HEREBY GRANTED IN PART AND IS OTHERWISE DISMISSED AS MOOT.

48. IT IS FURTHER ORDERED that the Commission's Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of this First Order on Reconsideration, including the Supplemental Final Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration.

49. IT IS FURTHER ORDERED that the Commission SHALL SEND a copy of this First Order on Reconsideration in a report to be sent to Congress and the Government Accountability Office pursuant to the Congressional Review Act, see 5 U.S.C. 801(a)(1)(A).

For the reasons discussed in the preamble, the Federal Communications Commission amends Parts 1 and 73 of Title 47 of the Code of Federal Regulations as follows:

This is a summary of the Commission's Second Order on Reconsideration, FCC 15-139, adopted October 21, 2015, in MB Docket No. 15-137. The full text of the Second Order on Reconsideration is available for inspection and copying during regular business hours in the FCC Reference Center, 445 12th Street SW., Room CY-A257, Portals II, Washington, DC 20554. This document is available in alternative formats (computer diskette, large print, audio record, and Braille). Persons with disabilities who need documents in these formats may contact the FCC by email: [email protected] or phone: 202-418-0530 or TTY: 202-418-0432.

Paperwork Reduction Act of 1995 Analysis: This Second Order on Reconsideration does not contain any additional new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (“PRA”), Public Law 104-13, beyond those that were already in the Commission's Incentive Auction Report and Order, 79 FR 48442-01 (Aug. 15, 2014) (“Incentive Auction R&O”). In addition, therefore, it does not contain any additional new or modified information collection burden for small business concerns with fewer than 25 employees, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, beyond those that were already in the Incentive Auction R&O.

The Commission is seeking separate OMB approval for FCC Form 2100, Schedule B (for a full power station) and F (for a Class A station) and FCC Form 177.

1. The Commission adopted rules for the broadcast incentive auction in the Incentive Auction R&O including rules for parties interested in entering into CSAs. The Commission recently modified those channel sharing rules to provide greater flexibility to stations considering that option. In this Second Order on Reconsideration, the Commission announces that the availability of back-up channel sharing arrangements would provide additional flexibility for stations considering channel sharing. In particular, it would enable both parties to a CSA to participate in the auction while mitigating the risk that the auction system could freeze both stations in the same round and thus deprive both stations of a post-auction host or “sharer” station. For some, the risk of being left without any spectrum on which to share may be too great and foreclose that kind of participation. The Commission concludes that a back-up CSA could mitigate that risk and encourage greater participation.

2. The Commission clarifies that, if both parties to a CSA participate in the auction, the rules allow either or both parties to also enter into a back-up CSA with one other station in the same DMA to act as the back-up host or sharer station. By allowing the parties to secure a fallback arrangement in the event that both parties relinquish their spectrum usage rights in the auction, this clarification will help promote wider participation in the auction by broadcasters that require assurance that they will remain on the air in the DMA. The Commission reminds parties that all of their auction-related activity and communications, including with respect to back-up CSAs, must adhere to the antitrust laws as well as the rules.

3. In the Second Order on Reconsideration, the Commission rejects the Broadcaster Representatives' request to allow “contingent multi-party CSAs across multiple markets.” The Commission concludes that multi-market back-up CSAs are not necessary to address the uncertainty created if multiple parties to a particular CSA participate in the auction. Such a result would undermine the general goal of the rules prohibiting certain communications, which are intended to reinforce existing antitrust laws, facilitate the detection of collusive conduct, and assure incentive auction participants that the auction process will be fair and objective. The Commission restated that it crafted the CSA exception to apply on an agreement-by-agreement basis in order to encourage channel sharing relationships without undermining these objectives.

4. The Commission also clarifies that, consistent with the foregoing, the CSA exception to the reverse auction rule prohibiting certain communications applies only to communications between parties to a single CSA at any given time. Further, the CSA exception only applies to a CSA, including back-up CSAs, if the CSA was entered into and filed with the Commission by the application deadline. If both stations pursuant to the primary CSA have a bidding status of “frozen—provisional winner,” i.e., the auction system determines that the station can never be assigned a feasible channel in its pre-auction band in the current stage, then parties to a back-up CSA may communicate regarding bids and bidding strategy and must cease communication of this type with the party to the original CSA. Prior to that point, the rationale for the CSA exception—that parties to a CSA should be able to “fully engage as various options are presented during the auction process”—is inapplicable with respect to the back-up CSA. Once the relinquishment bid of the prospective host of the CSA is provisionally accepted by the auction system in a given stage of the auction, the CSA exception may be utilized for otherwise prohibited communications involving the parties to the back-up agreement, and can no longer be utilized for parties to the primary agreement in that stage.

5. The Commission notes that under the reverse auction bidding procedures, the bidding status of a “frozen—provisional winner” may change to “bidding in the current round” if the auction enters a subsequent stage. Accordingly, if the host in the primary CSA, which was no longer operative because its bidding status became “frozen—provisional winner” in the previous stage, is designated as “bidding in the current round” in a subsequent stage of the auction, and that CSA expressly provides that it becomes the operative sharing agreement under such circumstances, the host may notify the sharee in the primary CSA of that change in status and the CSA exception will again apply to communications between the parties to the primary agreement rather than with the back-up host.

6. The Commission also finds that the attractiveness of the channel sharing option would be enhanced if sharees were given additional time to plan and execute their transition to the host's facilities. Currently, the rules require that all winning go off-air bidders in the reverse auction, including winning channel sharees, must terminate operations on their pre-auction channels within three months of when they receive auction proceeds. While three months for termination of operations is sufficient for go off-air winners who intend to relinquish their licenses and cease broadcasting altogether, the Commission recognizes that winning bidders that plan to share a channel will remain in operation and may therefore need more time to implement the move to the sharer's facility. For instance, a channel sharee may need time to deal with technical issues associated with transitioning to its shared location. If it is changing its community of license, it may also need to negotiate modifications to carriage agreements or finalize new must-carry arrangements with multichannel video programming distributors.

7. For these reasons, the Commission modifies section 73.3700(b)(4)(ii) of the rules to extend the amount of time a sharee in a pre- or post-auction CSA will have to relinquish its pre-auction channel to six months after receipt of its reverse auction proceeds. As the Commission decided in the Incentive Auction R&O, winning channel sharing bidders may request a waiver of up to an additional three months to cease operations on their pre-auction channel, pursuant to section 1.3 of the rules, and the Commission will view these requests most favorably. Further, winning channel sharing bidders may request an additional three-months, and the Commission will view the additional requests favorably as well so long as it determines that grant of the extension will not delay the post-auction transition. The Commission finds that this extension of the transition period to six months, and the availability of waivers of up to an additional six months, is unlikely to adversely affect the Commission's post-auction transition timeline.

The Regulatory Flexibility Act of 1980, as amended (RFA), requires that a regulatory flexibility analysis be prepared for notice-and-comment rule making proceedings, unless the agency certifies that “the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities.” The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. A “small business concern” is one which: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the U.S. Small Business Administration (SBA).

In 2012, Congress mandated that the Commission conduct an incentive auction of broadcast television spectrum as set forth in the Middle Class Tax Relief and Job Creation Act of 2012 (“Spectrum Act”). The incentive auction will have three major pieces: (1) A “reverse auction” in which full power and Class A broadcast television licensees submit bids to voluntarily relinquish certain broadcast rights in exchange for payments; (2) a reorganization or “repacking” of the broadcast television bands in order to free up a portion of the ultra-high frequency (“UHF”) band for other uses; and (3) a “forward auction” of licenses for flexible use of the newly available spectrum. In the Incentive Auction R&O, the Commission adopted rules to implement the broadcast television spectrum incentive auction. Among other things, the Commission adopted rules for broadcast stations that choose to channel share. Pursuant to the RFA, a Final Regulatory Flexibility Analysis (“FRFA”) was incorporated into the Incentive Auction R&O.

This Second Order on Reconsideration reflects clarifications and modifications to the Commission's rules arising in response to comments filed by Fox, ION, Tribune, and Univision (the “Broadcaster Representatives”). The Commission generally responds favorably to the Broadcaster Representatives' requests, finding that providing these clarifications will increase broadcasters' flexibility to use the channel sharing bid option and will make the option more attractive. Specifically, this Second Order on Reconsideration clarifies the Commission's rules to permit broadcasters to enter into back-up channel sharing agreements (“CSAs”) with an additional partner to mitigate the risk that stations that intend to channel share could be left without spectrum after the auction, if both partners receive a status of “frozen-provisionally winning” in the same round of the reverse auction. The Commission also clarified that the CSA exception to the general prohibition on communications regarding bids and bidding strategy will apply to that back-up CSA, so long as the back-up CSA was filed before the application deadline, is the requirement for all CSAs. This Second Order on Reconsideration also permits back-up agreements based on price or other contingencies, but declines to extend the CSA exception to them as introducing unacceptable risk of becoming a vehicle for collusion. Finally, this Second Order on Reconsideration extends the transition period for channel sharing winning bidders from three months to six months, and extends the possibility for additional waivers from three months to six months, barring any delay this would cause other transitioning broadcasters.

Neither of these changes adopted in this Second Order on Reconsideration will impose additional costs. The changes provide greater flexibility for both stations that wish to pursue channel sharing agreements pre-auction and those that become channel sharing stations post-auction. Therefore, the Commission certifies that the changes adopted in this Second Order on Reconsideration will not have a significant economic impact on a substantial number of small entities.

The Commission will send a copy of the Second Order on Reconsideration, including a copy of this Final Regulatory Flexibility Certification, in a report to Congress pursuant to the Congressional Review Act. In addition, the Second Order on Reconsideration and this certification will be sent to the Chief Counsel for Advocacy of the Small Business Administration, and will be published in the Federal Register.

None.

For the reasons discussed in the preamble, the Federal Communications Commission amends 47 CFR part 73 as follows:

NMFS manages the groundfish fishery in the GOA exclusive economic zone according to the Fishery Management Plan for Groundfish of the Gulf of Alaska (FMP) prepared by the North Pacific Fishery Management Council (Council) under authority of the Magnuson-Stevens Fishery Conservation and Management Act. Regulations governing fishing by U.S. vessels in accordance with the FMP appear at subpart H of 50 CFR part 600 and 50 CFR part 679.

The annual pollock TACs in Statistical Areas 610, 620, and 630 of the GOA are apportioned among four seasons, in accordance with § 679.23(d)(2). Regulations at § 679.20(a)(5)(iv)(B) allow the underharvest of a seasonal apportionment to be added to subsequent seasonal apportionments, provided that any revised seasonal apportionment does not exceed 20 percent of the seasonal apportionment for a given statistical area. Therefore, NMFS is increasing the D season apportionment of pollock in Statistical Areas 610, 620, and 630 of the GOA to reflect the underharvest of pollock in those areas during the C season. In addition, any underharvest remaining beyond 20 percent of the originally specified seasonal apportionment in a particular area may be further apportioned to other statistical areas. Therefore, NMFS also is increasing the D season apportionment of pollock to Statistical Areas 610 and 630 based on the underharvest of pollock in Statistical Areas 620 of the GOA. These adjustments are described below.

The D seasonal apportionment of the 2015 pollock TAC in Statistical Area 610 of the GOA is 12,185 metric tons (mt) as established by the final 2015 and 2016 harvest specifications for groundfish of the GOA (80 FR 10250, February 25, 2015). In accordance with § 679.20(a)(5)(iv)(B), the Administrator, Alaska Region, NMFS (Regional Administrator), hereby increases the D season apportionment for Statistical Area 610 by 2,437 mt to account for the underharvest of the TAC in Statistical Areas 610 and 620 in the C season. This increase is in proportion to the estimated pollock biomass and is not greater than 20 percent of the D seasonal apportionment of the TAC in Statistical Area 610. Therefore, the revised D seasonal apportionment of the pollock TAC in Statistical Area 610 is 14,622 mt (12,185 mt plus 2,437 mt).

The D seasonal apportionment of the pollock TAC in Statistical Area 620 of the GOA is 14,628 mt as established by the final 2015 and 2016 harvest specifications for groundfish of the GOA (80 FR 10250, February 25, 2015). In accordance with § 679.20(a)(5)(iv)(B), the Regional Administrator hereby increases the D seasonal apportionment for Statistical Area 620 by 2,926 mt to account for the underharvest of the TAC in Statistical Areas 620 in the C season. This increase is not greater than 20 percent of the D seasonal apportionment of the TAC in Statistical Area 620. Therefore, the revised D seasonal apportionment of the pollock TAC in Statistical Area 620 is 17,554 mt (14,628 mt plus 2,926 mt).

The D seasonal apportionment of pollock TAC in Statistical Area 630 of the GOA is 18,639 mt as established by the final 2015 and 2016 harvest specifications for groundfish of the GOA (80 FR 10250, February 25, 2015). In accordance with § 679.20(a)(5)(iv)(B), the Regional Administrator hereby increases the D seasonal apportionment for Statistical Area 630 by 3,728 mt to account for the underharvest of the TAC in Statistical Areas 620 and 630 in the C season. This increase is in proportion to the estimated pollock biomass and is not greater than 20 percent of the D seasonal apportionment of the TAC in Statistical Area 630. Therefore, the revised D seasonal apportionment of pollock TAC in Statistical Area 630 is 22,367 mt (18,639 mt plus 3,728mt).

This action responds to the best available information recently obtained from the fishery. The Assistant Administrator for Fisheries, NOAA (AA), finds good cause to waive the requirement to provide prior notice and opportunity for public comment pursuant to the authority set forth at 5 U.S.C. 553(b)(B) as such requirement is impracticable and contrary to the public interest. This requirement is impracticable and contrary to the public interest as it would prevent NMFS from responding to the most recent fisheries data in a timely fashion and would provide opportunity to harvest increased pollock seasonal apportionments. NMFS was unable to publish a notice providing time for public comment because the most recent, relevant data only became available as of October 27, 2015.

The AA also finds good cause to waive the 30-day delay in the effective date of this action under 5 U.S.C. 553(d)(3). This finding is based upon the reasons provided above for waiver of prior notice and opportunity for public comment.

This action is required by § 679.20 and is exempt from review under Executive Order 12866.