SUPPLEMENTARY INFORMATION:

On April 30, 2024, the White House National Security Council published the National Security Memorandum 22 (NSM-22) on Critical Infrastructure Security and Resilience, which builds on the important work that the Cybersecurity and Infrastructure Security Agency has been undertaking in partnership with America's critical infrastructure communities. Replacing the previous Presidential Policy Directive 21 (PPD-21) on Critical Infrastructure Security and Resilience, is the National Security Memorandum will help ensure U.S. critical infrastructure can provide the nation a strong and innovative economy, protect American families, and enhance our collective resilience to disasters before they happen, strengthening the nation for generations to come. This National Security Memorandum specifically:

Task the U.S. Department of Homeland Security to coordinate the national effort to enhance the security and resilience of United States critical infrastructure and provide strategic guidance on this national effort, with Cybersecurity and Infrastructure Security Agency acting as the National Coordinator for the Security and Resilience of U.S. Critical Infrastructure. The Secretary of Homeland Security will be required to submit to the President a biennial National Risk Management Plan that summarizes U.S. government efforts to mitigate risk to the nation's critical infrastructure.

Reaffirms the designation of 16 critical infrastructure sectors and establishes a federal department or agency responsible for managing risk within each of these sectors.

Elevates the importance of minimum security and resilience requirements within and across critical infrastructure sectors, consistent with the National Cyber Strategy, which recognizes the limits of a voluntary approach to risk management in the current threat environment.

( printed page 51725)

The Cybersecurity and Infrastructure Security Agency Act of 2018 provides the Cybersecurity and Infrastructure Security Agency with a mission, mandate, and responsibility to take various measures and lead various efforts to help secure the nation's critical infrastructure. To support this mission, Cybersecurity and Infrastructure Security Agency's Infrastructure Security Division conducts voluntary on-site security and resiliency assessments for various critical infrastructure entities, which requires Cybersecurity and Infrastructure Security Agency to voluntarily collect certain information about an entity's security posture, for example; the alignment of their security with business objectives, provide a baseline against which improvements can be measured, and by helping demonstrate due diligence to regulators, customers, and stakeholders. These assessments are web-based and are used to collect an organization's basic high-level information and its dependencies. This data is then used to determine a Protective Measures Index and a Resilience Measure Index for the assessed organization. In turn, the Protective Measures Index and the Resilience Measure Index allow the organization to see how it compares to other organizations within the same sector as well as allows them to see how adjusting certain aspects would change their protection and resiliency readiness. This allows the organization to then determine where best to allocate funding and perform other high-level decision-making processes pertaining to the security and resilience of the organization.

The information will be voluntarily provided by the organizations to Cybersecurity and Infrastructure Security Agency Protective Security Advisors and Cybersecurity Security Advisors. The Protective Security Advisors and Cybersecurity Advisors will then visit the site and perform the assessment, as requested. They then return to complete the vulnerability assessment and input the data into the system where the data is then accessible by the system users. Once available, the organization and other relevant system users can then review the data and use it for planning, risk identification, mitigation, and decision making.

All data captured is electronically by the Protective Security Advisors, Cybersecurity Advisors or by the organization as a self-assessment. Participation in the vulnerability assessments is voluntary but full completion of the assessment data collection is required if the organization desires to receive a complete evaluation of their security posture.

After assessments are input into the system, the user is prompted to participate in a feedback questionnaire called the Post Assessment questionnaire. Participation in the Post Assessment questionnaire is voluntary. The Post Assessment Questionnaires are designed to capture feedback about a vulnerability assessment and the system. There are three different questionnaires correlated and prompted after entering a particular assessment into the database. The results are used internally within the U.S. Department of Homeland Security to make programmatic improvements. After assessments are input into the system, the user is prompted to participate in a feedback questionnaire.

The collection of information uses automated electronic vulnerability assessments and questionnaires. The vulnerability assessments and questionnaires are electronic in nature and include questions that measure the security, resiliency and dependencies of an organization. The vulnerability assessments are arranged at the request of an organization and are then scheduled and performed by Protective Security Advisors.

The changes to the collection since the previous OMB approval includes the transition of three cyber-centric questionnaires customer feedback questionnaires (Cybersecurity Infrastructure Survey, Cyber Resilience Review, and External Dependency Management) to a disparate system, and the decommissioning of the Stakeholder Risk Assessment and Mitigation. These actions reflect a strategic consolidation of assessment functions and the migration of questionnaire content and capabilities to an alternative system. Collectively, these modifications have resulted in reduced respondent burden and associated cost estimates, as the retired questionnaires and system components are no longer part of the information collection framework.

The removal of the three questionnaires has decreased the burden estimates by $1,264,787. The annual burden cost for the collection has decreased by $1,267,072, from $1,907,757 to $640,685, due to the removal of the Post Assessment Questionnaires and updated wage rates. The annual government cost for the collection has decreased by $1,478,073, from $2,220,152 to $742,079, due to the removal of the three Post Assessment Questionnaires and updated wage rates. The information collected is also shared with the Federal Emergency Management Agency and is utilized to make determinations for Public Assistance grants based on the information supplied by the respondents.

Cybersecurity and Infrastructure Security Agency is authorized by the Cybersecurity and Infrastructure Security Agency Act of 2018 to collect this information codified under the authorities provided by 6 United States Code, section 652, including subsection (c)(5) (authorizing the Cybersecurity and Infrastructure Security Agency to “upon request, provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and, where appropriate, provide those analyses, expertise, and other technical assistance in coordination with Sector-Specific Agencies and other Federal departments and agencies”); and (e)(1)(B) (authorizing the Cybersecurity and Infrastructure Security Agency to “carry out comprehensive assessments of the vulnerabilities of the key resources and critical infrastructure of the United States”).

( printed page 51726)

The Office of Management and Budget is particularly interested in comments which:

1. Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;

2. Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;

3. Enhance the quality, utility, and clarity of the information to be collected; and

4. Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submissions of responses.

Analysis

Agency: Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security.

Title: Cybersecurity and Infrastructure Security Agency Vulnerability Assessments.

OMB Number: 1670-0035.

Frequency: Annually.

Affected Public: State, Local, Tribal, and Territorial Governments, and Private Sector Individuals.

Number of Respondents: 1,100.

Estimated Time per Respondent: 7.5 hours and 0.17 hours depending on response element.

Total Burden Hours: 7,150.5.

Total Annual Burden Cost: $661,475.

Total Annual Government Burden Cost: $883,064.

91 FR 51724