Ss 11-5-08

Supporting Statement for

“The FNS User Access Request Form Data Collection”

(OMB Control Number 0584-0532)

Bradley Nix

Chief Information Security Officer (CISO)

Technology Division

Office of Information Technology (OIT)

Food, Nutrition and Consumer Services/USDA

3101 Park Center Drive

Alexandria, Virginia 22302

Office Phone: 703-305-2242

Fax: 703-305-2924

Email: [email protected]

TABLE OF CONTENTS

A. Justification 3

1. Explain the circumstances that make the collection of information necessary. 3

2. How the information will be used, by whom and for what purpose 3

3. use of improved information technology to reduce burden 5

4. Efforts to identify and avoid duplication…………………………………………………….6

5. eFFORTS TO MINIMIZE BURDEN ON SMALL BUSINESSES OR OTHER ENTITIES. 6

6. consequences of less frequent data collection. 6

7. Special circumstances requiring collection of information 6

8. federal register comments and efforts to consult with persons outside the agency. 6

9. Payments to respondents. 8

10. assurance of confidentiality . 8

11. questions of a sensitive nature . 8

12. estimates of respondent burden. 8

13. estimates of other annual costs to respondents 10

14. estimates of annualized government costs. 10

15. changes in burden hours. 11

16. time schedule, publication and analysis plans . 11

17. display of expiration date for omb approval. 11

18. exceptions to the certification statement 11

A. Justification

1. Explain the circumstances that make the collection of information necessary.

The Office of Management and Budget Circular No. A-130, Appendix III, Security of Federal Automated Information Resources, dated February 8, 1996, establishes a minimum set of controls to be included in Federal automated information security programs. Establishing personal controls to screen users to allow access to authorized system is directed in this appendix. The FNS User Access Request Form, FNS-674, is designed for this purpose and will be used in all situations where access to an FNS computer system is required, where current access is required to be modified or where access is no longer required and must be deleted.

2. Indicate how, by whom and for what purpose the information is to be used. Except for a new collection, indicate the actual use the Agency has made of the information received from the current collection.

FNCS employees, contractors, state agencies and partners, e.g. Food Banks, etc. have requested access to FNCS systems via the User Access Request form. FNCS has used the information collected to grant access to FNCS Systems. Only specific systems require PII in order to grant access. Information that is collected: Name, e-Authentication ID (if exists), telephone number, home zip code, email address, contract expiration date, temporary employee expiration date, office address, State/locality codes, system name, form type, type of access, action requested, comments and special instructions.

From whom will the information be collected?

The User Access Request Form collects information from:

• new FNCS Employees

• new FNCS Contract Staff

• new State Agencies to FNCS

• new Partners to FNCS or

• Existing employees, Contract Staff, State Agencies or Partners to FNCS requesting updates to current access to FNCS Information Systems.

How will the information be collected (e.g., forms, non-forms, electronically, face-to-face, over the phone, over the internet)?

The information is collected via a paper-based and online form.

How frequently will the information be collected?

The information is requested as often as needed based on the user requests for new access or updated access requests to systems. In State agencies, the State Coordinators provide a liaison between the State agency and the Information Systems Security Officers (ISSO) in FNCS Regional Offices and the Information Security Office (ISO) in the FNCS National Office. The State Coordinator is responsible for ensuring that State users and entities comply with the FNCS Information Systems Security Guidelines and Procedures Handbook 702. The ISSOs act on behalf of the National Office ISO to ensure that Regional, Field and Compliance Office users comply with the FNCS 702 Handbook.

Will the information be shared with any other organizations inside or outside USDA or the government?

This information will be stored in the Information System Security Office (ISO), the Financial Management Division (FMD) where the information is stored and maintained for users requesting access to Financial Management Systems, the National Finance Center (NFC), and the National Information Technology Center (NITC) where information from this form is shared to grant access to NFC and NITC Systems.

If this is an ongoing collection, how have the collection requirements changed over time?

The information collected on this form has changed to include additional required fields used to identify a user when changes are requested to their access or when password resets are needed. Also, information is now collected to validate the completion of Computer Security and Awareness Training (CSAT) and Privacy Act Training, prior to processing the form.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g. permitting electronic submission of responses, and the basis for the decision for adopting this means of collection.

FNS is currently automating the FNS 674 for applications that have available funding to support the automation. Therefore, this collection is in compliance with E-Government 2002.

Information on the FNS-674 will be displayed and captured using Microsoft ASP.Net and HTML, via a web-based system on the FNCS web site. The information will be stored in Microsoft SQL Server. The information will be transmitted over a secured HTTP protocol. The foundation of this technical architecture is Microsoft, which is consistent with current FNCS standards.

4. Describe efforts to identify duplication.

There is no similar information.

5. If the collection of information impacts small businesses or other small entities (item 5 of OMB Form 83-1), describe any methods used to minimize burden.

There will be no impact to small businesses or entities.

6. Describe the consequences to Federal program or policy activities if the collection is not conducted or conducted less frequently, as well as any technical or legal obstacles to reducing burden.

Users provide name, e-Authentication ID (if exists), telephone number, home zip code, email address, contract expiration date, temporary employee expiration date, office address, State/locality codes, system name, form type, type of access, action requested, comments and special instructions to gain initial access to FNCS Information Systems and may require subsequent submissions if access privileges change. This form is also required if an individual is to be removed as a user from a specific system. If this form submission did not occur, users would be denied access to systems needed to deliver FNCS programs.

7. Explain any special circumstances relate to Guidelines of 5 CFR 1320.6.

There are no special circumstances. The collection of information is conducted in a manner consistent with the guidelines in 5 CFR 1320.6.

8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8 (d), soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

A 60-day notice requesting public comment on this collection was published in the Federal Register at Vol. 73, No. 110, Page 32285, Friday, June 6, 2008. The comment period closed on August 5, 2008 and no comments were received.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and record keeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported. Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years even if the collection of information activity is the same as in prior periods. There may be circumstances that may preclude consultation in a specific situation. These circumstances should be explained.

State agencies interact daily with Regional staff and would provide their views on the aspects of this collection if necessitates. State agencies’ concerns on the use of this form would be brought to the attention of FNCS National Office Information Systems Security Office and all valid suggestions would be taken into consideration on the development and delivery of this form to its users.

In May 2008, David Bray, ASC; Bernard Coles, CNSI; and Tim Riley, BP International provided comments on the FNS 674 specifically on the content, data elements, design of instruments and instructions related to the FNS 674.  The consensus is that FNS 674 is easy to fill out by end users.  FNS received advice on the design of the instrument as it relates to policy and procedures to verify CSAT compliance.  American Systems provided advice on the instructions to provide better clarity.  Another individual stated that the instructions were very helpful.

9. Explain any decision to provide any payment or gift to respondents, other than re-enumeration of contractors or grantees.

Payments or gifts are not provided to respondents.

10. Describe any assurance of confidentiality provided to respondents and the basis for the

assurance in statute, regulation, or Agency policy.

The FNS-674 will contain a Privacy Act Statement and the data will be stored in a secured database. The applications for authorization contain personal identifying information on individuals doing business with Food and Nutrition Service. Therefore, the Food and Nutrition Service published such a Privacy Act notice (system of records) March 31, 2000 in the Federal Register Volume 65 pages 17251-52 to specify the uses to be made of the information in this collection.  Access to records is limited to those persons who process the records for the specific uses stated in this Privacy Act notice.  Records are kept in physically secured rooms and/or cabinets. Paper records are segregated and physically secured in located cabinets. Various methods of computer security limit access to records in automated databases.

11. Provide additional justification for any question of a sensitive nature, such as sexual behavior or attitudes, religious beliefs, and other matters that are commonly considered private.

This information collection includes no questions of a sensitive nature.

12. Provide estimates of the hour burden of the collection of information.

A. Estimate of Burden

The respondents are State agencies, who are located in the 50 states and Trust Territories, staff contractors and Federal employees. Respondents who require access to the FNCS systems are estimated at 1725 (includes Federal, State and private) however, only 225 will account for the total burden. This is due predominately because the Federal government completes this data collection instrument in the line of duty. Each respondent takes approximately 0.16667 of an hour, or 10 minutes, to complete the required information on the on-line form.

FNCS estimates that it will receive an average of 300 requests per month (15 per day). Of the 300, 70% (or 210) of the responses are State Agency users, 5% (or 15) are staff contractors and 25% (or 75) are Federal employees which is not included in the total number of responses.

REPORTING BURDEN

Affected Public	Form Number	Number of Respondents	Number of responses annually per Respondent	Total Annual Responses	Estimate of Burden Hours per response	Total Annual Burden Hours
Contractors	FNS-674	15	1	15	0.16667 (10 minutes)	2.50005
State Agency Users	FNS-674	210	2	420	0.16667 (10 minutes)	70.0014
Annualized Totals		225		435		72.50145

RECORDKEEPING BURDEN

There is no recordkeeping burden imposed on the public. All requests from respondents are archived on FNCS National Office systems.

B. Annualized Cost to Respondent

It is estimated that each respondent take 10 minutes to read the instruction and complete the on-line form. Using the hourly rate reported the National Compensation Survey: Occupational Wages in the U.S., June 2006; Department of Labor, Bureau of Labor Statistics at

http://www.bls.gov/ncs/ocs/sp/ncbl0910.pdf.

Affected Public	Type of Instrument	Average time per response	Number of Respondents	Frequency of Response	Hourly Wage Rate	Cost to Respondent
State Agencies	FNS-674	0.16667	210	2	$23.99	$1,679.33
Contractors	FNS-674	0.16667	15	1	$34.61	$86.53
Total			225			$1,765.86

13. Provide an estimate of the total annual cost burden to respondents or record keepers

resulting from the collection of information.

There are no startups or annualized maintenance costs to the respondents.

14. Provide estimates of annualized cost to the Federal Government.

Description of Activities	HQ Security Officers (2 – GS-13 @ ($39.75 per hr)	Regional Security Officers (14 GS-12 @ $36.59)	Contractor ($34.61 per hr)	Total
Updating on-line form to support the collection			70 hours = $2423.00	$2423.00
Testing of computer system			10 hours = $346.00	$346.00
Reviewing, approving and issuing password 1	$1431.00	$3951.00		$5382.00
Labor for analyzing, evaluating, summarizing, and reporting on the collected information 2	$318			$318.00
Total Cost to the Federal Government				$8469.00

Annualized costs are determined by tasks as described in the chart above. The FNCS National Office’ staff salary was determined by the 2008 Salary and Wage tables available from the Office of Personnel Management (OPM). The staff contractors’ salary was determined by using the national average available from the Department of Labor.

15. Explain the reasons for any program changes or adjustments reported in items 13 or 14 of the OMB Form 83-I.

This is a revised collection; there are adjustments to the burden hours requested due to a re-calculation of respondents and frequency of responses. FNS has revised the FNS 674 to include additional requirements needed to identify users; collects and identifies completion of Computer Security and Awareness Training (CSAT) and Privacy Act Training, prior to processing the form and request access to information systems. However, these changes did not impact the changes in burden hours.

16. For collection of information whose results are planned to be published, outline plans for tabulation and publication.

There are no plans for publication.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

We are seeking not to display the expiration date for OMB approval on this form. To display the expiration date would mean the web system would require revisions each time this date changes. Also, the revision date of the form would change, which may cause confusion to the respondents thinking there may have been changes to data elements.

17. Explain each exception to the certification statement identified in item 19, “Certification

Requirement for Paperwork Reduction Act.”

There are no exceptions to the certification statement.

1

^?National Office: Two (2) GS-13 Information Security Officers spend 2 minutes (0.04 of an hour) reviewing, approving, and issuing passwords for each National Office’ applications received. (3,600 applications/25% = 900 x 0.04 = 36 hrs. [36 hrs. @$39.75 per hour = $1431.00

Regions: Fourteen (14) GS-12 Information Security Officers spends 2 minutes (or 0.04 of an hour) reviewing, approving, and issuing passwords for users in State agencies. (3,600 applications/75% = 2,700 x 0.04 = 108 hrs. x $36.59 = $3951.72)

2 Two (2) GS-13 HQ Security Officers spend 2 hours per quarter, each, on the analyzing and running reports of security users and authorized systems.

(GS-12 @ $39.75 x 8 hrs. = $318.00)

12

OMB #0584-0532

August 2008