1652-0057 EXIS_Supp_Stmt

INFORMATION COLLECTION SUPPORTING STATEMENT

EXIS Information System (EXIS)

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information. (Annotate the CFR parts/sections affected).

The Exercise Information System (EXIS) is a voluntary, online tool developed by TSA to support the mission of a program developed and implemented by TSA to fulfill requirements of the Implementing Recommendations of the 9/11 Commission Act of 2007 (911 Act) ¹and the Security and Accountability For Every Port Act of 2006.² These statutory programs led to the development of the Intermodal Security Training Exercise Program (I-STEP) for the Transportation Systems Sector (TSS).³

I-STEP is a design, development, and tracking resource of security exercises that can assess and improve the capabilities of all surface transportation modes to prevent, prepare for, mitigate against, respond to, and recover from acts of terrorism. Within this program, EXIS is an interactive resource for the TSS. As an interactive system, information collection is necessary for the program to be successful.

Use of EXIS is completely voluntary for industry and government operators in the TSS. While TSA expects the EXIS tool to be useful to industry, as described above, use of the system would not guarantee compliance with any existing or future TSA, DHS, or other Federal regulation.

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

EXIS is intended to be used by stakeholders in the TSS with a desire to conduct security exercises, including TSA’s internal stakeholders (such as Federal Security Directors) and publicly- or privately-owned transportation companies or assets. TSA will collect five kinds of information online from transportation stakeholders: (1) user registration information; (2) nature and scope of exercise; (3) corrective actions/lessons learned/best practices; (4) evaluation feedback on EXIS itself; and (5) After-Action Reports.

TSA will collect registration information from all EXIS users. Most likely, these users will be mid-level staffers at the transportation company/agency. TSA will use the information to ensure only those who are involved in transportation security with a “need-to-know” can utilize the features of EXIS, which is necessary because the context may contain Sensitive Security Information (SSI). See 49 CFR Part 1520. Although participation in EXIS is voluntary, for those who choose to participate, TSA requires those respondents to submit the following registration information:

• First and Last Name

• Agency/Organization Type and Name

• Job Title

• Employer Name

• Professional Phone Number

• Professional E-mail Address

• Employment Verification Contact Name

• Employment Verification Phone Number

In addition, because EXIS content may contain SSI, all users are also required to submit an electronic non-disclosure agreement (NDA) pertaining to SSI usage. ⁴ Furthermore, all users will be required to review and acknowledge review of SSI handling and protection requirements. The burden of reading and acknowledging the NDA and the SSI handling and protection requirements is accounted for in the registration burden estimate under Question 12.

TSA also requests the following optional registration information:

• Certifications

• Professional Address, City, State, and Zip

• Alternate Phone Number

• Professional Fax Number

• Alternate E-mail

After users are registered, the EXIS user can provide information regarding the nature and scope of the exercise that they would like to conduct. TSA then can access this information in order to generate an appropriate exercise for the user. Such information includes:

• Exercise Properties

• Objectives

• Scenario Events

• Participating Agencies

• Pre-Exercise Data (to assess the user’s state of readiness for a transportation security incident prior to initiating the training exercise)

After the completion of the exercise, the EXIS user can input information regarding the exercise. The EXIS user can ultimately use this information for generating an “After Action Report”. TSA will also collect this information in order to capture lessons learned and best practices. Such information includes:

• Corrective Actions

• Best Practices

• Lessons Learned

Users can submit feedback on EXIS itself through a voluntary evaluation survey called the “Evaluation Team Feedback”. This survey encompasses:

• Evaluation Materials

• Evaluator Training

• Team Composition

• Logistics

Finally, as previously mentioned, EXIS users can access data to generate and/or submit formal “After Action Reports” which may include:

• Exercise Overview

• Goals and Objectives

• Event Synopsis

• Analysis of Critical Issues

• Exercise Design Characteristics

• Conclusions

• Executive Summary

An EXIS user has the ability to limit the availability of his/her exercise information to a select group of other EXIS users by creating an exercise community. By creating an exercise community, the EXIS user groups exercises and data under a private sub-site within EXIS and can control community access by choosing which other EXIS users to invite to his/her community and/or by rejecting any requests from other users to join. All EXIS users, TSA and non-TSA, have the ability to organize and participate in communities. Regardless of whether the community organizer is TSA or non-TSA, TSA will have the ability to access and moderate all communities, although TSA will not actively do so. TSA will only step in to moderate if an issue arises in a particular community.

EXIS communities are not “bulletin boards” in the sense that all members of the community can contribute information. Rather, the community owner can post information regarding his/her exercise and other community members can only observe the posted information. Because such information may be SSI, all EXIS users will have unique usernames and passwords that meet or exceed the DHS standards of SSI access to log into EXIS. An SSI Content Management Plan has been approved for EXIS by the Office of Intelligence, and EXIS hardware and software have been approved to handle SSI by the Office of Information Technology.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden. [Effective 03/22/01, your response must SPECIFICALLY reference the Government Paperwork Elimination Act (GPEA), which addresses electronic filing and recordkeeping, and what you are doing to adhere to it. You must explain how you will provide a fully electronic reporting option by October 2003, or an explanation of why this is not practicable.]

EXIS is an electronic system, accessible through the Internet, and all information is collected electronically; thus this information collection is compliant with GPEA. The basis for adopting an online submission process include ease of accessibility for EXIS users, ease of information storage, and ease of control over information dissemination. Users can go to “https://exis.tsa.dhs.gov/default.aspx” to access the public-facing EXIS site and to request access by inputting registration information.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purpose(s) described in Item 2 above.

TSA is not aware of any other web portal in the government that is designed to generate transportation security training exercises and to record the data/results of such exercises. The purpose of EXIS is unique, and therefore any similar information already available cannot be modified to accomplish it.

5. If the collection of information has a significant impact on a substantial number of small businesses or other small entities (Item 5 of the Paperwork Reduction Act submission form), describe the methods used to minimize burden.

The collection of information will not have a significant impact on a substantial number of small businesses or other small entities.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

There has been growing demand among government and industry security partners across the nation to expand I-STEP, which TSA developed and implemented to fulfill the 911 Act’s requirement for DHS to establish an exercise program for the Transportation Systems Sector (TSS). I-STEP brings public and private sector partners together to exercise, train, share information, and address transportation security issues to protect travelers, commerce, and infrastructure. Through the program, TSA facilitates modal and intermodal exercises and workshops throughout the country. The program also provides training support to help modal operators meet their training objectives.

Without EXIS, there is no similar platform to make this information available. Using EXIS, transportation stakeholders have access to a system that will allow them to generate and conduct security exercises, expanding the reach and effectiveness of the I-STEP program and its mission to improve the capabilities of all surface transportation modes to prevent, prepare for, mitigate against, respond to, and recover from acts of terrorism. EXIS also collects lessons learned and best practices from such exercises and makes them available for the benefit of members of the TSS that participate in EXIS

Because an interactive system like EXIS requires the user to provide information, without the information collection, the user could not make selections, the system would not be able to generate these documents; and conversely, without the system-generated documents, the user would not be able to conduct their exercise. Once the user gains access and logs in, they are prompted to enter a variety of information related to the exercise they would like to create. This information ranges from basic input fields, such as the name, date and location of the exercise, to more substantial requirements, including selecting exercise objectives, tasks, and a scenario. Once the user has submitted their information, the system uses their selections to generate customized exercise documents that are ready to be used to conduct the final exercise.

Failure to collect this information will limit TSA’s ability to effectively test security countermeasures, security plans, and the ability of a modal operator to respond to and quickly recover after a transportation security incident. The TSS has over 100,000 operators which need support from TSA, and insufficient awareness, prevention, response, and recovery to a transportation security incident will result in increased vulnerability of the U.S. transportation network and a reduced ability of DHS to assess system readiness. The personnel resource requirements for conducting a security exercise using the resources of the I-STEP program team limit the availability of this resource to transportation stakeholders. The Exercise Information System (EXIS) is a voluntary, online tool developed by TSA that supports the I-STEP mission by expanding the availability of these resources and enhancing the partnership with TSS stakeholders. Based on consultations with its TSS stakeholders, TSA developed EXIS as a technology platform to expand both I-STEP resources and the availabilities of these resources for TSS operators. EXIS was designed by the Federal government with input from industry partners to support their risk reduction efforts, both in the initial design of the program and for its ongoing operations.

Failure to collect user registration information will prevent TSA from making this system available to transportation stakeholders as it would not have the ability to evaluate whether transportation stakeholders have a “need-to-know” in order to access and use EXIS.

EXIS is an SSI-level system. Therefore, collection of registration information is necessary in order to determine whether users should have access to the system.

In addition, failure to collect/monitor information regarding the nature and scope of the user’s desired exercise will prevent TSA from properly generating a relevant and useful training exercise for the user. A failure to collect corrective actions, best practices, lessons learned, and After-Action Reports from the user once the exercise is complete will hamper TSA’s attempt to record and document security feedback as well as TSA’s ability to disseminate such information to other members of the TSS.

Finally, a failure to collect feedback on EXIS’s performance will limit TSA from adjusting the properties and capabilities of EXIS to better suit the needs of the TSS.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with the general information collection guidelines in 5 CFR 1320.5(d)(2).

TSA will conduct this collection in a manner consistent with the general information collection guidelines in 5 CFR 1320.5(d)(2).

8. Describe efforts to consult persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d) soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

Pursuant to 5 CFR 1320.8(d), TSA published a 60-day notice soliciting comments from persons outside of the agency regarding the data collection procedures of EXIS. This notice was published on May 1, 2014 (79 FR 24742). We received one comment. This comment was from an industry association (Airlines for America) that sought more information on what EXIS is and how TSA uses it. TSA responded by providing the association’s TSA Point of Contact (POC) with a summary of EXIS, as well as referred the commenter to the appropriate EXIS personnel.

TSA later published a 30-day notice soliciting further comments. See 79 FR 42339 (July 21, 2014). This notice generated no further comments on the collection.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

TSA will not provide payment or gifts to respondents.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

TSA will not provide any assurance of confidentiality to respondents. TSA will gather and store all information pursuant to the Privacy Act, as applicable, as well as any information deemed SSI pursuant to 49 CFR Part 1520.

11. Provide additional justification for any questions of sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

TSA does not ask questions of a private, sensitive nature.

12. Provide estimates of hour burden of the collection of information.

The total annual hour burden estimate for EXIS’s collection of information is 6,072 hours. This was calculated by first estimating the future EXIS population using the current number of users and its rate of growth, in addition to the number of annual users added through outreach events. Then, the average number of exercises conducted annually was calculated based on the number of exercises built per user. Finally, the average number of annual exercises conducted was multiplied by four hours (the amount of time spent building each exercise) to determine the average hourly burden per exercise. A more detailed explanation of how these estimates were derived is provided below.

To estimate the number of registered users in the EXIS system, TSA used the current number of users as the base year (Year 1). The annual growth rate was determined by dividing the number of users in 2013 (364) by the number of users in 2012 (218) to reach 67%. Table 1 displays the estimated EXIS base population.

Table 1: EXIS Base Population*
	Current Number of Users	Annual Growth Rate	Year 1 Number of Base Users	Year 2 Number of Base Users	Year 3 Number of Base Users	Total Number of Base Users
	A	B	C=A	D=C*(1+B)	E=D*(1+B)	F=C+D+E
EXIS base users	364	67%	364	608	1,016	1,988
*EXIS populations are rounded up to nearest whole number

In addition to the EXIS base population, TSA estimates that for every outreach event it holds with the surface transportation sector, one percent of the modal population will register with EXIS. TSA’s current outreach strategy estimates it will hold one outreach event every three years, per mode. TSA used data from TSA Modal Annex reports, the Association of American Railroads (AAR), and the Motor Coach Census to estimate current surface transportation industry populations.

	Table 2: Additional Number of Users Added via Outreach (per year)*
Transportation Mode		Current Industry Population	Users Following Outreach Event	Outreach Events over 3 Years	Additional Number of Users per Event	Average Number of Users per Year
		G	H	I	J=G*(H*I)	K=J/3
Freight Rail		563	1%	1	6	2
Mass Transit		6,000	1%	1	60	20
Highway		1,075,000	1%	1	10,750	3,583
School Bus		14,000	1%	1	140	47
Pipeline		2,304	1%	1	24	8
Motor Coach		3,137	1%	1	32	11
Total					11,012	3,671
	*Transportation surface populations are rounded up to nearest whole number

Finally, to calculate the total number of registered EXIS users, TSA combined the users added via outreach with the annual base population. This is depicted in Table 3.

Table 3: Total EXIS Population*
	Year 1 Number of Users	Year 2 Number of Users	Year 3 Number of Users	Total Number of Users
	L=C+K	M=D+K	N=E+K	O=L+M+N
Total EXIS users	4,035	4,279	4,687	13,001
*EXIS populations are rounded up to nearest whole number

To determine the exercise response rate, TSA calculated the number of exercises conducted per EXIS user. In 2013, 129 exercises were conducted in EXIS. Given the total number of users in 2013 totaled 364, roughly one in three users conducted an exercise. This exercise response rate of 35% is used in Table 4 to display the estimated number of exercises conducted each year.

	Table 4: Exercises Conducted*
		Exercise Response Rate	Number of Exercises Conducted			Total Number of Exercises	Average Annual Number of Exercises
			Year 1	Year 2	Year 3
		P	Q=L*P	R=M*P	S=N*P	T	U=T/3
Total EXIS Users		35%	1,413	1,498	1,641	4,551	1,518
	*Exercises are rounded up to nearest whole number

The resulting average annual number of exercises is 1,518. TSA estimates the burden associated with each of the EXIS information collection categories as follows:

• Registration, 0.5 hours;

• Creating an exercise, 1 hour;

• Inputting best practices, corrective actions, and lessons learned, 1 hour;

• After action reports, 1 hour; and

• Evaluation Team Feedback survey of EXIS, 0.5 hours.

Thus, TSA estimates each exercise will take approximately 4 hours to build. The average annual hour burden was calculated by multiplying average annual exercises by the estimated hours per response as displayed in Table 5 below.

Table 5: Average Annual Exercises & Hour Burden
	Average Annual Exercises Conducted	Hours per Response	Average Annual Hour Burden
	V	W	X=V*W
Total EXIS Users	1,518	4	6,072

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information.

Beyond the hourly burden, there are no industry costs estimated for this collection.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, and other expenses that would not have been incurred without this collection of information.

TSA estimates the total cost to the Federal government associated with the EXIS information collection request to be approximately $796,180 annually. This includes TSA staff costs and other infrastructure costs to maintain and update EXIS. TSA staff costs were calculated by assuming approximately 3 TSA H/I program analysts will spend roughly 20 hours per week on EXIS-related duties. These estimates were used to calculate a TSA FTE of 1.5 (3 employees multiplied by 20 hours per week multiplied by 52 weeks divided by 2080 hours (standard work year) equals 1.5). The TSA FTE was then multiplied by a TSA H/I Hourly wage rate of $58.32 whose product was multiplied by 2080 hours for an average annual staff cost of $181,958. Infrastructure cost is comprised of contractor costs paid to maintain and update EXIS which are as follows:

• Year 1, $594,484;

• Year 2, $613,880; and

• Year 3, $634,300.

Thus, the average annual infrastructure cost is $614,221. Table 6 displays EXIS’s total cost to TSA.

Table 6: TSA Costs*
	TSA FTE	TSA Wage Rate	TSA Staff Cost	Infrastructure Cost	Total
	A	B	C=(A*B)*2080	D	E=C+D
Year 1	1.5	$58.32	$181,958	$594,484	$776,442
Year 2	1.5		$181,958	$613,880	$795,838
Year 3	1.5		$181,958	$634,300	$816,258
Average Annual			$181,958	$614,221	$796,180
*Costs are rounded to nearest dollar

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I.

TSA is adjusting the burden estimate based on information that was not available when the initial approval for this information collection was granted in February 2013. See ICR Control No. 201112-1652-001. The hourly burden was calculated at 392,385 hours, which is drastically higher than the 6,072 hours calculated in this renewal. In 2013, the Program Team did not have any historical data to determine the number of users accessing the EXIS system, and assumed a ten percent response rate from the targeted audience. Since the potential audience is over 100,000 transportation operators in the TSS, this calculation resulted in a projected number of users that was significantly higher than those that have enrolled in EXIS to date. Now that EXIS has collected two years of user data, the Program Team was able to refine the equations used to calculate the number of users, resulting in a much more accurate hourly burden that is reflected in this renewal effort.

16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

User registration information will not be published. Information regarding exercise properties, lessons learned, and best practices from past exercises will be made available online to certain users in the aggregate after removal of personal, proprietary, time, date, and location information.

As previously discussed, an EXIS user has the ability to limit the availability of his/her exercise information to a select group of other EXIS users by creating an exercise community. Once created, the EXIS user groups exercises and data under a private sub-site within EXIS and can control community access by choosing which other EXIS users to invite to his/her community and/or by rejecting any requests from other users to join. All EXIS users, whether TSA or non-TSA, have this ability. Regardless of whether the community organizer is TSA or non-TSA, TSA will have the ability to access and moderate all communities, although TSA will not actively do so. TSA will only step in to moderate if an issue arises in a particular community.

EXIS communities are not “bulletin boards” in the sense that all members of the community can contribute information. Rather, the community owner can post information regarding his/her exercise and other community members can only observe the posted information. Because such information may be SSI, all EXIS users will have unique usernames and passwords that meet or exceed the DHS standards of SSI access to log into EXIS. An SSI Content Management Plan has been approved for EXIS by the Office of Intelligence, and EXIS hardware and software have been approved to handle SSI by the Office of Information Technology.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

Not applicable.

18. Explain each exception to the certification statement identified in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

Not applicable.

1Pub. L. 110-53, 121 Stat. 408 (Aug. 3, 2007).

2 Pub. L. 109-347, 120 Stat. 1895-96 (Oct. 13, 2006) (codified at 6 U.S.C. 912).

3 See 9/11 Act secs. 1407 (public transportation, codified at 6 U.S.C. 1136(a)), 1516 (railroads, codified at 6 U.S.C. 1166), and 1533 (over-the-road buses, codified at 6 U.S.C. 1183). See also the Security and Accountability For Every Port Act of 2006 (SAFE Port Act), Pub. L. 109-347 (120 Stat. 1884, Oct. 13, 2006) (applicable to port security, codified at 6 U.S.C. 912).

4 To the extent that exercise information and results may be Sensitive Security Information (SSI) in accordance with 49 U.S.C. 114(r) and 49 CFR Part 1520, TSA will protect it as such.