Comment Matrix

60-Day Federal Register Commenting Period

SUMMARY OF COMMENTS and RESPONSES

1670-0029 (CFATS Personnel Surety Program)
#	Category	Comment	Response
Comments on whether the proposed collection is necessary for the proper performance of the functions of the agency
1.1.1	Additional Analysis	Four commenters suggested that the Department conduct further assessments on the Personnel Surety Program (PSP): One commenter suggested that the Department “should not expand the program until it can see the successes and failures it has with Tier 1 and Tier 2 facilities.” Further, the commenter suggested a “formal assessment, in conjunction with the Department of Justice and the Federal Bureau of Investigation, on the benefits and positive outcomes of running PSP-gained information through the TSDB [Terrorist Screening Database]” be conducted. The commenter also suggested that such a review could evaluate the effectiveness of the Chemical Facility Anti-Terrorism Standards (CFATS) CFATS Personnel Surety Program and opportunities “to make it more effective.” A second commenter encouraged the Department to “examine the effectiveness of such screening before proceeding to subject the bulk of CFATS regulated facilities to these additional measures.” The second commenter suggested the Department conduct a comprehensive evaluation, similar to the comprehensive evaluation the Transportation Security Administration (TSA) is conducting with respect to the Transportation Worker Identification Credentials (TWIC) Program,1 before determining whether to expand the CFATS Personnel Surety Program to Tier 3 and Tier 4 covered chemical facilities. A third commenter referenced an ongoing Government Accountability Office (GAO) assessment of the CFATS program and speculated that the GAO assessment might review the implementation of the CFATS Personnel Surety Program. The commenter suggested that the Department could benefit from considering the results of the GAO assessment with respect “to tailoring implementation of PSP for Tier 3 and 4 facilities.” The commenter also suggested that if the GAO assessment does not include a review of the CFATS Personnel Surety Program, the Department should undertake such an analysis. In conclusion, the same commenter suggested that the Department not expand the CFATS Personnel Surety Program to Tier 3 and Tier 4 covered chemical facilities until such an analysis has been conducted and the results used to inform the CFATS Personnel Surety Program Information Collection Request (ICR). A fourth commenter requested that the Department allow a third-party review of the CFATS Personnel Surety Program after a suitable period of time has passed to determine if the program adds value to the security of the nation.	The Department does not believe that additional analysis is needed prior to the Office of Management and Budget (OMB) approving the collection of information concerning affected individuals from all covered chemical facilities. The Department has closely reviewed how Tier 1 and Tier 2 covered chemicals facilities have implemented the check for terrorist ties. Tier 1 and Tier 2 covered chemical facilities have varied by size, complexity, security issue, and location. Additionally, vetting for terrorist ties for all four tiers of covered facilities is required by CFATS. Members of the public commented on the CFATS rulemaking in 2007 before the regulation was finalized, and DHS considered all public comments (including comments about terrorist ties vetting and background checks) in coming to the reasoned decision to vet affected individuals for terrorist ties at all tiered facilities as part of the program. DHS disagrees that a modification to the program to eliminate this requirement for Tiers 3 and 4 or to indefinitely delay its rollout in order to conduct additional analysis would be appropriate. Preventing terrorist access to high-risk chemical facilities’ restricted areas and critical assets is a core purpose of CFATS, and failure to conduct terrorist ties checks may allow terrorist to gain access.
1.2.1	Objection to inclusion of certain groups	One commenter reiterated its continued objection to the inclusion of railroad employees is within the scope of CFATS because the commenter claims that inclusion of railroad employees lacks a risk-based justification.	Under CFATS, the Department regulates covered chemical facilities that present a high risk from terrorist attack. Effectively regulating chemical facility security involves assessing whether terrorists have access to facilities, and terrorists seeking access might not be limited to facility employees. To help reduce risk to high-risk facilities, the Department requires covered chemical facilities to conduct a check for terrorist ties on affected individuals (e.g., facility personnel and unescorted visitors) with or seeking access to restricted areas and critical assets. A covered chemical facility has the discretion to decide if they want to escort railroad employees as visitors, identify railroad employees as affected individuals, or treat them in some other way consistent with CFATS requirements. Identifying railroad employees as affected individuals would require a covered chemical facility to ensure that those personnel are screened for terrorist ties pursuant to 6 CFR 27.230(a)(12). In ensuring affected individuals are screened for terrorist ties, the facility has the discretion to choose from four options for vetting affected individuals or propose alternatives or supplemental options in its Site Security Plan (SSP) or Alternative Security Program (ASP) (See 82 FR 61312, 61316).2
1.2.2	Objection to inclusion of certain groups	One commenter highlighted the Department of Transportation (DOT) requirement at 49 CFR 172.802(a)(1) which states, “Personnel security. Measures to confirm information provided by job applicants hired for positions that involve access to and handling of the hazardous materials covered by the security plan. …” The commenter suggested that railroad employees having undergone such a background check and demonstrated their reliability by being stewards of the chemical during transit, should “not suddenly seem suspect simply by crossing a fence line at a covered chemical facility.”	It is the Department’s understanding that the sort of background checks discussed by the commenter do not include checks for terrorist ties. Checks for terrorist ties are required under CFATS (6 CFR 27.230(a)(12)).

1670-0029 (CFATS Personnel Surety Program)
#	Category	Comment	Response
Comments on the accuracy of the agency’s estimate of the burden of the proposed collection of information
2.1.1	Clarification of assumptions	One commenter recognizes the assumptions that release facilities may have more affected individuals than theft and diversion facilities, that there are an average of 106 employees per facility, and that the time it takes to vet an affected individual may be valid, but states, “it is not clear upon what information they [the assumptions] are based.”	The Department based the assumptions on historical data collected by the Department since the implementation of the CFATS Personnel Surety Program. Specifically, for the difference between release and theft and diversion facilities, the Department recognizes that high-risk chemical facilities for release security issues may take a facility-wide approach rather than an asset-based approach in defining their restricted areas, which may result in a higher number of affected individuals than theft and diversion facilities. Therefore, the Department reviewed the number of release sites to ensure the estimated number of respondents for the Tier 3 and Tier 4 high-risk chemical facilities were comparable to the historical data received by the Department since the implementation of the CFATS Personnel Surety Program. The Department found that the release security issues for Tier 1 and Tier 2 high-risk chemical facilities made up 38 percent of the total Tier 1 and Tier 2 high-risk chemical facility population. For Tier 3 and Tier 4 high-risk chemical facilities, the release security issue made up 25 percent of the total Tier 3 and Tier 4 high-risk chemical facility population. Based on these findings, the Department is satisfied that the Tier 1 and Tier 2 high-risk chemical facility historical data provided a valid representation of what the Department can expect from Tier 3 and Tier 4 high-risk chemical facilities. Specifically for the 106 employees, the Department estimates that under this collection there are (a) 200 Tier 1 and Tier 2 high-risk chemical facilities that did submit or will have to submit information about affected individuals under the current ICR, and (b) 3,700 Tier 3 and Tier 4 high-risk chemical facilities that will submit for the first time under this new collection. Historically, each Authorizer submitted, on average, 180 initial respondents, with each Authorizer responsible for 1.7 high-risk chemical facilities. Dividing 180 affected individuals per Authorizer by 1.7 high-risk chemical facilities results in an average of 106 initial respondents submitted per high-risk chemical facility. The Department’s estimate per respondent (affected individual) is based on industry feedback and historical data collected on their use of the CFATS Personnel Surety Program application. The Department has estimated the time per respondent to be 5 minutes per submission of a record about an affected individual. Since this estimate is based on current submissions from Tier 1 and Tier 2 high-risk chemical facilities, the Department has chosen an estimate of 10 minutes per record to provide a more conservative estimate.
2.2.1	Underestimating Burden	Two commenters expressed concern that the ICR did not appear to account for the burden associated with part-time or seasonal employees or contractors that qualify as affected individuals.	The Department’s estimate of the number of affected individuals in the 60-day notice was based on actual data submitted by covered chemical facilities at which seasonal and part-time employees (to include contractors) are considered affected individuals. Thus, the Department concludes that the historical data relied upon in the 60-day notice incorporates seasonal and part-time employees.
2.2.2	Underestimating Burden	Three commenters felt the personal identifiable information collection is not “usual and customary”: One commenter disagreed with the Department’s decision to invoke 5 CFR 1320.3(b)(2) to exclude “certain activities and costs related to the PSP data collection process.” The commenter suggested that two assumptions made by the Department are not accurate. Specifically, that (a) the Department’s assumption that facilities already possess the information necessary to submit under Option 1 or Option 2 of the CFATS Personnel Surety Program; and (b) the Department’s assumption that additional data collection is not required and there is no further burden imposed by this Information Collection beyond submitting the information to the Department under Option 1 or Option 2. A second commenter also objected to the exclusion of “the time needed for a site security officer to manage data collection, submissions, and tracking” under 5 CFR 1320.3(b)(2) which is similar to some of the examples provided by the first commenter. A third commenter expressed concern similar in nature that the estimated time per respondent does not appear to account for acquiring the necessary personal information to compare against the TSDB.	The Department evaluated each of the examples provided by the commenters. The Department’s evaluation of the examples provided by the commenters are below: The Department considered whether the CFATS Personnel Surety Program ICR should be revised to account for the burden associated with coordinating with CFATS-facility stakeholders, including Human Resources, Procurement, and/or Contract Administration to explain the PSP requirements and determine how best to gather the data from different populations (e.g., employees and resident and non-resident contractors). One commenter clarified elsewhere in its comments that the coordination included creating separate groups3 and “PSP Submitter [user] accounts for each contract company, which may include hundreds of different contract companies in cases where a large facility is tiered for a release security issue.” After considering the comment, the Department did not revise the CFATS Personnel Surety Program ICR because this burden is properly accounted for under a separate and different ICR. The establishment of Chemical Security Assessment Tool (CSAT) accounts, such as a PSP Submitter, and the assignment of such accounts to “groups” is covered under Information Collection 1670-0007.4 The Department considered whether the CFATS Personnel Surety Program ICR should be revised to account for the burden associated with “developing and providing communications, Privacy Act notices, and data collection forms to affected individuals.” After considering the comment, the Department did not revise the CFATS Personnel Surety Program ICR because, as described earlier in this notice, this burden is already accounted for in the 10 minutes per respondent burden estimate. The Department considered whether the CFATS Personnel Surety Program ICR should be revised to account for the burden associated with “ensuring that all affected individuals provide the necessary [personally identifiable information] PII– and following up with those that do not.” After considering the comment, the Department did not revise the CFATS Personnel Surety Program ICR. The collection of data from affected individuals by a covered chemical facility or its designees is excluded under 5 CFR 1320.3(b)(2). The Department considered whether the CFATS Personnel Surety Program ICR should be revised to account for the burden associated with “training personnel to use the CSAT PSP application.” After considering the comment, the Department did not revise the CFATS Personnel Surety Program ICR because the burden is properly accounted for under Information Collection 1670-0007. The Department considered whether the CFATS Personnel Surety Program ICR should be revised to account for the burden associated with “ensuring change management (e.g., once the initial data is gathered and uploaded, the facility still must account for new hires and new contractors – and further incorporate this into the facility access process).” After considering the comment, the Department did not revise the CFATS Personnel Surety Program ICR because the burden is already accounted for in this ICR (See 82 FR 61312, 61316).5 The Department laid out the expectations to submit both existing affected individuals as well as new affected individuals in the ICR notices associated with the current Information Collection and in the CFATS Personnel Surety Program Implementation Notice. The clear expectation for covered chemical facilities to submit new affected individuals is therefore inherently a part of the actual historical data upon which the Department relied in the 60-day notice.
2.2.3	Underestimating Burden	One commenter suggested that the CFATS Personnel Surety Program is being implemented on a facility-by-facility basis rather than a company-wide basis, which encourages duplicative processes for information collection and vetting and dramatically increases the burdens on railroads serving more than one company location.	The Department has designed the CFATS Program as a whole, and the CFATS Personnel Surety Program in particular, to allow for a company-wide approach. This has been mentioned in previous notices6 and can be found in current program guidance and resources.7 Some companies have opted to implement a company-wide approach to the Personnel Surety Program while others have not. The design of the CFATS Personnel Surety Program and this ICR allows each company with multiple covered chemical facilities to choose for itself whether or not, or to what degree, to adopt a company-wide approach under CFATS.
2.2.4	Underestimating Burden	One commenter expressed concern that the estimated time per respondent of five minutes “does not appear to include the additional time necessary to notify employees of the PSP requirement, obtain consent …”	As previously discussed, the Department did not revise the CFATS Personnel Surety Program ICR because this burden is already accounted for in the 10 minutes per respondent burden estimate.
2.2.5	Underestimating Burden	One commenter is concerned with the time it takes authorizer to create CSAT accounts for contractors.	The Department accounts for the burden related to the creation of CSAT accounts for contractors under Information Collection 1670-0007.8

1670-0029 (CFATS Personnel Surety Program)
#	Category	Comment	Response
Comments on enhancing the quality, utility, and clarity of the information to be collected
3.1.1	N/A	No Comments Received	N/A

1670-0029 (CFATS Personnel Surety Program)
#	Category	Comment	Response
Comments on minimizing the burden of the collection of information on those who are to respond
4.1.1	Flexible approach	Two commenters suggested that the Department use a flexible approach in the rollout: One commenter requested a phased roll out of the CFATS Personnel Surety Program to Tier 3 and Tier 4 covered chemical facilities. A second commenter “appreciate[d] that DHS is proposing to roll out these requirements in a phased method…” The same commenter also encouraged the Department to consider a “site’s various risk factors, including location, number of employees, types and volumes of COI, and likely offsite incident consequences” when planning the phased-in approach.	The Department agrees that a flexible approach is appropriate for the rollout of the Personnel Surety Program to Tier 3 and Tier 4 covered chemical facilities. If approved, the Department plans to implement the CFATS Personnel Surety Program in a phased manner to Tier 3 and Tier 4 covered chemical facilities over a three year period. Similar to the successful and recent retiering effort, the Department plans to consider the number of facilities assigned to a single Authorizer when notifying facilities to implement the Personnel Surety Program, as not to overwhelm a single Authorizer. The Department will also allow the flexibility for Authorizers, if desired, to complete the process for their facilities before notification by the Department.
4.2.1	Other existing options	One commenter suggested that the Department has downplayed the use of “existing options” that could lessen the burdens on third-party service providers, such as railroads, that employ affected individuals as defined by the covered chemical facility. The commenter suggested that one such “existing option” is real-time video monitoring as a means of escort.	The Department has explicitly mentioned in multiple notices associated with this Information Collection (see 79 FR 6418, 6420) and in CFATS Personnel Surety Program resources the possibility of innovative escorting alternatives such as video monitoring. The Department has also worked with facilities to identify other alternatives for a covered chemical facility to limit who is an affected individual. Furthermore, the Department provided the following guidance to covered chemical facilities in the CFATS Personnel Surety Program Implementation Notice:9 “A high-risk chemical facility will have flexibility to tailor its implementation of the CFATS Personnel Surety Program to fit its individual circumstances and, in this regard, to best balance who qualifies as an affected individual, unique security issues, costs, and burden. For example, a high-risk chemical facility may, in its Site Security Plan: Restrict the numbers and types of persons allowed to access its restricted areas and critical assets, thus limiting the number of persons who will need to be checked for terrorist ties. Define its restricted areas and critical assets, thus potentially limiting the number of persons who will need to be checked for terrorist ties. Choose to escort visitors accessing restricted areas and critical assets in lieu of performing terrorist ties background checks under the CFATS Personnel Surety Program. The high-risk chemical facility may propose in its SSP traditional escorting solutions and/or innovative escorting alternatives such as video monitoring (which may reduce facility security costs), as appropriate, to address the unique security risks present at the facility [emphasis added].”
4.3.1	No additional preconditions	One commenter urged the Department to not include additional pre-conditions to the CFATS Personnel Surety Program that would preclude covered chemical facilities from leveraging the background checks performed in compliance with the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) Employee Possessor Program under Option 4.	The Department has not modified the CFATS Personnel Surety Program to preclude a covered chemical facility from the potential of leveraging the vetting conducted by ATF under Option 4 for affected individuals who possess a Federal explosives license/permit.
4.4.1	Restriction of CVI access	One commenter requested that the Department modify CSAT to allow designated employees such as human resource professionals the ability to upload and edit information about affected individuals without having to access Chemical-terrorism Vulnerability Information (CVI).	The Department currently provides the ability to restrict human resource professionals from accessing CVI in CSAT. If a user is designated as only a personnel surety submitter and is not assigned any other facility roles, they are not able to access the CVI documentation.

1670-0029 (CFATS Personnel Surety Program)
#	Category	Comment	Response
Comments on other topics
5.1.1	Escalation of cyber risk	One commenter suggested that compliance with the CFATS Personnel Surety Program exposes railroad employee PII and exacerbates cyber-security risk.	The Department disagrees with the commenter that the CFATS Personnel Surety Program exposes PII and exacerbates cyber security risk. If (1) a covered chemical facility opts to identify the employee of a third-party service provider as an affected individual, and (2) a covered chemical facility opts to implement Option 1 or Option 2 in their SSP or ASP then the Department has designed the CSAT Personnel Surety Program Application to allow third-party companies, such as a railroad, to be granted access to the CSAT Personnel Surety Application for the express purpose of submitting information about affected individuals directly to the Department. If a covered chemical facility opts to implement Option 3 or Option 4, information about affected individuals is not submitted to the Department. Option 3 allows high-risk chemical facilities to comply with the Personnel Surety Program by electronically verifying and validating the affected individual’s TWICs through the use of TWIC readers. Option 4 provides high-risk chemical facilities with the option to visually verify certain credentials or documents that are issued by a Federal screening program that periodically vets enrolled individuals against the TSDB.
5.2.1	Exceeds legal requirements	One commenter suggested that the Department “has encouraged covered chemical facilities to collect information that exceeds the legal requirements.”	The Department outlined in the ICR all data elements and identified the ones that are required for a submission under Option 1 or Option 2. While the minimum data is sufficient, it is the considered judgement of the Department that additional information reduces the likelihood of false positives in matching against records in the federal government's consolidated and integrated terrorist watchlist. Although helpful in reducing false positives, this additional information is optional.
5.3.1	Inspection Consistency	Two commenters made suggestions as it relates to the consistency of inspections: One commenter requested that the Department “work with facilities that have already been inspected to make sure inspections are being handled in a consistent fashion.” A second commenter reported that there are “many regional inconsistencies in how inspectors conduct inspections within a region.”	Although this comment is outside the scope of the information collect request, DHS agrees and continues to work to ensure inspection consistency across the country.
5.4.1	Regulatory fix	One industry association commented that any updates to the CFATS regulation should be flexible and tangible for facility compliance.	This information collection request does not modify existing regulations.
5.5.1	Contradiction with other regulations	One commenter suggested that a contradiction exists between the CFATS Personnel Surety Program and the railroads compliance with DOT regulations.	The Department disagrees with the commenter. If a covered chemical facility opts to identify a railroad employee as an affected individual, the performance of railroads with respect to complying with DOT regulations, does not materially alter the fact that a railroad employee is an affected individual. Covered chemical facilities must ensure that affected individuals have appropriate background checks performed, to include a check for terrorist ties. This ICR allows covered chemical facilities, and their service providers that employ affected individuals, an opportunity to enable a check for terrorist ties to be performed against the TSDB.
5.6.1	Value of PSP	One commenter stated that the CFATS Personnel Surety Program, as currently designed, “does not take into consideration that Tier 3 and 4 facilities present a comparatively lower risk profile than Tier 1 and 2 sites.” The commenter suggested that the Department acknowledge the lower risk profile of Tier 3 and Tier 4 covered chemical facilities and not require them to comply with 6 CFR 27.230(a)(12)(iv). The commenter requested that Tier 3 and Tier 4 covered chemical facilities still be allowed to voluntarily participate.	The Department believes that 6 CFR 27.230(a)(12)(iv) mitigates the risk of an individual with terrorist ties having insider access. Terrorist insiders could cause significant harm to the United States through access to any tiered chemical facility. To achieve the anti-terrorism objective of CFATS, it is necessary to mitigate this risk by conducting terrorist ties checks at all covered facilities. RBPS 12 accordingly requires terrorist ties checks for facilities of all four tiers.
5.6.2	Value of PSP	One commenter questioned the effectiveness of the CFATS Personnel Surety Program if “absent a clear national security, homeland security, or law enforcement rationale … DHS does not follow-up with the company to alert it of the possible threat.” The commenter further stated that the “value of conducting TSDB screening is questionable if an identified bad actor is permitted continued access to [chemicals of interest] unbeknownst to the facility, which is in the best position to ensure that the person is not afforded that opportunity.”	The Department’s design of the CFATS Program is intended to promote and enhance the security of high-risk chemical facilities; the Personnel Surety Program is one element of the larger CFATS Program. To prevent a significant threat to a facility or loss of life, a high-risk chemical facility will be contacted where appropriate and in accordance with federal law and policy, and per law enforcement and intelligence requirements.

1 See Section 1(b)(3) of Public Law 114-278 which may be viewed at https://www.congress.gov/bill/114th-congress/house-bill/710/text/pl?overview=closed.

2 The Department described the options for screening for terrorist ties on page 82 FR 61313 of its 60-day notice which may be viewed at https://www.federalregister.gov/d/2017-27519/page-61313.

3 The term “groups” is a technical term used by the Department to describe how a covered chemical facility may manage the access to records about affected individuals in the CSAT Personnel Surety application. The Department describes “groups” and provides additional information about how to create and manage “groups in section 9.5 of the CSAT User Manual which may be viewed at https://www.dhs.gov/sites/default/files/publications/csat-portal-user-manual-508-2.pdf.

4 Information Collection 1670-0007 was approved by OMB on July 14, 2016. The Notice of Action and Information Collection 1670-0007 may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.

5 The Department described its assumptions, to include updates and corrections, about the estimated time per respondent on page 82 FR 61316 of its 60-day notice which may be viewed at https://www.federalregister.gov/d/2017-27519/page-61316.

6 The possibility of a company-wide approach is mentioned in: (1) the CFATS Personnel Surety Program 30-Day notice and request for comments published on February 3, 2014 at 79 FR 6422 that may be viewed at https://www.federalregister.gov/d/2014-02082/page-6422, and (2) the CFATS Personnel Surety Program 60-Day notice and request for comments published on March 22, 2013 at 78 FR 17684 that may be viewed at https://www.federalregister.gov/d/2013-06184/page-17684

7 The Department describes the potential for a company-wide approach in CFATS Personnel Surety Program Implementation Notice published on December 18, 2015 at 80 FR 79064 that may be viewed at https://www.federalregister.gov/d/2015-31625/page-79064.

8 Information Collection 1670-0007 was approved by OMB on July 14, 2016. The Notice of Action and Information Collection 1670-0007 may be viewed at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201604-1670-001.

9 This specific text from the CFATS Personnel Surety Program Implementation Notice may be found on 80 FR 79060 and can be viewed at https://www.federalregister.gov/d/2015-31625/page-79060.

4