1670-0035_CISA Vulnerability Assessments_SSB_FINAL

Supporting Statement B for Paperwork Reduction Act Submissions

Title: Post Assessment Questionnaires

OMB Control Number: 1670-0035

B. Collections of Information Employing Statistical Methods.



1. Describe (including numerical estimate) the potential respondent universe

and any sampling or other respondent selection method to be used. Data on the number of entities (e.g., establishments, State and local government units, households, or persons) in the universe covered by the collection and in the corresponding sample are to be provided in tabular form for the universe as a whole and for each of the strata in the proposed sample. Indicate expected response rates for the collection as a whole. If the collection has been conducted previously, include the actual response rate achieved during the last collection.

The Cybersecurity Infrastructure Security Agency (CISA) uses the Post Assessment Questionnaires to conduct a review of the effectiveness and adequacy of vulnerability assessments. The questionnaires are designed to be a simple customer feedback survey that CISA utilizes to make programmatic improvements, and will not involve robust statistical analysis.

The Post Assessment Questionnaires are generated each time a user enters an assessment into the system. However, participation in a Post Assessment questionnaire is voluntary.

Respondent Universe:

The potential universe of respondents includes any Federal State, regional, local, and tribal (SLTT) government and private sector users. The Post Assessment Questionnaires are open to the entire respondent pool. It is estimated that an average of 266 responses are received annually.

2. Describe the procedures for the collection of information including:

• Statistical methodology for stratification and sample selection,

Not applicable. The Post Assessment Questionnaires are open to 100% of the eligible audience; therefore, no statistical methodology was utilized to determine stratification and sample selection.

• Estimation procedure,

Not applicable.

• Degree of accuracy needed for the purpose described in the justification,

Not applicable.

• Unusual problems requiring specialized sampling procedures, and

Not applicable.

• Any use of periodic (less frequent than annual) data collection cycles to reduce burden.

Not applicable.

3. Describe methods to maximize response rates and to deal with issues of

non-response. The accuracy and reliability of information collected must be shown to be adequate for intended uses. For collections based on sampling, a special justification must be provided for any collection that will not yield “reliable” data that can be generalized to the universe studied.

Not applicable. The Post Assessment Questionnaires are open to 100% of the eligible audience; therefore, no statistical methodology was utilized to maximize response rates.

4. Describe any tests of procedures or methods to be undertaken. Testing is encouraged as an effective means of refining collections of information to minimize burden and improve utility. Tests must be approved if they call for answers to identical questions from 10 or more respondents. A proposed test or set of tests may be submitted for approval separately or in combination with the main collection of information.

Not applicable. The Post Assessment Questionnaires are a simple customer feedback form; therefore, no testing was utilized.

5. Provide the name and telephone number of individuals consulted on statistical aspects of the design and the name of the agency unit, contractor(s), grantee(s), or other person(s) who will actually collect and/or analyze the information for the agency.



Ricky Morgan

DHS CISA

[email protected]

3