1652-0066 SecTrngPrgm SS 2.27.2020

INFORMATION COLLECTION SUPPORTING STATEMENT

Security Programs for Surface Transportation Modes

(Security Training Program for Surface Transportation Employees Final Rule)

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information. (Annotate the CFR parts/sections affected).

The Transportation Security Administration (TSA) was established by the Aviation and Transportation Security Act (ATSA) as the primary federal authority to enhance security for all modes of transportation.¹ The scope of TSA’s authority includes assessing security risks, developing security measures to address identified risks, and enforcing compliance with these measures.² TSA also has broad regulatory authority to issue, rescind, revise, and enforce, regulations as necessary to carry out its transportation security functions.³

As part of the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act),⁴ Congress directed TSA to use its regulatory authority to enhance surface transportation security through regulations addressing the following issues: (1) security training of frontline public transportation, railroad, and over-the-road bus (OTRB) employees, including prescriptive requirements for who must be trained, what the training must encompass, and how to submit and obtain approval for a training program;⁵ (2) vetting of frontline employees and security coordinators;⁶ and vulnerability assessments and security plans for higher-risk operations.⁷ The 9/11 Act also mandates regulations requiring higher-risk railroads and OTRBs to appoint security coordinators.⁸

TSA’s final rule, Security Training for Surface Transportation Employees (final rule), sets-up a structure for a security program for surface transportation operations that would eventually incorporate all of the previous requirements mandated by the 9/11 Act. Through this final rule, TSA established the requirement for higher-risk public transportation agencies and passenger railroads (PTPR), freight railroads, and OTRBs to submit a security program to TSA for approval, with the first requirement to address security training of security-sensitive employees (a term defined to align with the 9/11 Act’s definition of “frontline employees”).⁹ TSA would address additional requirements for the security program in future rulemakings promulgated through the notice-and-comment process.

As described below, this final rule requires the collection of information to implement the regulatory requirements.

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

TSA would collect and use this information to validate compliance with the regulatory requirements. For purposes of the final rule, the regulated person (the person responsible for compliance and liable for failure to comply) is the owner/operator of the public transportation systems, railroads, and over-the-road bus companies within the final rule’s applicability. See infra, section 12, “Respondent Population Categories,” for more detail on the final rule’s applicability for security training requirements.

Security Training Program. Each person required to have a security training program would need to submit the program to TSA for approval to ensure that the program meets the required program elements. TSA would then review the program submitted to verify that the training program satisfies the regulatory requirements. TSA would use the information collected to approve the training program, or provide required modifications to be compliant with the regulation. Initial security training of security sensitive employees would be required one year from the date of TSA approval of the security training program. Recurrent security training would be required every three years from the date of the initial security training. As discussed in section II.J.2 of the final rule, owner/operators may use “refresher training” with a different curriculum, such as a shorter, refresher version of training, to meet the recurrent training. See also §§ 1580.113(b)(6), 1582.113(b)(6), 1584.113(b)(6) in the final rule. If the recurrent, refresher, security training materials differ from the initial security training materials, owner/operators would need to submit the recurrent training materials to TSA for approval. Owner/operators would also need to submit any revisions or updates of their training materials to TSA for approval.

Security Training Records. Each owner/operator would be required to maintain security training records for each individual trained for no less than five years from the date of the training. This record retention schedule is necessary to validate compliance with the requirement to provide triennial training. They would need to retain records at the location(s) specified in the security training program. Owner/operators would be required to make the records available to TSA upon request for inspection and copying. TSA would need this information to provide documentation regarding compliance with the requirement to provide training to employees consistent with the schedule specified by the final rule.

Security Coordinator Information. Rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk would be required to designate, and provide to TSA the contact information of a primary and at least one alternate Security Coordinator. This information collection applies to populations not currently covered under OMB 1652-0051 (Rail Transportation Security), which reflects the requirements in current 49 CFR part 1580. Security Coordinator contact information, submitted to TSA via email or regular mail, would provide a primary contact for intelligence information, security related activities, and communications with TSA concerning threat information, security procedures, or coordinating incident or threat responses with appropriate law enforcement and emergency response agencies.

Reporting Significant Security Concerns Information. Rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk would be required to report potential threats and significant security concerns to TSA, within 24 hours of initial discovery. This information collection applies to populations not currently covered under OMB 1652-0051 (Rail Transportation Security), which reflects the requirements in current 49 CFR part 1580. TSA uses this reported information to analyze trends and indicators of developing threats and potential terrorist activity.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden. [Effective 03/22/01, your response must SPECIFICALLY reference the Government Paperwork Elimination Act (GPEA), which addresses electronic filing and recordkeeping, and what you are doing to adhere to it. You must explain how you will provide a fully electronic reporting option by October 2003, or an explanation of why this is not practicable.]

TSA would comply with the GPEA to reduce the burden on covered entities by encouraging electronic submissions and retention of the information collections in this final rule.

Security Training Program. Each person subject to the regulatory requirements could submit their respective security training programs electronically, through email, or by regular mail. Implicit in this requirement is the necessity of ensuring the submission method chosen allows TSA access to the content.

Security Training Records. Each person subject to the regulatory requirements would have the latitude and flexibility to maintain the required security training records in a manner that best meets their particular needs, including maintaining the information electronically. An owner/operator could maintain and transfer records through electronic transmission, storage, and retrieval if they meet the standards required by the final rule. Implicit in this requirement is the necessity of ensuring the method used to maintain records does not prevent TSA’s access to the content of the records for purposes of inspection, review, and copying.

Security Coordinator Contact Information. Entities would submit security coordinator contact information via email or regular mail.

Reporting Significant Security Concerns Information. TSA would collect significant security concerns and associated information telephonically or by other electronic means designated by TSA.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purpose(s) described in Item 2 above.

This final rule requires reporting of significant security concerns. The rule provides examples of what constitutes a “security concern.” It is not an “all hazards” reporting requirement. Particularly as there are other agencies with responsibility for all hazards. For example, the Coast Guard is the federal point of contact for reporting all hazardous substances releases and oil spills to inform response and recovery efforts. TSA’s purpose for collecting this information is not oriented to accidents but rather to discern potential threats and significant security concerns.

Implementation of the final rule would also result in information collected to determine if a covered entity’s security-sensitive employees are being provided effective security training and to establish a seamless and expeditious capability to contact industry for communicating intelligence information. TSA contacted the relevant modal administrations of the Department of Transportation (DOT), including the Pipeline and Hazardous Materials Safety Administration (PHMSA) and the Federal Railroad Administration (FRA); and the Nuclear Regulatory Commission who concur that these reporting requirements are not duplicative of their respective requirements because each supports a particular agency mission and programmatic purpose.

5. If the collection of information has a significant impact on a substantial number of small businesses or other small entities (Item 5 of the Paperwork Reduction Act submission form), describe the methods used to minimize burden.

This collection does not have a significant impact on a substantial number of small businesses or other small entities.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

If the information is not collected in the manner prescribed by the final rule, TSA would not be able to achieve the congressionally mandated requirement set forth in the 9/11 Act. Lack of this information would hinder TSA’s responsibility to assess vulnerabilities and carryout requirements to protect the traveling public and secure the Nation’s surface transportation system.

Security Training Program. Without the collection of security training programs from persons subject to the regulatory requirements, TSA would be unable to verify if regulated owner/operators are fulfilling the requirements of this regulation or provide feedback when a security training program warrants modification. If TSA determines the program submitted meets the regulatory requirements, the owner/operator would not need to submit additional programs to TSA unless or until amendments or updates are required. If modifications are required, the owner/operator would need to re-submit their training program as many times as necessary to obtain TSA-approval. As such, it is not practical for TSA to reduce the frequency of collection.

Security Training Records. Without a security training records requirement, TSA would be unable to verify that a person subject to the regulatory requirements is complying with the final rule’s requirements in the manner and schedule stipulated in the TSA-approved training program. A less frequent retention schedule would adversely affect the inspection process and impede verification of compliance with a regulatory requirement.

Security Coordinator Information. TSA is responsible for sharing intelligence and other risk information relevant to the transportation industry. Lack of security coordinator information impedes TSA’s ability to share information, potentially resulting in diminished capability for the industry and government to assess and respond to threats, incidents, and other security-related actions.

Significant Security Concerns Information. The lack of reporting of significant security concerns impedes TSA’s ability to analyze potential security-risk information and recognize trends that warrant a Federal response.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with the general information collection guidelines in 5 CFR 1320.5(d)(2).

Based on the reasons discussed above, the purposes of this information collection would not be met if collection is conducted in a manner consistent with the general information collection guidelines of 5 CFR 1320.5(d)(2)(i) and 5 CFR 1320.5(d)(2)(iv).

• In order for TSA to analyze potential security-risk information and recognize trends warranting a federal response, it is critical for the regulated entities to report significant security concerns within 24 hours of initial discovery. Quarterly reporting would not meet this purpose.

• Under the final rule, TSA provides for owner/operators to recognize security training that employees may have received from another employer if it meets the regulatory requirements. TSA believes owner/operators need to maintain training records for no less than three years to ensure the information is available for documentation of previous training.

8. Describe efforts to consult persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d) soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

TSA consulted with key stakeholders during the development of the regulatory requirements relating to this information collection, including industry representatives, governmental authorities, security experts, first responders, and employee representatives. TSA has attempted to obtain additional views of persons outside the agency through various Government Coordinating Councils (GCCs), Sector Coordinating Councils (SCCs), and Peer Advisory Groups (PAGs). Furthermore, TSA solicited comments on the information collection requirements described in the NPRM. See 81 FR 91336 (December 16, 2016).

TSA received public comments to the NPRM, which proposed requiring recurrent training annually and all training records to be maintained for 5 years from the date of training. Two commenters said that the proposed 5-year record-keeping requirement would be burdensome, and as an alternative, they suggested owner/operators should only be required to retain training from only the past three years. In response to the comments, TSA adjusted the frequency of recurrent training to once every three years rather than annually. Based upon this revised schedule for recurrent training, TSA is maintaining the requirement to retain records for 5 years as the minimum necessary to provide adequate records of compliance.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

TSA would not provide any payment or gift to respondents.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

While there is no assurance of confidentiality provided to the respondents, TSA protects information collected from disclosure to the extent appropriate under applicable provisions of the Freedom of Information Act, Federal Information Security Management Act, E-Government Act, and Privacy Act of 1974. TSA would also appropriately treat any information collected that it determines is Sensitive Security Information (SSI) and/or Personally Identifiable Information (PII), consistent with the requirements of 49 CFR part 1520 and OMB Guidance, M-07-16.

PIA coverage for this collection is provided under DHS/TSA/PIA-029 TSA Operations Center Incident Management System. This PIA outlines the use of the WebEOC incident management system to perform incident management, coordination, and situational awareness functions for all modes of transportation.

11. Provide additional justification for any questions of sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

TSA would not ask any questions of sensitive nature.

12. Provide estimates of hour burden of the collection of information.

In this justification, TSA describes the respondent population and then presents a summary of each of the information collections covered by this ICR.¹⁰

Respondent Population Categories

1. Freight Railroad Owner/operators: Freight Railroad owner/operators that fall within the applicability for security training requirements under 49 CFR § 1580.101 would submit information regarding security training programs under this ICR. The scope is limited to Class I freight railroads and freight railroads that transport Rail Security Sensitive Material (RSSM) in High Threat Urban Areas (HTUA) or that host higher-risk passenger operations. Thirty-three (33) unique freight railroads owner/operators fall within this scope and would be annual respondents in this analysis. TSA estimated the number of freight railroad owner/operators using TSA data on RSSM shipments. TSA does not expect any growth in the number of freight railroad owner/operators that would fall under this ICR. This population is already submitting information regarding security coordinators and significant security concerns, approved under OMB 1652-0051 (Rail Transportation Security).

2. Public Transportation and Passenger Railroad Owner/operators: Public Transportation and Passenger Railroad (PTPR) owner/operators that fall within the applicability for security training requirements under 49 CFR § 1582.101 would submit responses under this ICR. This includes Amtrak (also known as the National Railroad Passenger Corporation) and public transportation and passenger railroads that operate in the eight higher-risk public transportation regions listed in Appendix A of part 1582. TSA has identified 47 PTPR owner/operators as high-risk based on various factors including, but not limited to, ridership, geographic location, proximity to critical infrastructure. A significant portion of this population is currently required to submit information regarding security coordinators and significant security concerns under 49 CFR part 1580. Information collection from that portion of the population is approved under OMB 1652-0051 (Rail Transportation Security).

3. OTRB Owner/operators: Over-the-Road Buses (OTRB) owner/operators fall within the applicability for security training requirements under 49 CFR § 1584.101. This applicability includes OTRB operations that provide fixed-route service in high-risk areas identified in Appendix A of part 1584. TSA relied on a variety of sources, both public and private, to determine the number of OTRB owner/operators covered by the final rule’s applicability. TSA estimates 205 OTRB operators would meet this applicability in the first year of the final rule. TSA assumes the population of OTRB owner/operators would grow at a 1.93 percent annual rate throughout the period of analysis.¹¹ Based on a 1.93 percent annual growth rate, TSA estimates that this population would grow to 209 operators in the second year and 213 operators in the third year. Given this information, TSA estimates the total number of unique OTRB owner/operators respondents is 213 in the first three years of the final rule. TSA categorizes 33 of the 213 companies as large to medium and 181 as small.

Table 1: Respondent Summary

Respondent Category	Year 1	Year 2	Year 3	Average Annual Respondents
Freight Rail	33	33	33	33
PTPR	47	47	47	47
OTRB (Large to Medium Operator)	31	32	33	32
OTRB (Small Operator)	174	177	181	177
OTRB (Total)	205	209	213	209
All Respondents (Freight Rail, PTPR, and OTRB)	285	289	293	289
Note: Calculations may not be exact due to rounding.

Information Collection

This information collection requires that each respondent submit training programs and security coordinator information in the first year after a final rule takes effect. Additionally, each respondent would maintain employee training records after each training session and submit incident reports whenever necessary. TSA estimates the average annual burden in hours for each respondent category and the costs associated with them below. Calculations in this section may not total exactly due to rounding in the text.

Security Training Program Creation and Submission. The final rule would require that respondents submit training programs to TSA. TSA assumes respondents would develop a training program only once in the first three years of the final rule.

1. Freight Railroad Owner/operators: TSA estimates the total number of unique freight railroad respondents to be 33 owner/operators over the three-year period. TSA estimates that each freight railroad owner/operator would spend 152 hours creating and submitting its training program. TSA estimates an average annual hour burden of 1,672 hours by multiplying the program creation and submission time by the number of respondents (152 hours x 33 freight railroad owner/operators), then dividing by 3 years (5,016 hours ÷ 3 years). TSA estimates the average annual cost by multiplying the hour burden by the weighted industry compensation rate for a freight rail manager ($98.0436).¹² The average annual cost burden for freight railroad security training program creation is $163,929 (1,672 hours x $98.0436).

2. Public Transportation and Passenger Railroad Owner/operators: TSA estimates the total number of unique PTPR respondents to be 47 owner/operators over the three-year period. TSA estimates that each PTPR respondent would spend 88 hours creating and submitting a training program. TSA estimates an average annual hour burden of 1,378.67 hours by multiplying the program creation and submission time by the number of respondents (88 hours x 47 PTPR owner/operators), then dividing by 3 years (4,136 hours ÷ 3 years). TSA estimates the average annual cost by multiplying the hour burden by the weighted industry compensation rate for a PTPR manager ($87.18095).¹³ The average annual cost burden for PTPR security training program creation is $120,193 (1,378.67 hours x $87.18095).

3. OTRB Owner/operators: TSA estimates that approximately 33 owner operators over the three-year period would be considered “Large to Medium” and require more time to create and submit training programs than smaller owner/operators require. TSA estimates that these owner/operators, in the first three years after the final rule’s effective date, would require an hour burden of 44 hours each to create and submit a training program. TSA multiplies the 44 hours by the 32.6994 owner/operators to calculate a total of 1,438.76¹⁴ hours for the three-year period of this ICR (44 hours x 32.6994 Large to Medium OTRB owner/operators). TSA then divides the 1,438.76 hours by 3 years to estimate the average annual time burden of 479.59 hours for Large to Medium OTRB owner/operators. TSA estimates the average annual cost by multiplying the average annual hour burden by the average industry compensation rate for an OTRB manager ($76.81)¹⁵. The total average annual cost burden for Large to Medium OTRB owner/operators is $36,837 (479.59 hours x $76.81).

TSA estimates approximately 181¹⁶ OTRB respondents are “small” over the three-year period and would spend 28 hours to create and submit their training program. TSA estimates that these owner/operators, in the first three years after a final rule takes effect, would require an hour burden of 28 hours each, to create and submit a training program. TSA multiplies the 28 hours by the total respondents to calculate a total of 5,062.2 hours for the three-year period of this ICR (28 hours x 180.7929 Small OTRB owner/operators). TSA then divides the 5,062.2 hours by 3 years to estimate the average annual time burden of 1,687.4 hours for Small OTRB owner/operators. TSA estimates the average annual cost by multiplying the average annual hour burden by the average industry compensation rate for an OTRB manager ($76.81). The total average annual cost burden for Small OTRB owner/operators is $129,609 (1,687.4 hours x $76.81).

Modifications. Respondents affected by the Security Training final rule may be required to make modifications to their security training program before TSA would approve it. TSA assumes 90 percent of owner/operators covered in the final rule would be modifying their security training programs after their initial submission for TSA review.

1. Freight Railroad Owner/operators: TSA estimates that approximately 30¹⁷ freight railroad respondents would need to make modifications to their security training program before approval during the three-year period. TSA estimates that each modification would have a time burden of 25 hours for the operators. TSA estimates an hour burden of 742.5 hours (29.7 freight railroad program modifications x 25 hours) for the three-year period of this ICR. TSA then divides this total by three years to estimate an annual hour burden of 247.5 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for a freight rail manager ($98.044). TSA estimates an average annual cost of $24,266 (247.5 annual hours x $98.044) for freight railroad modifications.

2. Public Transportation and Passenger Railroad Owner/operators: TSA estimates that 42.3 (47 x 0.9) PTPR respondents would need to make modifications to their security training program before approval during the three-year period. TSA estimates that each modification would have a time burden of 25 hours per PTPR owner/operator. TSA estimates an hour burden of 1,057.5 hours (42.3 PTPR program modifications x 25 hours) for the three-year period of this ICR. TSA then divides this total by three years to estimate an annual hour burden of 352.5 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for a PTPR manager ($87.18). TSA estimates an average annual cost of $30,731 (352.5 annual hours x $87.18) for PTPR modifications.

3. Large to Medium OTRB Owner/operators: TSA estimates that approximately 29¹⁸ Large to Medium OTRB respondents would need to make modifications to their security training program before approval during the three-year period. TSA estimates that each modification would have a time burden of 25 hours for the operators. TSA estimates an hour burden of 735.725 hours (29.429 Large to Medium OTRB owner/operators x 25 hours) for the three-year period of this ICR. TSA then divides this total by three years to estimate an annual hour burden of 245.242 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for an OTRB manager ($76.81). TSA estimates an average annual cost of $18,837 (245.242 annual hours x $76.81) for Large to Medium OTRB modifications.

4. Small OTRB Owner/operators: TSA estimates that 163¹⁹ Small OTRB respondents would need to make modifications to their security training program before approval during the three-year period. TSA estimates that each modification would have a time burden of 25 hours for the operators. TSA estimates an hour burden of 4,067.84 hours (162.7136 Small OTRB owner/operators x 25 hours) for the three-year period of this ICR. TSA then divides this total by three years to estimate an annual hour burden of 1,355.95 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for an OTRB manager ($76.81). TSA estimates an average annual cost of $104,150 (1,355.95 annual hours x $76.81) for Small OTRB modifications.

Security Coordinator. The Security Training final rule would require that each respondent appoint a security coordinator and alternate, and submit their contact information to TSA.

1. Public Transportation and Passenger Railroad Owner/operators: TSA estimates that of the 47 unique PTPR respondents, 23 respondents do not currently have security coordinators. Based on TSA’s security coordinator data, TSA estimates existing freight and passenger railroad owner/operators, required to submit security coordinator information to TSA based on 49 CFR §§ 1580.101 and 1580.201, submit approximately 2.27 security coordinator submissions per owner/operator, which includes owner/operators submitting coordinators and alternates and replacing security coordinators from turnover. Given this data, TSA estimates 64.39 security coordinator submissions²⁰ within the three-year period of this ICR. TSA estimates each response would have a time burden of 0.5 hours. TSA estimates a total hour burden of 32 hours for the three-year period of this ICR. TSA then divides the total by three years to estimate an annual hour burden of 11 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for a PTPR manager ($87.18). The average annual cost of PTPR owner/operators security coordinator information submittal is $935 (10.7312 hours x $87.181).

2. OTRB Owner/operators: TSA estimates that the 213 OTRB respondents would submit security coordinator and alternate information to TSA. TSA uses the previous security coordinator submission estimate per owner/operator to estimate 597.39 submissions²¹ for OTRB owner/operators during the three-year period which includes owner/operators submitting coordinators and alternates, new submissions from new owner/operators, and replacing security coordinators from turnover. TSA estimates each response would have a time burden of 0.5 hours. TSA estimates an hour burden of 299 hours for the three-year period of this ICR. TSA then divides the total by three years to estimate an annual hour burden of 100 hours. TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for an OTRB manager ($76.81). The average annual cost of OTRB owner/operators security coordinator information submittal is $7,647.5 (100 hours x $76.81).

Recordkeeping. The Security Training final rule would require that respondents maintain the training records of their security-sensitive employees. Respondents would need to maintain the status of an employee’s training in the records. The average annual responses would vary depending on the number of employees that an owner/operator trains in a given year.

1. Freight Railroad Owner/operators: TSA estimates freight railroad operators would average 48,556 records per year.²² TSA estimates that each record would have a time burden of 1 minute (0.016666667 hours). TSA estimates an average annual time burden of 809.27 hours by multiplying the average annual number of records by the time burden (48,556 responses x 0.016666667 hours). TSA estimates the average annual cost by multiplying the average annual time burden by the weighted industry compensation rate for a freight rail manager ($65.0255).²³ The average annual cost of freight railroad carrier recordkeeping is $52,623 (809.27 hours x $65.0255).

2. Public Transportation and Passenger Railroad Owner/operators: TSA estimates that the 47 PTPR respondents would file training records in each of the first three years. TSA estimates PTPR owner/operators would average 80,214 records throughout the first three years of the final rule.²⁴ TSA estimates that each record would have a time burden of 1 minute (0.016666667 hours). TSA estimates an average annual time burden of 1336.91 hours by multiplying the average annual number of records by the time burden of one response (80,214 responses x 0.016666667 hours). TSA estimates the average annual cost by multiplying the average annual time burden by the average industry compensation rate for a PTPR manager ($35.5488).²⁵ The average annual cost of PTPR owner/operators recordkeeping is $47,526 (1,336.91 hours x $35.5488).

3. OTRB Owner/operators: TSA estimates that the 205 OTRB initial respondents would file training records in each of the first year, while four new respondents would enter the market in the second year of the final rule, and four respondents would enter in the third year. This results in a total of 213 respondents which TSA estimates would average 16,498 records throughout the first 3 years of the final rule.²⁶ TSA estimates that each response would have a time burden of 1 minute (0.016666667 hours). TSA estimates an average annual time burden of 274.97 hours by multiplying the average annual number of records by the time burden of one response (16,498 responses x 0.016666667 hours). TSA estimates the average annual cost by multiplying the average annual time burden by the average industry compensation rate for an OTRB manager ($25.598).²⁷ The average annual cost of OTRB owner/operators recordkeeping is $ 7,039 (274.97 hours x $25.598).

Incident Reporting. The Security Training final rule would require that respondents report significant security incidents to TSA. TSA uses internal historical data on incident reporting to estimate the annual number of responses per respondent.

1. Public Transportation and Passenger Railroad Owner/operators: TSA estimates that of the 47 PTPR respondents, 23 respondents do not currently have to report significant security incidents to TSA. TSA estimates that these respondents would report an annual average of 4,652.4 incidents throughout the first three years of the final rule. Based on internal historical evidence, TSA estimates that each response would require three minutes (0.05) hours of time. TSA estimates an average annual hour burden of 232.62 hours (4,652.4 x 0.05 hours) by multiplying the average annual number of reports by burden of time. TSA estimates the average annual cost by multiplying the average annual hour burden by the average industry compensation rate for a PTPR manager ($87.18095). The average annual cost of incident reporting for PTPR owner/operators is $20,280.03 (232.62 hours x $87.18095).

2. OTRB Owner/operators: TSA estimates that the 213 OTRB respondents who would report significant security incidents to TSA during the first three years of this ICR, would report an annual average of 42,695.7 incidents throughout the first three years. Based on internal historical evidence, TSA estimates that each response would require three minutes (0.05 hours) of time. TSA estimates an average annual hour burden of 2,134.78 hours by multiplying the average annual number of reports by the hours of time (42,695.7 incidents x 0.05 hours). TSA estimates the average annual cost by multiplying the average annual hour burden by the average industry compensation rate for an OTRB manager ($76.81) The average annual cost of incident reporting for OTRB owner/operators is $163,972 (2,134.78 hours x $76.81).

The Table 2 displays the information collection burden estimates for the surface training rule requirements.

Table 2: Average Annual Cost Burden Estimate for Surface Owner/Operators

Collection	Time Per Response (hours)	Number of Responses			3-Year Time Burden	Average Annual Time Burden	Compensation Rate	Average Annual Cost Burden
		Year 1	Year 2	Year 3
	A	B	C	E	F = A x (B+C+D)	G = F / 3	H	I = G x H
Initial Security Training Program Development and Submission
Freight Rail	152	33	0	0	5,016	1,672	$98.04	$163,929
PTPR	88	47	0	0	4,136	1,379	$87.18	$120,193
OTRB (Large to Medium )	44	31	1	1	1,439	480	$76.81	$36,837
OTRB (Small )	28	174	3	3	5,062	1,687	$76.81	$129,609
Modified Security Training Program Development and Submission
Freight Rail	25	30	0	0	743	248	$98.04	$24,266
PTPR	25	42	0	0	1,058	353	$87.18	$30,731
OTRB (Large to Medium)	25	28	1	1	736	245	$76.81	$18,837
OTRB (Small)	25	157	3	3	4,068	1,356	$76.81	$104,150
Security Coordinator Information Submission
PTPR (Bus only entities)	0.5	52	6	6	32	11	$87.18	$936
OTRB	0.5	466.95	64.59	65.84	299	100	$76.81	$7,648
Employee Training Documentation Recordkeeping
Freight Rail	0.017	136,155	4,750	4,764	2,428	809	$65.03	$52,623
PTPR	0.017	194,219	23,173	23,251	4,011	1,337	$35.55	$47,525
OTRB	0.017	39,147	5,142	5,206	825	275	$25.60	$7,039
Incident Reporting
PTPR	0.05	4,652	4,652	4,652	698	233	$87.18	$20,280
OTRB	0.05	41,881	42,691	43,516	6,404	2,135	$76.81	$163,972
Total Burden (responses)					579,070	193,023
Total Burden (hours)					36,953	12,318
Average Annual Total Cost								$928,575

Note: Calculations may not be exact due to rounding in the table.

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information.

While the final rule allows for electronic recordkeeping in order to demonstrate compliance, if regulated entities opted to keep paper records, TSA estimates a printing cost of $0.03828²⁸ per record. For the purposes of this analysis, conservatively TSA multiplies the annual average number of training records for freight railroads, public transportation and passenger railroads, and OTRB operators, 48,556, 80,214, and 16,498, by $0.038 to get a total recordkeeping costs of $ $5,561 per year.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, and other expenses that would not have been incurred without this collection of information

TSA estimates the total cost to the Federal Government associated with the information collections identified in this request amount to be approximately $228,933 annually. More detailed information about how TSA estimated these Federal Government costs is provided below.

Security Program Reviews:

1. Freight Railroad Reviews. For purposes of this ICR, TSA categorizes each freight railroad owner/operator security program into one of two categories – large and non-large.²⁹ TSA estimates a total of 7 large security program reviews and 26 non-large security program reviews over the three-year period. TSA estimates each review would require a review burden of 40 hours. TSA calculates a total of 280 hours for large security program reviews and a total of 1,040 hours for non-large security program reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 93 hours for large security program reviews and an annual hour burden of 347 hours for non-large security program reviews for this ICR. TSA assumes a team lead is expected to perform large security program reviews, and a TSA analyst is expected to perform non-large security program reviews. TSA estimates an average compensation rate of $78.65 for team lead³⁰ and an average compensation rate of $44.60 for an analyst.³¹

2. Public Transportation and Passenger Railroad Reviews. For purposes of this ICR, TSA categorizes each PTPR owner/operator security program into one of two categories – large and non-large. TSA estimates a total of 1 large security program review and 41.3 non-large security program reviews over the three-year period. TSA estimates each review would require a review burden of 40 hours. TSA calculates a total of 40 hours for large security program reviews and a total of 1,652 hours for non-large security program reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 13 hours for large security program reviews and an annual hour burden of 551 hours for non-large security program reviews for this ICR. TSA assumes a team lead is expected to perform large security program reviews, and a TSA analyst is expected to perform non-large security program reviews. TSA estimates an average compensation rate of $78.65 for team lead and an average compensation rate of $44.60 for an analyst.

3. OTRB Reviews. For purposes of this ICR, TSA categorizes each OTRB owner/operator security program into one of two categories – large and non-large. TSA estimates a total of 3 large security program reviews and 210.492 non-large security program reviews over the three-year period. TSA estimates each review would require a review burden of 20 hours. TSA calculates a total of 60 hours for large security program reviews and a total of 4,210 hours for non-large security program reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 20 hours for large security program reviews and an annual hour burden of 1,403 hours for non-large security program reviews for this ICR. TSA assumes a team lead is expected to perform large security program reviews, and a TSA analyst is expected to perform non-large security program reviews. TSA estimates an average compensation rate of $78.65 for team lead and an average compensation rate of $44.60 for an analyst.

Security Program Modification Reviews:

1. Freight Railroad Modification Reviews. TSA estimates a total of 6.3 large security program modifications and 23.4 non-large security program modifications would occur over the three-year period of this ICR. TSA estimates both modification reviews would require a burden of 4 hours. TSA calculates a total of 25 hours for large security program modification reviews and a total of 94 hours for non-large security program modification reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 8 hours for large security program modification reviews and an annual hour burden of 31 hours for non-large security program modification reviews for this ICR. TSA assumes a team lead is expected to perform large security program modification reviews, and a TSA analyst is expected to perform non-large security program modification reviews. TSA estimates an average compensation rate of $78.65 for team lead and an average compensation rate of $44.60 for an analyst.

2. Public Transportation and Passenger Railroad Modification Reviews. TSA estimates 2 large security program modifications and 40.4 non-large security program modifications would occur over the three-year period of this ICR. TSA estimates both modification reviews would require a burden of 2 hours. TSA calculates a total of 4 hours for large security program modification reviews and a total of 81 hours for non-large security program modification reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 1 hour for large security program modification reviews and an annual hour burden of 27 hours for non-large security program modification reviews for this ICR. TSA assumes a team lead is expected to perform large security program modification reviews, and a TSA analyst is expected to perform non-large security program modification reviews. TSA estimates an average compensation rate of $78.65 for team lead and an average compensation rate of $44.60 for an analyst.

3. OTRB Modification Reviews. TSA estimates 3 large security program modifications and 189 non-large security program modifications would occur over the three-year period of this ICR. TSA estimates both modification reviews would require a burden of 2 hours. TSA calculates a total of 6 hours for large security program modification reviews and a total of 378 hours for non-large security program modification reviews for the three-year period of this ICR. TSA estimates an annual hour burden of 2 hours for large security program modification reviews and an annual hour burden of 126 hours for non-large security program modification reviews for this ICR. TSA assumes a team lead is expected to perform large security program modification reviews, and a TSA analyst is expected to perform non-large security program modification reviews. TSA estimates an average compensation rate of $78.65 for team lead and an average compensation rate of $44.60 for an analyst.

Security Coordinator Information. Review and filing of security coordinator information cost burden on the Federal government was determined by multiplying the estimated number of submissions of each covered mode of transportation by a review time of 10 minutes (0.167 hours) for the average annual hour burden. TSA estimates that a total of 64 submissions of security coordinator contact information would be sent by PTPR owner/operators in the first three years while OTRB owner/operators would submit an estimated 597 in the same time period. This estimate takes into account new security coordinators and the replacement of security coordinators from turnover. The average annual hour burden from these submissions was then multiplied by the TSA compensation rate of a TSA analyst of $44.60 to provide annual cost burden.

Incident Reporting. Reporting of incidents cost burden on the Federal government was determined by approximating the number of reports submitted annually by each covered mode of transportation and multiplying it by the estimated time of 3 minutes (0.05 hours) to complete a report for the average annual hour burden. TSA estimates that an annual average of 4,652 and 42,696 significant security incidents would be reported to TSA in the first three years by PTPR and OTRB owner/operators, respectively. The average annual hour burden from these submissions was then multiplied by the TSA compensation rate of TSA analyst of $44.60 to provide the annual cost burden.

Table 3 shows TSA costs for information collections associated with each of the respondents.

Table 3: TSA Cost by Respondent to Process Information Collection

Collection	Time Per Response (hours)	Number of Responses			3-Year Time Burden	Average Annual Time Burden	TSA Compensation Rate	Average Annual Cost Burden
		Year 1	Year 2	Year 3
	A	B	C	E	F = A x (B+C+D)	G = F / 3	H	I = G x H
Initial Security Training Program Review
Freight Rail (Large Training Program)	40	7	0	0	280	93	$78.65	$7,340
Freight Rail (Non-large Training Program)	40	26	0	0	1,040	347	$44.60	$15,461
PTPR(Large Training Program)	40	1	0	0	40	13	$78.65	$1,049
PTPR (Non-large Training Program)	40	41	0	0	1,652	551	$44.60	$24,560
OTRB (Large Training Program)	20	3	0	0	60	20	$78.65	$1,573
OTRB (Non-large Training Program)	20	202	4	4	4,210	1,403	$44.60	$62,587
Modified Security Training Program Review
Freight Rail (Large Training Program)	4	6	0	0	25	8	$78.65	$661
Freight Rail (Non-large Training Program)	4	23	0	0	94	31	$44.60	$1,392
PTPR(Large Training Program)	2	2	0	0	4	1	$78.65	$100
PTPR (Non-large Training Program)	2	40	0	0	81	27	$44.60	$1,201
OTRB (Large Training Program)	2	3	0	0	6	2	$78.65	$163
OTRB (Non-large Training Program)	2	182	4	4	378	126	$44.60	$5,620
Security Coordinator Information Review
PTPR	0.1666667	52	6	6	11	4	$44.60	$160
OTRB	0.1666667	467	65	66	100	33	$44.60	$1,480
Incident Reporting
PTPR	0.05	4,652	4,652	4,652	698	233	$44.60	$10,375
OTRB	0.05	41,881	42,691	43,516	6,404	2,135	$44.60	$95,212
Total Burden (responses)					143,259
Total Burden (hours)					15,082	5,027
Average Annual Total Cost								$228,933

Note: Calculations may not be exact due to rounding in the table.

.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I.

TSA revised its burden estimates from the previous Information Collection Request submission in 2016. Data used in this submission are based on the security programs’ training content being a combination of the video and custom training, which increased the burden. TSA updated the freight railroad and OTRB respondents (see question 12). In addition, TSA updated the program creation and submission time for freight rail, PTPR, and OTRB owner/operators. TSA updated the program modification time for OTRB owner/operators. TSA updated the BLS wages and TSA team lead and analyst average compensation rates.

16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

TSA would not publish the results of this collection.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

TSA is not seeking such approval.

18. Explain each exception to the certification statement identified in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

TSA is not seeking any exceptions.

1 Pub. L. 107-71, 115 Stat. 597 (Nov. 19, 2001). ATSA created TSA as a component of the Department of Transportation (DOT). Section 403(2) of the Homeland Security Act of 2002 (HSA), Pub. L. 107-296, 116 Stat. 2135 (Nov. 25, 2002), transferred all functions related to transportation security, including those of the Secretary of Transportation and the Under Secretary of Transportation for Security, to the Secretary of Homeland Security. Pursuant to DHS Delegation Number 7060.2, the Secretary delegated to the Administrator, subject to the Secretary’s guidance and control, the authority vested in the Secretary with respect to TSA, including the authority in sec. 403(2) of the HSA.

2 See 49 U.S.C. 114, which codified section 101 of ATSA.

3 Id.

4 Pub. L. 110-53, 121 Stat. 266 (Aug. 3, 2007).

5 See secs. 1408, 1517, and 1534 of the 9/11 Act, codified at 6 U.S.C. 1137, 1167, and 1184, respectively.

6 Id. at secs. 1411, 1512, 1520, and 1531, as codified at 6 U.S.C. 1411, 1512, and 1531 (section 1520 of the 9/11 Act is uncodified).

7 Id. at secs. 1405, 1512, and 1531, as codified at 6 U.S.C. 1405, 1512, and 1531.

8 See secs. 1512 and 1531 of the 9/11 Act, codified at 6 U.S.C. 1162 and 1181, respectively. TSA addresses 1512(e)(1)(A) and 1531(e)(1)(A) in the final rule. TSA intends to address the other regulatory requirements of these provisions in separate rulemakings.

9 Definitions can be found in sec. 1402 and 1501 of the 9/11 Act, as codified at 6 U.S.C. 1131 and 1151.

10 See section 2.2 Population Affected in the final rule Regulatory Impact Analysis for details on the estimation of the population of owner/operators.

11 U.S. Census Bureau, “Transit and Ground Passenger Transportation: 2002”, 2002 Economic Census, pg. 1, Table 1, metric of “establishments”, http://www.census.gov/prod/ec02/ec0248i07t.pdf. Accessed on April 12, 2017. https://factfinder.census.gov/faces/nav/jsf/pages/searchresults.xhtml?refresh=t. Accessed on April 12, 2017. Growth rate is equal to Compound Annual Growth Rate (CAGR) from 2002 to 2012 of the sum of establishment populations of the following NAICS codes: 4859 (other transit and ground passenger transportation system), 4855 (charter bus industry), 485113 (bus and other motor vehicle transit systems), and 4852 (interurban and rural bus transportation). These NAICS codes were chosen because they were seen as representative of the general bus industry. CAGR = [(6,840 ÷ 5,648)^{(1÷ (2012 - 2002))}] – 1 = 0.0193.

12 TSA uses a weighted average of Bureau of Labor Statistics (BLS) and AAR data to calculate a freight railroad manager’s compensation rate for Class I, II, and III railroads. See section 2.3.1 in the Security Training final rule RIA for details on the estimation of this compensation rate. $98.0436 is the fully loaded hourly weighted average compensation rate.

13 TSA uses the BLS Transit Manager wage rate and multiplies it by a compensation factor of 1.73 to get an hourly compensation rate of $87.18095. See section 2.3.2 in the Security Training final rule RIA for details on the estimation of this compensation rate.

14 The three-year average estimate of 32.699 OTRB Medium to Large owner/operators x 44 hours = 1438.76 hours over three years.

15 TSA uses the BLS OTRB manager wage rate and multiplies it by a compensation factor of 1.51 to get an hourly compensation rate of $76.8096. See section 2.3.3 in the Security Training final rule RIA for details on the estimation of this compensation rate.

16 Estimated 180.7929 OTRB respondents are “small” over the three-year period.

17 29.70 modifications over three years = 7 large railroads x 0.9 submit program modifications + 26 medium to small railroads x 0.9.

18 29.429 Medium to Large OTRB owner/operator modifications = 32.699 Medium to Large OTRB owner/operators over three years x 0.9 submit program modifications.

19 162.7136 Small OTRB owner/operator modifications = 180.7929 Small OTRB owner/operators over three years x 0.9 submit program modifications.

20 Based on RSC data, TSA estimates 52.27 submissions in year one and 6.06 submissions in both years two and three of this ICR.

21 TSA estimates 466.95 submissions in year one, 64.59 submissions in year two, and 65.84 submissions in year three.

22 TSA estimates a total of 136,155.1 freight railroad employees in year one, 4,750 employees in year two, and 4,764 employees in year three.

23 See section 2.3.1 in the Security Training final rule RIA for details on the estimation of this compensation rate.

24 TSA estimates a total of 194,219 PTPR employees in year one, 23,173 employees in year two, and 23,251 employees in year three.

25 See section 2.3.2 in the Security Training final rule RIA for details on the estimation of this compensation rate.

26 TSA estimates a total of 39,147 OTRB employees in year one, 5,142 employees in year two, and 5,206 employees in year three.

27 See section 2.3.3 in the Security Training final rule RIA for details on the estimation of this compensation rate.

28 $0.03828 obtained by adding $0.0213 for black & white ink per page (calculated by taking average of Xerox Black-and-White Multifunction Printers’ consumable quotes http://callcds.com/pdf/Cost%20Per%20Prints.pdf) and $0.017 per piece of paper ($8.49 for 500 sheets; http://www.staples.com/Staples-Multipurpose-Paper-8-1-2-x-11-500-Ream-513099-WH-/product_513099). Accessed on August 18, 2018.

29 TSA categorizes the security programs based on the estimated complexity of the overall security program. In categorizing an owner/operator’s security program as either large or non-large, TSA is not considering the size of the owner/operator, rather the details contained in the security program itself.

30 TSA uses a fully loaded J band wage divided by 2,087 annual hours to calculate the annual hour wage of a team lead.

31 TSA uses a fully loaded G/H/I blended wage divided by 2,087 annual hours to calculate the annual hour wage of a TSA analyst.