NRC New Collection_CUI Challenge Request Supporting Statement SM_NRC CUI Revised 20201119

FINAL OMB SUPPORTING STATEMENT

FOR

NRC CUI PROGRAM CHALLENGE REQUEST FORM

(3150-XXXX)

NEW

Description of the Information Collection

Controlled Unclassified Information (CUI) is a new information security program utilized by the executive branch. The CUI program is intended to standardize the way the executive branch handles unclassified information that, although unclassified, is still sensitive and merits special controls to prevent unauthorized access. It introduces a new framework for the entire executive branch to designate, mark, safeguard, and disseminate unclassified information that laws, regulations, or government-wide policies require or allow agencies to protect using safeguarding or dissemination controls.

The CUI program was established pursuant to Executive Order 13556, "Controlled Unclassified Information." The National Archives and Records Administration (NARA) has issued government-wide implementing regulations for executive branch agencies to implement the CUI program at 32 CFR Part 2002.

32 CFR 2002.50 “Challenges to Designation of Information as CUI” requires that agencies have a process to accept and manage challenges to CUI status (which may include improper or absent marking). In order to implement this requirement, the NRC staff has developed an online form for this purpose.

A. JUSTIFICATION

1. Need For and Practical Utility of the Collection of Information

32 CFR 2002.50 requires that agencies must create a process to accept and manage challenges to CUI status. At a minimum, the information collection requirements for this process are that it must provide an opportunity for the challenger to define a rationale for belief that the CUI in question is inappropriately designated and ensure that challengers who authorized holders are have the option of bringing such challenges anonymously.

The Nuclear Regulatory Commission (NRC) CUI Program Challenge Request Process is an online reporting mechanism that provides the process used for NRC CUI authorized holders to challenge the designation of information that has been marked as CUI as improperly or incorrectly designated. “Authorized holder” includes any individual or organization who has been provided with CUI and has a lawful government purpose to possess CUI. This can include NRC staff members, NRC contractors, licensees, an Agreement State, or a vendor that has a lawful government purpose to possess the information. Any authorized holder who believes they have received unmarked CUI, may use this process to formally notify the NRC CUI Senior Agency Official (SAO). The process also allows for the NRC CUI SAO and CUI Program Manager to process such requests and to issue a Final Decision from the CUI SAO.

The NRC CUI Challenge Request Process is not intended to be used to address all disagreements regarding the proper designation of CUI. Authorized holders are encouraged to seek or utilize less formal means when resolving internal good faith disputes over the proper designation of information as CUI, such as discussion with the creator or designator of the information in disputes. Where resolution cannot be achieved through less formal means, the CUI Challenge Request Process is available.

2. Agency Use of Information

The information requested in this collection is the minimum necessary for authorized holders to file a specific request challenging the designation of materials as CUI. The NRC uses this information to review CUI designations and to adjust these designations as needed. Each information request, along with the reason why the NRC is requesting such information, is provided below:

Requestor Information (Optional Field):

• This contact information is being collected so that the NRC can, if necessary, obtain clarifying information from the Requestor to assist with processing the Requestor’s CUI Challenge Request. This information will also enable the NRC to notify the Requestor of the NRC’s CUI Challenge Request Decision. To comply with 32 CFR 2002.50(c)(5), this is an Optional Field.

Are you requesting to remain anonymous?:

• This “Yes / No” question is being asked to ensure compliance with 32 CFR 2002.50(c)(5), which requires agencies to ensure that CUI Challenge Requests can be brought anonymously. The response to this question will greatly assist the NRC CUI Program in properly handling the CUI Challenge Request, especially in a scenario where the Requestor identifies themselves to the CUI Program Manager, but asks to be anonymous to all other participants in the CUI Challenge Process.

Can you provide unique identifying information for the document / content to support review by the NRC CUI Senior Agency Official?:

• This information is being collected so that the NRC can more readily identify the document or information that is being challenged. Without receiving this information, the NRC may not have a clear understanding of what document or information is being challenged in the request. If the NRC still has questions about what is being challenged, the CUI Program Manager will reach out to the Requestor requesting additional clarifying information, providing that the Requestor completed the “Requestor Information” Field.

Do you know if this Information is associated with any ongoing (active or inactive) Government litigation that may or may not involve the NRC? If known, please identify the Agency / Department(s) involved in the legal action and the docket number, if applicable.

• In accordance with 32 CFR 2002.50(b), the NRC excludes from its CUI Challenge Process any CUI that is currently involved in Government litigation or a challenge to a CUI designation arising out of Government litigation. This information is being sought to help ensure that CUI Challenge Requests that involve such information are properly routed to the relevant litigation process/parties and are not inappropriately resolved through the CUI Challenge Process.

• The exclusion in 32 CFR 2002.50(b) for information involved in Government litigation is not limited to litigation in which the NRC is a party. Activities and facilities regulated by the NRC may have overlapping jurisdiction with other federal agencies (DOL, OSHA, FERC, etc.) and thus it is possible that CUI held by the NRC may be relevant to Government litigation involving other agencies. Thus, the form asks the Requestor whether he or she is aware of association with any Government litigation, regardless of whether the NRC is a party.

What is the Information’s current CUI designation?

• The purpose of the CUI Challenge Process is to allow individuals to challenge the designation of CUI if they believe it has been inappropriately designated. This question is being asked because it is a necessary component to understanding the nature of the CUI Challenge Request. This information also better enables the NRC CUI Program Manager to understand the nature of the information that is the subject of the Challenge Request and contact the proper individuals within the NRC to help resolve the request based on the subject matter.

If the Information is not currently marked as CUI and you believe that it should be, please identify the proposed CUI category name(s), and if it is Basic or Specified.

• The CUI Challenge Process permits Requestors to file a Challenge Request when they believe that Uncontrolled Unclassified Information (UUI) should in fact be designated as CUI. This question is being asked because it is a necessary component to understanding the nature of the CUI Challenge Request. This information also better enables the NRC CUI Program Manager to understand the nature of the information that is the subject of the Challenge Request and contact the proper individuals within the NRC to help resolve the request based on the subject matter.

If the Information is currently marked as CUI and you believe that it is not CUI, please provide your basis here to justify removal of the CUI marking(s).

• The CUI Challenge Process permits Requestors to file a Challenge Request when they believe that information currently designated as CUI should in fact be uncontrolled. This field allows the Requestor to provide his or her basis for requesting that CUI be decontrolled. This information is essential for the NRC in its consideration of the CUI Challenge Request and whether to take action based on the request.

The NRC CUI Program goal is to make a decision on Challenge Requests that it receives within 45 calendar days of the request’s submission. If there is a need for an expedited NRC review, please describe why an expedited review is needed.

• The NRC anticipates that some CUI Challenge Requests may be necessary to resolve in an expedited manner, depending on the circumstances. This question is being asked so that the Requestor can indicate whether he or she believes that such circumstances exist and why. This information can then be used by the NRC to determine whether it agrees that expedited consideration is warranted, improving the NRC’s ability to deliver a timely response to the Requestor under such circumstances.

Rationale for CUI Challenge:

• This question is being asked so that the Requestor can provide his or her basis for filing the CUI Challenge Request. This information is essential for the NRC in its consideration of the CUI Challenge Request and whether to take action based on the request.

3. Reduction of Burden Through Information Technology

The NRC has issued Guidance for Electronic Submissions to the NRC which provides direction for the electronic transmission and submittal of documents to the NRC. Electronic transmission and submittal of documents can be accomplished via the following avenues: the Electronic Information Exchange (EIE) process, which is available from the NRC's “Electronic Submittals” Web page, by Optical Storage Media (OSM) (e.g. CD-ROM, DVD), by facsimile or by e-mail. NRC staff estimates that approximately 100 percent of the potential responses will be filed electronically.

All CUI challenge requests (100%) will be submitted to the NRC electronically via a web form listed on the NRC’s public-facing website. There will be no paper-based submissions for this collection.

4. Efforts to Identify Duplication and Use Similar Information

No sources of similar information are available. There is no duplication of requirements.

5. Efforts to Reduce Small Business Burden

Not applicable. This information collection does not impose a significant economic impact on small businesses. The information is being provided by authorized holders (i.e., NRC licensees, applicants, vendors, etc.) who decide to formally challenge the NRC’s CUI designation of a document that they have a lawful government purpose to access and is not available from any other sources. The same information is required of every submission.

6. Consequences to Federal Program or Policy Activities if the Collection Is Not Conducted or Is Conducted Less Frequently

This information is collected only when authorized holders submit a challenge to CUI designations. It could not be less frequently. If the collection of information were not collected, the NRC could not comply with the requirements of 32 CFR 2002.

7. Circumstances Which Justify Variation from OMB Guidance

Not applicable.

8. Consultations Outside the NRC

Opportunity for public comment on the information collection requirements for this clearance package was published in the Federal Register on April 17, 2020 (85 FR 21475). The NRC did not receive any comments.

NRC also contacted four licensees by email. No responses or comments were received as a result of the FRN or the staff’s direct solicitation of comments.

9. Payment or Gifts to Respondents

Not applicable.

10. Confidentiality of Information

Confidential and proprietary information is protected in accordance with NRC regulations at 10 CFR 9.17(a) and 10 CFR 2.390(b).

11. Justification for Sensitive Questions

Not applicable.

12. Estimated Burden and Burden Hour Cost

The NRC estimates that it will receive 12 challenge requests per year.

The NRC estimates that it will take authorized holders approximately 1.5 hours to complete the challenge request, submit it to the NRC, and respond to inquiries from the CUI Program Manager.

The $278 hourly rate used in the burden estimates is based on the Nuclear Regulatory Commission’s fee for hourly rates as noted in 10 CFR 170.20 “Average cost per professional staff-hour.” For more information on the basis of this rate, see the Revision of Fee Schedules; Fee Recovery for Fiscal Year 2019 (84 FR 22331, May 17, 2019).

Table 1: Reporting Burden Hours/Burden Cost to Respondents

Item	Estimated Burden Hours	Estimated Responses (yr)	Estimated Burden (hrs/yr)	Estimated Rate ($/hr)	Estimated Total Cost ($/hr)
CUI Challenge Request	1.5	12	18	$278.00	$5,004.00
Totals		12	18		$5,004.00

13. Estimate of Other Additional Cost

There are no additional costs associated with this information collection.

14. Estimated Annualized Cost to the Federal Government

The NRC estimates that the CUI Program Manager will screen and perform the initial analysis of the Challenge Request, determine the processing path for the challenge request, notify NRC employees to review the challenge request, and respond to the authorized holder who submitted the challenge request, once the final determination on the request has been completed. The NRC also estimates that the following people will review the challenge request at the behest of the CUI Program Manager: CUI SAO, a representative from NRC’s Office of General Counsel, and, if necessary, NRC Technical Reviewer(s).

The NRC is using an agency estimated hourly rate of $278 for Federal employees working on this collection.

The NRC estimates that it takes the CUI Program Manager approximately 10 hours to process the challenge requests. The NRC also estimates that it takes the challenge request reviewers approximately 10 hours to review the challenge request and to respond appropriately to the CUI Program Manager.

Table 2: Burden Hour/Burden Cost to the Federal Government

Item	Estimated Hours	Estimated Responses (yr)	Estimated Burden (hrs/yr)	Estimated Rate ($/hr)	Estimated Total Cost
CUI Challenge Request – CUI Program Manager	10	12	120	$278.00	$33,360.00
CUI Challenge Request – Reviewers	10	12	120	$278.00	$33,360.00
Totals			240		$66,720.00

15. Reasons for Change in Burden or Cost

Because this is a new information collection request, there is no change in burden or cost.

16. Publication for Statistical Use

Not applicable. The NRC does not plan to publish this information for statistical use.

17. Reason for Not Displaying the Expiration Date

The form in this information collection will display the OMB Control Number and the expiration date of OMB approval.

18. Exceptions to the Certificate Statement

There are no exceptions.

B. COLLECTIONS OF INFORMATION STATISTICAL METHODS

This collection of information does not employ statistical methods.

8