Computer Security Incident Supporting Statement

Office of the Comptroller of the Currency

Supporting Statement

Libor Self-Assessment

OMB Control No. 1557-NEW

A. Justification.

1. Circumstances that make the collection necessary:

The proposed rule contains a reporting requirement that is subject to the PRA. The reporting requirement is found in § 53.3 of the proposed rule, which require a banking organization to notify its primary federal bank regulatory agency of the occurrence of a “notification incident” at the banking organization.

The proposed rule also contains a disclosure requirement that is subject to the PRA. The disclosure requirement is found in § 53.4 of the proposed rule, which require a bank service provider to notify at least two individuals at affected banking organization customers immediately after it experiences a computer-security incident that it believes in good faith could disrupt, degrade, or impair services provided subject to the BSCA for four or more hours.

2. Use of the information:

These requirements are intended to serve as an early alert to a banking organization’s primary federal regulator and is not intended to provide an assessment of the incident.

3. Consideration of the use of improved information technology:

Not applicable.

4. Efforts to identify duplication:

There is no duplication.

5. If the collection of information impacts small businesses or other small entities, describe any methods used to minimize burden.

Not applicable.

6. Consequences to the federal program if the collection were conducted less frequently:

Not applicable.

7. Special circumstances that would cause an information collection to be conducted in a manner inconsistent with 12 CFR part 1320:

Not applicable.

8. Efforts to consult with persons outside the agency:

The OCC issued a notice of proposed rulemaking for comment containing the collection.

9. Payment or gift to respondents:

None.

10. Any assurance of confidentiality:

The information will be kept private to the extent permitted by law.

11. Justification for questions of a sensitive nature:

There are no questions of a sensitive nature.

12. Burden estimate:

Reporting: 22 Respondents x 3 hours = 66 hours

Disclosure: 801 Respondents x 3 hours = 2,403 hours

2,469 hours x $115.19 = $ 284,404.11

To estimate wages the OCC reviewed May 2019 data for wages (by industry and occupation) from the U.S. Bureau of Labor Statistics (BLS) for credit intermediation and related activities excluding nondepository credit intermediaries (NAICS 5220A1).  To estimate compensation costs associated with the rule, the OCC uses $115.19 per hour, which is based on the average of the 90th percentile for six occupations adjusted for inflation (3.1 percent as of Q1 2020 according to the BLS), plus an additional 33.4 percent for benefits (based on the percent of total compensation allocated to benefits as of Q4 2019 for NAICS 522: credit intermediation and related activities).

13. Estimate of total annual cost to respondents (excluding cost of hour burden in Item #12):

Not applicable.

14. Estimates of annualized costs to the federal government:

Not applicable.

15. Change in burden:

This is a new collection.

16. Information regarding collections whose results are to be published for statistical use:

Not applicable.

17. Reasons for not displaying OMB expiration date:

Not applicable.

18. Exceptions to the certification statement:

Not applicable.

B. Collections of Information Employing Statistical Methods.

Not applicable.

5