Final - 2021-OCHCO-HCISD-Supporting Statement

Supporting Statement for Paperwork Reduction Act Submissions

(Personal Identification Verification & Pre-Security Form)

(OMB# 2501-NEW)

Personal Identity Verification (PIV) & Pre-Security Form

The purpose of this information collection request (ICR) is to obtain approval of the information that must be provided by applicants when applying for a Homeland Security Presidential Directive (HSPD-12) Identification Credential (identification card). This information collection is necessary to comply with the requirements outlined in Homeland Security Presidential Directive (HSPD-12), the Federal Information Processing Standard (FIPS) 201-2, the OMB Memorandum M-05-24 and the M-19-17; which asserts that all governmental agencies must implement a secure identity proofing, registration, and issuance process for identity verification, prior to granting federal and non-federal employee’s access to federally controlled facilities and/or information systems.

A. Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

The requirements outlined in the Homeland Security Presidential Directive (HSPD-12), the Federal Information Processing Standard (FIPS) 201-2, the OMB Memorandum M-05-24 and M-19-17 assert that all governmental agencies must implement a secure identity proofing, registration, and issuance process. This process must ensure secure personal identity verification prior to granting federal and non-federal employee’s access to federally controlled facilities and/or information systems. The approval of the information that must be provided by applicants when applying for a Homeland Security Presidential Directive (HSPD-12) Identification Credential (identification card) would satisfy the requirements.

The following authorities governs the collection of Personally Identifiable Information (PII) data which is stored in the PerSIST system:

The authority to collection this information is established under HSPD-12 and in accordance with the Personnel Security and Suitability Policy, Handbook 755.1 (2019), Chapter 4.

http://hudatwork.hud.gov/HUD/chco/doc/PSS-52019

2. Indicate how, by whom and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

The information on the PIV & Pre-Security form is used to start the record creation process in PERSIST and the enrollment process for the issuance of a PIV Credential as required by HSPD-12. Current collections in the system are used to document and support decisions regarding the suitability, eligibility, and fitness for service of applicants for federal employment and contract positions to include students, interns, or volunteers to the extent that their duties require access to federal facilities, information, systems, or applications. Additionally, records may be used to document security violations, and supervisory actions taken.

As the PSF system was outdated and did not have the capability of reducing errors within the reporting process, PerSIST allows HUD this ability; to capture data related to all aspects of pre-appointments, suitability determinations, and security clearance processing, and help facilitate the capabilities needed to support multi-user access, workflow definition, workflow tracking, and the ability to interface with interagency systems such as the Office of Personnel Management Electronic Questionnaires for Investigations Processing (e-QIP) and Personnel Investigations Processing System (PIPS).

When an applicant completes all automated background investigative forms, enrolls at a Registrar station to collect fingerprints and biometrics to establish and validate their identity, the data is submitted to OPM as part of the background investigation, and all required identity and information submissions are completed and a background investigation has been conducted, an Adjudicator will provide an approval for issuance of the HSPD-12 Credential (ID Card). Once the ID Card is printed and mailed to the Sponsoring agency, the Applicant will receive an automatic email in their personal email account indicating their HSPD-12 Credential is “ready for pickup.” Once the Applicant arrives to pick up the ID Card, a biometric matching process is conducted by scanning two (2) of the Applicants fingers. The Applicant is also required to provide a current identification card that would also validate the information on the PIV Card. When all steps are completed successfully, then the PIV Card can be activated and issued to the Applicant.

The below enrollment forms are required to be completed by all Applicants, before submission to OPM:

OF-306: Declaration for Federal Employment

SF-85: Questionnaire for Non-Sensitive Positions

SF-85P: Questionnaire for Public Trust

SF-86: Questionnaire for National Security Positions

Fair Credit Reporting Act of 1970, as Amended

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden. Information and access to information collection instruments (forms) will only be authorized and/or required by HUD adjudicators, who maintain the website.

The PIV & Pre-Security form is submitted via secure messaging to Personnel Security Division (PSD) to start the record creation and PIV enrollment process. No “commercial databases or data” are used in the PIV process, however; agencies do have an automated link to the Office of Personnel Management’s (OPM) Personnel Investigations Processing System (PIPS). Access to the PerSIST system will be controlled by the appointed Application Systems Security Administrator (SSA). The SSA will use DIAMS (Digital Identity and Access Management System) to approve/reject/grant access to the PerSIST system. The PerSIST system will also utilize PIV Card, a tailored role-based security and access (RBAC) model, and Users will access the system using Single Sign-On (SSO) or multifactor authentication through a Virtual Private Network (VPN). All permissions are completely configurable via roles, permissions, and assignments. Event logs will capture user actions at an account and data level, including login/logout times. Session settings will also be configured regarding session timeout, lockout conditions, and inactivity.

Role-Based Security Access Control (RBAC), an approach to restricting system access to authorized users, is used by the majority of enterprises with more than 500 employees and can implement mandatory access control or discretionary access control.

Single Sign-On (SSO)-A property of access control of multiple related, yet independent, software systems. A user logs in with a single ID and password to gain access to a connected system or systems without using different credentials or, in some configurations, seamlessly sign on at each system.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.

The PIV & Pre-Security Form is a fillable form which is completed electronically. It allows HUD the ability to capture data related to all aspects of pre-appointments, suitability determinations, and security clearance process. This helps facilitate the capabilities needed to support multi-user access, workflow definition, workflow tracking, and the ability to interface with interagency systems such as the Office of Personnel Management Electronic Questionnaires for Investigations Processing (e-QIP) and Personnel Investigations Processing System (PIPS). There is no other system duplicative of PerSIST.

5. If the collection of information impacts small businesses or other small entities (Item 5 of OMB Form 83-I) describe any methods used to minimize burden.

There is no impact to small businesses, or other businesses.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

Individuals do have an opportunity to object to the collections of their PII, however; if individuals do not provide the requested information in whole or in part, HUD will not be able to complete their identity proofing and registration process. If an individual does not have a PIV card, they will be treated as a visitor when entering the HUD building. They will not have access to certain resources. If holding a PIV card is a condition of employment or obtaining a contract, failure to provide the requested information will adversely affect the individual’s placement or employment prospects.

7. Explain any special circumstances that would cause an information collection to be conducted in a manner:

• requiring respondents to report information to the agency more than quarterly; N/A

• requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it; N/A

• requiring respondents to submit more than an original and two copies of any document; N/A

• requiring respondents to retain records other than health, medical, government contract, grant-in-aid, or tax records for more than three years; N/A

• in connection with a statistical survey, that is not designed to produce valid and reliable results than can be generalized to the universe of study; N/A

• requiring the use of a statistical data classification that has not been reviewed and approved by OMB; N/A

• that includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; N/A or

• requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law. N/A

8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

• Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping disclosure, or reporting format (if any) and the data elements to be recorded, disclosed, or reported.

• Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years -- even if the collection of information activity is the same as in prior periods. There may be circumstances that preclude consultation in a specific situation. These circumstances should be explained.

In accordance with 5 CFR 1320.8(d), this information collection soliciting public comments was announced in the Federal Register on May 21, 2021, Volume 86, No. 97, Pages 27644-27645. In accordance with the Paperwork Reduction Act of 1995, HUD published a 60-Day Notice of Proposed Information Collection in the Federal Register on May 20, 2021. The docket number was FR-7043-N-01, and the notice appeared on pages 27644-27645. The notice provided a 60-day period for public comments, and comments were due by July 20, 2021. HUD received a comment from Mr. Jeffrey L. Rhodes, Esquire, with McInroy, Rigby & Rhodes, LLP, whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility. HUD submitted a response to Mr. Jeffrey Rhodes, Esq on 8/6//2021.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

No payment or gift is provided.

10. Describe any assurance of confidentiality provided to respondents and the basis for assurance in statute, regulation or agency policy.

The Privacy Act (5 U.S.C § 552a) protects the information being collected. OPM and HUD provides a Privacy Act Statement (PAS), in which individuals are informed, when completing security processing forms with respect to having a background investigation initiated on their behalf. Upon signing and submitting the security forms, the employees or contractors subsequently, signs the Privacy Act Statement, as well.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

None of the information collection described herein includes questions of a sensitive nature.

12. Provide estimates of the hour burden of the collection of information. The statement should:

• indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than 10) of potential respondents is desirable. If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices;

• if this request covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I; and

• provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here.

Instead this cost should be included in Item 13.

Information Collection	Number of Respondents	Frequency of Response	Responses Per Annum	Burden Hour Per Response	Annual Burden Hours	Hourly Cost Per Response	Annual Cost
22019 PIV Pre-Screen Application	1,625	1	1,625	.17	276.25	$34.86	$9,630.08
Total	1,625	1	1,625	.17	276.25	$34.86	$9,630.08

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information (do not include the cost of any hour burden shown in Items 12 and 14).

• The cost estimate should be split into two components: (a) a total capital and start-up cost component (annualized over its expected useful life); and (b) a total operation and maintenance purchase of services component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major cost factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s) and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and record storage facilities;

• If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate. In developing cost burden estimates, agencies may consult with a sample of respondents (fewer than 10) utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection, as appropriate.

• generally, estimates should not include purchases of equipment or services, or portions thereof made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information or keep records for the government, or (4) as part of customary and usual business or private practices.

This data collection effort involves no recordkeeping or reporting costs for respondents other than the time burden to respond to questions on the data collection instruments as described in item 12 above. There is no known additional cost burden to the respondents

14. Provide estimates of annualized cost to the Federal government. Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), and any other expense that would not have been incurred without this collection of information. Agencies also may aggregate cost estimates from Items 12, 13, and 14 in a single table.

Information Collection	Number of Respondents	Frequency of Response	Responses Per Annum	Burden Hour Per Response	Annual Burden Hours	Hourly Cost Per Response	Annual Cost
22019 PIV Pre-Screen Application	1,625	1	1,625	.17	276.25	$34.86	$9,630.08
Total	1,625	1	1,625	.17	276.25	$34.86	$9,630.08

Burden hourly rate used for this estimate for technical/program staff (average grade GS-11, step 1).

15. Explain the reasons for any program changes or adjustments reported in Items 13 and 14 of the OMB Form 83-I.

This is a new collection.

16. For collection of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

HUD has no plans to publish any of the information collected.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

Not Applicable.

18. Explain each exception to the certification statement identified in item 19.

None.

B. Collections of Information Employing Statistical Methods

None.