2021 Final Supporting Statement for NRC Insider Threat Program

FINAL SUPPORTING STATEMENT

FOR

NRC INSIDER THREAT PROGRAM FOR LICENSEES

AND OTHERS REQUIRING ACCESS TO CLASSIFIED INFORMATION

(3150-XXXX)

NEW

Description of the Information Collection

On October 7, 2011, the President issued Executive Order (EO) 13587, “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information. In November 2012, following an extensive interagency coordination and vetting process, the president issued the National Insider Threat Policy and the Minimum Standards (NITPMS). Executive Order 12968—Access to Classified Information contains the requirements for access to classified information. EO 13587 mandated that an insider threat program (ITP) be implemented for all Executive branch departments and agencies that access classified information. The NITPMS states “Consistent with EO 13587 and 12968, this policy is applicable to all executive branch departments and agencies with access to classified information, or that operate or access classified computer networks; all employees with access to classified information, including classified computer networks (and including contractors and others who access classified information, or operate or access classified computer networks controlled by the federal government); and all classified information on those networks.” On May 18, 2016, the Department of Defense (DoD), acting as the Executive Agent for the National Industrial Security Program Operating Manual (NISPOM,) (DoD 5220.22M) issued NISPOM Change 2. This changed the NISPOM to require that federal agencies that provide classified information to contractors, as defined in the NISPOM, develop and maintain an ITP. The scope of affected the Nuclear Regulatory Commission (NRC) licensees covers 28 entities with NRC facility clearances that hold approximately 1100 NRC-issued personnel security clearances. Licensees under the new ITP requirements fall within two categories, those who possess, use or transmit classified matter at their site or a cleared contractor site, and those licensees or cleared contractors who only need access to classified matter at a government or appropriately cleared non-government site. The NISPOM contains the requirements as to what information is reportable and what records are required to be kept and maintained. Some collection requirements are recurring. Some reports or applications are only required as occasioned by the occurrence of specific events, such as an update to key personnel positions identified in the NISPOM, or a report of loss of classified information, would be an event-triggered cost. Periodic training and other requirements for recordkeeping that are necessary for checking the licensees’ and contractors’ procedures for maintaining acceptable security education, facility, and classification/declassification programs are examples of recurring costs.

A. JUSTIFICATION

1. Need For and Practical Utility of the Collection of Information

The scope of EO 13587 applies to all entities, government and private sector that access classified information as defined in the Atomic Energy Act of 1954 (AEA), as amended, or EO 13526, Classified National Security Information. The NRC has determined that licensees and their cleared contractors fall within the scope of the NISPOM leaving the NRC no discretion with respect to imposing the NISPOM ITP requirements upon licensees and their cleared contractors who access classified information.

The information collected is required to demonstrate that ITP requirements have been implemented and maintained by entities who access classified information for which the NRC is the Cognizant Security Agency (CSA) as defined in the NISPOM.

While EO 13587 is an element of determining the suitability of an entity to access classified information, Title 10 of the Code of Federal Regulations Part 95 (10 CFR 95) defines the scope for who the NRC grants access to classified information. The respondents of this collection fall into two groups. The first group are licensees and their cleared contractors who require access to classified information as a condition of their license. This group is comprised of fuel cycle licensees using technology that is determined to be Restricted Data as defined in the AEA. The second group is made up of licensees who do not require access to classified information as a condition of their license but for whom the Commission determined it was in the best interest of common defense and security to allow limited access to classified information under EO 13526. The Commission extended the invitation to apply for access to classified information under 10 CFR 95. Acceptance is voluntary. However, if accepted the invitee is bound by all the requirements necessary to establish and maintain access, including the ITP. However, invitees are free to surrender their access to classified information at any time with no effect upon their license.

2. Agency Use of Information

As the CSA for its licensees and their cleared contractors, the NRC has assigned responsibilities. The NRC will use this information to monitor ITP performance by its licensees and cleared contractors and to demonstrate the agency is fulfilling its responsibilities under the NISPOM.

3. Reduction of Burden Through Information Technology

The NRC has issued Guidance for Electronic Submissions to the NRC which provides direction for the electronic transmission and submittal of documents to the NRC. Electronic transmission and submittal of documents can be accomplished via the following avenues: the Electronic Information Exchange (EIE) process, which is available from the NRC's “Electronic Submittals” Web page, by Optical Storage Media (OSM) (e.g. CD-ROM, DVD), by facsimile or by e-mail. It is estimated that once established, approximately 80% of the responses will be filed electronically.

4. Effort to Identify Duplication and Use Similar Information

No sources of similar information are available. There is no duplication of requirements.

5. Effort to Reduce Small Business Burden

Currently, no licensees subject to ITP requirements qualify as a small business. The requirements to access classified information under the ITP are based on statutes or EO that must be complied with regardless of the size of the business.

6. Consequences to Federal Program or Policy Activities if the Collection Is Not Conducted or Is Conducted Less Frequently

Failure to collect the information or collecting the information would prevent the NRC from fulfilling its responsibility as a CSA under the NISPOM. The information collected is necessary to verify ITP program requirements have been properly implemented and are being maintained.

7. Circumstances Which Justify Variation from OMB Guidelines

Information reporting requirements are set forth in the NISPOM and the NRC has no discretion in their implementation. The NRC will not collect information more frequently than the NISPOM requires.

8. Consultations Outside the NRC

Opportunity for public comment on the information collection requirements for this clearance package was published in the Federal Register on September 22, 2021 (86 FR 52697). No responses or comments were received as a result of the FRN or the staff’s direct solicitation of comment.

9. Payment or Gift to Respondents

Not applicable.

10. Confidentiality of Information

Confidential and proprietary information is protected in accordance with NRC regulations at 10 CFR 95, Section 9.17(a) and 10 CFR 2.390(b).

However, no information normally considered confidential or proprietary is requested.

11. Justification for Sensitive Questions

There is no Privacy Act concern as the information collected is not retrieved using personal identifiable information.

12. Estimated Burden and Burden Hour Cost

The NRC estimates that there are 28 respondents and 71 responses to the information collection in the ITP. The annual reporting burden is 2,630 hours and recordkeeping burden is 1,198 hours, for a total of 3,828 burden hours for the collection. It should be noted that 679 of the reporting hours capture the burden for program implementation. However, each time a new Insider Threat Program Senior Official (ITPSO) is assigned, the burden associated with assigning or training them will be incurred. In the future, that burden will decrease but since the ITP is a new program, the NRC has no estimate of what the ITPSO turnover rate will be. The following table summarizes respondent burden, responses, and cost at $288/hr. Details of reporting and recordkeeping burden and cost estimates to the respondents, broken down by requirement, are reflected in Tables 1 and 2.

	Responses	Hours	Cost at $288/hr.
Reporting	71	2630	$757,440
Recordkeeping	28	1198	$345,024
Total	99	3828	$1,102,464

Records must be available for NRC review upon demand for such purposes as required inspections.

It should be noted that burden is not uniformly distributed across the twenty-eight respondents. The bulk of the burden is driven by two factors, the number of cleared personnel a respondent has and whether or not the respondent operates classified information systems. Three respondents account for 865 of 1106 NRC-cleared personnel coming under the program. Only three of the twenty-eight respondents operate classified information systems.

The $288 hourly rate used in the burden estimates is based on the Nuclear Regulatory Commission’s fee for hourly rates as noted in 10 CFR 170.20 “Average cost per professional staff-hour.” For more information on the basis of this rate, see the Revision of Fee Schedules; Fee Recovery for Fiscal Year 2021 (86 FR 32146, June 16, 2021).

13. Estimate of Other Additional Costs

None.

14. Estimated Annualized Cost to the Federal Government

The staff has developed estimates of annualized costs to the Federal Government

related to the conduct of this collection of information. These estimates are based on

staff experience and subject matter expertise and include the burden needed to

review, analyze, and process the collected information and any relevant operational

expenses.

Total Annual cost - professional effort

(100 hrs x $288/hr.) = $28,800

15. Reasons for Change in Burden or Cost

This is a new clearance.

16. Publication for Statistical Use

There is no application of statistics in the information collected. There is no publication of this information.

17. Reason for Not Displaying the Expiration Date

There are no forms currently required for the ITP.

18. Exceptions to the Certification Statement

There are no exceptions.

B. COLLECTIONS OF INFORMATION EMLOYING STATISTICAL METHODS

Statistical methods are not used in this collection of information.

TABLE 1 INSIDER THREAT PROGRAM ESTIMATE (REPORTING)

Section	Requirement	No. of Respondents 2021	Responses Per Respondent 2021	No. of Responses 2021	Burden Per Response 2021(Hours)	Total Annual Burden Hrs 2021
DoD 5220.22-M, (NISPOM), 1-202.b	Establish program including formal appointment and training by the licensee of an ITP senior official (ITPSO) who is a U.S. citizen employee and a senior official of the company.	28	1	28	24.25	679
DoD 5220.22-M, (NISPOM), 1-207.b	Annual licensee self-review including self-inspection of the ITP.	28	1	28	16	448
DoD 5220.22-M, (NISPOM), 1-300	Requirements to report to the NRC any detection of an insider threat to the licensee	28	.1	3	1	3
DoD 5220.22-M, (NISPOM), 8-100.d	Monitor user activity on classified IS	3	4	12	125	1500
Totals		28		71		2630

TABLE 2 INSIDER THREAT PROGRAM ESTIMATE

(RECORDKEEPING)

Section	Requirement/Record Retention	No. of Recordkeepers 2021	Annual Hours Per Recordkeeper 2021	Total Annual Recordkeeping Hours 2021
DoD 5220.22-M, (NISPOM), 1-202.b	Formal appointment by the licensee of an ITP senior official (ITPSO) who is a U.S. citizen employee and a senior official of the company.	28	10	280
DoD 5220.22-M, (NISPOM), 1-207.b	Annual licensee self-review including self-inspection of the ITP.	28	16	448
DoD 5220.22-M, (NISPOM), 3-103.c	Maintain ITP Training Records	28	2	280
DoD 5220.22-M, (NISPOM), 1-300	Requirements to report to the NRC any detection of an insider threat to the licensee	28	3	84
DoD 5220.22-M, (NISPOM), 8-100.d	Monitor user activity on classified information systems	3	110	330
Totals		28	141	1198

DESCRIPTION OF INFORMATION COLLECTION REQUIREMENTS CONTAINED IN

NRC INSIDER THREAT PROGRAM FOR LICENSEES

AND OTHERS REQUIRING ACCESS TO CLASSIFIED INFORMATION

3150-XXXX

DoD 5220.22-M, (NISPOM), Section 1-202.b: This section requires an entity under an ITP to appoint, train, and report the assignment of an Insider Threat Senior Program Manager. This is a new requirement since the last OMB Information Collection.

DoD 5220.22-M, (NISPOM), Section1-207.b: This section requires an entity under the ITP to perform and annual self-assessment/inspection and report it to the NRC.

DoD 5220.22-M, (NISPOM), 3-103.b: This section requires initial and annual insider threat awareness training for all persons with access to classified information.

DoD 5220.22-M, (NISPOM), 3-103.c: This section specifies the records retention requirements for the ITP.

DoD 5220.22-M, (NISPOM), 1-300: This section requires an entity under an ITP to report suspicious activity indicating a possible insider threat to the NRC.

DoD 5220.22-M, (NISPOM), 8-100.d: This section requires an entity with classified information systems to continuously monitor those systems to detect potential activity indicating an insider threat.