Identification of Facilities and Assets at Risk

Identification of Facilities and Assets at Risk

For inclusion within ICR 1670-0007

Cybersecurity and Infrastructure Security Agency

Paperwork Reduction Act Statement

In accordance with the Paperwork Reduction Act, no one is required to respond to a collection of information unless it displays a valid Office of Management and Budget (OMB) Control Number. The valid OMB Control Number for this information collection is 1670-0007. The time required to complete this information collection is estimated to average 0.17 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information.

Privacy Notice

Authority: 6 U.S.C. §§ 621-29 (Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014) and the Chemical Facility Anti-Terrorism Standards, 6 C.F.R. Part 27 authorize the collection of this information.

Purpose: The purpose of this collection is to identify covered chemical facilities and chemical facilities of interest. In addition, this collection is used to learn about critical cyber-systems used to control chemical processes at covered chemical facilities.

Routine Use: This information will be used by and disclosed to DHS personnel, contractors, or other agents, including but not limited to other Federal, state, and local officials; and used to contact a facility in order to determine if it is a chemical facility of interest.

Disclosure: Providing this information is voluntary. Covered chemical facilities are not required to provide this PII to comply with 6 CFR Part 27.

Identification of Facilities

In this section the instrument will collect, on a voluntary basis, the following information when the facility identifies it ships and/or receives (Chemical of Interest) COI:

• Shipping and/or receiving procedures

• Invoices and receipts

• Company names and locations that COI is shipped to and/or received from

Assets at Risks

In this section the instrument will collect, on a voluntary basis, the following information when the facility identifies a Supervisory Control and Data Acquisition (SCADA), Distributed Control System (DCS), Process Control Systems (PCS), or Industrial Control Systems (ICS):

• Provide details on the system(s) that controls, monitors, and/or manages small to large production systems as well as how the system(s) operates.

• If it is standalone or connected to other systems or networks and document the specific brand and name of the system(s).

2