Justification for the Non-Substantive Changes to 0960-0789 (IT Mod Request)

Justification for the Non-Substantive Changes for

Social Security Administration’s Public Credentialing and Authentication Process

20 CFR 401.45 & 20 CFR 402

OMB No. 0960-0789

Background

Since its establishment in May 2012, SSA uses the Social Security Administration’s Public Credentialing and Authentication Process (hereafter-called “eAccess”) to provide a secure, centralized gateway to Social Security’s public-facing electronic services. In September 2021, SSA switched over to using federated identity system (FIS) partners which will use the same federal guidelines and principles used by SSA when registering customers. When customers access SSA’s website to sign-in to their accounts, SSA’s website presents the customers with a choice to sign in with an eAccess credential or to sign in with a Login.gov or ID.me credential.

This release will focus on a subsequent phase of the migration of applications from our Integrated Registration Services (IRES) System (OMB No. 0960-0626) to our eAccess platform. We expect to eventually move additional applications from IRES to the more secure eAccess platform, as well. After this upcoming system release, SSA will require IRES users that need access to the Internet Representative Payee Accounting (iRPA) application for organizations to authenticate through eAccess rather than IRES to enhance the security for these business services.

Additionally, since customers can no longer create or register for a credential directly through eAccess, our burden significantly decreased. New customers must register with either Login.gov or ID.me for a credential to access eAccess. We are still in the process of phasing out eAccess sign-ins completely.

We will implement these new, non-substantive revisions on August 17, 2024. Therefore, we are asking for OMB’s approval of these revisions as soon as possible, to ensure we can implement on time.

Revisions to the Collection Instrument

• Change #1: Users that need access to the Internet Representative Payee Accounting (iRPA) application for organizations will be required to authenticate through our Public Credentialing and Authentication Process (OMB Clearance No. 0960-0789), known as eAccess, instead of through IRES.

Justification #1: This change will provide the proper authentication means for customers based on which business services they need to access, and will increase the security for business service customers.

Estimates of Public Reporting Burden

We are adjusting the reporting burden to this information collection because we expect additional customers to register an account for eAccess to allow them to access SSA’s website for the Internet Representative Payee Accounting (iRPA) for organizations application. We also expect the number of respondents or burden hours we reported in our existing burden estimate to change because of the new registrations going through Login.gov or ID.me instead of directly through eAccess. We will continue to monitor the MI data and reflect the burden accordingly. OMB approved the current burden estimate on 03/29/2023, and we have seen a decrease in burden as more respondents use Login.gov or ID.me for registration and access.

The data below is based on our actual Management Information (MI) data for fiscal year 2023 (showing end of year data). We use different modalities to collect the information, via the Internet and the Intranet. In addition, we also estimate an additional 5,825 new registrations for eAccess due to the users who will access iRPA through eAccess. We estimated the number of minutes for completion by averaging the “time-on-task” figures we obtained from our usability testing and from our current MI data.

See chart below with the updated figures:

Modality of Completion	Number of Respondents	Frequency of Response	Average Burden Per Response (minutes)	Estimated Total Annual Burden (hours)	Average Theoretical Hourly Cost Amount (dollars)*	Average Wait Time in Field Office (minutes)**	Total Annual Opportunity Cost (dollars)***
Internet eAccess Sign-Ins	107,299,293	1	1	1,788,322	$31.48*		$56,296,377***
Login.gov Sign-Ins	72,826,241	1	1	1,213,771	$31.48*		$38,209,511***
ID.me Sign-Ins	12,776,004	1	1	212,933	$31.48*		$6,703,131***
Intranet Registration (RCS)	122,763	1	8	16,368	$31.48*	24**	$2,061,090***
iRPA Users (Registration through Login.gov or ID.me)	5,825	1	1	97	$31.48*		$3,036***
Totals	193,030,126			3,231,491			$103,273,145***

* We based this figure on average U.S. citizen’s hourly salary, as reported by Bureau of Labor Statistics data (https://www.bls.gov/oes/current/oes_nat.htm#00-0000).

** We based these figures on the average FY 2024 wait times for field offices (24 minutes), based on SSA’s current management information data.

*** This figure does not represent actual costs that SSA is imposing on recipients of Social Security payments to complete this application; rather, these are theoretical opportunity costs for the additional time respondents will spend to complete the application. There is no actual charge to respondents to complete the application.

NOTE: We included the total opportunity cost estimate from this chart in our calculations when showing the total time and opportunity cost estimates in the paragraph below.

We base our burden estimates on current management information data, which includes data from actual interviews, as well as from years of conducting this information collection. Per our management information data, we believe that 1 minute accurately shows the average burden per response for learning about the program; reading and understanding instructions; and signing into the system. Based on our current management information data, the burden information we provided in the above chart is accurate. The total burden for this ICR is 3,231,491 burden hours (reflecting SSA management information data), which results in an associated theoretical (not actual) opportunity cost financial burden of $103,273,145. SSA does not charge respondents to complete our applications.

Future Plans

Due to the agile nature of our projects, we expect to make more enhancements in the future to strengthen our electronic access authentication posture. Currently, we are still finalizing our IT modernization plans for these changes. We expect to submit another change request within six to nine months to request approval for additional updates to the system, and potentially, update the burden again to include more users as we move more applications to a more secure authentication platform.