1652-0055 Pipeline Operator Security Info SS_

INFORMATION COLLECTION SUPPORTING STATEMENT

Pipeline Operator Security Information

1652-0055

Exp. 8/31/2025

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information. (Annotate the CFR parts/sections affected).

Pursuant to the Aviation and Transportation Security Act,¹ and delegated authority from the Secretary of Homeland Security, TSA has broad responsibility and authority for “security in all modes of transportation including security responsibilities over modes of transportation that are exercised by the Department of Transportation. Section 1557 of the Implementing Recommendations of the 9/11 Commission Act (9/11 Act)² recognizes this authority and further requires TSA to take specific actions related to pipeline security.

Consistent with these authorities and requirements, TSA issued Pipeline Security Guidelines in December 2010 and April 2011, and subsequently updated the Guidelines in March 2018 and April 2021.³ These voluntary guidelines were developed with the assistance of industry and government members of the Pipeline Sector and Government Coordinating Councils, industry association representatives, and other interested parties. These guidelines recommend submission of security incident information to TSA.

In May 2021, in response to a ransomware attack on the Colonial Pipeline Company, TSA issued a Security Directive (SD) series with requirements for TSA-specified critical pipeline owner/operators of hazardous liquid and natural gas pipelines and liquefied natural gas facilities.⁴ The SD series included two mandatory information collections.⁵ First, TSA requires all owner/operators subject to the SD’s requirements to report cybersecurity incidents or potential cybersecurity incidents on their information and operational technology systems to the Cybersecurity and Infrastructure Security Agency (CISA) within 24 hours of identification of a cybersecurity incident using the CISA Reporting System. Second, the SD requires critical pipeline owner/operators to appoint cybersecurity coordinators, who must be available to TSA and CISA 24/7 to coordinate cybersecurity practices and address any incidents that arise, and to provide contact information for the coordinators to TSA. To ensure that information reported pursuant to the SD is identifiable within the system, TSA requires these owners/operators to indicate that they are providing the information pursuant to the SD.

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

Voluntary Collection. As the lead Federal agency for pipeline security, TSA requests to be notified of all security incidents involving pipeline facilities or systems. TSA currently asks all pipeline owner/operators to voluntarily report suspicious activities or security incident data to the TSA Transportation Security Operations Center (TSOC). The scope of the request includes all incidents that are indicative of a possible deliberate attempt to disrupt pipeline operations or activities that could be precursors to such an attempt. Examples of the types of incidents are provided in the Pipeline Security Guidelines. The scope of the voluntary reporting applies to any type of security incident, to include physical or cybersecurity, affecting all pipeline systems or facilities. TSA uses the information voluntarily submitted, including the security incident and suspicious activity information, for vulnerability identification/analysis and trend analysis. The information, with company-specific data redacted, may also be included in TSA’s intelligence-derived reports.

Mandatory Collection. Pursuant to the SD series, TSA requires TSA-specified critical pipeline owner/operators of hazardous liquid and natural gas pipelines and liquefied natural gas facilities to appoint a U.S. Citizen Cybersecurity Coordinator and alternate who must submit contact information; in addition to being U.S. Citizens, these individuals must be eligible for a security clearance. The Cybersecurity Coordinator serves as the primary contact for cyber-related intelligence information and cybersecurity-related activities and communications with TSA and CISA; must be accessible to TSA and CISA 24 hours a day, 7 days a week; must coordinate cyber and related security practices and procedures internally; and must work with appropriate law enforcement and emergency response agencies.

In addition, Pipeline owner/operators must report actual and potential cybersecurity incidents to CISA within 24 hours of identification of a cybersecurity incident. The information provided to CISA pursuant to the SD is shared with TSA and may also be shared with the National Response Center (NRC) and other agencies as appropriate. Conversely, information provided to TSA pursuant to this directive is shared with CISA and may also be shared with the NRC and other agencies as appropriate.

TSA may also use this information to identify the need to impose additional security measures as appropriate or necessary. TSA may also use the information, with company-specific data redacted, for TSA’s intelligence-derived reports. TSA and CISA may use information submitted for vulnerability identification, trend analysis, or to generate anonymized indicators of compromise or other cybersecurity products to prevent other cybersecurity incidents. All reported information will be protected in a manner appropriate for the sensitivity and criticality of the information.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden. [Effective 03/22/01, your response must SPECIFICALLY reference the Government Paperwork Elimination Act (GPEA), which addresses electronic filing and recordkeeping, and what you are doing to adhere to it. You must explain how you will provide a fully electronic reporting option by October 2003, or an explanation of why this is not practicable.]

TSA, pursuant to the SD, collects Pipeline Cybersecurity Coordinator and alternate contact information, submitted to TSA via email or regular mail.

Cybersecurity incident reports are submitted using the CISA Reporting System form at: https://us-cert.cisa.gov/forms/report. Incident reports can also be reported by calling (888) 282-0870. In compliance with the Government Paperwork Elimination Act, a fully electronic reporting option is available for pipeline owner/operators to provide suspicious incident information to TSA. Information regarding incidents which are indicative of a possible deliberate attempt to disrupt pipeline operations or activities that could be precursors to such an attempt may be submitted to the TSOC by email at [email protected].

Usability Testing Requirement: Pursuant to a 2023 DHS requirement, all Information Collection requests must undergo usability testing prior to submission to OMB. See DHS Fiscal Year 2024 Burden Reduction Plan Memorandum dated, September 29, 2023.

TSA completed usability testing on the information collection TSA Pipeline Security Guidelines Appendix B – TSA Notification Criteria (Appendix B). The purpose of the test was to determine whether Appendix B used plain language. The test included seven participants. All of the participants were not familiar with the information being collected.

Participants found that Appendix B used plain language, was well-structured, and presented the information clearly, particularly through the use of bullet points. The streamlined design and organization also led to a clear presentation of the notification.

In addition, participants recommended TSA ensure the use of acronyms align with the TSA Style Guide. Participants also recommended to introduce “e.g.” before abbreviations like SCADA, PCS, and DCS for clarity, along with spelling out these acronyms the first time they appear. For content clarity, definitions for SCADA, PCS, and DCS should be included when they were introduced to help readers who may not be familiar with them. In the Pipeline Security section, participants suggested to reference the Pipeline Security Directive early in the document to provide context. Lastly, participants recommended that the cyber incident reporting section could be improved by adding a header such as “Pipeline Security Incidents Reported to CISA” above the final paragraph and clarifying CISA Central’s role by stating, “CISA Central will notify TSA of these incidents.”

TSA concurs with these recommendations and will update Appendix B in the next iteration of the Guidelines.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purpose(s) described in Item 2 above.

This collection effort will not duplicate the efforts of other agencies.

TSA desires information regarding all incidents that indicate a possible deliberate attempt to disrupt pipeline operations or activities that could be precursors to such an attempt. TSA’s Pipeline Security Guidelines recommend that all pipeline companies voluntarily notify the TSOC of security incidents and suspicious activities involving their systems, to include both physical and cybersecurity incidents.

The Cybersecurity Information Sharing Act of 2015 requires DHS, in consultation with interagency partners, to establish the Federal Government’s capability and process for receiving cyber threat indicators and defensive measures and directs DHS to further share cyber threat indicators and defensive measures it receives with certain Federal entities in an automated and real-time manner. 6 U.S.C. § 1504(c).

The NRC serves as the national point of contact for reporting all oil, chemical, radiological, biological, and etiological discharges into the environment anywhere in the United States and its territories. A limited number of pipeline facilities falling under the provisions of the Maritime Transportation Security Act (MTSA) are required to report suspicious activities to the NRC.⁶ Duplicative reporting could occur if an operator chose to make a voluntary report to TSOC in addition to the mandated NRC report. Given the small population of pipeline facilities that are subject to MTSA requirements, TSA does not anticipate a large volume of duplicate reporting to TSOC and NRC. That expectation is based on the actual incident reporting patterns TSA has observed from MTSA-regulated pipeline facilities. TSOC has coordinated with the NRC to obtain pipeline incident reports that may be of concern to TSA, in the event that a MTSA-regulated pipeline operator submits a report only to the NRC.

The NRC also receives reportable incidents involving hazardous materials regulated by the Pipeline and Hazardous Materials Safety Administration (PHMSA) of the Department of Transportation under 49 CFR part 191 for natural gas and other gases transported by pipeline and 49 CFR part 195 for liquids transported by pipeline.⁷ Although the NRC does accept suspicious activity reports, this reporting is not the type of incident for which reporting is mandated under the PHMSA pipeline regulations. To the extent that terrorist activity resulted in an incident meeting the reporting criteria of the PHMSA regulations, duplicative reporting could occur should an operator choose to contact both the NRC and TSOC. TSA does not anticipate that this will be a common event.

For the mandatory requirements, TSA’s SD also requires appointment of a Cybersecurity Coordinator and alternate Cybersecurity Coordinator(s) and submission of contact information to TSA. TSA has a consolidated listing of contact information for pipeline Cybersecurity Coordinators. This collection effort will not duplicate the efforts of other agencies.

Cybersecurity incidents and potential cybersecurity incidents are reported to CISA. To avoid duplicate reporting, information provided to CISA pursuant to the SD will be shared with TSA and may also be shared with the NRC and other agencies as appropriate. Similarly, any relevant information provided to TSA pursuant to the directive will be shared with CISA and may also be shared with the NRC and other agencies as appropriate. All reported information will be protected using appropriate system controls.

TSA may use the information, with company-specific data redacted, for TSA’s intelligence-derived reports. TSA and CISA also may use information submitted for vulnerability identification, trend analysis, or to generate anonymized indicators of compromise or other cybersecurity products to prevent other cybersecurity incidents.

5. If the collection of information has a significant impact on a substantial number of small businesses or other small entities (Item 5 of the Paperwork Reduction Act submission form), describe the methods used to minimize burden.

This collection is not expected to have a significant impact on small businesses or other small entities.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

As the lead Federal agency for pipeline security, TSA must maintain situational awareness of the industry in order to execute its security responsibilities. TSOC is TSA's 24/7 coordination center during security incidents. If incident information is not reported, the ability of the TSOC to coordinate any required agency involvement/response to the event may be inhibited.

With regard to cybersecurity incident reporting pursuant to the SD, it is critical that CISA and TSA are aware of cybersecurity incidents and potential cybersecurity incidents which may impact critical infrastructure and pipeline product delivery. CISA is DHS’s 24/7 coordination center for cyber security incidents. If incident information is not reported, the ability of CISA to coordinate any required agency involvement/response to the event may be inhibited. Information received by CISA may be shared with other agencies as necessary to support.

DHS must be able to coordinate cybersecurity incident information quickly and accurately with a pipeline owner/operator. For this reason, TSA must have a point of contact at each critical pipeline company to ensure communication regarding cybersecurity.

Additionally, if the information were not reported, DHS may not otherwise become aware of security incidents, which would affect the ability of the department to meet its statutory obligation to analyze potential cybersecurity threats across all critical infrastructure. In turn, loss of this information would reduce the efficacy of the intelligence products developed by TSA and CISA for its industry and government partners. Currently, industry suspicious incident reported information is used by TSA for several reports, including the Transportation Security and Industry Report, Pipeline Threat Assessments, and Transportation Intelligence Notes. If the collection of suspicious incident information is not conducted, it may hinder TSA’s ability to produce intelligence documents of benefit to the pipeline industry as well as other transportation and government stakeholders. The Cybersecurity Information Sharing Act of 2015 requires DHS, in consultation with interagency partners, to establish the Federal Government’s capability and process for receiving cyber threat indicators and defensive measures, and directs DHS to further share cyber threat indicators and defensive measures it receives with certain federal entities in an automated and real-time manner. 6 U.S.C. § 1504(c). If the information is not reported, CISA will not be able to alert other agencies that need the information to identify.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with the general information collection guidelines in 5 CFR 1320.5(d)(2).

This collection will be conducted consistent with the information collection guidelines, except for those in 5 CFR 1320.5(d)(2)(i), which requires respondents to report information to the agency more often than quarterly. Quarterly reporting would not meet the security needs that is the basis for this information collection. DHS needs owner/operators to report cybersecurity incident information as soon as practicable. For required reporting, information must be provided no later than 12 hours after a cybersecurity incident is discovered, or within 12 hours of recognition of a potential cybersecurity incident.

8. Describe efforts to consult persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d) soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

In SD Pipeline-2021-01, Enhancing Pipeline Cybersecurity, TSA provided detailed definitions, requirements and instructions related to cybersecurity incident reporting and the appointment of pipeline Cybersecurity Coordinators.

TSA invited public comment on this information collection requirement, a 60-day notice was published in the Federal Register on November 15, 2024 (89 FR 90305), and a 30-day notice was published on June 2, 2025 (90 FR 23353). TSA received no comments on the notices.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

No payment or gift will be provided to respondents.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

While there is no assurance of confidentiality provided to Cybersecurity Coordinators, TSA protects information collected from disclosure to the extent appropriate under applicable provisions of the Freedom of Information Act, Federal Information Security Management Act, E-Government Act, and Privacy Act of 1974. TSA would also appropriately treat any information collected that it determines is Sensitive Security Information and/or Personally Identifiable Information, consistent with the requirements of 49 CFR part 1520 and OMB Guidance, M-07-16.

To the extent permissible under the law, DHS will seek to protect the trade secrets and commercial and financial information of the pipeline owner/operators. See 49 CFR part 1520. In addition, any Personally Identifiable Information associated with reported incidents is handled in accordance with the System of Records Notices for DHS/TSA-001 Transportation Security Enforcement Record System 83 FR 43888 (August 28,2018); and DHS/TSA 011 - Transportation Security Intelligence Service Files, 75 FR 18867 (April 13, 2010). This collection is also covered by DHS/ALL/PIA-006 DHS General Contacts (June 15, 2007) and DHS/TSA/PIA-029 Operations Center Incident Management System (for incidents) (August 25, 2015).

For defensive measures and indicators shared under CISA’s framework, federal entities are required to apply appropriate controls to protect the confidentiality of cyber threat indicators that contain personal information of a specific individual or information that identifies a specific individual that is directly related to a cybersecurity threat or a use authorized under CISA to the greatest extent practicable. 6 U.S.C. § 1504(b).

11. Provide additional justification for any questions of sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

No personal questions of a sensitive nature are posed.

12. Provide estimates of hour burden of the collection of information.

TSA estimates that there will be 100 pipeline operator respondents and an estimated annual burden hours of 726 as discussed below:

Based on previous reporting under OMB approval, TSA anticipates voluntary reporting of pipeline security incidents will occur on an irregular basis. TSA estimates that approximately 118 incidents will be reported annually, requiring a maximum of 30 minutes (0.5 hours) to collect, review, and submit event information by the respondent’s Corporate Security Manager or equivalent. The annual burden hours are estimated at 59 hours.

TSA expects the mandatory reporting of pipeline cybersecurity incidents to CISA using CISA Reporting System will occur 20 times per year per pipeline operator. Each incident takes approximately 20 minutes (.33 hours) to gather the appropriate information and submit the report, therefore the annual burden to the public for this task is 100 × 20 × .33 hours = 667 hours (2,000 hours over 3 years).

TSA estimates one pipeline owner/operator will update their cybersecurity coordinator and/or alternate point of contact (POC) information each year due to turnover or other change in POC information, and it will take approximately 30 minutes (0.50 hours) to do so. The total burden for this task over 3 years is 1.50 hours.⁸

The average total time burden to the public for this information collection request is estimated to be 59 hours + 667 hours + 0.50 hours = 726 hours annually (2,179 hours over 3 years) for an estimated 100 estimated respondents annually. Based on the respondent’s Corporate Security Manager’s fully-loaded⁹ average hourly loaded wage rate of $114.44,¹⁰ TSA estimates an average total cost of $249,314 annually ($747,943 over 3 years). Table 1 summarizes these calculations.

Table 1: Public Time Burden and Cost
Year	Security Incident Responses	Time Burden Per Security Incident Report (Hrs)	Security Incident Reporting Time Burden (Hrs)	Cybersecurity Incident Responses	Time Burden Per Cybersecurity Incident Report (Hrs)	Cybersecurity Incident Report Time Burden (Hrs)	Cybersecurity Manager POC Info Responses	Time Burden Per POC Report (Hrs)	POC Reporting Time Burden (Hrs)	Total Annual Time Burden (Hrs)	Annual Time Burden Cost
	A	B = 0.5	C = A x B	D	E = .33	F = D x E	G	H = 0.5	I = G x H	J = C + F + I	K = J x $114.44
2024	118	0.5	59	2,000	.33	667	1	0.5	0.5	726	$83,104.75
2025	118		59	2,000		667	1		0.5	726	$83,104.75
2026	118		59	2,000		667	1		0.5	726	$83,104.75
Total	354		177	6000		2,000	3		1.5	2,179	$249,314.25
Average	118		59	2000		667	1		0.5	726	$83,104.75

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information. (Do not include the cost of any hour burden shown in Items 12 and 14).

TSA does not estimate a cost to the industry beyond the burden detailed in answer 12.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, and other expenses that would not have been incurred without this collection of information.

Based on previous reporting under OMB approval, TSA estimates that approximately 32 security incidents will be voluntarily reported annually to TSOC, requiring a maximum of 30 minutes (0.5 hours) to process the information provided by the respondents. The report is taken and processed by an H-Band TSA employee. The fully-loaded wage rate for an H-Band employee is $74.32.¹¹ TSA estimates 2,000 cybersecurity incidents will be reported annually to CISA under the SD’s requirements, and that it will take a maximum of 30 minutes (0.5 hours) to process these reports. TSA will receive an average of one Cybersecurity POC report, but the time burden to TSA to process the POC information is negligible. The total time burden to government is estimated to be 1,059 hours (3,177 over 3 years). TSA applies the fully-loaded wage rate of an H-Band employee of $74.32 to estimate the cost of the time burden to government. TSA estimates the total TSA burden to be $78,706 per year ($236,119 over 3 years). Table 2 summarizes these calculations.

Table 2: Federal Government Time Burden and Cost
Type of Information Reported	Number of Reported Security Incidents	Hour Burden to Process Report	Annual Hour Burden	Annual Hour Burden Cost
	A	B	C = A x B	D = C x $74.32
Security (Non-Cybersecurity) Incidents	118	0.5	59	$4,384.97
Cybersecurity Incidents	2000	0.5	1,000	$74,321.51
Cybersecurity POC Info (Year 1)	1	0	0	$0.00
Total	2119		1,059	$78,706.48
Average	706.33		3177	$236,119.45

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I.

There are no program changes from the previously reported information collection request; however, TSA is updating the burden estimates as the security incidents’ responses increased from 32 to 118, and the cybersecurity coordinator responses decreased from 34 to 1. In addition, TSA is adjusting the time burden estimate of the cybersecurity incident responses from 2 hours to 20 minutes.

16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

Suspicious activity and security incident information, in redacted form, may be published in TSA intelligence-derived reports, which are distributed to pipeline industry and government stakeholders with a need-to-know.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

Not applicable.

18. Explain each exception to the certification statement identified in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

No exceptions noted.

1 Pub. L. 107-71 (115 Stat. 598; Nov. 19, 2001), as codified at 49 U.S.C. 114.

2 Pub. L. 110-53 (121 Stat. 266; Aug. 3, 2007).

3 See https://www.tsa.gov/sites/default/files/pipeline_security_guidelines.pdf.

https://www.tsa.gov/for-industry/surface-transportation.

4 Under section 1557(b) of the 9/11 Act, TSA is required to identify the 100 most critical pipeline operators. The criteria used to identify these systems and facilities is being used to designate the owner/operators subject to TSA’s SD. Due to the sensitive nature of this information, TSA is individually notifying each Owner/Operator that they are a designated critical operation subject to the SD’s requirements.

5 The additional requirement in the SD to conduct a cybersecurity assessment is covered under a separate OMB control number, 1652-0050.

6 See Section 106 of MTSA of 2002 (Pub. L. 107-295 (116 Stat. 2064; November 25, 2002).

7 For purposes of the PHMSA regulations, incidents are primarily related to safety concerns, including release of hazardous materials that results in death or serious injury, property damage, and unintentional loss as well as events that result in an emergency shutdown and other significant events. See 49 CFR 191.3.

8 TSA assumes that covered pipeline operators have previously submitted their cybersecurity coordinator and alternate POC information per the requirements of SD Pipeline 2021-01 series. Therefore, this analysis only accounts for the ongoing updates that may occur due to turnover or updating contact information.

9 A fully-loaded wage rate accounts for non-wage components of employee compensation, such as healthcare and retirement benefits.

10 The unloaded mean hourly wage rate for an Operations Specialties Manager is $80.48. BLS. May 2023 National Industry-Specific Occupational Employment and Wage Estimates. NAICS 486000 - Pipeline Transportation. OCC 11-1021 General and Operations Managers. Last modified April 3, 2024 (accessed December 16, 2024). https://www.bls.gov/oes/2023/May/naics3_486000.htm

TSA calculates a load factor to increase the unloaded wage to account for non-wage compensation. TSA calculates this factor by dividing the total compensation of private industry workers ($43.94) by the wage and salary component ($30.90) of compensation to get a load factor of 1.422006. BLS. Employer Costs for Employee Compensation - March 2021. Table 1. Employer costs per hour worked for employee compensation and costs as a percent of total compensation: private industry workers. Last modified September 10, 2024 (accessed December 16, 2024). https://www.bls.gov/news.release/archives/ecec_09102024.htm.

The fully loaded wage rate is calculated by multiplying the unloaded wage rate by the load factor. $114.44 = $80.48 × 1.422006.

11 TSA, Resource Management Office (CY2024). This is a fully-loaded rate for an SV H-band (GS-12 equivalent), Step 5 employee located in the National Capital Region (NCR).