DHS reports CSAT Data Collection Requirements

Yesterday DHS had a Data Collection Report for the CSAT published in the Federal Register. This is required any time that a federal agency requires the public (or businesses in this case) to provide data to that agency. The report lists who is required to provide information, the expected number of respondents and how much time will be required to provide the information. This report is required under the Paperwork Reduction Act (PRA) of 1995.

 

The table below summarized the data provided in the notice. It appears as if DHS is using a value of $87.81 per hour for determining their cost. I would assume that this value is dictated by the PRA.

 

	Registration	Top Screen	CVI Training	SVA	SSP
# Respondents	16,667	16,667	16,667	2,500	2,167
Hrs/Response	1	30	0.5	153	84
Total Hours	17 K	500 K	8 K	386 K	182 K
Total Cost	$1.5 M	$44.4 M	$0.7 M	$34.8 M	$14.6 M

 

The “Number of Respondents” data does not track with other information provided by DHS. On November 5th, Robert Stephan, DHS Assistant Secretary for Infrastructure Protection, told a news conference that the current estimate of the number of facilities that will be completing the Top Screen is “less than 50,000” and that about “5 to 8,000 facilities” will be classified as High-Risk Facilities that have to complete SVA’s. The Final Rule for Appendix A gives a figure of about 40,000 for the number of facilities expected to be required to submit a Top Screen based on the requirements of that Rule.

 

The difference between the SVA and SSP number is probably due to the fact that facilities that are put into the lowest High-Risk classification (Tier 4) may submit an alternative SSP outside of the CSAT system if they so choose. Given the discrepancy previously noted in the numbers for the Top Screen and SVA, this number also appears to be understated by a significant factor.

 

The assumption that only one person from each affected facility will be completing the CVI training is, in my mind, too low. Because most facilities will have little or no experience handling “classified” information, I would expect that at least two or three people from each facility would need to go through this training program to ensure that an adequate number of people understand the requirements for handling, storing, transmitting, and destroying this information.

 

The time allotted for completing the Registration and CVI training match well with my experience completing these requirements. I think that the estimate for completing the Top Screen is too high, unless DHS is including the data collection organization time. If that is true (and it would seem reasonable in keeping with the purpose of this report), then the time estimates for the Security Vulnerability Assessment (SVA) are an order of magnitude too low if you count total man hours involved in the SVA. Based on my experience with conducting Process Hazard Analysis (a similar type review for process safety) there will be at least four or five people per facility doing about 40 hours of work per chemical/process involved in the review. I would expect that a Site Security Plan would take at least as much time to complete as would the SVA.

 

Anyone wishing to make official comments on this report should send the comments to:

 

Office of Infrastructure Protection 

Attn: Matthew Bettridge 

Department of Homeland Security 

NPPD/OIP/CSCD Mail Stop 8100, DHS, 

Washington, DC 20528

Tags: Chemical Facility Security, CSAT Time-Cost Analysis