OMB Approves CISA SLTT Incident Collection ICR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced the emergency approval of an information collection request (ICR) for the new State, Local, Tribal and Territorial (SLTT) Incident Collection. According to the supporting document provided to OIRA, CISA established the pilot SLTT Cyber Reporting and Threat Information Sharing Pilot in September 2019.

That supporting document explains the program this way:

“The SLTT Incident Collection Form is a voluntary form that will be posted on fraudsupport.org which is a public facing website operated by the Cybercrime Support Network (the organization awarded a cooperative agreement to conduct the Pilot). Respondents can fill out the form for each instance where they believe they have been victim of a cyber incident, including ransomware. The collection of the cyber threat incident data is critical to the work of the pilot as it ensures that citizens and SMBs receive tailored responses to help them understand what has occurred. CSN will provide detailed incident data to the appropriate state agencies for investigation and to assist SMBs, local governments and other critical infrastructure facilities recover from the cyber attacks. These victims would largely otherwise go without assistance without the information captured through this effort.”

The form for this collection will be maintained on fraudsupport.org which is a public facing website operated by the Cybercrime Support Network (the organization awarded a cooperative agreement to conduct the Pilot).

As part of the emergency approval OIRA is requiring CISA to publish the normal 60-day and 30-day ICR notices.