Review - OMB Approves Yet Another TSA Pipeline Cybersecurity Emergency ICR – 7-29-22

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an emergency information collection request (ICR) revision for the TSA’s “Pipeline Corporate Security Review”. This is the same ICR (1652-0056) for which OIRA had just approved a three-year extension earlier this week. TSA submitted this emergency ICR revision to support another change to the pipeline security directive (Security Directive Pipeline-2021-02C) that was published this week.

Change in Burden Estimate

Unusually for an emergency ICR revision, the approved revision does include a change in burden estimate. According to the Supporting Document submitted to OIRA, the revised ICR includes three new information collection requirements. The table below shows all five elements of the revised ICR burden estimate.

Collection Requirements	Responses	Hrs/Resp	Burden
Pipeline Corporate Security Review (PCR) Initial Interviews	20	8	160
PCR Re-interview	20	3	60
Cybersecurity Implementation Plan (new)	100	400	40,000
Cybersecurity Incident Response Plan	100	80	8,000
Audits Plans of Cybersecurity Measures (new)	100	40	4,000
Compliance Documentation (new)	100	80	8,000
Totals	440	N/A	60,220
Old Estimate	331	N/A	12,830

Moving Forward

As with most emergency ICR revision requests, OIRA is only approving the revised data for six months. TSA will be required to go through the normal publish and comment process for that extension. Additionally, OIRA noted:

“Given that this is an emergency approval that does not have the benefit of public input prior to implementation, the agency will brief OIRA on the comments it has received and lessons learned as it implemented this package when this package is resubmitted during the next six months following the normal notice and comment procedures. TSA will also work toward allowing as much time for comment as possible on its emergencies to avoid new aspects of its collections going into effect without the benefit of public input.”

 

For more information about the revised ICR approved by OIRA, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/omb-approves-yet-another-tsa-pipeline - subscription required.