OMB Disapproves New BIS Cyber Enabled Activities ICR

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that the DOC’s Bureau of Industry and Security (BIS) improperly submitted an emergency information collection request (ICR) for “Taking Additional Steps To Address the National Emergency With Respect To Significant Malicious Cyber-Enabled Activities”. While there is nothing in yesterday's notice that explains why the emergency ICR was disapproved, it looks like OIRA objected to the use of an emergency request instead of the normal publish and public comment process required for ICR’s.

The supporting document that BIS submitted to OIRA mentions a notice of proposed rulemaking on the same topic as the justification for the ICR. This is the notice of proposed rulemaking that OMB approved last week. And the letter requesting emergency approval of the ICR notes that BIS intends to publish that NPRM on Friday, noting that there will be a 90-day comment period on that NPRM. Typically, NPRMs contain the initial 60-day ICR notice required for any new or revised ICR’s needed to support agency actions under that proposed rule. It looks like OIRA is expecting BIS to follow that procedure instead of using the emergency ICR approval process.