Review - DOD Publishes DFARS Cyber Reporting 60-day ICR Extension Notice

Today the DOD’s Defense Acquisition Request System published a 60-day information collection request (ICR) extension notice in the Federal Register (90 FR 24196-24197) for “Defense Federal Acquisition Regulation Supplement (DFARS); Cyber Incident Reporting and Cloud Computing”. While this is listed as an ‘extension’, changes have been made to the burden estimate. The table below shows the differences between the burden estimates of the current and proposed ICR.

Commentary

The whole point of the ICR process is to allow for the regulated public to review the assumptions made by federal agencies about the burden placed upon the public by these information requests. Collection of data by such agencies is frequently necessary for the administration of various government regulations, but the government owes it to their served constituencies to minimize the reporting burden placed upon those folks. Periodically updating those estimates, based upon recent regulatory history, makes eminent sense.

Unfortunately, as in this case, federal agencies frequently do not provide sufficient information to allow a realistic review of the burden estimate as is required by statute. There are, however, few people that call foul in response to that inadequate information. If industry started submitting comments about the inadequacy of the presented information, then OIRA would be more likely to hold agencies to the requirements of Paperwork Reduction Act.

 

For more information about the changes in the burden estimate, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/dod-publishes-dfars-cyber-reporting - subscription required.