NPPD Cyber Security Evaluation ICR – 60 Day Notice

DHS published an initial information collection request (ICR) in today’s Federal Register (76 FR 22409) to allow them to collect information in support of their new cyber security evaluation program. According to the ICR, this program was mandated by Congress in “House Report 111-298 and Senate Report 111-31” as part of an effort to develop tools for “all levels of government to complete a cyber network security assessment so that a full measure of gaps and capabilities can be completed”.

This a program targeted at government agencies (Federal, State and local) and it has no apparent affect on industry in general or specifically on the chemical security community. I only mention it here because it is an example of the kind of information collection that really needs to take place to establish the current state of cyber security.

Public comments on the ICR are requested. Comments can be submitted via the Federal eRulemaking Portal (http://www.regulations.gov/, Docket# DHS-2011-0012). Comments should be submitted by June 20, 2011.

Duplicate DHS ICR

Earlier this month I noted that the Obama Administration was more aggressive than its predecessor in filing information collection requests (ICR) with the Office of Management and Budget (OMB), apparently reflecting a more expansive definition of what is required under the Paperwork Reduction Act of 1995. Yesterday it was taken to a new level when an ICR 60-day notice was posted in the Federal Register that was a word-for-word duplicate of an earlier submission made by the DHS National Protection and Programs Directorate; that earlier filing was made on September 14th. Now, in the vast expanse of the Federal Government, this must certainly rank very near the bottom of the severity list of government errors. I am not sure where the mistake was made in the office of the Chief Information Officer at DHS NPPD or whether it was made at the Government Printing Office where the Federal Register is assembled. Perhaps it was even the OMB that caused the error. This ranks even lower on the magnitude of cost list for government errors. I’m sure that there is almost no incremental administrative cost for the filing of this ICR. The people doing the work were going to get paid for the couple of minutes involved in processing this ICR. There might have been an extra page in yesterday’s Federal Register, but since most people (but certainly not all) receive the FR electronically, the extra paper and printing costs are inconsequential. If this is such an inconsequential error, why am I even pointing it out? It just goes to show how often government rules become counter productive. The original point of the Paperwork Reduction Act was to reduce the amount of government paperwork that people and business were required to complete. I would be surprised if there have been many (if any) significant federal forms that were prevented or removed by this act in the last ten years. I would bet, however, that the cost of administering the program is significant. I would like to suggest to the Obama Administration that, if they are looking for government programs to reduce or eliminate as cost saving measures, this is one program that ought to be on their list. Lacking that, they need to re-evaluate their increased emphasis on making initial filings existing programs. If the program needs to be eliminated, get rid of it. If not, don’t waste the time.