Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received the 30-day ICR renewal notice from the TSA for “Cybersecurity Measures for Surface Modes” that the TSA announced yesterday in the Federal Register. The data provided to OIRA should have included more of the information that a commentor would have needed to provide the public feedback on this ICR that was requested in both the 60-day and 30-day ICR notices.
Information Collections
The data submitted to OIRA lists three information collections included within this ICR:
Cybersecurity contingency/response (SIC) plan,
Cybersecurity vulnerability assessment, and
Designation of Cybersecurity Coordinator
The documents explaining these three collections all have the same title (“1652-0074 CyberMeasSurfModes SS.docx”) with different URL’s. The reason for the same title being used for each document is that all three documents are identical. They refer back to the four requirements listed below in the two respective Security Directives {SD 1580-2021-01 – Rail; SD 1582-2021-02 (actually SD 1582-2021-01)}:
Designate a Cybersecurity Coordinator,
Report Cybersecurity Incidents,
Cybersecurity Incident Response Plan, and
Cybersecurity Vulnerability Assessment
While the burden estimate in the Supporting Document provided to OIRA includes voluntary responses by Over-the-Road Bus Operators (OTRB) these information collection documents do not provide a reference to Information Circular (Surface Transportation IC-2021-01) that request that voluntary participation.
There is no specific mention of ‘Report Cyber Incidents’ on the Information Collection List. It is referenced in the repetitive documents listed above, so that is covered, but it is not included in the burden estimate listed on that page. This is explained in the Supporting Statement; that requirement is included in an existing CISA ICR (1670-0037).
Burden Estimate
The table below summarizes the burden estimate details provided in the Supporting Statement submitted to OIRA.
INSERT Burden Estimate
The hours burden is calculated based upon the following hours per submission estimates from the TSA:
Cybersecurity Coordinator – 1 hour,
Cybersecurity Plan – 80 hours, and
Cybersecurity Assessment – 42 hours
The TSA adds 50 hours of burden each in Year 2 and 3 of the data collection for updating cybersecurity coordinator information. This is odd because each of the Security Directives expire at the end of this year.
Security Assessment Checklist
According to the Supporting Document (pg 2), a key component of this Information Collection is the completion of “a cybersecurity vulnerability assessment to address cybersecurity gaps using the form provided by TSA [emphasis added].” TSA has not included that form in the data submitted to OIRA. The TSA describes this requirement (Table, pg3) as an assessment of their “current cybersecurity posture consistent with the functions and categories found in the National Institute of Standards and Technology Cybersecurity Guidance Framework”, it is hard to imagine that this blank form could be sensitive enough that it cannot be made available to the public. Completed forms should certainly be considered Sensitive Security Information, but since the TSA is not, at this point at least, specifying security measures that need to be taken, the blank forms should be part of the public record of this ICR.
Comments Solicited
In accordance with regulatory requirements, the TSA is soliciting public comments on this ICR. Comments should be submitted to OIRA via their website by clicking on the ‘Comments’ button on the page for this ICR. Comments should be submitted by May 9th, 2022.