Spring 2023 Unified Agenda
DHS
Yesterday the Biden Administration published their Spring 2023 Unified Agenda). The Unified Agenda lays out the major regulatory measures that the Administration is considering taking action on over the next year. The listing of a rulemaking or the estimated action dates associated with a rulemaking are aspirational at best and no guarantee of agency action. There are 80 rulemakings listed for DHS with 33 rulemakings on the Long-Term Action list for DHS.
DHS Rulemakings
The DHS portion of the UA lists 80 rulemakings, eight of which will be covered here in this blog if/when any actions are taken on them. The table below shows those eight rulemakings.
There was one new rulemaking added since the Fall 2022 Unified Agenda was published in January; Cybersecurity Incident Reporting for Critical Infrastructure Act Regulations (1670-AA04).
Three rulemakings were removed since the early version was published:
Homeland Security Acquisition Regulation: Information Technology Security Awareness Training (HSAR Case 2015-002) (1601-AA78) – Moved to the Inactive List,
Civil Monetary Penalty Adjustments For Inflation (1601-AB07) – final rule published, and
2022 Liquid Chemical Categorization Updates (1625-AC73) – Moved to Long Term Actions
New Rulemaking
The Cybersecurity Incident Reporting rulemaking is a new addition to the Unified Agenda. According to the Abstract for the rule:
“The Cybersecurity and Infrastructure Security Agency (CISA) will propose regulations to implement certain aspects of the Cybersecurity Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). Specifically, CIRCIA directs CISA to develop and implement regulations requiring covered entities to submit reports to CISA regarding covered cyber incidents and ransom payments. CIRCIA requires CISA to publish a Notice of Proposed Rulemaking (NPRM) within 24 months of the date of enactment of CIRCIA as part of the process for developing these regulations. CISA previously issued a Request for Information on September 12, 2022, and held a series of listening sessions seeking public input on potential aspects of the proposed regulation prior to publication of the NPRM.”
CISA ‘expects’ (remember aspirational at best) to publish the Notice of Proposed Rulemaking in March 2024.
CFATS Update
The CFATS rulemaking has been on and off the Unified Agenda for quite some time. The notice of proposed rulemaking was submitted to the OMB’s Office of Information and Regulatory Affairs (OIRA) in April, so there is a remote possibility that the NPRM may be published in June as forecast, but it will probably be later this summer.
The updated abstract for the rulemaking notes:
“The Cybersecurity and Infrastructure Security Agency (CISA) previously invited public comment on an Advance Notice of Proposed Rulemaking (ANPRM) during August 2014 for potential revisions to the Chemical Facility Anti-Terrorism Standards (CFATS) regulations. The ANPRM provided an opportunity for the public to provide recommendations for possible program changes. In June 2020, CISA published for public comment a retrospective analysis of the CFATS program. And in January 2021, CISA invited additional public comment through an ANPRM concerning the removal of certain explosive chemicals from CFATS. CISA intends to address many of the subjects raised in both ANPRMs and the retrospective analysis in this regulatory action, including potential updates to CFATS cybersecurity requirements and Appendix A to the CFATS regulations.”
Long Term Agenda
There is a separate section of the Unified Agenda for rulemaking actions that are on the minds of agencies, but for which there is no current intention by those agencies to take action, the Long-Term Actions list. Rulemakings move back and forth between the Long-Term Actions list and the main Unified Agenda listing, sometimes without rhyme or reason. There are currently three rulemakings on the DHS list that would be covered here if the agencies were to act on those rulemakings.
The new addition to the list is the Coast Guard’s 2022 Liquid Chemical Categorization Updates (1625-AC73). This was moved from the active listing in the previous version of the Unified Agenda. They are aspirationally forecasting the publication of the final rule next May.