ML23072A156

OMB 3150-0246 Draft Supporting Statement for CUI Challenge Request 2023

ML23072A156
Person / Time
Issue date:	04/12/2023
From:	NRC/OCIO
To:
References
OMB 3150-0246
Download: ML23072A156 (7)

Text

DRAFT OMB SUPPORTING STATEMENT FOR

NRC CUI PROGRAM CHALLENGE REQUEST FORM (3150-0246)

EXTENSION

Description of the Information Collection

Controlled Unclassified Information (CUI) is a new information security program utilized by the executive branch. The CUI program is intended to standardize th e way the executive branch handles unclassified information that, although unclassified, i s still sensitive and merits special controls to prevent unauthorized access. It introduces a new fr amework for the entire executive branch to designate, mark, safeguard, and disseminate unclassif ied information that laws, regulations, or government-wide policies require or allow agenc ies to protect using safeguarding or dissemination controls.

The CUI program was established pursuant to Executive Order 135 56, "Controlled Unclassified Information." The National Archives and Records Administration (NARA) has issued government-wide implementing regulations for executive branch agencies to implement the CUI program at 32 CFR Part 2002.

32 CFR 2002.50 Challenges to Designation of Information as CUI requires that agencies have a process to accept and manage challenges to CUI status (which may include improper or absent marking). In order to implement this requirement, the NRC staf f has developed an online form for this purpose.

A. JUSTIFICATION

1. Need For and Practical Utility of the Collection of Information

32 CFR 2002.50 requires that agencies must create a process to accept and manage challenges to CUI status. At a minimum, the information collection requirements for this process are that it must provide an oppor tunity for the challenger to define a rationale for belief that the CUI in que stion is inappropriately designated and ensure that challengers who authorized holders a re have the option of bringing such challenges anonymously.

The Nuclear Regulatory Commission (NRC) CUI Program Challenge R equest Process is an online reporting mechanism that provides the proc ess used for NRC CUI authorized holders to challenge the designation of informat ion that has been marked as CUI as improperly or incorrectly designated. Authori zed holder includes any individual or organization who has been provided w ith CUI and has a lawful government purpose to possess CUI. This can include NRC staff members, NRC contractors, licensees, an Agreement State, or a vendor tha t has a lawful government purpose to possess the information. Any authorized holder who believes they have received unmarked CUI, may use this process to formally notify

1 the NRC CUI Senior Agency Official (SAO). The process also allows for the NRC CUI SAO and CUI Program Manager to process such requests and to issue a Final Decision from the CUI SAO.

The NRC CUI Challenge Request Process is not intended to be use d to address all disagreements regarding the proper designation of CUI. Aut horized holders are encouraged to seek or utilize less formal means when resolving internal good faith disputes over the proper designation of information as CUI, suc h as discussion with the creator or designator of the information in disputes. Where resolution cannot be achieved through less formal means, the CUI Challenge Request Process is available.

2. Agency Use of Information

The information requested in this collection is the minimum nec essary for authorized holders to file a specific request challenging the d esignation of materials as CUI. The NRC uses this information to review CUI designations and to adjust these designations as needed. Each information reques t, along with the reason why the NRC is requesting such information, is provided below:

Requestor Information (Optional Field):

• This contact information is being collected so that the NRC can, if necessary, obtain clarifying information from the Requestor to assist with processing the Requestors CUI Challenge Request. This informa tion will also enable the NRC to notify the Requestor of the NRCs CUI Ch allenge Request Decision. To comply with 32 CFR 2002.50(c)(5), this is an Optional Field.

Are you requesting to remain anonymous?:

• This Yes / No question is being asked to ensure compliance w ith 32 CFR 2002.50(c)(5), which requires agencies to ensure that CUI Chall enge Requests can be brought anonymously. The response to this ques tion will greatly assist the NRC CUI Program in properly handling the CUI Challenge Request, especially in a scenario where the Requestor identifies themselves to the CUI Program Manager, but asks to be anonymous to all other participants in the CUI Challenge Process.

Can you provide unique identifying information for the document / content to support review by the NRC CUI Senior Agency Official?:

• This information is being collected so that the NRC can more r eadily identify the document or information that is being challenged. Without receiving this information, the NRC may not have a clear unders tanding of what document or information is being challenged in the request. If the NRC still has questions about what is being challenged, the CUI Program Manager will reach out to the Requestor requesting additional c larifying information, providing that the Requestor completed the Reques tor Information Field.

2 Do you know if this Information is associated with any ongoing (active or inactive)

Government litigation that may or may not involve the NRC? If known, please identify the Agency / Department(s) involved in the legal action and the docket number, if applicable.

• In accordance with 32 CFR 2002.50(b), the NRC excludes from it s CUI Challenge Process any CUI that is currently involved in Governm ent litigation or a challenge to a CUI designation arising out of G overnment litigation. This information is being sought to help ensure th at CUI Challenge Requests that involve such information are properly r outed to the relevant litigation process/parties and are not inappropria tely resolved through the CUI Challenge Process.

• The exclusion in 32 CFR 2002.50(b) for information involved in Government litigation is not limited to litigation in which the NRC is a party.

Activities and facilities regulated by the NRC may have overlap ping jurisdiction with other federal agencies (DOL, OSHA, FERC, etc. ) and thus it is possible that CUI held by the NRC may be relevant to Government litigation involving other agencies. Thus, the form asks the R equestor whether he or she is aware of association with any Government l itigation, regardless of whether the NRC is a party.

What is the Informations current CUI designation?

• The purpose of the CUI Challenge Process is to allow individua ls to challenge the designation of CUI if they believe it has been in appropriately designated. This question is being asked because it is a neces sary component to understanding the nature of the CUI Challenge Requ est.

This information also better enables the NRC CUI Program Manage r to understand the nature of the information that is the subject of the Challenge Request and contact the proper individuals within the NRC to he lp resolve the request based on the subject matter.

If the Information is not currently marked as CUI and you believe that it should be, please identify the proposed CUI category name(s), and if it is Basic or Specified.

• The CUI Challenge Process permits Requestors to file a Challen ge Request when they believe that Uncontrolled Unclassified Inform ation (UUI) should in fact be designated as CUI. This question is be ing asked because it is a necessary component to understanding the nature of the CUI Challenge Request. This information also better enables th e NRC CUI Program Manager to understand the nature of the information tha t is the subject of the Challenge Request and contact the proper individ uals within the NRC to help resolve the request based on the subject matter.

If the Information is currently marked as CUI and you believe that it is not CUI, please provide your basis here to justify removal of the CUI marking(s).

• The CUI Challenge Process permits Requestors to file a Challen ge Request when they believe that information currently designated as CUI should in fact be uncontrolled. This field allows the Requesto r to provide his or her basis for requesting that CUI be decontrolled. This information

3 is essential for the NRC in its consideration of the CUI Challenge Request and whether to take action based on the request.

The NRC CUI Program goal is to make a decision on Challenge Requests that it receives within 45 calendar days of the requests submission. If there is a need for an expedited NRC review, please descr ibe why an expedited review is needed.

• The NRC anticipates that some CUI Challenge Requests may be necessary to resolve in an expedited manner, depending on the circumstances. This question is being asked so that the Reques tor can indicate whether he or she believes that such circumstances exi st and why.

This information can then be used by the NRC to determine wheth er it agrees that expedited consideration is warranted, improving the NRCs ability to deliver a timely response to the Requestor under suc h circumstances.

Rationale for CUI Challenge:

• This question is being asked so that the Requestor can provide his or her basis for filing the CUI Challenge Request. This information i s essential for the NRC in its consideration of the CUI Challenge Request and w hether to take action based on the request.

3. Reduction of Burden Through Information Technology

The NRC has issued Guidance for Electronic Submissions to the NRC which provides direction for the electronic transmission and submitta l of documents to the NRC. Electronic transmission and submittal of documents can be accomplished via the following avenues: the Electronic Informa tion Exchange (EIE) process, which is available from the NRC's Electronic Su bmittals Web page, by Optical Storage Media (OSM) (e.g. CD-ROM, DVD), or by e-mail. NRC staff estimates that approximately 100 percent of the potential responses will be filed electronically.

All CUI challenge requests (100%) will be submitted to the NRC electronically via a web form listed on the NRCs public-facing website. There wi ll be no paper-based submissions for this collection.

4. Efforts to Identify Duplication and Use Similar Information

No sources of similar information are available. There is no d uplication of requirements.

5. Efforts to Reduce Small Business Burden

Not applicable. This information collection does not impose a significant economic impact on small businesses. The information is being provided by authorized holders (i.e., NRC licensees, applicants, vendors, etc.) who de cide to formally challenge the NRCs CUI designation of a document that they hav e a lawful government purpose to access and is not available from any othe r sources. The same information is required of every submission.

4

6. Consequences to Federal Program or Policy Activities if the Collection Is Not Conducted or Is Conducted Less Frequently

This information is collected only when authorized holders subm it a challenge to CUI designations. It could not be less frequently. If the col lection of information were not collected, the NRC could not comply with the requireme nts of 32 CFR 2002.

7. Circumstances Which Justify Variation from OMB Guidance

Not applicable.

8. Consultations Outside the NRC

Opportunity for public comment on the information collection re quirements for this clearance package was published in the Federal Register.

9. Payment or Gifts to Respondents

Not applicable.

10. Confidentiality of Information

Confidential and proprietary information is protected in accord ance with NRC regulations at 10 CFR 9.17(a) and 10 CFR 2.390(b).

11. Justification for Sensitive Questions

Not applicable.

12. Estimated Burden and Burden Hour Cost

The NRC estimates that it will receive 12 challenge requests pe r year.

The NRC estimates that it will take authorized holders approxim ately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to complete the challenge request, submit it to the NRC, and respo nd to inquiries from the CUI Program Manager. Which comes to a total cost of $5,220.00 (See Table 1).

The $290 hourly rate used in the burden estimates is based on t he Nuclear Regulatory Commissions fee for hourly rates as noted in 10 CFR 170.20, Average cost per professional staff-hour. For more informatio n on the basis of this rate, see the Revision Of Fee Schedules; Fee Recovery For Fiscal Year 2022 (87 FR 37214, Jun. 22, 2022).

5 Table 1: Reporting Burden Hours/Burden Cost to Respondents Estimated Estimated Estimated Estimated Estimated Item Burden Responses Burden Rate Total Cost Hours (yr) (hrs/yr) ($/hr) ($/hr)

CUI Challenge Request 1.5 12 18 $290.00 $5,220.00 Totals 12 18 $5,220.00

13. Estimate of Other Additional Cost

There are no additional costs associated with this information collection.

14. Estimated Annualized Cost to the Federal Government

The NRC estimates that the CUI Program Manager will screen and perform the initial analysis of the Challenge Request, determine the proces sing path for the challenge request, notify NRC employees to review the challenge request, and respond to the authorized holder who submitted the challenge re quest, once the final determination on the request has been completed. The NRC also estimates that the following people will review the challenge request at the behest of the CUI Program Manager: CUI SAO, a representative from NRCs Office of General Counsel, and, if necessary, NRC Technical Reviewer(s).

The NRC is using an agency estimated hourly rate of $290 for Fe deral employees working on this collection.

The NRC estimates that it takes the CUI Program Manager approxi mately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> to process the challenge requests. The NRC also estimates that it takes the challenge request reviewers approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> to review th e challenge request and to respond appropriately to the CUI Program Manager. Which comes to a total of $34,800 (See Table 2).

6 Table 2: Burden Hour/Burden Cost to the Federal Government

Estimated Estimated Estimated Estimated Estimated Item Hours Responses Burden Rate Total Cost (yr) (hrs/yr) ($/hr)

CUI Challenge Request - CUI 10 12 120 $290.00 $34,800.00 Program Manager CUI Challenge Request - 10 12 120 $290.00 $34,800.00 Reviewers Totals 240 $69,600.00

15. Reasons for Change in Burden or Cost

There is no change in burden or cost. Due to budget issues, whi ch has been resolved, the form was never deployed. This request is to extend the clearan ce in order to complete the form issuance and collect the intended information.

16. Publication for Statistical Use

Not applicable. The NRC does not plan to publish this informati on for statistical use.

17. Reason for Not Displaying the Expiration Date

The form in this information collection will display the OMB Co ntrol Number and the expiration date of OMB approval.

18. Exceptions to the Certificate Statement

There are no exceptions.

B. COLLECTIONS OF INFORMATION STATISTICAL METHODS

This collection of information does not employ statistical methods.

7