Data Security Requirements for Accessing Confidential Data Federal Register Notice

Agency Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; Data Security Requirements for Accessing Confidential Data

DATES:

To ensure consideration, comments regarding this proposed information collection must be received on or before September 8, 2026.

SUPPLEMENTARY INFORMATION:

I. Abstract

Title III of the Foundations for Evidence-Based Policymaking Act of 2018 (hereafter referred to as the Evidence Act) mandated that OMB establish a Standard Application Process (SAP) for requesting access to certain confidential data assets. Specifically, the Evidence Act requires OMB to establish a common application process through which agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, may apply for access to certain confidential data assets collected, accessed, or acquired by a statistical agency or unit. This process maintains stringent controls to protect confidentiality and privacy, as required by the law governing the data-owning agency.

Data collected, accessed, or acquired by statistical agencies and units is vital for developing evidence of conditions, characteristics, and behaviors of the public and on the operations and outcomes of public programs and policies. This evidence can benefit the stakeholders in the programs, the broader public, as well as policymakers and program managers at the local, State, Tribal, and National levels. The many potential benefits of access to data for evidence building notwithstanding, the U.S. Census Bureau and the U.S. Bureau of Economic Analysis (BEA) are required by the law governing their activities to maintain controls to protect the confidentiality and privacy of the data they collect.

The SAP Portal is a web-based application for the public to request access to confidential data assets from federal statistical agencies and units. The objective of the SAP Portal is to increase public access to confidential data for the purposes of evidence building and reduce the burden of applying for such access. Once an individual's application in the SAP Portal has received a positive determination by the data-owning agency, the data-owning agency(ies) or unit(s) will begin the process of collecting information to fulfill their data security requirements.

The paragraphs below outline the process for BEA and Census to collect information fulfilling their data security requirements, consistent with their statutory requirements.

Collection of Information for Data Security Requirements

In the instance of a positive determination for an application requesting access to a U.S. Census Bureau and/or a U.S. Bureau of Economic Analysis confidential data asset through the SAP process, the U.S. Census Bureau and/or the U.S. Bureau of Economic Analysis will contact the applicant(s) to initiate the process of collecting information to fulfill their security requirements. These requirements include additional information necessary for the statistical agency or unit to place the applicant(s) in a trusted category that may include the applicant's successful completion of a background investigation, confidentiality training, nondisclosure, and data use agreements.

The U.S. Census Bureau and the U.S. Bureau of Economic Analysis's data security requirements include the completion of trainings on topics such as data stewardship, controlled unclassified information (CUI), records management, safety, and IT Security. Requirements also include the completion of forms:

• Form BC-1759, Special Sworn Status-U.S. Census Bureau
• OF-306 Declaration for Federal Employment
• Fair Credit Release-U.S. Census Bureau
• Selective Service Form-U.S. Census Bureau
• BC-4002 Foreign National Residence History-U.S. Census Bureau
• BC-4003 Initial Information Sheet-U.S. Census Bureau
• BC-4004 Researcher Semi-Annual Contact Information and Travel History Update-U.S. Census Bureau
• Sworn Statement (Affirmation) of Nondisclosure for Consultant to BEA-U.S. Bureau of Economic Analysis
• Annual Census Bureau Data Handling University Training, including:

○ Data Stewardship & Controlled Unclassified Information (CUI)

○ Title 13 Awareness Course

○ Title 26 Awareness Training

○ Cybersecurity Awareness & Protection Course

• Annual Census Bureau Records Management Training
• Annual Bureau of Economic Analysis Title 26 Awareness Training
• Annual Bureau of Economic Analysis Data Stewardship and IT Security Training
• Annual Bureau of Economic Analysis Records Management 101 Training
• Annual Bureau of Economic Analysis Active Shooter Training
• Annual Bureau of Economic Analysis Employees Safety Training

II. Method of Collection

Electronically (internet).

III. Data

OMB Control Number: 0607-1026.

Form Number(s): Various.

Type of Review: Regular submission, Request for an Extension, without Change, of a Currently Approved Collection.

Affected Public: Individuals who are seeking a security clearance with either the U.S. Census Bureau or the U.S. Bureau of Economic Analysis.

Estimated Number of Respondents: 900.

Estimated Time per Response: On average, 57 minutes for the U.S. Bureau of Economic Analysis and 433 minutes for the U.S. Census Bureau. This estimate includes completion of paperwork and training requirements. The amount of time to complete the agreements and other paperwork that comprise the U.S. Census Bureau and the U.S. Bureau of Economic Analysis's security requirements will vary based on the confidential data assets requested and the access modality. This estimate does not include the time needed to complete and submit an application within the SAP Portal. All efforts related to SAP Portal applications occur prior to and separate from the U.S. Census Bureau and the U.S. Bureau of Economic Analysis's effort to collect information related to data security requirements.

Estimated Total Annual Burden Hours: Overall, per year, the U.S. Census Bureau and the U.S. Bureau of Economic Analysis estimate they will collect data security information for a total of 300 application submissions that received a positive determination within the SAP Portal. The U.S. Census Bureau and the U.S. Bureau of Economic Analysis estimate that the total burden for the collection of information for data security requirements and completion of training over the course of the three-year OMB clearance will be about 7,350 hours and, as a result, an average annual burden of 2,450 hours.

Estimated Total Annual Cost to Public: $0. There is no cost to the respondent other than time to answer the information request.

Respondent's Obligation: Mandatory.

Legal Authority: Data collection for this project is authorized under 13 U.S.C. 9 and 23(c) for the Census Bureau and 22 U.S.C. 3104 and 15 CFR part 80 for BEA.

IV. Request for Comments

We are soliciting public comments to permit the Department/Bureau to: (a) Evaluate whether the proposed information collection is necessary for the proper functions of the Department, including whether the information will have practical utility; (b) Evaluate the accuracy of our estimate of the time and cost burden for this proposed collection, including the validity of the methodology and assumptions used; (c) Evaluate ways to enhance the quality, utility, and clarity of the information to be collected; and (d) Minimize the reporting burden on those who are to respond, including the use of automated collection techniques or other forms of information technology.

Comments that you submit in response to this notice are a matter of public record. We will include, or summarize, each comment in our request to OMB to approve this ICR. Before including your address, phone number, email address, or other personal identifying information in your comment, you should be aware that your entire comment-including your personal identifying information-may be made publicly available at any time. While you may ask us in your comment to withhold your personal identifying information from public review, we cannot guarantee that we will be able to do so.