Everything you need to know about ranked-choice voting in one spot. Click to learn more!

Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information rule (2023)

From Ballotpedia
Jump to: navigation, search
New Administrative State Banner.png
What is a significant rule?

Significant regulatory action is a term used to describe an agency rule that has had or might have a large impact on the economy, environment, public health, or state or local governments. These actions may also conflict with other rules or presidential priorities. As part of its role in the regulatory review process, the Office of Information and Regulatory Affairs (OIRA) determines which rules meet this definition.


Administrative State
Administrative State Icon Gold.png
Five Pillars of the Administrative State
•Agency control
• Executive control
• Judicial control
•Legislative control
• Public Control
Click here for more coverage of the administrative state on Ballotpedia.
Click here to access Ballotpedia's administrative state legislation tracker.


The Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information rule is a significant rule issued by the U.S. Department of Homeland Security (DHS) effective July 21, 2023, that implemented information security measures and amended Controlled Unclassified Information (CUI) incident reporting to DHS. DHS issued the rule pursuant to its authority under the Federal Information Security Modernization Act of 2014 (FISMA).[1]

HIGHLIGHTS
  • Name: Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information
  • Code of Federal Regulations: 48 CFR 3001, 3002, 3004, and 3052
  • Action: Final rule
  • Type of significant rule: Other significant rule

    • Timeline

    The following timeline details key rulemaking activity:

    Background

    The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies to establish “information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of—(i) information collected or maintained by or on behalf of the agency; and (ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency,” according to the text rule.[1]

    The U.S. Department of Homeland Security (DHS) argued that additional security measures were needed to regulate contractor information handling after repeated incidents of unclassified but important information breaches. The Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information rule established additional guidance and rules related to how contractors should handle and protect controlled data.[1]

    Summary of the rule

    The following is a summary of the rule from the rule's entry in the Federal Register:

    “ DHS is issuing a final rule to amend the Homeland Security Acquisition Regulation (HSAR) to modify a subpart, remove an existing clause and reserve the clause number, update an existing clause, and add two new contract clauses to address requirements for the safeguarding of Controlled Unclassified Information (CUI). This final rule implements security and privacy measures to safeguard CUI and facilitate improved incident reporting to DHS. These measures are necessary because of the urgent need to protect CUI and respond appropriately when DHS contractors experience incidents with DHS information.[1][2] ”

    Summary of provisions

    The following is a summary of the provisions from the rule's entry in the Federal Register:[1]

    “

    This final rule strengthens and expands existing HSAR language to ensure adequate security when: (1) contractor and/or subcontractor employees will have access to CUI; (2) CUI will be collected or maintained on behalf of the agency; or (3) Federal information systems, which include contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI. Specifically, the final rule:

    • Identifies CUI handling requirements and security processes and procedures applicable to Federal information systems, which include contractor information systems operated on behalf of the agency;
    • Identifies incident reporting requirements, including timelines and required data elements, inspection provisions, and post-incident activities;
    • Requires certification of sanitization of government and government-activity-related files and information; and
    • Requires contractors to have in place procedures and the capability to notify and provide credit monitoring services to any individual whose Personally Identifiable Information (PII) or Sensitive PII (SPII) was under the control of the contractor or resided in the information system at the time of the incident.[2]
    		 ”

    Significant impact

    See also: Significant regulatory action

    Executive Order 12866, issued by President Bill Clinton (D) in 1993, directed the Office of Management and Budget (OMB) to determine which agency rules qualify as significant rules and thus are subject to OMB review.

    Significant rules have had or might have a large impact on the economy, environment, public health, or state or local governments. These actions may also conflict with other rules or presidential priorities. Executive Order 12866 further defined an economically significant rule as a significant rule with an associated economic impact of $100 million or more. Executive Order 14094, issued by President Joe Biden (D) on April 6, 2023, made changes to Executive Order 12866, including referring to economically significant rules as section 3(f)(1) significant rules and raising the monetary threshold for economic significance to $200 million or more.[1]


    The text of the Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information rule states that OMB deemed this rule significant, but not economically significant under section 3(f)(1) of E.O. 14094:

    “ This rule has been designated a 'significant regulatory action,' although not economically significant, under section 3(f) of E.O. 12866.[2] ”

    Text of the rule

    The full text of the rule is available below:[1]

    See also

    External links

    Footnotes

    1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 Federal Register, "Homeland Security Acquisition Regulation; Safeguarding of Controlled Unclassified Information," February 14, 2024.
    2. ↑ 2.0 2.1 2.2 Note: This text is quoted verbatim from the original source. Any inconsistencies are attributable to the original source.
    v • e
    The Administrative State
    MainThe Administrative State Project Badge.png
    Pillars
    Reporting
    Laws
    Administrative Procedure Act • Antiquities Act • Civil Service Reform Act • Clayton Antitrust Act • Communications Act of 1934 • Congressional Review Act • Electronic Freedom of Information Act • Federal Food, Drug, and Cosmetic Act of 1938 • Federal Housekeeping Statute • Federal Reserve Act • Federal Trade Commission Act of 1914 • Freedom of Information Act • Government in the Sunshine Act • Independent Offices Appropriations Act of 1952 • Information Quality Act • Interstate Commerce Act • National Labor Relations Act • Paperwork Reduction Act • Pendleton Act • Privacy Act of 1974 • Regulatory Flexibility Act • REINS Act • REINS Act (Wisconsin) • Securities Act of 1933 • Securities Exchange Act of 1934 • Sherman Antitrust Act • Small Business Regulatory Enforcement Fairness Act • Truth in Regulating Act • Unfunded Mandates Reform Act
    Cases
    Abbott Laboratories v. Gardner • A.L.A. Schechter Poultry Corp. v. United States • Association of Data Processing Service Organizations v. Camp • Auer v. Robbins • Chevron v. Natural Resources Defense Council • Citizens to Preserve Overton Park v. Volpe • Federal Trade Commission (FTC) v. Standard Oil Company of California • Field v. Clark • Food and Drug Administration v. Brown and Williamson Tobacco Corporation • Humphrey's Executor v. United States • Immigration and Naturalization Service (INS) v. Chadha • J.W. Hampton Jr. & Company v. United States • Lucia v. SEC • Marshall v. Barlow's • Massachusetts v. Environmental Protection Agency • Mistretta v. United States • National Federation of Independent Business (NFIB) v. Sebelius • National Labor Relations Board v. Noel Canning Company • National Labor Relations Board v. Sears, Roebuck & Co. • Panama Refining Co. v. Ryan • Securities and Exchange Commission v. Chenery Corporation • Skidmore v. Swift & Co. • United States v. Lopez • United States v. Western Pacific Railroad Co. • Universal Camera Corporation v. National Labor Relations Board • Vermont Yankee Nuclear Power Corp. v. Natural Resources Defense Council • Wayman v. Southard • Weyerhaeuser Company v. United States Fish and Wildlife Service • Whitman v. American Trucking Associations • Wickard v. Filburn • Wiener v. United States
    Terms
    Adjudication (administrative state) • Administrative judge • Administrative law • Administrative law judge • Administrative state • Arbitrary-or-capricious test • Auer deference • Barrier to entry • Bootleggers and Baptists • Chevron deference (doctrine) • Civil servant • Civil service • Code of Federal Regulations • Codify (administrative state) • Comment period • Compliance costs • Congressional Record • Coordination (administrative state) • Deference (administrative state) • Direct and indirect costs (administrative state) • Enabling statute • Ex parte communication (administrative state) • Executive agency • Federal law • Federal Register • Federalism • Final rule • Formal rulemaking • Formalism (law) • Functionalism (law) • Guidance (administrative state) • Hybrid rulemaking • Incorporation by reference • Independent federal agency • Informal rulemaking • Joint resolution of disapproval (administrative state) • Major rule • Negotiated rulemaking • Nondelegation doctrine • OIRA prompt letter • Organic statute • Pragmatism (law) • Precautionary principle • Promulgate • Proposed rule • Publication rulemaking • Regulatory budget • Regulatory capture • Regulatory dark matter • Regulatory impact analysis • Regulatory policy officer • Regulatory reform officer • Regulatory review • Rent seeking • Retrospective regulatory review • Risk assessment (administrative state) • Rulemaking • Separation of powers • Significant regulatory action • Skidmore deference • Statutory authority • Substantive law and procedural law • Sue and settle • Sunset provision • Unified Agenda of Federal Regulatory and Deregulatory Actions • United States Code • United States Statutes at Large
    Bibliography
    Agencies
    Retrieved from "https://ballotpedia.org/wiki/index.php?title=Homeland_Security_Acquisition_Regulation;_Safeguarding_of_Controlled_Unclassified_Information_rule_(2023)&oldid=10360950"