Key Takeaways
- CISA has submitted a 30‑day Federal Register notice for a new Information Collection Request (ICR) supporting the voluntary ChemLock program, which assists facilities handling hazardous chemicals.
- The ICR consolidates existing data gathering and adds a new service offering through three instruments: Request for Services, Service Registration and Preparation, and Service Feedback.
- Information collected includes contact details, facility identifiers, chemical inventories, and feedback on service outcomes, satisfaction, and staff performance.
- No comments were received during a prior 60‑day notice in December 2024; the agency is now accepting public comments until July 2, 2026, with a warning not to submit protected information via the public docket.
- Estimated annual burden totals 1,120.8 hours (≈ $107,971) across the three instruments, with no capital, startup, or record‑keeping costs.
- In parallel, CISA launched a 60‑day notice to study the implementation and effectiveness of the State and Local Cybersecurity Grant Program (SLCGP).
Overview of the ChemLock ICR Proposal
The U.S. Department of Homeland Security, acting through the Cybersecurity and Infrastructure Security Agency (CISA), has moved forward with a proposed Information Collection Request (ICR) for its voluntary ChemLock program. Published as a 30‑day notice in the Federal Register on Tuesday under the Paperwork Reduction Act, the proposal will be forwarded to the Office of Management and Budget (OMB) for review and clearance. ChemLock is designed to help facilities that handle hazardous chemicals improve their security posture and reduce risk through voluntary assistance such as consultations, assessments, training, and exercises.
Purpose and Scope of the New Collection
CISA states that the information collection is intended to consolidate and clarify data gathering across existing ChemLock services while also enabling an additional service offering under the program. By standardizing the information collected, the agency aims to streamline the process for both requesters and providers, ensuring that essential data are available when services are delivered. The new ICR will therefore support a broader range of ChemLock activities without creating duplicate or conflicting data requirements.
Three Instruments Proposed for the ICR
The proposal outlines three distinct instruments that together comprise the ChemLock ICR: (1) ChemLock Request for Services, (2) ChemLock Service Registration and Preparation, and (3) ChemLock Service Feedback. Each instrument targets a different stage of the service lifecycle—initial request, preparation and registration, and post‑service evaluation—allowing CISA to capture relevant data at each point while minimizing respondent burden.
Details of the Request for Services Instrument
The ChemLock Request for Services instrument gathers basic contact information from individuals seeking assistance, such as security consultations, technical consultations, onsite assessments and assistance, exercises and drills, training courses, access to tailored resources, and risk assessments. In addition, it collects facility identifying information, a description of the facility’s operations, and specifics about the chemicals present on site. This foundational data enables CISA to match requests with appropriate expertise and resources.
Prior Public Input and Lack of Comments
Before issuing the current 30‑day notice, CISA had previously sought public input through a 60‑day notice published in December 2024. That earlier notice elicited no comments, indicating either satisfaction with the existing approach or limited awareness among stakeholders. The agency is now reopening the comment period to ensure that any concerns or suggestions are captured before the ICR proceeds to OMB review.
ChemLock’s Role as the Sector Risk Management Agency
As the Sector Risk Management Agency for the chemical sector, CISA emphasizes that ChemLock supports critical infrastructure owners and operators by providing voluntary security assistance to facilities that handle hazardous chemicals. The program aligns with broader national efforts to protect critical infrastructure from chemical‑terrorism threats and to enhance resilience through proactive risk reduction measures.
Comment Submission Procedures and Protections
CISA is accepting comments on the proposed information collection through July 2, 2026. The agency explicitly advises that submissions containing protected information—such as Chemical‑terrorism Vulnerability Information, Sensitive Security Information, or Protected Critical Infrastructure Information—should not be filed through the public docket. Commenters are encouraged to use secure channels if they need to share sensitive details, ensuring that the public process remains transparent while safeguarding classified or otherwise protected data.
Goal to Formalize and Standardize Information Collection
The latest notice is part of CISA’s broader effort to formalize and standardize the information collection associated with ChemLock service requests, registrations, preparation activities, and feedback collection. By establishing a single, OMB‑cleared ICR, the agency hopes to reduce administrative variability, improve data quality, and facilitate better tracking of program outcomes and effectiveness across the chemical sector.
Insights from CISA Leadership
Winfield P. Werntz, acting chief information officer at CISA, elaborated in the Federal Register notice that the instrument collects information needed to enable ChemLock services that require additional data to be performed—specifically security consultations, onsite assessments and assistance, and risk assessments. He also noted that the instrument will capture feedback about ChemLock‑related services, including which service was provided, when it occurred, program outcomes, participant satisfaction, and the performance of staff delivering the service.
Estimated Burden and Costs for Each Instrument
For the ChemLock Request for Services instrument, CISA anticipates 450 respondents, each spending about 0.25 hour to complete the form, resulting in an annual burden of 112.5 hours and an associated cost of $10,838.06. The ChemLock Service Registration and Preparation instrument expects 300 respondents, each dedicating roughly 3.17 hours, leading to an annual burden of 952 hours and a cost of $91,714.10. Finally, the ChemLock Service Feedback instrument projects 225 respondents, each investing approximately 0.25 hour, for a total annual burden of 56.26 hours and a cost of $5,419.03. Across all three instruments, the combined annual burden is estimated at 1,120.8 hours, with a total cost of approximately $107,971. No capital, startup, or record‑keeping expenses are forecasted.
Parallel Initiative: Study of the State and Local Cybersecurity Grant Program
In addition to the ChemLock ICR, CISA announced this week a study to evaluate the implementation and effectiveness of the State and Local Cybersecurity Grant Program (SLCGP). The effort, introduced via a 60‑day notice and request for comments, will gather quantitative and qualitative feedback from state, local, and territorial governments to assess how they use the grant funds, approach cybersecurity planning, and implement security measures. The study aims to identify best practices, gaps, and opportunities for improvement, thereby informing future grant design and agency support.
Prepared for clarity and conciseness while preserving all substantive details from the source material.