Protected Critical Infrastructure Information (PCII) Advanced Notice of Proposed Rulemaking (ANPRM) Frequently Asked Questions

These are some frequently asked questions regarding the Protected Critical Infrastructure Information (PCII) Program's Advanced Notice of Proposed Rulemaking (ANPRM).

What is an Advanced Notice of Proposed Rulemaking (ANPRM)?

Before a federal government agency can implement a new regulation, it must typically issue a “Notice of Proposed Rulemaking (NPRM)” to (1) inform the public of the specifics of the proposed regulations and (2) to provide the public with the opportunity to comment on the proposed regulations. An “Advanced Notice of Proposed Rulemaking (ANPRM)” is a document that an agency may choose to issue before it is ready to issue a Notice of Proposed Rulemaking (NPRM). The Advanced Notice of Proposed Rulemaking (ANPRM) is used by an agency to involve the interested public in a regulatory action at an early stage before the agency has arrived at even a tentative decision on a particular regulatory change.

This Advanced Notice of Proposed Rulemaking (ANPRM), regarding the updating of 6 CFR Part 29 “Procedures for Handling Critical Infrastructure Information” Final Rule, was published in the Federal Register on April 21, 2016, with a 90-day comment period to elicit any viewpoints, impacts, concerns, and benefits from possible revisions to the entire Final Rule. The comment period is now closed.

Why is 6 CFR Part 29 “Procedures for Handling Critical Infrastructure Information” Final Rule being updated?

After 10 years of operation, the Department of Homeland Security (DHS) is looking to update the entire Final Rule to strengthen and align the language to support the evolving needs of the critical infrastructure community and the cyber landscape. The Critical Infrastructure Information Act of 2002 authorized DHS to establish a program to accept information relating to critical infrastructure voluntarily submitted from the owners and operators of critical infrastructure and nonfederal entities, while limiting public disclosure of sensitive information under the Freedom of Information Act and other laws, rules, and processes. To implement this authority, DHS issued 6 CFR Part 29 “Procedures for Handling Critical Infrastructure Information” Final Rule in 2006.

In brief, what aspects of 6 CFR Part 29 “Procedures for Handling Critical Infrastructure Information” Final Rule is DHS reexamining?

DHS is primarily concerned with receiving feedback and comments on proposals to revise the overall approach for, but not limited to: (1) automated submissions and an expansion of categorical inclusions, (2) marking PCII, (3) sharing PCII with foreign governments, (4) restrictions on regulatory access to PCII, (5) safeguarding, (6) oversight and compliance, (7) alignment with other information protection programs, and (8) the administration of PCII at the state, local, tribal, and territorial level.

What opportunities will the public have to express its views about these matters?

The public and other interested members had 90 days from April 21, 2016, to provide comments on the Advanced Notice of Proposed Rulemaking (ANPRM). The comment period is now closed. The Department will now utilize both the feedback and the PCII Program's knowledge to being developing the Notice of Proposed Rulemaking (NPRM).

After DHS collects comments on the ANPRM, what will happen next?

Now that the 90-day comment period allotted for the Advanced Notice of Proposed Rulemaking (ANPRM) is over, DHS will utilize both the interested parties' feedback and the PCII Program's knowledge to begin developing the Notice of Proposed Rulemaking (NPRM). The public will have an additional opportunity to comment before any changes to 6 CFR Part 29 “Procedures for Handling Critical Infrastructure Information” Final Rule are finalized.