1

OMB / FSA Tracking # 2/17/2015

SUPPORTING STATEMENT

FOR PAPERWORK REDUCTION ACT SUBMISSION

Background

Public Law 89-329, Sections 401-495, the Higher Education Act of 1965, as amended (HEA), mandates that the 

Secretary of Education “shall produce, distribute, and process free of charge common financial reporting forms as 

described in this subsection to be used for application and reapplication to determine the need and eligibility of a 

student for financial assistance...”. 

Federal Student Aid (FSA), an office of the U.S. Department of Education (hereafter “the Department”), subsequently 

developed an application process to collect and process the data necessary to determine a student’s eligibility to 

receive Title IV, HEA program assistance. The application process involves an applicant’s submission of the Free 

Application for Federal Student Aid (FAFSA). After submission and processing of the FAFSA, an applicant receives a 

Student Aid Report (SAR), which is a summary of the processed data they submitted on the FAFSA. The applicant 

reviews the SAR, and, if necessary, will make corrections or updates to their submitted FAFSA data. 

In addition, Title IV, Part G of the Higher Education Act of 1965, as amended by the 1998 Amendments to the HEA 

(P.L. 105-244) section 485B, requires the Secretary of Education to establish a National Student Loan Data System 

(NSLDS). 

The Department made online accessibility to these services and information a major priority as part of its compliance 

with The Government Paperwork Elimination Act (GPEA), 44 USC 3504. Currently, students, applicants, parents and 

borrowers can access FSA systems to enter, review or correct applications and loan information. They also interact 

online with FSA to sign Master Promissory Notes for federal student loans and Agreements to Serve for Teacher 

Education Assistance for College and Higher Education (TEACH) Grants. Due to the sensitivity of the personal and 

financial data entered into and available on FSA systems, FSA must ensure that only authorized users have access to 

their data. The current legacy system, PIN, was used to manage this access by requesting a user’s social security 

number, date of birth and last name along with a four digit code. However, FSA recognized the need for improved 

access and identity management that did not require the use of Personally Identifiable Information (PII) for each 

authentication. The Inspector General’s Office recommended several changes to the PIN system which also resulted in 

a decision to replace the PIN system. 

FSA intends to replace the current PIN system with the Personal Authentication Service (PAS) which will employ a FSA 

ID, a standard username and password solution. In order to create an FSA ID to gain access to FSA systems a user 

must register online for a FSA ID account. The FSA ID will allow the customer to have a single identity, even if there is 

a name change or other change to personally identifiable Information (PII), moving FSA closer towards a one 

person/one record system.

A. Justification 

1. Explain the circumstances that make the collection of information necessary. Identify any legal or 

administrative requirements that necessitate the collection. Attach a hard copy of the appropriate section of 

each statute and regulation mandating or authorizing the collection of information, or you may provide a 

valid URL link or paste the applicable section1. Specify the review type of the collection (new, revision, 

extension, reinstatement with change, reinstatement without change). If revised, briefly specify the changes. 

If a rulemaking is involved, make note of the sections or changed sections, if applicable.

 

1

Please limit pasted text to no longer than 3 paragraphs.
2

OMB / FSA Tracking # 2/17/2015

The Department’s legal right to require Social Security Numbers (SSN) is found in section 484(a)(4)(B) of the Higher 

Education Act of 1965, as amended (HEA). That section states that an applicant must provide their SSN in order to be 

eligible for aid under the Federal Pell Grant, Federal Direct Loan, Federal Family Education Loan, Federal 

Supplemental Educational Opportunity Grant, TEACH Grant, Federal Work Study, and Federal Perkins Loan 

Programs. The Department is authorized to collect all the other information under sections 474, 475, 476, 477, 479, 

480, and 483 of the HEA.

OMB Circular 130, Management of Federal Information Resources, establishes that “agencies will use electronic 

media and formats ... in order to make government information more easily accessible and useful to the public”. The 

Government Paperwork Elimination Act (GPEA), 44 USC 3504, Title XVII, requires agencies, by October 21, 2003, to 

provide the option of electronic submission of information by the public. The Freedom to E-File Act, E-Government Act, 

and the President’s Management Agenda prescribe eGovernment functions as alternatives to traditional paperbased processes. 

The U.S. Department of Education has been a leader in government in making paper processes available 

electronically. Since the introduction of FAFSA on the Web and the FSA PIN for online authentication and access in 

the 1990’s, the paperwork completion burden on students, borrowers and parents has been reduced by millions of 

hours.

Conducting online transactions necessitates processes for authenticating and authorizing online users and completing 

transactions with an electronic equivalent to traditional ink signatures. The Privacy Act of 1974 at 5 U.S.C. 552A 

(e)(10) requires agencies to establish appropriate administrative, technical, and physical safeguards to ensure the 

security and confidentiality of records. The information collected for the creation of an FSA ID enables the electronic 

authentication and authorization of users for FSA web-based applications and information and protects users from 

unauthorized access to user accounts on all protected FSA sites.

Applicants, parents and borrowers establish a FSA ID which includes a username and password. The FSA ID is used 

for the purposes of verifying the identity of the user; allowing users to establish an account with FSA; safeguarding 

their personally identifiable and financial information; signing applications and loan related documents; providing 

users access to their information and applications; allowing users to customize or update their accounts with FSA; 

renewing or revoking a user’s account with FSA; and supporting the Federal Student Aid Information Center (FSAIC)

help desk functions. 

The specific questions that applicants are asked to answer in the FSA ID creation process are described separately in 

the Data Elements and Justification document which lists all the data elements and explains the purpose and use of 

each in the application. As part of this process, user’s information is matched with information from the Social Security 

Administration (SSA) to confirm their SSA status. This is a request for a new information collection. 

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, 

indicate the actual use the agency has made of the information received from the current collection.

The information used to create a FSA ID is collected through a voluntary online self-registration process from student

and parent applicants and borrowers in order to provide them with authorized access to FSA systems. Users access 

the account creation site through an existing FSA system or website by clicking on the “Create Account” link. The 

information a user is required to provide to create a FSA ID is based on the information necessary to confirm their 

identity with the SSA, and for them to be able to manage their information in the case that they lose or forget their 

username and password. The online self-registration process to obtain a FSA ID is a one-time information collection 

process. The account information can be modified without the need of the user to re-register. By creating a FSA ID, a 

user provides the necessary information for FSA to electronically authenticate them and give them access to their 

information.

The electronic authentication of users protects them from individuals seeking to gain unauthorized access to user 

accounts on FSA systems and websites. A FSA ID is used to access the following web site or systems to apply or view 

loan information:

1) FAFSA On the Web (FOTW) where users complete their online version of the FSAFA and can view or correct 

their Student Aid Report (SAR)
3

OMB / FSA Tracking # 2/17/2015

2) NSLDS and StudentAid.gov where student/PLUS borrowers receive “real time” information on their financial 

aid history

3) StudentLoans.gov and TEACH-ats.ed.gov where applicants can agree to the conditions of their master 

promissory note or the Agreement to Serve for TEACH grants, and complete loan entrance or exit 

counseling. 

4) Federal Student Aid Information Center Integrated Voice Response System (IVR) —where student/PLUS 

borrowers receive “real time” information from NSLDS on their financial aid history via the FSAIC IVR.

FSA also uses the information to:

1) Conduct matches with the SSA to confirm their identity. This data match is processed by the Department’s 

Central Processing System (CPS). 

2) Support customer assistance through the Federal Student Aid Information Center (FSAIC) and the FSA ID help 

desk.

3) Provide inputs into the Department’s Audit and Program Review Planning. Data on usage of FSA websites 

and applications are used to support assumptions for estimating the long-term budgets for the Federal 

student aid programs. 

4) Support audit and investigations. Transactional and non-transactional data is sent on a monthly basis to the 

OIG for purposes of populating the OIG–OIG Data Analytic System (ODAS) Data Warehouse. The 

information is also used by FSA Security auditors and program reviewers as part of system and program 

audits.

All shared data is transmitted to a system that has an approved and valid Certification and Accreditation (C&A) 

Authority to Operate (ATO) in effect. In addition, the shared data is securely managed by requiring a Privacy Impact 

Assessment (PIA) and Interface Control documents

3. Describe whether, and to what extent, the collection of information involves the use of automated, 

electronic, mechanical, or other technological collection techniques or forms of information technology, e.g. 

permitting electronic submission of responses, and the basis for the decision of adopting this means of 

collection. Also describe any consideration given to using technology to reduce burden.

The collection of the registration information for a FSA ID is done through an on-line registration form. All technology 

used in creation of the FSA ID is compliant with the Federal Information Security Management Act of 2002 ("FISMA", 

44 U.S.C. § 3541, et seq), the National Institute of Standards and Technology (NIST) Special Publication 800-53, 

800-37, and Federal Information Processing Standards (FIPS) publications 140-2 and 200. There is not a paper 

based form available to register for a FSA ID. Users must access the account creation site through an existing FSA 

application or website. Users complete and submit the self-registration forms electronically over the Internet. The 

registration process is self-explanatory; where instructions are needed they are integrated within the website. 

Additional assistance is available by phone, chat and email at FSAIC if needed.

4. Describe efforts to identify duplication. Show specifically why any similar information already available 

cannot be used or modified for use for the purposes described in Item 2 above.

The Department reviewed its existing systems to identify any instances where required data is already collected or 

maintained. In those cases, the data used to create an account is pre-populated or is transmitted electronically to the 

other system reducing duplication and the overall data entry burden on the user. 

5. If the collection of information impacts small businesses or other small entities, describe any methods used 

to minimize burden. A small entity may be (1) a small business which is deemed to be one that is 

independently owned and operated and that is not dominant in its field of operation; (2) a small organization 

that is any not-for-profit enterprise that is independently owned and operated and is not dominant in its field; 

or (3) a small government jurisdiction, which is a government of a city, county, town, township, school 

district, or special district with a population of less than 50,000.

The collection of eligibility information for the awarding of student aid does not impact small businesses. 

6. Describe the consequences to Federal program or policy activities if the collection is not conducted or is 

conducted less frequently, as well as any technical or legal obstacles to reducing burden.
4

OMB / FSA Tracking # 2/17/2015

If the collection is not conducted, there will be no adequate means to safeguard access to personal and financial 

information and verify the identity of the user. The Department will be hindered from advancing its own compliance 

with GPEA and will be unduly burdened in its ability to perform its mission, be hindered from reducing the burden on 

its customers by providing them the most timely and efficient way to request aid and loan information and be unable 

to assure the confidentiality of user information.

7. Explain any special circumstances that would cause an information collection to be conducted in a manner:

 requiring respondents to report information to the agency more often than quarterly;

 requiring respondents to prepare a written response to a collection of information in fewer than 30 

days after receipt of it;

 requiring respondents to submit more than an original and two copies of any document;

 requiring respondents to retain records, other than health, medical, government contract, grant-inaid, or tax records for more than three years;

 in connection with a statistical survey, that is not designed to produce valid and reliable results than 

can be generalized to the universe of study;

 requiring the use of a statistical data classification that has not been reviewed and approved by 

OMB;

 that includes a pledge of confidentiality that is not supported by authority established in statute or 

regulation, that is not supported by disclosure and data security policies that are consistent with the 

pledge, or that unnecessarily impedes sharing of data with other agencies for compatible confidential 

use; or

 requiring respondents to submit proprietary trade secrets, or other confidential information unless 

the agency can demonstrate that it has instituted procedures to protect the information’s 

confidentiality to the extent permitted by law.

There are no special circumstances associated with this information collection. Users respond as needed. Registration 

occurs once and updates occur only when passwords expire or there is a change to user’s personal information such 

as address, last name or email address. By replacing the PIN with the FSA ID, the Department has instituted 

procedures to protect the information’s confidentiality. All technology used in creation of the FSA ID is compliant with 

NIST Special Publication 800-53, 800-37, and FIPS publications 140-2 and 200.

8. As applicable, state that the Department has published the 60 and 30 Federal Register notices as required 

by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB. 

Summarize public comments received in response to that notice and describe actions taken by the agency 

in response to these comments. Specifically address comments received on cost and hour burden.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of 

data, frequency of collection, the clarity of instruction and record keeping, disclosure, or reporting 

format (if any), and on the data elements to be recorded, disclosed, or reported.

Consultation with representatives of those from whom information is to be obtained or those who must 

compile records should occur at least once every 3 years – even if the collection of information activity is

the same as in prior periods. There may be circumstances that may preclude consultation in a specific 

situation. These circumstances should be explained.

FSA consulted with all applicable systems during the requirements phase to solicit comments and suggestions for the 

creation of the FSA ID. These meetings addressed usability and necessary functionality while also incorporating 

industry best practices in the creation of a secure access management credential. The FSA ID is modeled on the 

commonly used username and password approach.

FSA also solicited comments from the public through a 60-day notice published in the Federal Register, Vol. 79, No. 

224 page 69100. 

FSA received three comment letters which had several comments. Only the comments germane to the project and 

information collection filing are responded to here. Attached are the full responses to the comments received.
5

OMB / FSA Tracking # 2/17/2015

Comment Summary: Balance of Security and Access

It is important to balance security and access for users. Specifically, the FSA ID password will be valid for 18 months 

before requiring it to be reset. Thank you for your recommendation to notify servicers when a password requires 

resetting. This recommendation will be considered as part of future releases.

Comment Summary: Curbing Improper Third Party Access to Borrower Identification Information

FSA has referred this recommendation to the appropriate business unit for review.

Comment Summary: New process is confusing and a barrier to completing the FAFSA

The new process mirrors industry best practices and was developed to minimize barriers while maintaining security. 

FSA is required to safeguard a user’s personal information. Without the changes we are implementing, information 

could be vulnerable to an external attack. 

Comment Summary: Request for number of Forgot PINs to be published on FSA’s website

FSA has referred this question to the appropriate business unit for review.

Comment Summary: Password should be valid for more than 15 months

User passwords are valid for 18 months. 

Comment Summary: Duplication with FAFSA which asks for a password

To eliminate confusion, the FAFSA on the Web transaction password field will change to “Save Key.” 

Comment Summary: Recommendation to delete the option to create a “limited FSA ID”

FSA has removed the option to create a limited FSA ID.

There will be a 30 day notice published in the Federal Register seeking additional public comment on the forms and 

burden calculations.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of 

contractors or grantees with meaningful justification.

There are no payments or gifts for the completion and/or submission of the application.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in 

statute, regulation, or agency policy. If personally identifiable information (PII) is being collected, a Privacy 

Act statement should be included on the instrument. Please provide a citation for the Systems of Record 

Notice and the date a Privacy Impact Assessment was completed as indicated on the IC Data Form. A 

confidentiality statement with a legal citation that authorizes the pledge of confidentiality should be provided.

If the collection is subject to the Privacy Act, the Privacy Act statement is deemed sufficient with respect to 

confidentiality. If there is no expectation of confidentiality, simply state that the Department makes no pledge 

about the confidentially of the data.

FSA protects and holds confidential the information it collects in accordance with the following Department and OMB 

policies: Privacy Act of 1974, OMB Circular A-108 – Privacy Act Implementation – Guidelines and Responsibilities, 

OMB Circular A-130 Appendix I – Federal Agency Responsibilities for Maintaining Records About Individuals, OMB 

M-03-22 – OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, OMB M-06-15 

– Safeguarding Personally Identifiable Information, OM:6-104 – Privacy Act of 1974 (Collection, Use and Protection 

of Personally Identifiable Information). FSA will not make any disclosure of the information to agencies or individuals 

outside this department unless previously stated in the Routine Uses section of the System of Records Notice for the 

Person Authentication Service, as required by law ort written consent accompanies the request. The current ED 

Personal Identification Number (PIN) System of Records Notice is being updated for the PAS system. A Privacy Act 

statement is included as part of the account creation process.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and 

attitudes, religious beliefs, and other matters that are commonly considered private. The justification should 

include the reasons why the agency considers the questions necessary, the specific uses to be made of the 
6

OMB / FSA Tracking # 2/17/2015

information, the explanation to be given to persons from whom the information is requested, and any steps to 

be taken to obtain their consent.

There are no questions of a sensitive nature in this collection of information.

12. Provide estimates of the hour burden of the collection of information. The statement should:

 Indicate the number of respondents by affected public type (federal government, individuals or 

households, private sector – businesses or other for-profit, private sector – not-for-profit 

institutions, farms, state, local or tribal governments), frequency of response, annual hour 

burden, and an explanation of how the burden was estimated, including identification of burden 

type: recordkeeping, reporting or third party disclosure. All narrative should be included in 

item 12. Unless directed to do so, agencies should not conduct special surveys to obtain 

information on which to base hour burden estimates. Consultation with a sample (fewer than 10) 

of potential respondents is desirable. If the hour burden on respondents is expected to vary 

widely because of differences in activity, size, or complexity, show the range of estimated hour 

burden, and explain the reasons for the variance. Generally, estimates should not include 

burden hours for customary and usual business practices.

 If this request for approval covers more than one form, provide separate hour burden estimates 

for each form and aggregate the hour burdens in the ROCIS IC Burden Analysis Table. (The 

table should at minimum include Respondent types, IC activity, Respondent and Responses, 

Hours/Response, and Total Hours)

 Provide estimates of annualized cost to respondents of the hour burdens for collections of 

information, identifying and using appropriate wage rate categories. The cost of contracting out 

or paying outside parties for information collection activities should not be included here. 

Instead, this cost should be included in Item 14.

The FSA ID online registration form, a copy is included in the information collection submission, is neither complex nor 

long. Based upon repeated trials of the FSA ID system, it is estimated that it will take a registrant a maximum of 8

minutes (.133 hours) to register for the first time including linking to a legacy PIN account if one exists. 

The estimated annual burden is based on the estimated number of total users multiplied by the maximum time to 

complete the registration form. The expected growth rate was calculated based on NCES Projections and is shown in 

Table 1. Enrollment Projections for 2015 from NCES Projections of Education Statistics. The estimated number of 

total users is based on actual 2013 Active and New User counts from the PIN system and then applying the projected 

growth rate and multiplying by the time to register. There is no known cost to the individual. 

Table 1. Enrollment Projections for 2015 from NCES Projections of Education Statistics 

[in thousands]

Year Enrollment Projections % Growth

2013 20,948

2014 21,320 1.8%

2015 21,651 1.6%
7

OMB / FSA Tracking # 2/17/2015

Table 2. Estimated Number of New and Total Users based on NCES Growth Projections 2013-2015

Table 3. Estimated Total FSA ID Registrations 2015

13. Provide an estimate of the total annual cost burden to respondents or record keepers resulting from the 

collection of information. (Do not include the cost of any hour burden shown in Items 12 and 14.)

 The cost estimate should be split into two components: (a) a total capital and start-up cost component 

(annualized over its expected useful life); and (b) a total operation and maintenance and purchase of 

services component. The estimates should take into account costs associated with generating, 

maintaining, and disclosing or providing the information. Include descriptions of methods used to 

estimate major cost factors including system and technology acquisition, expected useful life of 

capital equipment, the discount rate(s), and the time period over which costs will be incurred. 

Capital and start-up costs include, among other items, preparations for collecting information such 

as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and 

acquiring and maintaining record storage facilities.

 If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and 

explain the reasons for the variance. The cost of contracting out information collection services 

should be a part of this cost burden estimate. In developing cost burden estimates, agencies may 

consult with a sample of respondents (fewer than 10), utilize the 60-day pre-OMB submission public 

comment process and use existing economic or regulatory impact analysis associated with the 

rulemaking containing the information collection, as appropriate.

 Generally, estimates should not include purchases of equipment or services, or portions thereof, 

made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not 

associated with the information collection, (3) for reasons other than to provide information or keep 

records for the government or (4) as part of customary and usual business or private practices. Also, 

these estimates should not include the hourly costs (i.e., the monetization of the hours) captured 

above in Item 12

Total Annualized Capital/Startup Cost : 

Total Annual Costs (O&M) : 

____________________

Total Annualized Costs Requested : 

Other than the costs shown in Item14, there is no annual cost burden to respondents or record keepers.

Actual Number of 

New User Accounts 

(in millions)

Actual Number 

of Active User 

Accounts

Expected Growth 

based on NCES 

Enrollment 

Projections

Estimated Number 

of New User 

Accounts (in 

millions)

Estimated Number 

of Total User 

Accounts (in

millions)

2013 11.3 32.1

2014 NA 1.8% 11.5 43.6 

2015 NA 1.6% 11.7 55.3 

Estimated Number (in 

millions)

Frequency of 

Registration

Estimated Time to

Register in hours

Annual Burden in

millions of hours

PIN Users who will need to register for a 

FSA ID

43.6 1 0.133333333 5.81

New FSA ID Users in 2015 11.7 1 0.133333333 1.56

Total Registrations 2015 55.3 7.37
8

OMB / FSA Tracking # 2/17/2015

14. Provide estimates of annualized cost to the Federal government. Also, provide a description of the 

method used to estimate cost, which should include quantification of hours, operational expenses (such as 

equipment, overhead, printing, and support staff), and any other expense that would not have been incurred 

without this collection of information. Agencies also may aggregate cost estimates from Items 12, 13, and 14 

in a single table.

Table 4. FSA ID Information Collection Annualized Costs

The development and integration costs associated with the PAS system are all based on fixed price contracts and 

include costs for hosting, software, hardware and services. The on-going operations and maintenance costs are 

based on a fixed price contract option for 2015. The costs are for a full year. 

15. Explain the reasons for any program changes or adjustments. Generally, adjustments in burden result 

from re-estimating burden and/or from economic phenomenon outside of an agency’s control (e.g., correcting 

a burden estimate or an organic increase in the size of the reporting universe). Program changes result from a 

deliberate action that materially changes a collection of information and generally are result of new statute or 

an agency action (e.g., changing a form, revising regulations, redefining the respondent universe, etc.). 

Burden changes should be disaggregated by type of change (i.e., adjustment, program change due to new 

statute, and/or program change due to agency discretion), type of collection (new, revision, extension, 

reinstatement with change, reinstatement without change) and include totals for changes in burden hours, 

responses and costs (if applicable).

This is a request for a new collection. The program change is a result of the Department’s action to improve user 

access and security of systems that include personal and financial information used to determine federal student aid 

eligibility. 

16. For collections of information whose results will be published, outline plans for tabulation and 

publication. Address any complex analytical techniques that will be used. Provide the time schedule for the 

entire project, including beginning and ending dates of the collection of information, completion of report, 

publication dates, and other actions.

The results of the collected information will not be published for tabulation or publication.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, 

explain the reasons that display would be inappropriate.

The expiration date for OMB approval of the information collection will be displayed.

18. Explain each exception to the certification statement identified in the Certification of Paperwork 

Reduction Act.

Exceptions to the certification requirement are not requested for this information collection.

(in $ millions) Total Annualized 

Development and Integration Costs 7.3 1.46

Operations and Maintenance Costs 3.39

Total Cost FY2015 4.85