1536 Federal Register / Vol. 90, No. 5 / Wednesday, January 8, 2025 / Notices 

39As noted above, for the purposes of the security 

requirements, to the extent CISA uses a term that 

is defined in the DOJ rulemaking, CISA uses that 

definition. Therefore, CISA is using the term U.S. 

persons as defined by the DOJ Final Rule. That 

definition reads ‘‘any United States citizen, 

national, or lawful permanent resident; any 

individual admitted to the United States as a 

refugee under 8 U.S.C. 1157 or granted asylum 

under 8 U.S.C. 1158; any entity organized solely 

under the laws of the United States or any 

jurisdiction within the United States (including 

foreign branches); or any person in the United 

States.’’ 28 CFR 202.256. 

40 6 U.S.C. 650(14) (which applies to all of Title 

XXII of the Homeland Security Act of 2002, which, 

in turn, contains most of CISA’s authorities) defines 

Information System as having the meaning given 

the term in the Paperwork Reduction Act, 44 U.S.C. 

3502, and specifically includes ‘‘industrial control 

systems, such as supervisory control and data 

acquisition systems, distributed control systems, 

and programmable logic controllers.’’ 6 U.S.C. 

650(14). However, given CISA’s assumption that 

this type of operational technology is unlikely to be 

implicated by DOJ’s regulations, CISA is not 

including the operational technology-related prong 

here. 

as part of a restricted transaction, on the 

covered systems more broadly (both 

terms CISA defines within the security 

requirements), and on the organization 

as a whole. While the requirements on 

covered systems and on an 

organization’s governance of those 

systems apply more broadly than to the 

data at issue and the restricted 

transaction itself, CISA continues to 

assess that implementation of these 

requirements is necessary to validate 

that the organization has the technical 

capability and sufficient governance 

structure to appropriately select, 

successfully implement, and continue to 

apply the data-level security 

requirements in a way that addresses 

the risks identified by DOJ for the 

restricted transactions. For example, to 

ensure and validate that a covered 

system denies covered persons access to 

covered data, it is necessary to maintain 

audit logs of accesses as well as 

organizational processes to utilize those 

logs. Similarly, it is necessary for an 

organization to develop identity 

management processes and systems to 

establish an understanding of which 

persons may have access to different 

data sets. 

In addition to requirements on 

covered systems, applying security 

requirements on the covered data itself 

that may be accessed in a restricted 

transaction is also necessary to address 

the risks. The specific requirements that 

are most technologically and logistically 

appropriate for different types of 

restricted transactions may vary. For 

example, some transactions may be 

amenable to approaches that minimize 

data or process it in such a way that 

does not reveal covered data to covered 

persons. In other cases, techniques such 

as access control and encryption may be 

more appropriate to deny any access by 

covered persons to unmitigated covered 

data. The security requirements provide 

multiple options to mitigate risk, though 

all the options build upon the 

foundation of the requirements imposed 

on covered systems and the organization 

as a whole. While U.S. persons 39

engaging in restricted transactions will 

be required to implement all the 

organizational- and system-level 

requirements, such persons will have 

some flexibility to determine which 

combination of data-level requirements 

are sufficient to fully and effectively 

prevent access to covered data that is 

linkable, identifiable, unencrypted, or 

decryptable using commonly available 

technology by covered persons and/or 

countries of concern, based on the 

nature of the transaction and the data at 

issue. 

Finally, the security requirements 

include a definitions section. To the 

extent the requirements use a term 

already defined in the DOJ rulemaking, 

CISA’s use of that term in the security 

requirements would carry the same 

meaning. For the purpose of these 

security requirements, CISA includes 

definitions for five terms used 

exclusively in the security 

requirements: 

• Asset. CISA defines the term to 

mean data, personnel, devices, systems, 

and facilities that enable the 

organization to achieve business 

purposes. This definition is derived 

from the CSF version 1.1, which defined 

asset as ‘‘[t]he data, personnel, devices, 

systems, and facilities that enable the 

organization to achieve business 

purposes.’’ 

• Covered data. CISA defines the 

term to mean the two categories of data 

identified by the Order and that DOJ is 

regulating through its rulemaking— 

government-related data or bulk U.S. 

sensitive personal data. 

• Covered system. CISA defines this 

term as a specific type of information 

system that is used to conduct a number 

of activities related to covered data as 

part of a restricted transaction. These 

activities are drawn from a combination 

of the activities in the definition of 

information system in the security 

requirements and the activities in the 

DOJ rulemaking’s definition of access. 

See 28 CFR 202.201. The term means an 

information system used to obtain, read, 

copy, decrypt, edit, divert, release, 

affect, alter the state of, view, receive, 

collect, process, maintain, use, share, 

disseminate, or dispose of (collectively, 

‘‘interact with’’) covered data as part of 

a restricted transaction, regardless of 

whether the data is encrypted, 

anonymized, pseudonymized, or deidentified. ‘‘Covered system’’ does not 

include an information system (e.g., an 

end user workstation) that has the 

ability to view or read sensitive personal 

data (other than sensitive personal data 

that constitutes government-related 

data) but does not ordinarily interact 

with such data in bulk form. 

• Information system. CISA defines 

this term consistent with the definition 

in the Paperwork Reduction Act (PRA), 

44 U.S.C. 3502.40 The term means a 

discrete set of information resources 

organized for the collection, processing, 

maintenance, use, sharing, 

dissemination, or disposition of 

information. 

• Network. CISA defines this term, 

which CISA developed consistent with 

the definition of the term in NIST 

Special Publication 800–171 rev. 3, 

Protecting Controlled Unclassified 

Information in Nonfederal Systems and 

Organizations. The term would mean a 

system of interconnected components, 

which may include routers, hubs, 

cabling, telecommunications 

controllers, key distribution centers, and 

technical control devices. 

The publication of the finalized 

security requirements for restricted 

transactions pursuant to Executive 

Order (E.O.) 14117, ‘‘Preventing Access 

to Americans’ Bulk Sensitive Personal 

Data and United States GovernmentRelated Data by Countries of Concern’’ 

can be found on CISA’s website: https:// 

www.cisa.gov/resources-tools/resources/ 

EO-14117-security-requirements. The 

Director of CISA, Jennie M. Easterly, has 

delegated the authority to approve and 

electronically sign this document to 

Nitin Natarajan, who is the Deputy 

Director of CISA, for purposes of 

publication in the Federal Register. 

Nitin Natarajan, 

Deputy Director, Cybersecurity and 

Infrastructure Security Agency, Department 

of Homeland Security. 

[FR Doc. 2024–31479 Filed 1–3–25; 8:45 am] 

BILLING CODE 9111–LF–P 

DEPARTMENT OF HOUSING AND 

URBAN DEVELOPMENT 

[Docket No. FR–7080–C–64] 

30-Day Notice of Proposed Information 

Collection: Application for the 

Community Development Block Grant 

(ICDBG) Program for Indian Tribes and 

Alaska Native Villages; Correction; 

OMB Control No.: 2577–0191 

AGENCY: Office of Policy Development 

and Research, Chief Data Officer, HUD. 


lotter on DSK11XQN23PROD with NOTICES1
Federal Register / Vol. 90, No. 5 / Wednesday, January 8, 2025 / Notices 1537 

ACTION: Notice, correction. 

SUMMARY: HUD is publishing this notice 

to correct the heading on the notice that 

was published in the Federal Register 

on December 26, 2024. The heading 

should read 30-day Notice of Proposed 

Information Collection. 

FOR FURTHER INFORMATION CONTACT: 

Anna Guido, Clearance Officer, REE, 

Department of Housing and Urban 

Development, 451 7th Street SW, 

Washington, DC 20410; email 

Anna.P.Guido@hud.gov, telephone 202– 

402–5534. This is not a toll-free number. 

HUD welcomes and is prepared to 

receive calls from individuals who are 

deaf or hard of hearing, as well as 

individuals with speech or 

communication disabilities. To learn 

more about how to make an accessible 

telephone call, please visit https://

www.fcc.gov/consumers/guides/ 

telecommunications-relay-service-trs. 

Copies of available documents 

submitted to OMB may be obtained 

from Ms. Guido. 

SUPPLEMENTARY INFORMATION: HUD 

published an information collection 

notice in the Federal Register at 89 FR 

105064 entitled ‘‘Indian Community 

Development Block Grant Information 

Collection’’. This notice corrects the 

heading to read ‘‘30-Day Notice of 

Proposed Information Collection. 

Nacheshia Foxx, 

Federal Register Liaison, Office of General 

Counsel. 

[FR Doc. 2025–00217 Filed 1–7–25; 8:45 am] 

BILLING CODE 4210–67–P 

DEPARTMENT OF THE INTERIOR 

Fish and Wildlife Service 

[Docket No. FWS–HQ–IA–2024–0202; 

FXIA16710900000–245–FF09A30000] 

Endangered Species; Issuance of 

Permits 

AGENCY: Fish and Wildlife Service, 

Interior. 

ACTION: Notice of issuance of permits. 

SUMMARY: We, the U.S. Fish and 

Wildlife Service (Service), have issued 

permits to conduct certain activities 

with endangered species. We issue these 

permits under the Endangered Species 

Act (ESA). 

ADDRESSES: Information about the 

applications for the permits listed in 

this notice is available online at https:// 

www.regulations.gov. See 

SUPPLEMENTARY INFORMATION for details. 

FOR FURTHER INFORMATION CONTACT: 

Timothy MacDonald, by phone at 703– 

358–2185 or via email at DMAFR@

fws.gov. Individuals in the United States 

who are deaf, deafblind, hard of hearing, 

or have a speech disability may dial 711 

(TTY, TDD, or TeleBraille) to access 

telecommunications relay services. 

Individuals outside the United States 

should use the relay services offered 

within their country to make 

international calls to the point-ofcontact in the United States. 

SUPPLEMENTARY INFORMATION: We, the 

U.S. Fish and Wildlife Service (Service), 

have issued permits to conduct certain 

activities with endangered and 

threatened species in response to permit 

applications that we received under the 

authority of section 10(a)(1)(A) of the 

Endangered Species Act of 1973 (16 

U.S.C. 1531 et seq.). 

After considering the information 

submitted with each permit application 

and the public comments received, we 

issued the requested permits subject to 

certain conditions set forth in each 

permit. For each application for an 

endangered species, we found that (1) 

the application was filed in good faith, 

(2) the granted permit would not operate 

to the disadvantage of the endangered 

species, and (3) the granted permit 

would be consistent with the purposes 

and policy set forth in section 2 of the 

ESA. 

Availability of Documents 

The permittees’ original permit 

application materials, along with public 

comments we received during public 

comment periods for the applications, 

are available for review. To locate the 

application materials and received 

comments, go to https://

www.regulations.gov and search for the 

appropriate permit number (e.g., 

12345C) provided in the following table: 

ePermit No. Applicant Permit issuance date 

PER4417242 ..... Toledo Zoological Society ......................................................................................... July 9, 2024. 

PER10276124 ... Gunner B. Peterson ................................................................................................... July 10, 2024. 

PER7757383 ..... Emory University ....................................................................................................... July 12, 2024. 

PER10272760 ... Southwest Fisheries Science Center ........................................................................ July 15, 2024. 

PER10289648 ... Saginaw Valley Zoological Society ........................................................................... July 16, 2024. 

PER1012710 ..... Milwaukee County Zoo .............................................................................................. July 23, 2024. 

PER10215681 ... Kootenai Tribe of Idaho ............................................................................................. July 25, 2024. 

PER10145205 ... Delaware Museum of Nature and Science ............................................................... August 5, 2024. 

PER10970319 ... Cornell University Animal Health Diagnostic Center and NYS Veterinary Diagnostic Laboratory.August 15, 2024. 

PER5817086 ..... University of New Orleans ......................................................................................... August 15, 2024. 

PER10200447 ... The Peregrine Fund .................................................................................................. August 20, 2024. 

PER10535315 ... Duke University ......................................................................................................... August 21, 2024. 

PER11439122 ... DNCR State of North Carolina Zoo dba North Carolina Zoo ................................... September 19, 2024. 

PER11444722 ... Daniel Pearson .......................................................................................................... September 19, 2024. 

PER12806337 ... Tanner Glidden .......................................................................................................... September 23, 2024. 

PER11642225 ... William Laird Hamberlin ............................................................................................ September 23, 2024. 

PER11541207 ... Tony Boles ................................................................................................................. September 24, 2024. 

PER11541505 ... Zachary Boles ............................................................................................................ September 24, 2024. 

PER11546525 ... Paul Hansen .............................................................................................................. September 24, 2024. 

PER11641654 ... Sullivan Atkinson ....................................................................................................... September 25, 2024. 

PER11750395 ... John Howell ............................................................................................................... September 25, 2024. 

PER11295255 ... Tulsa Zoo ................................................................................................................... September 25, 2024. 

PER11277351 ... Staten Island Zoo ...................................................................................................... October 3, 2024. 

PER1162024.8 .. Smithsonian’s National Zoo and Conservation Biology Institute .............................. October 4, 2024. 

PER9328605 ..... David Kanellis ............................................................................................................ November 4, 2024. 

PER2858327 ..... Vernon Bret Padgett .................................................................................................. May 2, 2024. 

PER2919227 ..... Vernon Bret Padgett .................................................................................................. May 1, 2024. 


lotter on DSK11XQN23PROD with NOTICES1