[Federal Register Volume 83, Number 38 (Monday, February 26, 2018)]
[Rules and Regulations]
[Pages 8166-8172]
[FR Doc No: 2018-03858]

=======================================================================
-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 229 and 249

[Release Nos. 33-10459; 34-82746]

Commission Statement and Guidance on Public Company Cybersecurity
Disclosures

AGENCY: Securities and Exchange Commission.

ACTION: Interpretation.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (the ``Commission'') is
publishing interpretive guidance to assist public companies in
preparing disclosures about cybersecurity risks and incidents.

DATES: Applicable February 26, 2018.

FOR FURTHER INFORMATION CONTACT: Questions about specific filings
should be directed to staff members responsible for reviewing the
documents the company files with the Commission. For general questions
about this release, contact the Office of the Chief Counsel at (202)
551-3500 in the Division of Corporation Finance, U.S. Securities and
Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

I. Introduction

A. Cybersecurity

    Cybersecurity risks pose grave threats to investors, our capital
markets, and our country.\1\ Whether it is the companies in which
investors invest, their accounts with financial services firms, the
markets through which they trade, or the infrastructure they count on
daily, the investing public and the U.S. economy depend on the security
and reliability of information and communications technology, systems,
and networks. Companies today rely on digital technology to conduct
their business operations and engage with their customers, business
partners, and other constituencies. In a digitally connected world,
cybersecurity presents ongoing risks and threats to our capital markets
and to companies operating in all industries, including public
companies regulated by the Commission.
---------------------------------------------------------------------------

    \1\ The U.S. Computer Emergency Readiness Team defines
cybersecurity as ``[t]he activity or process, ability or capability,
or state whereby information and communications systems and the
information contained therein are protected from and/or defended
against damage, unauthorized use or modification, or exploitation.''
U.S. Computer Emergency Readiness Team website, available at https://niccs.us-cert.gov/glossary#C (Adapted from: CNSSI 4009, NIST SP
800-53 Rev 4, NIPP, DHS National Preparedness Goal; White House
Cyberspace Policy Review, May 2009).
---------------------------------------------------------------------------

    As companies' exposure to and reliance on networked systems and the
internet have increased, the attendant risks and frequency of
cybersecurity incidents also have increased.\2\ Today, the importance
of data management and technology to business is analogous to the
importance of electricity and other forms of power in the past century.
Cybersecurity incidents \3\ can result from unintentional events or
deliberate attacks by insiders or third parties, including
cybercriminals, competitors, nation-states, and ``hacktivists.'' \4\
Companies face an evolving landscape of cybersecurity threats in which
hackers use a complex array of means to perpetrate cyber-attacks,
including the use of stolen access credentials, malware, ransomware,
phishing, structured query language injection attacks, and distributed
denial-of-service attacks, among other means. The objectives of cyber-
attacks vary widely and may include the theft or destruction of
financial assets, intellectual property, or other sensitive information
belonging to companies, their customers, or their business partners.
Cyber-attacks may also be directed at disrupting the operations of
public companies or their business partners. This includes targeting
companies that operate in industries responsible for critical
infrastructure.
---------------------------------------------------------------------------

    \2\ See World Economic Forum, Global Risks Report 2017, 12th Ed.
(Jan. 2017), available at https://www.weforum.org/reports/the-global-risks-report-2017 (concluding that ``greater interdependence
among different infrastructure networks is increasing the scope for
systemic failures--whether from cyber-attacks, software glitches,
natural disasters or other causes--to cascade across networks and
affect society in unanticipated ways.''). See also PwC, ``Turnaround
and Transformation in Cybersecurity: Key Findings from the Global
State of Information Security Survey 2016'' (Oct. 2015), available
at https://www.pwccn.com/en/retail-and-consumer/rcs-info-security-2016.pdf. (finding that in 2015 there was a reported 38% increase in
detected information security incidents from 2014).
    \3\ A ``cybersecurity incident'' is ``[a]n occurrence that
actually or potentially results in adverse consequences to . . . an
information system or the information that the system processes,
stores, or transmits and that may require a response action to
mitigate the consequences.'' U.S. Computer Emergency Readiness Team
website, available at https://niccs.us-cert.gov/glossary#I.
    \4\ One study using a sample of 419 companies in 13 countries
and regions noted that 47 percent of data breach incidents in 2016
involved a malicious or criminal attack, 25 percent were due to
negligent employees or contractors (human factor) and 28 percent
involved system glitches, including both IT and business process
failures. See Ponemon Institute and IBM Security, 2017 Cost of Data
Breach Study: Global Overview (Jun. 2017), available at https://www.ponemon.org/library/2017-cost-of-data-breach-study-united-states.
---------------------------------------------------------------------------

    Companies that fall victim to successful cyber-attacks or
experience

other cybersecurity incidents may incur substantial costs \5\ and
suffer other negative consequences, which may include:
---------------------------------------------------------------------------

    \5\ The average organizational cost of a data breach in the
United States in 2016 was $7.35 million based on the sample in the
study. Id. However, the total costs a company may incur in
connection with a particular cyber-attack or incident could be much
higher.
---------------------------------------------------------------------------

     Remediation costs, such as liability for stolen assets or
information, repairs of system damage, and incentives to customers or
business partners in an effort to maintain relationships after an
attack; \6\
---------------------------------------------------------------------------

    \6\ A company's costs may also include payments to perpetrators
of ransomware attacks in order to attempt to restore operations or
protect customer data or other proprietary information. But see
Federal Bureau of Investigation, ``How To Protect your Network from
Ransomware,'' Ransomware Prevention and Response for CISOs,
available at https://www.justice.gov/criminal-ccips/file/872771/download.
---------------------------------------------------------------------------

     increased cybersecurity protection costs, which may
include the costs of making organizational changes, deploying
additional personnel and protection technologies, training employees,
and engaging third party experts and consultants;
     lost revenues resulting from the unauthorized use of
proprietary information or the failure to retain or attract customers
following an attack;
     litigation and legal risks, including regulatory actions
by state and federal governmental authorities and non-U.S. authorities;
\7\
---------------------------------------------------------------------------

    \7\ See, e.g., New York State Department of Financial Services,
23 NYCRR 500, Cybersecurity Requirements for Financial Services
Companies; European Union General Data Protection Regulation,
Council Regulation 2016/679, 2016 O.J. (L 119) 1.
---------------------------------------------------------------------------

     increased insurance premiums;
     reputational damage that adversely affects customer or
investor confidence; and
     damage to the company's competitiveness, stock price, and
long-term shareholder value.
    Given the frequency, magnitude and cost of cybersecurity incidents,
the Commission believes that it is critical that public companies take
all required actions to inform investors about material cybersecurity
risks and incidents in a timely fashion, including those companies that
are subject to material cybersecurity risks but may not yet have been
the target of a cyber-attack. Crucial to a public company's ability to
make any required disclosure of cybersecurity risks and incidents in
the appropriate timeframe are disclosure controls and procedures that
provide an appropriate method of discerning the impact that such
matters may have on the company and its business, financial condition,
and results of operations, as well as a protocol to determine the
potential materiality of such risks and incidents.\8\ In addition, the
Commission believes that the development of effective disclosure
controls and procedures is best achieved when a company's directors,
officers, and other persons responsible for developing and overseeing
such controls and procedures are informed about the cybersecurity risks
and incidents that the company has faced or is likely to face.
---------------------------------------------------------------------------

    \8\ See Section II.B.1 below for further discussion of
disclosure controls and procedures.
---------------------------------------------------------------------------

    Additionally, directors, officers, and other corporate insiders
must not trade a public company's securities while in possession of
material nonpublic information, which may include knowledge regarding a
significant cybersecurity incident experienced by the company. Public
companies should have policies and procedures in place to (1) guard
against directors, officers, and other corporate insiders taking
advantage of the period between the company's discovery of a
cybersecurity incident and public disclosure of the incident to trade
on material nonpublic information about the incident, and (2) help
ensure that the company makes timely disclosure of any related material
nonpublic information.\9\ In addition, we believe that companies are
well served by considering the ramifications of directors, officers,
and other corporate insiders trading in advance of disclosures
regarding cyber incidents that prove to be material. We recognize that
many companies have adopted preventative measures to address the
appearance of improper trading and we encourage companies to consider
such preventative measures in the context of a cyber event.
---------------------------------------------------------------------------

    \9\ See Section II.B.2 below for further discussion of insider
trading.
---------------------------------------------------------------------------

B. CF Disclosure Guidance: Topic No. 2

    In October 2011, the Division of Corporation Finance (the
``Division'') issued guidance that provided the Division's views
regarding disclosure obligations relating to cybersecurity risks and
incidents.\10\ The guidance explains that, although no existing
disclosure requirement explicitly refers to cybersecurity risks and
cyber incidents, companies nonetheless may be obligated to disclose
such risks and incidents.\11\ After the issuance of the guidance, many
companies included additional cybersecurity disclosure, typically in
the form of risk factors.\12\
---------------------------------------------------------------------------

    \10\ See CF Disclosure Guidance: Topic No. 2--Cybersecurity
(Oct. 13, 2011), available at https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.
    \11\ Id.
    \12\ For example, Willis North America released a 2013 report
that found that approximately 88% of the public Fortune 500
companies and about 78% of the Fortune 501-1000 companies included
risk factor disclosure regarding cybersecurity in their annual
reports filed in 2012. See Willis Fortune 1000 Cyber Disclosure
Report (Aug. 2013), available at http://blog.willis.com/wp-content/uploads/2013/08/Willis-Fortune-1000-Cyber-Report_09-13.pdf. In 2015,
over 88% of Russell 3000 companies disclosed cybersecurity as a
risk. See Audit Analytics, ``Cybersecurity Disclosure in Risk
Factors,'' (Jan. 14, 2016), available at http://www.auditanalytics.com/blog/cybersecurity-disclosures-in-risk-factors/.
---------------------------------------------------------------------------

C. Purpose of Release

    In light of the increasing significance of cybersecurity incidents,
the Commission believes it is necessary to provide further Commission
guidance. This interpretive release outlines the Commission's views
with respect to cybersecurity disclosure requirements under the federal
securities laws as they apply to public operating companies.\13\ While
the Commission continues to consider other means of promoting
appropriate disclosure of cyber incidents, we are reinforcing and
expanding upon the staff's 2011 guidance. In addition, we address two
topics not developed in the staff's 2011 guidance, namely the
importance of cybersecurity policies and procedures and the application
of insider trading prohibitions in the cybersecurity context.
---------------------------------------------------------------------------

    \13\ This release does not address the specific implications of
cybersecurity to other regulated entities under the federal
securities laws, such as registered investment companies, investment
advisers, brokers, dealers, exchanges, and self-regulatory
organizations. For example, in 2014 the Commission adopted
Regulation Systems Compliance and Integrity, applicable to certain
self-regulatory organizations, to strengthen the technology
infrastructure of the U.S. securities markets. Final Rule:
Regulation Systems Compliance and Integrity, Release No. 34-73639
(Nov. 19, 2014) [79 FR. 72252 (Dec. 5, 2014)], available at https://www.sec.gov/rules/final/2014/34-73639.pdf. For additional
cybersecurity regulations and resources, see the Commission's
website page devoted to cybersecurity issues, available at https://www.sec.gov/spotlight/cybersecurity; see also Cybersecurity
Guidance; IM Guidance Update (April 2015), available at https://www.sec.gov/investment/im-guidance-2015-02.pdf (staff guidance on
cybersecurity measures for registered investment companies and
investment advisers).
---------------------------------------------------------------------------

    First, this release stresses the importance of maintaining
comprehensive policies and procedures related to cybersecurity risks
and incidents. Companies are required to establish and maintain
appropriate and effective disclosure controls and procedures that
enable them to make accurate and timely disclosures of material events,
including those related to cybersecurity. Such robust disclosure

controls and procedures assist companies in satisfying their disclosure
obligations under the federal securities laws.
    Second, we also remind companies and their directors, officers, and
other corporate insiders of the applicable insider trading prohibitions
under the general antifraud provisions of the federal securities laws
and also of their obligation to refrain from making selective
disclosures of material nonpublic information about cybersecurity risks
or incidents.\14\
---------------------------------------------------------------------------

    \14\ See Final Rule: Selective Disclosure and Insider Trading,
Release No. 33-7881 (Aug. 15, 2000) [65 FR 51715 (Aug. 24, 2000)],
available at https://www.sec.gov/rules/final/3-7881.htm.
---------------------------------------------------------------------------

    The Commission, and the staff through its filing review process,
continues to monitor cybersecurity disclosures carefully.

II. Commission Guidance

A. Overview of Rules Requiring Disclosure of Cybersecurity Issues

1. Disclosure Obligations Generally; Materiality
    Companies should consider the materiality of cybersecurity risks
and incidents when preparing the disclosure that is required in
registration statements under the Securities Act of 1933 (``Securities
Act'') and the Securities Exchange Act of 1934 (``Exchange Act''), and
periodic and current reports under the Exchange Act.\15\ When a company
is required to file a disclosure document with the Commission, the
requisite form generally refers to the disclosure requirements of
Regulation S-K \16\ and Regulation S-X.\17\ Although these disclosure
requirements do not specifically refer to cybersecurity risks and
incidents, a number of the requirements impose an obligation to
disclose such risks and incidents depending on a company's particular
circumstances. For example:
---------------------------------------------------------------------------

    \15\ Listed companies also should consider any obligations that
may be imposed by exchange listing requirements. For example, the
NYSE requires listed companies to ``release quickly to the public
any news or information which might reasonably be expected to
materially affect the market for its securities.'' See NYSE Listed
Company Manual Rule 202.05--Timely Disclosure of Material News
Developments. In addition, in 2015, the NYSE, in partnership with
Palo Alto Networks, published a summary of information about legal
and regulatory aspects of cybersecurity governance for directors and
officers of public companies. See Navigating the Digital Age: The
Definitive Cybersecurity Guide for Directors and Officers. Chicago:
Caxton Business & Legal, Inc., 2015, available at https://www.securityroundtable.org/wp-content/uploads/2015/09/Cybersecurity-9780996498203-no_marks.pdf. Similarly, Nasdaq requires listed
companies to ``make prompt disclosure to the public of any material
information that would reasonably be expected to affect the value of
its securities or influence investors' decisions.'' See Nasdaq
Listing Rule 5250(b)(1).
    \16\ 17 CFR part 229.
    \17\ 17 CFR part 210.
---------------------------------------------------------------------------

     Periodic Reports: Companies are required to file periodic
reports \18\ to disclose specified information on a regular and ongoing
basis.\19\ These periodic reports include annual reports on Form 10-
K,\20\ which require companies to make disclosure regarding their
business and operations, risk factors, legal proceedings, management's
discussion and analysis of financial condition and results of
operations (``MD&A''), financial statements, disclosure controls and
procedures, and corporate governance.\21\ Periodic reports also include
quarterly reports on Form 10-Q,\22\ which require companies to make
disclosure regarding their financial statements, MD&A, and updated risk
factors.\23\ Likewise, foreign private issuers are required to make
many of these same disclosures in their periodic reports on Form 20-
F.\24\ Companies must provide timely and ongoing information in these
periodic reports regarding material cybersecurity risks and incidents
that trigger disclosure obligations.
---------------------------------------------------------------------------

    \18\ An issuer with a class of securities registered under
Section 12 or subject to Section 15(d) of the Exchange Act is
subject to the periodic and current reporting requirements of
Section 13 and 15(d), respectively, of the Exchange Act.
    \19\ ``Congress recognized that the ongoing dissemination of
accurate information by companies about themselves and their
securities is essential to effective operation of the trading
markets. The Exchange Act rules require public companies to make
periodic disclosures at annual and quarterly intervals, with other
important information reported on a more current basis. The Exchange
Act specifically provides for current disclosure to maintain the
currency and adequacy of information disclosed by companies.''
Proposed Rule: Additional Form 8-K Disclosure Requirements and
Acceleration of Filing Date, Release No. 33-8106, 3-4 (Jun. 17,
2002) [67 FR 42914 (Jun. 25, 2002)].
    \20\ 17 CFR 249.310.
    \21\ See Part I, Items 1, 1A and 3 of Form 10-K; Part II, Items
7, 8 and 9A of Form 10-K; and Part III, Item 10 of Form 10-K [17 CFR
249.310].
    \22\ 17 CFR 249.308a.
    \23\ See Part I, Items 1 and 2 of Form 10-Q; Part II, Item 1A of
Form 10-Q [17 CFR 249.308a].
    \24\ See Part I, Items 3.D, 4, 5 and 8 of Form 20-F; Part II,
Items 15 and 16G of Form 20-F; Part III, Items 17 and 18 of Form 20-
F [17 CFR 249.220f].
---------------------------------------------------------------------------

     Securities Act and Exchange Act Obligations: Securities
Act and Exchange Act registration statements must disclose all material
facts required to be stated therein or necessary to make the statements
therein not misleading. Companies should consider the adequacy of their
cybersecurity-related disclosure, among other things, in the context of
Sections 11, 12, and 17 of the Securities Act, as well as Section 10(b)
and Rule 10b-5 of the Exchange Act.\25\
---------------------------------------------------------------------------

    \25\ 15 U.S.C. 77k; 15 U.S.C. 77l; 15 U.S.C. 77q; 15 U.S.C
78j(b); 17 CFR 240.10b-5.
---------------------------------------------------------------------------

     Current Reports: In order to maintain the accuracy and
completeness of effective shelf registration statements with respect to
the costs and other consequences of material cybersecurity
incidents,\26\ companies can provide current reports on Form 8-K \27\
or Form 6-K.\28\ Companies also frequently provide current reports on
Form 8-K or Form 6-K to report the occurrence and consequences of
cybersecurity incidents.\29\ The Commission encourages companies to
continue to use Form 8-K or Form 6-K to disclose material information
promptly, including disclosure pertaining to cybersecurity matters.
This practice reduces the risk of selective disclosure, as well as the
risk that trading in their securities on the basis of material non-
public information may occur.\30\
---------------------------------------------------------------------------

    \26\ See Item 11(a) of Form S-3 [17 CFR 239.13] and Item 5(a) of
Form F-3 [17 CFR 239.33].
    \27\ 17 CFR 249.308.
    \28\ 17 CFR 249.306.
    \29\ ``The registrant may, at its option, disclose under this
Item 8.01 [of Form 8-K] any events, with respect to which
information is not otherwise called for by this form, that the
registrant deems of importance to security holders.'' 17 CFR 308.
    \30\ See Sections II.B.2 and II.B.3 below for further discussion
of insider trading and Regulation FD.
---------------------------------------------------------------------------

    In addition to the information expressly required by Commission
regulation, a company is required to disclose ``such further material
information, if any, as may be necessary to make the required
statements, in light of the circumstances under which they are made,
not misleading.'' \31\ The Commission considers omitted information to
be material if there is a substantial likelihood that a reasonable
investor would consider the information important in making an
investment decision or that disclosure of the omitted information would
have been viewed by the reasonable investor as having significantly
altered the total mix of information available.\32\
---------------------------------------------------------------------------

    \31\ Rule 408 of the Securities Act [17 CFR 230.408]; Rule 12b-
20 of the Exchange Act [17 CFR 240.12b-20]; and Rule 14a-9 of the
Exchange Act [17 CFR 240.14a-9].
    \32\ This approach is consistent with the standard of
materiality articulated by the U.S. Supreme Court in TSC Industries
v. Northway, 426 U.S. 438, 449 (1976) (a fact is material ``if there
is a substantial likelihood that a reasonable shareholder would
consider it important'' in making an investment decision or if it
``would have been viewed by the reasonable investor as having
significantly altered the `total mix' of information made
available'' to the shareholder).
---------------------------------------------------------------------------

    In determining their disclosure obligations regarding cybersecurity
risks and incidents, companies generally weigh, among other things, the
potential

materiality of any identified risk and, in the case of incidents, the
importance of any compromised information and of the impact of the
incident on the company's operations. The materiality of cybersecurity
risks or incidents depends upon their nature, extent, and potential
magnitude, particularly as they relate to any compromised information
or the business and scope of company operations.\33\ The materiality of
cybersecurity risks and incidents also depends on the range of harm
that such incidents could cause.\34\ This includes harm to a company's
reputation, financial performance, and customer and vendor
relationships, as well as the possibility of litigation or regulatory
investigations or actions, including regulatory actions by state and
federal governmental authorities and non-U.S. authorities.
---------------------------------------------------------------------------

    \33\ For example, the compromised information might include
personally identifiable information, trade secrets or other
confidential business information, the materiality of which may
depend on the nature of the company's business, as well as the scope
of the compromised information.
    \34\ As part of a materiality analysis, a company should
consider the indicated probability that an event will occur and the
anticipated magnitude of the event in light of the totality of
company activity. Basic v. Levinson, 485 U.S. 224, 238 (1988)
(citing SEC v. Texas Gulf Sulphur Co., 401 F. 2d 833, 849 (2d Cir.
1968)). Moreover, no ``single fact or occurrence'' is determinative
as to materiality, which requires an inherently fact-specific
inquiry. Basic, 485 U.S. at 236.
---------------------------------------------------------------------------

    This guidance is not intended to suggest that a company should make
detailed disclosures that could compromise its cybersecurity efforts--
for example, by providing a ``roadmap'' for those who seek to penetrate
a company's security protections. We do not expect companies to
publicly disclose specific, technical information about their
cybersecurity systems, the related networks and devices, or potential
system vulnerabilities in such detail as would make such systems,
networks, and devices more susceptible to a cybersecurity incident.
Nevertheless, we expect companies to disclose cybersecurity risks and
incidents that are material to investors, including the concomitant
financial, legal, or reputational consequences. Where a company has
become aware of a cybersecurity incident or risk that would be material
to its investors, we would expect it to make appropriate disclosure
timely and sufficiently prior to the offer and sale of securities and
to take steps to prevent directors and officers (and other corporate
insiders who were aware of these matters) from trading its securities
until investors have been appropriately informed about the incident or
risk.\35\
---------------------------------------------------------------------------

    \35\ See Sections 7 and 10 of the Securities Act; Sections
10(b), 13(a) and 15(d) of the Exchange Act; and Rule 10b-5 under the
Exchange Act [15 U.S.C 78j(b); 15 U.S.C. 78m(a); 15. U.S.C. 78o(d);
17 CFR 240.10b-5].
---------------------------------------------------------------------------

    Understanding that some material facts may be not available at the
time of the initial disclosure, we recognize that a company may require
time to discern the implications of a cybersecurity incident. We also
recognize that it may be necessary to cooperate with law enforcement
and that ongoing investigation of a cybersecurity incident may affect
the scope of disclosure regarding the incident. However, an ongoing
internal or external investigation--which often can be lengthy--would
not on its own provide a basis for avoiding disclosures of a material
cybersecurity incident.
    We remind companies that they may have a duty to correct prior
disclosure that the company determines was untrue (or omitted a
material fact necessary to make the disclosure not misleading) at the
time it was made \36\ (for example, if the company subsequently
discovers contradictory information that existed at the time of the
initial disclosure), or a duty to update disclosure that becomes
materially inaccurate after it is made \37\ (for example, when the
original statement is still being relied on by reasonable investors).
Companies should consider whether they need to revisit or refresh
previous disclosure, including during the process of investigating a
cybersecurity incident.
---------------------------------------------------------------------------

    \36\ See Backman v. Polaroid Corp., 910 F.2d 10, 16-17 (1st Cir.
1990) (en banc) (finding that the duty to correct applies ``if a
disclosure is in fact misleading when made, and the speaker
thereafter learns of this.'').
    \37\ See id. at 17 (describing the duty to update as potentially
applying ``if a prior disclosure `becomes materially misleading in
light of subsequent events''' (quoting Greenfield v. Heublein, Inc.,
742 F.2d 751, 758 (3d Cir. 1984))). But see Higginbotham v. Baxter
Intern., Inc., 495 F.3d 753, 760 (7th Cir. 2007) (rejecting duty to
update before next quarterly report); Gallagher v. Abbott
Laboratories, 269 F.3d 806, 808-11 (7th Cir. 2001) (explaining that
securities laws do not require continuous disclosure).
---------------------------------------------------------------------------

    We expect companies to provide disclosure that is tailored to their
particular cybersecurity risks and incidents. As the Commission has
previously stated, we ``emphasize a company-by-company approach [to
disclosure] that allows relevant and material information to be
disseminated to investors without boilerplate language or static
requirements while preserving completeness and comparability of
information across companies.'' \38\ Companies should avoid generic
cybersecurity-related disclosure and provide specific information that
is useful to investors.
---------------------------------------------------------------------------

    \38\ See Business and Financial Disclosure Required by
Regulation S-K, Release No. 33-10064 (Apr. 13, 2016) [81 FR 23915
(Apr. 22, 2016)]. See also Plain English Disclosure, Release No. 33-
7497 (Jan. 28, 1998) [63 FR 6370 (Feb. 6, 1998)]; and Updated Staff
Legal Bulletin No. 7: Plain English Disclosure (Jun. 7, 1999)
available at https://www.sec.gov/interps/legal/cfslb7a.htm.
---------------------------------------------------------------------------

2. Risk Factors
    Item 503(c) of Regulation S-K and Item 3.D of Form 20-F require
companies to disclose the most significant factors that make
investments in the company's securities speculative or risky.\39\
Companies should disclose the risks associated with cybersecurity and
cybersecurity incidents if these risks are among such factors,
including risks that arise in connection with acquisitions.\40\
---------------------------------------------------------------------------

    \39\ 17 CFR 229.503(c); 17 CFR 249.220f.
    \40\ See Final Rule: Business Combination Transactions, Release
No. 33-6578 (Apr. 23, 1985) [50 FR 18990 (May 6, 1985)].
---------------------------------------------------------------------------

    It would be helpful for companies to consider the following issues,
among others, in evaluating cybersecurity risk factor disclosure:
     The occurrence of prior cybersecurity incidents, including
their severity and frequency;
     the probability of the occurrence and potential magnitude
of cybersecurity incidents;
     the adequacy of preventative actions taken to reduce
cybersecurity risks and the associated costs, including, if
appropriate, discussing the limits of the company's ability to prevent
or mitigate certain cybersecurity risks;
     the aspects of the company's business and operations that
give rise to material cybersecurity risks and the potential costs and
consequences of such risks, including industry-specific risks and third
party supplier and service provider risks;
     the costs associated with maintaining cybersecurity
protections, including, if applicable, insurance coverage relating to
cybersecurity incidents or payments to service providers;
     the potential for reputational harm;
     existing or pending laws and regulations that may affect
the requirements to which companies are subject relating to
cybersecurity and the associated costs to companies; and
     litigation, regulatory investigation, and remediation
costs associated with cybersecurity incidents.
    In meeting their disclosure obligations, companies may need to

disclose previous or ongoing cybersecurity incidents or other past
events in order to place discussions of these risks in the appropriate
context. For example, if a company previously experienced a material
cybersecurity incident involving denial-of-service, it likely would not
be sufficient for the company to disclose that there is a risk that a
denial-of-service incident may occur. Instead, the company may need to
discuss the occurrence of that cybersecurity incident and its
consequences as part of a broader discussion of the types of potential
cybersecurity incidents that pose particular risks to the company's
business and operations. Past incidents involving suppliers, customers,
competitors, and others may be relevant when crafting risk factor
disclosure. In certain circumstances, this type of contextual
disclosure may be necessary to effectively communicate cybersecurity
risks to investors.
3. MD&A of Financial Condition and Results of Operations
    Item 303 of Regulation S-K and Item 5 of Form 20-F require a
company to discuss its financial condition, changes in financial
condition, and results of operations. These items require a discussion
of events, trends, or uncertainties that are reasonably likely to have
a material effect on its results of operations, liquidity, or financial
condition, or that would cause reported financial information not to be
necessarily indicative of future operating results or financial
condition and such other information that the company believes to be
necessary to an understanding of its financial condition, changes in
financial condition, and results of operations.\41\ In this context,
the cost of ongoing cybersecurity efforts (including enhancements to
existing efforts), the costs and other consequences of cybersecurity
incidents, and the risks of potential cybersecurity incidents, among
other matters, could inform a company's analysis. In addition,
companies may consider the array of costs associated with cybersecurity
issues, including, but not limited to, loss of intellectual property,
the immediate costs of the incident, as well as the costs associated
with implementing preventative measures, maintaining insurance,
responding to litigation and regulatory investigations, preparing for
and complying with proposed or current legislation, engaging in
remediation efforts, addressing harm to reputation, and the loss of
competitive advantage that may result.\42\ Finally, the Commission
expects companies to consider the impact of such incidents on each of
their reportable segments.\43\
---------------------------------------------------------------------------

    \41\ 17 CFR 229.303; 17 CFR 249.220f.
    \42\ A number of past Commission releases provide general
interpretive guidance on these disclosure requirements. See, e.g.,
Commission Guidance Regarding Management's Discussion and Analysis
of Financial Condition and Results of Operations, Release No. 33-
8350 (Dec. 19, 2003) [68 FR 75056 (Dec. 29, 2003)]; Commission
Statement About Management's Discussion and Analysis of Financial
Condition and Results of Operations, Release No. 33-8056 (Jan. 22,
2002) [67 FR 3746 (Jan. 25, 2002)]; Management's Discussion and
Analysis of Financial Condition and Results of Operations; Certain
Investment Company Disclosures, Release No. 33-6835 (May 18, 1989)
[54 FR 22427 (May 24, 1989)].
    \43\ 17 CFR 229.303(a).
---------------------------------------------------------------------------

4. Description of Business
    Item 101 of Regulation S-K and Item 4.B of Form 20-F require
companies to discuss their products, services, relationships with
customers and suppliers, and competitive conditions.\44\ If
cybersecurity incidents or risks materially affect a company's
products, services, relationships with customers or suppliers, or
competitive conditions, the company must provide appropriate
disclosure.
---------------------------------------------------------------------------

    \44\ 17 CFR 229.101; 17 CFR 249.220f.
---------------------------------------------------------------------------

5. Legal Proceedings
    Item 103 of Regulation S-K requires companies to disclose
information relating to material pending legal proceedings to which
they or their subsidiaries are a party.\45\ Companies should note that
this requirement includes any such proceedings that relate to
cybersecurity issues. For example, if a company experiences a
cybersecurity incident involving the theft of customer information and
the incident results in material litigation by customers against the
company, the company should describe the litigation, including the name
of the court in which the proceedings are pending, the date the
proceedings are instituted, the principal parties thereto, a
description of the factual basis alleged to underlie the litigation,
and the relief sought.
---------------------------------------------------------------------------

    \45\ 17 CFR 229.103.
---------------------------------------------------------------------------

6. Financial Statement Disclosures
    Cybersecurity incidents and the risks that result therefrom may
affect a company's financial statements. For example, cybersecurity
incidents may result in:
     Expenses related to investigation, breach notification,
remediation and litigation, including the costs of legal and other
professional services;
     loss of revenue, providing customers with incentives or a
loss of customer relationship assets value;
     claims related to warranties, breach of contract, product
recall/replacement, indemnification of counterparties, and insurance
premium increases; and
     diminished future cash flows, impairment of intellectual,
intangible or other assets; recognition of liabilities; or increased
financing costs.
    The Commission expects that a company's financial reporting and
control systems would be designed to provide reasonable assurance that
information about the range and magnitude of the financial impacts of a
cybersecurity incident would be incorporated into its financial
statements on a timely basis as the information becomes available.\46\
---------------------------------------------------------------------------

    \46\ See Section 13(b)(2)(B) of the Exchange Act [15
U.S.C.78m(b)(2)(B)].
---------------------------------------------------------------------------

7. Board Risk Oversight
    Item 407(h) of Regulation S-K and Item 7 of Schedule 14A require a
company to disclose the extent of its board of directors' role in the
risk oversight of the company, such as how the board administers its
oversight function and the effect this has on the board's leadership
structure.\47\ The Commission has previously said that ``disclosure
about the board's involvement in the oversight of the risk management
process should provide important information to investors about how a
company perceives the role of its board and the relationship between
the board and senior management in managing the material risks facing
the company.'' \48\ A company must include a description of how the
board administers its risk oversight function.\49\ To the extent
cybersecurity risks are material to a company's business, we believe
this discussion should include the nature of the board's role in
overseeing the management of that risk.
---------------------------------------------------------------------------

    \47\ 17 CFR 229.407(h); 17 CFR 240.14a-101--Schedule 14A.
    \48\ Final Rule: Proxy Disclosure Enhancements, Release No. 33-
9089 (Dec. 16, 2009) [74 FR 68334 (Dec. 23, 2009)], available at
http://www.sec.gov/rules/final/2009/33-9089.pdf.
    \49\ See Item 407(h) of Regulation S-K [17 CFR 229.407(h)].
---------------------------------------------------------------------------

    In addition, we believe disclosures regarding a company's
cybersecurity risk management program and how the board of directors
engages with management on cybersecurity issues allow investors to
assess how a board of directors is discharging its risk oversight
responsibility in this increasingly important area.

B. Policies and Procedures

1. Disclosure Controls and Procedures
    Cybersecurity risk management policies and procedures are key
elements of enterprise-wide risk management, including as it relates to
compliance with the federal securities laws. We encourage companies to
adopt comprehensive policies and procedures related to cybersecurity
and to assess their compliance regularly, including the sufficiency of
their disclosure controls and procedures as they relate to
cybersecurity disclosure. Companies should assess whether they have
sufficient disclosure controls and procedures in place to ensure that
relevant information about cybersecurity risks and incidents is
processed and reported to the appropriate personnel, including up the
corporate ladder, to enable senior management to make disclosure
decisions and certifications and to facilitate policies and procedures
designed to prohibit directors, officers, and other corporate insiders
from trading on the basis of material nonpublic information about
cybersecurity risks and incidents.\50\
---------------------------------------------------------------------------

    \50\ See Final Rule: Certification of Disclosure in Companies'
Quarterly and Annual Reports, Release No. 33-8124 (Aug. 28, 2002)
[67 FR 57276 (Sept. 9, 2002)], available at https://www.sec.gov/rules/final/33-8124.htm (``We believe that, to assist principal
executive and financial officers in the discharge of their
responsibilities in making the required certifications, as well as
to discharge their responsibilities in providing accurate and
complete information to security holders, it is necessary for
companies to ensure that their internal communications and other
procedures operate so that important information flows to the
appropriate collection and disclosure points in a timely manner.'');
see also Section 10(b) of the Exchange Act and Rule 10b-5 thereunder
[15 U.S.C. 78j(b); 17 CFR 240.10b-5].
---------------------------------------------------------------------------

    Pursuant to Exchange Act Rules 13a-15 and 15d-15, companies must
maintain disclosure controls and procedures, and management must
evaluate their effectiveness.\51\ These rules define ``disclosure
controls and procedures'' as those controls and other procedures
designed to ensure that information required to be disclosed by the
company in the reports that it files or submits under the Exchange Act
is (1) ``recorded, processed, summarized and reported, within the time
periods specified in the Commission's rules and forms,'' and (2)
``accumulated and communicated to the company's management . . . as
appropriate to allow timely decisions regarding required disclosure.''
\52\
---------------------------------------------------------------------------

    \51\ 17 CFR 240.13a-15; 17 CFR 240.15d-15.
    \52\ Id.
---------------------------------------------------------------------------

    A company's disclosure controls and procedures should not be
limited to disclosure specifically required, but should also ensure
timely collection and evaluation of information potentially subject to
required disclosure, or relevant to an assessment of the need to
disclose developments and risks that pertain to the company's
businesses.\53\ Information also must be evaluated in the context of
the disclosure requirement of Exchange Act Rule 12b-20.\54\ When
designing and evaluating disclosure controls and procedures, companies
should consider whether such controls and procedures will appropriately
record, process, summarize, and report the information related to
cybersecurity risks and incidents that is required to be disclosed in
filings. Controls and procedures should enable companies to identify
cybersecurity risks and incidents, assess and analyze their impact on a
company's business, evaluate the significance associated with such
risks and incidents, provide for open communications between technical
experts and disclosure advisors, and make timely disclosures regarding
such risks and incidents.
---------------------------------------------------------------------------

    \53\ See Final Rule: Certification of Disclosure in Companies'
Quarterly and Annual Reports, Release No. 33-8124 (Aug. 28, 2002)
[67 FR 57276 (Sept. 9, 2002)], available at https://www.sec.gov/rules/final/33-8124.htm (``We believe that the new rules will help
to ensure that an issuer's systems grow and evolve with its business
and are capable of producing Exchange Act reports that are timely,
accurate and reliable.'').
    \54\ 17 CFR 240.12b-20.
---------------------------------------------------------------------------

    Exchange Act Rules 13a-14 and 15d-14 \55\ require a company's
principal executive officer and principal financial officer to make
certifications regarding the design and effectiveness of disclosure
controls and procedures,\56\ and Item 307 of Regulation S-K and Item
15(a) of Exchange Act Form 20-F require companies to disclose
conclusions on the effectiveness of disclosure controls and
procedures.\57\ These certifications and disclosures should take into
account the adequacy of controls and procedures for identifying
cybersecurity risks and incidents and for assessing and analyzing their
impact. In addition, to the extent cybersecurity risks or incidents
pose a risk to a company's ability to record, process, summarize, and
report information that is required to be disclosed in filings,
management should consider whether there are deficiencies in disclosure
controls and procedures that would render them ineffective.
---------------------------------------------------------------------------

    \55\ 17 CFR 240.13a-14; 17 CFR 240.15d-14.
    \56\ Section 302 of the Sarbanes-Oxley Act of 2002 required the
Commission to adopt final rules under which the principal executive
officer or officers and the principal financial officer or officers,
or persons providing similar functions, of an issuer each must
certify the information contained in the issuer's quarterly and
annual reports. Public Law 107-204, 116 Stat. 745 (2002).
    \57\ 17 CFR 229.307; 17 CFR 249.220f.
---------------------------------------------------------------------------

2. Insider Trading
    Companies and their directors, officers, and other corporate
insiders should be mindful of complying with the laws related to
insider trading in connection with information about cybersecurity
risks and incidents, including vulnerabilities and breaches.\58\ It is
illegal to trade a security ``on the basis of material nonpublic
information about that security or issuer, in breach of a duty of trust
or confidence that is owed directly, indirectly, or derivatively, to
the issuer of that security or the shareholders of that issuer, or to
any other person who is the source of the material nonpublic
information.'' \59\ As noted above, information about a company's
cybersecurity risks and incidents may be material nonpublic
information, and directors, officers, and other corporate insiders
would violate the antifraud provisions if they trade the company's
securities in breach of their duty of trust or confidence while in
possession of that material nonpublic information.\60\
---------------------------------------------------------------------------

    \58\ In addition to promoting full and fair disclosure, the
antifraud provisions of the federal securities laws prohibit insider
trading, which harms not only individual investors but also the very
foundations of our markets by undermining investor confidence in the
integrity of those markets. 17 CFR 243.100. Final Rule: Selective
Disclosure and Insider Trading, Release No. 34-43154 (Aug. 15, 2000)
[65 FR 51716 (Aug. 24, 2000)].
    \59\ Rule 10b5-1(a) of the Exchange Act [17 CFR 240.10b-5-1(a)].
    \60\ This would not preclude directors, officers, and other
corporate insiders from relying on Exchange Act Rule 10b5-1 if all
conditions of that rule are met.
---------------------------------------------------------------------------

    Beyond the antifraud provisions of the federal securities laws,
companies and their directors, officers, and other corporate insiders
must comply with all other applicable insider trading related rules.
Many exchanges require listed companies to adopt codes of conduct and
policies that promote compliance with applicable laws, rules, and
regulations, including those prohibiting insider trading.\61\ We
encourage companies to consider how their codes of ethics \62\ and
insider trading policies take into account and prevent trading on

the basis of material nonpublic information related to cybersecurity
risks and incidents. The Commission believes that it is important to
have well designed policies and procedures to prevent trading on the
basis of all types of material non-public information, including
information relating to cybersecurity risks and incidents.
---------------------------------------------------------------------------

    \61\ See e.g., NYSE Listed Company Manual Section 303A.10, which
states in relevant part that every NYSE ``listed company should
proactively promote compliance with laws, rules and regulations,
including insider trading laws. Insider trading is both unethical
and illegal, and should be dealt with decisively.'' See also NASDAQ
Listing Rule 5610 and Section 406(c) of the Sarbanes-Oxley Act of
2002.
    \62\ Item 406 of Regulation S-K [17 CFR 229.406].
---------------------------------------------------------------------------

    In addition, while companies are investigating and assessing
significant cybersecurity incidents, and determining the underlying
facts, ramifications and materiality of these incidents, they should
consider whether and when it may be appropriate to implement
restrictions on insider trading in their securities. Company insider
trading policies and procedures that include prophylactic measures can
protect against directors, officers, and other corporate insiders
trading on the basis of material nonpublic information before public
disclosure of the cybersecurity incident. As noted above, we believe
that companies would be well served by considering how to avoid the
appearance of improper trading during the period following an incident
and prior to the dissemination of disclosure.
3. Regulation FD and Selective Disclosure
    Companies also may have disclosure obligations under Regulation FD
in connection with cybersecurity matters. Under Regulation FD, ``when
an issuer, or person acting on its behalf, discloses material nonpublic
information to certain enumerated persons it must make public
disclosure of that information.'' \63\ The Commission adopted
Regulation FD owing to concerns about companies making selective
disclosure of material nonpublic information to certain persons before
making full disclosure of that same information to the general
public.\64\
---------------------------------------------------------------------------

    \63\ 17 CFR 243.100. Final Rule: Selective Disclosure and
Insider Trading, Release No. 34-43154 (Aug. 15, 2000) [65 FR 51716
(Aug. 24, 2000)].
    \64\ Id.
---------------------------------------------------------------------------

    In cases of selective disclosure of material nonpublic information
related to cybersecurity, companies should ensure compliance with
Regulation FD. Companies and persons acting on their behalf should not
selectively disclose material, nonpublic information regarding
cybersecurity risks and incidents to Regulation FD enumerated persons
\65\ before disclosing that same information to the public.\66\ We
expect companies to have policies and procedures to ensure that any
disclosures of material nonpublic information related to cybersecurity
risks and incidents are not made selectively, and that any Regulation
FD required public disclosure is made simultaneously (in the case of an
intentional disclosure as defined in the rule) or promptly (in the case
of a non-intentional disclosure) and is otherwise compliant with the
requirements of that regulation.\67\
---------------------------------------------------------------------------

    \65\ Regulation FD applies generally to selective disclosures
made to persons outside the issuer who are (1) a broker or dealer or
persons associated with a broker or dealer; (2) an investment
advisor or persons associated with an investment advisor; (3) an
investment company or persons affiliated with an investment company;
or (4) a holder of the issuer's securities under circumstances in
which it is reasonably foreseeable that the person will trade in the
issuer's securities on the basis of the information. 17 CFR
243.100(b)(1).
    \66\ Final Rule: Selective Disclosure and Insider Trading,
Release No. 34-43154 (Aug. 15, 2000) [65 FR 51716 (Aug. 24, 2000)].
    \67\ ``Under the regulation, the required public disclosure may
be made by filing or furnishing a Form 8-K, or by another method or
combination of methods that is reasonably designed to effect broad,
non-exclusionary distribution of the information to the public.''
Id. at 3.

---------------------------------------------------------------------------
    By the Commission.

    Dated: February 21, 2018.
Brent J. Fields,
Secretary.
[FR Doc. 2018-03858 Filed 2-23-18; 8:45 am]
 BILLING CODE 8011-01-P


[Federal Register Volume 77, Number 226 (Friday, November 23, 2012)]
[Notices]
[Page 70160]
[FR Doc No: 2012-28407]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. EL13-21-000]

California Independent System, Operator Corporation; Notice of
Petition for Declaratory Order

    Take notice that on November 15, 2012, pursuant to section
207(a)(2) and 212 of the Federal Energy Regulatory Commission's
(Commission) Rules of Practice and Procedure, California Independent
System Operator Corporation filed a petition requesting that the
Commission issue a declaratory order to enforce the exercise of its
authority and rights under its tariff to obtain reliability services
under a Reliability Must-Run (``RMR'') agreement with AES Huntington
Beach LLC.
    Any person desiring to intervene or to protest this filing must
file in accordance with Rules 211 and 214 of the Commission's Rules of
Practice and Procedure (18 CFR 385.211, 385.214). Protests will be
considered by the Commission in determining the appropriate action to
be taken, but will not serve to make protestants parties to the
proceeding. Any person wishing to become a party must file a notice of
intervention or motion to intervene, as appropriate. Such notices,
motions, or protests must be filed on or before the comment date. On or
before the comment date, it is not necessary to serve motions to
intervene or protests on persons other than the Applicant.
    The Commission encourages electronic submission of protests and
interventions in lieu of paper using the ``eFiling'' link at http://www.ferc.gov. Persons unable to file electronically should submit an
original and 14 copies of the protest or intervention to the Federal
Energy Regulatory Commission, 888 First Street NE., Washington, DC
20426.
    This filing is accessible on-line at http://www.ferc.gov, using the
``eLibrary'' link and is available for review in the Commission's
Public Reference Room in Washington, DC. There is an ``eSubscription''
link on the Web site that enables subscribers to receive email
notification when a document is added to a subscribed docket(s). For
assistance with any FERC Online service, please email
<EMAIL_ADDRESS>or call<PHONE_NUMBER> (toll free). For
TTY, call<PHONE_NUMBER>.
    Comment Date: 5:00 p.m. Eastern Time on November 29, 2012.

    Dated: November 16, 2012.
Nathaniel J. Davis, Sr.,
Deputy Secretary.
[FR Doc. 2012-28407 Filed 11-21-12; 8:45 am]
BILLING CODE 6717-01-P


                    UNITED STATES OF AMERICA

            DEPARTMENT OF TRANSPORTATION

                    OFFICE OF THE SECRETARY

                             WASHINGTON, DC

Issued by the Department of Transportation on April 19, 2004

NOTICE OF ACTION TAKEN -- DOCKETS OST-2001-11152 AND OST-96-1839

________________________________________________________________________
_____________

This serves as notice to the public of the action described below, taken
by the Department official indicated (no additional confirming order
will be issued in this matter).

Applications of   US Airways, Inc.   filed  2/5/2004, as amended
4/2/2004  for:

XX  Exemption for two years pursuant to 49 U.S.C. §40109 to provide the
following services:

DOCKET OST-01-11152

Scheduled foreign air transportation of persons, property and mail (1)
between Washington DC and Bermuda (renewal of existing authority), and
(2) between Chicago, Illinois and Bermuda (new authority).

DOCKET OST-96-1839

Scheduled foreign air transportation of persons, property and mail
between Charlotte, North Carolina, and Bermuda (renewal of existing
authority).

US Airways requests that the exemption authorities described above be
issued with a common expiration date to run concurrently with its other
Bermuda exemption authority in Docket OST-03-14671, set to expire on
March 18, 2005.  US Airways also requests that these Bermuda exemption
authorities be consolidated into one of the referenced dockets.

Applicant rep:  Howard Kass<PHONE_NUMBER>     DOT Analyst:  Gerald
Caolo<PHONE_NUMBER>

D I S P O S I T I O N

XX  Granted (Subject to conditions, see below)

The above action was effective when taken: April 19, 2004, through March
18, 2005

Action taken by:   Paul L. Gretch, Director

		    Office of International Aviation

XX   The authority granted is consistent with the aviation agreement
between the United States and the United Kingdom.

Except to the extent exempted or waived, this authority is subject to
the terms, conditions, and limitations indicated:

	XX  Holder’s certificates of public convenience and necessity

	XX  Standard Exemption Conditions (attached)

________________________________________________________________________
___________________

Remarks:  We have granted the carrier’s request to consolidate the
exemption authority granted here into Docket OST-2001-11152.  Thus, the
carrier may henceforth file in Docket OST-2001-11152 at such time as it
seeks to make requests concerning its exemption authority to serve the
Charlotte/Chicago/Washington-Bermuda markets.

The authority for the Washington-Bermuda market for which US Airways
requested renewal expired April 18, 2004, but had been kept in force
pursuant to the provisions of the Administrative Procedure Act, 5 U.S.C.
558(c), as implemented by 14 CFR Part 377, pending action on its
timely-filed renewal application.

Conditions:  The code-share operations conducted under this
authorization are subject to the following conditions:

 The code-sharing operations conducted under this authority must comply
with 14 CFR 257 and with any amendment to the Department’s regulations
concerning code-share arrangements that may be adopted.  Notwithstanding
any provisions in the contract between the carriers, our approval here
is expressly conditioned upon the requirements that the subject foreign
air transportation be sold in the name of the carrier holding out such
service in computer reservation systems and elsewhere; that the carrier
selling such transportation (i.e., the carrier shown on the ticket)
accept responsibility for the entirety of the code-share journey for all
obligations established in its contract of carriage with the passenger;
and that the passenger liability of the operating carrier be unaffected;
and

 The authority granted here is specifically conditioned so that neither
US Airways nor United Air Lines shall give any force or effect to any
contractual provisions between themselves that are contrary to these
conditions.

___________________________________

On the basis of data officially noticeable under Rule 24(g) of the
Department’s regulations, we found the applicant qualified to provide
the services authorized.

Under authority assigned by the Department in its regulations, 14 CFR
Part 385, we found that (1) our action was consistent with Department
policy; (2) grant of the authority was consistent with the public
interest; and (3) grant of the authority would not constitute a major
regulatory action under the Energy Policy and Conservation Act of 1975.
To the extent not granted, we denied all requests in the referenced
Docket.  We may amend, modify, or revoke the authority granted in this
Notice at any time without hearing at our discretion.

Persons entitled to petition the Department for review of the action set
forth in this Notice under the Department’s regulations, 14 CFR §
385.30, may file their petitions within seven (7) days after the date of
issuance of this Notice.  This action was effective when taken, and the
filing of a petition for review will not alter such effectiveness.

An electronic version of this order is available on the World Wide Web
at

  HYPERLINK "http://dms.dot.gov//reports/reports_ aviation.asp"
http://dms.dot.gov//reports/reports_ aviation.asp

U.S. Carrier Exemption Conditions

In the conduct of the operations authorized, the U.S. carrier
applicant(s) shall:

(1) Hold at all times effective operating authority from the government
of each country served;

(2) Comply with applicable requirements concerning oversales contained
in 14 CFR 250 (for scheduled operations, if authorized);

(3) Comply with the requirements for reporting data contained in 14 CFR
241;

(4) Comply with requirements for minimum insurance coverage, and for
certifying that coverage to the Department, contained in 14 CFR 205;

(5) Except as specifically exempted or otherwise provided for in a
Department Order, comply with the requirements of 14 CFR 203, concerning
waiver of Warsaw Convention liability limits and defenses;

(6) Comply with all applicable requirements of the Federal Aviation
Administration and with all applicable U.S. Government requirements
concerning security.  To assure compliance with all applicable U.S.
Government requirements concerning security, the holder shall, before
commencing any new service (including charter flights) to or from a
foreign airport, contact its Principal Security Inspector (PSI) to
advise the PSI of its plans and to find out whether the Transportation
Security Administration has determined that security is adequate to
allow such airport(s) to be served; and

(7) Comply with such other reasonable terms, conditions, and limitations
required by the public interest as may be prescribed by the Department
of Transportation, with all applicable orders and regulations of other
U.S. agencies and courts, and with all applicable laws of the United
States.

The authority granted shall be effective only during the period when the
holder is in compliance with the conditions imposed above.

08/2003

 US Airways amended its application in Docket OST-01-11152 by requesting
new authority between Chicago and Bermuda.

 US Airways states that it plans to provide service between Chicago and
Bermuda under a code-share arrangement with United Air Lines.  However,
US Airways states that it wants the opportunity to provide service to
this Bermuda market either directly or through a code-share arrangement.

 PAGE

 PAGE   2


[Federal Register Volume 86, Number 79 (Tuesday, April 27, 2021)]
[Rules and Regulations]
[Pages 22121-22124]
[FR Doc No: 2021-08761]

=======================================================================
-----------------------------------------------------------------------

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 271

[EPA-R04-RCRA-2021-0229; FRL-10021-97-Region 4]

Georgia: Final Authorization of State Hazardous Waste Management
Program Revisions

AGENCY: Environmental Protection Agency.

ACTION: Direct final rule.

-----------------------------------------------------------------------

SUMMARY: The Environmental Protection Agency (EPA) is taking direct
final action on the authorization of Georgia's changes to its hazardous
waste program under the Resource Conservation and Recovery Act (RCRA).
These changes were outlined in an application to the EPA and correspond
to certain Federal rules promulgated between July 1, 2004, and June 30,
2020. We have determined that these changes satisfy all requirements
needed for final authorization.

DATES: This rule is effective on June 28, 2021 without further notice,
unless the EPA receives adverse comment by May 27, 2021. If the EPA
receives adverse comment, we will publish a timely withdrawal in the
Federal Register informing the public that the rule will not take
effect.

ADDRESSES: Submit your comments, identified by Docket ID No. EPA-R04-
RCRA-2021-0229, at https://www.regulations.gov. Follow the online
instructions for submitting comments. Once submitted, comments cannot
be edited or removed from www.regulations.gov. The EPA may publish any
comment received to its public docket. Do not submit electronically any
information you consider to be Confidential Business Information (CBI)
or other information whose disclosure is restricted by statute.
Multimedia submissions (audio, video, etc.) must be accompanied by a
written comment. The written comment is considered the official comment
and should include discussion of all points you wish to make. The EPA
will generally not consider comments or comment contents located
outside of the primary submission (i.e., on the web, cloud, or other
file sharing system). For additional submission methods, the full EPA
public comment policy, information about CBI or multimedia submissions,
and general guidance on making effective comments, please visit http://www.epa.gov/dockets/commenting-epa-dockets.
    The EPA encourages electronic submittals, but if you are unable to

submit electronically or need other assistance, please contact Kelly
Adams, the contact listed in the FOR FURTHER INFORMATION CONTACT
provision below. Please also contact Kelly Adams if you need assistance
in a language other than English or if you are a person with
disabilities who needs a reasonable accommodation at no cost to you.
    All documents in the docket are listed in the www.regulations.gov
index. Publicly available docket materials are available electronically
in www.regulations.gov. For alternative access to docket materials,
please contact Kelly Adams, the contact listed in the FOR FURTHER
INFORMATION CONTACT provision below.

FOR FURTHER INFORMATION CONTACT: Kelly Adams; RCRA Programs and Cleanup
Branch; Land, Chemicals and Redevelopment Division; U.S. Environmental
Protection Agency; Atlanta Federal Center, 61 Forsyth Street SW,
Atlanta, Georgia 30303-8960; telephone number:<PHONE_NUMBER>; fax
number:<PHONE_NUMBER>; email address<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

I. Why is the EPA using a direct final rule?

    The EPA is publishing this rule without a prior proposed rule
because we view this as a noncontroversial action and anticipate no
adverse comment. This action is a routine program change. However, in
the ``Proposed Rules'' section of today's Federal Register, we are
publishing a separate document that will serve as the proposed rule
allowing the public an opportunity to comment. We will not institute a
second comment period on this action. Any parties interested in
commenting must do so at this time. For further information about
commenting on this rule, see the ADDRESSES section of this document.
    If the EPA receives adverse comment, we will publish a timely
withdrawal in the Federal Register informing the public that this
direct final rule will not take effect. We will address all public
comments in a subsequent final rule and base any further decision on
the authorization of the State program changes after considering all
comments received during the comment period.

II. Why are revisions to state programs necessary?

    States that have received final authorization from the EPA under
RCRA section 3006(b), 42 U.S.C. 6926(b), must maintain a hazardous
waste program that is equivalent to, consistent with, and no less
stringent than the Federal program. As the Federal program changes,
states must change their programs and ask the EPA to authorize the
changes. Changes to state programs may be necessary when Federal or
state statutory or regulatory authority is modified or when certain
other changes occur. Most commonly, states must change their programs
because of changes to the EPA's regulations in 40 Code of Federal
Regulations (CFR) parts 124, 260 through 268, 270, 273, and 279.
    New Federal requirements and prohibitions imposed by Federal
regulations that the EPA promulgates pursuant to the Hazardous and
Solid Waste Amendments of 1984 (HSWA) take effect in authorized states
at the same time they take effect in unauthorized states. Thus, the EPA
will implement those requirements and prohibitions in Georgia,
including the issuance of new permits implementing those requirements,
until the State is granted authorization to do so.

III. What decisions has the EPA made in this rule?

    Georgia submitted a complete program revision application, dated
January 4, 2021 and supplemented on February 9, 2021, seeking
authorization of changes to its hazardous waste program corresponding
to certain Federal rules promulgated between July 1, 2004 and June 30,
2020 (including RCRA Clusters \1\ XV (Checklist \2\ 206 only), XXIV
(Checklist 235 only), and XXVI through XXVIII). The EPA concludes that
Georgia's application to revise its authorized program meets all of the
statutory and regulatory requirements established under RCRA, as set
forth in RCRA section 3006(b), 42 U.S.C. 6926(b), and 40 CFR part 271.
Therefore, the EPA proposes to grant Georgia final authorization to
operate its hazardous waste program with the changes described in the
authorization application, and as outlined below in Section VI of this
document.
---------------------------------------------------------------------------

    \1\ A ``cluster'' is a grouping of hazardous waste rules that
the EPA promulgates from July 1st of one year to June 30th of the
following year.
    \2\ A ``checklist'' is developed by the EPA for each Federal
rule amending the RCRA regulations. The checklists document the
changes made by each Federal rule and are presented and numbered in
chronological order by date of promulgation.
---------------------------------------------------------------------------

    Georgia has responsibility for permitting treatment, storage, and
disposal facilities within its borders and for carrying out the aspects
of the RCRA program described in its program revision application,
subject to the limitations of HSWA, as discussed above.

IV. What is the effect of this authorization decision?

    The effect of this decision is that the changes described in
Georgia's authorization application will become part of the authorized
State hazardous waste program and will therefore be federally
enforceable. Georgia will continue to have primary enforcement
authority and responsibility for its State hazardous waste program. The
EPA will maintain its authorities under RCRA sections 3007, 3008, 3013,
and 7003, including its authority to:
     Conduct inspections, and require monitoring, tests,
analyses, and reports;
     Enforce RCRA requirements, including authorized State
program requirements, and
    suspend or revoke permits; and
     Take enforcement actions regardless of whether the State
has taken its own actions.
    This action does not impose additional requirements on the
regulated community because the regulations for which the EPA is
authorizing Georgia are already effective under State law and are not
changed by today's action.

V. What has Georgia previously been authorized for?

    Georgia initially received final authorization on August 7, 1984,
effective August 21, 1984 (49 FR 31417), to implement the RCRA
hazardous waste management program. The EPA granted authorization for
changes to Georgia's program on the following dates: July 7, 1986,
effective September 18, 1986 (51 FR 24549); July 28, 1988, effective
September 26, 1988 (53 FR 28383); July 24, 1990, effective September
24, 1990 (55 FR 30000); February 12, 1991, effective April 15, 1991 (56
FR 5656); May 11, 1992, effective July 10, 1992 (57 FR 20055); November
25, 1992, effective January 25, 1993 (57 FR 55466); February 26, 1993,
effective April 27, 1993 (58 FR 11539); November 16, 1993, effective
January 18, 1994 (58 FR 60388); April 26, 1994, effective June 27, 1994
(59 FR 21664); May 10, 1995, effective July 10, 1995 (60 FR 24790);
August 30, 1995, effective October 30, 1995 (60 FR 45069); March 7,
1996, effective May 6, 1996 (61 FR 9108); September, 18, 1998,
effective November 17, 1998 (63 FR 49852); October 14, 1999, effective
December 13, 1999 (64 FR 55629); November 28, 2000, effective March 30,
2001 (66 FR 8090); July 16, 2002, effective September 16, 2002 (67 FR
46600); November 19, 2002, effective January 21, 2003 (67 FR 69690);
July 18, 2003, effective September 16, 2003 (68

FR 42605); January 27, 2005, effective April 20, 2005 (70 FR 12973);
April 25, 2006, effective June 26, 2006 (71 FR 23864); May 2, 2013,
effective July 1, 2013 (78 FR 25579); January 26, 2015, effective March
27, 2015 (80 FR 3888); and February 22, 2019 (84 FR 5603).

VI. What changes is the EPA authorizing with this action?

    Georgia submitted a complete program revision application, dated
January 4, 2021 and supplemented on February 9, 2021, seeking
authorization of changes to its hazardous waste management program in
accordance with 40 CFR 271.21. This application included changes
associated with Checklists 206, 235, and 238 through 242. The EPA has
determined, subject to receipt of written comments that oppose this
action, that Georgia's hazardous waste program revisions are equivalent
to, consistent with, and no less stringent than the Federal program,
and therefore satisfy all of the requirements necessary to qualify for
final authorization. Therefore, the EPA grants final authorization to
Georgia for the following program changes:

------------------------------------------------------------------------
   Description of Federal       Federal Register       Analogous state
         requirement              date and page         authority \1\
------------------------------------------------------------------------
Checklist 206 and 206.1,      70 FR 9138, 2/24/05;  391-3-11-.01(2); 391-
 Nonwastewaters from Dyes      70 FR 35032, 6/16/    3-11-.07(1); and
 and Pigments.                 05.                   391-3-11-.16.
Checklist 235, Disposal of    80 FR 21302, 4/17/15  391-3-11-.01(2) and
 Coal Combustion Residuals                           391-3-11-.07(1).
 from Electric Utilities.
Checklist 238,                82 FR 60894, 12/26/   391-3-11-.01(2); 391-
 Confidentiality               17.                   3-11-.03(4); 391-3-
 Determinations for                                  11-.07(1); and 391-
 Hazardous Waste Export and                          3-11-.08(1).
 Import Documents \2\.
Checklist 239, Hazardous      83 FR 420, 1/3/18...  391-3-11-.01(2); 391-
 Waste Electronic Manifest                           3-11-.08(1); 391-3-
 User Fee Rule \3\.                                  11-.09; and 391-3-
                                                     11-.10(1)-(3).
Checklist 240, Safe           83 FR 61552, 11/30/   391-3-11-.01(2); 391-
 Management of Recalled        18.                   3-11-.02(1); 391-3-
 Airbags.                                            11-.07(1); and 391-
                                                     3-11-.08(1).
Checklist 241, Management     84 FR 5816, 2/22/19.  391-3-11-.01(2); 391-
 Standards for Hazardous                             3-11-.07(1); 391-3-
 Waste Pharmaceuticals and                           11-.08(1); 391-3-11-
 Amendment to the P075                               .10(1)-(2); 391-3-
 Listing for Nicotine.                               11-.11(1)(a); 391-3-
                                                     11-.16; 391-3-11-
                                                     .18; and 391-3-11-
                                                     .19.
Checklist 242, Universal      84 FR 67202, 12/9/19  391-3-11-.01(2); 391-
 Waste Regulations: Addition                         3-11-.02(1); 391-3-
 of Aerosol Cans.                                    11-.07(1); 391-3-11-
                                                     .10(1)-(2); 391-3-
                                                     11-.11(1)(a); 391-3-
                                                     11-.16; and 391-3-
                                                     11-.18.
------------------------------------------------------------------------
Notes
\1\ The Georgia regulatory citations are from the Georgia Rules for
  Hazardous Waste Management, Ga. Comp. R. & Regs. r. 391-3-11, as
  amended through October 5, 2020.
\2\ Georgia has not adopted 40 CFR 260.2(b) and is not seeking
  authorization for this provision.
\3\ Georgia has not adopted 40 CFR 260.5 and is not seeking
  authorization for this provision.

VII. Where are the revised State rules different than the Federal
rules?

    When revised state rules differ from the Federal rules in the RCRA
state authorization process, the EPA determines whether the state rules
are equivalent to, more stringent than, or broader in scope than the
Federal program. Pursuant to RCRA section 3009, 42 U.S.C. 6929, state
programs may contain requirements that are more stringent than the
Federal regulations. Such more stringent requirements can be federally
authorized and, once authorized, become federally enforceable. Although
the statute does not prevent states from adopting regulations that are
broader in scope than the Federal program, states cannot receive
federal authorization for such regulations, and they are not federally
enforceable.
    There are no State requirements in the program revisions listed in
the table above that are considered to be more stringent or broader in
scope than the Federal requirements.
    The EPA cannot authorize states to implement certain Federal
requirements associated with the Confidentiality Determinations for
Hazardous Waste Export and Import Documents Rule (Checklist 238) and
the Hazardous Waste Electronic Manifest User Fee Rule (Checklist 239).
Georgia has adopted these requirements and appropriately preserved the
EPA's authority to implement them (see Ga. Comp. R. & Regs. r. 391-3-
11-.01(2)(c)).

VIII. Who handles permits after the authorization takes effect?

    When final authorization takes effect, Georgia will issue permits
for all the provisions for which it is authorized and will administer
the permits it issues. The EPA will continue to administer any RCRA
hazardous waste permits or portions of permits that the EPA issued
prior to the effective date of authorization until they expire or are
terminated. The EPA will not issue any new permits or new portions of
permits for the provisions listed in the table above after the
effective date of the final authorization. The EPA will continue to
implement and issue permits for HSWA requirements for which Georgia is
not yet authorized. The EPA has the authority to enforce State-issued
permits after the State is authorized.

IX. What is codification and is the EPA codifying Georgia's hazardous
waste program as authorized in this rule?

    Codification is the process of placing citations and references to
the State's statutes and regulations that comprise the State's
authorized hazardous waste program into the Code of Federal
Regulations. The EPA does this by adding those citations and references
to the authorized State rules in 40 CFR part 272. The EPA is not
codifying the authorization of Georgia's revisions at this time.
However, the EPA reserves the ability to amend 40 CFR part 272, subpart
L, for the authorization of Georgia's program changes at a later date.

X. Statutory and Executive Order Reviews

    The Office of Management and Budget (OMB) has exempted this action
from the requirements of Executive Order 12866 (58 FR 51735, October 4,
1993) and 13563 (76 FR 3821, January 21, 2011). This action authorizes
State requirements for the purpose of RCRA section 3006 and imposes no
additional requirements beyond those imposed by

State law. Therefore, this action is not subject to review by OMB. I
certify that this action will not have a significant economic impact on
a substantial number of small entities under the Regulatory Flexibility
Act (5 U.S.C. 601 et seq.). Because this action authorizes pre-existing
requirements under State law and does not impose any additional
enforceable duty beyond that required by State law, it does not contain
any unfunded mandate or significantly or uniquely affect small
governments, as described in the Unfunded Mandates Reform Act of 1995
(2 U.S.C. 1531-1538). For the same reason, this action also does not
significantly or uniquely affect the communities of tribal governments,
as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).
This action will not have substantial direct effects on the states, on
the relationship between the national government and the states, or on
the distribution of power and responsibilities among the various levels
of government, as specified in Executive Order 13132 (64 FR 43255,
August 10, 1999), because it merely authorizes State requirements as
part of the State RCRA hazardous waste program without altering the
relationship or the distribution of power and responsibilities
established by RCRA. This action also is not subject to Executive Order
13045 (62 FR 19885, April 23, 1997), because it is not economically
significant and it does not make decisions based on environmental
health or safety risks. This action is not subject to Executive Order
13211, ``Actions Concerning Regulations That Significantly Affect
Energy Supply, Distribution, or Use'' (66 FR 28355, May 22, 2001),
because it is not a significant regulatory action under Executive Order
12866.
    Under RCRA section 3006(b), the EPA grants a state's application
for authorization as long as the state meets the criteria required by
RCRA. It would thus be inconsistent with applicable law for the EPA,
when it reviews a state authorization application, to require the use
of any particular voluntary consensus standard in place of another
standard that otherwise satisfies the requirements of RCRA. Thus, the
requirements of section 12(d) of the National Technology Transfer and
Advancement Act of 1995 (15 U.S.C. 272 note) do not apply. As required
by section 3 of Executive Order 12988 (61 FR 4729, February 7, 1996),
in issuing this rule, the EPA has taken the necessary steps to
eliminate drafting errors and ambiguity, minimize potential litigation,
and provide a clear legal standard for affected conduct. The EPA has
complied with Executive Order 12630 (53 FR 8859, March 15, 1988), by
examining the takings implications of this action in accordance with
the ``Attorney General's Supplemental Guidelines for the Evaluation of
Risk and Avoidance of Unanticipated Takings'' issued under the
executive order. This action does not impose an information collection
burden under the provisions of the Paperwork Reduction Act of 1995 (44
U.S.C. 3501 et seq.). ``Burden'' is defined at 5 CFR 1320.3(b).
Executive Order 12898 (59 FR 7629, February 16, 1994), establishes
Federal executive policy on environmental justice. Its main provision
directs Federal agencies, to the greatest extent practicable and
permitted by law, to make environmental justice part of their mission
by identifying and addressing, as appropriate, disproportionately high
and adverse human health or environmental effects of their programs,
policies, and activities on minority populations and low-income
populations in the United States. Because this action authorizes pre-
existing State rules which are at least equivalent to, and no less
stringent than existing Federal requirements, and imposes no additional
requirements beyond those imposed by State law, and there are no
anticipated significant adverse human health or environmental effects,
this rule is not subject to Executive Order 12898.
    The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the
Small Business Regulatory Enforcement Fairness Act of 1996, generally
provides that before a rule may take effect, the agency promulgating
the rule must submit a rule report, which includes a copy of the rule,
to each House of the Congress and to the Comptroller General of the
United States. The EPA will submit a report containing this document
and other required information to the U.S. Senate, the U.S. House of
Representatives, and the Comptroller General of the United States prior
to publication in the Federal Register. A major rule cannot take effect
until 60 days after it is published in the Federal Register. This
action is not a ``major rule'' as defined by 5 U.S.C. 804(2). This
final action will be effective June 28, 2021.

List of Subjects in 40 CFR Part 271

    Environmental protection, Administrative practice and procedure,
Confidential business information, Hazardous waste, Hazardous waste
transportation, Intergovernmental relations, Penalties, Reporting and
recordkeeping requirements.

    Authority: This action is issued under the authority of sections
2002(a), 3006, and 7004(b) of the Solid Waste Disposal Act as
amended, 42 U.S.C. 6912(a), 6926, and 6974(b).

    Dated: April 20, 2021.
John Blevins,
Acting Regional Administrator, Region 4.
[FR Doc. 2021-08761 Filed 4-26-21; 8:45 am]
BILLING CODE 6560-50-P


[Federal Register Volume 85, Number 153 (Friday, August 7, 2020)]
[Notices]
[Pages 47960-47961]
[FR Doc No: 2020-17298]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. CP20-47-000]

PennEast Pipeline Company, LLC; Notice of Availability of the
Environmental Assessment for the Proposed Penneast 2020 Amendment
Project

    The staff of the Federal Energy Regulatory Commission (FERC or
Commission) has prepared an environmental assessment (EA) for the
PennEast 2020 Amendment Project, proposed by PennEast Pipeline Company,
LLC (PennEast) in the above-referenced docket. PennEast proposes to
amend its certificate of public convenience and necessity for the
PennEast Pipeline Project (Docket No. CP15-558-000) that was issued by
the Commission on January 19, 2018 and the PennEast Pipeline Project
Amendment (CP19-78-000) that was issued by the Commission on March 19,
2020. In the PennEast 2020 Amendment Project, PennEast requests
authorization to construct and operate the previously authorized
project in two phases, beginning with the facilities located in
Pennsylvania through approximately milepost (MP) 68.2 of the
certificated route. As part of Phase 1, PennEast proposes to include
new delivery points with Columbia Gas Transmission, LLC and Adelphia
Gateway, LLC at a new metering and regulating station (Church Road
Interconnects) in Northampton County, Pennsylvania. The Phase 1
facilities would deliver up to 650,000 dekatherms per day of firm
transportation service to the new delivery points. PennEast states it
will continue to work towards acquiring the New Jersey authorizations
for the Phase 2 facilities located in New Jersey.
    The EA assesses the potential environmental effects of the
construction and operation of the PennEast 2020 Amendment Project in
accordance with the requirements of the National Environmental Policy
Act (NEPA). The FERC staff concludes that approval of the proposed
amendment, with appropriate mitigating measures, would not constitute a
major federal action significantly affecting the quality of the human
environment.
    The U.S. Army Corps of Engineers (COE), U.S. Environmental
Protection Agency (EPA), and U.S. Department of Agriculture (USDA)--
Natural Resources Conservation Service (NRCS) participated as
cooperating agencies in the preparation of the EA. Cooperating agencies
have jurisdiction by law or special expertise with respect to resources
potentially affected by the proposal and participate in the NEPA
analysis. In addition to the lead and cooperating agencies, other
federal, state, and local agencies may use this EA in approving or
issuing permits for all or part of the PennEast 2020 Amendment Project.
    The proposed PennEast 2020 Amendment Project includes the following
facilities:
     New interconnection facilities in Bethlehem Township,
Northampton County, Pennsylvania (Church Road Interconnects),
including:
    [cir] A metering and regulation station, and a pig \1\ launcher and
receiver, at approximate at MP 68.2 of the certificated route; and
---------------------------------------------------------------------------

    \1\ A pipeline pig is a device used to clean or inspect the
pipeline. A pig launcher/receiver is an aboveground facility where
pigs are inserted or retrieved from the pipeline.
---------------------------------------------------------------------------

    [cir] two separate interconnection and measurement facilities;
     phasing of the certificated facilities, such that PennEast
would construct and operate the facilities--including the modifications
under the PennEast 2020 Amendment application--in two phases:
    [cir] Phase 1 would consist of construction of the certificated
route to approximate milepost 68.2, including two of the compressor
units at the Kidder Compressor Station in Carbon County, Pennsylvania,
as well as the new interconnection facilities in Northampton County,
Pennsylvania; and
    [cir] Phase 2 would consist of the remainder of the certificated
facilities from approximate MP 68.2 to MP 114 and would include the
third compressor unit at the Kidder Compressor Station. Proposed Phase
2 facilities are located in Northampton and Bucks Counties,
Pennsylvania, and Hunterdon and Mercer Counties, New Jersey.
    The Commission mailed a copy of the Notice of Availability to
federal, state, and local government representatives and agencies;
Native American tribes; potentially affected landowners; and other
interested individuals and groups

that filed comments on the project docket prior to issuance of the
notice. The EA is only available in electronic format. It may be viewed
and downloaded from the FERC's website (www.ferc.gov), on the natural
gas environmental documents page (https://www.ferc.gov/industries-data/natural-gas/environment/environmental-documents).
    In addition, the EA may be accessed by using the eLibrary link on
the FERC's website. Click on the eLibrary link (https://www.ferc.gov/ferc-online/elibrary/overview), select General Search and enter the
docket number in the Docket Number field, excluding the last three
digits (i.e. CP20-47). Be sure you have selected an appropriate date
range. For assistance, please contact FERC Online Support at
<EMAIL_ADDRESS>or toll free at<PHONE_NUMBER>, or for TTY,
contact<PHONE_NUMBER>.
    The EA is not a decision document. It presents Commission staff's
independent analysis of the environmental issues for the Commission to
consider when addressing the merits of issues raised in this
proceeding. Any person wishing to comment on the EA may do so. Your
comments should focus on the EA's disclosure and discussion of
potential environmental effects, reasonable alternatives, and measures
to avoid or lessen environmental impacts. The more specific your
comments, the more useful they would be. To ensure that the Commission
has the opportunity to consider your comments prior to making its
decision on this project, it is important that we receive your comments
in Washington, DC on or before 5:00 p.m. Eastern Time on September 2,
2020.
    For your convenience, there are three methods you can use to submit
your comments to the Commission. The Commission encourages electronic
filing of comments and has staff available to assist you at (866) 208-
3676 or<EMAIL_ADDRESS>Please carefully follow these
instructions so that your comments are properly recorded.
    (1) You can file your comments electronically using the eComment
feature on the Commission's website (www.ferc.gov) under the link to
FERC Online. This is an easy method for submitting brief, text-only
comments on a project;
    (2) You can also file your comments electronically using the
eFiling feature on the Commission's website (www.ferc.gov) under the
link to FERC Online. With eFiling, you can provide comments in a
variety of formats by attaching them as a file with your submission.
New eFiling users must first create an account by clicking on
eRegister. You must select the type of filing you are making. If you
are filing a comment on a particular project, please select Comment on
a Filing; or
    (3) You can file a paper copy of your comments by mailing them to
the following address using the U.S. Postal Service. Be sure to
reference the project docket number (CP20-47-000) with your submission:
Kimberly D. Bose, Secretary, Federal Energy Regulatory Commission, 888
First Street NE, Room 1A, Washington, DC 20426 NE, Room 1A, Washington,
DC 20426. Submissions sent through carriers other than the U.S. Postal
Service must be sent to 12225 Wilkins Avenue, Rockville, Maryland 20852
for processing.
    Filing environmental comments will not give you intervenor status,
but you do not need intervenor status to have your comments considered.
Only intervenors have the right to seek rehearing or judicial review of
the Commission's decision. At this point in this proceeding, the
timeframe for filing timely intervention requests has expired. Any
person seeking to become a party to the proceeding must file a motion
to intervene out-of-time pursuant to Rule 214(b)(3) and (d) of the
Commission's Rules of Practice and Procedures (18 CFR 385.214(b)(3) and
(d)) and show good cause why the time limitation should be waived.
Motions to intervene are more fully described at https://www.ferc.gov/ferc-online/ferc-online/how-guides.
    Additional information about the PennEast 2020 Amendment Project is
available from the Commission's Office of External Affairs, at (866)
208-FERC, or on the FERC website (www.ferc.gov) using eLibrary. The
eLibrary link also provides access to the texts of formal documents
issued by the Commission, such as orders, notices, and rulemakings.
    In addition, the Commission offers a free service called
eSubscription, which allows you to keep track of all formal issuances
and submittals in specific dockets. This can reduce the amount of time
you spend researching proceedings by automatically providing you with
notification of these filings, document summaries, and direct links to
the documents. Go to https://www.ferc.gov/ferc-online/overview to
register for eSubscription.

    Dated: August 3, 2020.
Kimberly D. Bose,
Secretary.
[FR Doc. 2020-17298 Filed 8-6-20; 8:45 am]
BILLING CODE 6717-01-P