SAFEGUARDS AND SECURITY

SURVEY AND SELF-ASSESSMENT

GUIDE

DOE G 470.1-1

![](media/image1.png){width="3.2069444444444444in"
height="3.1930555555555555in"}

U.S. Department of Energy

Office of Security Affairs

Office of Safeguards and Security

March 15, 1996

**SAFEGUARDS AND SECURITY SURVEY AND SELF-ASSESSMENT GUIDE**

**TABLE OF CONTENTS** [Page]{.underline}

CHAPTER I. INTRODUCTION TO SURVEYS AND SELF-ASSESSMENTS 1

A. PURPOSE AND OBJECTIVE 1

B. STRUCTURE AND USE OF THE GUIDE 1

C. DEFINITIONS 2

D. REFERENCES 3

CHAPTER II. BASIS FOR SURVEYS 4

A. REQUIREMENTS 4

B. PURPOSE AND SCOPE 4

C. RESPONSIBILITIES 4

CHAPTER III. FACILITY IMPORTANCE RATINGS 6

A. PURPOSE 6

B. CRITERIA 6

CHAPTER IV. TYPES OF SURVEYS 8

A. INITIAL 8

B. PERIODIC 8

C. SPECIAL 8

D. TERMINATION 8

CHAPTER V. SURVEY ACTIVITIES - INTRODUCTION 10

A. PLANNING 10

B. CONDUCT 10

C. POST-SURVEY ACTIVITIES 10

CHAPTER VI. PLANNING 11

A. SURVEY FREQUENCIES 11

B. SCHEDULING REQUIREMENTS 12

C. PURPOSE AND GOALS 12

D. TEAM STAFFING/SELECTION 12

E. PLANNING 14

F. ADMINISTRATIVE AND LOGISTICAL REQUIREMENTS 18

G. NOTIFICATIONS 18

CHAPTER VII. CONDUCT 20

A. SCOPE 20

B. IN-BRIEFING 20

C. DATA GATHERING 20

D. TEAM ACTIVITIES/INTERFACES 34

E. VALIDATION 35

F. OUT-BRIEFING 36

G. AGREEMENTS AND COMMITMENTS 37

H. CLASSIFICATION AND INFORMATION SECURITY 37

CHAPTER VIII. POST-SURVEY ACTIVITIES 38

A. INTRODUCTION 38

B. POST-SURVEY TEAM MEETING 38

C. DATA ANALYSIS 38

D. REPORT WRITING 45

E. SAFEGUARDS AND SECURITY INFORMATION MANAGEMENT SYSTEM (SSIMS) 52

F. RESOLUTION OF FINDINGS 53

G. TRACKING OF FINDINGS 54

H. ROOT-CAUSE ANALYSIS 56

I. COST-BENEFIT ANALYSIS 58

CHAPTER IX. SELF-ASSESSMENTS 59

ATTACHMENT 1 - SAMPLE SURVEY PLAN FORMAT 61

ATTACHMENT 2 - SAMPLE SURVEY REPORT FORMAT 63

ATTACHMENT 3 - REFERENCE LIST 65

ANNEX A - TOPICAL AREA SURVEY GUIDE: PROGRAM MANAGEMENT 70

I. INTRODUCTION 70

II\. PROGRAM MANAGEMENT AND ADMINISTRATION 70

III\. PROGRAM PLANNING 72

IV\. PERSONNEL DEVELOPMENT AND TRAINING 74

V. FACILITY APPROVAL AND REGISTRATION OF ACTIVITIES 75

VI\. FOREIGN OWNERSHIP, CONTROL OR INFLUENCE 78

VII\. SAFEGUARDS AND SECURITY PLANS 83

VIII\. SURVEYS AND SELF-ASSESSMENTS 84

IX\. RESOLUTION OF FINDINGS 85

X. INCIDENT REPORTING AND MANAGEMENT 86

ANNEX B - TOPICAL AREA SURVEY GUIDE: PROTECTION PROGRAM OPERATIONS 88

I. INTRODUCTION 88

II\. PHYSICAL SECURITY 89

III\. SECURITY SYSTEMS 91

IV\. PROTECTIVE FORCE 94

V. SECURITY BADGES, CREDENTIALS AND SHIELDS 98

VI\. TRANSPORTATION SECURITY 100

ANNEX C - TOPICAL AREA SURVEY GUIDE: INFORMATION SECURITY 102

I. INTRODUCTION 102

II\. CLASSIFICATION GUIDANCE 102

III\. CLASSIFIED MATTER PROTECTION AND CONTROL 103

IV\. SPECIAL ACCESS PROGRAMS & INTELLIGENCE INFORMATION 106

V. CLASSIFIED AUTOMATED INFORMATION SYSTEMS SECURITY 110

VI\. TECHNICAL SURVEILLANCE COUNTERMEASURES 116

VII\. OPERATIONS SECURITY 118

VIII\. UNCLASSIFIED AUTOMATED INFORMATION SYSTEMS SECURITY 120

IX\. PROTECTED DISTRIBUTION SYSTEMS 123

X. COMMUNICATIONS SECURITY (COMSEC) 125

ANNEX D - TOPICAL AREA SURVEY GUIDE: NUCLEAR MATERIALS CONTROL AND
ACCOUNTABILITY 128

I. INTRODUCTION 128

II\. BASIC REQUIREMENTS 130

III\. MATERIAL ACCOUNTABILITY 137

IV\. MATERIAL CONTROL 145

V. MC&A PERFORMANCE MEASURES 152

ANNEX E - TOPICAL AREA SURVEY GUIDE: PERSONNEL SECURITY 155

I. INTRODUCTION 155

II\. ACCESS AUTHORIZATION (PERSONNEL CLEARANCES) 155

III\. SECURITY EDUCATION BRIEFINGS AND AWARENESS 158

IV\. CONTROL OF VISITS 161

V. UNCLASSIFIED VISITS AND ASSIGNMENTS BY FOREIGN NATIONALS 164

VI\. PERSONNEL ASSURANCE PROGRAM 170

VII\. PERSONNEL SECURITY ASSURANCE PROGRAM 172

**CHAPTER I. INTRODUCTION TO SURVEYS AND SELF-ASSESSMENTS**

**A. PURPOSE AND OBJECTIVE**

This Guide is intended to provide a description of actions required in
planning and conducting safeguards and security surveys and related
activities. To the extent this Guide is implemented throughout DOE,
standardization of survey requirements will enhance the cost-effective
application of safeguards and security (S&S) requirements.

This Guide provides comprehensive guidance for all survey activities.
Although its primary focus is on surveys, the information provided may
also be readily applied to self-assessment program requirements. The
basis for this is described in Chapter IX. of this Guide.

The primary objective of this Guide is the accomplishment of
professional, comprehensive and site-specific, compliance and
performance-oriented surveys.

Three primary elements comprise a standard survey:

1\. Planning

Planning is crucial to the success of an survey. It includes the
identification of the facility and topical areas to be surveyed,
development of a survey plan, selection of survey team members, the
notification of the facility/organization to be surveyed and the request
for necessary documentation.

2\. Conduct

Conduct of the survey includes all on-site activities through the
completion of the compliance and performance evaluations. This includes
the in-briefing, the examination of the applicable topical and
subtopical areas for compliance and performance, the validation of
potential findings, the presentation of the out-briefing describing the
results of the survey and the drafting of report sections to support
each validated finding.

3\. Post-Survey Activities

Post-survey activities include the preparation of a final survey report,
the assignment of ratings to the topical and subtopical areas and the
overall composite rating for the surveyed facility, and the
accomplishment and tracking of corrective actions for the findings of
the survey.

**B. STRUCTURE AND USE OF THE GUIDE**

This Guide is essentially formatted as follows:

Survey Requirements

Types of Surveys

Planning

Conduct

Post-Survey Activities

Self-Assessments

Topical Area and Subtopical Area Survey Guides

This Guide supplements the requirements of DOE O 470.1, specifically
Chapters 9 and 10, and is intended to be used as a tool to standardize
the conduct of surveys. The Guide provides implementation guidelines and
suggested methods. Its use, however, is not mandatory, but discretionary
at all levels. It may also be modified to meet local requirements for
such modification. To facilitate such local implementation, a diskette
in IBM PS/2 DOS format will be provided with the initial distribution of
this Guide. Where the text in this Guide correlates with DOE directives
or other statutory requirements, care must be taken in local
implementation of the Guide, so as not to negate or obfuscate those
directives or requirements.

It is hoped that suggestions for enhancements to this Guide will be
provided to the Facility Survey and Approval Program Manager, Cathy A.
Tullis, Office of Safeguards and Security, telephone (301) 903-4805,
facsimile (301) 903-8717, and e-mail cathy.tullis@hq.doe.gov. Ms. Tullis
should also be contacted for assistance with questions or issues related
to this Guide.

The included topical and subtopical guides provide specific information
focused on each topic and subtopic. This information includes
performance measures which may be applied to the survey. The Safeguards
and Security Standards and Criteria should be applied as the standard
measure of compliance in each topical and subtopical area.

**C. DEFINITIONS**

The definitions for a few terms specifically used in this Guide are
provided below. The DOE Safeguards and Security Definitions Guide should
be consulted for further definition of these and other terms found in
this Guide.

FACILITY IMPORTANCE RATING

A method of grading the relative importance of a facility, in
relationship to other DOE facilities, and its importance to the security
and common defense of the United States.

LEAD RESPONSIBLE OFFICE

The Departmental Element that has primary safeguards and security
jurisdiction over a facility. It is responsible for ensuring surveys are
conducted in the facility. The following DOE Elements have been
identified by the Office of Safeguards and Security to function as
Responsible Offices: Albuquerque Operations Office, Chicago Operations
Office, Idaho Operations Office, Nevada Operations Office, Oak Ridge
Operations Office, Oakland Operations Office, Pittsburgh Naval Reactors,
Richland Operations Office, Rocky Flats Office, Savannah River
Operations Office, Schenectady Naval Reactors, Strategic Petroleum
Reserve Office and the Office of Safeguards and Security, Headquarters
Operations Division.

The Lead Responsible Office is the DOE organization with primary
responsibility for implementation and oversight of safeguards and
security requirements at a DOE facility, including approval of
safeguards and security plans and resolution of deficiencies other than
those specific to another DOE organization\'s security interests.

If there is more than one DOE organization with security interests at a
facility, the organization responsible for the programs involving the
highest level of security interest is normally the lead responsible
office. However, this responsibility may, by mutual agreement of the
offices involved, be accepted by an office which does not have the
highest level of security interest, but rather a greater scope of
interest, as with a long-term or traditional interest.

OTHER OFFICE WITH AN ESTABLISHED INTEREST

An office other than the Lead Responsible Office which has an
established interest or registered activity within a facility. Each such
office should maintain liaison with the Lead Responsible Office to the
extent necessary for assurance that their interests are adequately
protected.

PERFORMANCE TEST

A test to confirm the ability of an implemented and operating, critical
system element or total system to meet an established requirement.

SELF-ASSESSMENT

An evaluation, conducted by the facility\'s staff, of the effectiveness
of an activity or a determination of the extent of compliance with, and
performance to, required procedures and practices. Self-assessments
utilize internal inspections, reviews and/or audits to provide a
facility with internal monitoring of safeguards and security programs
and interests to assure ongoing compliance with safeguards and security
requirements.

SURVEY

An examination of the devices, equipment, personnel, and procedures
employed at a facility to safeguard information, selected nuclear
material, and property of significant monetary value by an authorized
representative of a responsible Departmental Element.

SURVEYING OFFICE

The Departmental Element, designated by the Lead Responsible Office,
which has responsibility for conducting surveys of a facility and
registered activities. The following DOE Elements have been identified
by the Office of Safeguards and Security to function as Surveying
Offices: Albuquerque Operations Office, Chicago Operations Office, Idaho
Operations Office, Nevada Operations Office, Oak Ridge Operations
Office, Oakland Operations Office, Pittsburgh Naval Reactors, Richland
Operations Office, Rocky Flats Office, Savannah River Operations Office,
Schenectady Naval Reactors, Strategic Petroleum Reserve Office and the
Office of Safeguards and Security, Headquarters Operations Division.

The DOE safeguards and security organization has responsibility for
conducting safeguards and security surveys of DOE and DOE-contractor
facilities.

**D. REFERENCES**

A comprehensive listing of references is provided in Attachment 3.
References found in this Guide will, to the extent feasible, use the
item number on this Reference List.

**CHAPTER II. BASIS FOR SURVEYS**

**A. REQUIREMENTS**

Executive Order 12958, the National Industrial Security Program
Operating Manual, and DOE O 470.1 require surveys and self-assessments
to be conducted in DOE and DOE-contractor facilities.

**B. PURPOSE AND SCOPE**

The purpose of the facility survey is to evaluate the adequa­cy and
effectiveness of safeguards and security programs and the protection
afforded DOE safeguards and security interests. Surveys cover the
protection afforded DOE safeguards and security activities at a
facility, including an evaluation of the adequacy and effectiveness of
material control and accountability (MC&A) and security programs, to
include a thorough examination of policies and procedures to ensure
compliance/performance with appropriate safeguards and security
directives and agreements. All facilities are subject to the compliance
and per­formance segments of surveys.

The scope of surveys will include those programs/measures designed to
prevent acts of radiological/toxicological sabotage that would cause
unacceptable impact to national security or pose significant dangers to
the health and safety of employees, the public, or the environment,
and/or mitigate the consequences of such acts.

New initiatives are evolving to require safeguards and security surveys
to be integrated with other oversight activities into single visits to
DOE laboratories, reducing the number of inspection-type activities they
must contend with. All efforts should be made to coordinate survey
activities to meet these requirements while ensuring that the objectives
of the safeguards and security survey program are met.

**C. RESPONSIBILITIES**

DOE designates Headquarters and Field Elements as Responsible and
Surveying Offices to ensure oversight of its activities. Such
designation is based on each element\'s demonstrated ability to provide
adequate resources to assure such oversight. These resources include
adequate numbers of safeguards and security staff, trained and
knowledgeable in all applicable disciplines, including the conduct of
surveys and inspections; enough staff in support services, contracts,
etc., to assure timely accomplishment of required tasks; establishment
of a Safeguards and Security Information Management System (SSIMS)
terminal and staff trained to use it; and adequate funding for all
aspects of oversight, including inspections and surveys. Upon
determination by the Office of Safeguards and Security that these
assurances are met, the element is advised by memorandum of its
designation and added to the lists of Responsible and Surveying Offices
maintained in the SSIMS.

1\. LEAD RESPONSIBLE OFFICE

The DOE Operations Office with primary responsibility for oversight of a
given facility is considered the Lead Responsible Office. This office
has the responsibility for the registration of the facility to house DOE
safeguards and security interests and to conduct safeguards and security
activities on behalf of the DOE.

2\. SURVEYING OFFICE

The DOE Operations Office conducting surveys of a facility on behalf of
the Lead Responsible Office is considered the Surveying Office. This is
typically based on geographic proximity or collocated interests or
facilities where the surveying office can most cost-effectively
accomplish the survey for the Lead Responsible Office.

To ensure that the survey will meet the requirements of the Lead
Responsible Office, it is important that the Surveying Office have good
communications with them, know their standards and obtain facility and
scheduling information from them in a timely manner.

3\. OTHER OFFICE WITH AN ESTABLISHED INTEREST

As discussed under the definition of Lead Responsible Office, above,
offices other than the Lead Responsible Office may have established
interests or registered activities within a facility. Each such office
should maintain liaison with the Lead Responsible Office to the extent
necessary for assurance that their interests are adequately protected.

**CHAPTER III. FACILITY IMPORTANCE RATINGS**

**A. PURPOSE**

Importance ratings provide a means of identifying relative importance of
facilities and activities. Importance ratings assigned to activities
cannot exceed the importance rating of the facility housing them.

**B. CRITERIA**

1\. [\"A\"]{.underline} importance ratings are assigned to those
activities and facilities that meet any of the following criteria:

a\. determined by Heads of Headquarters Elements or Field Offices, to
include engagement in administrative activities considered essential to
the direction and continuity of the overall DOE nuclear weapons program;

b\. authorized to possess Top Secret matter; or

c\. authorized to possess Category I quantities of special nuclear
material(s) (SNM).

2\. [\"B\"]{.underline} importance ratings are assigned to those
activities and facilities that meet any of the following criteria:

a\. engaged in activities other than those categorized as \"A\" which
are authorized to possess Secret Restricted Data or weapon data matter;

b\. have been designated a Field Intelligence Element (FIE); or

c\. authorized to possess Category II quantities of SNM;

3\. [\"C\"]{.underline} importance ratings are assigned to those
activities and facilities that meet any of the following criteria:

a\. authorized to possess Categories III and IV quantities of SNM or
other nuclear materials requiring safeguards controls or special
accounting procedures; or

b\. authorized to possess classified matter other than the type
categorized for \"A\" and \"B\" facilities.

4\. [\"D\"]{.underline} importance ratings are assigned to those
activities and facilities that provide common carrier, commercial
carrier or mail service and the facility is not authorized to store
classified matter or nuclear material during non-working hours. Carriers
who store classified matter or nuclear material must be assigned an
\"A\", \"B\" or \"C\" importance rating.

5\. [\"E\"]{.underline} (Excluded Parent); a corporate tier parent of a
contractor organization, which has been barred from participation in the
activities related to a contract with the Department of Energy.

6\. [\"PP\"]{.underline} (Property Protection) importance ratings are
assigned to those facilities for which a special standard of protection
must be applied when significant monetary value ([\>]{.underline}
\$5,000,000), nuclear materials requiring safeguards controls or special
accounting procedures other than the type categorized as \"A\", \"B\",
\"C\", DOE program continuity, national security considerations, or
protection of the public health and safety constitutes an important DOE
responsibility. Basic considerations include physical protection to
prevent or deter acts of arson, civil disorders, riots, sabotage,
terrorism, vandalism, and theft or destruction of DOE property and
facilities.

7\. [\"NP\"]{.underline} (Non-Possessing) importance ratings are
assigned to facilities which have access authorizations in order to
access classified information or special nuclear materials at other
approved locations. Non‑possessing facilities do not, themselves,
possess any classified matter or SNM.

**CHAPTER IV. TYPES OF SURVEYS**

**A. INITIAL**

A comprehensive survey conducted at the facility before granting
approval of the safeguards and security interest. A satisfactory initial
survey establishes the eligibility of the facility and results in the
completion of the Facility Data Approval Record (FDAR). To ensure the
establishment and implementation of appropriate protective measures,
special emphasis should be placed on documentation and on the
performance testing of staff to ensure procedures have been implemented
and understood.

**B. PERIODIC**

A comprehensive survey conducted at the facility at scheduled intervals.
The periodic survey is used as the basis for the continued eligibility
of the facility for the approved safeguards and security interests and
activities. The periodic survey examines ongoing compliance and
performance. It is similar to an initial survey. More
extensive/sophisticated performance testing may, however, be
appropriate, due to the longer period for skills development relative to
the staff evaluated during a typical initial survey.

**C. SPECIAL**

A survey conducted at a facility and/or activity for a specific purpose,
such as for technical security reason, a review of a security system, an
unannounced survey, a detailed review of a problem area, a \'for-cause\'
review, shipment of nuclear materials or classified material, or change
in the contractor operating a government-owned facility. Shipments
between sites by rail, truck, air, or ship are subject to survey unless
the shipment is made via a commercial carrier(s) licensed by the Nuclear
Regulatory Commission (NRC).

A special survey may be predicated on a new security interest or
significant configuration change, the need to review or validate
corrective actions, or other special, out of cycle survey requirement.
These would typically relate to specific S&S interests and would,
therefore, likely be more limited in scope than an initial or periodic
survey. Special surveys may be announced or unannounced.

Shipment surveys, which are one form of special survey, provide a basis
for evaluating the adequacy of protection afforded DOE classified matter
or SNM during shipment. Shipments which move between sites by rail,
truck, air, or ship are subject to survey based on an approved security
plan unless the shipment is made via a commercial carrier(s) licensed by
the NRC. Movements of SNM between security areas at the same site should
be surveyed during the security survey of the site protection system.
Each type of security shipment must be surveyed initially and at least
once every 12 months thereafter by the organization having
administrative jurisdiction over the shipment. Shipment survey reports
must provide sufficient detail to assure adequate survey coverage and
provide an explanation of all findings.

**D. TERMINATION**

A survey conducted of the facility when all safeguards and security
interests have been removed, to assure proper disposition has been made
of nuclear material and/or classified matter, and close-out of required
records has been accomplished. Termination surveys evaluate the actions
taken to ensure termination of safeguards and security interests,
execution of an appropriate security termination statement, and
submission of a certificate of possession or nonpossession, as
appropriate. Termination of facility approvals for Class \"A\"
facilities and facilities possessing classified matter and/or SNM
requires an on-site termination survey. For other facilities,
termination may be by on-site survey or correspondence. The on-site
survey or correspondence will assure the classified matter or nuclear
materials have been appropriately transferred before terminating the
facility approval.

**CHAPTER V. SURVEY ACTIVITIES - INTRODUCTION**

The survey activities associated with each surveyed facility may be
broken down into three phases: Planning, Conduct and Post-Survey
Activities.

**A. PLANNING**

Planning consists of the scheduling and planning involved in identifying
facilities to be surveyed and establishing all the necessary staff and
other requirements to ensure the accomplishment of an effective survey
at each facility.

Scheduling entails the identification of facilities to be surveyed,
allocation of resources to plan and conduct the surveys, the
determination of the interval between surveys and the advanced
scheduling of the survey to ensure resources can be available and the
survey conducted within the required interval.

Planning includes all preparations for the survey, to include the
determination of the scope of the survey, the dates the survey will be
conducted, the establishment of a survey team, notifications and
coordinations with the surveyed facility and determination of
performance measures to be applied to the survey.

**B. CONDUCT**

The conduct of the survey includes facility in-briefing and all of the
activities involving the collection and analysis of information in the
topical and subtopical areas being surveyed. This includes the ongoing
validation of findings between survey team members and their
counterpart(s) in the facility and the final validation and out-briefing
of the survey results with facility management.

**C. POST-SURVEY ACTIVITIES**

Post-survey activities include the compilation of the findings and other
narrative material into the writing of a report for the survey, the
distribution of the report, the establishment of corrective action plans
and the tracking of corrective actions for findings.

**CHAPTER VI. PLANNING**

**A. SURVEY FREQUENCIES**

1\. Facilities possessing classified matter or nuclear material shall be
surveyed once every 12 months.

2, Approved facilities which do not possess classified matter or nuclear
material shall be surveyed at least once every 24 months.

3\. For facilities containing only Category IV materials or other
nuclear materials, as defined in DOE 5633.3B, requiring safeguards
controls or special accounting procedures, the MC&A topical area shall
be surveyed at least once every 24 months. If the total inventory
consists entirely of source material, less than 10 tons of heavy water,
less than 350 grams of SNM, or any combination of these, a survey of the
MC&A topical area is not required.

4\. The results of prior surveys may affect the scheduling frequency. At
the discretion of the Surveying Office, after consultation with the Lead
Responsible Office, the interval for the survey may be increased. The
Lead Responsible Office will document any such extended survey schedule
to the Office of Safeguards and Security and each DOE element with an
established interest in the affected facility. An extended survey
schedule (up to 24 months) may be implemented, by the Surveying Office,
if the facility has:

a\. A facility security staff trained and knowledgeable of DOE
safeguards and security requirements, as evidenced by past performance
in DOE surveys;

b\. An ongoing, periodic self-assessment program covering all survey
topics and subtopics, with the results reported to DOE;

c\. No significant deficiencies (including no less than satisfactory
rating at the topic level) resulting from DOE surveys or facility
self-assessments; and

d\. An approved site safeguards and security plan (SSSP) or Site
Security Plan (SSP), as appropriate.

Extended schedules may also be implemented for facilities with Category
I Special Nuclear Material if all of the above conditions have been met
and with the prior approval the Office of Safeguards and Security.

5\. Reviews, including inspections, conducted by Departmental Elements
or other Government oversight offices may be used to meet survey
requirements. Topics and subtopics on DOE F 5634.1 which are not
addressed during reviews must be surveyed by the Surveying Office. When
using reviews to meet the requirements of the survey, the following
guidelines shall be followed:

a\. The review must have been conducted within the last 6 months.

b\. Portions of the review that are utilized must be attached to the
survey.

c\. Those topics and subtopics not covered by the review must be
surveyed.

d\. Ratings must be assigned for those reviews that are used. After the
review is conducted the Surveying Office analyzes the impact of any
deficiencies and assigns ratings.

6\. Special surveys, defined in Chapter IV, C., shall be conducted as
determined by the Lead Responsible Office.

**B. SCHEDULING REQUIREMENTS**

Scheduling should be performed on an annual basis to ensure that
facilities will be surveyed within the intervals prescribed above.
Schedules should also be monitored, at least quarterly, to ensure
scheduling and planning activities commence at the appropriate time.
Scheduling should, in as timely a manner as possible, also identify an
individual to be assigned team leader responsibilities for each survey
and provide some means of timely notification of each designated team
leader of their assignments and scheduled survey dates.

**C. PURPOSE AND GOALS**

Scheduling and planning should provide a tool for the identification of
facilities to be surveyed and a means to distribute the surveys over
time to facilitate the reasonable allocation of staff and other
resources for the accomplishment of the surveys while also meeting
required frequencies for each survey.

**D. TEAM STAFFING/SELECTION**

[Team Leader]{.underline}

The first step in planning a survey should be the selection of a team
leader for the survey. The team leader will ultimately be responsible
for the successful completion of all phases of the survey. The selection
of the right person to fulfill this role is most critical. Generally,
this person should have a well rounded understanding of safeguards and
security programs and how the various topical areas interface and
interrelate, as well as specific, detailed knowledge in one or more of
the topical areas to be surveyed.

Team leaders must possess specific skills, attributes, and qualities in
order to be effective. Experience, or expertise, has already been
mentioned; but others include the following:

Ability to influence people toward a common goal

Ability to plan and utilize resources within fiscal and logistical
constraints

Integrity

Loyalty to team members and management

Objectivity and fairness

Courage to make the hard choices

Ability to resolve conflicts

Acceptance of the differences in people and their varying levels of
interests, values, skills and abilities.

[Team Member Selection/Responsibilities]{.underline}

Equally as important as the leader are the multi-disciplined safeguards
and security professionals (both federal and contractor) that comprise
the rest of the survey team.

The selection of team members for a survey may predetermine the success
or failure of that survey. It is very important to find mature,
technically qualified people who will conduct themselves in a
professional and courteous manner. It is also extremely helpful if these
people can also establish an \'investigative mindset\' for their survey
activities. This mindset will provide the basis for their inquiries into
areas not specifically identified in survey plans or guides.

The following items should be weighed in choosing survey team members:

Qualifications: Does the individual possess the knowledge and have the
experience (to include a specific DOE background) in order to
comprehensively inspect and evaluate compliance and performance in the
topical area(s) to which they are being assigned? Is the person credible
from a credentials standpoint?

Technical competence: Has the individual displayed a level of expertise
commensurate with being able to accurately analyze and evaluate issues
and situations involving their assigned topical area(s)?

Survey training and experience: Does the individual have prior DOE
survey experience or recognized Central Training Academy training in the
conduct of surveys?

Investigative Mindset: Has the individual had prior experience or
displayed an ability to collect facts, collate and correlate them, and
arrive at defensible conclusions? Is the individual objective (leaving
personal biases out of the process)?

Maturity: Is the person dependable? Does the individual remain calm
under stress or in conflict situations? Do they act on thought or
emotion?

Professionalism: Does the person display, by his or her actions, an
appreciation for the accepted norms of dress, appearance and behavior
associated with a safeguards and security professional? Is their
approach to findings one objectivity with, or one of intimidation of,
the staff being surveyed?

People Skills: How well does the person interact with others? Is the
person survey centered or self-centered? Is the person a team player?
Does the person respect the dignity of others? Can the individual deal
with people as well as issues?

Communicative Skills (Verbal and Written): How articulate? How accurate?
How concise? If asked, can the person brief relative to their topical
area? Can they adequately prepare draft report material?

[Team Composition/Dynamics]{.underline}

The survey team leader is the focal point for the conduct of a survey.
He or she will be responsible for the success of the survey. The team
leader, therefore, should carefully choose team members and ensure that
each of the team members clearly understands his or her assignments and
responsibilities. Where more than one team member will be conducting the
survey in an assigned topical or subtopical area, the team leader should
ensure that these team members can work well together and attempt to
match complementary skills to maximum advantage. Team staffing should
attempt to staff each area at the appropriate level and to equalize the
survey work load as much as possible. It can be frustrating for all
involved to have some team members working very hard and others sitting
around with seemingly little to do.

The Survey Team Leader provides necessary oversight and manage­ment to
ensure that the survey is conducted in a thorough, professional, and
timely manner. To that end, the leader should specify his or her
expectations regarding planning, conduct, and post-survey time lines and
deliverables as well as establish clearly delineated procedures and
parameters for inspection protocol issues while the team is on site.
Typical examples include:

Lines of communication/interface: Ensuring that team members work
through their topical area points-of-contact and that information
regarding survey results (findings/suggestions/ratings) is only
disseminated in accordance with pre-established procedure(s).

Adherence to local requirements: These should be made clear to all team
members and, for the sake of setting a professional and proper example,
should be followed explicitly.

Team meetings: Routines (times/place/rules for discussion) should be
established and followed. Emphasis should be placed on sharing
information that may impact upon multiple topical areas.

In- and out-briefings: Which team members should attend and specific
taskings for same (if any) should be clearly defined.

While this discussion regarding team selection and staffing (to include
those specifics pertaining to ethics and conduct) may appear to some as
stating the obvious, their importance cannot be overemphasized. As a
team, those persons selected to participate in a survey effort carry
with them the reputation and credibility of the program each time they
go out. How the team performs, both in terms of expertise and character,
will have a profound effect on the continuing viability of this effort
and on the safeguards and security profession as a whole.

**E. PLANNING**

Planning is crucial to the success of a survey. It includes the
identification of the facility and topical areas to be surveyed,
development of a survey plan, selection of survey team members and the
notification of the facility/organization to be surveyed. Planning for
the survey will entail consideration of the following:

. Facility identification

. Nature of the safeguards and security interest(s):

Nuclear Weapons and Components

Special Nuclear Materials (SNM)

Classified Matter

Classified Automated Information System(s)

DOE Property

. Nature of the safeguards and security activities:

Special Access Programs (SAPs)

Intelligence Work

Foreign Government Information (FGI)

Other agency work to be reviewed by DOE

. Facility location

. Type of survey

. Team personnel, technical support, and other staffing requirements

. Pre-survey data collection from facility files

Facility registration/SSIMS

Safeguards and/or security plans

Self-Assessment Documentation and Reports

Vulnerability Assessments

Reports and Trends Analyses for Findings from the Office of Security
Evaluations and Surveying Offices

. Results of Previous Survey(s)

Facility description

Security interests surveyed

Findings/Suggestions

Corrective Action Plans

Resolution of Previous Findings

Lessons Learned

1\. INITIAL PLANNING

The pre-survey planning sets the direction for the entire survey.
Schedules, topical area assignments, data collection activities, and
resources are all determined during initial planning. Performance test
pre-planning and decision making for Limited Scope Performance Tests or
Force-on-Force exercises take a significant amount of time during the
initial plan­ning for the survey.

The survey plan should be developed during initial planning. The survey
plan provides a comprehensive outline of the survey and the topical area
focus. The Survey Team Leader is ultimately responsible for determining
which performance tests are to be conducted and the priority of data
gathering activities. Performance tests and data collection activities
should be included as appendices to the survey plan. The decisions made
during the initial planning will flow down to the facili­ty in-briefing.

Some of the essential elements which need to be known for planning the
survey include the type of survey to be conducted, the facility and its
mission, the safeguards and security interests and how they are
protected, and the classification level of the work and matter in the
facility. This information may be obtained through contracts and
procurement records and facility registration information. Past survey
reports, with their description of the facility and past findings, are
certainly key sources of planning information. The Safeguards and
Security Information Management System (SSIMS) provides a compilation of
much information valuable to the survey planning activity. Security
plans, especially the comprehensive Site Safeguards and Security Plan,
with its facility description, vulnerability assessments and other
elements, are also good sources of information. Self-assessment results
reported by the facility may give indications of activities occurring at
the facility since the last survey.

2\. SURVEY TEAM PLANNING MEETING

This meeting brings the complete survey team together to discuss the
survey scope and methodology and planning for survey activities. Inputs
and recommendations may be made regarding the facility in-briefing and
any concerns or areas of special interest that may need to be addressed.
Facility files may be reviewed on a topical/subtopical basis by those
assigned each of the specific topics/subtopics. Any requirements for
documentation should be identified. Each topical and subtopical lead
inspector should provide a plan for the survey of their area to the team
leader for concurrence. This plan will also identify performance test
plans, where applicable.

3\. COORDINATION AND TOPIC INTEGRATION

Safeguards and security surveys should be conducted in an integrated
manner or by means of separate evaluation activities. When performed
separately, the Surveying Office must outline the responsibility for
each survey activity and coordinate a single survey report submission
that includes a composite facility rating.

Safeguards and security surveys conducted separately must be completed
within a 30 working-day period following the closeout of the first
survey activity.

4\. COMPLIANCE VERSUS PERFORMANCE

DOE requires that various safeguards and security functions be performed
to achieve stipulated levels of protection. But, DOE policy often does
not specify HOW such safeguards and security functions or levels of
protection are to be achieved. While it is necessary for all DOE
facilities to comply with Departmental policies and directives, failure
to meet the letter of a directive does not necessarily indicate a
substandard or ineffective program, if alternate means are in place that
provide adequate protection. Conversely, full compliance with DOE policy
does not in and of itself ensure a viable protection program.

Compliance: The compliance segment of the survey addresses how well the
facility meets requirements contained in DOE directives and the
applicable facility Secu­rity Plan and/or Site Safeguards and Security
Plan (SSSP).

Performance: Surveys of facilities include performance evalua­tions to
assess the capability of the safeguards and security system to meet
performance objec­tives. The performance evaluations determine system
performance against scenarios for appli­cable threats/targets.

5\. REVIEW OF FINDINGS AND CORRECTIVE ACTION PLANS

All previous findings, regardless of their status (open or closed),
should be reviewed during the planning for the survey. These findings,
even though corrected and closed, may indicate areas where the facility
has historically had problems with compliance and performance. Although
the findings of the last survey will be of primary interest, findings of
prior surveys or of other inspections may also be of interest and value.

Documented survey findings must have been monitored until suitably
resolved. Quarterly reporting on unresolved findings of previous survey
activities will be reviewed. The current state of the Safeguards and
Security Program at the time of this survey may be used to validate the
status of previous findings, if appropriate. Findings of this survey
which correlate with findings of the previous survey will be identified
as Repeat Findings, regardless of their status prior to this survey.

Concerns about open or repeat findings or the inability to establish and
implement effective corrective action plans should be discussed with
those team members surveying the Program Management topical area for
potential impacts on their survey activities and scope/focus.

6\. SURVEY PLAN

The survey plan provides the basis for determining the scope and
methodologies to be applied to the survey. It should be formally
documented and retained on file as part of the documentation for the
survey. It provides the basis for the information to be provided in the
notification letter to the surveyed facility. It also provides an agenda
for the accomplishment of the survey and related activities.

A good survey plan provides a systematic method for handling assignments
and promotes organizational effectiveness in attending to survey
requirements. The goals and objec­tives identified in the survey plan are
the specific targets that the survey team must achieve to complete a
comprehensive survey. These target objectives define the survey goals
and provide the day-to-day direction for each topical area team.

The Survey Plan objectives must be clearly defined in terms of both
personnel and tasks. The more specific and realistic the objectives, the
easier it is for survey team members to understand what must be
accomplished and when it should be completed. The plan should, however,
provide sufficient latitude to accommodate contingencies that may
develop during the survey.

The survey plan, by identifying areas to be surveyed, is also used to
determine the resources needed to accomplish the survey. It is used to
determine the number and qualifications of team members and support
personnel needed.

The survey plan format is not critical. It should, however, contain
enough information to describe the who, what, when, where, why, and how
of the survey. A typical survey plan format is provided in Attachment 1.

7\. LIMITED SCOPE PERFORMANCE TESTS

Surveys, and especially self-assessments, are typically conducted with
limited time and resources. It is difficult, under these conditions, to
comprehensively test all aspects of a program or program element. This
is especially true for large protection elements or where the use of
large numbers of personnel would be required. By limiting the focus or
scope of the evaluation to smaller aspects of the overall program
element or testing the skills and/or knowledge of a small sample of the
personnel responsible for the element, a reasonably clear idea of the
health of the entire program can be obtained without consuming large
amounts of time and resources.

If suitable procedures have been implemented for a program element and
staff suitably trained on those procedures, these will be apparent in
the limited scope performance test (LSPT) results. In situations where
these results indicate a lack of procedures, training, skills or other
required program element, the LSPT may provide insight into the cause
for the deficiency or otherwise point to another element that requires
further evaluation.

In order to be effective and to provide the desired, essential
indication of the overall program effectiveness, LSPTs must be clearly
defined and planned in advance of the survey activity. The basis, scope
and method for each LSPT must be documented and established in the
Survey Plan. These test plans should be approved by the Team Leader.
Other approvals may also be required, especially if safety concerns are
involved.

LSPTs and other aspects of performance testing are further discussed in
Chapter VII. C. 5., Performance Tests.

8\. WORKING PAPERS

Working papers are notes, checklists and other documentation accumulated
during the actual accomplishment of a survey. Their retention as part of
the permanent survey report file may be essential, especially for any
findings or observations not fully documented in the final report.
Survey working papers may be used to support the validity of findings
and to provide a source of information for future surveys. These papers
can also be used for such things as reviewing the survey process,
itself, by examination of checklists, plans and other documentation of
the survey. For these reasons, all working papers should be compiled and
annotated with the title of their respective subtopical areas.
Additional markings based on classification or directions from the Team
Leader will also be affixed. At the end of the survey, all working
papers should be turned over to the Team Leader for retention, generally
at least until completion of the next survey at the facility.

Each team member must understand his or her responsibility for keeping
accurate notes and copies of documentation supporting the results of
their survey activities. These will be retained at the end of the
survey.

**F. ADMINISTRATIVE AND LOGISTICAL REQUIREMENTS**

Planning for administrative and logistical requirements is essential to
the successful accomplishment of a survey or self-assessment. Adequate
space, furnishings, office equipment, supplies and staff to support the
survey team and ensure the timely compilation of the draft survey report
are essential. The team leader must ensure that administrative and
logistical requirements are included in the planning for the survey.
Follow-up may also be required to ensure all of these requirements are
met in time for their use by the survey team.

**G. NOTIFICATIONS**

Survey notification should be provided to the appropriate DOE program
office and to the facility to be surveyed at least thirty (30) days in
advance. The initial communication may be by telephone and should be
followed by written notice which includes the agenda and pre-survey
questionnaire.

Although informal coordinations with the surveyed facility, to determine
appropriate dates to schedule the survey and other information, may have
already occurred, the facility will be formally advised of the planned
survey by means of a formal notification letter. This letter will
establish the type and scope of the survey, the survey dates, proposed
agenda for the conduct of the survey, any requirements related to
in-briefing requirements, a request for any pre-survey materials or
information that may be needed, any available information about the team
and a request for the facility to identify point(s) of contact for
coordination of the survey. A schedule of any pre-survey visits might
also be included.

A Pre-survey Questionnaire may be used in order collect information to
be used in the conduct of the survey. This information is needed in
order to plan and conduct an in-depth survey, but may not be readily
available to the survey team. The questionnaire will provide needed
administrative and operational details which will aid the team. The
questionnaire should accompany the notification letter. The
questionnaire should be completed by the facility, in accordance with
instructions provided, and be available to the Surveying Office at least
three working days prior to the first day of the survey.

Pre-survey visits may be needed to accommodate special logistical or
other requirements of the team or the facility. These visits may also
provide an opportunity for the team leader and the facility point of
contact to discuss the survey scope, philosophy and/or methodology;
coordinate proposed performance testing; and to ensure adequate office
space and support have been planned for the team.

1\. DOCUMENT REQUESTS (aka: \'DATA CALL\')

The notification letter may provide the opportunity to advise the
facility to be surveyed of the documentation that the survey team will
need to review. The request for these should clearly identify those to
be on hand during the survey and those which the facility is expected to
provide prior to the actual on-site survey.

2\. IDENTIFY POINTS OF CONTACT

The notification letter may include a questionnaire or other means of
establishing preliminary baseline information required by the survey
team. The facility to be surveyed should also be asked to provide one or
more points of contact for each topical/subtopical area, as well as the
management staff who will be responsible for interfacing with the survey
team leadership.

3\. SCHEDULE, SCOPE AND OTHER SUPPORT

The scheduled dates for the survey and any other refinement of scope and
scheduling applicable to the areas to be surveyed should be established
in the notification letter.

**CHAPTER VII. CONDUCT**

Throughout the conduct of the survey, each team member must be
responsible for presenting a professional and impartial demeanor. This
starts with appropriate attire and hygiene and includes courtesy towards
facility staff with which they must interact. Bearing and demeanor are
important. Team members must look motivated to do a good job but not
appear overly zealous. Their integrity and the integrity of the survey
should be among the motivations for each team member\'s activities.

Each team member must establish an investigative mindset for the survey.
The ability to look beyond the response of an interviewee or apparent
piece of the puzzle is important. This ability will also serve the team
member well in separating facts from presumptions. The team members\'
inquiries should be thorough but fair. This fairness should help to
alleviate the feeling of fear or harassment some facility staff
occasionally feel during a survey.

**A. SCOPE**

The scope of the survey must be one of the initial planning steps for
the survey. The clear identification of the scope of the survey is
essential to all other planning for staff and other resources. The scope
of a survey should normally include all the applicable topical and
subtopical areas, as identified on DOE Form 5634.1 and described in this
Guide. The scope of the survey should be clearly defined, both for the
members of the survey team and for the staff of the surveyed facility.
The documentation for the survey should contain the basis for any
limiting of the scope of the survey.

**B. IN-BRIEFING**

The Team Leader must have a prepared agenda identifying what will be
discussed and in what order and identifying persons making
presentations. All briefings should be documented to facilitate
post-briefing notes and a roster of attendees should be taken at each
briefing. All briefings should close on a positive note.

The Survey Team Leader should use the facility in-briefing to maximum
advantage, by making a good first impression. Professionalism and
preparedness at this briefing are essential for getting the survey off
to a good start. Topic areas to be covered during the facility
in-briefing include (but are not limited to):

General Introduction

Local DOE Operations Office

Survey Overview Briefing

Survey Schedule

Topical Areas to be Surveyed

Introduction of Survey Team Members

Facility/Site Briefing (facility point-of-contact)

Introduction of All Facility Points-of-Contact

Daily Survey Status Meetings

Conduct of Performance Tests/Table Top Reviews

Provisions for Schedule Changes or Additional Support

Out-briefing Arrangements

**C. DATA GATHERING**

Data collection activities are the essence of the survey process. The
data collection methods and techniques that are chosen, and the skill
with which they are used, will determine the quality and quantity of the
information collected. Standard data collection methodologies in­clude:
document reviews, personnel interviews, direct observation of
operations, and performance-based and knowledge-based testing.

Each method has a purpose and a cost (both to survey team and facility)
associated with it. Therefore, you need to know when and where to use
each method. For example, you would not want to run a costly
force-on-force performance test if you can get the data you need through
an interview or observation.

Data collection is accomplished by all members of the survey team.
Often, members of one survey topical area will collect data that
supports other topical areas. An example of this would be data that is
collected about physical security systems that could also be useful to
the nuclear material control topic, as they both relate to overall
protection of the material.

It is important to prioritize data collection activities. Prioritizing
data collection activities allows schedule adjustments if complications
or unforeseen events do not permit completion of all planned activities.
If this occurs, the survey team can concentrate on gathering the data
which was deemed most critical. High priority data collection activities
should be scheduled early in the survey process to ensure that they are
accomplished.

It is also important that the collected data are accurately recorded.
This may be done using notebooks, checklists, or other means. They are
usually annotated, dated and retained for a given period of time. Local
procedures typically define what these working papers should contain and
how long they should be kept.

It is unlikely that the survey team will be able to review every
document, watch every individual perform his or her safeguards and
security tasks, and account for each security interest in the inventory.
The team must, therefore, use sampling techniques, described below, and
strive to ensure that data collection sample sizes and configurations
are adequate to accomplish the survey objectives. Samples must be large
enough to give reasonable assurance that the sample reflects the entire
population, and small enough to ensure that the data can be collected
during the survey period. A variety of statistically valid sampling
techniques are available; however, statistical significance is not
necessarily required to meet the demands of many survey topical areas.

Standard data collection methodologies in­clude: direct observation,
personnel interviews, reviews of documents, and performance-based and
knowledge-based tests.

Instead of randomly looking at things and depending on luck to find some
basis for assessing the state of a program, it is usually best to have a
plan and to pursue areas where potential problems may have been
indicated during pre-survey planning.

Each team member must establish an investigative mindset for the survey.
Don\'t just record responses, but develop and pursue leads and fully
develop facts. The ability to look beyond the response of an interviewee
or apparent piece of the puzzle is important. This ability will also
serve the team member well in separating facts from presumptions. The
team member\'s inquiries should be thorough but fair. This fairness
should help to alleviate the feeling of fear or harassment some facility
staff occasionally feel during a survey.

Survey team members must actively interface with facility personnel. It
is, therefore, important to create a high level of rapport and trust
between the survey team and the facility. This will facilitate the open
communication necessary to obtain valid data.

You may encounter some defensiveness and hostility while collecting data
from facility personnel. You should be aware of this possibility and use
every technique available to put people at ease. Some techniques at your
disposal are:

[Arrive on time and be mentally and physically prepared to conduct the
survey:]{.underline} - Arriving on time shows respect for the facility
staff. It is also important to be prepared with a clear idea of whom to
meet with and what data to collect. Interview questions should have be
developed to guide interviews and to ensure essential elements of data
are collected. Checklists or other tools may be used for other methods
of collection.

[Emphasize that you are there to survey the program, not the
individual:]{.underline} - Explain to the facility personnel that there
will be no names mentioned in the survey report. State the purpose and
objectives of the survey.

[Recognize that your early actions will be suspect:]{.underline} - When
you start collecting data from facility personnel, don\'t start telling
them how \"you\" do things. Never use the words \"I\" or \"my\" at the
beginning of data collection. It is necessary for each team member to
establish an initial atmosphere of open communication. Boasting about
yourself early on will tend to shut down the possibility of successful
data collection.

[Act with cool persistence:]{.underline} - There are times when you will
encounter someone who repeatedly fails to provide you with information.
It is important that you remain in control and not become hostile.
Knowing what data you [need]{.underline} to collect can help if you
encounter hostility. If a person will not give information on a subject,
you need to know if the subject is important to the survey. If the
information is not important, don\'t ask again. If it is important,
redirect the conversation reducing the person\'s intentional or
unintentional avoidance of the topic.

Biased data can give a highly personal and unreasonable distortion of
information collected for the survey. Precautions should be taken to
ensure bias is kept to a minimum. A good surveyor will investigate the
facility with a detached investigative mindset. This mindset reduces
intentional bias. Sometimes bias can occur unintentionally; therefore,
there are a few general rules you need to follow to obtain data that is
unbiased. These rules are:

[Be flexible:]{.underline} - don\'t be so determined to follow your plan
that you fail to respond to unforeseen developments.

[Be professional:]{.underline} - don\'t discuss personal issues with
facility personnel.

[Be objective:]{.underline} - don\'t lose your independence by passing
judgement or making requirements or committing to use the survey to
solve internal problems.

DOCUMENTS

Required documentation, procedures, administrative records, operational
logbooks and other documents will depend on the topical or subtopical
area being evaluated. These should be identified by the responsible team
members in their individual topical and subtopical survey plans. The
topical and subtopical sections of the Safeguards and Security Survey
and Self-Assessment Guide provides suggestions on documents and other
elements of data to be collected by survey team members involved with
each of the respective topics/subtopics.

Reviewing key documents and selected records begins during the planning
phase of the survey and continues throughout the survey process. A
thorough review of documents is critical and accomplishes several
things.

 It establishes or identifies additional requirements, or further
defines those already established.

 It may indicate how well a required process or task has been defined.
Poorly defined tasks may result in poorly performed tasks, which would
be determined with subsequent performance testing.

 Documents and/or records often provide the necessary audit trail to
validate findings or corrective actions taken to findings.

 Verifies and permits comparison of information received from
interviews, briefings, tours, observations and performance tests.

 Can be used to develop and refine performance tests to be conducted as
part of the survey.

 Reports may identify recent protection system changes, weaknesses, or
previous deficiencies that should be closely scrutinized during the
survey.

 Allows verification of line management support of the safeguards and
security program, through such indicators as:

 Appropriate approvals for distribution

 Distribution to appropriate personnel/organizations

 Documented reviews at the appropriate frequencies

While reviewing documentation, ensure that current requirements have
been implemented. Some indicators for problems in procedures and other
documentation include:

 The procedures have not been approved for publication or
implementation;

 The references are current but not the procedures, indicating someone
merely replaced references to superseded documents without implementing
the changes indicated by new directives;

 The requirements referenced are all outdated, indicating a lack of
periodic review or implementation of new directives;

 There is no method prescribed to ensure procedures are updated when
necessary;

 The meaning of the procedure is unclear, which may indicate it was not
thoroughly reviewed and may not have been implemented \[which might have
entailed some quality improvement feedback from the training department
or users of the procedure\].

The following are types of documents routinely included in a document
review. These documents are used for comparison to the applicable DOE
directives, to determine program compliance status.

 Operations Office Survey Reports

 Office of Security Evaluations (SE) Inspection Reports

 Inspector General (IG) or General Accounting Office (GAO) Reports

 Site Safeguards and Security Plans

 Master Safeguards and Security Agreement

 Vulnerability Assessments

 Performance Test Results

 Other Site/Facility Safeguards and/or Security Plans

 Facility Self-Assessment Documentation and Reports

 OPSEC Assessments

 TSCM Surveys

 Pre-Survey Questionnaire

 Incident Reports

 Deviations to established requirements

 Facility Data and Approval Records

 Foreign Ownership, Control or Influence Files

 SSIMS Database Information/Facility Registration

 Local plans (MC&A Plans, Computer Security Plans, OPSEC Plans, etc)

 Local orders and directives

 Policy manuals

 Procedures

 Contracts

 Work For Others documents

These documents are reviewed to determine how effectively they implement
DOE requirements. They also provide a basis against which performance
may be evaluated. In addition to determining how requirements are being
met, any compensatory measures are identified during this review and
analyzed to determine if they are valid and current. The effectiveness
of these measures may be determined by subsequent performance testing.

The results of previous surveys may provide information of value to the
current survey, including the description of the facility,
identification of the security interests surveyed and the findings and
suggestions. The corrective action plans and resolution of the previous
findings may also be indicative of the quality of the program and the
level of management support the program receives.

All previous findings, regardless of their origin (e.g., TSCM findings)
or status (open or closed), should be reviewed. These findings, even
though corrected and closed, may indicate areas where the facility has
historically had problems with compliance and performance. Although the
findings of the last survey will be of primary interest, findings of
prior surveys or of other inspections may also be of interest.

Documented survey findings must have been monitored until suitably
resolved. Quarterly reporting on unresolved findings of previous survey
activities will be reviewed. The current state of the Safeguards and
Security Program at the time of this survey may be used to validate the
status of previous findings, if appropriate. Findings of the current
survey which correlate with findings of the previous survey should be
identified as Repeat Findings, regardless of their status prior to this
survey.

Concerns about open or repeat findings or the inability to establish and
implement effective corrective action plans should be discussed with
those team members surveying the Program Management topical area for
potential impacts on their survey activities and scope/focus. Repeat
findings may indicate problems in the management of the safeguards and
security program, or element(s) thereof, such as the failure to
effectively identify and correct systemic, root causes of identified
deficiencies.

INTERVIEWS

Personnel with knowledge of, or responsibility for, program elements
should be interviewed. This helps to establish that staff have essential
skills and knowledge and also helps to locate documentation or other
elements of information essential to the survey.

The purpose of conducting interviews is to gather information to explain
how policies and procedures are implemented and clarify impressions or
the contents of documents. Interviews may be conducted at any time
during the survey process to clarify documents/records or observed
performance and conditions.

Not all interviews are necessarily formal. Discussions frequently take
place during tours, while reviewing documents or during performance
tests. Individuals conducting the survey should take advantage of every
opportunity to ask questions of appropriate personnel. Interviews with
personnel at all levels are recommended. Frequently, discussions with
personnel involved with hands-on operations will indicate whether the
policies and directives of management are effectively communicated and
implemented.

Proper interviewing requires a great deal of experience and skill. The
following are some important points to consider when conducting an
interview:

 [Courtesy and a non-adversarial approach will facilitate the
interview]{.underline}. A pushy or know-it-all attitude will generally
receive a negative response. The same is true when the surveyor appears
interested only in finding deficiencies, rather than also identifying
strengths.

 [Explain the purpose of the interview and the importance of the
individual\'s assistance]{.underline}. Make every effort to establish
rapport before attempting to ask questions.

 [Be an active listener]{.underline}. Provide reinforcement by
repeating key points, and acknowledge that you understand what is being
communicated.

 [Maintain a neutral position]{.underline}. Avoid agreeing or
disagreeing.

 [Use open questions as much as possible and encourage
elaboration]{.underline}. If a statement or response is unclear, ask the
interviewee to expand on the subject to avoid misunderstanding.

 [Gradually escalate the importance of the questions]{.underline}.
Begin with general questions and work toward areas where concerns may
exist.

 [Verify facts thorough use of a question format]{.underline}. For
example, if documentation shows that 14 internal reviews were conducted
on safeguards and security programs, ask the point of contact to verify
the quantity.

 [Restate facts gathered from other sources]{.underline}. For example,
if documentation shows that annual security refresher training was not
held, the interviewer should state this as a fact to the point of
contact for confirmation. **BE CAREFUL NOT TO COMPROMISE SOURCE, UNLESS
APPROPRIATE!**

 [Do not appear excited about finding a deficiency]{.underline}.
Request further clarification as to how the requirement is being met to
determine whether there is a deficiency in procedures, or if acceptable
alternative approaches are being used.

Emphasis is placed on maintaining a positive approach and ensuring a
cordial relationship between the survey team and the representatives of
the facility being surveyed. This must not, however, be construed to
suggest that an investigation into a potential problem area will be
limited or terminated because of potential or actual hostile attitudes,
or obstructionist tactics on the part of the person being interviewed.

Preparation is the first and most important step in the interview
process. If it is known in advance what needs to be discussed, it is
more likely that appropriate questions will be asked. You or someone on
your team should take notes throughout the interview process; memory is
unreliable, at best. Although note taking may create small pockets of
silence, most persons will be comfortable with the note taking process
if they understand that notes are being taken to ensure that accurate
information is being recorded.

QUESTIONING

The type of questions asked during an interview influences the climate
of the interview situation and the amount and type of information
received. The four basic types of questions are open, closed, probing,
and leading or loaded.

1\. Open Questions

Open question ask for general information and allow the interviewee to
structure the response. Use open questions for starting each area of
inquiry. An example of an open question is:

\"What are your responsibilities for documenting training?\"

2\. Closed Questions

Closed questions are designed to limit the response available to the
interviewee. Usually a closed question can be answered with a word or
phrase. For example:

\"Do you know all the regulatory requirements for training
certification?\" \"Was the report sent on time?\"

The disadvantage of closed questions is that they limit the amount of
information given. Use closed questions only when seeking a specific
item of information. Generally, do not ask more than three closed
questions in succession.

3\. Probing Questions

Probing questions are used to clarify information or gain additional
information, usually based on a response to an open question. Examples
of probing questions are:

\"Could you give me an example of what you mean by bad instructions?\"
\"What happened after the report was submitted?\"

Probing questions are always based on the information given by the
interviewee. They are useful because they focus the response on the
information you need to know. They can be used to clarify apparent
inconsistencies or discrepancies, for example:

\"You stated you did not have enough staff; yet, you also stated you had
two staff members transferred - could you explain what caused you to
transfer two staff members when you believe you don\'t have enough staff
to accomplish the task?\"

4\. Leading/Loaded Questions

Leading or loaded questions have hidden agendas and usually ask the
respondent to agree with a position already held by the questioner. For
example:

\"Don\'t you agree that the proposed management system is a good one?\"
\"We found this procedure to be inadequate. Can you explain why you
approved it?\"

Asking loaded or leading questions is seldom if ever useful and should
be avoided in an interview situation. People naturally become defensive,
causing the interview climate to become uncooperative.

LISTENING

The importance of listening cannot be over stressed; it is difficult to
gather information while talking. The interviewer must listen intently.
This involves not formulating new questions as the individual is
responding to the previous ones and not listening only for the \"bottom
line.\" It is important to let the person respond in as much detail as
possible to get the information that is needed. The best way to
accomplish this is to ask open-ended questions to start with and then
move to close-ended questions to get clarification of details. Silence
on the part of the interviewer can also be an effective method of
getting an individual to continue talking.

PARAPHRASING

Paraphrasing is using your words to convey your understanding of what
the interviewee stated. To use this technique, the interviewer must
listen and comprehend the message. It is a technique to foster a
positive climate because it shows the interviewee that you are paying
attention and feel the information being presented is important.
Paraphrasing also requires the surveyor to wait until the interviewee
has finished presenting the information.

Paraphrasing should be used when you feel the interviewee has made a
statement that clearly needs to be understood by both parties. For
example:

\"If I understand you correctly, you don\'t believe Procedure XYZ
applies to your record keeping system?\"

Notice that paraphrasing can also lead to another line of questioning.
If the interviewee answers \"right\" or \"that is correct\" the
paraphrase serves as a closed question. If the surveyor\'s perception
was not correct, the paraphrase functions as an open or probing
question. Then the interviewee needs to provide additional information.

SUMMARIZING

This technique should be used by the surveyor at the end of the
conversation for each area of inquiry and at the end of the interview.
The difference between summarizing and paraphrasing is that summarizing
covers all the key points covered related to an area of inquiry or to
the entire interview. For example:

\"Let\'s go over what we have about training certification records.\"

This technique is especially useful when a great deal of information is
covered during an interview. It serves as a comprehension check for both
parties.

Summarizing is also a technique to use to diffuse a potential negative
situation or solve a problem. For example, the interviewee seems to
hesitate or gives vague answers to a specific question. Rather than
continuing to press the point with more questions, you can stop to
summarize the information gained up to that point, and then indicate to
the interviewee the point of stalemate. For example:

\"So far we have discussed X, Y, and Z, but I still need to know about
A.\"

RECORDING THE INTERVIEW

Look over your notes to determine the logical sequence of the ideas
discussed. Because the interview can take many turns and twists in terms
of the ideas discussed. This activity give you a chance to decide on the
major ideas and related details discussed. It is recommended that you
write a summary of the interview results, organized around you desired
outcomes or objectives.

OBSERVATIONS

Observation of routine work, processes/systems and the environment may
identify practices that may not be appropriate. These should then be
pursued through interviews and/or review of procedures, training, etc.

Tours and observations differ from physical examination, performance
testing and other forms of data gathering since the person doing the
surveying does not interject an opinion or interfere with the
environment being evaluated.

Tours are especially valuable for an individual who has never been to
the facility being surveyed, or to observe specific operations or
procedures and to gather data for later performance tests. Tours
familiarize the survey team with the site and facility layout. This is
particularly important to physical security, protective force and
nuclear material control and accountability topics.

Observations are necessary to confirm or disprove procedural compliance.
The existence of a procedure does not necessarily mean it is being
carried out. If a procedure is specified for a particular task,
observations look for its use/non-use, as well as consistency in
application. It is recommended to spend as much time as \"practical\" in
the field observing actual operations. Be careful to make sure the time
is worthwhile. Assumptions can be validated by testing.

The survey team should attempt to minimize impact on the facility. One
way to do so is to observe procedures, such as special nuclear material
transfers, security alarm preventative maintenance checks, or portal
monitor checks, when they are scheduled by the facility, rather than
requesting a special demonstration. However, if the operations, such as
nuclear material inventory taking is not scheduled during the survey and
the observance of the inventory procedure is critical to evaluating
system operations, then initiating an inventory through a performance
test is allowable.

Observations are made to ensure the procedures are being implemented as
described. Observations may also be made to validate the data collected
through document review and/or interviews. Techniques for conducting
successful observations include putting observed personnel at ease,
observing and questioning with minimal disruption and taking good notes.

PERFORMANCE TESTS

Surveys are required to be both compliance and performance oriented.
Compliance data gathered through document reviews and interviews are
analyzed to determine whether the program element being surveyed
complies with the intent of applicable facility and DOE requirements.

Performance testing is also an essential part of the survey. A
performance test is a set of controlled events during which information
is recorded to answer specific questions regarding system, personnel or
procedural performance. Test results are validated and incorporated with
other data gathered during the survey.

Although traditionally used primarily for evaluating protective force
personnel, performance tests are now used to evaluate other areas,
especially those involving tasks or processes. The success of these
tests is, however, predicated on thorough planning. In cases where armed
protective force responses or other hazardous conditions may be
encountered, this planning must address the safety of the team members
and facility staff. A safety plan, identification of a trusted agent,
the use of exercise controllers and compensatory security measures
during the performance test are critical aspects of this sort of
exercise.

Test plans and other documentation related to what was tested, how it
was tested and why, should be retained with the working papers for the
survey.

This Guide\'s topical and subtopical area survey guidance provide
guidelines for evaluating compliance and performance within each topical
area. The survey team should review the survey findings to determine how
well the compliance and performance measures applicable to each topic or
subtopic area are being met by the facility. Standard Performance
Measures, developed by the Office of Safeguards and Security, should be
applied, where appropriate.

System performance tests evaluate all or selected portions of safeguards
and/or security systems as they exist at the time of the test. Survey
performance test results demonstrate the ability of an element of a
protection system to react to a specific scenario in the context of the
circum­stances of the specific date/time of the test. They will not
necessarily reflect the overall state of security at a facility, since a
single performance test is, by definition, one data point and,
therefore, not statistically significant in and of itself. It must be
placed in context with other findings, observations, and conclusions.

Performance tests are typically on-site exercises of the personnel,
equipment and/or procedures of selected portions of safeguards and
security systems to determine the system\'s effectiveness. Each
performance test is designed to exercise and evaluate some portion of
the system or program. The purposes of performance tests include:

 Determining whether personnel know and follow procedures

 Determining whether procedures are effective

 Observing whether plans and procedures accurately describe operations
conduct

 Determining whether personnel know how to operate equipment

 Determining whether personnel and equipment interact effectively

 Determining whether equipment is functional and operational

 Determining whether equipment has proper sensitivity

 Determining whether equipment meets design objectives

Examples of equipment that might be performance tested include portal
monitors, computer systems, laboratory measurement systems and alarm
systems.

If the facility has a program for conducting performance tests, the
survey team may consider requesting the facility to perform one of its
performance tests rather than, or in addition to, one the team designs.
Observing the facility conduct a performance tests has three benefits to
the survey:

 It also tests the facility\'s assessment program

 It supports the facility\'s testing program

 It simplifies the survey planning with regarding identifying trusted
agents and developing safety plans.

Performance tests are usually coordinated in some fashion with
appropriate personnel at the facility. Some performance tests require
that the personnel being directly tested are unaware that a test is
being conducted. These types of tests require special care to ensure
they are coordinated and safely conducted.

At a minimum, inclusion of these types of tests during a survey should
be covered at the survey in-briefing. The facility can be briefed of the
fact that tests will be conducted and informed that they will be
\"no-notice,\" or other limitations discussed. Appropriate personnel can
then be informed that equipment or procedural performance tests will be
conducted without compromising the validity of the test.

Performance tests that are used for surveys may be as simple as an
observation or as complex as a large scale force-on-force exercise. The
complexity of the performance test will be determined by the questions
to be answered by the survey team. Performance test for surveys should
be used to validate possible findings.

Performance testing may include No-Notice Exercises, Limited Scope
Performance Tests, Force‑on‑Force exercises, Emergency Manage­ment
Performance Tests, and Alarm Response and Assessment Performance Tests.

No-notice exercises are useful when only one component of an element is
found to be inadequate. For example: the facility has a procedure
written describing how a Security Police Officer (SPO) is supposed to
verify a sample transfer. During an interview, the SPO could not recall
this procedure. Observations were made of several SPOs performing this
procedure (all of them performed what was on the checklist but each SPO
performed the procedure somewhat differently.) The team decided to
return to this one component without giving any notice to the SPOs being
tested. The same checklist was used for the no-notice exercise as was
used for the observation. The objective of the team was to insure that
this procedure was actually carried out when the SPO was unaware that
they were being watched.

Force-on-force exercises should be used when S&S elements in two or more
areas show possible deficiencies. For example, the survey team discovers
during the course of the survey that there is a possibility that
procedures are not being followed for alarm response at the Protected
Area and the Material Access Area. A scenario is developed using the
vulnerability assessment as a guide, to insure that proper alarm
response occurs if an adversary team crosses the Protected Area and the
Material Access Area.

Complex tests require more time to plan, and more personnel to conduct.
Therefore, use them if it is the only method available for validation.

Limited scope performance tests are beneficial to run if several
components in one S&S element seems to be inadequate. Take, for example,
a Material Access Area (MAA) personnel portal. During the course of the
survey several possible deficiencies were noted from interrelated S&S
topical areas, all of which are present at the MAA Personnel portal. The
survey team wants to determine if these possible deficiencies could
allow an adversary to defeat this S&S element. A performance test is
planned using a scenario described in the vulnerability assessment. A
test is conducted to determine if an adversary could gain access to the
MAA.

LIMITED SCOPE PERFORMANCE TESTS

A limited scope performance test (LSPT) is a test of an individual or
group of individuals that is conducted to assess the effectiveness of
certain specific aspects of the surveyed facility\'s policies,
procedures, or training require­ments. LSPTs are vehicles for information
collection.

Surveys and self-assessments are typically conducted with limited time
and resources. It is difficult, under these conditions, to
comprehensively test all aspects of a program or program element. This
is especially true for large protection elements or where the use of
large numbers of personnel would be required. By limiting the focus or
scope of the evaluation to smaller aspects of the overall program
element or testing the skills and/or knowledge of a small sample of the
personnel responsible for the element, a reasonably clear idea of the
health of the entire program can be obtained without consuming large
amounts of time and resources.

If suitable procedures have been implemented for a program element and
staff suitably trained on those procedures, these will be apparent in
the limited scope performance test (LSPT) results. In situations where
these results indicate a lack of procedures, training, skills or other
required program element, the LSPT may provide insight into the cause
for the deficiency or otherwise point to another element that requires
further evaluation.

In order to be effective and to provide the desired, essential
indication of the overall program effectiveness, LSPTs must be clearly
defined and planned in advance of the survey activity. The basis, scope
and method for each LSPT must be documented and established in the
Survey Plan. These test plans should be approved by the Team Leader.
Other approvals may also be required, especially if safety concerns are
involved.

LSPTs are not individually rated; they should be used by the survey team
as one factor in assigning survey ratings. They are an indicator of
program effectiveness. When LSPTs are used, they should be defined in
the survey report and their impact on a rating or ratings must be
carefully delineated.

LSPTs may not test the overall effectiveness of a system, but they can
identify vulnerabilities within the \'defense‑in-depth\' security
envelope. The LSPT allows assessment of individual components or skills
in a security system, and it can be repeated against the same component
or skill as many times as necessary to develop statistically valid data
as a basis for determining the component\'s or skill\'s effectiveness.
Consistently high performance results for individual elements of the
security envelope can be used to infer that the overall protec­tion level
is at a level which is at least as high, if the ele­ments tested are
related. For these reasons, the relative emphasis on and scope of LSPTs
has been increased.

The value of the LSPT is that it not only tests a portion of the
defense‑in‑depth at a particular target or site, but it also affords the
opportunity to observe individual skills and knowl­edge.

PLANNING AND REPORTING PERFORMANCE TESTS

Performance tests should generally be fully defined in a performance
test plan. A performance test plan typically contains the following
sections:

 [Test objective]{.underline} - Identifies what is to be tested and
what the test is designed to accomplish.

 [Scenario description(s)]{.underline} - Describes elements or system
being evaluated by the test. The scenarios may be restricted to
specific, limited aspects of the safeguards and security system, e.g.,
weapons detection at a protected area entry point, or many elements of a
total system, e.g., a Force-on-Force exercise.

 [Test methodology and evaluation criteria]{.underline} - This section
describes how the test will be conducted. It should list steps involved
in planning and execution.

This section should also include a description of any statistical models
or mathematical formulas used to determine probabilities or confidence
levels, and pass/fail criteria. It should include models, equations or
methods to be used for data analysis.

 [Test controls]{.underline} - This section describes controls imposed
to ensure the integrity of the test, such as safety plans, special
security activities, etc., such as:

\- Use of trusted agents

\- Providing notice or no/notice of upcoming test

\- Procedural modifications

\- Other equipment controls, etc.

 [Resource requirements]{.underline} - This section includes a
description of resources that are needed to conduct the test, such as
facilities, personnel and equipment.

 [Test coordination requirements]{.underline} - This section describes
how and when coordination is required with other operational elements -
such as **safety**, quality assurance, security, safeguards, facility
operations, etc. EMPHASIZE SAFETY!!!!

 [Operational impact(s) of testing program]{.underline} - Describes any
impacts of conducting the test, such as overtime costs, decreased
facility production rates, etc.

 [Compensatory measures (if necessary)]{.underline} - Describes
measures to be taken to compensate for any degradation of security
posture which might occur while conducting the test. Also identifies
measures which might need to be implemented in the event of test
failures or other contingencies.

 [Coordination and approval process]{.underline} - Discusses the
approval process for test records including, witness sign-off, dates of
data collection, and use of compensatory measures.

 [References]{.underline} - Lists applicable DOE orders/manuals, SSSPs,
and other DOE Policy documents containing requirements for the element
or system being tested. Also lists all reference materials used in
analysis or calculations used.

Performance tests will be reported in the survey report. The reported
results should be supported by the notes and working papers associated
with the collected data from each test. In addition to key information
from the test plan, the following elements might be included:

 [Description of the Test]{.underline}. What were the conditions under
which the test was performed. Who participated, by number and job
titles/descriptions.

 [Synopsis of Test Data]{.underline}. What was observed during the
test. Include both positives and negatives, as well as data that show
performance against minimum requirements.

 [Test Results]{.underline}. A statement of success or failure
according to evaluation criteria provided in the test plan should be
included. Any unusual observations related to the area tested should
also be discussed.

 [Corrective Actions]{.underline}. Corrective actions recommended for
safeguards and security measures failing to meet requirements should be
listed and discussed. The persons, organizations, or groups responsible
for the corrective actions should be identified. Both immediate and
longer range solutions will be discussed.

 [References]{.underline}. The test plan and other pertinent materials
may be provided as an attachment to the survey report.

Test plans and other documentation related to what was tested, how it
was tested and why, should be retained with the working papers for the
survey.

SAMPLING METHODOLOGIES

It is unlikely that the survey team will be able to review every
document, watch every individual perform his or her safeguards and
security tasks, and account for each security interest in inventory.
Therefore, the survey team must strive to ensure that data collection
sample sizes and configurations are adequate to accomplish the survey
objectives. Samples must be large enough to give reasonable assurance
that the sample reflects the entire population, and small enough to
ensure that the data can be collected during the survey period. A
variety of statistically valid sampling techniques are available,
however, statistical significance is not necessarily required to meet
the demands of many survey topical or subtopical areas.

Surveys are conducted to assess the effectiveness of safeguards and
security programs. Confidence in these assessments is influenced by
perceptions of consistency, thoroughness, and fairness in conducting the
surveys. The use of statistically valid methods for gathering and
interpreting information can frequently strengthen the confidence in the
results obtained.

Data collection sample sizes and configurations must be adequate to
accomplish the survey objectives. Samples must be large enough to give
reasonable assurance that the sample reflects the entire population, and
small enough to ensure that the data can be collected during the survey
period. A variety of statistically valid sampling techniques are
available, however, statistical significance is not necessarily required
to meet the demands of many survey topic areas.

Sample sizes and configurations are important planning points that must
be determined for many data collection activities. While the ideal
situation might be to review every record or check every item, it is
often impractical. Most survey teams operate with limitations in terms
of available time and manpower. For example, if a facility has 10,000
classified documents, a 100 percent review of them would generally be
impractical. However, pertinent information can be obtained by examining
a portion, or sample, of the population and making conclusions about the
entire population. Properly used, statistical sampling allows these
conclusions to be made accurately, and cost-effectively.

It should be noted that samples are sometimes [not]{.underline} selected
at random. DOE management is sometimes interested in whether
deficiencies exist at all rather than making projections based on
statistical sampling. Some form of random selection should, however,
usually be used to ensure all elements of a system have a non-zero
probability of being examined. Whether non-random sampling is used
depends on survey goals, such as identifying weaknesses or quantifying
effectiveness.

The tested sample sizes must be large enough to provide a reasonable
indication of the entire population under review. Examining 10 files
from a population of 5,000 personnel security files would hardly permit
the determination of overall quality and completeness of personnel
security packages. On the other hand, examining all 5,000 during a
survey would probably be impossible. For small facilities or
populations, 100 percent checks may be possible and appropriate.

The most important factor in sample configuration is that the sample be
representative of the entire population. The best way to ensure this is
to use statistically valid random selection techniques to draw the
sample from the entire population under review, whenever possible. A
randomly selected sample provides a high level of confidence to project
results in a valid and meaningful way for DOE reporting.

In determining sample sizes for a particular sample problem, [confidence
levels]{.underline} are associated with statements made about the
outcome of the sampling procedure. For example, statistical
interferences made at a 95% level of confidence are correct at least 95%
of the time. Thus, if a random sample of 200 items is selected and zero
defects are observed, it can be stated with [95% confidence]{.underline}
that the true proportion of defectives in the population is at most
0.015 (1.5%). In this same case of a sample of 200 items and zero
defects, it can also be stated with [80% confidence]{.underline} that
the true proportion of defectives in the population is at most 0.008
(0.8%). Thus, a lower level of confidence permits a more reliable
statement to be made about the population proportion, but at the price
of an increased chance of an incorrect statement \-- in this case, a 5%
chance of being wrong versus a 20% chance of being wrong.

If you are interested in learning more about how to use statistical
sampling, information may be found in documents published by the Office
of Security Evaluations (SE) or in texts on statistics available
commercially. Here are some examples:

\"Statistical Methods For Nuclear Materials Management,\" W. M. Bowen
and C. A. Bennett, 1989.

\"Attributes Sampling Inspection Procedure Based on Hypergeometric
Distribution,\" T.S. Sherr, 1972.

\"Sampling Methodology for Inspections,\" DOE/OSE, 1987.

\"Sampling Methodology for Sampling Classified Document and Material
Accountability Systems,\" DOE/OSE, 1991.

**D. TEAM ACTIVITIES/INTERFACES**

Daily meetings for integration and discussion of concerns and
identification of those crossing topical/subtopical areas to those
surveying the related areas. Team members will meet on a daily basis to
review the progress of the survey and to identify any areas of concern
that may have developed. The Team Leader will also be informed of any
significant items as they develop. This will permit the Team Leader to
resolve any potential misinformation that the survey team might be using
in their evaluations. The daily team meeting should include the
following:

Summaries of Observations by Topical Area Leaders

Identification of Significant Issues and Potential Problems

Discussion of Compliance/Non-Compliance Issues

Discussion of Performance Test Results

Discussion of Issues Requiring Policy Interpretation

Issues Requiring Security Classification Determination

Discussion of Topical/Subtopical Areas Requiring Expanded, In-depth
Review

Status of Meeting the Survey Schedule

Integration between and among topical and subtopical area teams is
critical to accomplishing a comprehensive survey. Integration of efforts
aligns the focus of the survey to avoid discontinuity of results.
Integration of efforts provides cross-over of survey team expertise,
thereby allowing one topic team to benefit from the efforts of another
topic team. Integration of efforts also provides more timely
confirmation of the strength or weakness of compensatory measures (e.g.,
if a compensatory measure for the lack of an intrusion detection sensor
is manpower intensive, the survey team can use performance tests to
evaluate the proficiency of the protec­tion personnel providing the
compensatory measure).

After the survey has been conducted, integration of data collected by
one topical area team may affect other topical areas. It may be
necessary for the survey team member who actually observed or collected
the data, to write a portion of the draft input of this data for the
other topical area to which it applies.

**E. VALIDATION**

Survey results must be validated by discussion, observations, or
exercises during the survey process to ensure accuracy. Team members
will validate all concerns representing potential findings with
appropriately identified staff at the inspected facility prior to their
presentation at the close-out meeting. Findings will be clearly defined
and referenced to DOE orders or other requirements. Validation with the
Team Leader will occur in a timely, ongoing manner.

Effective validation to verify the accuracy of the survey data is
arguably the most essential component of the survey process. The purpose
of the validation activities is to provide high assurance that facility
points-of-contact agree with the observations of the survey team.

To ensure the accuracy of data collected during a survey, the survey
team informally validates collected data continually during the survey.
In addition to on-the-spot validation, the teams may conduct a more
comprehensive validation of data collected, with the locally assigned
point of contact and their first level supervisor, but without
evaluative discussions. Data to be validated should be tendered as
concisely and accurately as possible.

Validation is an on-going process throughout the survey, but the Survey
Team Leader should schedule a close-of-day or first-thing-in-the-morning
meeting to conduct validation activities. The Survey Team Leader should
consider whether an overnight delay between data collection activities
and validation activities would short-circuit the chain-of-command and
place facility points-of-contact at an informational disadvantage.

The team leader should meet with facility management daily for:

\- Discussion/Resolution of Open Items From Previous Day

\- Summary of Survey Accomplishments (findings/concerns)

\- Identification of Schedule/Resource Prob­lems

\- Recap/tracking of schedule and adjustments

\- Open items to be addressed at the next meeting

Once the survey is underway, briefings should be drawn from the survey
team working papers and briefing notes developed during the survey. The
Survey Team Leader should pay special attention to areas identified
during the survey that indicate policy issues or require additional,
specific definition to fully understand the facility\'s position in
interpreting guidance from HQ.

WEEK-END AND SURVEY-END SUMMARY VALIDATIONS

A summary validation meeting should be conducted either at the end of
data collection activities or on a weekly basis for a survey covering a
multi-week period. The Survey Team Leader should focus the summary
validation at the working-group level, and should include a recap of the
highlights of daily validation activities. It is important that the
Survey Team Leader document the summary validation through meeting notes
and attendance roster(s), in order to reduce the potential for
post-survey claims that salient data points were not adequately
discussed with, and validated by, facility personnel.

REVIEW BOARDS

Each survey should undergo internal review by knowledgeable management
from the Surveying Office, to analyze survey findings and review the
survey report for readability, adequacy, fairness, and logical support
for assigned ratings. The purpose of the review board is to analyze the
draft survey report and the impact of topical area ratings from the
perspective of the facility, DOE Headquarters, other government agencies
and congressional oversight committees. The review board discusses any
concerns with the Team Leader and team members responsible for the
respective topical or subtopical area. The review board has the
authority to reject findings which may not be adequately supported and
may exercise editorial control over the final document.

Team leaders should conduct informal review meetings at one or more
points during the conduct of the survey. These reviews serve as a
quality assurance tool to identify findings that may not be clearly
written or fully described or others that may not meet standards
established for findings. Each of these reviews should be done with the
team member(s) responsible for each of the findings that may be
questionable. The team leader may decide to accomplish these reviews
\'one-on-one\' or in a group setting with all of the team present to add
their perspective. At least one of these reviews should occur prior to
the out-briefing.

**F. OUT-BRIEFING**

The Survey Team Leader conducts one or more facility out-briefings,
outlining the survey findings. The Survey Team Leader then pre­pares the
survey report detailing the findings and assigning the ratings.

A final out-briefing must be conducted with the surveyed organization.
At a minimum, the briefing must present each finding, the topical
ratings and the overall composite rating, and the corrective action
reporting requirements.

The team leader must have a prepared agenda for the out-briefing. The
agenda should identify personnel making reports or presentations.
Because of the potential for confrontation during the out-briefing, it
is generally best for the team leader to provide the briefing and, if
necessary, to ask the Topical Lead inspector to assist with technical
details.

The out-briefing may be approached as an opportunity to \'sell\' the
results of the survey. A positive and cordial attitude can have a
positive impact on an otherwise hostile audience. This attitude can be
established with the audience by making a point of identifying
noteworthy items observed by the survey team. This briefing is a formal
opportunity to present the results of the survey and to identify any
aspects that may remain in dispute or question. At the end of the
presentation the team leader might like to thank the facility for their
hospitality and support.

Facility Out-Briefings should provide:

General Introduction

Recap Of Survey Schedule

Topics Surveyed -

Validation Test Results

Program Strengths

Areas of Non-Compliance

Findings

Suggestions

Schedule for Survey Report

The Survey Team Leader must be prepared to answer a variety of questions
concerning the survey. He or she should be well prepared to respond to
tough questions and answer them in a balanced and unbiased manner. The
Survey Team Leader may not have to declare specific ratings, but must
fully disclose any findings made by the survey team. All findings should
have already undergone validation with facility personnel. If facility
management disagrees with a finding, the Survey Team Leader may find it
necessary to take the facility comments under review and get back with
the facility after the survey report has been drafted.

**G. AGREEMENTS AND COMMITMENTS**

Agreements and commitments made during the conduct of the survey and
even during the out-briefing itself, should be summarized during the
conclusion of the out-briefing. As with the out-briefing itself, this
provides an opportunity to identify potential misconceptions before they
are formally presented to management outside the surveyed facility.
Agreements and commitments should be put in writing as soon as possible.

**H. CLASSIFICATION AND INFORMATION SECURITY**

Team members must be ever vigilant to the potential classification of
any information included in working papers, potential findings or other
documentation related to this survey. When appropriate, the information
will be protected and presented, in a timely manner, for classification
review.

Team members must ensure their conduct complies with all information
security requirements and that their notes and other materials are
reviewed, marked and protected as appropriate to the sensitivity or
classification of the information they contain.

**CHAPTER VIII. POST-SURVEY ACTIVITIES**

**A. INTRODUCTION**

Post-survey activities include those activities which ensure that each
survey results in meaningful efforts to correct deficiencies. These
include activities conducted by the Surveying Office and the surveyed
facility. Post-survey activities include the post-survey team meeting,
the writing of a report for the survey and the resolution of any
findings.

The most tangible result of the post-survey activities is the formal,
written report documenting the survey. But, this report and the survey
itself are without real benefit without the establishment, tracking and
validation of corrective actions for the deficiencies.

**B. POST-SURVEY TEAM MEETING**

Post-survey team meetings should be convened. These meetings may include
the following, not exclusive, activities, many of which may be valuable
in the pre-planning and planning phases for the next survey:

A. Review draft report or respective section(s);

B. Review of lessons learned;

C. Identification of any problem areas and how to plan for them;

D. Observed trends, which may provide projections of items to watch for
in the next survey;

E. Identification of helpful information sources/resources found during
the survey, including individual interviewees;

F. Review and summarization of agreements and commitments made during
the conduct of the survey and out-briefing;

G. Resolution of report content, especially for any area of contention;

H. Documentation of any unique organizational structures or other items
of potential use to those planning the next survey;

I. Documentation related to performance testing, including what was
tested, how it was tested and why, and any difficulties or other
concerns encountered during performance testing;

J. Preparations for briefings on the survey results to DOE management,
as appropriate;

K. Planning for the next survey.

**C. DATA ANALYSIS**

1\. FINDINGS/SUGGESTIONS

Only the terms Findings and Suggestions will be used in the survey
program. Findings and all other statements that need to be emphasized,
such as observations of conditions, are to be contained in the narrative
sections of the survey report. Where practical, suggestions (program
enhancements) should be listed and identified as distinct items or as a
separate paragraph at the end of the narrative for each topical area in
the report.

The survey report should identify findings corrected \'on-the-spot\' and
the findings and actions taken should be clearly described in the
narrative. Even if they were fixed, they may indicate information
relating to program management support and effectiveness. Where
appropriate, this information could support other information impacting
the rating in the Program Management topical area.

2\. IMPACTS AND COMPENSATORY MEASURES

Both the findings and their impacts on the protection of safeguards and
security interests must be considered in determining the ratings for the
survey. The survey team must evaluate how the collected data impact the
S&S program at the surveyed facility and whether adequate compensatory
measures have been taken to provide appropriate protection or assurance
of protection. Have vulnerability assessments been conducted as the
basis for the alternative measures? Have deviations been formally
submitted and approved? Are there significant impacts affecting program
needs or assurances; are these impacts only partially affecting program
needs or assurances; or are there no impacts?

3\. ROOT-CAUSE ANALYSIS

Any pattern of non-compliance identified in the survey may indicate a
systemic problem which should be analyzed to determine the root cause.
Root cause analyses of findings should also be performed to determine
whether deficiencies in other areas have contributed to a finding. For
example, a preliminary finding that classified documents were not
properly marked may, when analyzed, result in a determination that
adequate procedures had not been developed, that they had not been
promulgated to those responsible for marking documents, or that these
people had not been adequately trained on the procedures. These
determinations may then result in findings in Program Planning and
Management, Security Education, or other topical or subtopical areas.

Root cause analysis can consume considerable amounts of time. The need
for root cause analysis and the extent of such analysis should,
therefore, be determined by the survey team and topical area leaders.
Possible methodologies for root cause analysis are described in
Paragraph VIII. E.

4\. RATING ASSIGNMENTS AND RATING RATIONALE

All preliminary findings discovered by the survey team are discussed
with the Survey Team Leader. The survey team Topical Area Leads validate
each finding with their respec­tive facility points of contact. Survey
team members may complete a data collection form describing the finding,
applicable reference, conditions encountered, and the perceived impact
to the protection program. After the finding has been validated through
the responsible facility personnel, the data collection form is
completed and trans­mitted to the Survey Team Leader.

Upon completion of all survey activities related to each topical and
subtopical area, the team members for each of these areas will determine
a recommended rating for each subtopical area. The ratings for the
subtopical areas and other considerations will be used to determine an
overall rating for each topical area. The topical leads meet with their
associated team members to review the find­ings in each subtopical area.
Proposed ratings are assigned to each subtopical area and a combined
topic rating is derived for the topical area.

Rating determinations must be made based upon logical, defensible, and
validated conclusions that support each topical and subtopical rating
and facility impact. Each rating is debated and discussed, and the
specific reasons for the rating are justified. The Survey Team Leader is
responsible for assigning the preliminary rating(s). There is no set
formula for assigning overall ratings for the primary topical areas;
however, the process used by the Survey Team Leader should be well
documented and able to withstand scrutiny by other managers and subject
matter experts.

The Survey Team Leader determines the composite facility rating, based
upon the ratings for each topic area, and compares the current rating
with the previous survey rating to ensure successive Marginal ratings
are not assigned unless specific conditions are met. The basis for the
rating determinations should be documented for potential future use in
justifying the assigned ratings.

The composite rating should be based on the effectiveness and adequacy
of the safeguards and security program at the facility and should
reflect a balance of performance and compliance.

Ratings are not assigned for termination surveys.

Permissible survey ratings are SATISFACTORY, MARGINAL, and
UNSATISFACTORY.  These are assigned as follows:

[Satisfactory]{.underline}.  The safeguards and security element being
evaluated meets protection objectives or provides plausible assurance
that protection needs shall be met.

[Marginal]{.underline}.  The safeguards and security element being
evaluated only partially meets protection objectives or provides
questionable assurance that protection needs shall be met.

[Unsatisfactory]{.underline}.  The safeguards and security element being
evaluated does not meet protection objectives or does not provide
adequate assurance that protection needs shall be met.

Protection objectives are defined by DOE Orders and as modified by
approved site safeguards and security plans (SSSPs), facility safeguards
and security plans, ap­proved upgrades, and documented and approved
deviations to DOE requirements. These modifiers specify site-specific
considerations and tailor the local safeguards and security program to
meet the local mission operating environ­ment.

Ratings are based on conditions found to exist at the time of the survey
activities; not on future or planned corrective actions. Ratings less
than Satisfactory in any topical area shall be based on validated
weaknesses in the safeguards and security system or on deficiencies in
performance in an operational area.

A facility\'s composite rating or topical area rating shall not be
Marginal for consecutive survey periods unless one of the following
conditions applies (If either of these conditions, a. or b., are not
met, an Unsatisfactory rating must be assigned.):

a\. The previous survey that resulted in a rating of Marginal identified
different deficiencies and reasons for the rating.

b\. The deficiencies and reasons that were the basis for the previous
Marginal rating were related to the completion of a major line‑item
construction project or upgrade program.  In that case, acceptable
interim measures must have been implemented and physically validated
pending completion of the project.  The approved interim measures and
milestones for construction completion must be documented in the survey
report.

A topic or subtopic will usually be rated Satisfactory if all applica­ble
compliance and performance measures are met and implementation is
suitable for the mission operating environment. A topic or subtopic
would also be rated Satisfactory if, for any measure not met, effective
compensatory measures are in place to provide comparable protection. In
some instances, a topic or subtopic will be rated Satis­factory when it
fails to meet an applicable measure but, in the judgment of the topic
area expert and the Survey Team Leader, the impact of that shortfall
does not erode the effectiveness of the safeguards and security system
being surveyed. A small number of isolated deficiencies, not
significantly impacting the safeguards and security element, would not
necessarily result in a Marginal rating if there is no evidence of
systemic problems.

A Satisfactory rating is generally assigned if:

 No findings exist;

 Findings represent only isolated events; not system­ic failures, unless
one of them significantly impacts the safeguards and security element;

 Deficiencies present minor impact in system effectiveness;

 Category I or II quantities of SNM are adequately protected against
theft;

 SNM and vital equipment are adequately pro­tected against radiological
or industrial sabo­tage;

 Category III, and IV SNM is protected in compliance with DOE Orders
and approved site plans;

 Classified documents, parts, and material are protected in accordance
with DOE Orders and approved site plans;

 Physical security systems provide adequate defense in depth;

 Required safeguards and security program documentation is current and
properly approved (e.g., SSSPs, MSSAs, VAs, MCAPs, site and/or facility
security plans, computer protection plans, computer security plans, TSCM
plans, OPSEC plans, COMSEC plans, protective force orders, etc.);

 The protective force program provides assurance that SNM is protected
from theft, and provides assurance that information assets are
adequately protected;

 Effective MC&A, TSCM, OPSEC, COMSEC, Personnel Security, Facility
Approval and Self-Assessment programs have been established,
implemented, and supported by management as required;

 Coordination and communication is effective between/among the various
organizations at the facility and to/from Headquarters;

 Corrective actions addressing the root causes of deficiencies are
identified and implemented in a timely and comprehensive manner,

 Corrective actions are routinely monitored by facility management and
coordination with the site organizations and with Headquarters is
effective,

 Training programs are adequate and comprehensive;

 Effectiveness and benefit/cost ratio of upgrades to address identified
deficiencies are validated before findings are closed, and

 The appropriate survey or self-assessment program, itself, is
effective.

Noncompliance with one or more compliance measure may result in a
preliminary rating of Marginal or Unsatisfactory for a survey subtopic
area. Assignment of one or more subtopic ratings of Marginal or
Unsatisfactory may, in turn, result in a topic composite rating of
Marginal or Unsatisfactory. The survey team must carefully analyze the
seriousness and multiplicity of findings in a subtopical area against
the definitions for Marginal or Unsatisfactory before assigning these
ratings.

Marginal ratings are assigned if the program is not meeting required
protection objectives but SNM, vital equipment, and classified
information are not at risk. Compensatory measures have either not been
implemented or are not effective, and the impact of that short­fall
degrades the effectiveness of the system being surveyed.

A Marginal rating may be assigned if:

 The topic or subtopic only partially meets identified protection
needs;

 There is questionable assurance that protec­tion needs are being met;
or

 One or more compliance measures are not being met and are only
partially compensated for by other measures or systems, resulting in the
degrada­tion of the protection system.

 Serious deficiencies are identified in one or two survey subtopics;

 Significant deficiencies are identified in multiple survey topics,
document control or account­ability, personnel security, computer
security, or in the facility\'s self-assessment program;

 A systemic pattern of deficiencies are identified across survey
topics; or

 There is a systemic pattern of incomplete, out-of-date, or unapproved
program documentation.

A topic or subtopic will be rated Unsatisfactory if applicable
compliance measures are not being met, compensatory measures are
nonexis­tent or seriously inadequate, and resultant shortfalls seriously
detract from the effectiveness of the safeguards and security program
being surveyed.

An Unsatisfactory rating may be assigned if:

 The topic or subtopic does not provide adequate assurance that the
identified protec­tion needs are met; or

 One or more compliance measures are obviously not being met and no
compensatory measures or other systems are in place to mitigate
degrada­tion of the protection system.

 Category I SNM is vulnerable to theft in terms of the design-basis
threat;

 A radiological or industrial sabotage target is not protected or is
vulnerable to sabotage in terms of the design basis threat;

 Classified information is vulnerable to loss or compromise;

 There exists systemic failure to protect Catego­ry II, III, or IV SNM
or Classified informa­tion in accordance with DOE orders;

 Severe and wide-spread deficiencies exist in the subtopical areas of
Surveys and Self-Assessments, Physical Security, Protective Force,
Classified Matter Protection and Control or Classified Automated
Information Systems Security, or in the topical areas of Nuclear
Materials Control and Accountability or Personnel Security;

 Failure to establish effective OPSEC, TSCM, TEMPEST programs;

 Failure to establish and support a self-assessment program;

 Systemic failure to develop and maintain required formal planning
documents, or resolve deficiencies identified by other responsible DOE
offices; and

 Systemic failure to effectively communicate and coordinate activities
resulting in a demonstrated adverse impact on protective effective­ness.

If the survey reveals no deficiencies, the analysis and related
assignment of a rating of SATISFACTORY is simple. If, as is often the
case, the survey reveals one or more deficiencies, weaknesses or
compliance measures that are not being met, the analysis focuses on the
relative importance of those findings. Short­falls and deficiencies must
be analyzed individually as well as collectively, balancing weaknesses
with mitigating factors and compensatory measures to determine the
overall impact on the safeguards and security program.

A less than satisfactory rating can be applied to a topical area due to
an excessive number of deviations, or where programmed upgrades would
not be in place until some future time. Ratings should not be based upon
future corrective actions. A topical area survey rating is based upon
conditions existing when the rating was as­signed. If immediate
corrective actions have been taken and VALIDATED in the interval between
the topical area survey and the assign­ment of the composite rating, the
final rating may reflect these actions. The finding must, however, be
fully documented in the report. Caution must be exercised to preclude
short-circuiting of the root-cause analysis process which would lead to
a long-term solution of any systemic cause for the corrected deficiency
as well as the identification and correction of other unsampled elements
which may continue to exist with the same deficiency.

The compliance and performance rating of a facility reflects the
judgments of the survey team as to the assurances with which the
facility\'s safeguards and security program protects the DOE interests
located at that facility, as measured against related DOE directives.

The survey team should incorporate a variety of factors into the
analysis upon which the ratings will be based. These factors include:
the impacts of the identified deficiencies on the protection of
safeguards and security interests, determinations as to whether
identified deficiencies are single-point or systemic failures; whether
the facility knew about the deficiency prior to the survey and what
corrective measure had been taken; mitigating factors from other topical
or subtopical areas that help compensate for the deficiency; the
magnitude of the deficiency; and the significance of the vulnerability
to DOE posed by the deficiency.

Identified deficiencies in one subtopic do not necessarily determine the
rating for the topical area. The rating for the topical area is derived
from the combined ratings for its associated subtopics. It is possible
for a docu­mented deficiency in one subtopic to be offset by satisfac­tory
ratings in other related subtopics in such a way as to rate the overall
topic area as SATISFACTORY. Subtopical deficiencies with significant
impacts might, however, degrade an otherwise satisfactory topic; just as
serious deficiencies in a topical area might degrade an otherwise
satisfactory facility.

It is possible that a finding could be applied to more than one topical
area, and subsequently impact the rating for both areas. The survey team
should closely evaluate these dual-topic findings to determine the
appropriate ratings.

A facility\'s failure to comply with procedural documentation
requirements in a topical area, of and by itself, should not normally be
the basis for a reduction in a composite rating. Ratings of less than
Satisfactory in any topical area must be based upon verified weaknesses
in the safeguards and security program or deficiencies in performance in
an operational area.

While determining ratings the survey team should consider:

 The adequacy of the facilities being surveyed;

 The permanent versus temporary nature of the facility with regard to
operational requirements;

 Intra- and inter site transfers of SNM;

 The attractiveness of identified targets;

 The range of threats and adversaries;

 Approved deviations;

 Alternative approaches to provide adequate security;

 The provisions of approved MSSAs, safe­guards and security plans, and
materi­al control and accountability plans (MCAPs) and related, accepted
risks; and

 The results of vulnerability assessments.

After the ratings have been assigned, the Survey Team Leader should
reflect back upon the survey and put a note to file regarding lessons
learned. The note should identify items such as: what worked, who worked
well with whom, recom­mended changes for subsequent surveys, and what
specific things the next survey team may wish to do differ­ently.

**D. REPORT WRITING**

As soon as possible after completion of each element of the survey, a
formal report of the results of the survey should be compiled. The
individual team members and topical and subtopical leaders will ensure
complete, concise and accurate reporting of the results is accomplished
in a timely manner. The writing of the report will be overseen by the
Team Leader, who has ultimate responsibility for its completion and
accuracy.

Since a safeguards and security survey is a critical and primary
instrument used to assure and verify that DOE and national security
interests are being adequately protected, it is also important that this
effort be accurately, comprehensively, and cogently documented for the
record.

Survey reports have many audiences. In addition to DOE audiences,
including DOE Headquarters, readers have included the General Accounting
Office, the U.S. Congress, and other agencies and departments within the
executive branch of the U.S. government, just to name a few.
Consequently, the report, because of its readership, not only documents
the results of a survey, but is (by its very existence) a reflection of
the professionalism and competency of the Department and its safeguards
and security practitioners. Accordingly, preparation and publication of
survey reports should not be viewed as a routine exercise or an
afterthought. Reports are the evidence of the hard work and dedicated
effort that went into the successful planning and conduct of a survey
and, therefore, demand every bit as much attention as other phases of
this process.

Reports must be evaluated and reviewed by an Authorized Classifier in a
timely manner. Appropriate protection and control will be provided
classified or sensitive information. Each finding must be portion marked
with its classification for the purpose of properly protecting the
information wherever the finding may be used.

In preparing the survey report, there are three key components that the
survey team must attend to in ensuring that the product produced is of
the highest quality and can withstand the scrutiny and critical eye of
its many readers. These are:

\* Format: Safeguards and security surveys have a suggested format
(Attachment 2). Use of a standard format will assure readers that the
same type of information will be available in generally the same
location in any report being reviewed, regardless of its source. This
format facilitates ease of review and trends analysis and presents a
positive, professional image to audiences outside the Department.

\* Content: This is the substance of the report. Content (details below)
should provide the reader with a clear mental picture of the facility
(to include its layout and mission), all activities of the survey team,
and the results. Many interested reviewers of surveys may have never
been to the location that is the subject of the report. They may not be
in the security profession (and therefore have never participated or
been a host to a survey). But they may, in fact, have a vested and real
interest in the results. Therefore, taking the time to describe the who,
what, when, where, why, and how of each survey is a matter of great
importance.

\* Style: While format and content specifies "what" is said in a survey
report, style is a determination of "how" it is articulated. There are
clearly different approaches and viewpoints relative to this subject and
these will be discussed in this Chapter as well.

1\. FORMAT

The survey report should follow the format of the Safeguards and
Security Survey Report Form, DOE F 5634.1, and should contain the
elements listed in Attachment 2, Sample Survey Report Format.

2\. CONTENT

The report must clearly describe the facility. A complete description of
the facility needs only to be included in the report every five years
providing that there have not been any changes to the securi­ty system or
security interests involved. There may, however, be readers of a report
who are not famil­iar with the surveyed facility. Providing them with a
clear mental picture of the facility may eliminate confusion or
uncertainty which may impact the effectiveness of the report. For this
reason, it may be advantageous to include a brief facility description
in the report anyway. This is generally recommended.

It is important that acronyms are spelled out or defined when first used
and that any technical terms or jargon are clearly explained.

To the extent possible, the description of an activity, event, or
situation contained in the document should clearly answer the questions:
who, what, when, where, why, and how.

The survey report must clearly describe the safeguards and security
interests and activities and the status of the safeguards and security
program at the surveyed facility at the time the survey was conducted.
The protection methodologies used by the facility must be described. The
report must also describe the manner in which the protection measures
were evaluated and the evaluation methodologies used by the survey team.

The report should provide statistics describing the scope of the
facilities safeguards and security activities. Relevant statistics
provide the reader with a more concise picture of both the facility
(e.g., numbers of employees with each level of clearance, number of
classified documents in each level and category) and the extent of
survey effort (e.g., numbers of each sampled for compliance/performance.

Reports must describe, in sufficient detail, the conduct, results, and
evaluation of the safeguards and security program. This information is
incorporated into the standard format, outlined in Attachment 2. The
following minimum requirements and recommendations for content should be
met:

a\. DOE F 5634.1, Safeguards and Security Survey Report Form. A fully
completed Safeguards and Security Survey Report Form will be used to
document each survey and will accompany each narrative survey report.
The ratings rendered shall be annotated as **S**, **M**, or **U** (for
**S**atisfactory, **M**arginal or **U**nsatisfactory) only. Those areas
not applicable to the surveyed facility shall be rated **DNA** (for
**D**id **N**ot **A**pply). Any other notations (such as NR, for not
rated) are not acceptable. The ratings and other entries on this form
will be fully supported by the narrative of the report for the survey.

NOTE: The **DNA** rating means that the topical/subtopical program
element was not required to be implemented at the surveyed facility. It
may not be used in facilities where the program element is mandated but,
for whatever reason, was not surveyed. All mandated programs must be
surveyed and rated **S**, **M**, or **U**. Only programs not required
may be omitted from the survey and rated **DNA**. For example, a
facility that has no classified automated information systems would have
a **DNA** rating for the Classified AISS subtopical element. If,
however, the facility has, or is approved for, classified automated data
processing, the Classified AISS element must be surveyed and a rating of
**S**, **M**, or **U** must be assigned this subtopical element.

b\. The executive summary. It should contain:

\(1\) A statement reflecting the survey scope, the period of coverage,
and a brief description of the survey methodologies used.

\(2\) A brief description of the facility, function, and scope of
operations.

\(3\) A discussion of major points that had, or might have, a
significant effect on the facility\'s safeguards and security program,
including strengths, weaknesses, and the correlation of results from the
survey.

\(4\) The overall composite facility rating with supporting rationale.

NOTE: It is recommended that every report contain an executive summary;
even those for Class C facilities when the report itself may only be
10-20 pages in length. There is no requirement to limit the executive
summary to a single page; it should concisely summarize those items
outlined above.

c\. The Introduction. Basic elements contained in the introduction
include the following:

\(1\) An opening statement to the effect that a survey (specify type)
was conducted (specify dates) at (specify location).

\(2\) Identification of team leader/members.

\(3\) The methodology used to evaluate the facility.

\(4\) A description of the function and scope of operations and the
protective measures employed.  Descriptions in safeguards and security
plans may be referenced when no changes have occurred within the last
five years.

\(5\) Overall composite rating and an explanation of the factors
responsible for that rating.

d\. Narrative (by topical area).

The narrative section of the report must clearly describe the surveyed
facility and its protective measures. It must reflect both compliance
and performance segments of the survey. This portion of the report is
organized by topical area as identified on DOE F 5634.1. A summary of
content requirements appears below. The report narrative should
basically answer these three questions:

\* What is the program supposed to do?

\* What did you inspect?

\* What did you find?

More specifically, the narrative portion of a report should include:

The status (e.g., approved, pending, etc.) of any required planning
documents (e.g., SSSP, SSP, MC&A, AISS, TEMPEST).

Identification of all new findings, with SSIMS-compatible finding
numbers, to be covered later in this Chapter. Uncorrected findings from
the previous survey will be documented as repeat findings and will use
their respective, previous finding numbers. A finding number, once
issued will be used for each time that finding is found in the facility.
A finding that is a repeat of an open finding will be reported as such
and the previous finding number will be used. For example, a 1993
finding that was repeated in 1995 would use the 1993 finding number; not
a new 1995 number. With previously Closed findings, the repeat finding
would require the old number to be reopened in SSIMS. Using the previous
example, if the finding with the 1993 number had been closed, but was
cited as a repeat finding in 1995, the 1993 number would be used in the
1995 report, with a statement that the repeat status was the basis for
reopening the 1993 number.

Deficiencies and non-mandatory program enhancements must be described
only as \"findings\" and or \"suggestions.\"

The program deficiencies (findings) and supporting data must be clearly
described. The term \"finding\" refers to deficiencies or concerns found
during the survey. The term \"suggestion\" refers to suggested,
non-mandatory, potential program enhancements cited in the survey
report.

A description of the facility\'s strengths and weaknesses. This should
correlate to the results from the compliance and performance survey
segments, and discuss the basis for the ratings. The survey report must
reflect validated and defensible ratings and assigned performance
ratings must be based upon well conducted and replicable performance
tests. The narrative description must be consistent with and support the
composite and topical area ratings (to include DNA).

The status of corrective actions for open findings and findings from the
previous survey (also included in Resolution of Findings under the
Program Management topical area).

Concluding analysis of each topical area.

A detailed explanation of the factors responsible for the assignment of
a less than Satisfactory rating. The report must address the survey
scope, scope of operations, corrective actions or findings, discussion
of significant impact, and analysis of each topical area.

e\. Portion Marking

Each finding and subsequent corrective action will be required to have a
stand‑alone security classification (i.e., SRD, SNSI, SFRD, CNSI, U,
etc.). Paragraphs and portions thereof are required to be marked with
the highest classification level and category of the information
contained therein. This requirement includes Restricted and Formerly
Restricted Data (RD/FRD) and National Security Information (NSI).

f\. Synopsis of Findings

Findings shall be documented in each survey report and listed separately
at the end of the report. Each report will include an attachment,
summary or other section in which all the findings for the survey will
be collected and listed. The data for each finding on this list should
include: (1) the Finding Number, (2) the Finding Synopsis, (3) the
Classification of each finding, (4) the DOE Order Reference Number, and
(5) the Standards and Criteria Reference Number.

Each finding will be concisely described in a synopsis format (FINDING
SYNOPSIS). The SSIMS allows a maximum of 500 alpha/numeric characters
and spaces. Each finding is to have a separate, stand-along
classification level and category at the end of the finding synopsis
statement. A separate five-character field is provided for the finding
classification in the SSIMS.

Each finding is to have alpha/numeric references to the DOE Orders or
other documents that identify the requirement(s) not being met in the
finding. This reference should be written as \[DOE Order\] XXXX.XX;
followed by the chapter, section and sub-section reference numbers
and/or letters (e.g., 5632.1C, II.A.3.c.).

If appropriate, each finding should have alpha/numeric references to the
Safeguards and Security Standards and Criteria that identify the
requirement(s) not being met in the finding. This reference should be
written as the topical area (PM, PPO, IS, NMCA or PS) followed by the
numeric reference to the section and sub-sections.

g\. Finding Identification Numbering

Each finding identified in the survey report must have a unique
identification number assigned, which must be used throughout the
reporting and tracking process. The following number system is mandated,
in order to provide consistency in the SSIMS. A number in this format
will be system-generated upon entry of the finding into the SSIMS.

EXAMPLE FINDING NUMBER: 10MAR90-HQS-0515-SSIS-PM-010

\(1\) The date of the survey. The last date of the survey is used if the
survey occurred over several days. The date will be written in the
following format: two numeric digits for the day of the month (DD),
three alpha characters for the month (MMM), and two numeric digits for
the year (YY).

\(2\) Two or three alpha characters for the Lead Responsible Office or
other office assigned responsibility for the oversight/tracking of the
corrective action(s) for the deficiency, not the Surveying Office,
unless they are the same.

\(3\) The facility code for the subject facility written with four
numeric digits. A \"0\" should precede all three digit numbers.

\(4\) Up to five alpha characters designating the source/type of report.
The following codes are those used as source/type identifiers in the
SSIMS:

CODE TYPE OF DOCUMENT OR ORGANIZATION

GAO General Accounting Office Reports

IG Inspector General Reports

OSE Security Evaluations Inspections

SPEC Special Surveys

SSIS Safeguards and Security Initial Surveys

SSPS Safeguards and Security Periodic Surveys

SSTS Termination Surveys

TSCM TSCM Reports

\(5\) Up to four alpha characters which designate the topical area
surveyed. The following codes should be used:

PM Program Management

PPO Protection Program Operations

IS Information Security

NMCA Nuclear Materials Control and Accountability

PS Personnel Security

\(6\) Up to three numeric digits designating the sequential number of an
individual finding within each of the topical areas listed above.

h\. Termination survey reports should include the following minimum
information and reported actions:

\(1\) Verification of nonpossession of classified matter or nuclear
material.

\(2\) Verification that personnel access authorizations no longer needed
have been canceled and validation that termination statements have been
completed by affected employees.

\(3\) Verification of the deletion of all safeguards and security
interests.

3\. STYLE

Thus far, the sections on format and content have outlined what to write
within a survey report. This section will discuss the remaining and
extremely important issue of how to write it.

Many surveying offices have established procedures and expectations
relative to style. In order to get the document \'out the door\' an
author generally has to adhere to these rules and guidelines.

Local requirements notwithstanding, there are still a number of writing
style tips survey teams may be able to use to improve the clarity and
readability of future reports.

While several books have been written on how to write effectively, the
most widely cited style and composition suggestions include the
following:

a\. Using conversational English. Why not write as we speak? If the goal
is to get people to easily understand what is being said (and it is),
this is a simple way to do it.

b\. Using active rather than passive voice, whenever possible. Example:
\"The team reviewed over 100 documents,\" rather than \"over 100
documents were reviewed by the team.\"

c\. Limiting the length of sentences to 15 - 20 words, whenever
possible. Short sentences increase impact. Long ones tend to bury the
main theme or point.

d\. Capturing the proper tone. Be dignified and polite. Avoid harsh,
superior sounding thoughts and ideas. Remain objective and factual and
even bad news will not appear as condemning; but merely the way things
were.

e\. Avoiding sentences using contractions or ending in a preposition.

f\. Attending to rules regarding punctuation, capitalization, tense
(past, present, future) and noun-verb agreement.

g\. Avoiding use of double negatives.

h\. Eliminating unnecessary words. Example: \"During the trip\" as
opposed to \"during the course of the trip.\"

i\. Avoiding use of technical jargon, whenever possible. Remember the
discussion on the varied audiences, mentioned above.

j\. Spelling out acronyms. Mentioned before; merits an encore. Again,
remember the audience.

k\. Paragraphing. This means putting ideas into single units.
Accomplished writers actually think in paragraphs as opposed to
sentences.

l\. Use of transitional words and phrases. The linkage between those
single unit paragraphs that gives a document \'flow.\' Typical
transitional words include: consequently, accordingly, on the other
hand\...In addition to\.....Equally as important\.....etc.

m\. Ensuring each report (and major subsection) has a definable
introduction, body (or main discussion) and conclusion (summary).

In addition to style suggestions, report writing can be improved by the
way the author approaches the task of writing and editing. The following
are some helpful hints:

a\. During the conduct phase of the survey, take copious notes.
Fact-find. Gather and record data.

b\. Do not wait too long to begin putting the results on paper. Do it
while the event is fresh in the mind.

c\. Organize notes and results. Some find it helpful to prepare an
outline.

d\. Write. It is better to write too much, than not enough. Editing will
take care of the extraneous material.

e\. Edit: both for content and style. Use a spelling check or grammar
software tool, if available.

f\. Have someone else review the document for clarity and accuracy.

g Rewrite, if necessary; finalize for formal review, if not.

h\. In all cases, be open to constructive criticism and feedback.

4\. DISTRIBUTION

Within 60 working days after the final out-briefing of each survey, the
Surveying Office shall distribute the final survey report. For
Departmental Elements or other Government Agencies with limited
activities, survey results may be transmitted by memorandum. Forward one
copy of each survey report to the responsible organization; three copies
to the Chief, Assessment and Integration Branch, Field Operations
Division, Office of Safeguards and Security; copies for other DOE
elements or other government agencies; one copy to the Deputy Assistant
Secretary for Security Evaluations; and one copy to the surveyed
organization, as determined locally.

If the survey included any of the optional Information Security
subtopical areas, Unclassified Automated Information Systems Security
(AISS), Protected Distribution Systems (PDS), and Communications
Security (COMSEC), the Deputy Assistant Secretary for Information
Management should also be provided a copy of the report or relevant
portions of the report.

If a SCIF, SAP or other intelligence activity was surveyed, the
Director, Office of Energy Intelligence, must also be provided a copy of
the report. If this intelligence activity was surveyed or reported
separately, a copy of the survey report for the larger host facility
will also be included with the report sent the Director, Office of
Energy Intelligence.

**E. SAFEGUARDS AND SECURITY INFORMATION MANAGEMENT SYSTEM (SSIMS)**

The SSIMS is the primary system for maintaining information about
safeguards and security interests throughout DOE. This includes
information on facility approvals and deficiencies identified in surveys
and other inspection activities.

Survey findings are entered into the system by the surveying
organization, using the format described above.

**F. RESOLUTION OF FINDINGS**

Findings will be resolved and corrected in a timely manner. These should
include correction of root causes, to preclude recurrence of the finding
and to assure ongoing compliance in this and other impacted areas.
Findings will be resolved in a manner consistent with protection
requirements, with appropriate fiscal consideration and/or planning.

Findings found in a survey, which correlate with findings in the
previous survey in the facility being surveyed, will be documented as
repeat findings. This makes the use of root-cause analysis and other
techniques very important in thoroughly identifying and correcting each
deficiency; not just treating a single manifestation of it.

1\. CORRECTIVE ACTION PLANS

A vital element in the resolution of findings is the establishment of
corrective action plans with meaningful, measurable milestones for their
completion. These plans must be established by the surveyed facility and
be formally agreed to by the facility and the Responsible Office.

Upon presentation of a finding at the survey close-out, the facility is
to take appropriate corrective measures and/or identify measures to be
taken, including milestones for completion. Identification of corrective
actions can be accomplished in a timely manner through a documented
agreement and commitment for corrective action that the facility,
Surveying Office, and other appropriate individual(s), such as the
Contracting Officer, sign at the time of close-out; OR the facility can
identify corrective actions, including milestones for completion, to the
Lead Responsible Office, not later than 30 days after receiving the
survey report. The Lead Responsible Office\'s initial reporting timeline
depends on the overall composite rating assigned to the facility. The
Surveying Office will make the initial input of the finding and any
identified corrective action, including milestones for completion, to
the SSIMS, the Lead Responsible Office, and appropriate Headquarters
elements.

When a survey report has a composite rating of Marginal, the responsible
organization shall notify the Director, Office of Safeguards and
Security, the surveying organization (if appropriate) and the applicable
field and Headquarters program office(s) within 15 working days after
completion of the survey of interim corrective actions taken, or to be
taken, to correct identified risks or vulnerabilities. If interim
corrective actions are instituted, the surveying organization shall
physically verify them for adequacy. If the surveying organization
differs from the responsible organization, the surveying orga­nization
shall promptly notify the responsible organization of the rating. The
responsible organization shall then take appropriate corrective and
notification actions outlined above or authorize the surveying
organization to take those actions. If the surveying organization is
unable to contact the respon­sible organization and a serious threat
exists or is imminent, the surveying organization shall take action to
protect the safeguards and security interest(s) until the responsible
orga­nization is notified. Subsequent action shall be taken on the basis
of agreement between the two organizations.

When a survey report has a composite rating of Unsatisfactory, and the
rating is indicative of a significant vulnerability such as unacceptable
risk in the area of SNM theft, radiologi­cal or industrial sabotage or
espionage, the Operations Office Manager shall immediately or as soon as
possible, but not later than within 24 hours:

Take action to suspend or terminate operation of the facility or
activity, pending remedial action; or

Provide the rationale for continuing this criti­cal operation to the
Cognizant Secretary; the Director, Office of Security Affairs; the
Director, Office of Safeguards and Security; Heads of the Headquarters
Elements, as di­rected; and the Head of the responsible organiza­tion,
responsible office, and the applicable field and Headquarters program
office(s) and identify those immediate interim corrective actions being
undertaken to mitigate identified risks or vulnerabilities.

For all other less than Satisfactory ratings, the Operations Office
Manager of the responsible organization shall notify the Cognizant
Secretary; the Director, Office of Security Affairs; the Director,
Office of Safeguards and Security; Heads of Headquarters Elements, as
directed; applicable program and field office(s); and the responsible
office, within 15 working days, of interim corrective actions taken, or
to be taken, to correct identified risks or vulnerabilities.

2\. MANAGEMENT OVERSIGHT

Management must monitor the accomplishment of corrective actions and
ensure resources are allocated to permit their successful completion.
Management and staff must set a high priority on meeting or beating the
milestones and suspenses established by the corrective action plan.

**G. TRACKING OF FINDINGS**

1\. TRACKING SYSTEMS

All survey findings identified in the survey report will be entered into
the Safeguards and Security Information Management System (SSIMS). The
SSIMS is the central, DOE-wide, integrated tracking database for
findings of surveys and other S&S inspection activities. Each Operations
Office is responsible for entering and providing corrective actions on
survey findings, including findings from Technical Surveillance
Countermeasures (TSCM) surveys. The Surveying Office is responsible for
entering all findings into the SSIMS; the Lead Responsible Office, for
reporting of the status of corrective actions for the findings.

Findings shall be monitored and the status of the corrective actions
shall be reported to SSIMS until resolved. This includes findings of all
surveys, inspections, reviews, or evaluations (including, but not
limited to, Headquarters Program Reviews, Field Element Surveys,
Automated Information System Security Surveys, TSCM Surveys, Security
Evaluations, Inspector General, and General Accounting Office Reports).

The tracking of findings is the responsibility of the Surveying Office
and the Lead Responsible Office. When the Surveying Office is different
from the Lead Responsible Office, timeliness and documentation of
findings/ratings is critical. The Surveying Office must notify the Lead
Responsible Office of findings. Similarly the Lead Responsible Office
must keep the surveying organization appraised of findings status.

NOTE: Findings may be assigned to an office other than the Lead
Responsible Office if they are specific to the other office\'s
interests.

Local tracking tools may also be used, especially for self-assessment
activities within facilities.

2\. REPORTING STATUS

When a survey report indicates a composite rating of Satisfactory but
the report contains findings requiring corrective action, the
responsible organization shall provide to the Director, Office of
Safeguards and Security, appropriate Headquarters elements, and the
surveying organi­zation (if appropriate), a quarterly status report of
corrective actions. Notification is made by memorandum to include the
identification of the facility, a description of the deficiency, and a
description of corrective actions taken or planned (with associated
milestone dates).

When either a Marginal or Unsatisfactory composite rating is assigned,
the Lead Responsible Office shall provide to the Director, Office of
Safeguards and Security, and the applicable field and Headquarters
program office(s), quarterly status reports on completed or planned
corrective actions (with associated milestone dates), until all have
been completed.

Once entered into the SSIMS, the Lead Responsible Office may update the
SSIMS daily, but must update the system quarterly. Quarterly updates
must be made by the Lead Responsible Office for each open finding and a
notification sent to the Assessment and Integration Branch when this
action has been completed. These quarterly updates shall occur by the
end of each January, April, July, and October. Notification may be by
electronic mail or written memorandum. Notification of these SSIMS
status updates to the other elements identified above will replace the
need for additional status reporting to those elements.

When the Lead Responsible Office determines that the com­posite survey
rating should be upgraded to Satisfactory, the surveying organization
shall physically verify the completion and adequacy of corrective
actions for those deficiencies which contributed to the Marginal or
Unsatis­factory composite rating. The Lead Responsible Office shall then
notify the Director, Office of Safeguards and Security, and the Head(s)
of applicable Headquarters Element(s) that the rating should be
upgraded. Depending upon the facility-specific organization of the
survey program, the Survey Team Leader may have a signifi­cant role in
survey follow-up activities.

3\. VALIDATION AND CLOSURE

The responsible and surveying offices must establish a procedure for
validating the satisfactory completion of corrective actions for
findings. Upon validation that the completed actions bring the program
element identified by the finding into compliance, the finding\'s status
may be closed.

The quality of the validation activity should be such to virtually
preclude a repeat finding in the program element. This is accomplished
by ensuring that the problem itself was fixed and that root causes for
the problem, such as procedures or training, have also been corrected.

Findings cannot be considered closed until associated corrective actions
have been verified as completed. A commitment by the facility to
implement a corrective action does not constitute completion of that
corrective action.

**H. ROOT-CAUSE ANALYSIS**

The Survey Team Leader is responsible for evaluating the survey results
and making an initial determi­nation as to which of the survey results
will be car­ried forward as findings. The purpose of declaring a finding
is to identify a shortfall of the facility safeguards and security
program that does not meet the intent of or comply with DOE
requirements.

It is important to determine if the finding is an isolated
single-point-failure or a broad systemic failure. Often, multiple
find­ings can be collected together and presented as a systemic finding.
If there is reason to believe that the survey has uncovered a systemic
failure, the survey team may perform a root-cause analysis. This
analysis may identify failures in other aspects of the S&S program, such
as management or training, which may need to be documented in the survey
report.

Root cause analysis should also be applied by the surveyed facility in
the development of corrective actions for identified deficiencies, to
ensure that systemic problems are corrected as well as the individual
manifestation(s) which resulted in a reported finding. For the same
reason, DOE Lead Responsible Offices and Surveying Offices might also
apply root cause analysis methods in the review and approval of
corrective action plans submitted by surveyed facilities, as well as in
the validation of the corrective actions identified as completed by
these facilities.

The root-cause is the most basic and elemental deficiency which, if
corrected, will prevent recurrence of the problem. The survey team
reviews the information collected for root-cause analysis for
thoroughness, including but not limited to:

 Activities related to the occurrence/trend;

 Whether the occurrence is an initial or a recurring problem;

 Associated hardware (equipment) or software (programs);

 Recent program or equipment changes; and

 Physical environment or circum­stances.

The initial phase of the analysis involves a determination of which of
the following methods is best suited for performing the analysis.

1\. Event and Causal Factor Charting Method - This is the most
comprehensive and effective method for solving complicated problems. A
block diagram is used to graphically display what is known and to
identify the questions to ask. The advantages to this block diagram
approach include:

 Providing a means for organizing the event data;

 Providing a concise summa­ry of what is known and unknown about the
event;

 A detailed sequence of facts and activities; and

 Simplifying the organization of the report.

2\. Pareto Analysis - This type of analysis helps to identify the
categories in which most of the problems occur. Using a comparison of
bar-graph data to reveal the rough ranking of problems by category type.

3\. Fault Tree Analysis - This is a tier-type systemat­ic approach that
is best used when the problem is known but the cause is not clear. This
meth­od uses a set of questions to help identify the root-cause. The
major advantage of this method is the reduced need for technical
expertise or reliance upon other subject matter experts.

4\. Kepner-Tregoe - This method identifies solutions to problems
identified by the survey team, by:

 Addressing the existing situation;

 Analyzing the apparent problems and their causes;

 Studying the problems that could develop when implementing changes;
and

 Deciding on the best solu­tion to the problem.

5\. Causal Diagram - This method provides a relatively fast and simple
way to gain the scope of the problem. This technique segregates data
into common categories of causes such as machinery, materials,
personnel, and methods. This method is quite vulnerable to subjective
manipulation by an individual and should, therefore, be undertaken using
a team ap­proach.

6\. Change Analysis - This method is best used when the problem is
obvious. This is a simple six-step process that is used for a single
event and focuses upon what elements have changed. This method
essentially compares the trouble-free activity with the problem event to
identify differences. These differences are then evaluat­ed to assess
their contribution to the event.

7\. Compliance Assessment - This simple process first places causes into
compliance and noncompliance categories. The survey team then further
reduces the non-compliance roster into three sub-categories of Knowledge
Issues, Resource Issues, and Decision Issues. These three categories are
also referred to as \'Don\'t Know,\' \'Can\'t Comply,\' and \'Won\'t
Comply.\' Once the team has placed noncompliance issues into the
subcategories it is relatively easy to determine the most appropriate
type of corrective action.

8\. Barrier Analysis - This method is a systematic process that can be
used for problems that appear to be programmatic. This method
identifies:

 Physical controls;

 Administrative controls;

 Procedural controls; and

 Other controls or barriers that should have prevented the event from
happening.

The Barrier Analysis method is best used to assess why the controls or
barriers have failed and what can be done to prevent recurrence.

9\. Human Performance Evaluation - This method is best used to identify
human performance prob­lems. This method examines the factors which
influence human performance, including:

 Environment;

 Communications;

 Training; and

 Experience.

The Survey Team should keep in mind that a pattern of non-compliance,
identified in the survey, probably indicates a systemic problem worthy
of further analysis to determine the root-cause.

**I. COST-BENEFIT ANALYSIS**

In considering actions which the surveyed facility might take to correct
deficiencies, one must consider the cost of correcting the problem
against the potential benefits of such action(s). Expenditures of large
amounts of funds for fixes which provide little, tangible improvement in
protection may not be appropriate; especially in today\'s fiscally
constrained environment. Such expenditures would have to be predicated
on vulnerability assessments or other risk assessment methodologies. In
such cases, the corrective action plan should include risk assessment
activities.

**CHAPTER IX. SELF-ASSESSMENTS**

DOE and contractor facilities are required to perform self-assessments.
Self-assessments provide internal monitoring of safeguards and security
programs and activities to assure compliance with safeguards and
security requirements. It has been determined that surveys conducted in
and by a DOE Surveying Organization, while meeting the requirement for
the survey program, also meet the requirement for the self-assessment of
that organization.

Self-assessments must include reviews of all applicable DOE F 5634.1
topical and subtopical areas of the facility\'s safeguards and security
program/system. For this reason, they may be conducted using the topical
and subtopical guidance of this Guide. The planning, conduct and other
survey activity guidance provided by this Guide may also be readily
applied to self-assessment, albeit on a generally smaller scale. Using
this Guide for self-assessments requires less document development for
the self-assessment program and provides a standard means of measuring
the safeguards and security program using the same methods applied by
the surveying office.

Self-assessments should be performed on an ongoing basis between the
periodic surveys conducted by the Surveying Office. This may be done
with a separate assessment program staff which, if necessary, can be
augmented by internal or external personnel. The assessments should be
conducted using knowledgeable programmatic or topical area personnel. It
may be advantageous to place extra emphasis on areas which were
deficient in past surveys and self-assessments.

Self-assessment should be an ongoing process at all levels of an
organization. They should be used as a management tool to determine
program effectiveness and to identify areas needing special attention.

Key elements of effective self-assessment programs include:

1\. Established basis and procedures

2\. Approved and implemented plans and \[annual\] schedules

3\. Formal reports of self-assessment activities

4\. Corrective action plans with meaningful milestones

5\. Accountability to corrective action plans

Self-assessment reports, which might resemble scaled-down survey
reports, will be written for all self-assessments and will:

1\. Address all applicable topical areas.

2\. Be used as organizational management tools/aids in determining the
status of safeguards and security performance and compliance with
applicable safeguards and security order requirements.

3\. Be available for review by the Surveying Office during the conduct
of surveys.

4\. List findings resulting from self-assessment activities.

Findings resulting from self-assessments must be:

1\. Reviewed during the surveys by the Surveying Office.

2\. Addressed by facility/organization management through a documented
corrective action plan.

3\. Reviewed and tracked until closed.

4\. Reported to the Lead Responsible Office if:

a\. a vulnerability to classified information or special nuclear
material results, or may result, in a significant anomaly which could
have significant programmatic impact or embarrass the Department; or

b\. the self-assessment is used to extend the Surveying Office\'s
periodic survey frequency.

5\. Documented in survey reports, at the discretion of the Surveying
Office, when deficiencies still exist and have not been adequately
addressed.

**ATTACHMENT 1. SAMPLE SURVEY PLAN FORMAT**

The following information should be included in the survey plan:

1\. Title of Survey

2\. Location of Facility

3\. Purpose of Survey

4\. Survey Dates

5\. Scope of Survey

a\. Objectives

b\. Topical Areas to be included/excluded

c\. Topical Areas with findings and observations from previous surveys

d\. Special areas/items of interest/concern

6\. Survey Conduct \-- Approach and Methodology

7\. General Facility Information/Description

a\. Facility Data

b\. Work/Activities Performed

c\. DOE Lead Responsible Organization

d\. Operating Organization \[Contractor\]

e\. Safeguards and Security Interests

f\. Work for Others or Other Security Interests

8\. Survey Planning and Preparation

a\. Performance Tests

b\. Survey Guide Information

c\. Pre‑Survey Visit Information

9\. Schedule of Activities

a\. Survey Schedule

b\. In-briefing Information

c\. Coordinating Instructions

d\. Out-briefing

e\. Schedule for Development of Report

10\. Team Composition/Assignments

a\. Team Members

b\. Assignments/Responsibilities

c\. Individual Survey Plans (which include references, survey conduct,
performance tests, subtopical areas to be inspected and topic schedules)

d\. Contractor Support

e\. Points of Contact at the Facility

f\. Validation of Potential Findings

11\. Authority/Governing Documents

a\. Directives

b\. References - Unclassified

\- Classified

12\. Survey Report

13\. Administration, Support and Logistics

a\. Work Facilities

b\. Transportation

c\. Computer Support

d\. Clerical Support

14\. Appendices

a\. Performance Tests

b\. Survey Guides

c\. Forms

**ATTACHMENT 2. SAMPLE SURVEY REPORT FORMAT**

The survey report must follow the format of the Safeguards and Security
Survey Report Form and should contain the following elements:

1\. Cover page (optional, but recommended)

2\. Table of Contents (optional)

3\. Ratings, Fully Annotated on DOE Form 5634.1

4\. Executive Summary

5\. Introduction

6\. Description of Facility and Safeguards and Security Interests

7\. Topical Description of Protection Program

a\. Program Management

\(1\) Program Management and Administration

\(2\) Program Planning

\(3\) Personnel Development and Training

\(4\) Facility Approval and Registration of Activities

\(5\) Foreign Ownership, Control or Influence (FOCI)

\(6\) Safeguards and Security Plans

\(7\) Surveys and Self Assessments

\(8\) Resolution of Findings

\(9\) Incident Reporting and Management

b\. Protection Program Operations

\(1\) Physical Security

\(2\) Security Systems

\(3\) Protective Force

\(4\) Security Badges, Credentials and Shields

\(5\) Transportation Security

c\. Information Security

\(1\) Classification Guidance

\(2\) Classified Matter Protection and Control

\(3\) Special Access Programs and Intelligence Information

\(4\) Classified Automated Information System Security

\(5\) Technical Surveillance Countermeasures

\(6\) Operations Security

\(7\) Unclassified AISS (optional)

\(8\) Protected Distribution System (optional)

\(9\) Communications Security (COMSEC) (optional)

d\. Nuclear Materials Control and Accountability

\(1\) Basic Requirements

\(2\) Material Accountability

\(3\) Material Control

e\. Personnel Security

\(1\) Access Authorization (Personnel Clearances)

\(2\) Security Education Briefings and Awareness

\(3\) Control of Visits

\(4\) Unclassified Visits and Assignments by Foreign Nationals

\(5\) Personnel Assurance Program

\(6\) Personnel Security Assurance Program

8\. Conclusions

9\. Synopsis of Findings

10\. Appendices (Optional)

a\. Performance Test Scenarios and Results

b\. Exhibits

**ATTACHMENT 3. REFERENCE LIST**

The following is a comprehensive listing of references for use with this
Guide. References found in this Guide will, to the extent feasible, use
the item number corresponding with the referenced document on this list.

1\. 10 CFR, Part 707, \"Workplace Substance Abuse Programs at DOE
Sites\"

2\. 10 CFR, Part 710, \"Criteria and Procedures for Determining
Eligibility for Access to Classified Matter or Significant Quantities of
Special Nuclear Material\"

3\. Title 10 CFR 1016, \"Safeguarding of Restricted Data,\" 8‑10‑83

4\. Title 10 CFR 1046, \"Medical and Physical Fitness Standards for
Protective Force Personnel\"

5\. Title 10 CFR 1047, \"Limited Arrest Authority and Use of Force by
Protective Force Personnel\"

6\. Title 42 U.S.C. 2011, et seq., \"Atomic Energy Act of 1954\"

7\. Title 48 CFR Chapter 9 (Department of Energy Acquisition Regulation
(DEAR))

a\. DEAR Subpart 904.70, \"Foreign Ownership, Control or Influence over
Contractors\"

b\. DEAR 952.204‑2, \"Security\" \[\'Security Clause\'\]

c\. DEAR 952.204‑70, \"Classification\" \[\'Classification Clause\'\]

d\. DEAR 952.204‑73, \"Foreign Ownership, Control or Influence (FOCI)
Over Contractor (Representation)\"

e\. DEAR 952.204.74, \"Foreign Ownership, Control or Influence (FOCI)
Over Contractor\" \[\'FOCI Clause\'\]

8\. DOE Acquisition Letter 92‑2, 3‑4‑92

9\. Executive Order 10865, \"Safeguarding Classified Information within
Industry,\" 2‑20‑60

10\. Executive Order 12333, \"United States Intelligence Activities,\"
12‑4‑81

11\. Executive Order 12958, \"Classified National Security
Information,\" 4‑17‑95

12\. Information Security Oversight Office Directive No. 1, 6‑25‑82

13\. Executive Order 12829, \"National Industrial Security Program,\"
1‑6‑93

14\. National Industrial Security Program Operating Manual, 1-95

15\. National Industrial Security Program Operating Manual Supplement,
2-95

16\. Director of Central Intelligence Directives (DCID) 1/7, \"Security
Controls on the Dissemination of Intelligence Information,\" 4-12-95

17\. DCID 1/14, \"Minimum Personnel Security Standards and Procedures
Governing Eligibility for Access to Sensitive Compartmented Information
(SCI),\" 1‑22‑92

18\. DCID 1/16, \"Security Policy for Uniform Protection of Intelligence
Processed in Automated Information Systems and Networks,\" 7‑19‑88

19\. DCID 1/19, \"Security Policy for Sensitive Compartmented
Information,\" 3-1-95

20\. DCID 1/20, \"Security Policy Concerning Travel and Assignment of
Personnel with Access to Sensitive Compartmented Information (SCI),\"
12‑29‑91

21\. DCID 1/21, \"Physical Security Standards for Sensitive
Compartmented Information Facilities (SCIF),\" 1‑30‑94

22\. DCID 1/22, \"Technical Surveillance Countermeasures,\" 7‑3‑85

23\. Public Law 100-235, Computer Security Act of 1987

24\. Federal Personnel Manual Letter 732-7, \"Personnel Security Program
for Position Associated with Federal Computer Systems\"

25\. National Security Decision Directive 145, \"National Policy on
Telecommunications and Automated Information Systems Security,\" 9-17-84

26\. Office of Management and Budget (OMB) Circular No. A-130,
\"Management of Federal Information Resources,\" 12-12-85

27\. OMB Bulletin 90-08, \"Guidance for the Preparation of Security
Plans for Federal Computer Systems That Contain Sensitive Information\"

28\. National Telecommunications Information Systems Security
Instruction, 3013, \"Operational Security Doctrine for the Secure
Telephone Unit III (STU-III) Type 1 Terminal\"

29\. National Telecommunications Information Systems Security
Instruction 7000, \"TEMPEST Countermeasures for Facilities\"

30\. National Telecommunications Information Systems Security Policy
300, \"National Policy on Compromising Emanations\"

31\. DOE 1240.2B, UNCLASSIFIED VISITS AND ASSIGNMENTS BY FOREIGN
NATIONALS, 8‑21‑92

32\. DOE 1324.5B, RECORDS MANAGEMENT PROGRAM, 1-12-95

33\. DOE 1330.1D, COMPUTER SOFTWARE MANAGEMENT, 5-18-92

34\. DOE 1360.1B, ACQUISITION AND MANAGEMENT OF COMPUTING RESOURCES,
1-7-93

35\. DOE 1360.2B, UNCLASSIFIED COMPUTER SECURITY PROGRAM, 5-18-92

36\. DOE 1360.3C, INFORMATION TECHNOLOGY STANDARDS, 10-19-92

37\. DOE 1360.6A, AUTOMATIC DATA PROCESSING EQUIPMENT/DATA SYSTEMS,
11-12-92

38\. DOE 1500.3, FOREIGN TRAVEL AUTHORIZATION, 11‑10‑86

39\. DOE 1800.1B, PRIVACY ACT, 8-31-84

40\. DOE 2030.4B, REPORTING FRAUD, WASTE, AND ABUSE TO THE OFFICE OF
INSPECTOR GENERAL, 5-18-92

41\. DOE 3410.1B, TRAINING, 2-29-88

42\. DOE 3510.1A, POSITION MANAGEMENT, 6-23-92

43\. DOE 3511.1A, POSITION CLASSIFICATION, 10-1-84; Change 1, 7-8-92

44\. DOE 4300.2C, WORK FOR OTHERS (NON‑DEPARTMENT OF ENERGY FUNDED
WORK), 12/28/94

45\. DOE 5300.1C, TELECOMMUNICATIONS, 6-12-92

46\. DOE 5300.2D, TELECOMMUNICATIONS: EMISSIONS SECURITY (TEMPEST),
5-18-92

47\. DOE 5300.3D, TELECOMMUNICATIONS: COMMUNICATIONS SECURITY, 8-3-93

48\. DOE 5300.4D, TELECOMMUNICATIONS: PROTECTED DISTRIBUTION SYSTEMS,
3-4-94

49\. DOE 5480.16A, FIREARMS SAFETY, 3-4-94

50\. DOE 5610.3, PROGRAM TO PREVENT ACCIDENTAL OR UNAUTHORIZED NUCLEAR
EXPLOSIVE DETONATIONS

51\. DOE 5610.11, NUCLEAR EXPLOSIVE SAFETY

52\. DOE 5610.14, TRANSPORTATION SAFEGUARDS SYSTEM PROGRAM OPERATIONS,
5‑12‑93

53\. DOE 5630.12A, SAFEGUARDS AND SECURITY INSPECTION AND ASSESSMENT
PROGRAM, 6-23-92

54\. DOE 5632.1C, PROTECTION AND CONTROL OF SAFEGUARDS AND SECURITY
INTERESTS, 7-15-94

55\. DOE M 5632.1C-1, MANUAL FOR PROTECTION AND CONTROL OF SAFEGUARDS
AND SECURITY INTERESTS, 7-15-94

56\. DOE 5632.7A, PROTECTIVE FORCE PROGRAM, 4-13-94; Change 1, 2-13-95

57\. DOE 5633.3B, CONTROL AND ACCOUNTABILITY OF NUCLEAR MATERIALS,
9-7-94

58\. GUIDE FOR IMPLEMENTATION OF DOE 5633.3A, CONTROL AND ACCOUNTABILITY
OF NUCLEAR MATERI­ALS, 4-95

59\. DOE 5633.3B GUIDE OF IMPLEMENTATION INSTRUCTIONS FOR NUCLEAR
MATERIALS MANAGEMENT AND SAFEGUARDS SYSTEM REPORTING AND DATA
SUBMISSION, 9-94

60\. DOE 5639.8A, SECURITY OF FOREIGN INTELLIGENCE INFORMATION AND
SENSITIVE COMPARTMENTED INFORMATION FACILITIES, 7‑23‑93

61\. DOE 5650.2B, IDENTIFICATION OF CLASSIFIED INFORMATION, 12-31-91;
Change 2, 4-28-93

62\. DOE 5670.1A, MANAGEMENT AND CONTROL OF FOREIGN INTELLIGENCE,
1‑15‑92

63\. DOE 6430.1A, GENERAL DESIGN CRITERIA MANUAL, 4-6-89

64\. DOE O 232.1, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS
INFORMATION, 9-25-95

65\. DOE M 232.1, MANUAL FOR OCCURRENCE REPORTING AND PROCESSING OF
OPERATIONS INFORMATION, 9-25-95

66\. DOE O 470.1, SAFEGUARDS AND SECURITY PROGRAM, 9-28-95

67\. DOE O 471.1, IDENTIFICATION AND PROTECTION OF UNCLASSIFIED
CONTROLLED NUCLEAR INFORMATION, 9-25-95

68\. DOE O 471.2, INFORMATION SECURITY PROGRAM, 9-28-95

69\. DOE M 471.2-1, MANUAL FOR CLASSIFIED MATTER PROTECTION AND CONTROL,
9-26-95

70\. DOE G 471.2-1, CLASSIFIED MATTER PROTECTION AND CONTROL
IMPLEMENTATION GUIDE, 11-95

71\. DOE M 5639.6A-1, MANUAL OF SECURITY REQUIREMENTS FOR THE CLASSIFIED
AUTOMATED INFORMATION SYSTEM SECURITY PROGRAM, 7-15-94

72\. DOE O 472.1, PERSONNEL SECURITY ACTIVITIES, 9-25-95

73\. Memorandum, Rowland (MA-254.3)/Jones (SA-10), \"Generic Security
Plans\--Secure Telephone Unit III (STU-III),\" 3-1-88

74\. Memorandum, Breault (DP-343.2), \"Use of STU-III Data Port for Data
Transmission,\" 8-18-89

75\. Memorandum, E. J. McCallum to Distribution, \"Verification of
Special Access Program Activities,\" 8-27-92

76\. Memorandum, D. A. Jones, \"Survey Coverage of Foreign Ownership,
Control or Influence,\" 6-7-94

77\. Memorandum, E. J. McCallum to Distribution, \"Facility Surveys and
Approvals of Sensitive Compartmented Information Facilities,\" 2-28-95

78\. Memorandum, E. J. McCallum, \"Reporting and Tracking of Survey
Findings and Corrective Actions,\" 3-28-95

79\. DESIGN BASIS THREAT POLICY FOR THE DEPARTMENT OF ENERGY PROGRAMS
AND FACILITIES, 9-7-94

80\. DOE SECURITY CONTAINER AND LOCKING DEVICE GUIDE, 12-9-93

81\. TECHNICAL SURVEILLANCE COUNTERMEASURES PROCEDURAL MANUAL, 10-94

82\. TECHNICAL SURVEILLANCE COUNTERMEASURES (TSCM) ACTIVITY REPORT
WRITING GUIDE, 9-91

83\. DOE OPERATIONS SECURITY PROCEDURAL GUIDE, Second Edition, 10-92.

84\. DOE INFORMATION TECHNOLOGY SYSTEMS EMISSIONS CONTROL MANUAL, Part
1, 6-94

85\. DOE PROTECTED DISTRIBUTION SYSTEM (PDS) MANUAL, 4-94

86\. DOE COMMUNICATIONS SECURITY PROCEDURAL GUIDE, 7-91 (Rev 4, 1-93)

87\. DOE TEMPEST Threat Assessment Precepts Memorandum, 1-24-90

88\. CLASSIFICATION GUIDE FOR SAFEGUARDS AND SECURITY INFORMATION,
CG-SS-3, 8-94

89\. SAFEGUARDS AND SECURITY STANDARDS AND CRITERIA, 12-1-93.

90\. MATERIAL CONTROL AND ACCOUNTABILITY (MC&A) INSPECTORS GUIDE, 1-94.

**ANNEX A. TOPICAL AREA SURVEY GUIDE: PROGRAM MANAGEMENT**

**[I.]{.underline} [INTRODUCTION]{.underline}**

This topical area deals with the planning and management of the
safeguards and security program. The survey of this topical area will
examine the facility\'s planning process(es), organization and
management (looking for indications of strong management support and
effective long and short term strategic planning).

The effectiveness with which Operations Offices and contractors manage
Safeguards and Security Programs, through the implementation of
established DOE policies, directly impacts the overall success of those
programs. Management activities used to protect DOE assets will
determine the level of success achieved in each of the areas included in
the Safeguards and Security Program. The Program Management section
addresses nine key elements in Safeguards and Security: 1) program
management and administration; 2) program planning; 3) personnel
development and training; 4) facility approval and registration of
activities; 5) foreign ownership, control or influence (FOCI); 6)
safeguards and security plans; 7) surveys and self-assessments; 8)
resolution of findings; and 9) incident reporting and management.

The Program Management topical area\'s main function is to ensure that
facility management supports the safeguards and security program and
that proper planning is completed to ensure that adequate resources are
available for the implementation of the protective measures.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

53, 66.

**[Subtopical Areas]{.underline}**

The following subtopical areas comprise this topical area:

A. PROGRAM MANAGEMENT AND ADMINISTRATION

B. PROGRAM PLANNING

C. PERSONNEL DEVELOPMENT AND TRAINING

D. FACILITY APPROVAL AND REGISTRATION OF ACTIVITIES

E. FOREIGN OWNERSHIP, CONTROL OR INFLUENCE (FOCI)

F. SAFEGUARDS AND SECURITY PLANS

G. SURVEYS AND SELF-ASSESSMENTS

H. RESOLUTION OF FINDINGS

I. INCIDENT REPORTING AND MANAGEMENT

**[II.]{.underline}** **[PROGRAM MANAGEMENT AND
ADMINISTRATION]{.underline}**

DOE Operations and Field Office managers and DOE contractor facility
managers are assigned the responsibility for the development,
implementation, and maintenance of the safeguards and security (S&S)
programs. DOE requires that these responsibilities be assigned in
writing and maintained at the responsible DOE organization.

The management and administration of S&S programs are generally
evaluated through document reviews, interviews, and observations.
Documentation may take the form of appointment letters, memoranda for
record, memoranda of understanding, DOE order supplements, site specific
procedures, standard operating procedures, or employee position
descriptions. For the S&S programs to be effective, management support
is critical. This support is usually indicated by documents promulgated
by management and correspondence relative to S&S activities. Also,
management\'s participation in briefings, reporting activities, and
correspondence relative to the S&S activities are all indicators of
management support.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

41, 42, 43, 66.

**[Survey Content]{.underline}**

It is essential that individuals assigned to perform management
responsibilities be qualified and knowledgeable in the S&S programs they
are overseeing. It is also essential that the Safeguards and Security
organization be at a high enough organizational level to effect S&S
policy and requirements on the operating organizational elements.
Adequate funding and the availability of sufficient supplies and
equipment are important elements in a successful S&S program. These
areas can be reviewed by examining budget documents and proposals that
identify expenses related to S&S program requirements. A review can
determine whether appropriate equipment and materials are in place and
accessible to the S&S program staff.

**[Documentation]{.underline}**

Document review in the Management and Administration subtopical area is
very important to understanding how the S&S organization functions. The
following types of documents for both the Contractor and DOE should be
carefully reviewed and validated.

 Organization diagrams depicting the management structure

 Documents depicting responsibilities and authorities of S&S management

 Position descriptions for S&S management positions

 Operating instructions for the implementation of S&S programs

 Supplemental Orders/Directives implementing S&S programs

The existence of other documents which further delineate the Management
of the S&S program may be derived from the review of these initial
documents.

The survey team must be thoroughly familiar with the purpose of each
document reviewed. The requirement for the document should be compared
with the finished product, and an assessment made of the adequacy of the
document in complying with the requirement.

The team should review all ancillary documents or records associated
with the major document under review. The review should be aimed at
determining whether commitments made are accurate for the current
operating condition, or whether omissions have occurred. The documents
should be scrutinized for understatements and overstatements.

Documents should be used as the basis for determining whether management
supports the S&S program in a manner which demonstrates both compliance
with the requirements and a commitment to performance which assures the
adequate protection of national security assets.

Prior to the actual site visit, documentation needs to be requested and
received from the facility to be surveyed, including the Site Safeguards
and Security Plan (SSSP) or, if not applicable, the Site Security Plan
(SSP). Additional documentation, such as budgets, may be requested while
conducting the on-site survey activities.

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted, as appropriate,
with the following:

 DOE Operations/Field/Area Office Manager,

 DOE Assistant Manager or Director responsible for S&S,

 Individual DOE S&S Program Managers,

 DOE and contractor management assigned responsibility for developing
and implementing the Program Management and Administration for the S&S
program,

 Contracts and Procurement Department management,

 Budget and/or Finance Department management,

 Human Resources Department management,

 Security management assigned responsibility for developing and
implementing the S&S programs,

 Property management.

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure the
effectiveness of the programs. The documentation in place can be used to
determine how well management requirements have been implemented, to
include, for example, the lack of resources or other previously
identified deficiencies have been resolved. A determination of the
programmatic guidance and forecasts of significant changes planned in
site operations can be identified. The current and projected operational
constraints and resources shall also be identified. Other forms of
measurement may also be developed to assist the survey team in
determining the effectiveness of the management of the S&S programs.

**[III.]{.underline} [PROGRAM PLANNING]{.underline}**

Program planning is the basis for the implementation and oversight of
the S&S programs at each DOE facility. Its main function is to ensure
that facility management supports the S&S programs and that proper
planning is completed to ensure that adequate resources are provided for
the implementation of protective measures. The survey team should
examine the process used by the facility to develop and maintain the S&S
plans. The capability of that process to identify new and changed
requirements and to incorporate those requirements in a timely manner
should also be assessed.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

53, 66.

**[Survey Content]{.underline}**

The following specific elements should be used for validating the
adequacy of the planning process.

 Safeguards and security management organizations initiate planning
procedures and actions that support the orderly and timely
accomplishment of S&S policy requirements.

 To achieve S&S program requirements, required S&S plans are developed
and implemented.

 Planning documents define short and long term goals, describe
milestones, indicate start and finish times using schedules, and
identify resources required.

 Operations Office survey reports are used by management to assess the
status of S&S and to ensure implementation of corrective actions as
required.

**[Documentation]{.underline}**

The following are representative of the documents which should be
reviewed. Additional documents which must be reviewed will arise from
these.

 Site Safeguards and Security Plan (SSSP) or Site Security Plan (SSP)

 Emergency Plan

 Contingency Plan

 Procedures

 Notes of Conference or Minutes of Regularly Scheduled S&S Management
Meetings (e. g., Operations Security (OPSEC) Council, Management
Council, Local Law Enforcement Liaison)

 Agendas for S&S Management Meetings

 Schedule of Meetings for Fiscal or Calendar Year

 Operations Office Survey Reports

The survey team must be thoroughly familiar with the purpose of each
document reviewed. The requirement for the document should be compared
with the finished product, and an assessment made of the adequacy of the
document in complying with the requirement.

**[Interviews]{.underline}**

The following personnel should be interviewed, as appropriate, and other
site personnel associated with the planning process should be added as
they are identified.

 DOE Operations/Field/Area Office Manager,

 DOE Assistant Manager or Director responsible for S&S,

 DOE Division Director(s) responsible for S&S-related activities,

 Individual DOE S&S Program Managers,

 Contractor Senior Management with line responsibility for S&S
activities

 Contractor S&S Director

 Contractor Program Managers responsible for S&S related activities

 Protective Force Managers

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure how
effective the program planning is. The documentation in place can be
utilized to determine how effectively it has been implemented. The
programmatic guidance and forecasts of planned significant changes in
site operations can be identified. The current and projected operational
constraints and resources shall also be identified. Other forms of
measurement may also be developed to assist the survey team in
determining the effectiveness of the planning of the S&S programs.

**[IV.]{.underline}** **[PERSONNEL DEVELOPMENT AND
TRAINING]{.underline}**

DOE and DOE contractor personnel involved in DOE S&S programs and
activities shall be trained to a level of proficiency and competence
that provides high assurance that the S&S programs are successful. The
scope and level of training provided to individuals shall be tailored to
their assigned duties and responsibilities and shall be based upon an
analysis of their prior safeguards and security experience and training.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

66\.

**[Survey Content]{.underline}**

The S&S training programs shall be based on the results of job task
analyses to document the review and codification of major tasks and
skill requirements identified as a result of those analyses.

Knowledge and performance-based testing shall apply to all required
training to measure the skills acquired from the training programs
developed.

For specialized skill requirements, i.e., personnel security, nuclear
material custodians, and technical security specialists, performance
testing will form the primary basis for certification.

The training approval program shall be developed and implemented to
assure that S&S training conducted at DOE facilities meets established
standards.

**[Documentation]{.underline}**

The following are representative of the documents which should be
reviewed. Additional documents which must be reviewed will arise from
these.

 Site Safeguards and Security Plan (SSSP) or Site Security Plan (SSP)

 Procedures

 Agendas for S&S Management Meetings

 Schedule of Meetings for Fiscal or Calendar Year

 Operations Office Survey Reports

 Training records

 Training courses being offered

These documents should be used as the basis for determining whether
training is being conducted for the S&S program in a manner which
demonstrates both compliance with the requirements and a commitment to
performance which assures the adequate protection of national security
assets.

**[Interviews]{.underline}**

The following personnel should be interviewed at a minimum, and other
site specific personnel who are associated with the planning process
should be added as they are identified.

 S&S Division Director, if appropriate

 DOE Division Director(s) responsible for S&S-related training
activities, if appropriate

 Individual DOE S&S Program Managers, as appropriate

 Contractor S&S Director

 Contractor Program Managers responsible for S&S training activities

 Protective Force Managers

 Training coordinator(s)

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure the
effectiveness of the training program. The documentation in place and
how well it has been developed can be used to determine how effectively
it is being followed. Other forms of measurement may also be developed
to assist the survey team in determining the effectiveness of the
training activities for the S&S staff.

**V. [FACILITY APPROVAL AND REGISTRATION OF ACTIVITIES]{.underline}**

The Facility Approval Program establishes a process to determine that a
facility is eligible to have access authorizations or to receive,
produce, use, or store classified matter, nuclear material, or DOE
property. Facility approval is based on a determination that
satisfactory safeguards and security measures are in place.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

44, 66 and 89.

**[Survey Content]{.underline}**

Special nuclear material, classified matter, and property protection
interests shall not be permitted on premises occupied by the Department
or covered contractors until a facility approval is granted. S&S
interests involving access authorizations, classified information,
special nuclear materials, and property shall be registered to assure
proper levels of protection of these interests.

Facility approval shall be based upon a determination that required S&S
can be afforded the activities.  The determination of a valid facility
approval shall be based upon approved S&S plans, results of S&S facility
surveys and a favorable FOCI determination.

**[Documentation]{.underline}**

The following types of documents for all contractors, subcontractors,
and consultants should be carefully reviewed and validated against
current contracts and operational requirements.

 Current contract to include Statement of Work

 List of all subcontractors and consultants conducting work for
Contractor being surveyed

 Facility Security Plan

 Deviations to DOE directives

 Master facility registration, in the SSIMS, and local facility
registration listings (if used)

 Previous survey reports

 List of facility personnel responsible for security

 List of cleared personnel, to include clearance number and date of
latest background investigation

 List of all activities conducted at site under the scope of the
contract

 List of classified holdings, to include documents and matter

 Internal procedures

 Applicable Memorandums of Understanding/Agreement

**[Interviews]{.underline}**

The following personnel should be interviewed as appropriate, and other
site specific personnel who are associated with the facility approval
process should be added as they are identified.

 DOE S&S Division Director, if appropriate

 DOE Division Director(s) responsible for S&S-related facility approval
activities, if appropriate

 DOE and Contractor Contracts and Procurement Managers

 DOE S&S Program Managers

 Contractor S&S Director

 Contractor Program Managers with S&S facility approval responsibility

**[Performance Measures]{.underline}**

The following specific elements should be used for validating the
adequacy of the facility approval process.

 Procedures are in place to assure that all facilities eligible to
receive, process, reproduce, store, transmit, destroy, or handle
classified matter, to include nuclear materials, have been granted
facility approval prior to permitting these types of materials on the
premises.

 An accurate Facility Register (SSIMS) contains all S&S facilities
under the administrative or survey responsibility of an Operations
Office.

 Facility approvals and activity registrations are appropriately
documented and supported by surveys, plans, and corrective actions, and
are consistent with national security interests.

 Facility terminations are supported by surveys or appropriate
documentation and are consistent with national security interests.

 Surveys are conducted and reports submitted within established time
frames, and corrective actions are monitored against established
milestones.

**WORK FOR OTHERS (NON‑DEPARTMENT OF ENERGY FUNDED WORK)**

An area of Registration of Activities which has required special
attention is Work for Others (WFO). Work for Others is work performed
for non‑DOE entities that utilizes DOE facilities or contractor
personnel and is not directly funded, in whole or in part, by DOE. WFO
is covered in DOE 4300.2C, WORK FOR OTHERS (NON‑DEPARTMENT OF ENERGY
FUNDED WORK), dated 12-28-94.

Intelligence‑Related Work for Others is WFO which includes any of the
following:

Work sponsored by an organization specifically identified in Executive
Order 12333 as an intelligence organization, or

Work funded by either the National Foreign Intelligence Program (NFIP)
or the Tactical Intelligence and Related Activities (TIARA) Program, or

Work for which the cognizant technical DOE Headquarters official is the
Director, Office of Energy Intelligence (NN‑30).

DOE facilities and resources may be made available for the performance
of work for non‑DOE entities. Such work can only be undertaken when a
determination of the following has been made and certified in writing by
the responsible Contracting Officer:

Is consistent with and complementary to DOE\'s mission and the mission
of the organization to which the work is to be assigned;

Would not adversely impact completion of DOE projects at the facility;

Would not place the facility in direct competition with the domestic
private or public sectors;

Would not create a potentially detrimental future burden on the
commitment of DOE resources;

Is consistent with the legislative authority of the Department; and

Is consistent with established standards for humane treatment of human
or animal subjects involved in research or other activities of the
Government.

Contracts sends WFO requests to the Safeguards and Security organization
responsible for the S&S interest.

Work for Others activities are registered at DOE Headquarters.

All proposed intelligence‑related WFO projects are forwarded to NN‑30,
for validation as intelligence‑related and, as appropriate,
certification and acceptance.

An annual summary WFO report is required for each DOE facility
performing WFO. This report must be received by the cognizant
Secretarial Officer and the Assistant Secretary for Human Resources and
Administration, not later than December 10 following the fiscal year
reported.

Heads of DOE Field Elements assure that Work for Others under their
jurisdiction is protected in accordance with applicable DOE safeguards,
security, and classification policies, including the Site Security Plan
or a supplemental security plan specific to the WFO project. Before the
commencement of WFO, they review the work request and certify that the
sponsoring organization has either provided the appropriate
classification guidance or has stated in writing that the work will not
entail classified information or activities. Also, prior to the
commencement of work involving classified matter or special nuclear
materials, they ensure that the WFO has been registered as a security
interest, in accordance with DOE O 470.1, SAFEGUARDS AND SECURITY
PROGRAM.

A project file information documenting policy compliance is maintained
by the DOE and/or each performing contractor. A project summary listing
of information on each active Work for Others project is also
maintained, which should include:

Field points of contact

Total estimated costs

Sponsoring Agency

Project Title/Description

Establish Start/Completion dates

Assigned laboratory/contractor

DOE places reliance on DOE-approved contractor systems and procedures
for implementation of DOE policy and control of WFO projects. The extent
of this reliance depends on factors such as the following:

Management and technical oversight performed by the sponsor.

Size, sensitivity and duration of the project.

Past performance of the contractor.

Environment, safety, health and waste management implications.

Financial and cost status of the project.

Issues and/or problems that arise during the project.

Special arrangements covered in a memorandum of understanding or
statement of work.

A memorandum of understanding between the DOE Responsible Office and the
sponsor should establish whether DOE policy and requirements or the
sponsor organization\'s requirements will be used. This will include
responsibility and requirements for DOE oversight, including periodic
surveys.

These written agreements will typically have a strong Contracts
involvement, to ensure that appropriate methods for back-charging DOE\'s
costs, including oversight and surveys, to the sponsor have been
established.

Work for Others projects should be surveyed during periodic surveys in
the facility and a survey report, by letter or other agreed-to format,
supplied to the sponsor(s) of each project. Termination surveys and
project closeout should also be accomplished and reported to the
sponsor. In addition to the Program Management aspects of WFO, discussed
above, the topical and subtopical guidance applicable to each project
should be used in the planning and conduct of surveys of Work for Others
projects.

**VI. [FOREIGN OWNERSHIP, CONTROL OR INFLUENCE]{.underline}**

DOE\'s Foreign Ownership, Control or Influence (FOCI) program is
designed to obtain information that indicates whether DOE
offerors/bidders or contractors/subcontractors are owned, controlled or
influenced by foreign individuals, governments or organizations, and
whether that foreign involvement may pose an undue risk to the common
defense and security,

When DOE solicits bids or proposals (i.e., a contract, subcontract,
agreement or use of an individual consultant who will be permitted to
further contract the consultant work) requiring access authorizations, a
FOCI submission is required of the offerors/bidders and all tier
parents, if applicable. A FOCI submission consists of answers to an
eleven-part questionnaire (i.e., the FOCI representations), a
certification of its accuracy and back-up or explanatory information.

DOE examines the foreign involvement of the successful bidder and its
tier parents, if applicable, to ensure appropriate resolution of matters
determined to be of national security significance.

A favorable FOCI determination must be rendered prior to the award of
affected contracts/agreements and prior to granting facility approval.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

3, 6, 7, 8, 9, 11, 13, 14, 15, 31, 38, 44, 53, 66, 68, 69, and 76.

**[Survey Content]{.underline}**

Prior to the survey, verify with the FOCI Operations Manager from the
Lead Responsible Office, that a FOCI determination has been rendered on
the contractor and, if applicable, all its tier parents, to include
whether there are any new or unresolved FOCI issues. Provide, in the
survey report, the date the above information was obtained and the title
and organization of the person from which you obtained this information.
Also, obtain a copy of the following for use in verifying whether any
significant changes have occurred or anticipated changes are expected to
occur: (a) the FOCI determination on the contractor; (b) if applicable,
the FOCI determinations(s) on its parent organization(s); and (c) the
most current lists(s) of OODEPs (owners, officers, directors, and
executive personnel).

In addition, note any exclusion actions DOE required be taken by formal
action of the governing body, e.g., exclusion of certain officers,
directors or parent organizations, for use in verifying whether the
contractor is complying with the exclusion procedures and that all
required forms, e.g., Nondisclosure Certificate, have been executed. The
report should state how this was verified.

Reports should also identify the company records that were reviewed to
verify that no significant changes have occurred or are anticipated to
occur. The documents identified below should be reviewed to verify the
accuracy and completeness of the information previously provided to DOE,
and individuals within the organization that you can contact with
questions on this information. Inspectors are encouraged to request the
identified information with the most recent FOCI determination. In
addition, inspectors are encouraged to notify the contractor prior to
the start of the survey, of the corporate personnel that will be
interviewed during the survey.

When the contractor is controlled by a parent organization(s) excluded
from all access to DOE classified information and/or nuclear material,
survey reports should provide the date(s) of contact and the name(s) of
the individual(s), with their title and organization, that were
contacted to determined that no significant changes have occurred, or
anticipated changes are expected to occur, which would affect the
excluded parent(s)\'s previous FOCI representations, to include any
change in ownership or control. The survey report should describe how
the above was verified.

The survey team should determine whether the company has subcontracted
work requiring access authorizations to any other company(ies) or
consultant(s). If so, obtain identifying information on each such
subcontractor and determine whether a FOCI determination has been
rendered.

Obtain identification of all companies with which the contractor has
entered into contracts or subcontracts requiring access authorizations.
Provide the name(s), title(s) and organization(s) of the individual(s)
providing this information and demonstrate how you verified that each of
the identified companies has a FOCI determination.

Inspectors are encouraged to obtain the above information prior to the
start of the survey in order to verify determinations.

During the survey, or as part of the pre-survey data collection, the
following should be obtained from the Facility Security Officer:

 A current list of all OODEPS, signed and dated by an OODEP, which
designates by name all OODEPs and designates those individuals
possessing or in the process of obtaining a DOE personnel security
clearance. This list should be compared with the latest OODEP list
provided to the FOCI Operations Manager from the Lead Responsible Office
to ensure he/she is in possession of the most current list of OODEPs.

Verify with the Facility Security officer and by reviewing the
company\'s latest Proxy Statement and/or minutes of Board Meetings that
the list is current and complete.

 A list of all employees of the company possessing or in the process of
obtaining DOE personnel security clearances who are Representatives of
Foreign Interests (RFI).

Determine if a Representative of Foreign Interest Statement has been
provided to the appropriate DOE office for each employee of the company
possessing or in process of obtaining a DOE personnel clearance who
becomes an RFI or whose status as an RFI changes in a manner that would
make him/her ineligible for a personnel clearance.

 A list of all OODEPs of the organization possessing or in the process
of obtaining DOE personnel security clearances who hold interlocking
positions with an excluded parent organization.

Determine if the Nondisclosure Certificate has been provided to the
appropriate DOE office for each such interlocking OODEP.

The report should illustrate how you verified the above.

During the survey, or as part of the pre-survey data collection request,
the following should be obtained from the Treasurer:

 The number of loan or credit agreements the organization has entered
into with lenders or which it guarantees for its wholly- and
majority-owned subsidiaries or any of its affiliates.

 For each identified loan or credit agreement, obtain the names,
country location, and participation amount of each of the lenders
involved; as well as the aggregate amount of the loan or credit
agreement.

Obtain a list from the company of all individuals possessing or in
process of obtaining DOE security clearances. Determine whether all such
individuals are in fact employees of the company. Also compare the list
with the current OODEPs list to determine whether the OODEPs list
reflects the correct DOE personnel clearance information.

During pre-survey planning you can obtain a list from the DOE Central
Personnel Clearance Index (CPCI) of access authorizations held by the
contractor. The CPCI and contractor lists, including current OODEPs
list, should be compared for discrepancies.

Determine whether requests transmitted to the CPCI reflect the true
employer identification of the individual and that security clearances
are terminated when required, e.g., individual is no longer an employee
of the company, classified contract has ended, individual is out of the
country for more than 3 months.

**[Documentation]{.underline}**

During a FOCI survey the following documents are required for review:

From the Lead Responsible Office:

1\. The completed FOCI questionnaire

2\. The OODEP List

3\. The FOCI Determination

From the contractor(s):

1\. A listing of all security clearances being held by the contractor,
including all contractors have cleared employees conducting work at the
facility

2\. A list identifying any other organization conducting work at the
facility and personnel security clearances requested for each of their
respective organizations.

3\. A copy of the contractor\'s records of all contracts and
subcontracts involving access authorizations

4\. A copy of the contractor\'s procedures implementing FOCI

5\. Company visitor\'s log

6\. Requests for visits from foreign nationals

Corporate Records:

1\. Loan or Credit Agreements (if applicable)

2\. Board of Director\'s meetings minutes

3\. Copies of all Schedules 13D and 13G submitted to the Securities and
Exchange Commission (SEC), if publicly traded

4\. Annual Report and/or Financial Statement of the company

5\. List of all contracts and subcontracts

**[Interviews]{.underline}**

Facility Security Officer \-- Point of contact for the company\'s FOCI
representations and information on foreign citizens with access to
classified information or SNM and on foreign visits and assignments

Facility Procurement and Contracting Officer \-- Point of contact for
records of all contracts and subcontracts

Corporate Secretary \-- Point of contact for the organization\'s owners;
any changes that may have occurred in company\'s business, management,
or ownership of subsidiary/parent (that is, the creation of an
intermediate parent; and information on whether the company has acquired
ownership in foreign corporations

Chief Financial Officer or Treasurer \-- Point of contact for
information on revenue/income derived from foreign interests, and loan
or credit agreements entered into with foreign lenders

**[Performance Measures]{.underline}**

A FOCI survey has five major goals.

1\. To determine whether the contractor received a favorable FOCI
determination.

2\. To verify the accuracy of the answers to the eleven questions, that
the certification has been signed, and supporting documentation has been
submitted.

3\. To determine whether any significant changes have occurred.

4\. To determine the contractor\'s familiarity with the reporting
requirements, e.g. significant changes.

5\. To determine whether five years have elapsed since the contractor\'s
last full FOCI submission.

The following reviews will assist in making this determining whether the
above listed five goals are being met:

1\. Review copies of all Schedule 13D and/or Schedule 13G reports which
have been received from any investors.

2\. Review shareholders agreements to determine if amount of stock is
sufficient to elect representation to the Board or an agreement exists
whereby the shareholder(s) is permitted representation on the board,
currently or at a future date.

3\. Review Proxy Statements (Notice of Annual Meeting of Stockholders)
to determine: (a) current beneficial owners of 5 percent or more of the
company\'s securities; (b) changes to the company\'s directors; (c)
changes in location of its principal executive offices, state of
incorporation, the company\'s business, management, proposed mergers,
etc.

4\. Review Annual Report and SEC Form 10-K Report to determine: (a)
changes in revenue/income derived from foreign interests; (b) loan or
credit agreements entered into with foreign lenders or in which foreign
lenders are participants; (c) joint ventures/contracts with foreign
interests, etc.

5\. Review negative covenants in loan or credit agreements to determine
if any power has been granted the lender.

6\. Review minutes of Board meetings to determine if any actions taken
by the Board resulted, or will result, in changes which should be
reported to DOE. This could be a change in management (OODEPs), loan or
credit agreements with foreign lenders, formation of company(ies)
located in foreign countries, etc.

7\. Review IRS Form 5471\'s to determine whether all foreign holdings
were reported.

8\. Review Articles of Incorporation and By-Laws or Partnership
Agreement to determine if any changes have been made to the
company\'s/partnership\'s business, management, etc.

NOTE: The following reflects which of the above-mentioned documents
apply to the different type of business entities:

 Sole proprietor, divisions of a legal entity, or self-employed
consultant \-- none of the above documents would apply, except negative
covenants in loan or credit agreements.

 Publicly traded \-- all of the above documents.

 Privately owned \-- will not normally have any of the documents
required to be submitted to the Securities and Exchange Commission,
i.e., Schedule 13D and/or Schedule 13G and Form 10-K Report. However, if
they have issued bonds or debentures, the organization is required to
file a Form 10-K Report with the SEC.

**VII. [SAFEGUARDS AND SECURITY PLANS]{.underline}**

A review needs to be conducted of all the facility\'s S&S plans to
determine their adequacy of development and compliance with the site\'s
requirements.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

66\.

**[Survey Content]{.underline}**

The following specific materials should be used for validating the
adequacy of the planning process.

 Approved MSSAs, SSSPs or SSPs exist for those facilities that possess,
process, use, or store Special Nuclear Materials (SNM).

 Planning documents indicate that DOE S&S interests are identified and
protected at required levels, and that strategies used to implement
protection measures are accurately described.

 Site S&S plans are developed consistent with site/facility
vulnerabilities as identified in vulnerability analysis reports.

 Site S&S plans and procedures are validated on a recurring basis using
approved documented performance tests.

 Site S&S plans are aligned with the budget process.

**[Documentation]{.underline}**

Document review in the Safeguards and Security Plans subtopical area is
paramount to understanding the adequacy of the S&S planning process. The
following types of documents for both the Contractor and DOE should be
carefully reviewed and validated against current operations.

 Site Safeguards and Security Plan (SSSP) or Site Security Plan (SSP)

 Vulnerability Assessment Reports

 Emergency Plan

 Contingency Plan

 Materials Control and Accountability Plan

 AISS Security Plan

 OPSEC Master Plan

 Classified Telecommunications Plan

 Sensitive Compartmented Information Facility Plan

 S&S Training Plan

**[Interviews]{.underline}**

Meetings should be scheduled as far in advance as possible since most
will be with management personnel. The following personnel should be
interviewed, as appropriate, and other site specific personnel who are
associated with the planning process should be added as they are
identified.

 DOE Management responsible for S&S plans, as appropriate

 S&S Division Director, if appropriate

 Individual DOE S&S Program Managers, as appropriate

 Contractor S&S Director

 Contractor Program Managers responsible for S&S related plan
activities

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure how
effectively the S&S plans are being implemented. Other forms of
measurement may also be developed to assist the survey team in
determining the effectiveness of the S&S planning.

**VIII. [SURVEYS AND SELF-ASSESSMENTS]{.underline}**

The Survey and Self-Assessment Programs encompass on-site examinations
of the safeguards and security measures implemented for the protection
of DOE S&S facilities, activities, and interests. S&S surveys and
self-assessments provide assessments of adequacy and effectiveness, and
are conducted by DOE and contractor personnel to ensure compliance with
the requirements of DOE Orders and related S&S directives.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

66 and 78.

**[Survey Content]{.underline}**

The following specific elements should be used for validating the
adequacy of the survey and self-assessment program.

 Survey and self-assessment programs are conducted and documented for
all approved facilities.

 The surveys and self-assessments are conducted at required intervals.

 The surveys and self-assessments are conducted by qualified
programmatic or topical area personnel.

 The surveys and self-assessments address all topical areas related to
the site.

 The program is used by management to determine the status of
compliance with S&S requirements and for site-wide planning purposes.

 Results of surveys (findings, ratings and corrective actions) are
entered into the SSIMS promptly and correctly.

 Findings and associated corrective actions are validated, tracked, and
closed according to established procedures and milestones.

**[Documentation]{.underline}**

Document review in the Survey and Self-Assessment Programs should
provide insight into the management perception of and support for the
programs. The following types of documents for all contractors,
subcontractors, and consultants should be carefully reviewed and
validated against current operations.

 Survey and Self-Assessment Program Plans

 Implementing Procedures

 Survey and Self-Assessment Reports

 Corrective Action Plans

 Validation and Closing Procedures

**[Interviews]{.underline}**

The following personnel should be interviewed at a minimum, and other
site specific personnel who are associated with the planning process
should be added as they are identified.

 DOE management responsible for S&S survey and self-assessment programs

 S&S Division Director, if appropriate

 DOE Division Director(s) responsible for S&S-related survey and
self-assessment activities, if appropriate

 Individual DOE S&S Program Managers

 Contractor S&S Director

 Contractor Program Managers responsible for S&S related
self-assessment activities

 Protective Force Managers

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure how
effectively the S&S survey and self-assessment programs have been
implemented. Other forms of measurement may also be developed to assist
the survey team in determining the effectiveness of the S&S survey and
self-assessment programs.

**IX. [RESOLUTION OF FINDINGS]{.underline}**

Self-assessments, surveys, and inspections may result in the
identification of discrepancies or findings in the S&S program at a
facility. The management must ensure that the findings from these
reviews are documented properly, monitored, and resolved in a timely
manner.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

66 and 78.

**[Survey Content]{.underline}**

The following specific elements should be used for validating the
adequacy of the Resolution of Findings.

 Formal, current plans are to be developed and implemented to achieve
S&S program requirements.

 Short and long term goals, to include specific corrective actions,
milestones, start and completion dates are to be identified.

 Identification of resources necessary to resolve identified findings.

 Documented budget process to support corrective action plans.

 Formal, documented procedures for the resolutions of findings.

**[Documentation]{.underline}**

Document review in the Resolution of Findings subtopical area provides
the current status, management support and direction for correcting
identified S&S program deficiencies. The following types of documents
for all contractors, subcontractors, and consultants should be carefully
reviewed and validated against current operations.

 Survey Reports

 Self-Assessment Reports

 Corrective Action Plans

 Implementing Procedures

 Validation and Closing Procedures

 Documented budget for S&S.

Documents should be used as the basis for determining the degree and
extent of management involvement with the Resolution of Findings
process.

**[Interviews]{.underline}**

The following personnel should be interviewed at a minimum, and other
site specific personnel who are associated with the planning process
should be added as they are identified.

 DOE management responsible for S&S, as appropriate

 Individual DOE S&S Program Managers, as appropriate

 Contractor Senior Management with line responsibility for S&S
activities, if appropriate

 Contractor S&S Director

 Contractor Program Managers responsible for S&S-related to the
resolution of findings

 Protective Force Managers

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure how
effectively the S&S organization has handled the resolution of findings.
Other forms of measurement may also be developed to assist the survey
team in determining the effectiveness of the S&S resolution of findings.

**X. [INCIDENT REPORTING AND MANAGEMENT]{.underline}**

DOE S&S organizations have investigative authority for personnel
security matters. Primary investigative authority for suspected crimes
against DOE resides with the DOE Office of Inspector General (IG) (for
suspected crimes that do not involve the national security interest) or
the Federal Bureau of Investigation (FBI) (for those that do). Matters
under the IG\'s purview are generally categorized as \"fraud, waste, or
abuse,\" and the IG has retained complete investigative authority. For
matters under the FBI\'s purview, DOE conducts a preliminary inquiry
whenever it is not clear that a loss of classified matter or other
security incident involves a criminal violation. When it is clear that a
criminal violation involving the national security has occurred, the FBI
is notified through the Director, Office of Safeguards and Security. The
FBI or IG may decline or waive investigative jurisdiction or request
investigative assistance from DOE.

An \"incident of security concern\" is not just any security infraction,
but an indication or allegation of a possible incident \"which, at the
time of occurrence, cannot be determined to be an actual criminal
violation of law, but which is of such significant concern to the DOE
Safeguards and Security Program as to warrant immediate preliminary
(inquiry) and subsequent reporting. Examples include: drug use and
distribution, alcohol abuse, criminal racketeering or other organized
criminal activity, the loss or theft of firearms, the discovery or
possession of contraband articles in security areas, and unauthorized
attempts to access classified data bases.\"

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

40, 64, 65, and 66.

**[Survey Content]{.underline}**

The method and sequence of reporting incidents will depend upon the
situation as well as the immediacy of action which may be required to
mitigate a situation. Reports of incidents to DOE may require immediate
oral reporting and should be made in accordance with DOE O 232.1 and DOE
M 232.1. Appropriate security incident reports in the form of a hard
copy or other electronic means should be submitted to the appropriate
authorities as soon as the required information becomes available.

**[Documentation]{.underline}**

Document review in the Incident Reporting subtopical area provides the
current status, management support and direction for correcting
identified S&S program deficiencies. The following types of documents
for all contractors, subcontractors, and consultants should be carefully
reviewed and validated against current operations.

 Incident/Infraction Reports

 Self-Assessment Reports

 Occurrence Reporting Procedures

 Implementing Procedures

 Tracking documentation

 SSSP or SSP

Documents should be used as the basis for determining the degree and
extent of management involvement with the Incident Reporting process.

**[Interviews]{.underline}**

The following personnel should be interviewed at a minimum, and other
site specific personnel who are associated with the planning process
should be added as they are identified.

 DOE management responsible for the S&S incidents and investigations
programs, as appropriate

 S&S Division Director, if appropriate

 DOE Division Director(s) responsible for S&S-related incident and
investigation activities, if appropriate

 Individual DOE S&S Program Managers, as appropriate

 Contractor S&S Director

 Contractor Program Managers responsible for S&S related incident
program

 Protective Force Managers

**[Performance Measures]{.underline}**

After the completion of document reviews, interviews, and observations
of the day-to-day activities, the team will be able to measure how
effectively the S&S organization has reported and documented security
incidents. Other forms of measurement may also be developed to assist
the survey team in determining the effectiveness of the S&S incident
reporting program.

**ANNEX B. PROTECTION PROGRAM OPERATIONS**

**[I.]{.underline} [INTRODUCTION]{.underline}**

This topical area deals with the protection of safeguards and security
interests at the facility, including the physical security measures and
security systems employed to protect those interests, the effective use
of protective forces and security for SNM and classified matter in
transit.

The purpose of Protection Program Operations is to protect the
Department of Energy\'s safeguards and security interests from
malevolent acts that may occur. Malevolent acts may include: theft,
diversion, industrial sabotage, radiological sabotage, destruction,
riots, terrorism, espionage, unauthorized access, loss or compromise, or
other hostile acts which may cause adverse impacts on national security
or on the health and safety of employees and the public. The \"Design
Basis Threat Policy for the Department of Energy Programs and
Facilities\" (U), dated 9-7-94, and vulnerability assessments will be
used in conjunction with local threat guidance for the development and
implementation of the Protection Program Operations program.

The Protection Program Operations program should include a strategy for
protecting each safeguards and security interest.

 Protection strategies include the denial, containment,
recapture/recovery and pursuit.

 Denial and containment strategies rely upon physical security,
security systems, and protective force personnel.

 The type of strategy used will be determined by the impact that a
malevolent act would have on national security, the health and safety of
DOE and DOE contractor employees, the environment, the public, or loss
or damage of Government property.

 A denial strategy will be used for the protection of any safeguards
and security interest (e.g., Category IA SNM, certain radiological
sabotage targets, etc.) where unauthorized access presents an
unacceptable risk.

Protection Program Operations envelop the entire physical security
program at a facility including security equipment, procedures,
protective forces, management and supervision, security badges,
transportation security and the integration of these elements into a
total physical protection security system.

The intent of the Protection Program Operations elements is to provide a
graded level of protection system that accomplishes the safeguards and
security mission in an efficient and cost-effective manner. Ideally,
there should be a complete overlap of the performance of the protection
system and the compliance with the DOE orders.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 56 and 79.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the Protection
Program Operations should include management support/involvement,
administration of the program elements, funding and staffing to
implement the protection programs, planning (safeguards and security as
well as safety), reporting, and other activities associated with the
Protection Program Operations program.

**[Documentation]{.underline}**

Prior to the actual site visit, documentation needs to be requested and
received from the facility to be surveyed, including the Site Safeguards
and Security Plan (SSSP) or, if not applicable, the Site Security Plan
(SSP). Additionally, there will be contingency/emergency plans and plans
for the support by outside federal and local law enforcement agencies.
From these documents, the survey team can become familiar with the site
layout, site mission, and identify potential targets as part of the
pre-survey planning process. Additional documentation may be requested
while conducting the on-site survey activities.

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Management assigned responsibility for developing and implementing the
Protection Program Operations program,

 Contracts and Procurement Department management (if applicable),

 Emergency Preparedness Program management,

 Budget and/or Finance Department management.

**[Subtopical Areas]{.underline}**

The following subtopical areas comprise this topical area:

A. PHYSICAL SECURITY

B. SECURITY SYSTEMS

C. PROTECTIVE FORCE

D. SECURITY BADGES, CREDENTIALS AND SHIELDS

E. TRANSPORTATION SECURITY

**[II.]{.underline} [PHYSICAL SECURITY]{.underline}**

The scope of the Physical Security Program is the physical protection of
security interests to include Special Nuclear Material (SNM) and Vital
Equipment, Sensitive Information, Departmental Property and Unclassified
Facilities.

An effective Physical Security Program will have taken the following
items into consideration when developing their protection program
strategy:

 The vulnerability of an assembled or partially assembled nuclear
weapon or test device to malevolent acts.

 The vulnerability of SNM, vital equipment or facilities, or sensitive
matter to malevolent acts.

 The importance of the facility to the overall DOE mission and costs of
replacement.

 The classification level of the matter and the impact of its loss or
compromise on national security.

 The potential effects of a malevolent act on the health and safety of
employees, the environment, or the public.

 The need for compartmentalization of safeguards and security
interests.

 The need for efficient and cost-effective methods for protecting the
safeguards and security interests based upon DOE order requirements and
performance based tests.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 64, 65, and 89.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
Physical Security Program should include development and implementation
of planning documents, management support/involvement, administration of
the program, staffing qualifications to implement the protection
programs, reporting, and other activities associated with the Physical
Security Program. The main elements to be reviewed are the handling,
storage, and transmitting procedures and practices of SNM, vital
equipment or facilities, classified matter, and DOE property.

The process of evaluation includes assessing the results of the survey
activities (document reviews, interviews, and performance testing). Key
elements of the evaluation are:

 Integration

\- Site protection measures with the site security plans

\- Site protection measures with its value and the impact of its loss

 Analyzing data

 Developing findings, suggestions, and other observations

 Recognizing noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

**[Documentation]{.underline}**

The following documents should be requested and reviewed prior to the
survey:

 SSSP (to include the Master Safeguards and Security Agreements, if
applicable)

 If no SSSP, then a SSP

 Lock and Key records and procedures

 Property control and removal procedures

 Access control procedures

 Local performance testing plans and procedures

 Identification of security areas and S&S interests

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE Orders

 Identify inconsistencies and contradictions

 Ensure understanding of, and familiarity with, the protection programs
of the facility

 Develop ideas for system performance testing

 Identify deviations to DOE directives

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Security staff and management assigned responsibility for developing
and implementing the Physical Security Program,

 Receptionist/employee controlling access to facility,

 Access control personnel,

 Personnel assigned to monitor portals

 Personnel performing inspections of vehicles and hand-carried items

 Classified Matter Protection and Control staff

 Personnel responsible for key control

 Locksmiths

 Property management

**[Performance Measures]{.underline}**

In general, the goal of the physical security survey is to ensure that
protective systems and subsystems perform as intended and designed.
Therefore, survey activities should include, at a minimum, basic
performance tests of the following:

 Lock and key control system accountability procedures

 If combination locks are use, tests to ensure that random numbers have
been selected for each combination; that \"factory set\" combinations
have been changed; and that combination records are reasonably and
prudently protected

 Determine that locks meet minimum DOE standards

 Test the two-person rule for control of SNM at areas

 Property removal control systems

 Test of protective force personnel, if used, and their knowledge of
equipment and procedures.

 Test of existing survey/search procedures

 Check facilities at night to determine if they are being locked when
unoccupied.

These performance tests may be conducted on an announced or unannounced
basis. Unannounced performance tests will be coordinated with a
\"trusted agent\" assigned by senior facility management to minimize
operation impacts. Additionally, the \"trusted agent\" will assist in
reviewing safety aspects of the performance tests and ensuring they are
followed.

**[III.]{.underline} [SECURITY SYSTEMS]{.underline}**

The effectiveness of physical security systems in protecting SNM, vital
equipment, classified information, DOE property, and unclassified
facilities is determined by examination and testing of construction,
facilities, and equipment. Included are buildings, fences, barriers,
lighting, sensors, surveillance devices, entry control devices, access
control systems, protective personnel posts, central alarm
stations/secondary alarm stations (CAS/SAS), power systems, and other
real property and hardware designed for or affecting security.

The essential elements of these security systems are detection,
assessment, delay, and response. Security plans and security equipment
should effectively merge physical security systems and tactical
capabilities to assist the response force in being effective.

An effective security systems program will have taken the following
items into consideration when developing their protection program
strategy:

 Protection programs are tailored to address specific site
characteristics and requirements, current technology, ongoing programs,
operational needs, and to achieve acceptable protection levels that
reduce inherent risks on a cost-effective basis.

 If an Intrusion Detection System (IDS) is used, it is to be installed
at applicable security boundaries to provide reasonable assurance that
breaches of security boundaries are detected and that timely detection
of unauthorized access attempts and information is provided to
protective force personnel.

 If an IDS is used, ensure that all Safeguards and Security targets are
provided protection for early detection.

 An IDS will have an effective way to assess all non-scheduled alarms
whether they be real, false, nuisance, or tamper.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 63, 80 and 89.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
Security Systems should include development and implementation of
planning documents, administration of the program, staffing
qualifications, reporting, maintenance procedures and other activities
associated with Security Systems. The main elements to be reviewed are
the design, installation, maintenance, and testing procedures and
practices of the Security Systems. Test the alarm systems (or review
test results) to determine if the alarm systems provide real time
annunciation sufficient to ensure adequate time for the security force
to respond effectively. Determine if the barriers deny penetration or
provide sufficient delay to allow successful security force deployment.
Observe the assessment systems and determine if the assessment
capability provides sufficient information and intelligence about the
adversary to allow the security force to interdict adversary actions
effectively. Review the primary and alternate communications equipment
to determine if they are functional and of a design that allows for the
security force to respond effectively. Review compensatory measures and
determine if they are adequate to compensate for any system
deficiencies.

Personnel assigned to operate alarm systems consoles or monitors are to
be interviewed to determine their understanding of how the system
operates and their responses to alarm conditions and to ensure these
personnel are trained and qualified to perform in their assignments.
These individuals usually provide a great deal of information by which
the adequacy and effectiveness of the overall system can be evaluated.

The process of evaluation includes assessing the results of document
reviews, interviews, and performance testing. Key elements of the
evaluation are:

 Integration

\- System descriptions with system installation

\- Interaction with design engineers

\- Written procedures with actual practice

\- Alarm components with alarm systems

\- Alarm systems with CAS/SAS systems

\- Emergency power with delay times & protective force

 Analyzing data

 Developing findings, suggestions, observations

 Recognize noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

**[Documentation]{.underline}**

Procedures for a personnel identification, control, and monitoring
system should identify those personnel who are authorized to enter or
leave Security Areas and should indicate, as necessary, limitations on
their movement or access to classified matter within such areas. In
addition, the following documentation should be reviewed in this
process.

 SSSP or SSP

 Physical Security System description(s) & location(s)

 Maintenance and testing records and procedures

 Unscheduled alarm reports

 Calibration procedures and records

 CAS/SAS procedures (interface description)

 Emergency response for CAS/SAS recovery

 Emergency power systems (UPS System)

 Compensatory procedures for equipment outages

 Visitor logs containing information described in DOE Orders

 Inspection procedures

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE directives

 Identify inconsistencies and contradictions

 Ensure understanding of and familiarity with the system(s)

 Develop ideas for system performance testing

 Identify deviations to DOE directives

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Safeguards and security staff responsible for Security Systems

 Security Police Officers and Security Officers

 Engineers (involved with security systems)

 Alarms maintenance/installation & testing personnel

 CAS/SAS management

 CAS/SAS operators

 Other personnel responsible for monitoring/clearing alarm indications

 Protective force managers

 Emergency management planners

 User personnel responsible for walk-testing or other performance
testing of alarm systems

**[Performance Measures]{.underline}**

The goal of performance tests is to confirm the ability of implemented
and operating system elements or total system to meet established
protection requirements. A well developed maintenance and testing
program will demonstrate that the system operates to DOE specifications.
Security systems selected for evaluation should be performance tested by
walking through the paths they are designed to protect or by other
means. Simple visual survey often does not expose poor equipment
performance or defective components. Additionally, tamper alarms should
be tested physically. In areas that are hazardous or very difficult to
test, visual survey or other substitute tests may be appropriate.
Specific tests can be found in the Office of Security Evaluations (OSE)
Inspectors Guide. The suggested tests have been developed over time, are
widely used, and are accepted by the DOE community. By following the
detailed tests found in the guide, the method of measurement will be
fair and consistent.

Test any alarm systems in use to ensure compliance with applicable DOE
standards.

It is a practical necessity that on-site security and maintenance
personnel witness performance tests on systems for which they are
responsible. These personnel should not, however, influence which
systems are tested, especially when random selection is used.

Barriers which add significant delay should be evaluated by an
independent team of barrier experts to validate the delay claimed in
vulnerability assessments.

An evaluation of barriers to the facility should take place to ensure
that regulations are complied with. For example, fence heights and gauge
of wire, examination of openings in walls and ceilings, etc.

Testing of lighting and backup power to assure compliance with DOE
standards may be appropriate.

All major functions of the security system performance needs to be
evaluated at least annually through the conduct of approved tests.
Integrated performance tests combining safeguards and security system
functions should be performed.

**[IV.]{.underline} [PROTECTIVE FORCE]{.underline}**

The Protective Force protects DOE safeguards and security interests from
theft, diversion, industrial sabotage, radiological sabotage,
toxicological sabotage, espionage, unauthorized access, loss or
compromise, and other hostile acts that may cause unacceptable adverse
impacts on national security, program continuity, the environment, or
the health and safety of employees and the public.

Protective personnel who are armed protect life and property at DOE
facilities as authorized by 10 CFR 1046 and 1047.

To fulfill this mission, the protective force must have proper
management and supervision, a comprehensive, well-documented formal
training program, and sufficient quantities of appropriate,
well-maintained, and properly deployed equipment and facilities.
Protective personnel must possess both routine and tactical skills to
enable them to perform their mission as individuals or as a team.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

4, 5, 49, 54, 55, 56, 66 and 89.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
protective force should include development and implementation of
planning documents, management support/involvement, administration of
the program, reporting, and other activities associated with the
protective force Program. The main areas to be reviewed are the proper
management and supervision, a comprehensive, well-documented formal
training program, and sufficient quantities of appropriate,
well-maintained, and logically deployed equipment and facilities.

The process of evaluation includes assessing the results of the survey
activities (document reviews, interviews, and performance testing). Key
elements of the evaluation are:

 Integration

\- Site protection measures with the site security plans

\- Site protection measures with its value and the impact of its loss

 Analyzing data

 Developing findings, suggestions, and observations

 Recognizing noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

 System performance tests.

**[Documentation]{.underline}**

DOE Orders require that all protective force policies and procedures be
properly documented. Document review begins during the survey planning
stage. All survey team members should familiarize themselves with the
following documents:

 Protective Force general and post orders

 Protective Force shift schedules and post assignments

 Protective Force weapons and ammunition inventories

 Weapons maintenance logs

 Memoranda of Understanding with local law enforcement agencies and
documentation of exercises conducted with those agencies

 Protective Force training records which include:

\- Basic/Initial training

\- Refresher training

\- Re-qualification training

\- Special training

\- Remedial training

\- In-service training

\- On-the-job training (OJT)

 A list of protective force personnel who are subject to weapons
qualification within 90 days of the start date of the survey

 A list of protective force personnel who are medically certified to
participate in the physical fitness program

 All documentation of protective force exercises conducted since the
last DOE Safeguards and Security Survey

 Job task analyses (JTA)

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE directives

 Identify inconsistencies and contradictions

 Ensure understanding of, and familiarity with, the protective force

 Develop ideas for system performance testing

 Identify deviations to DOE directives

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Protective Force management

 Protective Force supervisors

 Protective Force training staff

 Flight Operations

 Special Response Team (SRT) leaders

 Security Police Officers (SPO) and Security Officers (SO)

 Facility safeguards and security management (concerning interface with
protective force)

 Protective Force safety managers

Virtually any member of the protective force, from the manager to a
recruit undergoing basic training, is a potential interview candidate.
Facility employees who are not members of the protective force may be
interviewed to provide information about protective force practices they
observe. While interviews can be used to round out the survey team\'s
knowledge of the protective force, their more important function is to
help determine the knowledge and perceptions of individuals. Members of
the protective force may be interviewed on or off post to determine
their perception, understanding, and knowledge of policies, procedures,
requirements, and duties.

The processes of evaluation include assessing the results of the above
activities (document reviews, interviews, and performance testing). Key
elements of the evaluation are:

 Coordination

\- Protective Forces elements (SPO, SRT, etc.)

\- Protective Forces and Local Law Enforcement Agencies

\- Protective Forces and FBI

 Integration

\- Basic training with site-specific job task

\- SRT training with tasks associated with SRT duties

 Analyzing data

 Developing findings, suggestions, observations

 Recognize noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

 Implementation of written procedures

 Adequacy of protective equipment and vehicles

**[Performance Measures]{.underline}**

Performance testing of a protective force involves a wide range of
activities from the very simple to the very complex. Performance tests
are used to realistically evaluate, and verify the effectiveness of
protective force programs; identify and provide training for personnel;
identify areas requiring system improvements; validate implemented
improvements; and motivate protective force personnel. Such tests are to
adhere to the policy and requirements found in Reference 66 (Attachment
3). All major functions of the protective force are to be tested.

Protective force performance tests are divided into six types: 1)
Limited Scope Performance Tests (LSPTs), 2) Alarm Response and
Assessment Performance tests, 3) Force-On-Force (FOF) exercises, 4)
Command Post Exercises, 5) Command Field Exercises, and 6) Joint
Training Exercises. At a minimum, LSPTs should be conducted to test the
following elements of the protective force system and organization:

 Firearms qualification proficiency

 Physical fitness proficiency

 Response to alarms and other security situations

 Command and control capabilities

 Special Response Team (SRT) tactics and capabilities (if applicable to
the surveyed facility)

 SPO knowledge and proficiency with issued equipment (handcuffs,
service batons, gas masks, etc.)

 SPO or SO personnel knowledge of DOE use of force criteria, approved
facility general orders, post orders and procedures

 Operation and reliability of assigned equipment and vehicles

Other exercises may be performed as appropriate for the facility. All
performance tests must be planned, coordinated, documented and executed
as specified in the following:

 The Office of Security Evaluations (OSE) Protective Force Inspectors
Guide. This guide contains detailed information on performance testing
guidelines and procedures. In addition, it references DOE Orders and
Office of Safeguards and Security (OSS) Standards and Criteria.

 Local Operations Office survey policies and procedures

Performance tests, of whatever type, generally lend themselves to being
conducted on either an announced or unannounced basis. Unannounced
performance tests require special planning and coordination to ensure
safety and minimum disruption of facility operation. For this reason, a
knowledgeable \"trusted agent\" should be provided by senior facility
management to the survey team.

Major aspects of the coordination, planning, conduct and results of
protective force performance test are to be documented in the survey
report.

A written test plan is to be prepared for protective force performance
testing activities. The plan should consider and include, as
appropriate:

a\. The specific element of the protective force being tested;

b\. The objective of the test;

c\. Applicable pass/fail criteria;

d\. Specific safety considerations;

e\. Specific safeguards and security considerations;

f\. Test results documentation and after action reviews; and

g\. Classification of the proposed test and anticipated results, as
appropriate.

Protective force performance tests are to be conducted with the

highest regard for the safety and health of personnel, protection of the
environment, and protection of Government property. Specific safety
considerations and requirements for conducting protective force
performance tests are found in Reference 49 (Attachment 3).

Performance testing is to be conducted as outlined below:

 Limited Scope Performance Test \-- AS REQUIRED

 Alarm Response and Assessment \-- 2/YEAR/ALARMED LOCATION

 Force‑On‑Force Exercise \-- 1/YEAR/FACILITY

 Command Post Exercise \-- 1/YEAR/SITE

 Command Field Exercise \-- 1/YEAR/SITE

 Joint Training Exercise \-- AS REQUIRED

Annual requirements for Force-On-Force exercise, Command Post exercise,
and Command Field exercise may be combined where determined appropriate
in Site Safeguards and Security Plans. Requirements for Alarm Response
and Assessment Performance Tests may also be satisfied through combined
testing of multiple alarms in the same or proximate location(s).

**[V.]{.underline} [SECURITY BADGES, CREDENTIALS AND
SHIELDS]{.underline}**

A security badge system or personal recognition is used at DOE and DOE
contractor facilities involving security interests to provide a means
for ensuring that only authorized personnel enter, occupy, or leave and
to indicate limitations placed on access.

A badge system is used to control access to facilities with security
interests or security areas in which thirty (30) or more persons are
employed. If a badge system is not used, the nature of the activities
and involvements permit adherence to a personal recognition system which
provides a high level of assurance that unauthorized persons will be
denied access.

Safeguards and security credentials and shields are issued only to DOE
and DOE contractor employees who are deemed essential in the performance
of official duties. The design of DOE credentials and shields are
approved on a case‑by‑case basis by the Lead Responsible Office.

There will be records pertaining to the security badge, credential, and
shield accountability system and they should indicate the disposition of
all badges, including the date of issuance, name of holder, and type of
access authorization.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 56 and 89.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
Security Badges, Credentials and Shields Program should include
development and implementation of planning documents, management
support/involvement, administration of the program, staffing
qualifications to implement the program, reporting, and other activities
associated with the Security Badges, Credentials and Shields Program.
The main elements to be reviewed are the handling, storage, and
transmitting procedures and practices of the badging system. Review the
procedures for forgotten badges and the recovery of badges from
terminating employees to ensure that all badges are accounted for.
Additionally, procedures should be in effect to retrieve badges from
employees terminating under unusual circumstances, i.e., death,
imprisonment or quitting without notice.

A review should be made of the records of lost badges. Review the
procedures for notifying personnel controlling access to security areas
of lost badges. DOE and contractor personnel controlling access to
security areas should be notified of lost badges. The storage location
of badges, inserts, and plates should be inspected to ensure they are
being protected against loss, theft, or unauthorized use. The records
should show that annual inventories are conducted of blank inserts and
plates, and that records are maintained of the inventories.

Procedures for issuing temporary badges should show that records used to
verify clearances are up to date. Visitor logs and records are reviewed
to ensure that positive identification is made before visitors enter.
Visitor badging records are to be reviewed to ensure that appropriate
records are maintained and that badges are issued only for the
appropriate dates.

The process of evaluation includes assessing the results of the survey
activities (document reviews, interviews, and performance testing). Key
elements of the evaluation are:

 Integration

\- Site protection measures with the site security plans

\- Site protection measures with its value and the impact of its loss

 Analyzing data

 Developing findings, suggestions and observations

 Recognizing noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

**[Documentation]{.underline}**

A personnel identification system should identify those personnel who
are authorized to enter or leave security areas and should indicate, as
necessary, limitations on their movement or access to classified matter
within such areas. In addition, the following documentation should be
reviewed in this process.

 Access/Badge control

\- Automated; systems description & procedures

\- Manual; procedures & controls

 Badges/passes contain required information on front of the badge

 Information containing at a minimum policies/procedures for issuing,
replacing, and recovering passes/badges

 Inventories (since last S&S survey) of:

\- Passes/badges made, issued, lost, recovered, returned and destroyed

\- Stocks of inserts and unissued passes/badges

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE directives

 Identify inconsistencies and contradictions

 Ensure understanding of and familiarity with the program

 Develop ideas for system performance testing

 Determine whether a proper choice has been made in the selection and
use of a badge, pass, electrical, mechanical, or personnel recognition
system for the circumstances, type of area, and work program involved.

 Identify deviations to DOE directives

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 S&S Management

 Security Police Officers and Security Officers

 CAS/SAS operators and/or other access control personnel

 Protective Force managers

 Personnel responsible for badge/pass system

The process of evaluation includes assessing the results of document
reviews, interviews, and performance testing. Key elements of the
evaluation are:

 Written procedures with actual practice

 Analyzing data

 Developing findings, suggestions, observations

 Recognize noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

 Security badge/pass system change-over process conforms to DOE order
requirements.

**[Performance Measures]{.underline}**

The tamper-resistance of badge/pass documents and the effectiveness of
the entry-control system(s) should be performance tested.

The following topics should also be performance tested:

 Access control systems

 Visitor control system

**[VI.]{.underline} [TRANSPORTATION SECURITY]{.underline}**

Surveys of SNM and/or sensitive information shipping operations (land,
sea, and air) are limited to survey of physical and technical protection
provided in transit. Inter-Operations Office coordination may be
necessary to ensure an adequate survey. Shipment surveys should be
conducted on an as-needed basis by the Operations Office contracting
with the commercial transfer agent or transporter, but on no occasion
less than once every 18 months.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

52, 54, 55 and 89.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
transportation of SNM and sensitive information should include
development and implementation of planning documents, management
support/involvement, administration of the program, reporting, and other
activities associated with the Transportation Security Program. The main
elements to be reviewed are the handling, and transporting procedures
and practices of SNM, sensitive matter, and DOE property.

The process of evaluation includes assessing the results of the survey
activities (document reviews, interviews, and performance testing). Key
elements of the evaluation are:

 Site transportation practices

 Analyzing data

 Developing findings, suggestions and observations

 Recognizing noteworthy accomplishments/achievements

 Validation of observations

 Compiling field activity notes

**[Documentation]{.underline}**

Prior to an actual visit to the warehouse, terminal, port, or airport of
the shipper, the following documents should be requested from the
shipper or the sponsoring contractor, program office, etc.:

 Shipment security plan

 Shipment procedures

 In-transit emergency plan

 Shipment emergency response plan

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE directives

 Identify inconsistencies and contradictions

 Ensure understanding of and familiarity with the protection aspects of
the shipment

 Identify deviations to DOE directives

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Sponsoring contractor\'s program manager

 DOE\'s responsible program oversight office

 Facility\'s designated responders (as described in the Emergency
Response Plan)

 Emergency Operations Center personnel responsible for response and
recovery

 Warehouse personnel (shipment preparations)

 Security oversight personnel

 Driver(s), pilot(s) and their escorts

**[Performance Measures]{.underline}**

Shipment surveys do not lend themselves to performance testing in the
traditional DOE sense. The most effective performance test is to
accompany a randomly selected shipment. The shipment should be reviewed
from the origination until unloading at destination. Such a performance
test allows the inspector to determine if: 1) appropriate DOE-approved
procedures are being followed; 2) adequate surveillance of the matter
being shipped is maintained, and 3) appropriate emergency procedures are
followed.

**ANNEX C. INFORMATION SECURITY**

**[I.]{.underline} [INTRODUCTION]{.underline}**

This topical area deals with the protection of classified and sensitive
unclassified information, in whatever form, from potential loss,
compromise or other unauthorized disclosure.

**[Subtopical Areas]{.underline}**

The following subtopical areas comprise this topical area:

A. CLASSIFICATION GUIDANCE

B. CLASSIFIED MATTER PROTECTION AND CONTROL

C. SPECIAL ACCESS PROGRAMS AND INTELLIGENCE INFORMATION

D. CLASSIFIED AUTOMATED INFORMATION SYSTEMS SECURITY

E. TECHNICAL SURVEILLANCE COUNTERMEASURES

F. OPERATIONS SECURITY

G. UNCLASSIFIED AUTOMATED INFORMATION SYSTEMS SECURITY

H. PROTECTED DISTRIBUTION SYSTEM

I. COMMUNICATIONS SECURITY (COMSEC)

**[II.]{.underline} [CLASSIFICATION GUIDANCE]{.underline}**

**[Description]{.underline}**

The DOE Classification Program is responsible for the establishment of
policies and procedures which ensure the proper classification of
information within the Department. This includes Restricted Data and
Formerly Restricted Data, which are classified at their inception,
pursuant to the Atomic Energy Act, and National Security Information,
which is classified pursuant to Executive Order 12958.

The survey of this element will examine how well DOE\'s policy on
classification, transclassification, downgrading, and declassification
of information has been implemented.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

61, 68, 69 and 88.

**[Survey Content]{.underline}**

Evaluation of how well classification guidance disseminated, how
classification training is provide to authorized classifiers, and the
availability of proper classification guides for reference. The
availability of current classification guidance, both general and
program-specific, and it\'s application is a key element of the survey
of this area. The three essential questions to be answered are (1) does
the facility have Authorized Classifiers which have been appointed in
writing, (2) have they received required training, and (3) is
classification guidance on hand for each of the facility\'s classified
projects.

**[Documentation]{.underline}**

The facility should have an appropriate number of Authorized
Classifiers. Documentation should be examined to determine that all
Authorized Classifiers have been appointed in writing and have receive
appropriate training.

Procedures and documentation should be reviewed to determine how the
facility is reviewing new programs to determine whether classified
information is involved and, if so, whether classification guidance is
on hand for each such program.

**[Interviews]{.underline}**

The Classification Officer, Authorized Classifiers and users of
classified matter should be interviewed to obtain an understanding of
how the classification program has been implemented, how new programs
are reviewed for classification, how training in the area of
classification is conducted and documented, how classification guidance
is distributed, and how many Authorized Classifiers and Authorized
Declassifiers are at the facility.

**[III.]{.underline} [CLASSIFIED MATTER PROTECTION AND
CONTROL]{.underline}**

**[Description]{.underline}**

The Classified Matter Protection and Control (CMPC) Program should have
a designated operations manager to ensure procedures are developed for
consistent implementation and that classified information is protected
from inadvertent release to unauthorized individuals. Individuals
reviewing this area need to be cleared commensurate to the information
being reviewed. The review of classified matter may require access into
radiation areas.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

11, 14, 15, 68, 69 and 70.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the CMPC Program, to
include administration, procedures, training, dissemination and
transmission, reproduction, and destruction. Key program elements to be
reviewed are: CMPC procedures, control stations, and protection and
control measures by custodians and authorized users.

**[Documentation]{.underline}**

 CMPC Procedures. Review the procedures to understand how the facility
implemented DOE M 471.2.

 Control Station Procedures. These may be a separate document from the
CMPC procedures and should be reviewed to understand how classified
matter is received and distributed at the facility.

 Control Station Training. DOE M 471.2, Chapter II, Paragraph 4.b.
requires employees of controls stations to be trained. Reviewing
training material will ensure compliance with this requirement.

 Site Safeguards and Security Plan (SSSP). The SSSP or other security
plans should be reviewed to ensure that the CMPC function has been
incorporated in the protection program planning documents.

**[Interviews]{.underline}**

 CMPC Operations Managers. Each DOE Operations and Field Office must
designate a Classified Matter Protection and Control (CMPC) Operations
Manager. This individual should be one of the first individuals
contacted at the beginning of the survey. This individual manages and is
knowledgeable of the CMPC Program at the facility in which the survey is
being conducted. This individual will provide an understanding of what
the CMPC Program consists of and what guidelines are being followed. The
contractor at a site is not required to designate a CMPC Operations
Manager, but will have an individual assigned the role of implementation
and oversight of the program. This individual should be interviewed in
this case.

 Control Station Operators. Individuals who operate the control
station(s) which maintains records and controls the incoming and
outgoing classified at the facility would be another interview. This
would provided information on how classified matter moves into and out
of the facility, which is key to the effectiveness of the program.

 Custodians or Authorized Users. Individuals who possess classified
matter should be interviewed to establish their knowledge and
implementation of protecting and controlling classified matter.

 Reproduction Staff. Centralized classified reproduction facility staff
should be interviewed to identify any discrepancies between the
procedures and actual implementation.

 Classified Communications Center. Individuals handling incoming
classified facsimiles should be interviewed to determine how classified
is received, transmitted and stored within the communications center.

**[Performance Measures]{.underline}**

The following areas should be considered for performance testing during
the survey of the CMPC subtopic:

 Document Generation

 Document and Material Marking

 Document Reproduction

 Document and Material Control System(s)

 Document and Material Storage

 Document Accountability Front Check

 Document Accountability Back Check

 Document Receipt

 Document and Material Transmittal

 Document and Material Destruction

The information below could be incorporated under interviews or as
performance tests.

Survey team should interview selected personnel specifically responsible
for administering document generation. They should also interview other
staff and tour work spaces to determine whether site-specific policies
are understood and effectively implemented. Survey team should determine
whether the individuals understand local document preparation procedures
and their responsibilities. If specific local procedures have not been
published, individuals should be asked to explain all aspects of how
they prepare documents. Survey teams should also check for availability
of necessary procedures, references, and cover sheets. Survey team may
choose to ask the custodian or responsible individual to demonstrate the
procedures.

To supplement information provided by custodians or authorized users,
survey teams should interview selected individuals who only occasionally
generate, write, or prepare classified documents to determine how well
they understand their responsibilities. Such persons can be identified
by noting the authors of classified memoranda or reports and identifying
individuals with security clearances who work outside a limited area.
Survey teams should determine exactly how the procedures are applied,
and compare the results with DOE and site policies. If local procedures
do not exist, survey teams should ask the responsible individuals to
explain all aspects of how they prepare documents and interact with
other individuals involved. Survey teams may also elect to ask
individuals whether they are currently writing or working on any
classified documents to see how they are marked.

Survey teams should interview selected specialists and administrative
personnel who routinely or occasionally use special or unique equipment,
e.g., viewgraph machines to generate classified documents in order to
determine how well they understand their responsibilities. Survey teams
should determine exactly how the procedures are applied and compare the
results with DOE and site policies.

Survey teams should interview selected document holders, supervisors,
secretaries, and other staff members to determine the procedures used
for limiting access, enforcing need-to-know, and attending classified
documents outside lock repositories. Also, survey teams should determine
whether staff members clearly understand the procedures. The procedures
should be clearly documented in writing. The survey team should
determine whether the procedures are available to all staff members.
Up-to-date access lists should be available to custodians to help them
determine need-to-know for individuals wanting access to classified
documents.

When checking repositories, survey teams should determine who has
access. They should check to ensure that individuals who have access
also have a need-to-know for all the classified information in the
security container.

Survey teams should accompany or follow intra-site messengers or post
office couriers to determine whether they constantly attend and control
the classified matter they pick up and deliver.

With the reduction in accountability, survey teams should interview
administrative personnel and supervisors to determine what checkout
procedures are used. They should determine whether these individuals
fully understand the procedures and to what extent the procedures are
actually followed. The name of employees who have transferred,
terminated, or died recently should be obtained to see whether their
documents have been transferred, their names removed from access lists,
and appropriate combinations changed.

**[IV.]{.underline} [SPECIAL ACCESS PROGRAMS AND INTELLIGENCE
INFORMATION]{.underline}**

**[Description]{.underline}**

[Policy]{.underline}

Intelligence information and activities, as defined in Executive Order
12333, will be provided protection to preclude unacceptable risks to the
national security. These include FII, SCI, SAP and other activities
performing work for the Department which require access, receipt,
storage, processing and/or handling of Foreign Intelligence Information
(see Definitions below).

Security for these activities and information shall conform to the
applicable provisions of Executive Order; Executive orders as may
supersede it; and to applicable Director of Central Intelligence
Directives (DCID).

[Definitions]{.underline}

Foreign Intelligence Information (FII) - National Security Information
(NSI) relating to the capabilities, intentions and activities of foreign
powers, organizations or persons, that would impact the national
security or foreign relations of the United States.

Sensitive Compartmented Information (SCI) - Classified information
concerning or derived from intelligence sources, methods, or analytical
processes, which is required to be handled within formal access control
systems established by the Director of Central Intelligence.

Sensitive Compartmented Information Facility (SCIF) - An accredited
area, room, group of rooms, or installation where Sensitive
Compartmented Information may be stored, used, discussed, and/or
electronically processed.

Special Access Program (SAP) - Any program established under Executive
Order 12958 or the Atomic Energy Act of 1954, as amended, that imposes
additional controls governing access to classified information involved
with such programs beyond those required by normal management and
safeguarding practices. These additional controls may include, but are
not limited to, access approval, adjudication or investigative
requirements, special designation of officials authorized to determine a
need‑to‑know, or special lists of persons determined to have a
need‑to‑know.

The Department requires access to a wide-variety of classified
information, some of which is so uniquely sensitive it requires special
access authorizations, handling procedures, or controls. Special Access
Program (SAP), which includes SAPs for Intelligence, is the term
authorized for use within the Department. Terms and activity
designations such as Limited Access Program, Controlled Access Program,
Limited Distribution and Special Access Required are no longer used.

[Requirements]{.underline}

The requirements for the protection of sensitive compartmented
information are derived from Intelligence Community requirements and the
DCIDs. The following outlines the Department\'s responsibilities for the
protection of this information.

a\. Only persons who have been adjudicated for access to SCI by the
Office of Safeguards and Security and granted access by the Office of
Energy Intelligence shall be permitted access to such information.

b\. SCI will be stored, processed and used in Sensitive Compartmented
Information Facilities (SCIFs) which have been specifically certified by
the Office of Safeguards and Security and accredited by the Office of
Energy Intelligence for such purpose.

c\. Actual or suspected incidents involving a possible or probable
compromise of foreign intelligence information, including SCI, shall be
fully investigated and reported to the appropriate component of the
Intelligence Community.

d\. Security policy, procedures, standards, and criteria for new
construction or modification of existing SCIFs will be the basis for the
establishment and use of SCIFs within the Department. Preconstruction
reviews and formal inspections and evaluations of such construction or
modifications will be included in the basis for the certification and
accreditation of each SCIF. Heads of Departmental Elements will provide
to the Director of Security Affairs site approved, preconstruction
architectural and engineering design materials, and results of the local
DOE security element review. Any recommendations developed through the
local review of proposed construction of new SCIFs or modifications to
existing SCIF(s) shall be submitted to the Director of Security Affairs
and the Director of Energy Intelligence for approval prior to beginning
any construction or modification activities.

e\. Physical security, technical security and information systems
security measures will be established and applied to facilities and
systems used for SCI and other foreign intelligence information.
Security plans documenting system specific implementation of the
requirements in these areas will be established and evaluated during the
certification and accreditation and during each periodic inspection or
survey of each SCIF. Departmental Elements will review SCIF Information
System and general security plans and standard operating procedures and
any changes/revisions to existing plans for adequacy and compliance with
established policies and directives, and forward plans to the Director
of Security Affairs and the Director of Energy Intelligence for
appropriate action(s).

The requirements for the protection of special access programs include
the following:

a\. All SAPs originated by the Department must be approved by the
Secretary, with the recommendation of the Undersecretary, who serves as
the Chairperson of the Special Access Programs Oversight Committee
(SAPOC), which oversees the development of policy and procedures for
SAPs.

b\. The security policy and procedures for SAPs under Departmental
cognizance is developed by the Office of Safeguards and Security, in
coordination with the appropriate Program Office.

c\. SAPs are registered through the established Facility Data and
Approval Record process. Registration of DOE SAPs will be sent only to
the SAP Security Program Manager. The FDAR will be classified in
accordance with CG-SS-3, Chapter 2.

d\. SAP facilities and activities will be surveyed/inspected by the
cognizant Operations Office and/or Office of Safeguards and Security, in
coordination with the appropriate Program Office and/or sponsor.
Intelligence SAPs will be surveyed by the Office of Energy Intelligence.

e\. Protection program planning documents, including security plans and
standard operating procedures must comply with established SAP policies.

f\. Any possible or probable loss, compromise, or unauthorized
disclosure of SAP information must be immediately reported to the
appropriate Program Office and the Director of the Office of Safeguards
and Security, according to established Departmental policies.

[Other information of potential use to the survey team member, such as
special classification, safety or access requirements that should be
considered/anticipated.]{.underline}

SCIF Survey Course completion and current SAP/SCI access for survey team
members to survey these activities.

If, at any time during a survey, an activity is discovered which has not
been registered and claims SAP status (including SCI, Limited Access
Program, Special Use Controlled Information, \"Eyes Only\" information,
cover operations and code word programs), the following actions should
be taken, with strict OPSEC in mind and all communications concerning
SAPS or other Work for Others activities conducted by secure means:

Report the discovery immediately to the DOE Field or Area Office
Safeguards and Security Director and, if directed, question the local
DOE Contacting Officer Technical Representative (COTR) or DOE
representative to determine whether the activity has been properly
registered;

Contact the Chief, Technical and Operations Security, Office of
Safeguards and Security, to verify the veracity of the SAP status claim,
in conjunction with other appropriate government agencies; and

Ensure that the circumstances surrounding the discovery of the activity
are clearly described in appropriate documentation, such as the survey
report.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

10, 11, 12, 14, 15, 16, 17, 18, 19, 20, 21, 54, 55, 60, 62, 68, 69, 75
and 77.

**[Survey Content]{.underline}**

Program areas and elements to be surveyed include Special Access
Programs, Sensitive Compartmented Information Facilities (SCIFs) and
other activities handling intelligence information. The survey is
required to ensure compliance with security procedures for the receipt,
control, dissemination, transmission, and destruction of foreign
intelligence information.

Survey plans are required to identify how the applicable survey topical
and subtopical areas will be surveyed within the SCIF. The specific
dates for a survey of each SCIF must be coordinated with the Office of
Safeguards and Security and the Office of Energy Intelligence, at the
beginning of each fiscal year. Copies of all SCIF survey correspondence,
including any changes to the coordinated schedule, notification letters,
survey reports, corrective action plans, etc) must be provided to
Technical and Operations Security, Office of Safeguards and Security,
and to the Office of Energy Intelligence.

As part of the activity registration process, an approved Classified
Mailing Address (CMA) must be available to appropriate organizations for
the receipt of classified matter. since only those activities involved
with a specific SAP need to know the address of that SAP, the CMA should
[only]{.underline} be maintained at the registered activity. The CMA
will be validated by team members during the conduct of required annual
security surveys.

**[Documentation]{.underline}**

Documents, Procedures and Records to be reviewed:

 Self-Assessment Reports

 TSCM Survey Reports

 Budgets

**[Interviews]{.underline}**

 Contractor Special Security Officers and Alternates

 SAP Coordinator

 Classified Automated Information System Site Manager (CSSM)

 TSCM Officer

**[Compliance Measures]{.underline}**

Compliance measures from applicable topical and subtopical areas may be
applied to these activities. Due to staffing and time constraints,
however, it is essential that the survey plan for these activities
identify the scale and extent to which the compliance measures for the
other topical and subtopical areas will be applied.

Some requirements specific to this subtopic will require the survey team
to:

 Ensure that all persons having access to FII, SCI and SAP information
and activities have been favorably adjudicated for such access and
appropriately advised of their responsibilities resulting from that
access.

 Ensure requests for SCI access have provided the information required,
including the need‑to‑know justification, prior to being forwarded to
the Director of Intelligence.

 Ensure that site-approved, preconstruction architectural and
engineering design materials, and results of local DOE security element
reviews have been forwarded to the Director, Security Affairs. These
materials and any recommendations developed through the local review of
proposed construction of new SCIFs or modifications to existing SCIF(s)
shall be submitted to the Director of Security Affairs for approval
prior to beginning any construction or modification activities.

 Review cognizant SCIF AIS and general security plans and standard
operating procedures and any changes/revisions to existing plans for
adequacy and compliance with established policies and directives.
Determine that the plans have been forwarded to the Director of Security
Affairs and the Director of Intelligence for appropriate action.

**[Performance Measures]{.underline}**

Performance measures from applicable topical and subtopical areas may be
applied to the performance testing of staff and systems associated with
these activities. Due to staffing and time constraints, however, it is
essential that the survey plan for these activities identify the scale
and extent to which the performance measures for the other topical and
subtopical areas will be applied.

The survey team should endeavor to determine whether staff assigned to
these activities are familiar with their responsibilities, including the
reporting of potential compromises or other incidents. Understanding of
special requirements, such as travel restrictions or handling of
possible attempts of outside solicitation of intelligence information
should also be examined.

**[V.]{.underline} [CLASSIFIED AUTOMATED INFORMATION SYSTEMS
SECURITY]{.underline}**

**[Description]{.underline}**

[Policy]{.underline} - The Department of Energy (DOE) classified
automated information system (AIS) security policy is to ensure that the
integrity of the information on the classified AIS is preserved; that
information processed on a classified AIS is protected from unauthorized
access, alteration, modification, disclosure, transmission or
destruction; that classified AIS resources provide an appropriate level
of protection against denial of service, subversion of security
measures, or improper use; and, that classified AIS resources are
protected from damage, destruction, and unauthorized modification.

This policy is specified in DOE O 471.2, Information Security Program,
and in DOE M 5639.6A-1, Manual of Security Requirements for Classified
Automated Information System Security Program.

[Requirements]{.underline} - The basic requirements of the Classified
AIS Security Program are varied. The program consists of many elements,
each one with multiple requirements. These elements include management
functions, assignment of responsibilities, training, policies and
procedures, formal approval processes, technical security measures,
program reviews, documentation, and coordination with other security and
related programs.

Specific requirements are detailed in the Standards and Criteria.

[Key Elements/Indicators of Program Effectiveness]{.underline} - Some of
the key indicators of an effective Classified AIS program are listed
below:

a\. Basic documentation exists, is complete, and is accurate. This
includes security plans, test plans and results, certification and
accreditation letters, site policies, AIS security procedures, training
materials, access authorizations, and internal review and audit reports.

b\. The Classified AIS Security Site Manager (CSSM) and the site
Classified AIS Security Officers (CSSOs) have current copies of all the
documentation that they are required to maintain.

c\. The classified AIS components and media are properly marked, and
media, if appropriate, are entered into required accountability.

d\. The AIS security staff is knowledgeable of program requirements and
their responsibilities.

e\. The classified AIS users are knowledgeable of site protection
requirements and their responsibilities.

f\. Previously identified findings or deficiencies have either been
corrected or addressed in corrective action plans.

[Special Considerations]{.underline} - Although programs differ in
implementation from site to site, certain basic issues can arise during
the course of any survey activity. The following, which does not
represent a complete list of issues, should be taken into consideration
when conducting Classified AIS evaluations.

a\. Plan inspection of systems and facilities to ensure that the largest
AIS resources, with the most users, are reviewed.

b\. Select additional AIS resources and stand-alone systems randomly,
but attempt to obtain a balance of AIS systems, installations, and users
by including different organizations and locations.

c\. Coordinate any inspections of AIS located in a Sensitive
Compartmented Information Facility (SCIF) or AIS processing Sensitive
Compartmented Information (SCI) with the Special Security Officer (SSO)
and ensure that personnel conducting the review have the proper
clearances and access authorizations.

d\. Inspections of classified AIS located in Material Balance Areas
(MBAs) or Material Access Areas (MAAs) may require personnel to attend
site radiation safety training prior to entry. Extra time may be
required to permit proper entry into and exit from these areas.

e\. Notes taken during document reviews or field activities may be
classified, and should be protected accordingly until classification can
be positively established.

f\. Coordinate all AIS performance tests with the CSSM and the
appropriate CSSO and system manager(s).

g\. Performance tests should be based on specific program requirements
or security features specified in the AIS security plans. Tests should
be focused, with well defined test scenarios and expected results.

h\. Coordinate any tests of the Special Nuclear Material (SNM)
accountability system with the Nuclear Material Control and
Accountability personnel and the protective force.

i\. Coordinate any tests of the site alarm systems with the site
Safeguards and Security staff and protective force.

j\. Structure performance tests so that if problems arise during the
conduct of the tests, the tests can be quickly and safely halted.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

34, 35, 36, 37, 45, 46, 47, 48, 68, 69, 70 and 71.

**[Survey Content]{.underline}**

Evaluation of the management and implementation of the Classified
Automated Information System (AIS) Security Program, to include
assignment of responsibility, risk management, preparation of security
plans, implementation and verification of security controls, development
of protection procedures, training, program monitoring activities, and
other elements essential to a viable Classified AIS Security Program.

**[Documentation]{.underline}**

Prior to an actual visit to the facility, the following documents should
be requested from the appropriate organization, either federal or
contractor, to provide advance information on site compliance with DOE
Orders and to provide initial information on site implementation
practices.

 Appointment letters for the DAA, CSOM, and CSSM, as appropriate.

 List of all accredited classified AISs at the site or facility.

 Classified AIS Security Plans for major systems and networks, and a
sample of plans for distributed and stand-alone systems, including a
Master Plan, if applicable.

 Plan approval, test, certification, and accreditation documentation
for the systems or networks covered by the Classified AIS Security Plans
requested.

 Any site deviations from the generic DOE threat statement and risk
assessment documentation, including identification of any unique site
threats or risks.

 Site AIS Security policies, procedures, or handbooks.

 Site Safeguards and Security Plan or the Site Security Plan.

 Computer security training materials used to train CSSOs, users, and
computer security escorts.

 Procedures for validation/revalidation of users and for prompt
notification when a user no longer needs access.

 Samples of the written acknowledgements of Classified AIS user\'s
responsibilities (Code of Conduct) for the protection of classified AISs
and classified information.

 Criteria and decision documents concerning the need for a continuity
of operations plan (including contingency planning and disaster recovery
planning) for each classified AIS. (A statement of the decision and the
basis for that decision should be documented in the Classified AIS
Security Plans.)

 Continuity of operations plans for the systems identified by the
continuity of operations decision, with appropriate management
signatures.

 If appropriate, results from continuity of operations plan tests.

 Procedures for back up of all essential data, utility, and operating
system files (including network interface software) on a regular basis.

 Policies regarding the installation and/or use of third party software
on classified AIS, including public domain software.

 Results of program reviews and CSSM site self-assessments, including
the status of corrective actions.

 A summary of security incidents involving classified AIS, including
severity and resultant actions.

 Site-specific procedures related to AIS security involvement in the
design and development of new AIS.

 Procedures related to the site Configuration Management Program.

 Procedures implemented to authorize user access to classified AIS
resources and need-to-know for specific information.

 Site plans to implement new requirements of DOE O 471.2 and DOE Manual
5639.6A-1.

 Previous survey and inspection reports, and the status of corrective
actions for any identified deficiencies.

 Qualifications and required training of CSOM and/or CSSM.

 Procedures for configuration management of AIS and associated
Protected Distribution System(s) (PDS)

 Site inventory of accredited systems, showing the accrediting
authority and most recent accreditation date for each.

 TEMPEST Plan, including PDS decisions

 List of deviations

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE orders or other requirements;

 Identify inconsistencies or contradictions with other documentation;

 Ensure understanding of and familiarity with the protection aspects of
classified AIS processing; and,

 Identify deviations to DOE directives the facility may have pending
and/or approved.

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted, as appropriate,
with the following personnel.

 The Designated Accrediting Authority (DAA) and/or the Classified AIS
Security Operations Manager (CSOM). (The DAA is dependent on the
protection index of a given system.)

 The Classified AIS Security Site Manager (CSSM).

 Classified AIS Security Officers (CSSOs).

 System Managers or Administrators for classified AIS.

 Owners of major applications, especially Mission-Essential
applications.

 System Users and Operators.

 Computer Security Staff Members.

 Information Management Staff.

**[Performance Measures]{.underline}**

[Administrative Performance]{.underline}

Develop a questionnaire for users of multi-user classified AIS. The
questionnaire should include questions related to receipt of passwords,
sharing of passwords, marking of output, leaving classified terminals or
workstations unattended, knowledge of computer security incidents and
incident reporting procedures, and whether they can identify their
cognizant AIS security officer.

Develop a questionnaire for users of stand-alone classified AIS. The
questionnaire should include questions related to receipt and sharing of
passwords (if used), marking of output, leaving classified terminals or
workstations unattended, knowledge of computer security incidents and
incident reporting procedures, and whether they can identify their
cognizant AIS security officer.

Verify that selected systems are consistent with the specifications of
hardware and software, as presented in the AISS plan.

Ask users of stand-alone classified AIS to demonstrate the proper
procedures for upgrading from unclassified to classified processing mode
and the proper procedures to downgrade from classified to unclassified
processing mode. Particular attention should be given to switching
media, sanitization of printers, and completion of required logs.

Ask operators in the CCF or another classified multi-user AIS facility
to demonstrate marking of output generated on central or common
printers.

Verify compliance with site procedures for transfer or distribution of
classified output from a classified multi-user AIS facility to
individual users.

Verify that classified media under user control is properly marked with
classification level and category. Verify compliance with site
procedures for marking media containing software used on classified AIS.

Ask the CSSM to demonstrate that security tests, to verify security
functionality, have been run on a periodic basis.

[Technical Performance Measures]{.underline}

All technical performance tests should be coordinated with the CSSO and
System Manager or Administrator. These tests may require establishing
dummy accounts and/or files.

Verify compliance with AIS security features that block unauthorized AIS
access attempts, such as invalid logons.

Verify compliance with AIS security features that block unauthorized
file access attempts, including attempts to obtain system-level or
elevated privileges.

Verify that automatic inactivity logouts, if implemented, conform to the
time limits specified in the Classified AIS Security Plan.

Verify that software used to enforce automatic classification marking on
hard copy output fulfills its function.

Verify that AIS audit trails record all the events and information
specified in the Classified AIS Security Plan. Verify that events used
to conduct other performance tests are included.

If redundant, on-line processors are used, verify that processing can be
switched from the primary processor to the backup processor without
disrupting operations.

**[TEMPEST]{.underline}**

**[Description]{.underline}**

NOTE: Although a separate program, TEMPEST is generally surveyed as a
subset of the Classified AISS subtopic.

[Policy]{.underline} - It is DOE policy to prevent the unauthorized
intercept of compromising emanations that may be present in classified
information processing communication equipment, systems, and components.
To accomplish this:

 All classified information processing application will be evaluated to
determine what, if any, TEMPEST countermeasures are necessary.

 TEMPEST countermeasures will only be provided where required based on
conducting an on-site threat and vulnerability analysis. Because of the
high cost of installing and maintaining TEMPEST countermeasures, the
evaluations will focus on threat and vulnerability analysis.

 The most economical TEMPEST countermeasures will be deployed for areas
deemed threatened by hostile exploitation.

 No TEMPEST expenditure over \$50,000 will be obligated without the
written approval of the DOE Certified TEMPEST Technical Authority. This
limitation includes the costs associated with contractors or
subcontractors hired to assist in the implementation of DOE TEMPEST
programs.

 TEMPEST countermeasures will not be used for unclassified systems or
components.

 A TEMPEST determination (in the form of a memorandum or plan)
documenting the required elements of the site\'s TEMPEST program will be
prepared by the site\'s TEMPEST Coordinator.

[Requirements]{.underline} - Each contractor location which processes
classified information should be evaluated according to national TEMPEST
standards, based on DOE Order 5300.2D and the Information Technology
(IT) Systems Emission Control Manual, Parts 1 & 2. The basis for all
TEMPEST countermeasures should be a function of threat and
vulnerability. All deviations of DOE TEMPEST criteria must be
documented.

[Key Elements/Indicators of the Health/Effectiveness of the
Program]{.underline} -

 A TEMPEST Coordinator has been appointed

 DOE TEMPEST Class determination and Special Review has been conducted
at all locations which process classified information

 RED/BLACK separation of classified IT systems from unclassified IT
systems is maintained

 Recommendations from DOE HQ RED/BLACK Inspections have been
implemented

[Other information of potential use]{.underline} - The following, which
does not represent a complete list of issues, should be taken into
consideration when conducting an evaluation of the TEMPEST Program:

 Integration of the TEMPEST Program with the other security programs,
specifically computer security, physical security and the Facility Data
and Approval process, to ensure TEMPEST determinations are made for
subcontractors

 Appropriate/approved TEMPEST countermeasures have been identified in
classified computer security plans

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

29, 30, 46, 68, 84 and 87.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the TEMPEST Program,
to include TEMPEST countermeasures determinations, site-specific
procedures, results and corrective actions to DOE HQ RED/BLACK
Inspections, integration with other security programs, and other
elements essential to a viable TEMPEST Program.

**[Documentation]{.underline}**

Prior to an actual visit to the facility, the following documents should
be requested from the appropriate federal employee or sponsoring
contractor, program office, etc.:

 TEMPEST Coordinator appointment memorandum

 Site DOE TEMPEST Class Determination Memorandum or TEMPEST Plan, with
DOE HQ acknowledgement or approval

 Last DOE HQ RED/BLACK Inspection Report, with site\'s corrective
actions, if any

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE orders or other requirements (the TEMPEST
memorandum or TEMPEST Plan is the baseline for inspections)

 Identify inconsistencies or contradictions with other documentation

 Ensure understanding of and familiarity with the protection aspects of
the TEMPEST program as implemented by the site

 Identifying deviations to DOE orders that the facility may have
pending and/or approved

**[Interviews]{.underline}**

 TEMPEST Coordinator

 Site Computer Security Site Manager

**[Performance Measures]{.underline}**

 Visual checks to evaluate separation criteria as documented in the
site\'s TEMPEST determination.

 Verification that the TEMPEST Coordinator has the necessary documents
and reference material to make a judgmental decision as to the Class of
a facility and to determine the appropriate TEMPEST countermeasures (IT
Systems Emission Control Manual, paragraph 1.1)

**[VI.]{.underline} [TECHNICAL SURVEILLANCE
COUNTERMEASURES]{.underline}**

**[Description]{.underline}**

The National Technical Surveillance Countermeasures Program was
established in response to requirements contained in Executive Order
12333, \"United States Intelligence Activities,\" dated December 4,
1981, and Director of Central Intelligence Directive (DCID) 1/22,
\"Technical Surveillance Countermeasures,\" dated July 3, 1985. These
documents establish broad requirements for the conduct of the National
Technical Surveillance Countermeasure Program. The Department of Energy
Technical Surveillance Countermeasures Program must be consistent with
Federal policies, procedures, and standards.

The DOE Technical Surveillance Countermeasures (TSCM) Program was
implemented to prevent the unauthorized loss of classified information
by detecting, exploiting, and nullifying audio or visual monitoring
devices which may be targeted against the Department of Energy. The
purpose of the TSCM program is to detect technical penetrations,
identify technical security hazards, and discover security weaknesses.
The Department of Energy should use Technical Surveillance
Countermeasures in conjunction with physical security, personnel
security, communications security, and computer security measures to
protect classified information and other security interests in
Department of Energy facilities or the facilities of its contractors.

Key elements of the effectiveness of the DOE TSCM Program rest on the
cooperation and program knowledge of the TSCM Team members, TSCM
Officers, and the implementation of the local TSCM Program by the
cognizant DOE TSCM Operations Manager. Easily accessible TSCM Program
classified and unclassified documents, TSCM service reports, and policy
letters indicates an organized and effective TSCM infrastructure. A
clear and concise TSCM service schedule shows effective management of
the local TSCM Program.

Other key elements are the evidence of a broad reaching and informative
briefing and TSCM awareness program, encompassing all DOE and contractor
site personnel. Team files should be orderly, readily available, and
complete. Knowledge of the TSCM filing system and contents thereof by
all team members indicate a consistent and thoughtful approach to
meeting TSCM Program requirements. An aggressive and documented TSCM
equipment maintenance and calibration program indicates attention to
detail. The official documentation of all TSCM team member training,
including a formal in-house training program, is imperative to
conformance with the intent of the DOE TSCM Program. Logical and
effective tracking of TSCM services and reports is paramount to meeting
TSCM Program requirements for the conduct and documentation of all TSCM
activities.

Many aspects including the conduct of TSCM services and TSCM service
reports, are classified under the guidance of Chapter 16, CG-SS-3,
Classification Guide for Safeguards and Security Information.
Appropriate clearances must be obtained prior to beginning a survey of
the TSCM Program.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

10, 22, 68, 81, 82 and 89.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the TSCM Program, to
include administration, procedures, scheduling, reporting, tracking of
services and corrective actions, and other elements essential to a
viable TSCM program is essential. Key program elements to be reviewed
include the TSCM Operations Manager (management documentation and local
implementation policy), TSCM Officers (files), and the servicing TSCM
Team (reports and program documentation).

**[Documentation]{.underline}**

Local policy and implementation guidance.

TSCM service case files including inspections, surveys, advise and
assistance, and preconstruction services.

Scheduling documentation.

TSCM service schedule.

TSCMO service files and corrective action reports.

TSCM team equipment maintenance and calibration files.

TSCM team training and certification records.

Local TSCM threat awareness and education program.

Local security procedures, safety concerns, facility layout, site
operation, and badge procedures.

Deviations to DOE directives the facility may have pending and/or
approved.

**[Interviews]{.underline}**

DOE TSCM Operations Manager

DOE TSCM Operations Management Representative (TSCMOMR), if appropriate

Contractor TSCM Officer(s)

TSCM team manager and TSCM technicians

**[Performance Measures]{.underline}**

Evaluation, by a knowledgeable individual, of a TSCM Team\'s ability to
conduct a TSCM survey.

Questioning of TSCM Team members concerning the reporting procedures of
a TSCM penetration or hazard.

Unannounced questioning of federal and contractor employees who work in
areas which receive TSCM services concerning TSCM threat awareness and
procedures for reporting a possible/suspected penetration.

Knowledge of the contractor Technical Surveillance Countermeasures
Officer (TSCMO) or other point of contact for all TSCM service requests
or concerns.

**[VII.]{.underline} [OPERATIONS SECURITY]{.underline}**

**[Description]{.underline}**

POLICY: It is the policy of DOE that OPSEC techniques and measures shall
be utilized to provide reasonable assurance that critical and sensitive
information regarding national security and energy programs are
protected from compromise and secured against unauthorized disclosure.

INDICATORS OF EFFECTIVENESS: Indicators of the effectiveness of an OPSEC
program may be found in certain key elements, such as:

a\. Are selected tasks useful and achievable. Tasks must directly
contribute to management goals, and must be accomplished with a
reasonable amount of effort.

b\. Are as many people as possible involved? An effective program must
rely on the regular input of small amounts of time by many people.

c\. Are there steady levels of activity? While occasional focused
efforts are necessary (e.g., an OPSEC Assessment of a new program), a
sound program requires a continuous level of distributed activity.

d\. Does the OPSEC program have a high degree of visibility? An
effective OPSEC program thrives on visibility; be visible to everyone at
a facility, from top to bottom.

e\. Does the OPSEC program have credibility? Representing OPSEC in ways
that fit in with the organization\'s culture will inspire confidence and
invoke trust in the program.

f\. Is the technology understood? Effective OPSEC managers understand
the technical side of the organizations functions, and can communicate
about technical requirements with a real understanding of their impact
on facility operations.

g\. Does the OPSEC manager exercise tenacity and patience? Effective
managers take a long-range view of their programs and develop strategies
for consistently achieving their objectives.

h\. Are there indicators of \"organizational commitment?\" The four
major characteristics of effective management commitment are identified
as 1) active membership in security organizations, 2) job satisfaction,
3) the willingness to sacrifice some self-interest for the welfare of
the organization, and 4) recognition or reward of staff for hard work or
innovative behavior.

i\. Is the focus on achievement? Is proactive rather than reactive
change emphasized? Effective program management has a vision of what
they want to accomplish and focus on achieving it.

j\. Is there a \"big-picture\" perspective? In addition to handling
day-to-day problems, effective OPSEC managers must take time to consider
both internal and external events and their likely impact on operations
security.

k\. Is emphasis placed on the bottom line? With today\'s shrinking
security dollar, OPSEC managers must be very cost-conscious in
considering ways to economize while still getting the job done.

l\. Is there an open and honest path of information? Sharing information
with others is important in resolving situations, often before they
become troublesome.

m\. Is a win/win result pursued? When conflicts arise, effective OPSEC
managers should work hard to structure the situation so that both
parties gain.

n\. Are the following people-oriented skills practiced?

1\. Accepting people as they are and working to develop needed technical
skills.

2\. Approaching relationships in terms of the present rather than the
past.

3\. Treating colleagues with the same courteous attention extended to
strangers and casual acquaintances

4\. Trusting others even when it involves some risks.

5\. Not being dependent on constant approval and recognition from
others, emphasizing the importance of individual initiative and group
efforts.

OTHER CONSIDERATIONS: Consideration must be given to special access
requirements. In addition to Restricted Data, additional authorizations
may be required, such as for SCI or other special access programs.

**[References]{.underline}**:

The following references (Attachment 3) apply to this section:

68 and 83.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the OPSEC Program, to
include administration, procedures, scheduling, reporting, tracking of
services and corrective actions, and other elements essential to a
viable OPSEC program. Key program elements to be reviewed include the
OPSEC Manager, OPSEC Working Groups, OPSEC Program Plan, and OPSEC
Program Files.

**[Documentation]{.underline}**

DOE O 471.2 requires the development and maintenance of certain
documentation. Specific OPSEC program documentation to be developed and
maintained are:

 OPSEC Plan

 OPSEC Procedures

 OPSEC Program Files

 Local Threat Statement

 Critical and Sensitive Information List

 Essential Elements of Friendly Information

 Counter-Imagery Program Plan (if applicable)

**[Interviews]{.underline}**

Identified interviewees by position titles:

 OPSEC Program Manager

 CI Program Manager

 OPSEC Working Group Chairperson

 Director/Manager of Safeguards and Security

 Classification Officer

 Contracting Officer

 Program/Project Manager of selected sensitive activities.

**[VIII.]{.underline} [UNCLASSIFIED AUTOMATED INFORMATION SYSTEMS
SECURITY]{.underline}**

**[Description]{.underline}**

[Policy]{.underline} - DOE unclassified automated information systems
(AIS) shall be appropriately protected from abuse and misuse. Sensitive
unclassified automated information shall be protected from unauthorized
access, alteration, disclosure, destruction, or improper use as a result
of improper actions or adverse events. Unclassified systems and
unclassified computer applications which support DOE mission essential
functions shall be appropriately protected. Appropriate security
measures shall be utilized to protect unclassified computer systems and
automated information in a cost-effective manner.

[Requirements]{.underline} - This element should review and evaluate the
requirements, policies, responsibilities, and procedures for the
development, implementation, and maintenance of a DOE unclassified
automated information systems security program.

[Key Elements/Indicators of the Health/Effectiveness of the
Program]{.underline} - Some of the key elements of an Unclassified AIS
program are:

a\. Computer Protection Plan(s) that address the overall unclassified
AIS security program as well as individual systems.

b\. Sensitive application certification, including security testing, has
been performed and documented.

c\. Compliance reviews of the unclassified AIS program have been
conducted.

d\. Basic documentation exists and is accurate (plans, polices,
procedures, etc.);

e\. CPPMs have all the documentation that they are required to have;

f\. Sensitive Unclassified information has been defined and addressed in
the facilities procedures and other documentation and, specifically, in
the AIS Protection Plan(s). Users of unclassified AIS can identify
Sensitive Unclassified information and protect it appropriately.

g\. The required Long- and Short-Range Plans have been developed and
implemented.

h\. Waste, fraud and abuse audits have been conducted and documented on
a regular, ongoing basis.

i\. The computer security staff have been trained and are knowledgeable
of program requirements; and

j\. Unclassified AIS users have been trained and are knowledgeable of
the program requirements.

[Other information of potential use]{.underline} - The following, which
does not represent a complete list of issues, should be taken into
consideration when conducting unclassified AIS evaluations:

a\. Coordinate all performance tests with the CPPM and system
manager(s); and

b\. Structure performance tests so that if problems arise during the
conduct of test, the tests may be quickly and safely halted.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

23, 24, 25, 26, 27, 33, 34, 35, 39 and 67.

**[Survey Content]{.underline}**

Evaluation of the planning, implementation, and management of the
Unclassified AIS Security Program should include a review of the major
aspects of the program at the inspected site. The main elements to be
reviewed are the Computer Protection Plan (CPP), Certification and
Recertification Documentation, Contingency plans, Disaster Recovery
Plans, Unclassified Computer Security Incident Reports, Waste, Fraud and
Abuse Audit Reports, Training Records, Risk Assessments, and the
Management Control Process (MCP).

**[Documentation]{.underline}**

The following documents should be reviewed:

 AIS Protection Plan(s)

 Risk Assessments

 Certifications

 Recertifications

 Contingency Plans

 Disaster Recovery Plan(s)

 Waste, Fraud and Abuse Audit Procedures and Documentation

 Long- and Short-Range Plans

 Unclassified AIS Security Incident Reports

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE orders or other requirements;

 Identify inconsistencies or contradictions with other documentation;

 Educate the survey team member on local implementation of the
requirements and the facility layout;

 Develop performance testing ideas; and

 Identify deviations to DOE directives the facility may have pending
and/or approved.

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Computer Protection Program Coordinator;

 Site Managers (DOE and Contractor);

 Computer Protection Program Manager (CPPM);

 Assistant CPPMs;

 Computer Incident Response Team Members;

 Emergency Response Personnel;

 Application/Data Owners;

 Information Management Staff; and

 Representative sample of end users.

**[Performance Measures]{.underline}**

1\. PERSONAL COMPUTER PERFORMANCE TEST

[Objective]{.underline}: To determine whether personal computer systems
and the information processed on them are protected in accordance with
approved computer protection plans.

[Scenario]{.underline}: The survey team will select a sample of PCs from
information provided by the site. The systems selected for testing will
be at the discretion of the survey team and quantity of systems to be
reviewed will be based upon the scope of the survey. At the location of
a PC, the survey team will verify by observation that equipment and
storage media are appropriately marked and protected. Survey team
members will have the user or responsible security officer provide
license agreements and original disks for all software used on the
system. For software that is site-licensed, original disks may not be
required at each user system.

Survey team members will have the user or responsible security officer
start the system and list directories or folder contents on the display
to check for unauthorized use of government-owned equipment. If the PC
is capable of connecting to other computer system(s), team members will
also have the user or responsible security officer display the
configuration parameters to evaluate the effectiveness of the
configuration. Concurrently, users and/or responsible security officers
will be questioned regarding their specific responsibilities. Waste,
fraud and abuse audit reports should be requested and reviewed.

[Evaluation Criteria]{.underline}: DOE 1360.2B

2\. MAGNETIC MEDIA PERFORMANCE TEST

[Objective]{.underline}: To evaluate the accuracy of the magnetic media
marking.

[Scenario]{.underline}: The designated media will be inspected in their
storage location (i.e., magnetic media library). Reels and cartridges
will not be removed from their storage shelves/racks until needed by the
survey team member.

Front Check: The survey team will designate a random sample of media
from those listed in library records.

Back Check: The survey team will randomly select media and check for
markings.

[Evaluation Criteria]{.underline}: Media Labeling procedures contained
in site documentation.

3\. IDENTIFICATION AND ACCOUNTABILITY MECHANISMS

[Objective]{.underline}: To determine whether the automated protection
mechanisms used to control and audit valid and invalid logon attempts
are functions as intended and as described in the Computer Protection
Plan.

[Scenario]{.underline}: This test may be conducted from a normal user
terminal, a system console, or both. A terminal capable of privileged
access may also be needed to reactivate any accounts or ports that may
be \"locked out\" during the test. The authorized designee will conduct
the test under the supervision of the survey team member.

The team will have the designee logon to the system with a correct user
ID and authenticator to determine normal system response, followed by
several combinations of invalid logon attempts to observe system
response. The designee will also be asked to leave the terminal or
console logged on while initiating a session on another terminal. The
same security features should be present on the second terminal during
this simultaneous session.

After all tests are complete, the survey team will examine the system
audit trail to determine whether appropriate transactions have been
recorded.

[Evaluation Criteria]{.underline}: DOE 1360.2B, 11.e.(1)

**[IX.]{.underline} [PROTECTED DISTRIBUTION SYSTEMS]{.underline}**

**[Description]{.underline}**

[Policy]{.underline}

It is Departmental policy to use the protected distribution system (PDS)
only when the system is designed, engineered, installed, operated, and
maintained in a manner that ensures emission security (TEMPEST),
technical, and physical protection against access by unauthorized
personnel.

A protected distribution system is one of three ways in which classified
information can be securely transmitted. Use of cryptographic equipment
is preferred; intrusion detection optical communications systems is also
approved. A protected distribution system is no longer required inside a
secure communications center when transmission is from the cryptographic
equipment to a terminal. This is a \"distributive network,\" and normal
RED/BLACK criteria would apply.

[Requirements]{.underline}

Caution should be observed in planning a system in order to reduce or
eliminate security hazards consistent with the judicious use of funds.
It is essential that security officials work closely with communications
officials to obtain a cost-effective system that affords adequate
security protection.

A protected distribution system may traverse controlled or uncontrolled
access areas or may be installed wholly within an area accessed by
cleared personnel. Installation criteria for each system will vary
according to the security clearances of unescorted personnel,
classification of the information being handled, and access controls
exercised over these areas.

Cost and operational impact of maintaining the security of the system
must be assessed prior to acquisition and installation, as such cost can
easily exceed the installation cost of other systems.

A protected distribution system may only be used after the appropriate
authority has approved the system and certified that it is less costly
over the long term than other information security systems, it can
provide continuing protection, and maintenance and inspection records
will be maintained.

[Key Elements/Indicators of the Health/Effectiveness of the
Program]{.underline} -

 DOE-approved PDS Plan, which may be part of another security plan,
i.e., TEMPEST or Computer Security

 Results of last DOE HQ TEMPEST RED/BLACK Inspection and status of any
corrective actions

 Appointment of a knowledgeable individual who is responsible to
coordinate all PDS activities

 Accountability of PDS runs and signal cabling

 Technical inspections, such as technical surveillance countermeasures
(TSCM), are accomplished in accordance with the Threat Assessment
Scheduling System

 Inspections of a PDS installed outdoors must not be encumbered by
bushes, shrubs, or other obstacles

 Effective configuration management and change control systems are
used.

[Other information of potential use]{.underline} - The following, which
does not represent a complete list of issues, should be taken into
consideration when conducting an evaluation of the Protected
Distribution System:

 Integration of the PDS Plan and activities with other security
programs, to include physical security, computer security, etc.

 Coordinate all PDS inspections with the TEMPEST Coordinator, the
site\'s designated individual to coordinate all PDS actions, and the
Computer Security Site Manager

 PDS criteria need not be implemented for alarm systems PDS used
exclusively for the transmission of site intrusion alarm, control, or
monitoring/signaling information. There are no TEMPEST or separation
requirements for such PDS unless other classified information is being
transmitted.

 Determine that additional protective measures are employed should a
PDS run be located in a facility for which access to the area changes
upon use, e.g., a controlled area requiring escort procedures for
uncleared personnel changing to an uncontrolled area, where no
requirement for a clearance or escort exists.

 Coordination with the TEMPEST Coordinator to determine the potential
need for a PDS at subcontractor locations

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

46, 48, 68, 84 and 85.

**[Survey Content]{.underline}**

Evaluation of the installation and management of the Protected
Distribution System, to include periodic inspections, system
administration, site-specific procedures, and other elements essential
to a viable PDS.

**[Documentation]{.underline}**

Prior to an actual visit to the facility, the following documents should
be requested from the appropriate federal employee or sponsoring
contractor, program office, etc.:

 A copy of the site\'s PDS plan, which is the basis for the inspection

 The formal approval to operate the PDS

 The designation from the Contractor Site of an individual
knowledgeable in PDS operation and installation practices to coordinate
activities of DOE 5300.4D

 Results of the biennial PDS reviews

 Records relative to all PDS events or incidents, e.g., inspections,
results of patrols, attempted penetrations, employee reports, line
inspections, alarm events (if applicable), etc.

 Maintenance and inspection records

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE orders or other requirements

 Identify inconsistencies or contradictions with other documentation

 Ensure understanding of and familiarity with the physical protection
aspects of the PDS as defined in the site-specific plan

 Identifying deviations to DOE orders that the facility may have
pending and/or approved

**[Interviews]{.underline}**

 The designated individual who is responsible for coordinating all PDS
activities

 TEMPEST Coordinator

 Technical Surveillance Countermeasures Team Manager

 Site Computer Security Site Manager

**[Performance Measures]{.underline}**

 Visual checks to evaluate separation criteria.

 Inspection for application of security measures of the PDS, to include
protective measures for terminal ends, junction boxes, etc.

**[X.]{.underline} [COMMUNICATIONS SECURITY (COMSEC)]{.underline}**

**[Description]{.underline}**

Prior to the conduct of a safeguards and security survey involving the
COMSEC program, the subtopical survey team should clearly understand the
requirements of Reference 47 (Attachment 3). The Director, Office of
Intelligence and National Security, establishes policies, procedures,
and standards for the physical security of communications security
material and communications security facilities. Audits and surveys of
each Department and contractor communications security account and
cryptographic facility are conducted by the Office of IRM Policy, Plans,
and Oversight biennially or more often if required. These audits and
surveys pertain to the conduct of cryptologic activities, including
crypto-security, transmission security, emission security, and
accounting of communications security equipment, material, and operation
of communications security accounts.

[Policy]{.underline}

It is the policy of the DOE to provide a reliable and responsible
communications security capability for DOE telecommunications in
accordance with the national policy. All classified information
transmitted via Departmental telecommunications shall be secured by
using NSA-approved cryptographic equipment or PDS. Unclassified national
security-related information of value to an adversary transmitted by and
between Government elements and contractors will be given communications
protection commensurate with the associated risk of exploitation.

[Requirements]{.underline}

 Each organization and contractor site under their cognizance requiring
a COMSEC program establishes, implements, and sustains the program in
accordance with the requirements of DOE 5300.3D.

 Appoint, in writing, COMSEC control officers, custodians, and their
alternates. Appointment letters are required for all crypto-personnel.

 Through technical requirements personnel and procurement request
initiators, specify the requirements of DOE 5300.3D in statements of
work and specifications for use in solicitations and contracts.

[Key Elements/Indicators of the Health/Effectiveness of the
Program]{.underline} - Some of the key elements of a effective COMSEC
Program are:

 That basic program documentation exists and is accurate (plans,
polices, procedures, etc.)

 That complete and properly executed documentation on all COMSEC
personnel is maintained, to include appointment letters

 That the COMSEC staff is knowledgeable of program requirements

 Results of DOE HQ COMSEC Audits and the status of any corrective
actions

[Other information of potential use]{.underline} - The following, which
does not represent a complete list of issues, should be taken into
consideration when conducting COMSEC Program evaluations:

 COMSEC material of all classifications shall be accounted for by means
of the COMSEC accounting system, and shall be exempted from other
accounting systems, including Top Secret control document systems and
property management systems (see COMSEC Procedural Guide, Section 8).

 Coordinate all performance tests with the COMSEC Control Officer
and/or Custodian

 Coordinate all inspections within the communications center with the
COMSEC Control Officer and/or Custodian

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

28, 45, 46, 47, 48, 54, 55, 63, 72, 73, 74 and 86.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the COMSEC Program,
to include administration and procedures. Key program elements to be
reviewed include appointment of crypto-personnel, physical security of
COMSEC material and equipment; training of personnel with access to
\"crypto\" material; development of standing operating procedures and
emergency action plans for the protection of COMSEC material, and
development of STU-III security plans, which include provisions for
inventory, accountability and use of the data port for classified
transmissions.

**[Documentation]{.underline}**

Prior to an actual visit to the facility, the following documents should
be requested from the appropriate federal employee or sponsoring
contractor, program office, etc.:

 Copies of COMSEC Security Plans with DOE approvals, which established
the account

 Copies of STU-III Security Plans

 Results of the last HQ DOE COMSEC Audit and any corrective actions

 Records of appointments and changes of COMSEC Control Officer, COMSEC
Custodians, COMSEC Subcustodians, alternates, and any persons having
access to COMSEC materials

 Copies of crypto-personnel training records

 Copies of the Standing Operating Procedures (SOP) for each
crypto-activity

 Copies of the emergency action plan for the protection/destruction of
COMSEC material during emergencies.

Documents should be thoroughly reviewed to:

 Ensure compliance with DOE orders or other requirements;

 Identify inconsistencies or contradictions with other documentation;

 Ensure understanding of and familiarity with the protection aspects of
the site\'s implementation of the COMSEC Program

 Identifying deviations to DOE directives the facility may have pending
and/or approved.

**[Interviews]{.underline}**

 COMSEC Control Officer and alternate

 COMSEC Custodians and alternates

 COMSEC Subcustodians and alternates

 Computer Security Site Manager

**[Performance Measures]{.underline}**

 Inspection of physical protection measures being applied to COMSEC
equipment.

**ANNEX D. NUCLEAR MATERIALS CONTROL AND ACCOUNTABILITY**

**[I.]{.underline} [INTRODUCTION]{.underline}**

This topical area deals with the nuclear material safeguards, control
and accountability. It includes the inventory, control and accounting
associated with the management of nuclear materials under the control of
the surveyed facility.

Safeguards is defined as integrated system of physical protection,
material accounting, and material control measures designed to deter,
prevent, detect, and respond to unauthorized possession, use, or
sabotage of nuclear materials. Nuclear materials control and
accountability (MC&A) is that part of safeguards that detects or deters
theft or diversion of nuclear materials and provides assurance that all
nuclear materials are accounted for appropriately. The purpose of this
section is to provide a basis for planning, implementing, and inspecting
MC&A programs at DOE-owned facilities and for DOE-owned materials at
other facilities.

The DOE policy for MC&A is primarily contained in Order 5633.3B. A
comprehensive MC&A program is comprised of numerous programmatic
elements which DOE 5633.3B defines, in three chapters: Basic
Requirements; Materials Accountability; and Materials Control. The three
chapter headings are the three subtopical areas that are rated in the
Safeguards and Security Survey Report, DOE F 5634.1.

There are two distinct approaches to be used during the conduct of a
survey; compliance and performance evaluations. Neither of these
approaches is sufficient by itself. They must both be employed during
the survey to fully evaluate the MC&A program and arrive at a rating
which addresses the fundamental question as to whether or not material
is at risk.

Compliance is a measure of what has been accomplished to be in
accordance with policy requirements and site policies. The primary
methods for determining compliance are document reviews, interviews, and
tours of the facility. Compliance does not automatically imply that the
system or personnel can perform properly. Lack of compliance with
established policies and procedures does not, by itself, indicate a
system failure or a less than satisfactory program unless system
performance is actually degraded. The lack of compliance may be
mitigated by other measures or a deviation may be approved for the MC&A
system. The mitigation measures should provide protection equal to that
required by DOE policy and should be verified through performance
testing.

Performance evaluations relate to how well systems and personnel
function. Performance evaluations measure execution, accomplishment, or
fulfillment of a prescribed deed or feat. Performance testing of MC&A
elements should be based on the reported performance levels in facility
documentation or against performance standards specifically addressed in
DOE orders. There are two basic means of evaluating performance during a
survey. The first addresses the performance monitoring and testing
program conducted by the facility. The second is performance testing
conducted as part of the survey.

A good MC&A program accomplishes the following which are key indicators
of healthy program:

 Maximizes discrete item control

 Maximizes in-storage control

 Minimizes in-process materials

 Maintains near-real-time accountability

 Restricts personnel access

 Uses accurate measurements

 Performs effective inventories

 Conducts internal reviews and assessments

 Plans and budgets for upgrades

 Maintains qualified, well trained staff

During the planning phase of the survey any special requirements should
be ascertained to determine the impacts on team selection, scheduling,
and additional actions to be completed prior to initiating the field
work. Areas to evaluate include: classification issues that may require
special access authorizations; special training requirements for access
to radiation control or process areas; radiation exposure issues that
may require special dosimeters or special monitoring activities;
facility access controls; and any other safety related considerations.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 57, 58, 59, 66, 89 and 90.

**[Survey Content]{.underline}**

The most effective method of developing survey ratings addressing the
three subtopical areas of Basic Requirements, Materials Accountability,
and Materials Control is to break the areas down to elements which lend
themselves to a more detailed review.

Basic Requirements primarily pertains to the administration of the MC&A
program, addressing program planning and policy implementation through
documentation. Materials Accountability is best addressed by
individually evaluating the elements of accounting, measurements and
measurements control, and inventory. Materials Control addresses the
various methods used to ensure material is maintained in authorized
locations and material movements are properly authorized and
unauthorized actions are detected.

A review of these topics should provide an indication of MC&A program
performance and effectiveness. The level of the review and evaluation
for each topical area depends on its significance to the total MC&A
program and the strengths and weaknesses identified during the survey.
The combination of compliance evaluations and performance testing
provides the survey team with information needed to determine the MC&A
system\'s capability to meet its design objectives. Specifically the
system must detect removal of material from its authorized location,
provide assurance that material has not been removed and confirm its
status, and provide assurance that the various system elements are
operating as designed.

**[Documentation]{.underline}**

Prior to the actual site visit, documents need to be requested and
received from the facility to be surveyed. Documentation requiring a
thorough review and detailed understanding include: the Site Safeguards
and Security Plan (SSSP) or, if not applicable, the Site Security Plan
(SSP); Master Safeguards and Security Agreement(s) (MSSA); the
applicable Facility Data Approval Record (FDAR); and the MC&A plan. From
these documents, the survey team can become familiar with the site
layout, site mission, and identify potential targets as part of the
scoping during the pre-survey planning process. Additional documentation
that will be required either during the pre-survey planning or field
work includes:

 Training and qualification program plan

 Procedural directives

 Emergency plans

 Vulnerability assessments (VA)

 Performance testing program

 Internal review and assessment program plan and results

 Accounting system data base and procedures

 Deviations

 Previous survey report(s)

 Open findings status list

 Security Evaluations report(s)

**[Interviews]{.underline}**

Meetings should be scheduled and interviews conducted with the
following:

 Management official responsible for MC&A

 Tamper-indicating device (TID) administrator

 TID applicators and custodians

 Internal review and assessment personnel

 Material Balance Area custodians

 Measurement control coordinator

 MC&A training coordinator and instructors

 Accounting manager and accounting personnel

 Emergency preparedness program management,

 Emergency response implementing personnel

 Building management

**[Compliance Measures]{.underline}**

Detailed compliance measures will be found in the Standards and
Criteria. The following basic requirements will, however, assist in the
evaluation of each element of a MC&A program.

**[Subtopical Areas]{.underline}**

The following subtopical areas comprise this topical area:

A. BASIC REQUIREMENTS

B. MATERIAL ACCOUNTABILITY

C. MATERIAL CONTROL

**[II.]{.underline} [BASIC REQUIREMENTS]{.underline}**

ADMINISTRATION - The administration subtopic is comprised of eight
components: documentation; training; internal reviews and assessments;
performance testing program; graded safeguards; incident reporting;
emergency response; and termination of safeguards. The following
compliance issues associated with each component and review methods and
objectives should be the primary focus of the survey.

[Documentation]{.underline} - Is essentially required for all elements
of the MC&A program following the adage that if it is not documented, it
never happened. However, when reviewing this component there is specific
documentation that must be generated by the facility and which must be
reviewed. This component includes the organization and management, MC&A
plan, VA/MSSA/SSSP, deviations and procedures.

Organization and Management - This component addresses the
responsibilities for the control and accountability of a facility\'s
nuclear material inventory. Survey team members should look at the
following:

 The designated management official responsible for the MC&A program at
the facility must be determined. Is the person appropriate and at a
sufficient level to achieve effective program implementation?

 Facility organizational charts should be reviewed and MC&A and process
personnel interviewed to determine if the MC&A function is sufficiently
independent from production operations to assure that there are
conflicts of interest that might be detrimental to the protection of
nuclear materials.

 All of the MC&A functions that apply at the facility and the
individual responsible, at all levels, for each function must be
determined. The MC&A functions are most likely described in the facility
MC&A Plan and the reviewers should verify that these descriptions
accurately represent the current structure of the MC&A program.

 A review of the facility MC&A Program documentation and contractor
policies will provide a list of the authorities and responsibilities for
the MC&A function. Are they thoroughly documented and followed?

[MC&A Plan]{.underline} - The MC&A plan documents facility plans and
procedures for the control and accountability of nuclear materials. It
addresses planning and management, threat considerations, performance
criteria, accounting systems, measurements, measurement control,
physical inventories, control limits, loss detection elements, training,
response to nuclear material alarms, access controls, anomaly
resolution, containment, and surveillance. Survey team members should
look at the following when addressing this component.

 First, there should be a plan and it should be current and approved by
facility management and the cognizant Manager, Operations Office.

 It should address all of the DOE requirements for control and
accountability of nuclear materials.

 There should be a schedule for periodically reviewing and updating the
plan. There should be evidence that this review has been conducted as
scheduled.

 Facility personnel with MC&A responsibilities should be familiar with
the plan as it relates to their duties. Documentation should exist which
shows the distribution list for the plan and its revisions (change
control), to ensure that all those individuals who need to have access
to the plan actually have a current copy.

 The MC&A plan should address the insider threat and the controls to
assure detection and response.

The graded program required by DOE should be fully described in the
plan.

 The MC&A plan is the guiding document and there should be references
to MC&A procedures implementing the policies.

 The plan and procedures should be consistent and current with observed
practices.

 The plan should also include a description of how the MC&A program is
integrated with security programs to provide an overall protection
program.

[VA/MSSA/SSSP]{.underline} - These documents (if applicable) were
previously identified for review during the planning phase to
familiarize the survey team with the facility operations, performance
levels and potential targets. During the conduct phase, the
documentation should be reviewed from the perspective of validating the
data for consistency and accuracy. The performance of a system is used
to support the protection philosophies described in the MSSA. The
performance level is determined through the conduct of performance tests
which are an integral part of the VA completed to document the
capability described in the MSSA. Benchmarks described as levels of
performance are easily identified when reviewing these documents and
make excellent areas for performance testing when the applicable topical
area is addressed. The SSSP documents the compilation of the overall
safeguards and security program; it too should be reviewed. The survey
team members should look at the following when reviewing this component.

Loss detection elements must be specified in the MC&A plan. The survey
team should review all available vulnerability assessments for SNM
facilities and determine if these loss detection elements have been
addressed. Determine if all Category I facilities have VAs and that VAs
have been performed on facilities containing Category II or III
quantities where credible rollup scenarios are identified.

The reviewer should review all assumptions used in the VAs and
independently assess whether credible rollup scenarios exist. Bring any
concerns to the facility point-of-contact, such as determining why VAs
were not conducted. Determine if VAs are reviewed annually and updated
when system changes or new information indicates a potential change in
risk to the material.

VAs should be evaluated to determine that MC&A elements have been
addressed and that the detection probabilities specified are supported
by performance testing and/or expert judgement.

 Was the full threat spectrum used and were multiple scenarios
evaluated and documented? Were both single, abrupt and protracted theft
and diversion scenarios documented? Have site-specific threats been
addressed?

 Does the SSSP identify all agreements, deviations or special operating
conditions in place?

 Is the documentation consistent with the MC&A plan, procedural
directives and security-related documentation and does it accurately
correlate with conditions at the facility?

For Category I facilities and for Category II facilities within the same
Protected Area (PA) for which roll-up to a Category I quantity is
possible,

safeguards and security systems are to provide defense-in-depth to
assure that the failure of one component of the safeguards system will
not increase the level of risk for the system above an acceptable level.

[Deviations]{.underline} - If the facility has any approved deviations,
or if any have been requested and are pending, the survey team members
should look at the following when reviewing this component:

 Have all of the measures identified in the documentation addressing
the deviations remained in effect since they were originally validated?

 Have the deviations been accurately identified and reflected in other
facility documentation?

[Procedures]{.underline} - Procedural directives that implement the
policies defined in the MC&A plan or other documentation must be in
place. Each policy should have a procedure to ensure that it can be
implemented and the plan and procedures should be consistent. Survey
team members should look at the following when reviewing this component.

 Does the facility have, and require compliance with, one or more
procedural directives?

 Are the procedural directives compatible with the MC&A plan to
facilitate an effective, integrated safeguards system?

[Training]{.underline} - The key to the success of any MC&A program is
the knowledge of its personnel. In addition, personnel must demonstrate
the ability to consistently perform their duties and responsibilities.
In other words, it is not enough to know "how to do the job". Personnel
must also demonstrate the skills to perform what they know. The reviewer
must determine, through interviews and testing, if the MC&A and MC&A
support personnel are knowledgeable of their duties, and are qualified
to carry them out.

The facility shall have a program to assure that personnel performing
MC&A functions are trained and/or qualified to perform their duties and
responsibilities.

Some of the requirements for a good training program are course lesson
plans and schedules, records of student attendance, and documentation of
instructor qualifications. It is also necessary to demonstrate
evaluation methods for the training - whether they are knowledge or
performance tests. While it enhances the quality of the training to have
prepared overhead and video presentations, they are not required if it
can be demonstrated that there is a method in place for consistently
delivering training.

The facility should have or be able to describe their process for
obtaining personnel. The reviewer should determine if those procedures
are adequate to ensure that personnel with appropriate knowledge,
skills, and abilities are performing MC&A functions.

When reviewing this component the survey team should look at the
following:

 Is there a documented training program plan? Is the program
implemented as described?

 Are training records maintained and are they retrievable? Do they
reflect training attendance that complies with the documented plan?

 Evaluate the training methods to determine the degree of
effectiveness.

 Determine how the students learning is evaluated. How are knowledge
skills evaluated? How are performance skills assessed? For example, it
is inappropriate to test a student's ability to apply a
tamper-indicating device through a knowledge test. These types of skills
need to be evaluated by performance demonstration.

[Internal Reviews and Assessments]{.underline} - DOE 5633.3B requires
that each facility possessing nuclear materials must conduct system
assessments to assure the integrity and quality of the MC&A system.
Assessment of the integrity and quality involves determining
effectiveness of the MC&A system to deter, prevent, detect, and respond
to unauthorized removal of SNM from its authorized location.

Administrative controls are implemented at the facility as a management
tool to determine if the MC&A program, as implemented, meets DOE and
company requirements. It is designed to both prevent and detect material
losses or diversion, and it provides an evaluation of program
effectiveness. The process is usually referred to as an internal review
and assessment program.

When surveying this topic, it must be determined if an assessment
program exists and the effectiveness of its implementation. When new
facilities come on-line or a new process becomes operational, an
internal review and assessment should be conducted to assure that MC&A
program requirements are being met and assure that the operations are
consistent with documented system descriptions. The comprehensiveness of
the internal review and assessment program is important, in order to
lend credibility to the MC&A program administrative controls. The
internal reviews and assessments should combine compliance reviews and
performance assessments (just like surveys). The survey team member
should look for the following when reviewing this component:

Does the facility review and assess all of the systems that comprise the
MC&A program? Are the reviewers qualified? The answers to these
questions will provide the survey team member with an indication of the
program quality.

 Review the facility\'s plans and procedures to determine compliance
with program plan.

 Check corrective action schedules and validation of corrective
actions.

 Review the internal review and assessment documentation and compare
the results with observations and independent testing.

 Does the internal review and assessment have: a system for verifying
procedures/practices; a system to show material controls are effective;
and a system for reviewing inventory, accountability, internal
transfers, and ingress/egress practices.

The facility must have a documented system review program to provide
verification of procedures and practices and to show that material
controls and accountability practices are effective.

[Performance Testing]{.underline} - There are three parts to DOE 5633.3B
that must be assessed as part of the survey program. Vulnerability
assessments (VAs) are performed to identify the most important system
elements for detection-in-time-to-prevent theft or diversion.
Performance testing is required for those elements which provide
detection-in-time-to prevent theft or diversion, and those elements
which provide assurance that the material is present and the detection
systems are working properly. Minimum performance levels are specified
for some detection elements. Performance testing results should validate
VA data.

Performance tests must include not only loss detection elements, but
also elements that can effectively account for SNM in order to provide
assurance that safeguards and security systems are functioning properly.
The reviewer should verify that tests focus on the individual detection
elements and that critical elements identified by the VAs have met
approved testing frequencies. The evaluation of the facility\'s MC&A
performance testing program should answer the following questions:

 Is the facility management committed to conducting performance tests
on aspects of the safeguards system which are amenable to such testing?

 Are performance tests well planned and do they provide valid
indications as to the function of the subject aspect of the safeguards
system? Are any quantitative judgements resulting from performance test
results based on a sound statistical analysis?

 Are the results of performance tests well documented? What has been
the facility\'s management response to any test failures? Have any
\'lessons learned\' from performance testing been used to enhance the
safeguards system?

 Have critical system elements been identified and are they tested to
verify their continued operability and effectiveness? Is an annual test
performed, encompassing critical system elements associated with a
comprehensive site or facility threat scenario?

 Are systems performance tested after each instance of an
inoperative/ineffective condition or after any repairs/alterations.

Minimum performance requirements have been specified by DOE for access
controls, material surveillance, TIDs, portal monitoring, accounting
record systems, inventory confirmation/verification measurements, and
inventory difference control limits. Validation of these system elements
must be accomplished by performance testing.

The reviewer should review all performance testing results to determine
if the results support the required performance levels. In addition, the
quality of the tests should be assessed to ensure that tests are
well-designed and valid tests to assess performance. If quantitative
judgements resulting from performance test results are made it should be
determined if they are based on sound statistical analysis. The reviewer
should also determine if additional system elements have been assigned
performance standards that must be met.

Performance tests are to be designed and conducted to fully evaluate the
effectiveness of access controls and material surveillance activities
for Category I and II quantities of SNM. In at least 95% of the tests
conducted, the tests shall demonstrate the detection of unauthorized
access to Category I and II quantities of SNM.

[Graded Safeguards]{.underline} - One of the fundamental drivers behind
the DOE policy addressing MC&A is that all material is not created
equal. Categorization of Material Balance Areas based on the
attractiveness and quantity of material lends itself to the application
of the most stringent safeguards to the most attractive materials from a
theft or diversion viewpoint.

Material categorization forms the basis for the facility\'s overall
protection program. If a facility is not properly categorized, then the
nuclear materials may be at risk. The reviewer must thoroughly examine
the categorization process and designations of Material Balance Areas
(MBAs) and facility categories to determine if the assigned category
level is appropriate. The types of materials included in the category
determination should be available in a description of the area or
process. As part of the investigation, the reviewer should verify that
the DOE Operations Office has approved the categorization.

There are many scrap materials present that may fall in different
attractiveness levels, that could influence the outcome of the category
determination. Procedures for determining category levels are specified
in DOE 5633.3B and the \"Guide for Implementation of DOE 5633.3A.\" The
survey team member should check MBAs and facilities to determine if all
potential materials have been considered when category levels were
established. The categorization must be performed by Material Balance
Area (MBA), but facilities, buildings and sites may also be categorized.

Probably the most important task for the survey team member is to
determine if the controls that are in place are sufficient to ensure
that the category levels are not exceeded. If the category levels have
been exceeded, there is the possibility that nuclear materials are
under‑protected, and therefore, at risk.

When determining the category level, rollup must be considered. Rollup
is mentioned in two places in the Order. The first citation refers to
MBA categorization and the second refers to protection levels for
materials inside a Protected Area.

One DOE definition of rollup states that it is the credible summation of
material to a Category I quantity or the credible summation of smaller
quantities of material to achieve a higher category. The difficulty
comes when trying to accurately determine when is it credible. That
determination must be made considering all of the protection measures in
place in the area and their effectiveness. In most cases, a VA is
conducted to determine credibility. However, rollup must also be
considered in all areas that are less than Category I. The reviewer
should be familiar with all of the facilities or areas where the
potential exists to have a Category I quantity.

[Incident Reporting]{.underline} - When an MC&A anomaly or an abnormal
situation occurs, the facility may classify it as either an Emergency,
Unusual Occurrence, or Off-Normal Occurrence, conducts an investigation
and reports to DOE. The anomalies that must be reported are specified in
DOE 5633.3B and DOE M 232.1-1. Operations offices may require additional
local reporting, and any additional requirements must be clearly
understood. When reviewing this component, the survey team should review
all incident reports submitted to determine if:

 Abnormal situations were immediately assessed.

 Unresolved situations were properly reported and investigated.

 Apparent losses of Category I or II quantities of SNM were reported as
required by the DOE orders.

 Malevolent acts were reported.

 Inventory differences outside controls were reported.

 Abnormal situations, alarms, and new information were reported.

 Incident reports follow requirements in the DOE orders, facility
procedures, and local Operations Office guidance.

[Emergency Response Plans]{.underline} - Emergency Plans document how
discrepancies or unusual situations that could indicate a loss of
control of nuclear material or that could reduce the facility\'s
capability to prevent or detect a loss of nuclear material are handled
and resolved. When reviewing this component the survey team should:

Determine if the emergency plans address health, safety & environment,
operations, security, and emergency interfaces.

Determine that appropriate personnel responsible for emergency responses
are identified in the plans.

Do the plans address control measures in effect during an emergency,
such as nuclear material alarm evaluation and threat responses

Do the plans address special inventories after emergency evacuations?

The reviewer must determine if:

 The emergency plans and responses are consistent with DOE Orders.

 The personnel, both MC&A personnel and operations personnel with
command and control functions, are knowledgeable of the MC&A responses

 The Emergency Operations Center plan is adequate to address all
possible MC&A emergencies. This determination is most likely tested
during a site-wide emergency management exercise.

[Termination of Safeguards]{.underline} - The survey should evaluate any
material for which safeguards have been terminated to verify that only
appropriate material was involved or that all the appropriate approvals
were obtained.

Nuclear materials declared waste prior to the issuance of DOE 5633.3B,
for which safeguards have been terminated shall meet the following two
requirements:

1\. The material has been written off the MC&A books.

2\. The material is under the control of a waste management
organization.

When an unacceptable risk exists for materials previously discarded as
waste, the Operations Office Manager or the cognizant Program Office
Head may require that appropriate safeguards measures be implemented.

For safeguards on material currently on inventory to be terminated, all
of the following conditions must be met: the material must be
Attractiveness Level E, the material must be determined to be
discardable by the appropriate program office, and the material must be
written off the MC&A books and removed from its processing area to a
storage or disposal area containing only discardable material.

If necessary to dispose of materials which meet the definition of
Attractiveness Level D or greater, concurrence of the Office of
Safeguards and Security (OSS) is required for termination of safeguards
on materials. If a Category II or greater quantity of SNM is involved, a
vulnerability assessment (VA) is also to be conducted before safeguards
are terminated.

A facility\'s MC&A program is not to be terminated until a DOE
termination survey has determined that either (1) there is no nuclear
material at the facility or (2) the only nuclear material at the
facility is waste material that meets the definition of Attractiveness
Level E and has been written off the MC&A books.

**[III.]{.underline} [MATERIAL ACCOUNTABILITY]{.underline}**

Material accountability is divided into three subordinate elements to
facilitate a more effective survey: accounting; inventory; and
measurements and measurement control.

[Accounting Systems]{.underline} - The purposes of an accounting system,
as specified in DOE 5633.3B, are to track the inventories, document
transactions, issue reports and assist in detection of activities
related to the theft or diversion of nuclear material. Survey activities
must include data gathering and validation to assure that these
objectives are being met.

When conducting a survey of the accounting subtopic, there are three
facility specific things to look at. These include the facility
procedures, the data base descriptions, and the MBA account structure.

The account structure will assist in the determination of the category
and Attractiveness Level of each MBA. It will also provide an indication
of the approved accounts, inventory locations, and authorized transfer
paths. The MBA account structure and activities must show the quantities
on inventory, the quantities shipped and received and other adjustments
including rounding error, remeasurement, decay, fission and
transmutation.

The objective of the accounting system procedures is to document the
accounting techniques and/or practices utilized by a facility to
maintain the accountability records and data base for nuclear materials.
There are seven basic topics that must be reviewed when conducting a
survey of an accounting system:

 Organization and Management

 Procedures

 Account Structure

 Records and Reports

 Material Transfers

 Internal Control

 System Assurance

The conduct portion of the survey of accounting systems is a journey
from the uppermost level to the lowest level of detail and back again,
as you draw a conclusion as to the overall system assurance.

The survey team should look at the following when conducting the review
of this component:

What procedures are available? Are they clear? Are they reviewed at a
specified frequency? Is the frequency sufficient? What is the
distribution? Does everyone who needs to have them actually have a copy?

Who determines the MBA and account structure? Who can change it? How is
it changed? What role does the accounting system play in determining
categories of MBAs? What role does the accounting system play during
inventory?

What records does the system require to be input? Are data transcribed?
How is laboratory data input? What output formats are used and who
receives copies of the reports? Are the required reports being issued in
a timely manner?

Who prepares MBA transfers? How are authorizations verified? Are they
signatures or computer passwords? How is the data used in the accounting
organization? What calculations do accounting personnel perform? Are
they trained and qualified to perform these calculations?

Internal controls (checks and balances) should be employed to preclude
data omission and ensure transaction authorization and separation of
duties. What types of internal controls are applied? Are the
calculations verified? Are checks made to assure that what was shipped
was in the originating MBA and that what was received was verified by
the receiving MBA custodian?

This process should tie the entire survey of accounting systems together
and answer questions relevant to root cause analy­ses. Are incorrect
documents single-point failures or are they systemic management
deficiencies?

[Accounting Procedures]{.underline} - There are five aspects of good
accounting system procedures that should be surveyed:

Have the procedures been approved at the appropriate level? Usually, the
MC&A accounting manager is sufficient, but what about the MBA-specific
accounting system? Does it have its own system? Who approves its
procedures? What deficiencies may arise if the accounting manager does
not approve them? Are the procedures complete? Do they encompass
documentation initiation through destruction as well as records
retention?

Are the documents consistent? Are MBAs treated differently by the
accounting system? It is normal to see a vault or discrete item area
treated differently from a bulk processing area, but good accounting
practices dictate that discrete item MBAs should be consistent with each
other.

Are the procedures accurate? Are the procedures current? Are the
procedures used? How widely known is the information?

Internal nuclear materials transaction procedures are important since
they show the proper way to enter data into the accountability system.
DOE 5633.3B requires the completion of transfer checks upon receipt of
material. How are the checks accomplished and are they documented?

The Order also requires confirmation of measured values on internal
transfers. How are these accomplished? All internal transactions must be
auditable. In addition, requirements for holding accounts must be
defined.

Material control indicators are another element of the accounting that
must be reviewed. These accounts are germane to any nuclear material
accounting system and must be readily identified, evaluated and,
adequately documented. Questions to ask include:

What are the major material control indicators? How are they evaluated?
How are they documented? How are they approved? These are some key
questions that must be answered as part of any survey of an accounting
system. These questions must be answered for each and every indicator
that is identified and used by the facility.

To complete the review of the accounting system the survey team must
perform a review of the accounting transactions and the reports
generated. If reviewing 100% of the transactions is not feasible then a
valid statistical sample should be developed for detailed review. Areas
to address include the application of the proper procedures and accuracy
of the entries.

Reports generated should also be reviewed for compliance with DOE and
internal frequency, accuracy and content requirements. The facilities
reporting to the Nuclear Materials Management and Safeguards System
(NMMSS) should also be reviewed for compliance and performance with DOE
requirements. The NMMSS has the capability of generated several audit
packages which can assist the survey team with respect to sample
selection.

Another accounting related aspect to review is the application of and
adherence to generally accepted accounting principles (GAAP). The
documentation describing the system should address specific elements of
GAAP in a manner which is clear to the team member with accounting
expertise. The survey activities should not only include a review of
requirements for the applications, but also a determination relative to
effective application.

[Inventory]{.underline} - The survey activities addressing this element
include: observation of the physical inventory; validation of the
reconciliation process; verification of the accuracy and timeliness of
any resulting entries to the accounting system; and independent testing
of inventory values.

The bottom line of completing a survey in the area of inventory is that
the survey team should make a statement and render an opinion on whether
or not the facility inventory is as stated. The inventory performance
and reconciliation are the major mechanisms that verify actual SNM
holdings. The results of the physical inventory provides the assurance
that material has not been stolen or diverted. The degree of assurance
credited to the integrated safeguards and security program is validated
by the inventory results.

During the planning phase of the survey, the applicable facility
procedures regarding inventory should be requested. Prior to going to a
facility to witness the performance of an inventory, the survey team
should read copies of their procedures to develop an idea of what to
expect. It is also a good idea to write down the procedure numbers (or
take the procedures) that have been reviewed so that any questions which
arise in the field can be quickly resolved.

The next step would be to chose a procedure that can be observed and
schedule the observation of the procedure with facility management.
Independent testing of an inventory by the survey team is an area that
can also take significant planning and resources to do correctly.

One issue to be resolved in observing an inventory is, \"do the
practices and procedures agree.\" Some survey findings are related to
the fact that procedures are out of date or that personnel are not
following them. In some cases the procedure is wrong and in other cases
the practice is wrong. If the facility agrees on whether practice or
procedure is incorrect, it should be stated in the audit report. If not,
it is sufficient to note that the practice and procedure do not agree.

They must be based on measured values with holdup measured where
feasible. The definition of \"based on\" is not contained in DOE 5633.3B
and there is some interpretation as to what it means. Technically
defensible values have been developed from: estimates on the basis of
throughput; process data; modeling; and engineering estimates. This can
be a point of controversy during a survey. Thus, research into the
facility program is required to make sure the team understands what is
involved.

Nuclear material content is what must be reported and is really the
totality of the inventory. There are several techniques for assessing
nuclear material content. It is possible to write down item ID numbers,
query facility personnel as to how the nuclear material content was
assigned, and trace the records back through the accounting and
analytical laboratory reporting system.

The goal of the survey is to verify that the inventory is as stated.
Thus, an inventory verification mechanism must be established and an
acceptance criteria defined prior to the initiation of the survey. The
mechanism should include a means to determine the number of defects (and
de facto what a defect is); a confidence limit for the estimate; and, an
assessment of whether or not the inventory is \"in control.\"

The analyses will provide the necessary data to support the conclusion
and support an opinion. An opinion that the facility does not know what
is on its inventory has serious consequences. Realizing this, the
planning and observation of the inventory quantities must be thoroughly
documented and defensible.

Verifying calculations such as grams per liter times the number of
liters and analysis averaging while looking for outliers are methods of
performing independent tests of the data. This is tedious but it is
extremely important. Planning for this activity is essential since the
number of items to be tracked, who will do the work and the actual
conduct could use a significant portion of available resources.

Holdup is difficult to verify independently and may require a partially
subjective analysis. If survey team members are not comfortable in this
area (and most are not), finding an independent expert to assist in this
endeavor may be necessary. It also depends on how significant the holdup
calculations are relative to the total inventory and the Limited Error
of the Inventory Difference (LEID).

If the inventory is conducted using a statistical sampling plan, then
the survey team must inspect several things as part of the survey.
Questions to be answered include:

 How is the inventory stratified?

 Has the Operations Office manager approved the plan?

 What are the applicable procedures?

 What does the facility state is being accomplished by the plan?

 Is the facility implementing the program as it stated to the
Operations Office?

 What happens if there is a failure?

Another issue to evaluate are the facility cut-off procedures employed
prior to initiation of the inventory. A \"cut-off\" is necessary to
assure that no material is moved during the inventory so that material
is neither missed nor double counted. Questions to answer include: Who
determines cutoff times? Some facilities issue a letter that states
this. What happens when it is necessary to violate cutoffs; who
authorizes it; and how are transfers of samples handled?

The inventory difference program is a major area requiring evaluation
during the survey. The procedures for developing control limits are of
special concern. The basis for the control must be reviewed to determine
if they are current. If variance propagation is not used then the basis
used should be evaluated to determine its validity and if operations
office has been obtained. The reporting of inventory differences in
excess of limits should be confirmed through documentation review. The
facility\'s program for assessing differences through trend analysis
should also be reviewed. The procedures for responding to missing items
and investigating differences exceeding control limits should also be
reviewed.

There are several ways to provide assurance that stated quantities are
accurate. The observation of all components of the inventory, including
measurements is a common means. The qualifications of the observers must
be as good as the personnel performing the analyses.

Testing the quantities is also possible. This may involve observation of
measurements, bringing in your own equipment to measure, or measuring
items using a different technique are all acceptable mechanisms to
determine the accuracy of the stated quantities.

Additional questions to be answered during the survey of inventory
include:

 Are TIDs verified? If not, what are the problems? What do the facility
procedures say?

 Are inventory personnel familiar with the area? How have they been
trained?

 Who is responsible for what tasks during the inventory? This is
especially important in bulk facilities, e.g., fabrication or
reprocessing plants where cleanout and equipment shutdown is required.

[Measurements and Measurement Control]{.underline} - The objectives of
nuclear material measurements and measurement control programs are to
establish nuclear material inventory and transfer values and to assure
the quality of the data generated by the measurement systems. The
effectiveness of the materi­al balance accounting system hinges directly
on the accuracy and precision of these measurements. Any survey must
have a thorough review of the measurements and measurement control
systems to provide assurance that nuclear materials are being properly
measured and controlled.

Requirements for measurements and measurement control programs used for
Category I and II quantities of materials are given in Section II. 4. of
DOE 5633.3B. The scope and content of measurements and measurement
control programs for Category III and IV quantities are approved by the
Operations Office Manager.

Survey of measurement activities includes verification of measurement
methods, training, records and reports, and measurement control.

The first survey activity is to identify all of the measurement systems
utilized at the facility. It is important to know all the bulk,
sampling, analytical, and NDA measurement methods used at the facility
you are surveying. Each of these methods must be vali­dated, i.e., do
they do what they are intended to do. Some survey teams overlook this
activity and assume that the facility chemists/engineers know the
appropri­ate methods. But a valid question to ask during the sur­vey is,
\"Why was this method selected?\" Selection and qualification
documentation should be examined.

When it is known what each of the methods are, the next step is to find
out what the targets for accuracy and precision are. DOE 5633.3B
requires that the values be approved by the DOE Operations Office
Manager and monitored. Since the methods must be approved, the
implication is that a document exists that defines the measurement
methods as well as the precision and accuracy goals. By obtaining a copy
of this docu­ment, you will have a basis from which to begin the survey.

All accountability measurements must be made using approved measurement
systems and fol­lowing approved procedures. Determine who is responsible
for provid­ing procedures and who must approve procedures and any changes
to them.

All accountability measurement systems must be calibrated, periodically
recalibrated, and bias corrections applied (if applicable). Make sure
all measurement systems are in current calibra­tion when used for
accountability measurements. A question to ask at this point is whether
the measurement is used as a confirmation, verifica­tion, or both. The
survey team must determine that the sampling/measurement methods perform
adequately.

[Training]{.underline} - The facility program addressing the training of
measurement personnel should be reviewed to confirm that it specifies
training, qualification, and requalification requirements for each
method used for accountability purposes. It should also be confirmed
that measurement personnel demonstrate acceptable performance before
performing accountability measurements. These areas must be reviewed
during a survey:

 Qualification of personnel

 Qualification of trainer

 Training/lesson plans

 On-the-job training

 Testing

 Requalification

How can training be verified/validated? Survey team members addressing
training can validate training topics by completing the following:

 Field interviews \-- Gener­ates a list of questions from valid sources
and ask a sample of the trained popula­tion to ad­dress each one.

 Field testing \-- Request personnel to perform a typical operation to
observe compliance with procedures.

 Classroom testing \-- Using a validated written test, check the

knowledge of per­sonnel.

 Performance testing \-- Give personnel a situation requiring actions
and/or res­ponse and determine the ade­quacy of personnel actions or blind
samples (i.e. known samples supplied by New Brunswick Laboratory) can be
submitted for analysis and comparison.

[Records and Reporting]{.underline} - Records associated with
measurements and measurement control must be retained to:

 Furnish documented evidence of measure­ment quality, compliance with
program requirements;

 Permit tracing of measurement error data to the measurements;

 Track the measurement error to the LEID model.

Since measurement and measurement control records of each MBA are
subject to audit by the facility, these records would be something that
need to be reviewed during the survey as well. There are some record
keeping checks that will provide infor­mation about the quality of the
measure­ment data. Ques­tions that could be asked include:

 Are calculations of weighing error for each scale filed with the
cali­bration data?

 Is weighing error recorded on the container, on data sheets, or
inven­tory records, at the time of mea­surement?

 If measurement error is estimated instead of based on measurement
data, where is it noted and support­ed?

 If analytical results are involved, are measurement errors indexed to
laboratory analysis records?

 Are measurement error computa­tions for total quantities shown on
inventory records and on transfer papers?

The results of these checks may lead the survey team to other areas for
further inves­tigation of measurement errors and their propagation. For
example, if the mea­surement error is not identified, how is the limit of
error determined for ship­ments and receipts?

Measurement Control - Is a comprehensive pro­gram using data obtained
from the measurement processes to monitor and evaluate measurement
performance.

The survey team should evaluate the control program to determine that it
assures the effectiveness of the systems and the quality of values
reported. The review can be conducted by reviewing control charts to
determine that the systems were in control throughout the inventory
period.

The survey team should determine if the program has the following
elements:

 Administrative control measures over the selection or design of
facilities, equipment and measure­ment methods.

 Use of existing data and collection of additional data for monitoring
the quality of all SNM measure­ments.

 Measurement data evaluation and control through appropriate
statisti­cal procedures.

 Measurement system calibration and standardization.

 Control over selection, training and qualification of SNM measurement
person­nel.

 Periodic management reviews and audits of the measurements and
measurement control programs.

The following are criteria that can be used to determine if a system is
in control:

 Sequences of independent replicate measurements support a single value
limiting mean;

 The collection of measurement results is free from obvious trends or
groupings; and

 Each new measurement result veri­fies the validity of prediction limits
based on historical performance data.

[Sampling]{.underline}

The facility shall have a sampling program that ensures the sample of
bulk material taken for measurement is representative of the bulk
material. Sampling procedures are to be reviewed annually or whenever
changes are made to the sampling process or in material type or
composition. The \"representativeness\" of samples should be evaluated
along with compliance with procedure review/revision requirements.

[Statistical Programs]{.underline}

The facility shall have a documented program for the statistical
evaluation of measurement data to determine control limits, calibration
limits, and precision and accuracy levels for measurement and
measurement control programs used to determine Category I and II
inventories of SNM or SNM throughput over a 6 month period. A valid
statistical technique is to be used to determine the total bias and
random error generated for each measurement system or
sampling/measurement system. The development and application of facility
specific programs should be evaluated.

[Material Transfers]{.underline}

SNM transfers occur between MBAs, within an MBA, and outside an MAA
and/or PA. The purpose of documenting transfers is to assure that
material is properly tracked and is in its authorized location. The
survey team should identify all potential transfer paths regardless of
quantities involved. The purpose is to become familiar with the
shipping, receiving, transfer operations at portals, and the transfer
controls in place to assure that material is properly protected and
accounted for when it is moved. Survey activities should include:

 Verifying category of transfers and controls used for a selected
sample of material transfers.

 Verifying transfer activities against procedures for material
custodians, handlers, and SPOs.

 Reviewing transfer check records.

 Determining effectiveness of transfer controls and each control point.

Controls shall assure that material transfer procedures are followed.

As part of the survey of material surveillance you must review the
records maintained for performance tests to determine that the tests are
comprehensive (covering the spectrum of material surveillance measures
and locations where they are used) and are reasonable for the systems in
place. Verification of testing results by independent tests may be
necessary.

[External Transfers]{.underline} - The facility must have a documented
program to control external transfers of nuclear materials, including
inter-facility transfers. The facility\'s program for control of
external transfers of nuclear material includes documented procedures
that specify requirements for authorization, documentation, tracking,
verification, and response to abnormal situations. The performance of
these compliance measures should be evaluated.

[Internal Transfers]{.underline} - The facility must also have a
documented program to control internal transfers of nuclear materials,
including intra-facility transfers. The facility\'s program for internal
control of transfers of nuclear material shall include documented
procedures that specify requirements for authorization, documentation,
tracking, verification, and response to abnormal situations. The
performance of these compliance measures should also be evaluated.

[Material Control Indicators]{.underline}

The facility must implement a program for assessing the material control
indicators. The facility shall have documented plans specifying
responsibilities and providing procedures for evaluating the material
control indicators. A careful review and evaluation of these indicators
must be completed. Anomalies or conditions outside the predicted ranges
of the indicators must be addressed correctly by the facility to
substantiate the effectiveness of their overall system.

[Shipper/Receiver Difference Evaluation]{.underline}

For all nuclear material shipments, the differences in nuclear material
quantities in shipments are to be documented and evaluated, and if
significant, investigated and reported. Each facility shall have written
procedures for evaluating shipper/receiver differences.

The performance of specific program elements should be evaluated to
determine effectiveness of application.

[Inventory Difference Evaluation]{.underline}

The facility shall have a documented program for evaluating all SNM
inventory differences. The program should be evaluated for compliance
with the DOE requirements and the performance of program should be
reviewed in great detail. Inventory difference evaluation is critical to
effective program implementation and deserves in depth analysis before
assigning a MC&A program rating.

[Evaluation of Other Inventory Adjustments]{.underline}

The facility shall have a documented program for evaluating all
inventory adjustments entered in the accounting records. If all
inventory adjustments cannot be reviewed during the survey, a valid
statistical sample should be selected for review. The \"degree\" of
evaluation is the question to be answered. A cursory look by unskilled
staff provides no value to their program.

**[IV.]{.underline} [MATERIAL CONTROL]{.underline}**

The purpose of a material control program is to assure that nuclear
materials are properly protected. Material control combines access
controls, material surveillance, material containment, and
detection/assessment.

Material surveillance encompasses many detection/assessment mechanisms.
Effective containment, surveillance and detection/assessment mechanisms
must be in place and demonstrated by the conduct of performance tests
that show that an unauthorized act or material access is detected.

There is a strong hardware/people interface in this area. When surveying
the features of the materials control, do not ignore the people involved
in the success or failure of any of the components of the program.

When evaluating the materials control features of an MC&A program, as
with any program, the elements to inspect must be identified, the survey
responsibilities defined and the importance of each element in the
overall program determined.

Many protection elements covered in this topic relate to physical
security and material control. The responsibility for surveying these
elements may be delegated to the security survey organization or the
MC&A survey organization. The activities of both groups should be
coordinated to avoid missing elements or duplicating effort.

The survey should begin with an evaluation of the materials containment
documentation to determine if it is complete, current and approved by
the appropriate oversight personnel. The evaluation should also
determine that the plans and procedures meet applicable requirements and
are consistent with the security and MC&A plans.

No matter what area of control/containment is being surveyed, the team
must determine where the nuclear materials are located and their
authorized locations. Independently, the teams should determine if
rollup is credible. If rollup is credible, then measures may need to be
taken immediately to ensure that materials are not at risk. The main
function of the survey team is to determine that the program meets all
requirements and evaluate the effectiveness of the detection/assessment
systems.

[Access Control]{.underline}

There are several requirements for materials access programs that a
survey team must be familiar with and be prepared to evaluate:

 Material Access Program must be documented; documentation will be
found in the MC&A Plan and the Site Safeguards and Security Plan (SSSP).

 Only authorized personnel have access to material; these people should
be specified.

 Must have authorization procedures and mechanisms to detect/respond to
unauthorized access

 Amount of material accessible should be limited and the remainder
should be in storage that is accessed by only a limited number of
authorized persons.

 Material access will be implemented on a graded basis; i.e.,
Category I in an MAA, Category II in a PA, Category III locked up and
under alarm, and Category IV locked up.

[Materials Access]{.underline} - The facility shall assure that only
properly authorized personnel have access to nuclear materials. To
minimize the potential for unauthorized access to nuclear material, the
amount of material in use is to be limited to that necessary for
operational requirements, and excess material is to be stored in
repositories or kept in enclosures designed to assure that access is
limited to authorized individuals. The graded access control program
shall consider the quantity and attractiveness of the material in the
area and impacts of potential adverse acts.

The survey team should identify where badges are checked at the site and
what information on the badge is checked. The purpose is to become
familiar with identification and authorization checks for nuclear
material access. Survey activities related to badges used for access
control should include:

 Verifying that badges are issued and controlled according to
requirements.

 Verifying that the proper badge checks are made at the appropriate
locations for material access.

 Checking the most current authorization list to verify that badges are
current with the list.

 Determining whether badge checks are effective in preventing
unauthorized entry.

Keys and combinations are essential to any SNM containment system. They
may be found protecting access to processing areas, areas where SNM may
be present, and storage areas such as vaults. The survey team should
identify all areas and portals that are routinely accessed using keys or
combinations, who has access to the keys, and how keys and combinations
are controlled. Cards are the electronic equivalent of keys and they
have some unique considerations that must be examined. The purpose of
inspecting these access control features is to become familiar with the
control and issuing process to determine if the system is in control or
whether they may be exploited by an insider. Survey activities could
include:

 Determining the effectiveness of key/card issuance, control, return,
sign-out procedures and re-keying.

 Determining the effectiveness of combination controls and combination
change procedures in preventing an insider from exploiting access
control measures to perform an unauthorized act.

[Data and Equipment Access]{.underline} - The facility should have
procedures and systems in place to control access to data and equipment
utilized by the material control system. The procedures should be
employed on a graded basis that is clearly documented. Survey activities
should validate the facility\'s program.

[Material Containment]{.underline}

[Protected Areas]{.underline} - Category II or greater quantities of SNM
must be used, processed, or stored only within a Protected Area (PA).
The survey team must identify all PAs, their boundaries, and their
portals. The purpose is to become familiar with material locations,
determine if rollup is credible, and evaluate the effectiveness of
detection systems. Survey activities addressing Protected Areas would
include:

 Verify that access to PAs is limited to designated portals.

 Verify that authorization and identity of all personnel entering a PA
is checked.

 Verify that only authorized vehicles are permitted entry.

 Verify that all personnel, packages, and vehicles are searched on
entry.

 Verify that exit searches are conducted when Category II SNM is used
or stored outside an MAA.

 Verify compliance of procedures with DOE Orders and operational
practices with the procedures.

[Material Access Areas]{.underline} - Category I quantities of SNM must
be used, processed, or stored only within a MAA contained in a Protected
Area. The survey team should identify all MAAs, their boundaries, and
their portals. The purpose is to become familiar with material
locations, identify all material transfer paths, determine what is
documented for system capability, and evaluate the effectiveness of
detection systems. Survey activities involving MAAs include:

 Verify that access to MAAs is limited to designated portals.

 Verify that authorization and identity of all personnel entering a MAA
is checked.

 Verify that all personnel, packages, and vehicles are searched on
entry and exit.

 Inspect barriers for diversion paths out of the MAA.

 Verify compliance of procedures with DOE Orders and operational
practices with the procedures.

The facility shall have a documented program to provide controls for
nuclear materials operations relative to MAAs.

[Material Balance Areas]{.underline} - All SNM facilities must have at
least one MBA and could have more than one. The survey team should
identify all MBAs, their boundaries, and their controls for inventories
and material transfers. The survey team should determine if MBA
boundaries are established such that a material balance can be made
using quality measurements, and that a sufficient number of MBAs exist
to localize inventory differences. The purpose is to become familiar
with material locations, identify all material transfer steps, and
evaluate the effectiveness of loss detection systems. Survey activities
addressing MBAs would include identifying and observing administrative
controls; such as, one individual is assigned responsibility for
material in an MBA (MBA custodian), controls assure that limits will not
be exceeded, and that no MBA crosses an MAA boundary or that persons
cannot transfer material to themselves where the material is not
protected to the appropriate level.

The effectiveness of MBA operations is dependent on the knowledge and
performance of the MBA custodian(s). Custodian knowledge and performance
should be evaluated during the survey.

[Storage Repositories]{.underline} - SNM facilities should have one or
more storage areas. These areas should be identified along with the
amount of SNM (Category Level). Storage areas may be vaults, vault-type
rooms, or security containers. The purpose of becoming familiar with the
storage areas is to understand where materials are located, what
quantities are involved, and the protection measures implemented at each
area. Survey activities would include:

 Verifying the material in each storage area has the proper protection.

 Verifying that vaults, vault-type rooms, and security containers meet
DOE specifications.

 Verifying SNM is stored according to DOE M 5632.1C-1 requirements.

 Verifying that only authorized persons have access to storage areas
and that procedures for controlling access are effective and followed.

 Verifying that transfer controls are in place and effective.

The facility shall have controls, consistent with the graded safeguards
concept, for nuclear material held in storage repositories. Controls for
storage repositories are to be formally documented.

[Processing Areas]{.underline} - The survey team should identify the
location, boundaries, and category limits of these areas. The largest
quantities and most attractive materials should receive priority, but
some areas from each material category should be reviewed. The purpose
is to become familiar with the material locations, determine if rollup
is feasible and category limits can be maintained, and determine if
protection programs are reasonable and effective. Survey activities
could include:

 Verifying that limits in Category II, III, and IV areas have been
maintained.

 Checking process staging areas to determine if significant quantities
are left unattended and unprotected.

 Determining whether temporary processing areas are checked for
material balance prior to protection downgrades.

 Verifying that material movements and process changes have been
adequately documented.

 Verifying compliance of procedures with DOE Orders and operational
practices with the procedures.

The facility shall have documented controls covering nuclear material
being used or stored in processing areas.

A major potential deficiency is that the effectiveness of access
controls for Category I and II quantities of SNM cannot be demonstrated
by the detection of unauthorized access in 95% of the performance tests
conducted. This is a requirement of DOE 5633.3B. As part of the survey
of access controls, you must review the records maintained for
performance tests to determine that the tests are comprehensive
(covering the spectrum of access control measures and locations where
they are used) and are reasonable for the systems in place. Verification
of testing results by independent tests may be necessary.

[Material Surveillance]{.underline}

Material surveillance is the collection of information through devices
and/or personnel observation to detect unauthorized movements of nuclear
material, tampering with containment, falsification of information
related to location and quantities of nuclear material, and tampering
with safeguards devices.

A review of the procedures will indicate if the following areas are
addressed.

 Procedures must describe the methodologies used.

 Procedures must address investigation, notification, and reporting.

Intrusion detection systems consist of motion sensors, balanced-magnetic
switches on doors, alarm annunciation, and tamper indication. As part of
the survey, you should conduct the following checks. Unless you are
experienced in physical security systems and their operations and
maintenance, you should probably get expert help to review these
systems. It may be that the security survey personnel will inspect these
systems as part of their survey. Please coordinate so that all systems
are reviewed.

 Verify motion sensor operation. Motion sensors provide volumetric
coverage and can be tested for sensitivity and coverage.

 Verify correct balanced-magnetic switch (BMS) sensor operation and
proper installation (alarms when moved a specified amount). They should
also be sensitive to an external magnetic field.

 Verify alarm system operation. Does the entire system, from detection
to alarm readout, function properly? Conduct routine alarm tests.

 Determine effectiveness of detecting system tampering.

 Determine effectiveness of intrusion system. How well does it work to
detect any threat?

Material surveillance procedures often include implementation of the
two-person. The survey team should understand what type of
implementation is used and where it is being used. Survey activities
should:

 Determine how the rule is implemented.

 Verify enforcement against procedure.

 Check \"penalties for violation\" against recorded violations.

 Determine the effectiveness of implementation and compare with VA
value. Is the VA supportable?

Each facility shall establish a graded surveillance program for
monitoring nuclear materials and detecting unauthorized activities or
anomalous conditions.

[Detection/Assessment]{.underline}

[Portal Monitors]{.underline} - Monitoring for MC&A purposes occurs at
portal exits to MAAs and PAs where Category I or II quantities of SNM
are present or where rollup to Category I is possible. Searches are made
by protective force personnel to detect unauthorized movements of SNM
using portal and hand-held SNM and metal detectors. The metal detectors
are used to detect shielded SNM. The survey team should locate all
portals using monitoring equipment and test their operation using
material with a response equivalent to the SNM in the area.

 Verify that equipment has been routinely serviced and tested. Check
maintenance and operational records.

 Verify that equipment meets specified detection criteria. Sensitivity
tests should be conducted using criteria approved by the DOE field
office.

Tests should be made with SNM that is typically found in the area or
with material having similar properties.

 Check implementation of systems against operating and response
procedures. Are procedures followed and are responses to alarms
appropriate?

 Determine the effectiveness of shielded and unshielded SNM detection
at each portal.

 Determine the effectiveness of searches on personnel, packages, and
vehicles. Is everything searched? Can the detection system be bypassed?

Portal operations should be checked during high and low traffic
conditions.

A physical or electronic search of vehicles, personnel, packages, and
all other containers is to be made at all routine exit points from an
MAA and PA that contain Category I quantities of SNM (or Category II
quantities where roll-up to a Category I quantity is possible) to
protect against unauthorized removal of SNM.

Performance testing in this area should be accomplished in conjunction
with the Protection Program Operations topical team evaluating
Protective Force and Security Systems.

[Waste Monitors -]{.underline} With the intent of detecting the theft or
diversion of SNM, all liquid, solid, and gaseous waste streams leaving
MAAs must be monitored. Procedures must also be in place for responding
to situations that may exceed established discard limits.

[Daily Administrative Checks]{.underline} - Daily administrative checks
(DAC) relate to material loss detection, assessment, and response in
MBAs possessing Category I quantities of SNM. The purpose is to
determine daily that no items are obviously missing and that there are
no indications of tampering. Survey activities addressing DACs should
include:

 Verifying that the DAC program is documented in the MC&A Plan.

 Checking the DAC results to verify that they are conducted by MBA.

 Determining if the DAC implementation follows procedures.

 Checking areas to assure that both items and quantities are part of
the DAC program.

 Determining the effectiveness of DACs and compare with the VA value
assigned.

[Tamper-Indicating Devices]{.underline} - Each facility using
tamper-indicating devices (TID) must have a documented program
describing the TIDs used, the controls in place for their use, the
detection mechanisms, and the assessment procedures. The survey team
should determine the importance of TIDs to the material protection
program and assure that the program provides the needed protection.
Survey activities should include:

 Verifying program documentation against actual practice. Assure that
the program is being implemented as planned.

 Determining the effectiveness of TID accounting and control measures
from \"cradle to grave.\" Is the proper credit given to the TID program
in the overall protection plan?

 Verifying the accuracy of inventory records data against TID records
data. Can the material and TID numbers be traced from one set of records
to the other? DOE 5633.3B requires that the records be accurate in 99%
of the cases checked.

 Determining the effectiveness of the TID application. Can the TIDs be
easily defeated? DOE 5633.3B requires that the TIDs be properly applied
in 95% of the cases checked.

[Control of Tamper-Indicating Devices]{.underline} - The facility\'s
documented TID program shall provide controls for the procurement,
storage, distribution, and application of TIDs used for material control
purposes. Personnel authorized to apply, remove, and dispose of TIDs are
to be specified. These personnel, including the TID Administrator,
should be interviewed and considered for performance testing. TID
purchase order authorizations, control of unused TIDs and TID log
entries should be reviewed. Performance testing of TID application,
removal, verification and destruction should also be considered.

**[V.]{.underline} [MC&A PERFORMANCE MEASURES]{.underline}**

The performance of a system is used to support the protection
philosophies described in the Master Safeguards and Security Agreement
(MSSA) or to demonstrate compliance with DOE requirements.

System performance can be assessed by two distinct methods:

 Reviewing and analyzing contractor performance monitoring and testing
programs

 Conducting independent performance tests or facility exercises.

How do you accomplish a performance evaluation? MC&A elements have a
benchmark for level of performance. The benchmark can be provided in DOE
regulations, as is the case for TIDs, portal monitors, etc., or it can
be stated in vulnerability assessments/MSSAs. Wherever it is stated, the
benchmark provides a level of performance that has been assumed for the
MC&A system element. This assumed level of performance is required to
provide required levels of protection against theft or diversion of
nuclear material. These benchmarks provide the basis for developing
evaluation criteria for the results of performance tests. Such criteria
must be established and documented prior to conducting the test.
Criteria that are changing do not lend credibility to the testing
program or the results document in the report. Personnel responsible for
implementing the test should be knowledgeable of what constitutes a
\"Good\" program. The criteria should be measurable or easily evaluated
by knowledgeable personnel and they should be kept simple.

Specific examples of benchmark levels of performance that are Order
requirements include:

Performance tests are to be designed and conducted to fully evaluate the
effectiveness of access controls and material surveillance activities
for Category I and II quantities of SNM. In at least 95% of the tests
conducted, the tests shall demonstrate the detection of unauthorized
access to Category I and II quantities of SNM.

Performance tests shall indicate that the tamper-indicating device (TID)
record system accurately reflects the location and identity of TIDs in
at least 99% of cases. The tests shall also indicate that the TID
program assures that TIDs are properly in place in at least 95% of the
cases.

In addition to performance testing necessary to verify that VAs or
Operations Office detection requirements are being met, testing of
portal monitors (SNM and metal) shall include all applicable tests
described in ASTM guides unless otherwise directed by the Director,
Office of Safeguards and Security. When standards set in applicable ASTM
guides are not met, compensatory actions are to be taken.

Performance tests shall indicate that the accounting record system
accurately reflects item identity and location in at least 99% of the
cases.

For Category I and II items, acceptance/rejection criteria for
verification measurements and where possible for confirmatory
measurements are to be based on the standard deviation of the
measurement method under operating conditions. The control limits for
such criteria are to be set at no wider than three times the standard
deviation.

Limits-of-error for inventory differences of processes in new Category I
and II facilities are to be no larger than the smaller of a Category II
quantity of SNM or 2% of the sum of total throughput and active
inventory.

The facility materials accounting system shall include checks and
balances and is structured to: identify omission(s) of data for any
reportable transactions, provide timely detection (normally within 24
hours but in no case later than the subsequent inventory reconciliation)
of errors/discrepancies in records associated with a Category I or II
quantity of SNM, detect data discrepancies in control indicator
accounts, and ensure completeness of the nuclear materials accounting
system.

The accountability system shall provide checks and balances to detect
errors/discrepancies or omissions of data in records associated with a
Category I or II quantity of SNM.

The MBA records system is to be capable of being updated daily for all
nuclear material transactions.

The records and reporting system shall provide the capability to
localize inventory differences.

The system is to be capable of generating book inventory listings for
all SNM within 3 hours. For all other nuclear materials, the capability
for generation of book inventories is to be within 24 hours.

Performance tests are conducted on a specific aspect or element of the
MC&A system. They are sometimes referred to as \"Limited Scope
Performance Tests.\" Examples of MC&A system elements or aspects are:

 Custodian Knowledge

 Measurement of Unknowns

 Inventory Taking and Reconciliation

 Access Control Procedures

Another form of performance testing is the conduct of MC&A exercises.
Exercises are more global than performance tests and may include other
functions such as security, operations, ES&H, etc. They are performed
under a set of controlled conditions and are designed for observation of
system operation under the controlled conditions. The purposes of
exercises are to:

 Determine if the system performs as described, and

 Determine if the system is capable of meeting the goals established by
requirements.

Exercises can, and typically do, combine several performance tests to
determine the adequacy of many functions while minimizing the impact on
operations. The survey team should try to coordinate MC&A testing with
scheduled security and emergency preparedness exercises, if at all
possible.

The combination of compliance evaluations, performance testing, and
performance exercises provides the information needed to determine the
MC&A system\'s capability to meet its design objectives.

**ANNEX E. PERSONNEL SECURITY**

**[I.]{.underline} [INTRODUCTION]{.underline}**

This topical area deals with the granting of personnel access to
facilities and the safeguards and security interests within them. These
apply for assigned staff as well as visitors. Security training of
personnel granted access to the facility is a key part of these controls
and of the safeguards and security program as a whole.

The DOE Personnel Security Program is a major component in the
protection of DOE security interests. It is the only program to focus on
individual eligibility for access throughout the life of the access
authorization - from grant to termination. The Personnel Security
Program also focuses on security awareness through a continuing security
education program, and visitor control measures - with the emphasis on
the open exchange of information.

A strong personnel security program represents a logical and
cost-effective approach to protecting against the \"insider threat.\"
Insiders represent a major threat since they usually have extensive
knowledge of a facility and have unescorted access. Since the human
element may represent the weakest link in any protection program, it is
important that the significance of an effective personnel security
program is recognized by management. Coupled with human reliability
programs, such as the Personnel Security Assurance Program (PSAP) and
the Personnel Assurance Program (PAP) - for those individuals who have
access to Category I quantities of SNM or who are assigned nuclear
explosive duties - the Personnel Security Program can produce an even
more meaningful degree of protection.

**[Subtopical Areas]{.underline}**

The following subtopical areas comprise this topical area:

A. ACCESS AUTHORIZATION (PERSONNEL CLEARANCES)

B. SECURITY EDUCATION BRIEFINGS AND AWARENESS

C. CONTROL OF VISITS

D. UNCLASSIFIED VISITS AND ASSIGNMENTS BY FOREIGN NATIONALS

E. PERSONNEL ASSURANCE PROGRAM

F. PERSONNEL SECURITY ASSURANCE PROGRAM

**[II.]{.underline} [ACCESS AUTHORIZATION (Personnel
Clearances)]{.underline}**

**[Description]{.underline}**

The process of determining eligibility for access authorizations is at
the heart of the Personnel Security Program, and is the first line of
defense against the insider threat. The DOE established a structured and
uniform approach for determining eligibility for DOE access
authorizations. Only individuals whose jobs require access to classified
matter are processed for access authorizations. Pre-employment screening
is required of contractor employees being hired for positions requiring
such access. The Office of Personnel Management (OPM) is the primary
provider of security background investigations (BIs) to DOE. DOE may
accept the results of other government agency BIs that meet DOE
requirements. The results of a BI and other relevant information are
reviewed and adjudicated by DOE in accordance with the criteria set
forth in 10 CFR, Part 710.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

2, 72 and 89.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of access authorization
procedures at DOE facilities used to process requests, screen and
analyze initial access authorizations and reinvestigations, and process
substantially derogatory information.

**[Documentation]{.underline}**

Reviewing documentation will help in understanding the facility\'s
access authorization program and identifying procedures used in the
process. This information will also assist in developing ideas for
performance testing. All documents should be reviewed to identify
errors, inconsistencies, and contradictions and to determine if they are
current. Request and review the following documents prior to and during
the survey:

[Personnel Security Files]{.underline}: Review selected files to
determine if the procedures for verifying initial and continued need for
access authorizations are implemented as described. Review files for a
sample of cleared individuals who have changed positions. If the
individuals\' duties no longer require access to classified matter or
SNM, determine if action was taken to terminate their access
authorizations, or otherwise change the level of access.

[Local Procedures]{.underline}: Determine if local procedures are
consistent with DOE policy.

[Contractor Access Authorization Requests]{.underline}: Determine
whether statements indicating the results of pre-employment screening
were forwarded to DOE, whether the information forwarded to DOE
coincides with the information in the files and whether the screening
includes all elements required by the Department of Energy Acquisition
Regulation (DEAR).

[Training Records]{.underline}: Determine if in-house training is
relevant and effective.

[Questionnaires for National Security Positions (QNSPs), Standard Forms
86, and Fingerprint Cards]{.underline}: Check for errors or omissions.
Determine how often QNSPs are returned to the contractor because of
errors or failure to forward derogatory information found during
pre-employment screening. Due to Privacy Act issues, the review of these
documents is limited and must be conducted by a Federal employee.

[Central Personnel Clearance Index Records]{.underline}: Compare with
data in selected files to determine whether the input was made, whether
it was accurate and if entries are made as required. Review processing
time reports to determine whether processing times fall within
prescribed ranges.

[Workload and Overtime Records]{.underline}: Determine whether
sufficient resources have been allocated to perform effective screening
and analysis.

[Case Files]{.underline}: Review files by selecting a number of files
from listings that show types of actions taken to gather more
information to determine if the screening and analysis functions are
satisfactorily accomplished and are timely. If backlogs exist, determine
the cause(s).

[Case Analysis Sheets]{.underline}: Review sheets from a selection of
files known to contain derogatory information to determine if the
derogatory information has been appropriately resolved or mitigated.

[Interview Tapes, Transcripts and Summaries]{.underline}: Determine
whether they contain: a pre-interview discussion with the subject being
interviewed, briefly explaining the reason for the interview; the
authority for the interview; an explanation of Section 1001 Title 18 and
the Privacy Act; a statement explaining why interviews are recorded; and
a statement that the subject is voluntarily participating in the
interview. Determine if they provide a clear, objective evaluation of
the entire case. Interviews should be objective, thorough, accurate,
concise, well organized, and not distorted or biased.

[Reciprocal Access Authorization Documentation]{.underline}: Review any
records maintained on reciprocal access authorizations. Determine
whether correct procedures are being followed in operating this program.

**[Interviews]{.underline}**

Interviews provide background information and explanations as to how
policies and procedures are implemented. They may be conducted during
any phase of the survey process, to clarify records or observed
performance conditions. Interviews should be conducted to determine
whether the requirements for an effective access authorization program
are understood and implemented.

The following people should be interviewed:

[Personnel Security Specialists, Personnel Security Assistants and Other
Operating Personnel]{.underline}: Determine if they are familiar with
their specific duties and if they have received adequate training for
the work they perform, and if sufficient resources have been allocated.

[Supervisors and Cleared Employees]{.underline}: Determine whether their
current job requirements warrant their particular access authorization.

**[Performance Measures]{.underline}**

Several methods exist by which performance can be measured. Since the
primary intent is to determine whether access authorization procedures
are effective, the data collection activities will educate the evaluator
and assist in the formation of specific performance tests. Provided
below are techniques that can be employed when evaluating the
effectiveness of the procedures. These suggestions are not all
inclusive, and anyone conducting a survey can use his or her imagination
to develop additional innovative performance measures.

 Request that individuals responsible for handling requests for access
authorizations demonstrate how the process works and how the need for
access is justified. Select a number of records for review and determine
if the procedures described are implemented. Note the portions of
requests dealing with justification and certification to determine
whether they are properly implemented.

 Compare positions requiring access with the number of individuals
currently holding access authorizations. If there are more access
authorizations than required by positions, identify the justification
for the additional access authorizations.

 Request operational departments to provide files for a sample of
cleared individuals\' who have changed positions. If the individuals\'
duties no longer require access to classified matter or SNM, determine
if action was taken to terminate the authorization, or change the level
of access. Also review files to determine if duties justify access.

 Review staffing documents and interview staff to determine whether
sufficient numbers of personnel are assigned to the access authorization
processing activity to ensure timely and efficient processing. If an
office has established production quotas for each of the employees in
the access authorization process, these quotas can be examined to
determine whether they are realistic and contribute to or detract from
reaching objectives.

 Select and review at least 50 personnel security files from listings
provided by the office being surveyed to determine if data are arranged
in the files in accordance with DOE procedures or in a similarly uniform
manner to facilitate data handling and retrieval. Determine whether
screening and analysis functions have been satisfactorily accomplished
and are timely. If backlogs exist, determine the cause(s). Review the
case analysis sheets from files known to contain derogatory information
to determine if the information has been properly resolved or mitigated.
Review other pertinent documents in the files for accuracy of completed
forms and to ensure procedures were followed. Determine if interrogatory
and interview transcripts justify case results; determine whether
appropriate documentation exists to justify grants, terminations,
suspensions, etc., of access authorizations.

 Selected files should be compared to data in the CPCI to verify input,
accuracy and compliance. Review processing time printouts from CPCI to
evaluate processing times.

 Determine whether proper procedures are followed in the processing of
cases involving the Employee Assistance Program Referral Option, through
interviews and review of documentation.

 Determine whether administrative review (AR) procedures are in
accordance with DOE requirements.

**[III.]{.underline} [SECURITY EDUCATION BRIEFINGS AND
AWARENESS]{.underline}**

**[Description]{.underline}**

Security education is an integral element of the DOE\'s safeguards and
security program, affecting all Departmental elements and staff
performing work for the DOE who require access authorizations, access to
classified facilities, classified matter, Special Nuclear Materials
(SNM), or DOE security areas. As a condition of access each employee is
required to attend certain briefings applicable to their specific access
needs. The primary goal of the program is to inform employees of their
security responsibilities associated with DOE programs and activities,
alerting them to actual or potential threat, and motivating them to
maintain a high level of security awareness.

The DOE requires the formulation and maintenance of a structured
safeguards and security education program. As a condition of access to
DOE security areas, SNM or classified matter, all DOE and DOE contractor
employees will attend briefings that may include, but are not limited
to, initial, comprehensive, refresher and termination briefings. Each is
characterized below, with suggestions on how to ensure the security
education training presented is in compliance with DOE Orders and is
effective in informing employees of actual or potential threats, while
motivating them to maintain a high level of security awareness.

Security education programs will be designed to include site-specific
topics that address areas of concern to local management. To provide
effective training, the program will be established and maintained with
full knowledge and consideration of the personnel security access
authorization requirement, physical security features of the facilities
and their programs, nature of the work, the classification and
sensitivity of information, and numbers and levels of personnel in the
facilities for which security protection is provided.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

31, 32, 38, 54, 61, 66, 68, 72 and 89.

**[Survey Content]{.underline}**

Although it is easy to determine program compliance by comparing program
activities with applicable DOE Orders, it is not often easy to determine
program effectiveness; and ensuring a program is in compliance does not
guarantee that it is effective. When evaluating any security education
program it is essential that the evaluator look beyond compliance. With
adequate preplanning this can be accomplished. In addition to meeting
DOE requirements, key elements to an effective program include genuine
management support and interest; clear program implementation plans and
procedures; articulated program responsibilities; and use of the
security education program as a communication channel to address local
security problems.

The ultimate goal of the survey should be to determine if employees know
their safeguards and security responsibilities. This can be determined
by closely examining the security education program, reviewing
infraction records, and interviewing employees who have attended various
briefings to determine what they learned. The following information will
assist you in conducting a survey of any DOE security education program.

**[Documentation]{.underline}**

Reviewing the documentation will help in understanding the facility\'s
program and learning about the education and awareness needs.
Additionally, this information will assist in developing ideas for
performance testing. All documents should be reviewed to identify
inconsistencies and contradictions and to determine if they are current
and accurate. Request and review the following documents prior to the
survey:

 [Program Management Files]{.underline}: Should contain all
correspondence related to the security education program; may contain
letters which indicate management support for the program. Identify
special provisions for delegation of authority for oversight of
contractor and subcontractor security education. Assure compliance with
DOE Orders and may identify deviations.

 [Lesson Plans]{.underline}: Provide required information for each type
of briefing, with references for teaching/training aids and methods of
presentation.

 [Instructional Aids (Includes Student Handouts)]{.underline}: May
indicate management support, assist in helping students understand or
remember important aspects of the training.

 [Safeguards and Security Awareness Coordinator Appointment
Letter]{.underline}: Should be current and accurate.

 [Attendance Records]{.underline}: Will indicate who has received
specific training. Can be compared with badge issuing records and can be
used to identify potential employees for interviews.

 [Evaluation Records]{.underline}: Provides a historic record of
students\' reaction to training and potential effectiveness of specific
lessons. Can also be used to identify potential employees for
interviews.

 [Awareness Tools (Posters, Newsletters, etc.)]{.underline}: Should be
site-specific, current, visible, and meet DOE requirements. Can indicate
management support.

 [Security Infraction and Violation Records]{.underline}: May indicate
trends to identify training effectiveness, or may indicate problem
areas.

**[Interviews]{.underline}**

Interviews provide background information and explanations as to how
policies and procedures are implemented. They may be conducted during
any phase of the survey process, to clarify records or observed
performance or contradictions. Proper interviewing requires a great deal
of experience and skill. Interviews should be conducted to determine the
adequacy of security education documentation and training materials and
evaluate whether the training supports organizational areas of concern.
If interviews are conducted at various locations at the facility, ask to
see posters or awareness aids that may have been distributed for
display.

The following people should be interviewed:

 [Safeguards and Security Manager (Contractor and DOE)]{.underline}:
Consider their knowledge of the program and its goals. Determine what
guidance and resources they provide the Coordinator. Also evaluate the
use of the security education program as a communication channel to
address security problems.

 [DOE and Contractor Security Education Coordinator]{.underline}:
Determine if they have knowledge of DOE Orders, possess writing and
presentation skills, and are aware of security related incidents and
threats.

 [Security Education Training Attendees]{.underline}: Interviews of
people who have attended training should focus on the quality of the
training and retention of information presented by the instructor.

 [Site Managers and Supervisors]{.underline}: Determine if supervisors
and managers assigned throughout the facility are familiar with the
security education provided and have knowledge of the frequency and
effectiveness of the training.

**[Performance Measures]{.underline}**

Several methods exist by which performance can be measured. Since the
primary intent is to determine whether the security education program is
effective, the data collection activities will educate the evaluator and
assist in the formation of specific performance tests.

Provided below are techniques that can be employed when evaluating the
effectiveness of the program. These suggestions are not all inclusive,
and anyone conducting a survey can use her or his imagination to develop
additional innovative performance measures.

 Attend scheduled briefings to evaluate the information covered,
presentation style, briefing room environment, training aids, knowledge
and enthusiasm of the instructor, and quality of student handouts.
Lesson plans and visual aids should be examined to ensure they
adequately support the overall presentation. Question and answer
sessions should be evaluated to determine the instructor\'s ability to
respond effectively.

 Select 10 to 15 records to conduct random sampling comparisons of
security education records with badging records or other personnel
records. Determine if individuals were issued badges for access prior to
receiving the required briefings. If access authorizations have been
granted prematurely, expand the scope of the review and identify trends
that may be indicative of a larger problem.

 Review DOE Forms 1512.2, \"Notification of Proposed Travel to
Sensitive Countries\", DOE Forms 1512.3, \"Security Analysis of Proposed
Travel to Sensitive Countries\" and DOE authorization letters to
determine if forms were submitted in a timely manner. Review
approximately 10 to 15 foreign travel records and compare with briefing
records to ensure appropriate briefings were completed prior to travel
within the specified time periods. Also review debriefing records for
trends and follow-up reviews by the security office.

 Prepare a brief \"knowledge test\" for each type of briefing and ask
employees who have attended the briefings to complete the test. This
will assist in evaluating the effectiveness of the training, but should
not be used by itself to make that determination.

 Consider whether security infractions and violations are unusually
high. If so, carefully analyze available information to determine
whether it results from a lack of security awareness training, or
whether awareness training has intensified employee participation in
detecting and reporting security infractions and violations.

 Briefing files should be reviewed to determine whether current
information regarding travel advisories, public media, travel tips and
other data on foreign travel is maintained.

 Examine visual aids (posters, videos, handouts, newsletters, and
booklets) to determine if they are current, support security awareness,
and are consistent with briefing content and DOE policy. Posters should
be checked to determine whether themes relate to security problems and
agree with DOE policy.

**[IV.]{.underline} [CONTROL OF VISITS]{.underline}**

**[Description]{.underline}**

Strategies for the protection of DOE property (including nuclear
materials) and information have been incorporated into applicable
requirements established by DOE Order. These strategies when combined
with visitor control procedures ensure that only appropriately cleared
individuals gain access to security areas and facilities.

Visitor control is designed to protect various DOE security interests,
property and facilities (including appropriate contractor facilities).
Access to DOE facilities is controlled by personnel who have been
assigned the responsibility for assuring that only persons with proper
authorization are admitted. Access to security areas, classified
matter/information, special nuclear material or vital equipment is
limited to persons who possess appropriate access authorization and who
need such access or information in order to perform their official
duties.

The DOE visitor control program addresses security concerns raised by
visits and technical exchanges by universities, private industry, other
governmental agencies, and foreign governments. Visitors gain access on
a daily basis to some of the nation\'s most sensitive facilities engaged
in various activities, from unclassified, non-sensitive energy research
to nuclear weapons programs.

Access is limited to persons possessing appropriate access
authorizations who require access in the performance of their official
duties. Visitors to classified matter, areas or facilities are required
to follow the notification and approval procedures that ensure that
identity and access authorization level are accurately established.

Those visitor control procedures involving entrance and exit
inspection/searches are covered in Annex B of this Guide, under PHYSICAL
SECURITY.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

54, 55, 66 and 89.

**[Survey Content]{.underline}**

Evaluation of the implementation and management of the control of
visitors to DOE facilities used to establish identity and access
authorization, and visitor control requirements to deny access to
security interests for which visitors are not authorized access.

**[Documentation]{.underline}**

Reviewing documentation will help in understanding the facility\'s
visitor control program and identifying the systems used for access
control. Additionally, this information will assist in developing ideas
for performance testing. All documents should be reviewed to identify
inconsistencies and contradictions and to determine if they are current
and accurate. Request and review the following documents prior to the
survey:

 [DOE Form 5631.20 \"Request for Visit or Access Approval\"
(Notification and Approval of Incoming and Outgoing Classified Visits
Records)]{.underline}: The form should be complete and submitted in a
timely manner to ensure the visitor is not delayed or denied access to
classified areas or information to accomplish assigned tasks.
Information limiting the visitors access must be distributed to points
of contact and escorts.

 [Visitor Control Logs]{.underline}: Can be compared with visit
requests to ensure uncleared individuals were not granted access to a
facility or program.

 [Local Visitor Control Procedures]{.underline}: Determine consistency
with DOE policy. Procedures should ensure adherence to the dates of the
visit, level of access afforded, and areas of the facility to be
visited. Particular attention should be directed toward procedures used
to communicate the limitations of the visit between the visitor control
office and facility points of contact or escorts.

 [Security Infraction Records]{.underline}: To determine incidents
where visit hosts or escorts may have failed to meet their obligation to
accompany their visitors and limit their access to unapproved areas.

**[Interviews]{.underline}**

Interviews provide background information and explanations as to how
policies and procedures are implemented. They may be conducted during
any phase of the survey process, to clarify records or observed
performance conditions. Interviews should be conducted to determine
whether the requirement for an effective \"need-to-know\" policy
regarding National Security Information, Restricted Data, Formerly
Restricted Data and Nuclear Weapon Data is fully understood.

The following people should be interviewed:

 [Employees responsible for processing and controlling classified
visits]{.underline}: Determine whether staff are aware of their
responsibilities and the need to verify access authorization levels and
access requested.

 [Individuals responsible for processing, controlling, and approving
visits of uncleared U.S. citizens]{.underline}: Determine whether the
requirement for an effective \"need-to-know\" policy regarding SCI, RD
and NWD is fully understood, and to determine if they are fully aware of
their responsibilities.

**[Performance Measures]{.underline}**

Several methods exist by which performance can be measured. Since the
primary intent is to determine whether the visitor control program is
effective, the data collection activities will educate the evaluator and
assist in the formation of specific performance tests.

Provided below are techniques that can be employed when evaluating the
effectiveness of the program. These suggestions are not all inclusive,
and anyone conducting a survey can use her or his imagination to develop
additional innovative performance measures.

 Review procedures for the control of classified visits to determine
consistency with DOE policy. Procedures should assure adherence to the
dates of the visit, level of access afforded, and areas of the facility
to be visited. Particular attention should be directed toward procedures
used to communicate the limitations of the visit (that is, the areas and
levels of access) between the visitor control office and facility points
of contact or escorts.

 Review a sample of DOE F 5631.20s (when their use is required) to
determine whether they contain adequate information and were submitted
in time to allow the visited site to process the request. If
deficiencies are noted, it may be prudent to review additional forms.

 Review a sample of classified visitor badge requests - lists of
visitor badges issued or visitor logs - to ensure that visit requests
were received for each badge requested. If deficiencies are noted,
review additional forms.

 Review badge/pass system policies and procedures to determine whether
they are consistent with DOE requirements, and whether the implementing
procedures are consistent with site-specific policies. Determine if the
appropriate access control is being achieved.

 Review visitor logs and badge records and interview personnel in the
badge office to determine if visitors\' badges and passes are being
recovered at the conclusion of the visit. Determine what actions are
taken if a visitor forgets to turn in a badge.

 Interview staff and personnel who are responsible for requesting visit
authorizations to determine if the requirement for an effective
need-to-know policy regarding National Security Information, Restricted
Data, and Nuclear Weapon Data is fully understood.

 Observe badge checks and the wearing of badges by personnel during the
course of normal operations to determine if procedures are being
followed. Inspect badges/passes for proper identifying/access
information and compare with visitor control records. Observe badge/pass
preparation and accountability. Inspect containers used to store badge
inserts and unissued badges.

 Review a sample of specific security plans for foreign national visits
and assignments to determine whether the elements required by DOE
1240.2A are covered. A sample of visit requests should be examined to
determine if they are timely and complete, and have the appropriate
level of approval. If deficiencies are noted, it may be prudent to
review additional visit requests.

 Review a sample of indices checks. If the results of the checks were
forwarded to the requesting operations office, determine if appropriate
consideration was given to potentially derogatory information.

 Review copies of site OPSEC Program Working Group meeting minutes to
determine what review, if any, was conducted prior to the visit or
assignment of a foreign national.

 Review a sample of host reports to determine whether they were timely,
complete, and forwarded to the appropriate distribution. Interview four
or five individuals who acted as hosts for sensitive country visitors.
Determine each host\'s knowledge of the specific security plan and the
responsibilities pertaining to the visit, as well as each host\'s input
to the host report. Expand the review, if warranted.

 Interview operating personnel to identify problems in the operation of
DAVACs and WDACs.

**[V.]{.underline} [UNCLASSIFIED VISITS AND ASSIGNMENTS BY FOREIGN
NATIONALS]{.underline}**

DOE contractor facilities often act as hosts to foreign nationals in the
performance of unclassified project requirements, collaborative efforts
and research and development activities related to the program of
international cooperation to promote the dissemination of the benefits
of the peaceful applications of atomic energy. The country from which
the visitor hails, the sensitivity of the facility to be visited, the
subject matter to be accessed and the length of time the visitor is
present at the facility will all determine to a large degree the types
of pre-visitation inquiries and planning that will be required and the
limitations or restrictions that will be applied to the actual conduct
of the visit or assignment. Following the visit, these criteria will
also act to determine the prescribed follow-up reporting.

**[Description]{.underline}**

The DOE supports an active program of unclassified visits and
assignments by foreign nationals to DOE facilities for the benefit of
its programs. The exchange of information and personnel through visits
and assignments has been deemed essential to the achievement of
significant, mutual benefits from international cooperation.

The DOE has established the authorities, responsibilities and policies
to prescribe the administrative procedures for visits and assignments by
foreign nationals to DOE facilities for purposes involving unclassified
information and to ensure that these visits and assignments are
conducted under prescribed conditions in a manner consistent with
programmatic and security policies and international obligations.

Broadly stated, the visit and assignment program is to be consistent
with active, relevant international agreements and related formal
understandings and should be used to advance the programmatic objectives
of the Department, to facilitate maximum benefit to the U.S. from
international cooperation in science and technology matters, to support
DOE\'s mission to improve the competitive position of U.S. industry in
world trade, and to ensure reciprocity in international technology
transfers. Neither DOE nor DOE contractor personnel and facilities,
security interests, sensitive subjects, nor DOE technology are to be
compromised as a result of the visit and assignment program.

The following are of major importance regarding the program\'s security
policy and should be given major consideration in granting or in the
denial of a visit or assignment request:

 Sensitivity of the subject, facility, or country of national involved

 Adequacy of the security plan, e.g. protection of sensitive subjects
and/or security interests

 Evidence of intelligence threat

 Duration and continuity of visit or assignment

 Site visit and collaboration history of visitor/assignee

 Collaboration experience of program activity

The following elements are indicators and, as such, their presence and
the degree to which they are present will provide an inspector with a
perfunctory look at the \'health\' of the visit and assignment program.

 There are established visit and assignment procedures in the areas of
origination and processing of requests, the planning phase, visit and
assignment conduct and termination of visit and assignment reporting.
Management has displayed both an awareness of its responsibility for the
program and its acceptance and support of the program.

 Visit and assignment requests are submitted in a timely fashion to
both Safeguards and Security and to the Department. When requests are
furnished well in advance, necessary actions such as indices checks and
security planning can be accomplished.

 Security plans specific to the visit or assignment are drafted, when
warranted. Occasionally, generic plans are utilized; but, for optimum
coverage the visit-specific plan is preferred.

 If the security infraction and security incident documentation
indicates that host and escorts of foreign visitors have not been cited
for any transgressions of the requirements, this should be taken as a
valid observation in support of the strength of the program. Following
visits and assignments, the hosts and escorts should be debriefed as to
the knowledge of the visitor and as to any unusual activities, requests
or interests. Host/Escort procedures and responsibilities have been
formulated and there is an ongoing program to keep the hosts and escorts
current in their knowledge and training.

 Because the OPSEC Program focus is on unclassified information and how
best to protect that information, the OPSEC contribution during
unclassified foreign visits and assignments is logically going to be one
of major significance. The Counterintelligence (CI) Program, on the
other hand, is concerned with how best to counter attempts made at
intelligence gathering by foreign entities. Thus, we have a situation
where the OPSEC and CI Programs are merged. In light of their combined
requirements, a briefing and debriefing program, as well as the OPSEC
Assessment (OA) are all applied in the foreign visit and assignment
arena.

 Sensitive facilities and sensitive technologies have been identified
and these receive weighted consideration in determining visit/assignment
approvals and those requiring this information are aware of its
existence and well-versed in its application.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

31, 35, 38, 54, 55, 66, 67 and 68.

**[Survey Content]{.underline}**

Evaluation of the establishment, implementation, and management of the
visit and assignment program, to include administration, procedures,
staffing, reporting, and internal evaluation.

**[Documentation]{.underline}**

Program Management Files, which will tend to reflect the support for the
program and will indicate management\'s compliance with pertinent DOE
orders.

Review of documentation authorizing the laboratory director or in some
cases the assistant laboratory director or equivalent to approve
specific categories of visits and assignments.

Visits not requiring the submittal of DOE F 1A-473, which reflects
compliance with DOE 1240.2B and indicates knowledge of requirements.

Visits requiring the submittal of DOE F 1A-473, whether the visit
request originated with the Field Element, the Contractor, from
Headquarters or was received by EP outside of DOE/DOE Contractors;
appropriate level of approval, complete; submittal requirements vary
depending on the need for indices queries which sets the requirement at
six to eight weeks.

Review of all assignments, all of which require the submittal of DOE F
1A-473; appropriate level of approval, completed forms.

Review of indices checks, which are not required in all cases such as
for non-sensitive country nationals; where required submitted through
VAMS to IN; in cases of \"hits\" on indices checks are these recorded
and retrievable for future requests.

Escort/Host training, established procedures, documented
training/refresher attendance.

Security incidents/infractions involving foreign visits and assignments;
these should be looked at for trends and to identify weaknesses in
training, etc.

Escort/Host Procedures; documented and available for use, note whether
the importance of the security plan to the escort/host is addressed.

Security Plans: Was the generic plan sufficient for coverage or should
the specific plan have been incorporated, due to the nature of the
visit? Did those required to read the plan do so and is it documented?

Review of sensitive country listings, review for currency: If the
reporting is automated, does the report allow for these countries to be
automatically flagged?

Review of documentation identifying sensitive topics, review for
currency: If the reporting mechanism is automated, does the report allow
for these topics to be automatically flagged?

Review of documentation identifying sensitive facilities: If the
reporting mechanism is automated, does the report allow for these
facilities to be automatically flagged?

Visit Specific Security Plans: Have these been implemented when the
visit is of such a nature as to force their requirement? Were the
appropriate parties involved in formulating the specific plan? Did those
required to do so have input to, approval of, and/or read the plan? Has
appropriate distribution been made? The host must maintain or have
access to the security plan.

Unclassified Computer Security Review: To what extent is this review
accomplished? Is it part of the approval process/planning/OPSEC?

OPSEC Review: Is there documentation on review of request submittal and
of specific security plans and security planning in general? To what
extent is it tied to the CI program?

CI Program: Does the program make provisions for the extent of
involvement in the visit/assignment program from processing to closeout?

Notification of approval documentation: Was the host notified?

Personnel Assignment Agreement, if appropriate and documented.

Deviations pertinent to visits and assignments, if appropriate and
documented.

Funding or financial agreements, if appropriate and documented.

Host Reports; when required to do so by the nature of the visit
specifically when the approval was not granted by the cognizant
laboratory director, has the report been submitted in a timely manner to
the appropriate recipients and is it complete?

Hostile Contact Reports; are these addressed, when warranted, and
submitted to appropriate offices?

Visit request approvals and denials based on application of programmatic
and security interests and other factors; documented and retained, in
the case of denials are the reasons a matter of record and is
notification to and reason for the denial made to the host(s)?

VAMS Submittals; these should be cross-checked with the
request/processing format whether it be written or electronic, check for
consistency and accuracy of the information, did submittal institute
indices queries.

**[Interviews]{.underline}**

The following people should be interviewed regarding the visit and
assignment program:

 Security and Safeguards Manager (DOE and Contractor)

 OPSEC/CI Program Manager (DOE and Contractor)

 Unclassified Computer Security Manager

 Program Managers and Supervisors

 VAMS Coordinator

 OPSEC Coordinator and/or OPSEC Working Group members

 Hosts/Escorts

 Visit Control

 Individual Contributors

**[Performance Measures]{.underline}**

The performance measures can be divided into three phases. The first
phase being the origination/processing of the request stage; and as
such, this phase if the responsible participants adhere to the
requirements, the remaining phases will also be successful. The second
phase is planning and the actual conduct of the visit/assignment. The
third phase is the termination and reporting phase.

[Origination/Processing]{.underline}:

 The initial request format, whether it be an executable form or an
electronic version, should be the responsibility of a point of contact,
projected host or some other responsible person.

 Ascertain if there is a mechanism in place which will separate the
visits/assignments according to sensitivity by visitor, subject matter,
or facility to be visited.

 Is the host making the request knowledgeable about sensitive topics
and sensitive facilities and whether the purpose of the visit/assignment
falls within the approval criteria guidelines?

 Programmatic Policy - considerations, requirements of DOE 1240.2B,
7.b - ascertain what types of activities surround assuring that policy
requirements are adhered to and that certain standards are applied;
there should be either a review board or committee or specific,
designated individuals to attest to the fact and sign off that
requirements exist and are being met.

 Security Requirements - ascertain whether hosts/escorts know the
security requirements and understand the rationale behind these
requirements as they relate to sensitive subjects, countries, and
facilities and are security concerns built in to the host/escort
training and reporting procedures; has consideration been given to the
adequacy of the security plan and the protection of sensitive subjects
and/or security interests; are there established reporting procedures
for both the host report and the hostile contact report and are these
procedures known to the individuals requiring them.

 The correct categorization of visits and assignments based on the
duration has been applied; this becomes an important aspect of VAMS
because the length of the stay has a significant impact on those in
contact with the national regarding the extent of the associations and
the possibility of future contacts as well as on how much access to
facilities, etc. the national should have during the visit/assignment.

 While entering the data in VAMS is an ongoing process, the entries
should start as soon as possible; the indices checks are instituted if
required as soon as the VAMS system receives the initial input.

 Whether the visitor is to be escorted or have unescorted access is a
determination that must be made; unescorted access will require special
authorization from the Field Element and also at the conclusion of the
visit or assignment a letter must be forwarded to the Field Element
OPSEC Manager.

 Planning activities in general should be extensive, contingent on the
national, and should involve appropriate individuals and elements as
well as departments.

 Security plans/visit specific security plans should be resolved as to
their appropriateness on a case-by-case basis; when specific plans are
\"called out\" is there a mechanism in place to assist the host by
providing a boiler plate and the assistance to develop the plan.

 OPSEC and OPSEC review, involved in the processing stage.

 Visit Control involvement is evidenced by input to the
request/processing format.

 Physical Security involvement is evidenced by input to the
request/processing format, sensitive facilities have inherent
limitations.

 A number of indices inquiries should be reviewed to ascertain whether
they were forwarded to the requesting field element office and if due
consideration was given to any derogatory information.

 Approval/Disapproval based on DOE 1240.2B, 7.d.: Choose ten to fifteen
records and ascertain whether the guidelines and criteria have been
followed; who the signatories are; who has final approval authorization;
and whether there are exceptions.

 Personnel Agreements, if warranted, are in effect prior to the
visit/assignment.

[Planning/Conduct]{.underline}:

 Training - escorts/hosts on their responsibilities and is the
deteriorization of escort procedures addressed; general personnel
training in the areas of sensitive facilities, sensitive topics, OPSEC,
CI, how to report hostile contacts, etc.

 OPSEC and CI teamed together in the second phase for a
well-coordinated operation.

 OPSEC, Physical Security and Visit Control will be closely aligned
during this phase, in constant communication.

 Security Plan/Specific Security Plan; what criteria are used to make
the determination as to which one should be used, once the decision is
made to utilize the specific plan it should contain the input from
OPSEC, CI, Physical Security, Visitor Control, VAMS Coordinator,
Unclassified Computer Security, Visit/Assignment Point of Contact, Local
Field Element.

 Point of Contact; is there a point of contact with overall
responsibility for the visit/assignment program.

[Termination/Reporting]{.underline}:

 Hostile contacts - responsibilities, procedures, are they followed up
(SIR)

 Host reports - select a sample for review, what was provided, could
more information have been provided; was the host knowledgeable about
the specific security plan and his/her responsibilities; cross check
with VAMS

 OPSEC, Visit Control and Physical Security involved in the third phase
in lessons learned activities

 VAMS system should be queried as to parallel entries from the DOE
forms 1A-473

 Review of security incidents or infractions which were attributable to
a host or escort; what were the causes, could situation have been
prevented, were there attempts to incorporate this information into
lessons learned and consequently to augment the host/escort training and
briefing.

**[VI.]{.underline} [PERSONNEL ASSURANCE PROGRAM]{.underline}**

**[Description]{.underline}**

Essentially a Human Reliability Program, the Personnel Assurance Program
(PAP) was created as a certification program to assure the suitability
of individuals for nuclear explosive duties from a safety and physical
capability standpoint. It is designed as a fitness-for-duty program. For
example, individuals with a physical disability may not represent a
security risk, but may be unable to physically perform the duties
related to handling nuclear devices or components.

Since these duties do involve direct access to Category I quantities of
SNM (which would place these individuals in the Personnel Security
Assurance Program (PSAP)), an exception was made for PAP to avoid
duplication of testing. The elements that make up the evaluation aspect
of the PAP are nearly identical to those in the PSAP, therefore, when
conducting a survey of these programs duplication of efforts may result.
An incident may have both safety and national security implications.
This overlap is reflected in the testing elements of both the PAP and
the PSAP, which are markedly similar. However, the process through which
the information is analyzed and the procedures that are followed to
remove individual from the two programs are quite different. The PAP
system of certification and decertification set up a completely
independent line of review and appeals for the individual.

PAP evaluation elements are medical examinations, psychological testing,
drug screening, and supervisory reviews. An individual in the PAP must
have a DOE \"Q\" access authorization, which includes an initial
investigation and reinvestigation every 5 years. Training in recognizing
aberrant behavior is provided to individuals in the PAP. Due to the
similarity of PAP and PSAP training requirements, training is being
given at some sites based on the training developed for PSAP.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

1, 2, 50 and 51.

**[Survey Content]{.underline}**

Since this is primarily a safety program, for which DP-20 has
cognizance, coordination with non-S&S organizations must be conducted
prior to the survey. The survey cannot be conducted thoroughly without
the cooperation of the site medical director. When conducting the
survey, evaluate the implementation of management guidance in the
selection of individuals for assignment to critical duties and the
personnel assurance program certification process and effectiveness.
This includes procedures for drug testing (records and handling).

**[Documentation]{.underline}**

Reviewing the documentation will assist in understanding the facility\'s
program and learning about the education and awareness needs.
Additionally, this information will assist in developing ideas for
performance testing. All documents should be reviewed to identify
inconsistencies and contradictions and to determine their currency and
accuracy. Request and review the following documents prior to the
survey:

 [Site Implementation Plans, policies and procedures]{.underline}:
Determine whether the programs have been fully implemented and positions
have been properly identified. Confirm that they provide for drug
testing, supervisory reviews, medical assessments, management
evaluations, security reviews, approval authority notification
procedures, reassignment and termination procedures, and an effective
program for maintaining appropriate data on PAP positions.

 [Implementation Schedule]{.underline}: Ensure that it is complete,
realistic, and being followed.

 [Training Records/Materials]{.underline}: Determine if they are
complete and adequately maintained. Evaluate if training materials are
sufficient for the training staff and for the training of all personnel
involved with the program. If possible, the evaluator should attend a
training session to determine the effectiveness of training.

 [Drug Testing/Handling Procedures]{.underline}: Inspect, in
conjunction with HR or appropriate oversight office, the materials used
to conduct the tests. If possible, have individuals responsible for
conducting drug testing explain the process, step by step. Review
procedures for handling specimens to determine whether an effective
chain of custody is maintained.

 [Drug Testing Records]{.underline}: Determine if all PAP employees
have received a drug test and if the random testing program has been
implemented as described. If some employees have not been tested,
determine why they were excluded.

 [PAP Records]{.underline}: Verify information contained in the files
is pertinent to the program, is timely, accurate, and structured and
maintained to allow an audit trail of events and actions. Examine any
reports of unusual conduct or aberrant behavior to determine who made
the report, how it was recorded, and what action was taken.

 [Random Test Procedures]{.underline}: Review the selection process for
random testing to determine whether it is, in fact, conducted on a
random basis.

**[Interviews]{.underline}**

Interviews provide background information and explanations as to how PAP
policies and procedures are implemented. They may be conducted during
any phase of the survey process to clarify records or observed
performance or conditions. This information can also assist in
developing ideas for performance testing.

 [Facility Managers, Supervisors and Cleared Personnel]{.underline}:
Determine if they have received training and are aware of their
responsibilities, especially in reporting unusual conduct.

 [Tested Individuals]{.underline}: Ask them to describe the procedures
that were used during the test to determine whether policy and
procedures match actual practice.

 [Supervisors, Medical Personnel, Persons in PAP
Positions]{.underline}: Determine if the required reviews are being
conducted, and whether personnel fully understand their
responsibilities.

**[Performance Measures]{.underline}**

Several methods exist by which performance can be measured. Since the
primary intent of the survey is to determine whether the PAP is
effective, the data collection efforts will educate the evaluator and
assist in the formation of specific performance tests. The following
suggestions are not all inclusive, and anyone conducting a survey can
use his or her own imagination to develop additional innovative
performance measures.

 Attend scheduled training sessions to evaluate the information
covered, and the retention of the employees being trained. Compare the
review of training records and interview employees to determine if they
received training as indicated in the records.

 Determine how many PAP positions exist and how long individuals have
been in these positions. Determine their knowledge of their
responsibilities, and if they have received appropriate medical and
security screening.

 Visit the Site Occupational Medical Director. Request a tour of the
facility and observe the drug testing procedures as they are being
performed. Determine if they are similar to the procedures described by
employees during the interviews.

 Examine any reports of unusual conduct or aberrant behavior to
determine if the final action taken was appropriate. This will also
indicate whether supervisors and managers understand their
responsibilities to the program.

 Select a sample of PAP-designated position requests or DOE F 5631.35
and follow the audit trail to final approval. Review related medical and
security files, supervisors records, and training records. Ensure all
records are accurate and that the information coincides with actual
events.

**[VII.]{.underline} [PERSONNEL SECURITY ASSURANCE
PROGRAM]{.underline}**

**[Description]{.underline}**

The Personnel Security Assurance Program (PSAP) is a continuous
evaluation program for individuals who have direct access to, protect,
or transport Category I quantities of SNM; perform duties as nuclear
material production reactor operators; or people with the potential of
causing unacceptable damage to national security.

The purpose of the PSAP is to ensure that these individuals meet the
highest standards of reliability. The objective is to identify
individuals whose judgment may be impaired by physical or psychological
disorder, use controlled substances, or habitually use alcohol to
excess. Continuous evaluation is accomplished through an initial
assessment and recurring annual assessments consisting of supervisory
reviews, medical assessments, management evaluation, and security
determinations. An individual in the PSAP must have a DOE \"Q\" access
authorization, which includes an initial investigation and a
reinvestigation every 5 years.

Training in observation of aberrant behavior is provided to PSAP
supervisory and employees to assure that individuals in the PSAP are
aware of behavior that may indicate a security concern.

The PSAP is concerned with the risk to national security posed by an
individual and how that risk might be minimized. The ability of a person
to physically perform a job is generally not a criteria in a PSAP
determination; but trustworthiness, reliability, and sound judgement are
of concern.

**[References]{.underline}**

The following references (Attachment 3) apply to this section:

1, 2 and 72.

**[Survey Content]{.underline}**

Because a survey of the PSAP involves non-S&S organizations, it is
essential that the survey be coordinated with the site medical director
and his or her cooperation solicited. Many of the evaluation steps will
involve reviews of drug testing records and testing procedures. When
conducting the survey evaluate the implementation of management
guidance, procedures, and documentation (including medical and security
review processes) required for access authorization to a PSAP position.

**[Documentation]{.underline}**

Reviewing the documentation will help in understanding the facility\'s
program. Additionally, this information will assist in developing ideas
for performance testing. All documents should be reviewed to identify
inconsistencies and contradictions and to determine if they effectively
support the PSAP. Request and review the following documents prior to
the survey:

 [Site Implementation Plans, Policies, and Procedures]{.underline}:
Determine whether the program has been fully implemented and PSAP
positions have been properly identified. Confirm that they provide for
drug testing, supervisory reviews, medical assessments, management
evaluations, security reviews, approval authority notification
procedures, reassignment and termination procedures, and establish an
effective program for maintaining appropriate data on PSAP positions.

 [Implementation Schedule]{.underline}: Ensure that it is complete,
realistic, and being followed.

 [Training Records/Materials]{.underline}: Determine if they are
complete and adequately maintained. Evaluate if training materials are
sufficient for the training staff and for the training of all personnel
involved with the program. If possible, the evaluator should attend a
training session to determine the effectiveness of training.

 [Drug Testing/Handling Procedures]{.underline}: Inspect, in
conjunction with HR or appropriate oversight office, the materials used
to conduct the tests. If possible, have individuals responsible for
conducting drug testing explain the process, step by step. Review
procedures for handling specimens to determine whether an effective
chain of custody is maintained.

 [Drug Testing Records]{.underline}: Determine if all PSAP employees
have received a drug test and if the random testing program has been
implemented as described. If some employees have not been tested,
determine why they were excluded.

 [PSAP Records]{.underline}: Verify information contained in the files
is pertinent to the program, is timely, accurate, and structured and
maintained to allow an audit trail of events and actions. Examine any
reports of unusual conduct or aberrant behavior to determine who made
the report, how it was recorded, and what action was taken.

 [Random Test Procedures]{.underline}: Review the selection process for
random testing to determine whether it is, in fact, conducted on a
random, non-selective basis.

**[Interviews]{.underline}**

Interviews provide background information and explanations as to how
policies and procedures are implemented. They may be conducted during
any phase of the survey process to clarify records or observed
performance or conditions. Meetings should be scheduled and interviews
conducted to determine the adequacy of PSAP procedures and their
implementation. This information can also assist in developing ideas for
performance testing.

 [Facility Managers, Supervisors and Cleared Personnel]{.underline}:
Determine if they have received training and are aware of their
responsibilities, especially in reporting unusual conduct.

 [Tested Individuals]{.underline}: Ask them to describe the procedures
that were used during the test to determine whether policy and
procedures match actual practice.

 [Supervisors, Medical Personnel, Persons in PSAP
Positions]{.underline}: Determine if the required reviews are being
conducted, and whether personnel fully understand their
responsibilities.

**[Performance Measures]{.underline}**

Several methods exist by which performance can be measured. Since the
primary intent of the survey is to determine whether the PSAP is
effective, the data collection efforts will educate the evaluator and
assist in the formation of specific performance tests. The following
suggestions are not all inclusive, and anyone conducting a survey can
use his or her own imagination to develop additional innovative
performance measures.

 Attend scheduled training sessions to evaluate the information covered
and the retention of the employees being trained. Compare training
records and the interviews of employees to determine if they received
the training indicated in the records.

 Determine how many PSAP positions exist and how long individuals have
been in these positions. Determine their knowledge of their
responsibilities, and if they have received appropriate medical and
security screening.

 Visit the Site Occupational Medical Director. Request a tour of the
facility and observe the drug testing procedures as they are being
performed. Determine if they are similar to the procedures described by
employees.

 Examine any reports of unusual conduct or aberrant behavior to
determine if the final action taken was appropriate. This will also
indicate whether supervisors and managers understand their
responsibilities to the PSAP program.

 Select a sample of PSAP-designated position requests or DOE Forms
5631.35 and follow the audit trail to final approval. Review related
medical and security files, supervisors records, and training records.
Ensure all files are accurate and that the information coincides with
actual events.