##### SAFEGUARDS AND SECURITY

**SURVEY AND SELF-ASSESSMENT**

**GUIDE DOE G 470.1-2**

![](media/image1.png){width="3.5694444444444446in"
height="3.6666666666666665in"}

**U.S. Department of Energy**

**Office of Security**

**July 2002**

**FOREWORD**

The Office of Security has published this Guide to describe the
philosophy, scope, and general procedures essential to personnel
responsible for planning, conducting, evaluating, and documenting
performance and compliance with safeguards and security (S&S)
requirements or standards during surveys and self-assessments. To the
extent this Guide is implemented throughout the Department of Energy
(DOE), standardization of surveys will enhance the effective application
of S&S programs.

This Guide addresses all the requirements listed in DOE Order 470.1,
Chapters IX and X, and applicable requirements from other chapters of
the Order. Mandatory requirements are identified with the term
"**must**." The term "should" is used in conjunction with non-mandatory
implementation guidance. Text enclosed by quotation marks is verbatim
from the Order.

###### Periodic revisions to this Guide are anticipated in response to changes in DOE program direction and guidance, insights gained from independent oversight activities, and feedback from customers and constituents. Users are urged to continue to provide suggestions for enhancing this Guide to DOE Technical and Operations Security Program Manager.

###### 

###### 

###### 

###### 

###### 

######  

###### Table of Contents

[[]{#TOCSEC1 .anchor}Section 1 Introduction
5](#__RefHeading___Toc510594647)

[[]{#TOC11 .anchor}[1.1]{.smallcaps} General
5](#__RefHeading___Toc510594648)

[1.2 Applicability 5](#__RefHeading___Toc510594649)

[1.3 Content 5](#__RefHeading___Toc510594650)

[Section 2 Surveys 5](#__RefHeading___Toc510594651)

[2.1 Purpose 5](#__RefHeading___Toc510594652)

[2.2 Scope 6](#__RefHeading___Toc510594653)

[2.3 Responsibilities 7](#__RefHeading___Toc510594654)

[2.3.1 Lead Responsible Office 7](#__RefHeading___Toc510594655)

[2.3.2 Surveying Office 8](#__RefHeading___Toc510594656)

[2.3.3 Other Offices With An Established Interest
8](#__RefHeading___Toc510594657)

[2.4 Types 8](#__RefHeading___Toc510594658)

[2.5 Frequencies And Schedules 9](#__RefHeading___Toc510594659)

[2.6 Phases 11](#__RefHeading___Toc510594660)

[Section 3 Planning The Survey 12](#__RefHeading___Toc510594661)

[3.1 Survey Personnel 12](#__RefHeading___Toc510594662)

[3.1.1 Survey Team Leader 13](#__RefHeading___Toc510594663)

[3.1.2 Team Members 13](#__RefHeading___Toc510594664)

[3.2 Planning Activities 14](#__RefHeading___Toc510594665)

[3.2.1 Presurvey Planning 14](#__RefHeading___Toc510594666)

[3.2.2 Presurvey Coordination 15](#__RefHeading___Toc510594667)

[3.2.3 Survey Planning 17](#__RefHeading___Toc510594668)

[Section 4 Conducting The Survey 19](#__RefHeading___Toc510594669)

[4.1 Goal 19](#__RefHeading___Toc510594670)

[4.2 Facility In-Briefing 19](#__RefHeading___Toc510594671)

[4.3 Communications 19](#__RefHeading___Toc510594672)

[4.3.1 Internal Team Communication 19](#__RefHeading___Toc510594673)

[4.3.2 Interfacing With The Surveyed Organization
20](#__RefHeading___Toc510594674)

[4.4 Data Collection Considerations 20](#__RefHeading___Toc510594675)

[4.5 Types Of Data Collection 21](#__RefHeading___Toc510594676)

[4.5.1 Document Reviews 21](#__RefHeading___Toc510594677)

[4.5.2 Observations And Tours 22](#__RefHeading___Toc510594678)

[4.5.3 Interviews 23](#__RefHeading___Toc510594679)

[4.5.4 Performance Tests 24](#__RefHeading___Toc510594680)

[4.6 Data Validation 28](#section-15)

[4.7 Data Analysis 29](#__RefHeading___Toc510594682)

[4.8 Documenting And Determining Findings
29](#__RefHeading___Toc510594683)

[4.9 Ratings 30](#__RefHeading___Toc510594684)

[4.9.1 Overview Of The Rating Process 30](#__RefHeading___Toc510594685)

[4.9.2 Assigning Ratings 31](#__RefHeading___Toc510594686)

[4.9.3 Types Of Ratings 32](#__RefHeading___Toc510594687)

[4.9.4 Basis For Ratings 32](#__RefHeading___Toc510594688)

[4.9.5 Rationale For Ratings 32](#__RefHeading___Toc510594689)

[4.10 Out-Briefing 35](#__RefHeading___Toc510594690)

[Section 5 Post-Survey Activities 35](#__RefHeading___Toc510594691)

[5.1 Report Preparation Meetings 36](#__RefHeading___Toc510594692)

[5.2 Report Requirements 36](#__RefHeading___Toc510594693)

[5.2.1 Report Format 37](#__RefHeading___Toc510594694)

[5.2.2 Report Content 37](#__RefHeading___Toc510594695)

[5.2.3 Termination Reports 40](#section-17)

[5.3 Notification Requirements 40](#__RefHeading___Toc510594697)

[5.4 Report Distribution 41](#__RefHeading___Toc510594698)

[5.5 Resolution Of Findings 42](#__RefHeading___Toc510594699)

[5.5.1 Tracking Findings 42](#__RefHeading___Toc510594700)

[5.5.2 Corrective Action Completion 42](#__RefHeading___Toc510594701)

[Section 6 Self-Assessments 43](#__RefHeading___Toc510594702)

[6.1 Rationale 43](#__RefHeading___Toc510594703)

[6.2 Self-Assessment Elements 43](#__RefHeading___Toc510594704)

[6.3 Conducting A Self-Assessment 44](#__RefHeading___Toc510594705)

**ABBREVIATIONS AND ACROYNMS**

CS Cyber Security

DNA Does Not Apply

DOE Department of Energy

DOE O Department of Energy Order

FDAR Facility Data and Approval Record

FOCI Foreign Ownership, Control, or Influence

FRD Formerly Restricted Data

GAO General Accounting Office

IG Inspector General

LRO Lead Responsible Office

LSPT Limited Scope Performance Test

MAA Material Access Area

NMC&A Nuclear Material Control and Accountability

NNSI Nonproliferation and National Security Institute

NRC Nuclear Regulatory Commission

OA Office of Independent Oversight and Performance Assurance

OPSEC Operations Security

OS Office of Security

PA Protected Area

PF Protective Force

RD Restricted Data

S&S Safeguards and Security

SAP Special Access Program

SCIF Sensitive Compartmented Information Facility

SNM Special Nuclear Material

SPO Security Police Officer

SRD Secret Restricted Data

SSIMS Safeguards and Security Information Management System

SSSP Site Safeguards and Security Plan

TSCM Technical Surveillance Countermeasures

VA Vulnerability Assessment

WFO Work for Others

#### 

# [[]{#__RefHeading___Toc510594647 .anchor}Section 1 Introduction](#TOCSEC1)

## [[]{#__RefHeading___Toc510594648 .anchor}1.1 General](#TOC11)

> Executive Orders 12958, Classified National Security Information and
> 12829, National Industrial Security Program, the Atomic Energy Act and
> Department of Energy Order (DOE O) 470.1 require surveys and
> self-assessments to be conducted at DOE and DOE-contractor facilities
> to evaluate their performance and compliance with safeguards and
> security requirements and standards. This Guide provides an approach
> for satisfying those requirements. It describes the philosophy, scope,
> and general procedures associated with facility surveys and
> self-assessments and outlines the steps needed to conduct them.

## [[]{#__RefHeading___Toc510594649 .anchor}1.2 Applicability](#TOC11)

> The information in this Guide is intended to assist personnel
> responsible for planning and conducting surveys and/or
> self-assessments to evaluate and document DOE facility performance and
> compliance with safeguards and security requirements and standards.

## [[]{#__RefHeading___Toc510594650 .anchor}1.3 Content](#TOC11)

> Section 2 of this Guide presents an overview of facility surveys. It
> covers the purpose and scope of surveys, summarizes the
> responsibilities of the key parties involved, and describes the types
> of surveys typically conducted at DOE facilities. The frequency,
> schedules, and phases of surveys are also discussed in Section 2.
> Sections 3, 4, and 5 provide detailed descriptions of the three
> primary phases of a facility survey\--planning, conducting, and
> post-survey. Facility self-assessments are described in Section 6.

# 

# [[]{#__RefHeading___Toc510594651 .anchor}Section 2 Surveys](#TOC11)

## [[]{#__RefHeading___Toc510594652 .anchor}2.1 Purpose](#TOC11)

> The purpose of the facility survey is "to ensure proper levels of
> protection consistent with Departmental standards to prevent
> unacceptable, adverse impact on national security or on the health and
> safety of DOE and contract employees, the public, or the environment.
> The adequacy of Safeguards and Security (S&S) measures shall be
> validated through various means such as:

#### Surveys conducted by the DOE Surveying Office prior to initiation of Safeguards and Security activities and periodically thereafter; 

a.  Periodic facility self-assessments;

b.  Program reviews by Facility Survey Operations Managers and other
    appropriate Departmental elements; and

c.  Inspections and assessments by the Deputy Assistant Secretary for
    Independent Oversight and Appraisals."

"The Survey Program applies to all facilities that are eligible to have
access to, use, store, or transmit nuclear and other hazardous material
presenting a potential radiological or toxicological sabotage threat
and/or classified information, that require access authorizations, or
that possess over \$5,000,000 of DOE property, exclusive of facilities
and land values."

> Surveys provide the consistency and discipline required to conduct a
> meaningful and valid program evaluation by adhering to and applying
> established and accepted standards during all phases and aspects of
> the process. This approach has been developed over time, through
> experience, and is frequently reviewed and refined.
>
> DOE S&S policy requires that certain functions be performed to achieve
> certain levels of protection. However, policy does not always specify
> how those functions or protection levels are to be achieved. Although
> compliance with DOE policies and procedures is mandatory, failure to
> comply with one or more specific provisions does not by itself
> indicate an Unsatisfactory program if adequate protection is provided
> by other means. Conversely, full compliance with policies and
> procedures may not produce an effective protection program---a program
> may be in compliance, but not actually performing well. Surveys
> therefore consider both compliance and performance.

## [[]{#__RefHeading___Toc510594653 .anchor}2.2 Scope](#TOC11)

> Surveys assess the protection afforded DOE S&S activities at a
> facility, including the adequacy and effectiveness of Nuclear Material
> Control and Accountability (NMC&A) and security programs. The survey
> should include a thorough examination of policies and procedures to
> ensure compliance/performance with S&S directives and requirements.
> All approved facilities are subject to the compliance and performance
> segments of surveys. The survey scope **should** include:

a.  "Compliance. The compliance segment of a facility survey reflects
    the status of a facility's S&S system as measured against
    implementation of applicable Federal statutes, regulations, policy,
    and approved S&S plans."

b.  "Performance. The performance segment of a facility survey reflects
    the degree to which the elements of the S&S system meet protection
    objectives based upon operational testing of the system."

c.  "Comprehensive. Comprehensive surveys cover the protection afforded
    S&S activities and interests within a facility, including an
    evaluation of the adequacy and effectiveness of S&S programs and a
    thorough examination of policies and procedures to ensure compliance
    and performance. All applicable topical areas, identified on DOE F
    5634.1, "Safeguards and Security Survey Report," **should** be
    surveyed except as identified Paragraph 5c." of DOE O 470.1, Chapter
    IX.

d.  "Other. The scope of special and termination surveys shall be
    determined by coordination between the Lead Responsible Office (LRO)
    and the Surveying Office. The basis of scope determinations shall be
    established by the nature or status of operations at the facility,
    activity, or element being surveyed. These surveys need not cover
    all topical areas identified in DOE F 5634.1."

> Surveys examine the effectiveness of S&S protection programs in
> various topical areas, including but not limited to:

-   Program Management

-   Protection Program Operations

-   Information Security

-   Nuclear Materials Control and Accountability.

-   Personnel Security

> Surveys also should include those programs or measures designed to
> prevent acts of radiological/toxicological sabotage that would cause
> unacceptable impact to national security or pose significant dangers
> to the health and safety of employees, the public, or the environment.

## [[]{#__RefHeading___Toc510594654 .anchor}2.3 Responsibilities](#TOC11)

The Office of Security (OS) designates Headquarters and Field Elements
as Lead Responsible Offices (LROs) and Surveying Offices. Such
designation is based on each element\'s demonstrated ability to provide
adequate resources to perform oversight. These resources include
sufficiently trained and knowledgeable S&S staff and support service
staff (i.e., contracts and finance) to ensure timely accomplishment of
tasks, a Safeguards and Security Information Management System (SSIMS)
terminal and staff trained to use it, and adequate funding for S&S
programs. Upon determination by OS that these assurances are met, the
element is advised by memorandum of its designation and added to the
lists of Responsible and Surveying Offices maintained in the SSIMS.

### 

### [[]{#__RefHeading___Toc510594655 .anchor}**2.3.1 Lead Responsible Office**](#TOC11) 

> "The LRO must ensure surveys are conducted. The responsibility for
> conducting surveys may be transferred to another Surveying Office and
> documented on DOE F 5634.3. LROs for facilities that ship nuclear
> materials are responsible for conducting shipment surveys."
>
> The following DOE Elements have been identified by OS to function as
> LROs: Albuquerque, Chicago, Idaho, Nevada, Oak Ridge, Oakland,
> Richland, and Savannah River Operations Office, and Pittsburgh,
> Schenectady Naval Reactors, Rocky Flats Office, Ohio Field Office,
> Strategic Petroleum Reserve Office, the Office of Headquarters
> Security Operations, and the Nuclear Regulatory Commission.
>
> The LRO is the DOE Element that has S&S oversight for a facility,
> including approval of S&S plans and resolution of deficiencies other
> than those specific to another DOE organization\'s security interests.

If more than one Departmental Element has a registered activity at a
facility, the organization responsible for the activity involving the
highest classification level and category of activity is normally the
LRO. However, this responsibility may, by mutual agreement, be accepted
by a Responsible Office that does not have the highest classification
level and category of activity, but has a greater scope of activity,
such as with long term or traditional interests.

### [[]{#__RefHeading___Toc510594656 .anchor}**2.3.2 Surveying Office**](#TOC11)

> "Secretarial Officers shall function as the Surveying Office for those
> offices identified in, Chapter I, Paragraph 7, DOE O 470.1 5.k., by
> ensuring that periodic surveys are completed." The DOE Operations
> Office conducting surveys of a facility on behalf of the LRO is
> considered the Surveying Office. This is typically based on geographic
> proximity or collocated interests or facilities where the Surveying
> Office can most cost-effectively accomplish the survey.

### [[]{#__RefHeading___Toc510594657 .anchor}**2.3.3 Other Offices with an Established Interest**](#TOC11)

> Offices other than the LRO may have established S&S interests or
> registered activities within a facility. Each such office should
> maintain liaison with the LRO to the extent necessary to ensure that
> their S&S interests are adequately protected.

## [[]{#__RefHeading___Toc510594658 .anchor}2.4 Types](#TOC11)

> DOE O 470.1 has defined four primary types of surveys-initial,
> periodic, special and termination. Each is discussed in the following
> paragraphs.
>
> [Initial]{.underline}. "A comprehensive survey conducted at the
> facility before granting approval" of the facility. A Satisfactory
> initial survey establishes the eligibility of the facility and results
> in the completion of the Facility Data and Approval Record (FDAR). To
> ensure the establishment and
>
> implementation of appropriate protective measures, special emphasis
> should be placed on documentation and on the performance testing of
> staff to ensure procedures have been implemented and are understood.
>
> [Periodic]{.underline}. "A comprehensive survey conducted at the
> facility at scheduled intervals." The periodic survey is used as the
> basis for the continued eligibility of the facility for the approved
> S&S interests and activities. The periodic survey examines ongoing
> compliance and performance and is similar to an initial survey. A
> survey conducted by the LRO of a possessing or non-possessing facility
> on a regular schedule would be considered a periodic survey.
>
> [Special]{.underline}. "A survey conducted at a facility for a
> specific, limited purpose such as for a technical security reason
> (i.e., Technical Surveillance Countermeasures (TSCM) surveys or
> services), a detailed review of a problem area, an unannounced survey,
> shipment of nuclear materials or classified material, or change in the
> contractor operating a government-owned facility. Shipments between
> sites by rail, truck, air, or ship are subject to survey unless the
> shipment is made via a commercial carrier licensed by the Nuclear
> Regulatory Commission (NRC)."
>
> A special survey may be based on a new S&S interest or significant
> configuration change; the need to review or validate corrective
> actions; or other special, out of cycle survey requirements. These
> requirements typically would relate to specific S&S interests and be
> more limited in scope than an initial or periodic survey. Special
> surveys may be announced or unannounced. A survey for "cause" would be
> considered a special survey.
>
> [Termination]{.underline}. "A survey of a facility conducted when all
> S&S activities have been removed, access authorizations terminated,
> and close out of required records accomplished, to ensure proper
> disposition of classified matter and nuclear and other hazardous
> material presenting a potential radiological or toxicological sabotage
> threat. Termination of facility clearances for facilities possessing
> Top Secret matter or Special Nuclear Material (SNM) require an on-site
> termination survey. For other facilities, termination may be by
> on-site survey or correspondence." Termination surveys may also be
> required for facilities possessing Departmental property.

## [[]{#__RefHeading___Toc510594659 .anchor}2.5 Frequencies and Schedules](#TOC11)

> The frequency with which surveys are performed at a specific facility
> is determined by that facility's importance rating. Facility
> importance ratings provide a means of identifying relative importance
> of facilities and activities and help determine the frequency and
> schedule for performing surveys and self assessments. Importance
> ratings assigned to activities should not exceed the importance rating
> of the facility housing them. The facility importance ratings and the
> criteria used for their determination are listed in the following
> paragraphs.
>
> "Class A" importance ratings are assigned to those activities and
> facilities that meet any of the following criteria:

-   determined by Heads of Headquarters Elements or Operations/Field
    Offices to include engagement in administrative activities
    considered essential to the direction and continuity of the overall
    DOE nuclear weapons program

-   authorized to possess Top Secret matter

-   authorized to possess Category I quantities of SNM

-   maintain Sensitive Compartmented Information Facilities (SCIFs) and
    Special Access Programs (SAPs).

> "Class B" importance ratings are assigned to those activities and
> facilities that meet any of the following criteria:

-   engaged in activities other than those categorized as "A" that are
    authorized to possess Secret Restricted Data (SRD)

-   have been designated a Field Intelligence Element

-   authorized to possess Category II quantities of SNM.

> "Class C" importance ratings are assigned to those activities and
> facilities that meet any of the following criteria:

-   authorized to possess Categories III and IV quantities of SNM or
    other nuclear materials requiring safeguards controls or special
    accounting procedures

-   authorized to possess classified matter other than the type
    categorized for "A" and "B" facilities.

> "Class D" importance ratings are assigned to those activities and
> facilities that provide common carrier, commercial carrier, or mail
> service and the facility is not authorized to store classified matter
> or nuclear material during nonworking hours. Carriers storing
> classified matter or nuclear material should be assigned an "A," "B,"
> or "C" importance rating.
>
> "Class E" (Excluded Parent) importance ratings are assigned to a
> corporate tier parent of a contractor organization that has been
> barred from participation in the activities related to a contract with
> DOE.
>
> "Class PP" (Property Protection) importance ratings are assigned to
> those facilities:

-   having significant monetary value (\> \$5,000,000)

-   possessing nuclear materials requiring safeguards controls or
    special accounting

-   procedures other than the type categorized as "A," "B," or "C"

-   for which DOE program continuity, national security consideration,
    or protection of the public health and safety constitutes an
    important DOE responsibility. Basic considerations include physical
    protection to prevent or deter acts of arson, civil disorders,
    riots, sabotage, terrorism, vandalism, and theft or destruction of
    DOE property and facilities.

> "Class NP" (Non-Possessing) importance ratings are assigned to
> facilities that have access authorizations to access classified
> information or SNM at other approved locations. Non-possessing
> facilities do not possess any classified matter or SNM at their site.
>
> Initial surveys are not required for non-possessing facilities.
> Termination surveys of non-possessing facilities are not required,
> however, a review **should** be conducted and documented to verify
> that access authorizations have been terminated.
>
> "Periodic surveys shall be conducted in accordance with the following
> schedule.

1.  Facilities possessing classified matter or Category III or greater
    nuclear and other hazardous material, presenting a potential
    radiological or toxicological sabotage threat, shall be surveyed
    once every 12 months.

2.  Facilities possessing property protection interests shall be
    surveyed once every 24 months.

3.  Facilities that do not possess classified matter but do issue access
    authorizations to employees to satisfy contractual obligations shall
    be reviewed at least once every 5 years and not necessarily through
    an on-site survey. The review shall validate access authorizations,
    badging, briefing, facility registration, and FOCI information as a
    minimum.

4.  For facilities containing only Category IV nuclear materials, as
    defined in DOE 5633.3B, the NMC&A topical area shall be surveyed at
    least once every 24 months. If the total inventory consists entirely
    of source material, less than 10 tons of heavy water, less than 350
    grams of special nuclear material, or any combination of these, a
    survey of the NMC&A topical area is not required."

> "The results of prior surveys may affect the scheduling frequency. An
> extended survey schedule (up to 24 months) may be implemented by the
> Surveying Office after consultation with the LRO if the facility has:

1.  A facility security staff trained and knowledgeable in S&S
    requirements, as evidenced by past performance in surveys;

2.  An ongoing self-assessment program covering all applicable survey
    topics and sub-topics with the results reported to the LRO;

3.  No significant deficiencies resulting from self-assessments or
    surveys (including no less than a Satisfactory rating at the topic
    levels); and

4.  An approved site S&S plan."

> Operations Offices have the authority to extend the frequency of
> survey scheduling for all facilities under their purview, with the
> exception of facilities possessing Category I SNM. The Operations
> Offices should notify the OS of survey extensions approved under their
> authority. The notification **should** allow the SSIMS administrator
> to enter the extended date of the next survey into the SSIMS,
> precluding the Operations Office from being charged erroneously with
> conducting a late survey.
>
> "Reviews, including inspections, conducted by Departmental Elements
> other than the Surveying Office or other Government oversight offices,
> may be used to meet survey requirements. Topics and subtopics on DOE F
> 5634.1 that are not addressed during reviews should be surveyed by the
> Surveying Office. When using reviews to meet the requirements of the
> survey, the following guidelines shall be followed.

1.  The review should have been conducted within the survey period.

2.  Portions of the review used should be attached to the survey.

3.  Topics and subtopics not covered by the review should be surveyed.

4.  If ratings were not assigned, ratings should be assigned for those
    reviews that are used.

5.  After the review is conducted, the Surveying Office shall analyze
    the impact of any deficiencies and assign ratings.

Special surveys shall be conducted as determined by the LRO."

## 

## [[]{#__RefHeading___Toc510594660 .anchor}2.6 Phases](#TOC11)

Activities associated with a survey typically progress through three
phases - planning, conduct, and post survey.

-   Planning - Includes all preparations for the survey (e.g., team
    selection, scope determination, dates of conduct, notification,
    development of survey plans, and coordination with the facility
    being surveyed). "The survey process and requirements shall be
    documented in locally approved survey guidelines. Surveying Offices
    shall coordinate planning with the LRO and other organizations with
    registered S&S activities."

-   Conduct - The conduct of the survey includes facility briefings and
    all of the activities involving the collection and analysis of
    information in the topical and subtopical areas being surveyed. "To
    ensure accuracy, survey results shall be validated by discussion,
    observations, or exercises during the survey period."

-   Post-Survey - Post-survey activities include compiling findings and
    preparing a final survey report, as well as determining the status
    of corrective actions for all open and closed findings from the
    previous survey.

Although these phases are identified by the primary activities they
encompass, actual activities may overlap significantly. For example,
some data are collected during the planning phase, and planning
(particularly for performance testing) can extend into the conduct
phase. Similarly, analysis begins during data collection and continues
throughout the process. Each of these phases is discussed in greater
detail in subsequent sections of this Guide.

# [[]{#__RefHeading___Toc510594661 .anchor}Section 3 Planning the Survey](#TOC11)

Survey planning involves gathering and analyzing large amounts of
information from many sources, making decisions based on the analysis,
and preparing survey activities based on the decisions. Because there is
only a limited amount of time available on-site to collect the data
necessary to characterize the status of the programs being surveyed,
planning **should** focus on determining what program elements to review
and how best to survey those elements to help ensure the most effective
use of that time. It also includes identifying personnel and other
support requirements for all phases of the survey.

This section of the Guide describes the skills and characteristics
preferred for the key survey personnel. Activities typical of the survey
planning phase are outlined.

## 

## [[]{#__RefHeading___Toc510594662 .anchor}3.1 Survey Personnel](#TOC11)

> "Survey teams are composed of inspectors and support service
> personnel. All survey teams shall be led by a Federal employee. Team
> personnel for surveys shall possess qualifications, experience, and
> training sufficient to accomplish effective and thorough surveys. New
> inspectors must attend basic survey training."
>
> To ensure that planning, conduct, and follow-up activities are
> accomplished effectively, key functions and tasks are assigned by the
> Survey Team Lead to various positions based on survey experience and
> subject matter expertise. These functions and positions are reviewed
> frequently by the Survey Team Leader to ensure that survey teams
> remain organized to effectively accomplish its responsibilities. What
> follows is a summary of the roles and responsibilities of key
> personnel involved in the survey process.

### [[]{#__RefHeading___Toc510594663 .anchor}**3.1.1 Survey Team Leader**](#TOC11) 

> The Survey Team Leader is appointed by the management responsible for
> conducting the survey and is ultimately responsible for its successful
> completion. This person should have a well-rounded understanding of
> S&S programs, previous survey experience (preferably as a topic lead),
> and topical area integration experience, as well as detailed knowledge
> of one or more of the topical areas to be surveyed. It is recommended
> that the Survey Team Leader attend both the Nuclear Nonproliferation
> and National Security Institute (NNSI) Survey Team Leader Course and
> the Basic Survey Course.
>
> The Survey Team Leader is responsible for managing the efforts of the
> survey team and for keeping the participants informed of salient
> activities during the survey. In particular, the Survey Team Leader is
> the focal point for the survey and is responsible for coordinating and
> focusing the activities of the team, ensuring that deliverables are
> prepared and provided according to the schedule, promoting integration
> among topic teams, and acting as a spokesperson during meetings and
> briefings.
>
> The Survey Team Leader should ensure that administrative and
> logistical needs are included in the planning process. Planning for
> administrative and logistical needs ensures that there is adequate
> space, furnishings, office equipment, supplies, and staff to support
> the survey team during the survey and compilation of the draft survey
> report.
>
> The Survey Team Leader provides oversight and management to ensure
> that the survey is conducted in a thorough, professional, and timely
> manner. The Survey Team Leader should specify expectations for
> planning, conduct, and post-survey schedules and deliverables, as well
> as establish procedures and guidelines for survey protocol issues
> while the team is on site.
>
> The Survey Team Leader also should conduct informal meetings with
> survey team members to review findings during the conduct of the
> survey. These reviews serve as a quality assurance tool to identify
> findings that may not be clearly written or fully described, or others
> that may not meet standards established for findings. Each of these
> reviews should be done with the team member(s) responsible for each of
> the findings. The Survey Team Leader may decide to accomplish these
> reviews "one-on-one" or in a group setting with all of the team
> present. At least one of these reviews should occur prior to the
> out-briefing.

### [[]{#__RefHeading___Toc510594664 .anchor}**3.1.2 Team Members**](#TOC11)

> Selection of survey team members is an important part of the planning
> process as such it is coordinated between the Survey Team Leader and
> management responsible for the survey. Team members should possess
> technical competence, professionalism, and maturity. Because they are
> critical to the success of a survey, the following
> characteristics/qualities should be considered when choosing team
> members:

-   [Qualifications]{.underline}. The individual should possess the
    knowledge and have relevant DOE experience to comprehensively survey
    and evaluate compliance and performance in his/her assigned topical
    area(s).

-   [Survey Training and Experience]{.underline}. The individual should
    have previous DOE survey experience or DOE Nonproliferation and
    National Security Institute (NNSI) survey training.

-   [Investigative Skills]{.underline}. The individual should have
    previous experience or display an ability to objectively collect
    facts, analyze them, and prepare defensible conclusions.

-   [Maturity]{.underline}. The person should be dependable and be able
    to work effectively in stressful or conflict situations.

-   [Professionalism]{.underline}. The person should reflect accepted
    norms of dress, appearance, and behavior associated with an S&S
    professional.

-   [Interpersonal Skills]{.underline}. The person should be able to
    interact effectively with individuals and teammates, and demonstrate
    the ability to handle difficult situations with dignity and
    objectivity.

-   [Communication Skills]{.underline}. The individual should be
    articulate, accurate, and concise when communicating. The ability to
    present briefings and write reports is important.

Survey team members often work directly with facility personnel as part
of their survey activity. The cooperation and assistance of field
element and facility representatives is essential to a thorough,
efficient, and fair appraisal. Local representatives provide detailed
site and system knowledge for planning; arrange administrative and
logistical support; expedite data collection activities; and identify
the local points-of-contact who participate during data gathering and
validation. Inspectors are responsible for collecting data with an
objective, investigative mind-set. To achieve this, team members should
be flexible, professional, and objective.

## [[]{#__RefHeading___Toc510594665 .anchor}3.2 Planning Activities](#TOC11)

Planning a survey entails four distinct sets of activities: preplanning,
presurvey coordination, survey planning and final planning. Most of the
presurvey planning is performed by the Survey Team Leader.

### [[]{#__RefHeading___Toc510594666 .anchor}**3.2.1 Presurvey Planning**](#TOC11)

> Presurvey planning includes determining the survey scope and
> objectives. The Survey Team Leader **should** determine the survey
> approach, and in accordance with the policy, safeguards and security
> should be "\.... conducted in an integrated manner. If performed
> separately, the Surveying Office shall document the responsibility for
> each survey activity and coordinate submission of a single survey
> report that includes a composite facility rating." The Survey Team
> Leader develops an initial survey schedule and considers whether a
> presurvey visit is needed. Throughout the planning process, the Survey
> Team Leader is responsible for obtaining any necessary management
> approvals of decisions and actions.

### [[]{#__RefHeading___Toc510594667 .anchor}**3.2.2 Presurvey Coordination**](#TOC11)

> During presurvey coordination, the Survey Team Leader's
> responsibilities include:

-   Coordinating the proposed survey schedule with the facility and with
    other responsible parties.

-   Identifying appropriate points of contact at the facility.

-   Identifying information needed in the data collection.

-   Verifying the status of corrective actions from previous surveys.

-   Sending the notification letter.

> [Team Member Selection]{.underline} The Survey Team Leader selects
> team members based on several factors. These include the nature of the
> facility to be surveyed, the topical areas that will be addressed, the
> qualifications of candidates, their experience, and any potential
> conflicts of interest. When the team composition is finalized, the
> Topic Leads are designated.
>
> [Survey notification]{.underline} should be provided to the facility
> to be surveyed at least 30 days in advance. Although informal
> coordination with the surveyed facility may already have occurred, the
> facility should be advised of the survey by means of a formal
> notification letter. This letter should contain:

-   survey type and scope

-   survey date

-   proposed agenda

-   document call

-   logistical requests

-   identification of survey team leader

-   identification of topical team leaders and their topical areas

-   identification of other team members

-   request points of contact

-   presurvey questionnaire

-   presurvey tours or visits.

> [Document Call]{.underline} The notification letter includes a list of
> documents the survey team needs to review before they conduct the
> survey, as well as documents that need to be available during the
> survey. The requested documentation **should** depend on the topical
> or subtopical areas to be surveyed. These documents may include the
> following, as appropriate:

-   Site S&S Plans (SSSP)

-   Master S&S Agreement

-   Vulnerability Assessment (VAs)

-   performance test results

-   other site/facility safeguards and/or security plans

-   facility self-assessment documentation and reports

-   Operations Security (OPSEC) assessments

-   incident reports

-   deviations to established requirements

-   FDAR

-   FOCI files

-   SSIMS database information/facility registration

-   local plans (e.g., NMC&A, Cyber Security, OPSEC)

-   local orders and directives

-   policy manuals

-   procedures

-   contracts

-   Work For Others (WFO) documents.

> Reviewing key documents and selected records begins during the
> planning phase of the survey and continues throughout the survey
> process.
>
> The SSIMS database provides a compilation of information valuable to
> the survey planning activity. Security plans, especially the
> comprehensive SSSP, with its facility description, VAs, and other
> elements, are also good sources of information. Self-assessment
> results reported by the facility may give indications of activities
> occurring at the facility since the last survey.
>
> [Survey Questionnaire]{.underline} A pre-survey questionnaire may be
> used to collect information for conducting the survey. The
> questionnaire should request information needed to plan and conduct an
> in-depth survey including administrative and operational information
> to aid the team. The questionnaire should accompany the notification
> letter. It should be completed by the facility in accordance with the
> instructions provided and be available to the Surveying Office at
> least two weeks prior to the first day of the survey.
>
> [Facility Information]{.underline} The Survey Team Leader is
> responsible also for requesting facility information that **should**
> be reviewed to determine program compliance status. These documents
> include:

-   Operations Office survey reports

-   Office of Independent Oversight and Performance Assurance (OA)
    Inspection reports

-   Inspector General or General Accounting Office reports.

> The documents are reviewed to help determine how effectively the
> facility implements DOE requirements.
>
> [Team Meetings]{.underline}. Team leader will assemble personnel
> needed to complete survey procedures/plan and define protocols. Team
> meetings enable the Survey Team Leader and team members to discuss the
> survey scope, methodology, and planning for survey activities.
> Recommendations may be made regarding the facility in-briefing and any
> concerns or areas of special interest should be discussed. Facility
> files should be reviewed and any documents required for the survey
> should be identified. The topical and subtopical leads should be
> prepared to discuss the plan (including performance test plans, where
> applicable) for the survey of their respective subject area and to
> reach agreement on the plan with the Survey Team Leader.

### 

### [[]{#__RefHeading___Toc510594668 .anchor}**3.2.3 Survey Planning**](#TOC11)

> [Survey Plan]{.underline} While the preplanning and precoordination
> activities are under way, the Survey Team Leader **should** prepare a
> survey plan. The Survey Team Leader provides the preliminary plan and
> guidance to the topical area team members, but the team members are
> expected to make major planning contributions to complete the survey
> plan. Schedules, topical area assignments, data collection activities,
> logistical considerations, and resources all should be determined
> during initial scoping activities and documented in the survey plan.
>
> [Planning Considerations]{.underline} The Survey Team Leader should
> consider what needs to occur to conduct a survey that will indicate
> the degree of the facility's compliance with S&S requirements.
> Planning **should** include reviewing documentation, reviewing the
> presurvey questionnaire responses, conducting interviews, and
> physically reviewing facilities. To evaluate performance, inspectors
> will need to determine whether S&S systems meet the requirements;
> review vulnerability assessment data; validate procedures, plans and
> deviations; validate compensatory measures; and validate training\--
> both compliance and performance-based.
>
> Plans also **should** provide for data collection, reviews,
> interviews, tours, passive observations, and performance testing.
> Additionally, the plan should present a balanced approach to the
> survey and focus on the important interests, consider mitigating
> factors, place importance on performance over compliance, and provide
> a process for evaluating the overall status of the facility.
>
> The plan **should** state the purpose of the survey and should include
> the type of survey that will be conducted. The plan should also
> include the following components:

-   name and importance of the facility, to include S&S interests (e.g.,
    nuclear weapons and components, SNM, classified matter, classified
    information systems, and DOE property)

-   survey dates

-   survey scope (e.g., areas to be evaluated, number of team members)

-   objectives

-   approach and methodology

-   general facility information

-   team composition

-   schedule and expectations for survey report preparation

-   administrative and logistical requirements

-   references

-   appendices.

> The survey plan provides the basis for determining the scope and
> methodologies to be applied to the survey and should be documented
> formally and retained on file. The plan also is the basis for the
> information to be provided in the notification letter to the surveyed
> facility.
>
> [Final Planning Activities]{.underline} The final survey plan
> incorporates the team members' topic area plans. Sometimes changes
> occur, and the survey plan should be updated accordingly. The survey
> team needs to be kept aware of the most recent versions of the plan
> and work to those versions.
>
> The Survey Team Leader should prepare an in-briefing to be given to
> facility management and their designated points of contact at the
> initiation of the conduct of the survey. The in-briefing should
> include an agenda identifying discussion topics, the order of the
> discussions, presentations, and names of persons who will make the
> presentations.
>
> [Topic Survey Plans/Guides]{.underline} Topic leads, with support from
> team members, should develop draft survey plans and guides for their
> topical areas. Good plans/guides provide a systematic method for
> handling assignments and promote organizational effectiveness in
> attending to survey requirements. The goals and objectives identified
> in the survey plan are the specific targets that the survey team
> should achieve to complete a comprehensive survey. These target
> objectives provide the day-to-day direction for each topical area
> team.
>
> The survey plan objectives should be defined clearly in terms of both
> personnel and tasks. The more specific and realistic the objectives,
> the easier it is for survey team members to understand what should be
> accomplished and when it should be completed. The plan should provide
> for unforeseen events that may occur during the survey and those that
> may require schedule changes.
>
> The specific format for the survey plan is not critical. The plan
> should, however, contain enough information to describe what topical
> areas will be surveyed, why they will be surveyed, who is responsible
> for surveying each area, the schedule for the survey activities, and
> how the survey will be conducted. The schedule should include a record
> of events to take place, dates and times of events, and provisions for
> updating the schedule as required.
>
> To develop the plans and guides, the topical area teams will need to
> develop document review and interview lists, gather and analyze
> information, and identify areas and issues that need clarification.
> They should formulate a survey approach, including a topic area
> evaluation focusing on previous survey findings and the complexity of
> the S&S interests. The team also will need to consider data collection
> methods, special requirements such as conflicts with concurrent
> operations, and administrative issues like transportation or escorts.
> Any support required of the other survey teams also should be
> identified.
>
> [Performance Tests]{.underline} Developing performance tests, to
> include development of safety plans, takes a significant amount of
> time during the survey planning. The plans should include the
> objective of the test, a system description, the sampling technique
> that will be used, a scenario to describe how the test will be
> conducted, evaluation criteria, and a safety plan, if necessary.

# [[]{#__RefHeading___Toc510594669 .anchor}Section 4 Conducting the Survey](#TOC11) 

## [[]{#__RefHeading___Toc510594670 .anchor}4.1 Goal](#TOC11) 

> The goal is to conduct a survey that will evaluate performance and
> verify compliance using a methodology that will result in information
> to be analyzed in order to determine a proposed overall rating for the
> facility. The methodology typically includes document review, testing,
> observation, interviews, data collection, data analysis and
> validation.

## [[]{#__RefHeading___Toc510594671 .anchor}4.2 Facility In-Briefing](#TOC11)

A carefully prepared facility in-briefing will ensure a positive start
for the survey, creating a good first impression and providing an
opportunity to reduce any stress and tension associated with the survey.
All briefings should be documented and a roster of attendees should be
taken at each briefing.

> Items to be covered during the facility in-briefing include (but are
> not limited to)

-   general introductions of team members and facility points-of-contact

-   survey overview (schedule and topical areas to be surveyed)

-   survey approach (data collection methods)

-   facility/site briefing

-   daily survey status meetings (validations)

-   provisions for schedule changes or additional support

-   ground rules for the conduct of the survey

-   out-briefing schedule.

## [[]{#__RefHeading___Toc510594672 .anchor}4.3 Communications](#TOC11)

### [[]{#__RefHeading___Toc510594673 .anchor}**4.3.1 Internal Team Communication**](#TOC11)

> The Survey Team Leads or topic leaders should plan on daily, weekly
> and emergency meetings during the conduct of the survey. Teams should
> meet daily to review the progress of the survey, identify survey
> information related to each other's topical and subtopical areas, and
> identify any areas of concern. The Survey Team Leader should be
> informed of any significant items as they develop. The daily team
> meeting should include:

-   summaries of observations by Topic Leads

-   identification of significant issues and potential problems

-   discussions of compliance/non-compliance issues

-   performance test results

-   issues requiring policy interpretations

-   issues requiring security classification determination

-   topical/subtopical areas requiring expanded, in-depth review

-   survey progress toward schedule.

> Daily meetings can help the teams integrate information among topical
> and subtopical areas. This information integration is critical to
> accomplishing a comprehensive survey. Integration aligns the focus of
> the survey and enables the survey team to share expertise, thereby
> allowing one topic team to benefit from the efforts of another topic
> team. Integration of information also provides more timely
> confirmation of the strength or weakness of compensatory measures. For
> example, if a compensatory measure for the lack of an intrusion
> detection sensor is manpower-intensive, the survey team can use
> performance tests to evaluate the proficiency of the protection
> personnel providing the compensatory measure.
>
> Emergency meetings are self-explanatory and they will be held as the
> situation demands.

### [[]{#__RefHeading___Toc510594674 .anchor}**4.3.2 Interfacing with the Surveyed Organization**](#TOC11)

> Team members will need to interface with the surveyed organization on
> a regular basis. Members **should** review action items resulting from
> the planning meetings, ensure that logistical and support arrangements
> have been made and are acceptable, discuss new developments that occur
> during the overall survey, and work out schedule details. Members of
> the surveyed organizations also **should** be involved in meetings to
> validate the data collected by the survey team.

## [[]{#__RefHeading___Toc510594675 .anchor}4.4 Data Collection Considerations](#TOC11)

> All members of the survey team work to collect the data. Members of
> one survey topical area may collect data that supports other topical
> areas and should share the data with the appropriate topical area
> members. For example, data collected about physical security systems
> could also be useful to the nuclear material control topic, as they
> both relate to overall protection of the material.
>
> Prioritizing data collection activities allows schedule adjustments if
> complications or unforeseen events do not permit completion of all
> planned activities. If this occurs, the survey team can concentrate on
> gathering the data deemed most critical. High-priority data collection
> activities should be scheduled early in the survey process to ensure
> that they are accomplished.
>
> All working papers (or data collection records), notes, checklists,
> and other documentation accumulated during the survey should be
> retained as part of the permanent survey report file as backup
> documentation for the final report. Survey working papers may be used
> to support the validity of findings and as a source of information for
> future surveys. These papers also can be used for reviewing the survey
> process itself, by examination of checklists, plans, and other
> documentation of the survey.
>
> Survey team members should compile and annotate all working papers
> with the title of their respective subtopical area, author name, date,
> and name of facility being surveyed. Additional markings based on
> classification or directions from the Survey Team Leader **should**
> also be made. At the end of the survey, all working papers should be
> turned over to the Survey Team Leader for retention, generally at
> least until completion of the next survey at the facility. Each team
> member should keep accurate notes and copies of documentation
> supporting the results of survey activities.
>
> Team members should be aware of the potential classification of any
> information included in working papers, potential findings, or other
> documentation related to the survey. As necessary, the information
> should be protected and presented in a timely manner for
> classification review.
>
> Team members should ensure that their conduct complies with all
> information security requirements and that their notes and other
> materials are reviewed, marked, and protected as appropriate to the
> sensitivity or classification of the information they contain.

## [[]{#__RefHeading___Toc510594676 .anchor}4.5 Types of Data Collection](#TOC11) 

> The data collection methods and techniques that are chosen, and the
> skill with which they are used, will determine the quality and
> quantity of the information collected. Standard data collection
> methodologies include document reviews, personnel interviews, direct
> observation of operations, and performance and knowledge-based
> testing.
>
> Each method has an associated purpose and cost (both to the survey
> team and the facility). It is important to know when and where to use
> each method. For example, running an expensive force-on-force
> performance test would not be cost-effective if the data were
> available through an interview or observation.

### 

> It is not physically possible for survey teams to review every
> document, observe every individual perform S&S tasks, or account for
> each security interest in inventory. Teams may use sampling
> methodologies to ensure that data collection sample sizes and
> configurations are adequate to accomplish the survey objectives. A
> variety of statistically valid sampling techniques is available,
> although statistical significance is not necessarily required to meet
> the demands of many survey topical or subtopical areas. The use of
> statistically valid methods for gathering and interpreting information
> frequently can strengthen the confidence in the survey results
> obtained.
>
> Properly used, statistical sampling allows conclusions to be made
> accurately and cost-effectively. The tested sample sizes should be
> large enough to provide a reasonable indication of the entire
> population under review. The best way to ensure this is to use
> statistically valid random selection techniques to draw the sample
> from the entire population under review whenever possible. A randomly
> selected sample provides a high level of confidence to project results
> in a valid and meaningful way for DOE reporting.

### 

### [[]{#__RefHeading___Toc510594677 .anchor}**4.5.1 Document Reviews**](#TOC11)

To develop a basic understanding of the program elements at the
facility, the topic team usually begins by reviewing all available
documents pertaining to the program and topic to be inspected. Documents
reviewed include those obtained from Headquarters program offices and
the Office of Security and Emergency Operations, as well as those
requested from the DOE field element and facility to be inspected. The
objective of the document review is to understand the nature of the
facility to be inspected, the unique characteristics of the topic and
subtopics, and the environment in which they operate. Documents are
reviewed to determine how effectively they implement DOE requirements.
They also provide a basis for evaluating performance. In addition to
determining how requirements are being met, compensatory measures are
identified during this review and analyzed to determine if they are
valid and current. The effectiveness of these measures may be determined
by subsequent performance testing. Documents usually are reviewed during
the planning phase and during the conduct of the survey.

> The results of previous surveys, including the facility description,
> security interests surveyed, and the findings and suggestions, may
> provide information of value to the current survey. The corrective
> action plans and resolution of the previous findings also may be
> indicative of the quality of the program and the level of management
> support the program receives.
>
> All previous findings, regardless of their status (open or closed),
> should be reviewed during the planning phase. These findings, although
> corrected and closed, may indicate areas where the facility
> historically has had problems with compliance and/or performance.
> Although the findings of the last survey will be of primary interest,
> findings of previous surveys or of other inspections may also be of
> value.
>
> Quarterly reporting on unresolved findings of previous survey
> activities should be reviewed. The state of the S&S program at the
> time of the current survey may be used to validate the status of
> previous findings. Findings of the current survey that correlate with
> findings of the previous survey should be identified as repeat
> findings, regardless of their status (open or closed) prior to current
> survey.

Concerns about open or repeat findings or the inability to establish and
implement effective corrective action plans should be discussed with
those team members surveying the Program Management topical area for
potential impacts on their survey activities and scope/focus. Repeat
findings may indicate problems in the management of the S&S program or
element(s) thereof, such as the failure to effectively identify and
correct systemic, root causes of identified deficiencies.

### [[]{#__RefHeading___Toc510594678 .anchor}**4.5.2 Observations and Tours**](#TOC11) 

> Observing routine work, processes, and systems may reveal
> inappropriate practices. Such practices should be investigated through
> interviews and/or reviews of procedures, training, or other relevant
> materials. Often observations are necessary to confirm or disprove
> that procedures are being implemented as described. If a procedure is
> specified for a particular task, observers look for its use/non-use as
> well as consistency in application. Observations may be made also to
> validate data collected through document review and/or interviews.
> Inspectors should spend as much time as practical in the field
> observing actual operations. Inspectors should make notes of what they
> observe.
>
> The survey team should try to minimize impact on the facility. For
> example, procedures such as SNM transfers, security alarm preventive
> maintenance checks, or portal monitor checks should be observed when
> they are scheduled by the facility rather than by requesting a special
> demonstration. However, if an operation such as taking nuclear
> material inventory is not scheduled during the survey and the
> observance of the operation is critical to evaluating system
> operations, then initiating an inventory through a performance test
> may be appropriate.
>
> Tours are especially valuable for inspectors who have never been to
> the facility being surveyed, or to observe specific operations or
> procedures and to gather data for later performance tests. Tours
> familiarize the survey team with the site and facility layout.
> Familiarity with the survey site is particularly important for
> physical security, protective force (PF), and nuclear material control
> and accountability topics.

### 

### [[]{#__RefHeading___Toc510594679 .anchor}**4.5.3 Interviews**](#TOC11) 

> The purpose of conducting interviews is to gather information, to
> understand how policies and procedures are implemented, and to clarify
> impressions of the contents of documents. Interviews may be conducted
> at any time during the survey process to clarify documents/records or
> observed performance and conditions.
>
> Personnel with knowledge of, or responsibility for, program elements
> should be interviewed. Such interviews help to establish that staff
> have essential skills and knowledge. Information from these interviews
> also helps to locate documentation or other elements of information
> essential to the survey.
>
> Notes should be taken throughout the interview process to ensure that
> the interview is documented accurately. It is recommended that the
> inspector prepare a summary of the interview results organized around
> the objectives. Either the interviewer or a partner may take the
> notes.
>
> Information gathering can be informal. Discussions frequently take
> place during tours, while reviewing documents, or during performance
> tests. Individuals conducting the survey should take advantage of
> opportunities to ask questions of appropriate personnel. Discussions
> with personnel at all levels are recommended. Frequently, discussions
> with personnel involved with hands-on operations indicate whether the
> policies and directives of management are effectively communicated and
> implemented.
>
> Successful interviewing requires experience and skill. The following
> are some important points to consider when conducting an interview:

-   Courtesy and a nonadversarial approach will help facilitate the
    interview. A pushy or superior attitude will generally elicit a
    negative response. The same is true when the inspector appears
    interested only in finding deficiencies rather than also identifying
    strengths.

-   Explain the purpose of the interview and the importance of the
    individual\'s assistance.

-   Make an effort to establish rapport before attempting to ask
    questions.

-   Be an active listener. Provide reinforcement by repeating key points
    and acknowledging that what is being communicated is understood.

-   Maintain a neutral position. Avoid agreeing or disagreeing.

-   Use open-ended questions as much as possible and encourage
    elaboration. If a statement or response is unclear, ask the
    interviewee to expand on the subject to avoid misunderstanding.

-   Restate facts gathered from other sources. For example, if
    documentation shows that annual security refresher training was not
    held, the interviewer should state this as a fact for the
    interviewee to confirm.

> [Interview Questions.]{.underline} The types of questions asked during
> an interview influence the climate of the interview and can affect the
> amount and quality of information received. Four basic types of
> questions that are often used are open-ended, closed-ended, probing,
> and leading (or loaded).
>
> Open-ended questions ask for general information and allow the
> interviewee to structure the response. Use open-ended questions for
> starting each area of inquiry. An example of an open-ended question is
> "What are your responsibilities for documenting training?"
>
> Closed-ended questions are designed to limit the response available to
> the interviewee. Usually a closed-ended question can be answered with
> a word or phrase. The disadvantage of closed-ended questions is that
> they limit the amount of information given. Use closed-ended questions
> only when seeking a specific item of information. Generally, do not
> ask more than three closed-ended questions in succession. For example,
> "Do you know all the regulatory requirements for training
> certification? Was the report sent on time?"
>
> Probing questions are used to clarify information or gain additional
> information, usually based on a response to an open-ended question.
> Probing questions are always based on the information given by the
> interviewee. They are useful because they focus the response on the
> information you need to know. They can be used to clarify apparent
> inconsistencies or discrepancies; for example, "Could you give me an
> example of what you mean by bad instructions? What happened after the
> report was submitted?"

Leading questions that beg the answer usually are intended to get the
respondent to agree with a position already held by the interviewer. For
example, "Do you agree that the proposed management system is a good
one? Can you explain why you approved it? Asking leading questions is
seldom if ever useful and should be avoided in an interview situation.
People often become defensive, causing the interview climate to become
uncooperative.

> Summarizing is another good technique and should be used by the
> inspector at the end of the discussion of each area of inquiry and at
> the end of the interview. Summarizing covers all the key points
> covered related to an area of inquiry or to the entire interview. For
> example \"Let\'s go over what we have about training certification
> records.\"

### [[]{#__RefHeading___Toc510594680 .anchor}**4.5.4 Performance Tests**](#TOC11) 

> Performance tests are typically onsite exercises of the personnel,
> equipment, and/or procedures of selected portions of S&S systems to
> determine system effectiveness. Tests will not necessarily reflect the
> overall state of security at a facility because a single performance
> tests is one data point and therefore not statistically significant in
> and of itself. Test data should be placed in context with other
> findings, observations, and conclusions. Each performance test is
> designed to exercise and evaluate some portion of the system or
> program. The purposes of performance tests include determining
> whether:

-   Personnel know and follow procedures.

-   Procedures are effective.

-   Plans and procedures accurately describe operations conduct.

-   Personnel know how to operate equipment.

-   Personnel and equipment interact effectively.

-   Equipment is functional and operational.

-   Equipment has adequate sensitivity.

-   Equipment meets design objectives.

> If the facility has a program for conducting performance tests, the
> survey team may consider requesting the facility to conduct one of its
> performance tests rather than, or in addition to, one the team
> designs. Observing the facility conduct a performance test validates
> the facility\'s own assessment program and simplifies survey planning
> with regard to identifying trusted agents and the development of
> safety plans.
>
> Performance tests usually are coordinated with appropriate personnel
> at the facility. Some performance tests require that the personnel
> being tested are unaware that a test is being conducted. These types
> of tests require special care to ensure they are coordinated and
> conducted safely. At a minimum, inclusion of these types of tests
> during a survey should be covered at the survey in-briefing. The
> facility can be briefed that tests will be conducted and informed that
> there may be \"no-notice\" tests. Appropriate personnel then can be
> informed that equipment or procedural performance tests will be
> conducted without compromising the validity of the test.
>
> Performance testing may include no-notice exercises, limited scope
> performance tests (LSPT), force-on-force exercises, emergency
> management performance tests, and alarm response and assessment tests.
> Additional protective force performance test information may be found
> in DOE M 473.2-2.
>
> [No-Notice Exercises.]{.underline} No-notice exercises are useful when
> examining a specific element. Consider the following scenario:
>
> The facility has a procedure written describing how a Security Police
> Officer (SPO) is supposed to verify a sample transfer. During an
> interview, the SPO could not recall this procedure. Observations were
> made of several SPOs performing this procedure (all of them performed
> what was on the checklist, but each SPO performed the procedure
> somewhat differently). The team decided to return to this one
> component without giving any notice to the SPOs being tested. The same
> checklist was used for the no-notice exercise as was used for the
> observation. The objective of the survey team was to ensure that this
> procedure was actually carried out when the SPOs were unaware that
> they were being observed.
>
> [Limited Scope Performance Tests.]{.underline} Surveys and
> self-assessments are typically conducted with limited time and
> resources, making it difficult to comprehensively test all aspects of
> a program or program element. This is especially true for large
> protection elements or where the use of large numbers of personnel
> would be required. By limiting the focus or scope of the evaluation to
> smaller aspects of the overall program element or testing the skills
> and/or knowledge of a small sample of the personnel responsible for
> the element, a reasonably clear idea of the health of the entire
> program can be determined without requiring large amounts of time and
> resources.
>
> An LSPT is a test of an individual or group of individuals that is
> conducted to assess the effectiveness of certain specific aspects of
> the surveyed facility\'s policies, procedures, or training
> requirements. To be effective and to provide indication of the overall
> program effectiveness, LSPTs should be defined clearly and planned in
> advance of the survey activity. The basis, scope, and method for each
> LSPT should be documented and established in the survey plan. All LSPT
> plans should be approved by the Survey Team Leader. Other approvals
> also may be required, especially if safety concerns are involved.
>
> LSPTs are not individually rated; they should be used by the survey
> team as one factor in assigning survey ratings. They are an indicator
> of program effectiveness. When LSPTs are used, they should be defined
> in the survey report, and their impact on a rating or ratings should
> be carefully noted.
>
> LSPTs may not test the overall effectiveness of a system but they can
> identify vulnerabilities within the "defense-in-depth" security
> envelope. The LSPT allows assessment of individual components or
> skills in a security system, and it can be repeated against the same
> component or skill as many times as necessary to develop statistically
> valid data as a basis for determining the effectiveness of the
> component or skill. Consistently high performance results for
> individual elements of the security envelope can be used to infer that
> the overall protection level is at a level which is at least as high,
> if the elements tested are related. For these reasons, the relative
> emphasis on, and scope of, LSPTs have increased.
>
> [Force-on-Force Exercises.]{.underline} A force-on-force is a major
> test of the overall effectiveness of all elements involved in response
> to a design basis threat and site-specific threats. However,
> force-on-force exercises are costly and should be conducted only with
> management approval and in accordance with approved safety plans. For
> example, imagine that the survey team discovers a possibility that
> procedures are not being followed for alarm response at the Protected
> Area (PA) and the Material Access Area (MAA). A scenario is developed
> using the VA as a guide, to determine whether proper alarm response
> occurs if an adversary team crosses the PA and the MAA.
>
> [Alarm Response and Assessment Tests.]{.underline} An alarm response
> and assessment test would be conducted to determine whether or not
> protective force personnel respond to intrusion detection system
> alarms that are annunciated at the central and secondary alarm
> stations within prescribed times and in accordance with the facility's
> documented procedures.
>
> Performance tests should be documented in the survey report. The
> reported results should be supported by the notes and working papers
> associated with the collected data from each test. In addition to key
> information from the test plan, other documentation related to what
> was tested, how it was tested, and why should be retained with the
> working papers for the survey.
>
> [Planning and Reporting Performance Tests.]{.underline} Performance
> tests should generally be fully defined in a performance test plan. A
> performance test plan typically contains the following sections:

-   [Test objective]{.underline}. Identifies what is to be tested and
    what the test is designed to accomplish.

-   [Scenario description(s)]{.underline}. Describes elements or system
    being evaluated by the test. The scenarios may be restricted to
    specific, limited aspects of the safeguards and security system,
    e.g., weapons detection at a protected area entry point, or many
    elements of a total system, e.g., a Force-on-Force exercise.

-   [Test methodology and evaluation criteria]{.underline}. This section
    describes how the test will be conducted. It should list steps
    involved in planning and execution. This section should also include
    a description of any statistical models or mathematical formulas
    used to determine probabilities or confidence levels, and pass/fail
    criteria. It should include models, equations or methods to be used
    for data analysis.

-   [Test controls]{.underline}. This section describes controls imposed
    to ensure the integrity of the test, such as safety plans, special
    security activities, etc., such as:

    -   Use of trusted agents

    -   Providing notice or no/notice of upcoming test

    -   Procedural modifications

    -   Other equipment controls, etc.

-   [Resource requirements]{.underline}. This section includes a
    description of resources that are needed to conduct the test, such
    as facilities, personnel and equipment.

-   [Test coordination requirements]{.underline}. This section describes
    how and when coordination is required with other operational
    elements - such as **safety**, quality assurance, security,
    safeguards, facility operations, etc. EMPHASIZE SAFETY!!!!

```{=html}
<!-- -->
```
-   [Operational impact(s) of testing program]{.underline}. Describes
    any impacts of conducting the test, such as overtime costs,
    decreased facility production rates, etc.

-   [Compensatory measures (if necessary)]{.underline}. Describes
    measures to be taken to compensate for any degradation of security
    posture which might occur while conducting the test. Also identifies
    measures which might need to be implemented in the event of test
    failures or other contingencies.

-   [Coordination and approval process]{.underline}. Discusses the
    approval process for test records including, witness sign-off, dates
    of data collection, and use of compensatory measures.

-   [References]{.underline}. Lists applicable DOE orders/manuals,
    SSSPs, and other DOE Policy documents containing requirements for
    the element or system being tested. Also lists all reference
    materials used in analysis or calculations used.

> Performance tests will be reported in the survey report. The reported
> results should be supported by the notes and working papers associated
> with the collected data from each test. In addition to key information
> from the test plan, the following elements might be included:

-   [Description of the Test]{.underline}. What were the conditions
    under which the test was performed. Who participated, by number and
    job titles/descriptions.

-   [Synopsis of Test Data]{.underline}. What was observed during the
    test. Include both positives and negatives, as well as data that
    show performance against minimum requirements.

-   [Test Results]{.underline}. A statement of success or failure
    according to evaluation criteria provided in the test plan should be
    included. Any unusual observations related to the area tested should
    also be discussed.

-   [Corrective Actions]{.underline}. Corrective actions recommended for
    safeguards and security measures failing to meet requirements should
    be listed and discussed. The persons, organizations, or groups
    responsible for the corrective actions should be identified. Both
    immediate and longer range solutions will be discussed.

-   [References]{.underline}. The test plan and other pertinent
    materials may be provided as an attachment to the survey report.

> Test plans and other documentation related to what was tested, how it
> was tested and why, should be retained with the working papers for the
> survey.

## 

## [4.6 Data Validation](#TOC11)

Validation activities provide assurance that facility points-of-contact
concur with the observations of the survey team. The survey team
informally validates collected data continually during the survey. In
addition to on-the-spot validation, the team members may conduct a more
comprehensive validation of data collected with the locally assigned
point-of-contact and that person's first-level supervisor, but without
discussing ratings. Findings should be clearly written and supporting
information documented (e.g., DOE orders, site requirements, site
procedures) prior to formal validation.

> A summary validation meeting should be conducted, either at the end of
> data collection activities or on a weekly basis for a survey covering
> a multiweek period. The Survey Team Leader should focus the summary
> validation at the working-group level and should include a recap of
> the highlights of daily validation activities. It is important that
> the Survey Team Leader document the summary validation through meeting
> notes and attendance roster(s) to reduce the potential for post-survey
> claims that salient data points were not adequately discussed with,
> and validated by, facility personnel.
>
> The Survey Team Leader should meet with facility management daily to
> summarize survey data collection to include findings and identify
> schedule/resource problems. Once the survey is under way, briefings
> should be drawn from the survey team working papers and briefing
> notes. The Survey Team Leader should pay special attention to areas
> that indicate policy issues or require additional, specific details to
> fully understand the facility\'s position in interpreting guidance.

## [[]{#__RefHeading___Toc510594682 .anchor}4.7 Data Analysis](#TOC11)

> After the data are collected, they should be compiled and analyzed to
> report the results and determine ratings. The Survey Team Lead and
> Topic Leads should select the analysis method to be used for the
> survey data. Data analysis helps the team determine the cause of a
> finding. Generally, there are three kinds of causes\--contributing,
> direct, and root. Understanding what is causing a problem with
> compliance or performance is essential for taking corrective action.
>
> Root cause analysis can be used to determine whether the problem is
> localized or systemic. Localized problems may be characterized by the
> failure of a single point or lack of a pattern of non-compliance or
> insufficient performance. The survey team needs to avoid focusing on
> symptomatic or surface problems and identify the core or root cause(s)
> of the problem. A pattern of noncompliance may indicate a systemic
> problem that needs to be analyzed to determine the root cause.
> Detailed information on how to perform a formal analysis may be found
> in *Root Cause Analysis Guidance Document* (DOE NE-STD-1004-92).
> Normally the survey team may not have time to conduct a formal root
> cause analysis. However, root cause should always be considered when
> identifying issues.
>
> Root cause analysis of findings may be performed to determine whether
> deficiencies in other areas have contributed to a finding. For
> example, a preliminary finding that classified documents were not
> marked properly may, when analyzed, result in a determination that
> adequate procedures were not developed, that they were not issued to
> those responsible for marking documents, or that these people were not
> trained adequately on the procedures. These determinations may then
> result in findings in Program Management, Security Education, or other
> topical or subtopical areas.
>
> The surveyed facility should use root cause analysis to develop
> corrective actions for deficiencies and to ensure that systemic
> problems are corrected as well as the deficiencies that resulted in a
> reported finding. LROs and Surveying Offices also may apply root cause
> analysis
>
> methods in the review and approval of corrective action plans
> submitted by surveyed facilities, as well as in the validation of the
> corrective actions identified as completed by these facilities.

## [[]{#__RefHeading___Toc510594683 .anchor}4.8 Documenting and Determining Findings](#TOC11)

> The survey teams' field notes are essential for documenting the basis
> for findings. The notes should include applicable DOE directives, a
> brief narrative of the problem or situation, and names of people with
> whom the inspector discussed the problem or situation.
>
> Team members should be aware of the potential classification of any
> information included in working papers, potential findings, or other
> documentation related to the survey. When appropriate, the information
> should be protected and presented in a timely manner for
> classification review.
>
> All preliminary findings discovered by the survey team are discussed
> with the Survey Team Leader, and Topic Leads validate each finding
> with their respective facility points-of-contact. Survey team members
> may complete a data collection form that describes the finding and
> includes the following information:

-   aspects of the S&S program that do not comply with DOE policy;

-   brief description of the specific problem and a reference to the
    appropriate section of the DOE directive for the conditions
    encountered;

-   indication of whether the deficiency is localized or systemic;

-   perceived impact to the protection program;

-   unique finding number;

-   classification level and category (if RD or FRD), to include
    unclassified.

When the team is determining the impacts of findings, the following
should be considered:

-   *Low impact* indicates that nonconformance probably would not result
    in loss or compromise of SNM and/or classified matter.

-   *Moderate impact* indicates that nonconformance could result in loss
    or compromise.

-   *High impact* indicates that nonconformance would result in loss or
    compromise.

After the finding has been validated with the responsible facility
personnel, the data collection form is completed and transmitted to the
Survey Team Leader. If possible, the findings should be synthesized or
"rolled up" to provide a more focused picture of the deficiencies.

## [[]{#__RefHeading___Toc510594684 .anchor}4.9 Ratings](#TOC11)

### [[]{#__RefHeading___Toc510594685 .anchor}**4.9.1 Overview of the Rating Process**](#TOC11)

> Both the findings and their impacts on the protection of S&S interests
> should be considered in determining the ratings for the survey. The
> Survey Team Leader and survey teams should
>
> evaluate how the findings affect the S&S program at the surveyed
> facility and whether adequate compensatory measures have been taken to
> provide appropriate protection or assurance of protection. Consider
> the following:

-   Have VAs been conducted as the basis for the alternative measures?

-   Have deviations been formally submitted and approved?

-   Are there significant impacts affecting program needs or assurances?

-   Are these impacts only partially affecting program needs or
    assurances?

-   Are there no impacts?

> After analyzing the impact of the findings, the Survey Team Leader
> determines a proposed rating and, along with the survey team, the
> intended defense for the rating. It is helpful to have a board,
> comprised of management or other subject matter experts, review the
> ratings to ensure quality control requirements have been addressed.
> The finding should be well written and clearly and accurately reflect
> the deficiency.
>
> After the Survey Team Leader completed the proposed ratings, the
> facility points-of-contact are notified and summaries of findings are
> presented in a working closeout meeting. These may be held in topical
> area meetings or collectively. In addition to discussing the findings
> and proposed ratings, the closeout meeting is used for resolving
> questions and for receiving corrective action plans for findings
> pending closure of the findings. The plans for verifying corrective
> actions also are discussed during the closeout meeting.

Finally, a management closeout meeting is held. This is attended by
top-level managers at the facility, the Survey Team Leader, and usually
the Topic Leads. The Survey Team Leader leads this meeting, and the
managers are provided with a final composite rating for the facility,
topical area ratings, and subtopical area ratings.

### [[]{#__RefHeading___Toc510594686 .anchor}**4.9.2 Assigning Ratings**](#TOC11)

> Upon completion of all survey activities related to each topical and
> subtopical area, the team members for each of these areas **should**
> determine a recommended rating for each subtopical area. The Topic
> Leads meet with their associated team members to review the findings
> in each subtopical area. The findings for the subtopical areas and
> other considerations should be used to determine an overall rating for
> each topical area.
>
> Rating determinations should be made based upon logical, defensible,
> and validated conclusions that support each topical and subtopical
> rating and impact on the protection objectives of the program. Each
> rating is debated and discussed, and the specific reasons for the
> rating are justified. The Survey Team Leader is responsible for
> assigning the preliminary rating(s). There is no set formula for
> assigning overall ratings for the topical areas; however, the process
> used by the Survey Team Leader should be well documented and able to
> withstand scrutiny by other managers and subject matter experts.
>
> The Survey Team Leader determines the composite facility rating, based
> upon the ratings for each topic area, and compares the current rating
> with the previous survey rating to ensure that successive Marginal
> ratings are not assigned unless specific conditions are met. The basis
> for the rating determinations should be documented for potential
> future use in justifying the assigned ratings.

It is possible that a finding could be applied to more than one topical
area and subsequently impact the rating for both areas. The survey team
should evaluate these dual-topic findings closely to determine the
appropriate ratings. When determining these ratings, the survey team
should consider:

-   adequacy of program implementation the facility being surveyed;

-   attractiveness of identified targets;

-   range of threats and adversaries;

-   approved deviations;

-   alternative approaches to provide adequate security;

-   provisions of approved Master Safeguards and Security Agreements,
    S&S plans, and NMC&A procedures;

-   results of VAs.

> "The composite facility rating shall be based on the effectiveness and
> adequacy of the Safeguards and Security at a facility and reflect a
> balance of performance and compliance as determined by the Surveying
> Office. Ratings are not assigned for termination surveys."

### [[]{#__RefHeading___Toc510594687 .anchor}**4.9.3 Types of Ratings**](#TOC11)

> There are three types of ratings for results of S&S facility surveys.
> They are:

1.  "[Satisfactory]{.underline}. The Safeguards and Security element
    being evaluated meets protection objectives or provides plausible
    assurance that protection needs are being met.

2.  [Marginal]{.underline}. The Safeguards and Security element being
    evaluated only partially meets protection objectives or provides
    questionable assurance that protection needs are being met.

3.  [Unsatisfactory]{.underline}. The Safeguards and Security element
    being evaluated does not meet protection objectives or does not
    provide adequate assurance that protection needs are being met."

> Protection objectives or needs are defined by DOE orders and as
> modified by approved SSSPs, facility S&S plans, approved upgrades, and
> documented and approved deviations to DOE requirements. These
> modifiers specify site-specific considerations and tailor the local
> S&S program to meet the local mission operating environment.

### 

### [[]{#__RefHeading___Toc510594688 .anchor}**4.9.4 Basis for Ratings**](#TOC11)

> The following are some basis for ratings:

1.  **"**Ratings are based on conditions existing at the end of survey
    activities. Ratings shall not be based upon future or planned
    corrective actions.

2.  If corrective actions are taken before assignment of the survey
    rating at closeout, the final rating shall reflect validated
    corrective actions only.

3.  Marginal or Unsatisfactory ratings in any topical area shall be
    based on validated weaknesses in the Safeguard and Security system
    or deficiencies in performance in an operational area. Failure to
    comply with procedural documentation requirements, of and by itself,
    shall not normally be the basis for a reduction in a rating."

### [[]{#__RefHeading___Toc510594689 .anchor}**4.9.5 Rationale for Ratings**](#TOC11)

> [Satisfactory Rating]{.underline} A topic or subtopic will usually be
> rated Satisfactory if all applicable compliance and performance
> measures are met and implementation is suitable for the mission
> operating environment. A topic or subtopic would also be rated
> Satisfactory if, for any measure not met, effective compensatory
> measures were in place to provide comparable protection. In some
> instances, a topic or subtopic should be rated Satisfactory when it
> fails to meet an applicable measure but, in the judgment of the topic
> area expert and the Survey Team Leader, the impact of that shortfall
> does not erode the effectiveness of the S&S system being surveyed. A
> small number of isolated deficiencies, not significantly impacting the
> S&S element, would not necessarily result in a Marginal rating if
> there is no evidence of systemic problems.
>
> A Satisfactory rating generally is assigned if the following
> conditions have been documented:

-   No findings exist.

-   Deficiencies present minor impact in system effectiveness.

-   Category I or II quantities of SNM are protected adequately against
    theft.

-   SNM and vital equipment are protected adequately against
    radiological or industrial sabotage.

-   Category III and IV quantities of SNM are protected in compliance
    with DOE orders and approved site plans.

-   Classified documents, parts, and material are protected in
    accordance with DOE orders and approved site plans.

-   Physical security systems provide adequate defense in depth.

-   Required S&S program documentation is current and properly approved.

-   The Protective Force program provides assurance that SNM is
    protected from theft and provides assurance that information assets
    are adequately protected.

-   Effective S&S programs have been established, implemented, and
    supported by management as required.

-   Coordination and communication is effective between/among the
    various appropriate organizations.

-   Corrective actions addressing the root causes of deficiencies are
    identified and implemented in a timely and comprehensive manner.

-   Corrective actions are monitored routinely by facility management,
    and coordination with the appropriate organizations is effective.

-   Training programs are adequate and comprehensive.

-   Effectiveness and cost-benefit ratio of upgrades to address
    identified deficiencies are validated before findings are closed.

-   The appropriate survey or self-assessment program, itself, is
    effective.

> [Marginal Rating]{.underline}. Noncompliance with one or more
> compliance measure may result in a preliminary rating of Marginal or
> Unsatisfactory for a survey subtopic area. Assignment of one or more
> subtopic ratings of Marginal or Unsatisfactory may, in turn, result in
> a topic composite rating of Marginal or Unsatisfactory. The survey
> team should carefully analyze the seriousness and multiplicity of
> findings in a subtopical area against the definitions for Marginal or
> Unsatisfactory before assigning these ratings.
>
> Marginal ratings are assigned if the program is not meeting required
> protection objectives and SNM, vital equipment, and classified
> information may be at risk. Compensatory measures have either not been
> implemented or are not effective, and the impact of that shortfall
> degrades the effectiveness of the system being surveyed.
>
> A Marginal rating may be assigned if the following conditions are
> found:

-   The topic or subtopic only partially meets identified protection
    needs.

-   Assurance that protection needs are being met is questionable.

-   One or more compliance measures are not being met and are only
    partially compensated for by other measures or systems, resulting in
    the degradation of the protection system.

-   Serious deficiencies are identified in one or more survey subtopics.

-   Significant deficiencies are identified in multiple survey topics or
    in the facility\'s self-assessment program.

-   A systemic pattern of deficiencies is identified across survey
    topics.

-   There is a systemic pattern of incomplete, out-of-date, or
    unapproved program documentation.

> "A facility composite rating or topical area rating shall not be
> Marginal for consecutive survey periods unless one of the following
> conditions apply.

1.  The previous survey that resulted in a Marginal rating identified
    different deficiencies and reasons for the rating.

2.  The deficiencies and reasons that were the basis for the previous
    Marginal rating were related to the completion of a major line-item
    construction project or upgrade program. In that case acceptable
    interim measures should have been implemented and physically
    validated pending completion of the project. These interim measures
    and milestones for construction completion shall be documented in
    the survey report.

3.  If neither of the above conditions apply, an Unsatisfactory rating
    shall be assigned."

> [Unsatisfactory Rating.]{.underline} A topic or subtopic should be
> rated Unsatisfactory if applicable compliance or performance measures
> are not being met, compensatory measures are nonexistent or seriously
> inadequate, and resultant shortfalls seriously detract from the
> effectiveness of the S&S program being surveyed.

An Unsatisfactory rating may be assigned if the survey results in the
following:

-   The topic or subtopic does not provide adequate assurance that the
    identified protection needs are met.

-   One or more compliance measures are not being met and no
    compensatory measures or other systems are in place to mitigate
    degradation of the protection system.

-   Category I SNM is vulnerable to theft in terms of the design basis
    threat.

-   A radiological or industrial sabotage target is not protected or is
    vulnerable to sabotage in terms of the design basis threat.

-   Classified information is vulnerable to unauthorized disclosure,
    loss or compromise.

-   There exists systemic failure to protect Category II, III, or IV SNM
    or classified information in accordance with DOE orders.

-   Severe and widespread deficiencies exist in the topical or
    subtopical areas.

-   There exists systemic failure to develop and maintain required
    formal planning documents or to resolve deficiencies identified by
    other responsible DOE offices.

-   There exists systemic failure to effectively communicate and
    coordinate activities resulting in a demonstrated adverse impact on
    protective effectiveness.

> [[]{#__RefHeading___Toc510594690 .anchor}**4.10
> Out-Briefing**](#TOC11)
>
> Once all findings have been analyzed and ratings assigned, a final
> out-briefing should be conducted with the surveyed organization. At a
> minimum, the briefing should present each finding, the topical area
> ratings and the overall composite rating, the corrective action
> reporting requirements, and the draft schedule for the survey report.
> The Survey Team Leader should have a prepared agenda for the
> out-briefing. The agenda should identify personnel making reports or
> presentations. Because of the potential for confrontation during the
> out-briefing, it is generally best for the Survey Team Leader to
> provide the briefing and, if necessary, to ask the Topical Lead to
> assist with technical details.
>
> Agreements and commitments made during the conduct of the survey and
> during the out-briefing should be summarized at the conclusion of the
> out-briefing. This provides an opportunity to identify potential
> misconceptions before they are presented formally to management
> outside the surveyed facility. Agreements and commitments should be
> documented in writing as soon as possible.
>
> The out-briefing may be approached as an opportunity to "sell" the
> results of the survey. A positive, professional attitude helps to
> defuse a potentially hostile audience. Noteworthy items observed,
> including positive attributes of the program, by the team should be
> discussed during the briefing as well as findings and ratings. Even
> though issues that are in dispute or question are addressed during the
> working close-out meetings, the out-briefing is a formal opportunity
> to present the results of the survey and to identify any aspects that
> may continue to remain in dispute or question. At the end of the
> presentation, the Survey Team Leader should thank the facility staff
> for their cooperation and support.

# [[]{#__RefHeading___Toc510594691 .anchor}Section 5 Post-Survey Activities](#TOC11)

Post-survey activities ensure that the survey results in meaningful
efforts to correct deficiencies. The activities include post-survey team
meetings, survey report preparation, and resolution of any disputed
findings. The primary post-survey activities are the preparation of the
formal, written report documenting the survey.

As soon as possible after the survey is completed, a formal report of
the results should be compiled. The individual team members and topic
and subtopic leads **should** ensure complete, concise, and accurate
reporting of the results is accomplished in a timely manner. The report
preparation should be overseen by the Survey Team Leader who has
ultimate responsibility for its completion and accuracy.

Reports should be evaluated and reviewed by an Authorized Classifier in
a timely manner. Appropriate protection and control should be provided
classified or sensitive information. Each finding should be marked with
its classification to protect the information properly.

A review board, consisting of knowledgeable management from the
Surveying Office, should conduct an internal review of each survey
report to ensure that the findings and ratings are fair and adequately
supported. The board should review the survey report to ensure it is
clear, comprehensive, and in compliance with the survey requirements of
DOE O 470.1. The review board should discuss any concerns with the
Survey Team Leader and team members responsible for each respective
topical or subtopical area. The review board has the authority to reject
findings that may not be adequately supported and may exercise editorial
control over the final document.

After report preparation and distribution have been completed, the
Survey Team Leader should document and file lessons learned. These
lesson should identify what survey processes were effective,
observations of team dynamics, and specific recommendations for the next
survey. The Survey Team Leader should document similar lessons learned
as reported by Topic Leads and their teams.

## [[]{#__RefHeading___Toc510594692 .anchor}5.1 Report Preparation Meetings](#TOC11)

Post-survey team meetings are held to facilitate the preparation of the
survey report, review lessons learned from the survey, and plan for the
next survey. Agenda items for these meetings typically include the
following activities:

-   Review draft report or report section(s).

-   Plan for the next survey.

-   Review lessons learned.

-   Identify trends that might indicate areas of interest for the next
    survey.

-   Identify helpful information sources and resources to consider in
    the next survey.

-   Review and summarize agreements and commitments made during the
    conduct of the survey and the out-briefing.

-   Determine final report content, especially for areas of contention.

-   Document any unique organizational structures/functions or item of
    potential use to those planning the next survey.

-   Prepare for briefings on the survey results to DOE management, as
    appropriate.

[]{#__RefHeading___Toc510594693 .anchor}

## [5.2 Report Requirements](#TOC11)

> Survey reports **should** follow the format described in DOE O 470.1,
> Chapter IX, 7(a) and a completed DOE F 5634.1, S&S Survey Report Form,
> **should** be completed to include the Satisfactory (S), Marginal (M),
> or Unsatisfactory (U) ratings, as appropriate. All mandated programs
> should be surveyed and annotated as S, M, or U. Those topic areas not
> applicable to the surveyed facility **should** be rated DNA (Does Not
> Apply). Any other notations, such as NR for Not Rated, are not
> acceptable. The ratings and other entries on this form should be fully
> supported by the survey report narrative.
>
> The DNA rating may not be used in facilities where the program element
> is mandated but, for whatever reason, was not surveyed. Only programs
> that are not required may be omitted from the survey and rated DNA.
> For example, a facility that has no classified information systems
> would have a DNA rating for the Cyber Security subtopical area.
> However, if the facility has, or is approved for, classified
> information processing, the Cyber Security area should be surveyed,
> and a rating of S, M, or U should be assigned to this subtopical area.

### [[]{#__RefHeading___Toc510594694 .anchor}**5.2.1 Report Format**](#TOC11)

The report should be formatted with the cover page, table of contents,
ratings, executive summary, introduction, description of facility and
interests, narrative (including topical area description of the
program), conclusions, synopsis of findings, and appendices.

### [[]{#__RefHeading___Toc510594695 .anchor}**5.2.2 Report Content**](#TOC11)

> In addition to the completed DOE F 5634.1, the report **should**
> include:

1.  "an executive summary containing:

    a.  a statement reflecting the survey scope, period of coverage, and
        survey methodologies used;

    b.  a description of the facility, function, and scope of
        operations;

    c.  a discussion of major points that had, or might have, a
        significant effect on the facility's Safeguard and Security
        program, including strengths, weaknesses, and the correlation of
        results from the survey;

    d.  and the overall composite facility rating with supporting
        rationale."

        2.  The report also **should** include:

```{=html}
<!-- -->
```
a.  survey site and date;

b.  list of team members;

c.  "a copy of the current DOE F 5634.3 (Facility Data and Approval
    Record);

d.  identification of each active DOE F 5643.2 (Contract Security
    Classification Specification) or DD 254;

e.  a description of the facility's Safeguard and Security program by
    topical area as identified in the DOE F 5634.1;

f.  the methodology used to evaluate the facility;

g.  a description of the function and scope of operations and the
    protective measures employed (descriptions in Safeguard and Security
    plans may be referenced when no changes have occurred);

h.  identification of all new findings;

i.  the status of corrective actions for all open findings and status of
    all open and closed findings from the previous survey;

j.  concluding analysis of each topical area;

k.  a justification and rationale of the factors responsible for the
    composite facility rating." (Ratings **should** be based on the
    impact of the deficiencies. All ratings **should** be stated and
    justified in the survey report.)

> [Narrative]{.underline} The narrative section of the report should
> clearly describe the surveyed facility, its S&S interests and
> activities, its protective measures and the status of the S&S program
> at the time the facility was surveyed. The report also should explain
> how the protection measures were evaluated. Use of statistical data
> will help describe the facility's S&S interests and the survey effort.
> Such data might include numbers of employees with each level of access
> authorization; the number of classified documents in each level and
> category; and the number of documents sampled or
> compliance/performance.
>
> The report should reflect both compliance and performance segments of
> the survey. Discussions of topical areas in the report should follow
> the order of the topics identified in DOE F 5634.1. Reports should
> explain what the S&S program is supposed to do, what was inspected,
> and what was found. The content requirements are summarized as
> follows.

-   The status (e.g., approved, pending, etc.) of any required planning
    documents (e.g., SSSP, NMC&A, Cyber Security) should be noted.

-   The program deficiencies (findings) and supporting data should be
    described clearly. The term \"finding\" refers to deficiencies or
    concerns found during the survey. The term \"suggestion\" refers to
    suggested, nonmandatory, potential program enhancements cited in the
    survey report.

-   All new findings, with SSIMS-compatible finding numbers, should be
    identified. Open findings from the previous survey should be
    identified in the narrative portion of the survey report. Open
    findings **should** maintain their original finding number. A new
    finding that is a repeat of a closed finding **should** receive a
    new number, but the closed finding number should be referred to in
    the body of the narrative.

-   A description of the facility\'s strengths and weaknesses should
    correlate to the results from the compliance and performance survey
    segments, and discuss the basis for the ratings. The survey report
    should reflect validated and defensible ratings. Assigned
    performance ratings should be based upon well-conducted and
    replicable performance tests. The narrative description should be
    consistent with and support the composite and topical area ratings
    (to include DNA).

-   The report should identify findings corrected "on-the-spot." The
    findings and corrective actions should be clearly described in the
    narrative.

-   The status of corrective actions for open findings and findings from
    the previous survey should be included in the narrative (also
    included in Resolution of Findings under the Program Management
    topical area).

-   A concluding analysis of each topical area should be included in the
    narrative.

-   Reasons for a less-than-Satisfactory rating should be explained in
    detail.

> [Findings]{.underline} Each finding and subsequent corrective action
> **should** have a stand-alone security classification. Paragraphs and
> portions thereof are required to be marked with the highest
> classification level and category if restricted data (RD) or formerly
> restricted data (FRD) information is contained therein.
>
> Findings **should** be documented in each survey report and listed
> separately at the end of the report. Each report **should** include an
> attachment, summary, or other section in which all the findings for
> the survey should be collected and listed. The data for each finding
> on this list should include: 1) the finding number, 2) the finding
> synopsis, 3) the classification of each finding, and 4) the DOE order
> reference number.
>
> The surveying office **should** enter the findings into the SSIMS. The
> SSIMS is a centralized integrated database for maintaining information
> about S&S interests throughout the DOE complex. The system includes
> information on facility approvals and deficiencies identified in
> surveys and other survey activities. Survey findings are entered into
> SSIMS using the following format:

1.  Each finding should be described concisely in a synopsis format
    (FINDING SYNOPSIS). The SSIMS allows a maximum of 2,000 alphanumeric
    characters and spaces. Each finding **should** have a separate,
    stand-alone classification level and category, if RD or FRD. A
    separate field is provided for the finding classification level and
    category. The symbols S for Secret, C for Confidential, U for
    Unclassified, OUO for Official Use Only, and UCNI for Unclassified
    Controlled Nuclear Information **should** be used for the
    classification level. The symbols RD for restricted data and FRD for
    formerly restricted data should be used for the category.

2.  Each finding **should** have alphanumeric references to the DOE
    orders, manuals, or other documents that identify the requirement(s)
    not being met in the finding. This reference should be written as
    DOE O XXX.XX or DOE M XXX.XX-X; followed by the chapter, section,
    and subsection reference numbers and/or letters (e.g., DOE O 471.2A
    , III.3.a.(1) or DOE M 471.2-1C, II.1.h.).

3.  Each finding identified in the survey report should have a unique
    identification number assigned, which should be used throughout the
    reporting and tracking process. The following number system is
    mandated to provide consistency in the SSIMS. A number in this
    format should be system-generated upon entry of the finding into the
    SSIMS.

> Example of a finding number: 90MAR10-HQ-0515-SSIS-PM.1-010
>
> The first seven characters are the date of the survey. The last date
> of the survey is used if the survey occurred over several days. The
> date should be written in the following format: two numeric digits for
> the year (YY) three alpha characters for the month (MMM), and two
> numeric digits for the day of the month (DD).
>
> The next two or three alpha characters represent the LRO or other
> assigned responsibility for the oversight/tracking of the corrective
> action(s) for the deficiency, not the Surveying Office, unless they
> are the same. Up to six digits may be entered for the facility code.
> Leading zeros are not required. Up to five alpha characters are next
> and designate the source/type of report. Next are up to four alpha
> characters that designate the topical area surveyed, followed by one
> numeric digit that identifies the subtopical area. Finally, up to
> three numeric digits designate the sequential number of an individual
> finding within each of the topical areas.

### 

### [**5.2.3 Termination Reports**](#TOC11)

> " Termination survey reports shall include the following minimum
> information/reported action.

1.  Verification of non-possession of classified matter or nuclear or
    other hazardous material presenting a potential radiological or
    toxicological sabotage threat.

2.  Verification that personnel access authorizations no longer needed
    have been canceled and validation that termination statements have
    been completed by affected employees.

3.  Verification of deletion of all Safeguard and Security activities.

4.  Termination of facility clearance."

## [[]{#__RefHeading___Toc510594697 .anchor}5.3 Notification Requirements](#TOC11)

> "Reporting requirements identified below are initiated by the final
> close-out briefing.
>
> [Marginal]{.underline}. Within 15 working days following a survey
> closeout that results in an overall composite rating of Marginal, the
> LRO shall notify the Office of Security, and the applicable
> Departmental Elements. Notification shall contain the following:

1.  Identification of the facility (including both the facility code and
    reporting identification symbol - if applicable).

2.  A list of findings describing the deficiencies.

3.  A description of corrective actions taken to date or planned with
    associated milestones.

4.  A justification statement addressing the overall composite rating
    and status of the Safeguards and Security program at the facility.

5.  A statement identifying risks or vulnerabilities.

6.  A statement acknowledging physical validation of adequacy of interim
    corrective actions taken to date.

7.  A statement outlining steps that shall lead to the upgrading of the
    overall composite rating to Satisfactory."

> "If the Surveying Office is not the same as the LRO, the Surveying
> Office shall notify the LRO of results and rating(s) within 72 hours
> of survey closeout." The LRO **should** take corrective and
> notification actions, or authorize the Surveying Office to take those
> actions.
>
> "If the Surveying Office is unable to contact the LRO and a serious
> threat exists or is imminent, the Surveying Office shall take action
> to protect Safeguards and Security activities until the LRO can be
> notified. Subsequent action shall be taken on the basis of agreement
> between the two organizations and shall be fully documented in the
> survey report."
>
> [Unsatisfactory]{.underline}. "When a survey results in an overall
> composite rating of Unsatisfactory, the Operations Office Manager of
> the LRO shall coordinate with Secretarial Officers and other Heads of
> Operations Offices within 24 hours to:

1.  take action to suspend the activity and/or the facility clearance
    pending remedial action or

2.  provide the rationale for continuing this critical operation to the
    Office of Security Affairs, Office of Security, Secretarial
    Officers, and as directed, applicable Operations Offices. In
    addition to providing the rationale, the LRO should identify those
    immediate interim corrective actions being undertaken to mitigate
    identified risks or vulnerabilities.

> If the Surveying Office is not the same as the LRO, the Surveying
> Office shall notify the LRO of the results and rating(s) within 8
> hours of survey closeout.
>
> If the Surveying Office is unable to contact the LRO, action shall be
> taken to protect Safeguards and Security activities until the LRO can
> be notified. Subsequent action will be taken on the basis of agreement
> between the two organizations and shall be fully documented in the
> survey report."
>
> [[]{#__RefHeading___Toc510594698 .anchor}**5.4 Report
> Distribution**](#TOC11)
>
> "Within 60 working days after final closeout of the survey, the
> Surveying Office shall distribute the final survey report to all
> Departmental Elements with a registered activity and to all
> appropriate Headquarters Elements. For Departmental Elements or other
> government agencies with limited Safeguards and Security activities,
> survey results may be transmitted by memorandum."
>
> One copy of each survey report should be forwarded to the responsible
> organization; four copies to the office of Security Policy Staff;
> copies as appropriate for other DOE elements or other government
> agencies; one copy to the Office of Independent Oversight and
> Performance Assurance; and one copy to the surveyed organization, as
> determined locally.
>
> If the survey included any of the optional Information Security
> subtopical areas, Unclassified Cyber Security, Protected Transmissions
> Systems, and Communications Security, the appropriate Headquarters
> element should also be provided a copy of the report or relevant
> portions of the report.
>
> If a SCIF, intelligence related SAP, or other intelligence activity
> was surveyed, the Director of the Office of Intelligence also should
> be provided a copy of the report. If this intelligence activity was
> surveyed or reported separately, a copy of the survey report for the
> larger host facility **should** be included with the report sent the
> Director of the Office of Intelligence.

## [[]{#__RefHeading___Toc510594699 .anchor}5.5 Resolution of Findings](#TOC11)

> Survey findings should be resolved and corrected in a timely manner.
> These should include correction of root causes, to preclude recurrence
> of the finding and to ensure ongoing compliance in affected areas. In
> addition, findings should be resolved in a manner consistent with
> protection requirements, with appropriate fiscal consideration and/or
> planning. Corrective action plans with meaningful, measurable
> completion milestones are a primary means of resolving findings.
>
> "When a survey contains findings, the surveyed organization shall
> submit a response identifying corrective action(s) for each finding to
> the Responsible and Surveying Offices no later than 30 working days
> after formal receipt of findings. The corrective action(s) should be
> based on documented root cause analysis, risk assessment, and
> cost-benefit analysis."

### [[]{#__RefHeading___Toc510594700 .anchor}**5.5.1 Tracking Findings**](#TOC11)

> All survey findings identified in the survey report **should** be
> entered into the SSIMS. Each Operations Office is responsible for
> entering and providing corrective actions on survey findings,
> including findings from TSCM surveys. The Surveying Office is
> responsible for entering all findings into the SSIMS; the LRO is
> responsible for reporting the status of corrective actions for the
> findings.
>
> Findings **should** be monitored, and the status of the corrective
> actions **should** be reported to SSIMS until resolved. Monitoring
> **should** encompass findings of all surveys, inspections, reviews, or
> evaluations (including, but not limited to, Field Element surveys,
> Information Systems Security surveys, TSCM surveys, and OA, IG, and
> GAO reports).
>
> The tracking of findings is the responsibility of the Surveying Office
> and the LRO. Quarterly updates are to be entered into SSIMS by the
> 15th of January, April, July, and October. When the Surveying Office
> is different from the LRO, timeliness and documentation of
> findings/ratings is critical. The Surveying Office should notify the
> LRO of findings. similarly the LRO should keep the surveying
> organization apprised of findings status.

### [[]{#__RefHeading___Toc510594701 .anchor}**5.5.2 Corrective Action Completion**](#TOC11)

The responsible and surveying offices should establish a procedure for
validating the satisfactory completion of corrective actions for
findings. Upon validation that the completed actions bring the program
element identified by the finding into compliance, the finding\'s status
may be closed.

> The quality of the validation activity should virtually preclude a
> repeat finding in the program element. This is accomplished by
> ensuring that the problem itself was fixed and that root causes for
> the problem, such as procedures or training, also have been corrected.

Findings cannot be considered closed until associated corrective actions
have been verified as completed. A commitment by the facility to
implement a corrective action does not constitute completion of that
corrective action.

# [[]{#__RefHeading___Toc510594702 .anchor}Section 6 Self-Assessments](#TOC11)

Self-assessments provide internal monitoring of S&S programs and
activities to ensure compliance with S&S requirements and evaluate
performance of S&S systems and processes. "This program applies to
Departmental and contractor facilities for which a DOE F 5634.3 is
recorded. The level of detail of the self-assessment may be specified by
the Lead Responsible Office." Surveys conducted of a DOE organization by
a DOE surveying office, while meeting the requirement for the survey
program and reported as a survey, **should** meet the requirement for
the self-assessment of that organization as well.

The level of formality and rigor required for each element with the
self-assessment process will vary depending on the specific
circumstances at a DOE facility. Self-assessment is an ongoing process.
It should not be thought of as a single inspection, survey, or review
that is completed between periodic surveys to evaluate compliance. It
should be used as a management tool to determine program effectiveness
and to identify areas needing special attention.

> [[]{#__RefHeading___Toc510594703 .anchor}**6.1 Rationale**](#TOC11)
>
> "A Safeguards and Security self-assessment program shall be
> implemented to ensure internal monitoring of compliance and
> performance with Safeguard and Security requirements." A good working
> definition for self-assessment is the line organization's ongoing
> process for identifying and correcting weaknesses and promoting best
> practices. The individual employees, supervisors, and managers
> responsible for accomplishing an assigned mission or task are the ones
> who should be responsible for evaluating their own performance.
>
> An effective self-assessment program provides a clear basis for
> decreasing resources committed to external oversight - the new
> direction in which DOE's survey programs are going. When an
> organization consistently demonstrates its ability to find and correct
> weaknesses or promote the use of good practices, the external
> oversight group can commit reduced resources to ongoing surveys,
> reviews, and assessments to detect deteriorating conditions.

## [[]{#__RefHeading___Toc510594704 .anchor}6.2 Self-Assessment Elements](#TOC11)

> An effective self-assessment program has three elements: 1) management
> involvement and communication, 2) employee involvement, and 3) a
> positive self-assessment environment. All levels of management
> **should** continuously be actively and visibly involved in
> implementing the self-assessment program. Management commitment is
> essential to promoting employee participation and creating an
> environment where self-assessments contribute to continuous
> improvement to the S&S programs.
>
> Managements expectations of the self-assessment program also should be
> made clear to facility employees. Managers should visibly participate
> in self-assessment activities, to include a periodic walk-through of
> sites and facilities, meeting with the employees to go over the
> results of the self-assessments, and participating in analysis of
> results from self-assessments. The time management devotes to
> self-assessments is the best indicator of the level of importance they
> place on the self-assessment program.
>
> The environment best suited for conducting self-assessments is one of
> teamwork, open and effective communications, and mutual respect
> between management and employees. Employees should have confidence
> that management will support identification of performance weaknesses
> and potential improvements without reprisal. Also, management should
> have confidence that employees will approach each self-assessment
> activity objectively without attempting to manipulate results to
> advance a specific agenda. Employees should continuously scrutinize
> their own work and the work of their co-workers to determine if it can
> be performed better. Organizations that carefully measure essential
> elements of performance help to build a positive self-assessment
> environment.
>
> The self-assessment process should include provisions for monitoring
> the implementation of corrective actions and verifying closure.
> Existing commitment or action tracking systems may be sufficient,
> provided that effective controls are maintained over systems to ensure
> that schedules or action item content are not changed without
> appropriate management review and approval. Systems used to track
> corrective actions should provide routine output to management,
> identifying items that are coming due for completion, past-due items,
> and any items for which schedules have been altered several times.

The verification process should ensure that actions have been fully
completed and that the actions satisfactorily resolved the performance
deficiency originally identified. This verification should take into
account the root cause analysis, which should assist in verifying the
cause of the deficiency has been corrected.

## [[]{#__RefHeading___Toc510594705 .anchor}6.3 Conducting a Self-Assessment](#TOC11) 

> "Self-assessments shall include reviews of all applicable DOE F 5634.1
> topical and subtopical areas of the facility\'s Safeguards and
> Security program/system." The planning, conduct, and other survey
> activity guidance provided by this Guide may be readily applied to
> self-assessment, albeit on a generally smaller scale. Using this Guide
> for self-assessments requires less document development for the
> self-assessment program and provides a standard means of measuring the
> S&S program using the same methods applied by the Surveying Office.
> However, many sites have recently opted for the "rolling
> self-assessment" process wherein the self-assessment is conducted
> throughout the course of the year by utilizing surveillance or spot
> check-type activities. If using this method, care should be taken to
> identify interaction and dependence of programs that may not have
> their reviews conducted at the same time. While methods of conducting
> self-assessments may vary across the complex, all **should** comply
> with the intent of DOE O 470.1.
>
> The first step of a self-assessment, similar to that of a survey,
> involves planning the self-assessment activities. This includes:

-   Determining what activities are included within the scope of the
    self-assessment.

-   Identifying planned activities such as document reviews,
    observations, and performance assessments.

-   Assigning required resources.

-   Establishing appropriate schedules.

> "The Self-assessment program shall:

1.  include reviews of all applicable DOE F 5634.1 topical and
    subtopical areas of the facilities Safeguards and Security
    program/system;

2.  be conducted between the periodic surveys conducted by the surveying
    office; and

3.  be conducted using personnel knowledgeable of the programmatic or
    topical area."

> The self-assessments may be done with a separate assessment program
> staff which, if necessary, can be augmented by internal or external
> personnel. It may be advantageous to place extra emphasis on areas
> that were deficient in past surveys and self-assessments. Key elements
> of effective self-assessment programs include:

-   established basis and procedures

-   approved and implemented plans and (annual) schedules

-   formal reports of self-assessment activities

-   corrective action plans with meaningful milestones

-   accountability to corrective action plans.

> Self-assessment reports, which might resemble scaled-down survey
> reports, **should** be written for all self-assessments and
> **should**:

1.  "address reviewed topical areas;

2.  be used as organizational management tools/aids in determining the
    status of Safeguards and Security performance and compliance with
    applicable

3.  Safeguards and Security Order requirements;

4.  be available for review by the Surveying Office during surveys; and
    list findings resulting from self-assessment activities."

> "Findings resulting from self-assessments shall be processed as
> follows:

1.  Reviewed during the surveys by the Surveying Office.

2.  Addressed by facility/organization management through a documented
    corrective action plan.

3.  Reviewed and the status of findings tracked until closed.

4.  Reported to the Lead Responsible Office if:

```{=html}
<!-- -->
```
a.  a vulnerability to national security, classified information,
    nuclear materials, or Departmental property results, or may result,
    in a significant anomaly that could have significant programmatic
    impact or embarrass the Department; or

b.  the self-assessment is used to extend the Surveying Office's
    periodic survey frequency.

> 5\. Documented in survey reports when deficiencies still exist and
> have not been adequately addressed."