The Incident/Inquiry Report is designed to provide a consistent
reporting format to assist the Department of Energy (DOE) Complex in
obtaining accurate and thorough information regarding an incident of
security concern. Incident information collected will be input into the
Incident Tracking & Analysis Capability (ITAC) Database to be used by
the DOE, including the National Nuclear Security Administration (NNSA),
to conduct analysis, modify policy, and provide value added feedback to
the field.

This Report is to be completed by individual(s) with primary
responsibility for incident inquiries (i.e., the Inquiry Official). It
is to be submitted to the Office of Security and Safety Performance
Assurance, Office of Technology and Field Assistance, Office of Field
Assistance, SP-31, hereafter DOE/SP, as part of the Inquiry process.

Every effort should be made to complete the report with as much detail
as possible. All entries require completion to ensure each issue has
been addressed. Where an entry is not applicable or the information is
unknown, the field should be annotated as such (i.e., N/A or Unknown).

Please ensure the appropriate classification review is completed for
this document. Enter the appropriate classification level and category
(to include UCNI, OUO, etc.) at the top and bottom of all pages. Portion
mark as appropriate. Include any caveats associated with this record.

Your timely completion and transmittal of the Incident/Inquiry Report to
DOE/SP, is appreciated. After initial notification to the Headquarters
Emergency Operations Center (EOC) using DOE F 471.1, submission of a
[completed]{.underline} version of this report will serve to meet the
requirement for the final inquiry report, as identified in DOE Manual
470.4-1, Safeguards and Security Program Planning and Management,
Section N, *Incidents of Security Concern*, dated 8-26-05.

**NOTE: If an incident/inquiry is an IMI 1.2, 1.5, 1.6, 1.7, 1.13, 1.14,
1.15, 1.16, 1.17, 2.6, 2.12, 2.13, 2.14, 2.15, 2.16, 3.3, 3.4, 3.11,
3.12, 3.18, 3.19, 4.5, 4.7, 4.9, 4.10, 4.11, 4.13 information in the
following sections below must be completed in order to close an
incident/inquiry: 7.0 - Containment, 8.0 - Mitigation Aggravating
Factors, Sub-Tab 9.4 - Documentation Corrective Action Plan, 10.1 --
Corrective Action Taken, and 10.2 Corrective Action Process.**

**If you choose an IMI in red print, then the report sections identified
in red must also be completed prior to submitting a report for closure
per the requirements set forth by the Security Enforcement Program. If
you are entering data in the ITAC database, and chose one of the above
noted IMI categories, you will not be allowed to enter a closure date
until the fields are completed. It is recommend your complete all
sections of the report regardless of which IMI you chose.**

**DOE HQ Tracking Number:**

**Locally Assigned Incident Tracking Number:**

**ITAC Number:**

1.  **Location:**

> *(Complete the following Cognizant Security Office (CSO) and Facility
> information as identified in SSIMS.)*

**CSO for Facility where Incident Originated/Occurred**:

Facility Acronym:

SSIMS Facility Code:

**Facility where Incident Originated/Occurred:**

Facility Acronym:

SSIMS Facility Code:

Location (Bldg./Rm.):

**Facility responsible for conducting the Inquiry (if other than
above):**

Facility Name:

SSIMS Facility Code:

**Other Facilities/Location(s) affected by incident:**

Location Name:

SSIMS Facility Code (if applicable).

Address:

City:

State:

Location (Bldg./Rm.):

DOE Facility Yes No

**Security area where incident occurred:** (check all that apply)

Property Protection Area

Limited Area

Exclusion Area

Protected Area

Material Access Area

Vital Area

SCIF

SAPF/SSWA

Classified Information System Facility

Secure Communications Center

Non-Security Area (e.g., private residence, public areas, etc.)

2.  **Dates:**

    1.  **[Reporting]{.underline}**:

Time Zone (for the following times):

Incident Occurred Date/Time:

Incident Discovered Date/Time:

Inquiry initiated (determination that an incident has occurred)
Date/Time:

IMI Categorization made Date/Time:

DOE F 471.1 transmitted to HQ Date/Time:

Incident contained to prevent further compromise Date:

Inquiry Status Report transmitted to SO Date:

Inquiry completed Date:

Inquiry Report transmitted to SO Date:

Incident officially closed Date:

2.  **[Follow-up]{.underline}:**

Interim corrective actions implemented Date:

Proposed corrective actions transmitted to SO Date:

GEN-16 policy applied by Classification Office Date:

Damage Assessment completed Date:

> *If you enter a date in Damage Assessment Completed, you need to
> complete tab 9.3 -- Damage Assessment*

3.  **Identification:**

*Copy and Paste additional IDENTIFICATION sections below, as necessary.*

1.  **[Notifications]{.underline}**

**Initial Reporting Point of Contact (from DOE F 471.1):**

Name:

Organization:

Phone:

Title:

**Facility Security Officer:**

Name:

Organization:

Phone:

Title:

**DOE Cognizant Security Organization or HQ Representative:**

Name:

Organization:

Phone:

Title:

**Others Notified (e.g., ISSO, security personnel, etc...):**

Name:

Organization:

Phone:

Title:

2.  **[Inquiry]{.underline}**

**Lead Organization and Inquiry Official:**

Name:

Organization:

Phone:

Title:

**Inquiry Official(s) at other affected sites:**

Name:

Organization:

Phone:

Title:

**Inquiry Participant(s)/Assistant Inquiry Officials:** **Check if
inquiry lead**

Name:

Organization:

Phone:

Title:

**Other Departmental Elements, Field/Operations Offices, Site Offices,
Government Agencies, Foreign Government Agencies, or Contractors
involved in the Inquiry:**

Organization Name:

POC Name:

Phone:

**Case released to agency(s), including but not limited to LLEA (outside
of DOE, including NNSA):**

Organization Name:

POC Name:

Phone:

3.  **[Individuals Involved]{.underline}**

**Responsible Individual(s):**

Name:

Organization:

Phone:

Title:

> Did this individual receive a written infraction for the incident? Yes
> No
>
> Was this individual interviewed? Yes No
>
> Written statement available? Yes No
>
> Is this individual a foreign national? Yes No
>
> Was this individual appropriately cleared? Yes No
>
> First Line Supervisor's Name:

**Other Individual(s):**

Name:

Organization:

Phone:

Title:

> Was this individual interviewed? Yes No
>
> Written statement available? Yes No
>
> Is this individual a foreign national? Yes No
>
> Was this individual appropriately cleared? Yes No

4.  **IMI Categorization**:

*From the tables below, identify the incident*

### Reportable Categories of Incidents of Security Concern

1.  **[Impact Measurement Index (IMI-1)]{.underline}**

Actions, inactions, or events that pose the most serious threats to
national security interests and/or critical DOE assets, create serious
security situations, or could result in deaths in the workforce or
general public. Report within 1 hour. \[Topical Area (TA) shown within
\< \>\]

1.1 Confirmed or suspected loss, theft, or diversion of a nuclear device
or components.

\<Select the TA for this IMI category: ** NMC&A or  PHYSEC**\>

1.2 Confirmed or suspected loss, theft, diversion, or unauthorized
disclosure of weapon data. \<**IS**\>

1.3 Confirmed or suspected loss, theft, or diversion of Category I or II
quantities of Special

Nuclear Material (SNM). \<**NMC&A**\>

1.4 A shipper-receiver difference involving a loss in the number of
items which total a Category I or II quantity of SNM. \<**NMC&A**\>

1.5 Confirmed or suspected loss, theft, diversion, unauthorized
disclosure of Top Secret (TS) information, Special Access Program (SAP)
information, or Sensitive Compartmented Information (SCI), regardless of
the medium, method, or action resulting in the incident. \<**IS**\>

1.6 Confirmed or suspected intrusions, hacking, or break-ins into DOE
computer systems containing TS information, SAP, or SCI. \<**IS**\>

1.7 Confirmed or suspected physical intrusion attempts or attacks
against DOE facilities containing nuclear devices and/or materials,
classified information, or other national security related assets.
\<**PHYSEC**\>

1.8 Confirmed or suspected attacks against DOE Federal and contractor
employees that adversely impact a facility's or site's security posture.
\<**PHYSEC**\>

1.9 Confirmed or suspected acts or attempts of terrorist-type actions.
\<**PHYSEC**\>

1.10 Confirmed reports of DOE or DOE contractor employees making threats
against Departmental facilities, employees, or the U.S. Government
\<**PHYSEC**\>

1.11 Confirmed threats that immediately endanger personnel health or
safety and may require immediate protective force/law enforcement
intervention. \<**PHYSEC**\>

1.12 Dangerous weapons and firearms-related incidents where an
individual is killed, wounded, or an intentional discharge occurs.
\<**PROFORCE**\>

1.13 Confirmed or suspected acts of sabotage, at any DOE facility, that
place the safety or security of personnel, facilities, or the public at
risk. \<**PHYSEC**\>

1.14 Confirmed compromise of root/administrator privileges in DOE
unclassified computer systems that have a significant possibility of
being contaminated with TS information, SAP information, or SCI.
\<**IS**\>

1.15 Confirmed compromise of root/administrator privileges in DOE
computer systems containing Secret or Confidential information.
\<**IS**\>

1.16 Confirmed intrusions into information systems containing classified
information. \<**IS**\>

1.17 Instances of malicious code that cause disruption, degradation, or
compromise of information systems for an entire site/facility.
\<**IS**\>

1.18 Instances of malicious code that allow unauthorized or undetected
access to information systems containing classified information (Top
Secret, Secret, Confidential, SAP information, or SCI). \<**IS**\>

 1.19 Other (describe "Other"):

\<Select the TA for this "Other" IMI category:

> **IS,** **NMC&A,** **PERSEC,** **PHYSEC, or** **PROFORCE**\>

2.  **[Impact Measurement Index (IMI-2)]{.underline}**

***Actions, inactions, or events that pose threats to national security
interests and/or critical DOE assets or that potentially create
dangerous situations. Report within 8 hours.* \[Topical Area (TA) shown
within \< \>\]**

2.1 Suspected loss, theft, or diversion of any radioactive material not
categorized as special nuclear materials (SNM), or dangerous materials
that could pose a health threat or endanger security. \<Select the TA
for this IMI category: ** NMC&A or  PHYSEC**\>

2.2 Confirmed or suspected intrusions, hacking, or break-ins into DOE
computer systems containing Secret or Confidential classified
information. \<**IS**\>

2.3 Any amount of SNM found in an exceptionally dangerous/hazardous
unapproved storage environment, or unapproved mode of
transportation/transfer.

\<Select the TA for this IMI category: ** NMC&A or  PHYSEC**\>

2.4 Alarms or other loss detection indicators for security areas
containing a Category I or II quantity of SNM that cannot be proven
false within 24 hours. \<**NMC&A**\>

2.5 Inventory differences exceeding alarm limits in Category I and II
SNM material balance areas, where there is no indication or reason to
believe the difference is created by loss, theft or diversion.
\<**NMC&A**\>

2.6 Confirmed or suspected unauthorized disclosure, loss, or potential
loss of Secret matter regardless of the medium, method, or action
resulting in the incident. \<**IS**\>

2.7 Actual or suspected technical interceptions of any level of
classified information. \<**IS**\>

2.8 Actions, by electronic or physical means, that interfere with any
DOE safeguards and security practices.

\<Select the TA for this IMI category:

** IS,  NMC&A,  PERSEC,  PHYSEC, or  PROFORCE** \>

2.9 Notifications, by any media or source, of validated threats that do
not appear to immediately threaten personal safety or health.
\<**PHYSEC**\>

2.10 Loss of classified information that must be reported to other
Government agencies or foreign organizations. \<**IS**\>

2.11 Unsecured classified repositories of any type, including safes,
doors, or other protective encasements, that contain Top Secret
information, Special Access Program information, or Sensitive
Compartmented Information.

\<Select the TA for this IMI category: ** IS or  PHYSEC**\>

2.12 The loss of any DOE classified interest that requires State or
local government or other Federal agency notification. \<**IS**\>

2.13 Confirmed compromise of root/administrator privileges in DOE
unclassified computer systems. \<**IS**\>

2.14 Confirmed compromise of root/administrator privileges in DOE
unclassified computer systems that have a significant possibility of
being contaminated with Secret or Confidential information. \<**IS**\>

2.15 Potential compromise of root/administrator privileges in DOE
computer systems containing classified information. \<**IS**\>

2.16 Instances of malicious code that cause disruption/degradation or
compromise of information systems dedicated to safety, security, or
critical operations. \<**IS**\>

2.17 Detection of activities involving individuals who have been
confirmed as physically watching/casing/surveilling a site in an effort
to gather information to aid in the conduct of a terrorist-type attack.
\<**PHYSEC**\>

2.18 Other (describe "Other"):

\<Select the TA for this "Other" IMI category:

> **IS,** **NMC&A,** **PERSEC,** **PHYSEC, or** **PROFORCE**\>

3.  **[Impact Measurement Index (IMI-3)]{.underline}**

***Actions, inactions, or events that pose threats to DOE security
interests or that potentially degrade the overall effectiveness of the
Department's safeguards and security protection program. Report within 8
hours.* \[Topical Area (TA) shown within \< \>\]**

3.1 A shipper-receiver difference or inventory difference involving a
gain in the number of items for which the additional items total a
Category I or II quantity of special nuclear material (SNM).
\<**NMC&A**\>

3.2 Bomb-related incidents at any DOE facility, including location of a
suspected device. \<**PHYSEC**\>

3.3 Confirmed or suspected unauthorized disclosure, loss, or potential
loss of Confidential matter by any medium, method, or action. \<**IS**\>

3.4 Confirmed or alleged noncompliance with laws or DOE
directives/standards that jeopardizes protection of the facility or site
security interests. \<**PHYSEC**\>

3.5 Demonstrators or protestors that cause site and facility damage.
\<**PHYSEC**\>

3.6 Labor strikes that could degrade or impede the required protection
of the facility or site.

\<Select the TA for this IMI category: ** PHYSEC or  PROFORCE**\>

3.7 Physical violence or threat of retaliation against facility security
personnel. \<**PHYSEC**\>

3.8 Dangerous weapons and firearms-related incidents involving
protective force operations/personnel where an unauthorized weapon
discharge occurs. \<**PROFORCE**\>

3.9 Loss or theft of DOE firearms or ammunition, per DOE M 470.4-3,
Protective Force.

\<**PROFORCE**\>

3.10 Unplanned/unscheduled power outages that cause a
disruption/degradation of physical security systems and that would allow
unauthorized or undetected entry to access controlled/protected areas.
\<**PHYSEC**\>

3.11 Incidents involving the attempted or actual introduction of
controlled and prohibited items into Limited, Exclusion, Protected, or
Material Access Areas, excluding unauthorized cellular phones or
personal digital assistants where there is no potential for compromise
of classified or unclassified controlled information. \<**PHYSEC**\>

3.12 Confirmed or suspected malicious activities, including but not
limited to stealing badges or vehicle licenses. \<**PHYSEC**\>

3.13 Discovery of malicious activities, disorderly conduct, or vandalism
that disrupts facility activities or causes damage between \$10K and
\$100K. \<**PHYSEC**\>

3.14 Circumvention of established access control procedures into a
security area (excluding Property Protection Area). \<**PHYSEC**\>

3.15 Inventory differences exceeding alarm limits in Category III SNM
material balance areas or inventory differences greater than 50 g of
Tritium, where there is no indication or reason to believe the
difference is created by loss, theft, or diversion. \<**NMC&A**\>

3.16 A shipper-receiver difference involving a loss in the number of
items which total a Category III or IV quantity of SNM. \<NMC&A\>

3.17 Confirmed or suspected loss, theft, or diversion of Category III or
IV quantities of SNM. \<**NMC&A**\>

3.18 Intrusion attempts into information systems containing classified
information. \<**IS**\>

3.19 Confirmed intrusions into unclassified information systems that are
not publicly available (e.g., behind a firewall). \<**IS**\>

3.20 Confirmed instances of "denial of service" attacks on information
systems that result in disruption of site/facility ability to access the
Internet, disruption of site/facility information systems operations, or
disruption of site/facility information system protection measures
(e.g., firewall). \<IS\>

3.21 Unauthorized network scans/probes on information systems possessing
classified information. \<**IS**\>

3.22 Incidents of apparent surveillance of facilities or operations
(studying, photographing, low over-flights, outsiders questioning
employees or protective force, unusual calls for information, etc.).
\<**PHYSEC**\>

3.23 Other (describe "Other"):

\<Select the TA for this "Other" IMI category:

> **IS,** **NMC&A,** **PERSEC,** **PHYSEC, or** **PROFORCE**\>

4.  **[Impact Measurement Index (IMI-4)]{.underline}**

Actions, inactions, or events that could pose threats to DOE by
adversely impacting the ability of organizations to protect DOE
safeguards and security interests. Report monthly. \[Topical Area (TA)
shown within \< \>\]

4.1 Identified special nuclear materials (SNM) inventory differences
beyond alarm limits in a Category IV SNM material balance area where
there is no indication or reason to believe the difference is created by
loss, theft, or diversion. \<**NMC&A**\>

4.2 Significant shipper-receiver differences that exceed 200g of fissile
material and the combined limit of error for the shipment. \<**NMC&A**\>

4.3 Alarms or other loss detection indicators, excluding inventory
differences and shipper-receiver differences, for a security area
containing a Category III or IV quantity of SNM. \<**NMC&A**\>

4.4 A shipper-receiver difference or inventory difference involving a
gain in the number of items for which the additional items total to a
Category III or IV quantity of SNM. \<**NMC&A**\>

4.5 Confirmed or suspected unauthorized disclosure of Unclassified
Controlled Nuclear Information, Export Control information, and
unclassified Naval Nuclear Propulsion Information by any medium, method,
or action. \<**IS**\>

4.6 Non-credible bomb threats at any DOE nuclear or non-nuclear
facility. \<**PHYSEC**\>

4.7 Unsecured classified repositories of any type including safes,
doors, or other protective encasements in which no likely classified
disclosure occurred. If the repository contains Top Secret information,
Special Access Program information, or Sensitive Compartmented
Information, report under the IMI-1, IMI-2, or IMI-3 category, as
appropriate. \<**IS**\>

4.8 Peaceful demonstrations or protests that do not threaten facility or
site security interests or activities. \<**PHYSEC**\>

4.9 Failure to adhere to established procedures contributing to the
misuse or misprocessing of or failure to maintain security badges and
passes.

\<Select the TA for this IMI category: ** PERSEC or  PHYSEC**\>

4.10 Loss of security badges in excess of 5 percent of total issued
during 1 calendar year.

\<**PHYSEC**\>

4.11 Failure to adhere to established procedures contributing to the
mismanagement or faulty application of the DOE Human Reliability
Program. \<**PERSEC**\>

4.12 Failure to adhere to established administrative procedures
contributing to problems with foreign visitors. \<Select the TA for this
IMI category:

** IS,  NMC&A,  PERSEC,  PHYSEC, or  PROFORCE**\>

4.13 Classified information sent by e-mail that is contained within the
firewall. All parties involved are cleared to the level of information
transmitted, and the affected systems are identified, taken offline, and
appropriately stored in approved areas pending sanitization. If more
than 8 hours are required to isolate the affected systems, then such
incidents will be handled as suspected compromises in accordance with
their classification levels and categories. \<**IS**\>

4.14 Unauthorized cellular phones and personal electronic devices (e.g.,
PDA's) introduced into a Limited Area, Protected Area, or Material
Access Area, where there is no potential for compromise of classified or
unclassified controlled information. \<**PHYSEC**\>

4.15 Circumvent established access control procedures into a Property
Protection Area. \<**PHYSEC**\>

 4.16 High rate/amount of loss (excluding natural disasters) or theft
of Government property. \<**PHYSEC**\>

4.17 Other (describe "Other"):

\<Select the TA for this "Other" IMI category:

> **IS,** **NMC&A,** **PERSEC,** **PHYSEC, or** **PROFORCE**\>

5.  **Classified Matter Description**

*To be completed for incidents involving classified matter*

1.  **[Type]{.underline}**

**Disclosure Type:** (check all that apply)

Unsecured/Improperly Secured Matter

Classified Matter processed on an unclassified computer

Improper Transmission (e.g. Facsimile, E-Mail, package carrier)

Located/Found in an unapproved facility (including private residences)

Verbal

Media Leak

Classification Issue (includes failure to obtain classification review)

Other (describe "Other"):

**Form(s) of the matter involved in the incident:** (check all that
apply)

Electronic Storage Media

E-Mail

Facsimile

Hard Copy

Internet

Visual

Audio/Verbal

Other (describe "Other"):

**Identify the owner of the information (e.g., SO-10, NN-55, etc.):**

### 

### Did the matter involve Work for Others?"  Yes  No

### Did the matter involved belong to an "Other Government Agency?"  Yes  No

**If "Yes," Identify Other Government Agency(s) involved:**

2.  **[Classification]{.underline}**

**Classification Level:** (check only one)

Top Secret

Secret

Confidential

**Category of Information:** (check only one)

Restricted Data

Formerly Restricted Data

National Security Information

**Caveats:** (check all that apply)

Weapons Data (WD)

> Identify any SIGMA's (1-5, and 9-15) involved:
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Special Access Program (SAP)

Sensitive Compartmented Information (SCI)

Foreign Government Information (FGI)

Naval Nuclear Propulsion Information (NNPI)

No Foreign Dissemination (NOFORN)

Other (describe "Other"):

3.  **[Description]{.underline}**

**In the following field, identify/describe the classified matter lost,
compromised, or potentially compromised (e.g., document title and date,
description of matter):**

**In the following field, list the Classification Guide and Topic, or
Source Document, including date, which applies to the classification of
the matter:**

**Classification Official(s) that verified the matter's classification**
(if applicable):

Name:

Organization:

Phone:

Title:

6.  **Narrative:**

**Brief description of the incident (for incidents involving classified
matter, identify classification level, category, and any identifiers):**

**Describe the incident (including an executive summary, narrative,
chronology of events, and conclusion, identifying who, what, when,
where, why, and how) in accordance with DOE requirements for Inquiry
Report Content identified in DOE Manual 470.4-1, Safeguards and Security
Program Planning and Management, Section N, *Incidents of Security
Concern*, dated 8-26-05. (Specifics captured elsewhere in this report
may be excluded):**

7.  **Containment:**

**Summarize the actions taken to contain (and sanitize if appropriate)
the incident:**

8.  **Mitigating/Aggravating Factors:**

    1.  **[Mitigating Factors]{.underline}**

**Identify any information that may be considered as a mitigating factor
and reduces the potential impact of the incident:**

2.  **[Aggravating Factors]{.underline}**

**Identify any information that may be considered as an aggravating
factor and increases the potential impact of the incident:**

9.  **Determination of Inquiry:**

    1.  **[Determination]{.underline}**

**Determination of Unauthorized Disclosure:** (check only one)

Loss/compromise did occur

Probability of compromise is not remote

Probability of compromise is remote

Loss/compromise did not occur

**(UD ONLY) If the inquiry established credible information that a
Violation of U.S. law pertaining to the Unauthorized Disclosure of
classified information to the media occurred, is the DOJ 11-point
criteria satisfied?** Yes No

**Fundamental (root) cause(s) of the incident involves:** (check all
that apply)

Equipment/Material Problem

Management Problem

Personnel Error

Procedure Problem

Training Deficiency

Design Problem

External Phenomena

Other (describe "Other"):

**Summarize the root cause of the incident (include direct and
contributing factors). This can include formal and/or information root
cause analysis:**

**How would the responsible individual(s) non-compliance be
characterized:** (check only one)

Inadvertent

Negligence

Gross Negligence

Willful

2.  **[Summary]{.underline}**

**Summarize the conclusion of the Inquiry (include basis/facts that
support the conclusion and potential risk to the security interest based
upon subjective analysis):**

3.  **[Damage Assessment]{.underline}**

**Has the Program Office requested a Damage Assessment be done?** Yes No

**Was a damage assessment completed (formal and/or informal)?** Yes No

> *If you chose "Yes," you must insert a date in 2.2 -- Follow-Up --
> Damage Assessment Completed.*

**Summarize the results of the (formal and/or informal) damage
assessment:**

4.  **[Documentation]{.underline}**

**Documentation included in inquiry report:** (check all that apply. \*
indicates a required item.)

Security Incident Notification Report (DOE F 471.1)\*

Inquiry Official(s) Appointment Letter\*

Reporting Unaccounted for Documents (DOE F 5639.2)

Inquiry Report\*

Copy of Compromised or Potentially Compromised Information (portion
marking must be applied to identify what is classified)\*

Interview Statement(s)\*

Damage Assessment Report

Corrective Action Plan

Report of Security Incident/Infraction (DOE F 5639.3) or a form
comparable in content, as applicable

Occurrence Reporting and Processing System (ORPS)

Chain of Custody Form(s)

Other (describe "Other"):

10. **Corrective Actions**:

    1.  **[Corrective Action Taken]{.underline}**

**Categorize Action(s) Taken:** (check all that apply)

Communication Security System Modification

Cyber Security System Modification

Disciplinary Action

Physical Security System Modification

Policy/procedural Change

Training Modification

Other (describe "Other"):

**Summarize the proposed corrective actions identified to prevent
recurrence** (corrective actions identified in response to an incident
of security concern must be documented and, for incidents categorized as
IMI-1, 2, & 3 a copy forwarded to SO.):

**Management Official(s) responsible for Corrective Actions:**

Name:

Organization:

Phone:

Title:

2.  **[Corrective Action Process]{.underline}**

**Describe corrective action steps:**

**Describe the results achieved:**

**Remedial actions which will be taken to prevent recurrent:**

**The date by which full compliance will be achieved:**

11. **Disciplinary Actions:**

**Action taken:** (check all that apply)

Mandatory Training

Oral Admonishment

Personnel Reassignment

Suspension of Access Authorization

Termination of Access Authorization

Termination of Employment

Written Reprimand

Other (describe "Other"):

**Are there mitigating factors affecting disciplinary action?** Yes No

**If "Yes", identify the factors**: (check all that apply)

Possibility of genuine misunderstanding

Enticements or provocations

Culpability of others

Employee cooperativeness

Other (describe "Other"):

**Are there aggravating factors affecting disciplinary action?** Yes No

**If "Yes", identify the factors:** (check all that apply)

Past breaches

Series of breaches

Nature of other breaches

Employee willfulness

Other (describe "Other"):

**Management Official(s) responsible for Disciplinary Actions:**

Name:

Organization:

Phone:

Title:

12. **Comments:**

    1.  **[Other]{.underline}**

**Include any comments associated with the incident:**

**Record Caveats (check all that apply)**

Foreign Government Information (FGI)

Naval Nuclear Propulsion Information (NNPI)

No Foreign Dissemination (NOFORN)

Weapons Data (WD)

> Identify any SIGMA's (1-5, and 9-15) involved:
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Check here if this incident has been rescinded (e.g., determination
that an incident did not occur) based on the results of the inquiry?** 

**Check here if this incident has or may result in increased media
attention?** 

**Describe media attention:**

**Check here if this incident has any association with foreign
nationals:** 

**Classification of this Record:**

Official Use Only (OUO)

Secret Formerly Restricted Data (S/FRD)

Secret Restricted Data (S/RD)

Secret National Security Information (S/NSI)

Confidential Formerly Restricted Data (C/FRD)

Confidential Restricted Data (C/RD)

Confidential National Security Information (C/NSI)

Unclassified Controlled Nuclear Information (UCNI)

**Classification of DOE F 471.1**

Official Use Only (OUO)

Secret Formerly Restricted Data (S/FRD)

Secret Restricted Data (S/RD)

Secret National Security Information (S/NSI)

Confidential Formerly Restricted Data (C/FRD)

Confidential Restricted Data (C/RD)

Confidential National Security Information (C/NSI)

Unclassified Controlled Nuclear Information (UCNI)

**(HQ Use Only) DOE HQ Tracking Number (IMI#)**:

**Locally Assigned Incident Tracking Number:**

**Incident Man Hours Information (can enter more than 1 person):**

Name:

Hours:

**Total Hours for this Incident**:

2.  **[Other Information]{.underline}**

**HQ Security Enforcement**

Name:

Organization:

Phone:

Title:

**Comments:**

**Security Incident Coordinator:**

Name:

Organization:

Phone:

Title:

**Comments:**

**Classification Official who made the classification determination for
this record:**

Name:

Organization:

Phone:

Title:

**Classification Official who made the classification determination for
the 471.1 Form:**

Name:

Organization:

Phone:

Title: