**SAFEGUARDS AND SECURITY FOR PROJECT MANAGEMENT**

\[This Guide describes suggested non-mandatory approaches for meeting
requirements. Guides [are not]{.underline} requirements documents and
[are not]{.underline} construed as requirements in any audit or
appraisal for compliance with the parent Policy, Order, Notice, or
Manual.\]

**FOREWORD**

> This Department of Energy Guide is for use by all DOE elements.
>
> Beneficial comments (recommendations, additions, and deletions) and
> any pertinent data that may improve this document should be sent to
> the Director, Office of Policy, HS-71, U.S. Department of Energy,
> Washington, DC 20585, by letter or by sending the self-addressed
> Standardization Document Improvement Proposal (DOE F 1300.3).
>
> This Guide is intended to provide approaches for implementing the
> safeguards and security requirements of DOE O 413.3A, *Program and
> Project Management for the Acquisition of Capital Assets*. DOE Guides,
> which are part of the DOE Directives System, provide supplemental
> information for fulfilling requirements contained in rules, regulatory
> standards, and DOE directives. Guides do not establish or invoke new
> requirements nor are they substitutes for requirements.

**CONTENTS**

SECTION I: INTRODUCTION

1.  Goal

2.  Scope

3.  Objectives

4\. Applicability

SECTION II: SAFEGUARDS AND SECURITY PROGRAM

SECTION III: DESIGN CONSIDERATIONS & INTERFACES

1.  Design Philosophy

2.  Basis for Design Standards

3.  Applicability of Facility and Physical Protection Standards

4.  Federal and Local Building Codes and National Standards

5.  Site Planning and Architectural Design

6.  Security System Design

7.  Security System Alternatives Evaluation

SECTION IV: PROJECT & PROGRAM MANAGEMENT CONTROLS

1.  Change Control Process

2.  Change Initiation and Documentation

3.  Contract Completion and Closeout

SECTION V: SAFEGUARDS & SECURITY AND THE CRITICAL DECISION PROCESS

1.  Project Phases

2.  Time Frames

3.  Initiation Phase (Pre-Conceptual Planning)

4.  Definition Phase (Conceptual Design)

5.  Execution Phase I (Preliminary Design Phase)

6.  Execution Phase II (Final Design Phase)

7.  Transition/Closeout Phase (Construction)

8.  Operational Phase.

Attachment 1 -- Safeguards and Security Project Checklist

Attachment 2 -- References

**SECTION I: INTRODUCTION**

1.  [GOAL]{.underline}: The goal is to ensure that safeguards and
    security requirements are identified and integrated into the project
    early and their implementation assessed throughout the project life
    cycle, specifically at each Critical Decision (CD). Establishing
    safeguards and security requirements early is necessary for project
    planning and cost estimating and to prevent project impacts that can
    be expected when safeguards and security requirements are injected
    late into the design process or as part of the operational readiness
    review. Additionally, due to potential conflicts in meeting
    safeguards and security requirements and the requirements of other
    critical disciplines (e.g., operations and safety), the integration
    of all requirements is critical to developing a cost effective
    solution, which satisfies all requirements and provides the best
    overall solution for the project. The protection of an asset should
    consider the threat to the asset as a fundamental part of the design
    process, so that the Department can maximize safeguards and security
    effectiveness while minimizing safeguards and security costs. The
    total cost of the project (design, construction, installation,
    training and maintenance) should be measured against the potential
    harm from loss or misuse of the asset being protected or controlled.

2\. [SCOPE]{.underline}: This Guide addresses the implementation steps
for achieving safeguards and security systems that support the
Department's protection objectives. It provides a logical process for
the implementation of accepted safeguards and security principles, which
are translated into system requirements and configuration with an
auditable cost and schedule; from project/program initiation through the
transition/closeout phases.

3\. [OBJECTIVES]{.underline}: This Guide is to provide safeguards and
security advice to Federal Project Directors and Federal Program
Managers in identifying and implementing key safeguards and security
components of their projects and integrating safeguard and security
consideration into each Acquisition Management Phase (Initiation,
Definition, Execution and Transition/Closeout).

> a\. Facilitate communication and interaction between security
> professionals and the other members of the project design team.
>
> b\. Develop effective security which minimizes impact on operations.
>
> c\. Ensure a federal security representative is identified to serve as
> design Point of Contact (POC) and member of the Integrated Project
> Team (IPT) during the entire project cycle**.**

4\. [APPLICABILITY]{.underline}: This guide applies the term "DOE" to
refer to all DOE elements, including the National Nuclear Security
Administration (NNSA). Additionally, as used in this guide, the term
"security" refers to both safeguards and security as it is applicable to
the project or facility regardless of the type of building, structure,
or facility and whether new or a modification.

> This Guide provides approaches for implementing the security
> provisions within the functional areas contained in DOE O 413.3A,
> *Program and Project Management for the Acquisition of Capital
> Assets*. The DOE G 413.3-X series provides companion supplemental
> Project Management guidance. These are listed in the attached
> References of this Guide. Specific regulatory citations are provided
> in the body of the Guide. This Guide expands upon the regulatory
> requirements of DOE O 413.3A and provides explanations and examples
> for implementing the requirements.
>
> Except for requirements established by a regulation, contract, or
> administrative means, the provisions in this Guide are DOE's views on
> acceptable methods of program implementation and are not mandatory.
> Conformance with this Guide will; however, create an inference of
> compliance with the related regulatory requirements. Alternative
> methods that are demonstrated to provide an equivalent or better level
> of protection are acceptable. DOE encourages its contractors to go
> beyond the minimum regulatory requirements and to pursue excellence in
> their programs.
>
> The words "should" and "may" are used to denote optional program
> recommendations and allowable alternatives, respectively. This Guide
> is applicable to all DOE activities that are subject to the
> requirements of DOE O 413.3A.

**SECTION II: Safeguards and Security PROGRAM**

> DOE assets are defined and protection standards outlined in the
> Department's Design Basis Threat Policy. Protection strategies,
> depending on the asset being protected, range from a combination of
> compliance with DOE security policies to specific performance
> standards that must be met. This constitutes a graded and risk-based
> approach assuring the highest levels of protection for those assets
> where loss, theft, compromise, and/or unauthorized use would seriously
> affect the national security, the environment, Departmental programs,
> and/or health and safety of the public or employees. Security related
> interests and assets include special nuclear material (SNM), other
> nuclear material, radiological material, biological assets, classified
> parts, classified and/or sensitive information, critical assets, and
> high cost or unique items. For example, all radiological materials are
> under varying levels of compliance-based requirements (i.e., physical
> security; material control and accountability policies; protective
> force responses; etc) based on the categorization of the radiological
> material (both as individual items and as the aggregate of the items
> to a greater category). For those assets designated as Threat Level --
> 1, 2, or 3, reference the DBT policy, additional security measures may
> be required. These additional requirements are defined as
> performance-based security measures, and require the conduct of a
> vulnerability assessment (VA). The VA process is performed by the
> respective site, and results in a determination of what, if any,
> additional security measures are necessary to achieve an integrated
> protection system consisting of sensing, assessment, communication,
> response, interruption, and neutralization.
>
> The DOE O 470 Series of orders establish minimum design principals.
> Adherence to these orders will ensure safeguards and security designs
> embellish the DOE tenants of providing graded security and
> establishing defense in-depth. For example, a security area denotes a
> physically defined space containing departmental security assets and
> subject to physical protection and access controls. Security areas are
> established per the requirements of DOE M 470.4-2, *Physical
> Protection.* The type of security area established depends on the
> nature of the security interests to be protected, with the following
> types required for the protection of the listed security interests.
> These are: Property Protection Area (PPA); Limited Area; Exclusion
> Area; Protected Area (PA); Material Access Area (MAA), and Vital Area.
> The PPA (an office building or administrative area) represents the
> least restrictive area with the most restrictive being a PA which is
> located within an MAA. The descriptions are provided in DOE M 470.4-7,
> *Safeguards and Security Program References*.
>
> DOE safeguards and security programs are established through DOE 470
> series Orders and Manuals, examples of applicable Orders and Manuals
> are:

-   DOE O 470.3A, Design Basis Threat Policy (U), dated 11/29/05,

-   DOE O 470.4, Safeguards and Security Program, Performance Assurance,
    dated 08/26/05,

-   DOE M 470.4-1, Chg 1, Safeguards and Security Program Planning and
    Management, dated 03/07/06,

-   DOE M 470.4-2, Chg 1, Physical Protection, dated 03/07/06,

-   DOE M 470.4-4, Information Security, dated 08/26/05,

-   DOE M 470.4-6, Chg 1, Nuclear Material Control and Accountability,
    dated 08/14/06.

> **SECTION III: DESIGN CONSIDERATIONS & INTERFACES**

1.  [DESIGN PHILOSOPHY]{.underline}: Completed designs should meet the
    requirements of all disciplines associated with the project.
    Effective project management strives for an integrated solution to
    the issues. The best solution, achieving the goals of each
    discipline, should be the aim of the project. This integrated
    approach facilitates a cost effective solution for the project.
    Designs should be defensible in terms of scope, cost, and project,
    and supportability.

2.  [BASIS FOR DESIGN STANDARDS]{.underline}: DOE security interests are
    to be protected from theft or diversion, sabotage, espionage, loss
    or theft of classified matter or government property, and other
    hostile acts which could cause unacceptable adverse impacts on
    National security, program continuity, or the health and safety of
    employees, the public, or the environment. Levels of protection
    appropriate to particular safeguards and security interests are to
    be provided in a graded fashion in accordance with potential risks
    to National security and the health and safety of employees and the
    public. Protection programs are tailored to address site-specific
    characteristics on the basis of DOE Orders, DOE Manuals, and other
    requirements. Site-specific protection programs describing the
    implementation of these requirements are documented in protection
    program plans and/or Site Security Plans.

> The basis for each discipline standard should be addressed. For
> example, nuclear safety rules do not address malevolent acts,
> sabotage, or terrorist activities, while security requirements are
> focused primarily on such actions. However, successful design accounts
> for all requirements within the areas applicability and expected
> environmental conditions for the system to operate. This will
> necessitate accommodating potential interactions and overlaps among
> applicable requirements, such as those that might be encountered
> between postulated security technologies and normal operation or
> accident conditions, such as those required to be evaluated for life
> safety.

3.  [APPLICABILITY OF FACILITY AND PHYSICAL PROTECTION
    STANDARDS]{.underline}: Planning, design, and installation of
    security systems should be determined in consultation with the
    cognizant DOE security authority and should comply with security
    policies.

> A key role of the security professional assigned to the project team
> will be to ensure that the best approach to meeting policy
> requirements is identified. The approach should provide a security
> solution that minimizes security's impact on project cost, potential
> safety concerns, operational impact, and other important
> considerations while maintaining compliance with requirements and
> providing effective security.

4.  [FEDERAL AND LOCAL BUILDING CODES AND NATIONAL
    STANDARDS]{.underline}: The planning and design should consider
    those Federal and local municipal life safety and electrical codes
    and standards applicable to the specific site and facility
    commensurate with its configuration and operations, and support
    National model building codes, mandatory design standards, energy
    conservation and environmental standards. In addition, the design
    should address the facility design requirements driven by facility
    operations, such as chemical, biological, and radiological safety.

5.  [SITE PLANNING AND ARCHITECTURAL DESIGN]{.underline}: All DOE
    facilities are evaluated for potential risks to the employees, the
    public, and the environment. DOE M 470.4 series policy documents
    contain guidance for determining the level of protection, based on
    facility functions and potential security risks. A preliminary
    security review should be initiated during the project conceptual
    design phase and further developed during the preliminary and final
    design phases. In most situations, these reviews are included in the
    project planning and design documentation (e.g., in conceptual
    design reports, or Critical Decisions). Facility design and
    construction features, identified as a result of security review,
    may be factored into the conceptual design before establishing the
    project cost estimate and requesting funding authorization for
    design and construction. An appropriate security plan should be
    completed and approved prior to the start of construction (including
    site preparation), consistent with DOE M 470.4-1, *Safeguards and
    Security Program Planning and Management*. The plan should be
    updated as appropriate to reflect changes affecting security that
    are made to the facility during its lifetime.

6.  [SECURITY SYSTEM DESIGN:]{.underline} Controls should be established
    to prevent unauthorized access to security areas, unauthorized
    activities within security areas, and removal of security interests.
    The following considerations include:

-   Although building access points are often minimized for security
    reasons, personnel egress from security areas must meet the
    requirements of National Fire Protection Association (NFPA) 101 and
    the applicable portions of the project building code (e.g.,
    International Building Codes or NFPA 5000).

-   Entrances to and exits from security areas should be designed for
    efficient, yet controlled, movement of personnel or vehicles through
    designated portals.

-   Due to the security limitations on exiting certain buildings,
    alternative life safety approaches, such as a safe haven, based on
    performance based compliance with the NFPA requirements, may be
    required to meet the requirements of both disciplines.

-   External and internal areas within security boundaries should be
    provided with infrastructure support (i.e., electrical power, alarm
    communications and control systems).

> Where there are conflicts between the security requirements and those
> of other disciplines, these need to be defined as early in the project
> as practicable, so as to provide the time to reach the best overall
> solution to all requirements.

7.  [SECURITY SYSTEM ALTERNATIVES EVALUATION]{.underline}: During the
    conceptual and preliminary design phase, alternatives analysis of
    security system is performed along with the other major activities
    of the project, including the security implications of the various
    proposed sites. To ensure consideration of all alternatives
    appropriate to the significance of the threat, the project team
    should consult departmental programs supporting the development or
    deployment of security technologies. Currently these include the DOE
    Office of Health, Safety and Security and the NNSA Chief, Defense
    Nuclear Security. These organizations will be able to provide
    technical and contact information for security technologies being
    developed, tested, or deployed by the Department or other agencies
    of the United States. Care should be taken to avoid new untested
    systems. They should not be installed at DOE facilities unless there
    is a conscious decision that the site will be a field test facility
    for those systems.

> Project teams may request technical assistance from the Office of
> Health, Safety and Security. Communication is essential to ensure that
> the facility is able to receive the technology and that its deployment
> is appropriate for the facility.

**SECTION IV: PROJECT & PROGRAM MANAGEMENT CONTROLS**

1.  [CHANGE CONTROL PROCESS:]{.underline} Change control ensures that
    project changes are identified, evaluated, coordinated, controlled,
    reviewed, approved, and documented in a manner that best serves the
    project as depicted in Figure IV-1, Communication is the Key to
    Change Management. Errors, problems, opportunities, new management,
    or the availability of new methods or tools can initiate project
    changes. Uncontrolled changes can lead to serious, far-reaching
    problems, which could affect the project's technical scope,
    schedule, and cost baseline, as well as effects on safety, risk,
    quality, and products.

![](media/image1.wmf){width="2.54251968503937in"
height="1.544488188976378in"}**Figure IV-1 -- Communication is the Key
to Change Management**

> Once a security system has been selected and approved by the
> program/project manager, project evolution and/or changes in
> requirements can impact that decision or specifics of the solution.
> Therefore, it is critical to manage change. This includes the impact
> that security system changes have on the rest of the project and
> impacts other element changes could have on the security system.
>
> Due to the critical nature of the interface between security and the
> other project elements, project triggers for change management
> (including when DOE should approve the change) should be defined based
> on security requirements and not just on the traditional DOE O 413.3A
> cost and schedule baseline requirements. Once the program/project
> manager has approved construction, this change management process
> should become more formalized and timely.
>
> Examples of change management triggers that should cause a meeting of
> the project team to discuss overall impacts and issues as a result of
> changes in one area (safety, security, operations) that might result
> in changes in other areas are:

a.  Life safety requires the installation of fire doors in previously
    unobstructed hallways or corridors, thereby potentially impacting
    closed circuit television coverage, alarm sensor coverage, or
    applied security technology.

b.  Security designs incorporating active denial as the most cost
    effective solution, thereby resulting in the need for changes in
    operations and life safety approach through the addition of safe
    havens or additional emergency egress points.

c.  The planned operational environment of a room changes through the
    planned introduction of Radio Frequency-sensitive work or equipment,
    thereby potentially limiting the use of radios for life safety (fire
    and medical) and security (protective force and system maintenance).

d.  The selected facility design for processing nuclear material changes
    to incorporate additional processing quantities and/or material
    forms (e.g., oxide and chlorides, in addition to metal), thereby
    potentially changing the safeguards and security strategy,
    criticality safety, and nuclear facility safety approaches.

e.  The planned facility is changed from only handling general process
    unclassified information to incorporate handling and storage of
    sensitive and classified matter.

```{=html}
<!-- -->
```
2.  [CHANGE INITIATION AND DOCUMENTATION]{.underline}: If there are
    changes during the course of a project, the project team will need
    to determine whether project changes are required. If changes are
    needed, the project team should determine and document each of the
    alternatives with respect to security risk; safety risk;
    environmental impact; quality and other regulatory requirements;
    long-term programmatic costs; project risk, cost, and schedule; etc.
    Alternative selection approval should be made at the appropriate
    management level, as documented by the Project Execution Plan.

> The Integrated Project Team (IPT) needs to determine the correct
> timing for the identification and procurement of security technologies
> for the project. Although early planning and interface evaluation
> within the project is the key to success, especially the evaluation of
> alternative protection and control strategies, it may be important to
> delay actual procurement of the technology until it is required. This
> delay provides project options for using improved technologies and
> assuring that the chosen technology is not obsolete when the project
> is ready to begin operation. This is especially important for projects
> taking years to complete. In such cases, however, it will be necessary
> to provide the infrastructure to support these technologies. In doing
> so it is important that the federal project security representative
> maintains close coordination with the DOE and NNSA security technology
> organizations.

3.  [CONTRACT COMPLETION AND CLOSEOUT]{.underline}: After installation
    of safeguards and security systems, an appropriate level of review
    needs to be conducted to ensure that the security features will be
    available when needed and ready to function as intended. In
    particular, a mechanism needs to exist to ensure that the
    functionality of the mechanisms as implemented meets the required
    levels of performance. In addition, the review needs to ensure the
    safety features related to the security system are properly
    installed, operationally tested to ensure safety features operate as
    planned, and that the safeguards and security systems fail-safe
    (duplicate or alternative system elements designed to enhance
    operational reliability ensuring continuing operation in the event
    of failure of the primary system element) ensuring adequate security
    while avoiding safety mishaps. The level of review can be graded
    based on the significance of the installation as long as the review
    covers these key features. Use of existing readiness review
    processes in place at the site is encouraged. After installation,
    there is typically an acceptance period to discern if the installed
    system meets the technical requirement specified in the contract. An
    acceptance test based upon required security performance levels
    should have been specified for all security-relevant systems in the
    contract document, along with the plan approval requirements.

> Essential elements associated with security systems require routine
> testing of the system to ensure operability. Safeguards and security
> system testing requirements should be identified during the system
> selection process and documented in the Project Execution Plan. Before
> the facility becomes operational, testing requirements must be
> documented in the appropriate security plans and facility operating
> procedures, including a formal Performance Assurance Program Plan when
> required by DOE security directives.
>
> Administrative security mechanisms and any related physical and/or
> administrative safety controls must be tested and the review needs to
> ensure appropriate procedures, training, and other activities are in
> place and effective.
>
> DOE O 425.1 C, *Start and Restart of Nuclear Facilities*, is
> applicable for new nuclear facilities and modifications following shut
> down of a Hazardous Category (HC)-1 or HC-2 nuclear facility. The
> requirements of this order specify a readiness review process that
> must, in all cases, demonstrate that it is safe to start (or restart)
> the applicable facility. It is also required for new HC-3 nuclear
> facilities. The order should be reviewed for applicability when
> deploying security technologies and for modifications within a nuclear
> facility.

**SECTION V: SAFEGUARDS & SECURITY AND THE CRITICAL DECISION PROCESS**

1.  [PROJECT PHASES]{.underline}. The project consists of phases
    (Initiation, Definition, Execution, and Transition/Closeout) which
    incorporate and are separated by Critical Decisions, which act as
    hold points for DOE's approval of the current project activities and
    the plans for the next phase. These Critical Decisions provide DOE's
    approval for the project to move into the next phase. Four critical
    decisions are considered major milestones approved by the
    Acquisition Executive that establish mission need, recommended
    alternative(s), acquisition strategy, the performance baseline, and
    other essential elements required to ensure that the project meets
    applicable mission, design, security, and safety requirements.
    Figure IV-1, Typical DOE Functions for Projects, depicts a typical
    DOE project approach.

> ![](media/image2.wmf){width="4.499305555555556in" height="0.40625in"}

![](media/image3.jpeg){width="5.652777777777778in"
height="1.4472222222222222in"}

**Figure V-1 Typical DOE Project Timeline**

2.  [TIME FRAMES]{.underline}: The amount of time to complete a phase
    leading to a successful Critical Decision and to transition to the
    next decision will vary on the project and its complexity. The less
    complicated the project, the more likely that more than one critical
    decision may be approved simultaneously. On the other hand, there
    may be a need to separate a critical decision into sub-elements. The
    key security tasks associated with each project phase are presented
    in Table V-1. Note that these tasks need to be finished to complete
    the phase and support the Critical Decision. However, it is
    important to start these efforts early in the phase, providing time
    for project interaction in support of these tasks and to address
    project changes they drive. The phases are described below.

3.  [INITIATION PHASE (PRE-CONCEPTUAL PLANNING)]{.underline}: This phase
    includes all activities leading to a CD-0 Mission Need decision.
    This phase is normally independent of a particular solution and
    should not be defined by equipment, facility, technological
    solution, or physical end-item. The Initiation Phase allows
    flexibility to explore multiple solutions and not limit potential
    solutions. For all projects, an early evaluation of probable
    security concerns and Design Basis Threat (DBT) assessment should be
    made. When indicated by this evaluation, a security professional for
    the project should be identified to serve as technical advisor and
    consultant and IPT member to the project on security matters for the
    remainder of the project. For additional details regarding the CD
    process from initiation through the closeout phase, see Table V-1,
    Overarching Areas of Consideration.

> When determined that it is to be a classified project, the DOE program
> manager should determine, with assistance from the security staff, the
> actions necessary for identifying the level of security and the
> associated requirements cited in Part 2, Section I, Chapter VII, DOE M
> 470.4-1, *Program Planning and Management*. This action should
> identify the scope of the access authorizations required for project
> personnel and the need for procedures for the processing the Facility
> Data and Approval Record and any subsequent changes.

![](media/image4.wmf){width="6.495833333333334in"
height="8.509027777777778in"}

4.  [DEFINITION PHASE (CONCEPTUAL DESIGN):]{.underline} Once the Mission
    Need is approved (CD-0), the Definition Phase begins with the
    Conceptual Design Phase. Successful completion of the Conceptual
    Design Phase is identified by the approval of CD-1. The Conceptual
    Design Phase is defined as an interactive process to define,
    analyze, and refine project concepts and alternatives. Approval of
    CD-1 authorizes Project Engineering and Design funds. The security
    team representative would begin to plan for the role of security
    within the project. This represents a critical point for determining
    and defining the security involvement in the project. During
    conceptual design, the security representative would document all
    security requirements (e.g. physical security devices and systems,
    nuclear materials safeguards, information security and any
    specialized security equipment) to ensure that all critical
    overarching security components are identified. The security
    representative should summarize alternative protection and control
    strategies and provide the project manager with estimated ranges for
    capital and operating costs of alternatives which meet security
    policy requirements. This would occur with most topical security
    areas to ensure that alternatives for protection and control of
    security risks are evaluated for effectiveness and for long-term
    costs. At the conclusion of conceptual design (CD-1), the Program
    would know the impact of safeguards and security operations on the
    project and the overall security role (e.g., security's impact on
    the project will be significant, minimal, or serve in an advisory
    role ensuring safeguards and security departmental requirements are
    identified).

5.  [EXECUTION PHASE I (PRELIMINARY DESIGN PHASE):]{.underline} Once
    CD-1 has been obtained and Project Engineering and Design funds
    authorized, the Preliminary Design Phase commences. Successful
    completion of the Preliminary Design Phase is identified by the
    approval of CD-2. Approval of CD-2 authorizes submission of a budget
    request for the total project cost. Safeguards and security
    involvement in the Preliminary Design Phase would consist of
    activities such as conducting vulnerability assessments, refining
    security strategies, defining security system performance
    requirements, determining office, alarm station, and other
    infrastructure requirements; and preparing mature cost estimates.
    Depending on the scope of, and assets associated with the project,
    the resources necessary to conduct vulnerability assessments and
    security technology option analyses might be significant and require
    the expenditure of Project Engineering and Design funds in support
    of the performance baseline. Additionally, security designs and
    associated electrical; communications; heating, ventilation, and air
    conditioning; and other appropriate support infrastructures for the
    security features of the project should be integrated into the
    overall project design and engineering package. Where possible,
    industry standards should be used to plan for future growth or
    technological changes in the security systems.

6.  [EXECUTION PHASE II (FINAL DESIGN PHASE)]{.underline}: Once CD-2 has
    been obtained, the Final Design Phase is initiated. Final drawings,
    specifications, and contract documents are prepared to solicit bids
    for asset construction or assembly. Statements of Work are prepared
    to solicit and select needed contractor support and appropriate
    performance incentives are identified. Testing requirements and
    acceptance criteria are prepared for security systems and for system
    components. Acceptance tests based upon required performance levels
    should be specified for all security-relevant systems in the
    contract documents. Security representatives of the Integrated
    Project Team should ensure approval of the selected security system
    design by both contractor and field office managers. Foreign
    Ownership, Control, or Influence (FOCI) determinations are made and
    vendor and contractor management systems are examined. Project
    status and earned value milestones and reporting controls are
    negotiated. The configuration management program is established

> Successful completion of the Final Design Phase is identified by the
> approval of CD-3. CD-3 is authorization to complete all procurement,
> construction, and implementation activities. Guidance on the project
> cost parameters are addressed in DOE O 413.3A. CD-3 authorizes
> expenditure of all budgeted resources to execute the project. When
> final design is completed, all known security concerns have been
> identified and addressed, and the project is ready to begin
> construction. Following CD-3 security would support construction of
> necessary security initiatives, begin safeguards and
> security-identified training objectives, finalize organizational
> structure, and prepare appropriate security plans and procedures
> necessary to support the project. There should be included the
> Acceptance Plan preparation and Approval and when system operation and
> maintenance training should take place. This includes the supporting
> operations and maintenance manuals/procedures.

7.  [TRANSITION/CLOSEOUT PHASE (CONSTRUCTION)]{.underline}: Once CD-3
    has been completed, the project Transition /Closeout Phase begins.
    Project activities that are in progress in parallel with
    construction include final preparation of plans and procedures for
    facility operations. This includes acceptance testing of systems as
    construction is completed, and the facility is transferred from the
    project to operations. Thus, during the Transition/Close-out, all
    system documentation is reviewed and an acceptance determination
    made. System component and complete system acceptance testing is
    evaluated against the test and acceptance plan. Action is taken to
    evaluate the storage of system source codes and updates. Maintenance
    and spare parts requirements are assessed, and procedures and
    maintenance practices are tested. For security, efforts leading to
    CD-4 would represent an approved security plan, procedures, trained
    security professionals on-hand, and a successful Operational
    Readiness Review.

8.  [OPERATION PHASE:]{.underline} At CD-4, the project is completed,
    and there is transition to the operations program/project manager
    for assumption of responsibility for operations and maintenance. The
    facility/site Management and Operations Group takes over the
    responsibility for the management, operation, and associated
    support.

**ATTACHMENTS**

**ATTACHMENT 1 -- SAFEGUARDS AND SECURITY PROJECT CHECKLIST**

The following checklists are meant to be used by the safeguards and
security point of contact and project team lead as a guide for ensuring
that safeguards and security is efficiently and effectively integrated
into the project. As used in this attachment,, the term "security"
refers to both safeguards and security as it is applicable to the
project or facility regardless of the type of building, structure, or
facility and whether new or a modification.. These lists are not meant
to be all-inclusive.

**Initiation Phase**

1.  Safeguards and security (S&S) Point of Contact (POC) designated as a
    member of the Integrated Project Team (IPT)and briefed on the
    parameters of the potential project or mission need:

    a.  New Facility or existing retrofit

    b.  Type of facility (e.g., research, production,
        administrative/computing facility, nuclear and/or radiological
        material storage, processing with or without classified parts)

    c.  Population of the facility (e.g., numbers and origin)

    d.  Potential locations for the facility

    e.  Existing facility or infrastructure upgrade project (e.g., fire
        safety upgrade, security systems upgrade, adding classified
        capabilities to a formally unclassified facility)

2.  Begin identification of potential security-related assets associated
    with the project

    a.  Special Nuclear Materials (SNM), other nuclear material,
        radiological material, biological assets (virus samples, etc.),
        classified and/or sensitive information or parts, critical
        assets, high cost or unique items, high availability items (fire
        station, Emergency Operations Center (EOC), etc.)

    b.  Potential physical size and location of the project

    c.  Potential for hazardous materials

    d.  Potential impacts to protective force(PF) size and posture

    e.  Potential interfaces with emergency management/response assets
        due to nature of the facility

    f.  Impacts on existing security infrastructure/operations

    g.  Assess the Design Basis Threat (DBT) guidance for application to
        the project

[]{.mark}

3.  Establish relationships with other team members or disciplines
    involved:

    a.  Operations

    b.  Safety

    c.  Engineering

    d.  Information/Cyber Security Technologies

    e.  Budget

4.  Rough out timeline for major security related milestones and
    associated resources:

    a.  Conduct of Vulnerability Assessment's (VA)

    b.  Security System design initiated and completed

    c.  Security documentation prepared, updated and completed (e.g.,
        VA, security plan, materials control and accountability (MC&A)
        plan, security clearances)

    d.  Security tests (all safeguards and security functions)

    e.  Security Operational Readiness Review (ORR)

**Definition Phase**

1.  Confirm the parameters of the project and mission need:

    a.  New Facility or existing retrofit

    b.  Type of facility, e.g. research, production,
        administrative/computing facility

    c.  Population of the facility

    d.  Potential locations for the facility

    e.  Existing facility or infrastructure upgrade project (e.g. fire
        safety upgrade, security systems upgrade, adding classified
        capabilities to a formally unclassified facility, electrical
        power distribution and communications)

    f.  Potential initial registration or revision/update to the
        Safeguards and Security Information Management System (SSIMS)

    g.  Validate the application of the DBT to the facility and its
        operation

    h.  Perform vulnerability analyses against the facility
        configuration.

2.  Confirm security related assets identified in initiation phase and
    identify any new security- related assets

    a.  SNM, other nuclear material, radiological material, biological
        assets (virus samples, etc.), classified and/or sensitive
        information or parts, critical assets, high cost or unique
        items, high availability items (fire station, EOC, etc.)

    b.  Potential physical size and location of the project

    c.  Potential for hazardous materials

    d.  Potential impacts to Safeguards and Security staffing

        i.  Protective force size and posture

        ii. MC&A staffing

        iii. Information Security staffing

    e.  Potential interfaces with emergency management/response assets
        due to nature of the facility

    f.  Integration with existing security infrastructure/operations

3.  Finalize security-related functional and operational requirements
    for inclusion in overall project functional and operational
    requirements document:

    a.  Identify general safeguards and security requirements, to
        include barriers, explosives, security communications, PF
        support, entry/access controls, intrusion detection/surveillance
        systems, and MC&A systems

    b.  Identify operational and infrastructure support needed for
        safeguards and security features

4.  Identify safeguards and security-related disciplines necessary to
    consult on the project (e.g., physical security, information
    security, MC&A, operations security (OPSEC), PF, personnel security,
    etc.

5.  Continue relationships with other team members or disciplines
    involved:

    a.  Operations

    b.  Safety

    c.  Engineering

    d.  Information/Cyber Security Technologies

    e.  Project Management with other members IPT

    f.  Emergency Management

6.  Begin to finalize timeline for major security-related milestones and
    associated resources:

    a.  Conduct of computer-based VAs of the system and its components.

    b.  Security system design initiated and completed

    c.  Security documentation updated and completed

    d.  Security performance/acceptance tests

    e.  Security ORR

    f.  System operations and training documentation

    g.  System source code documentation

7.  Begin to develop/review security-related costs and resources

    a.  Direct Project related

    b.  Security operations

    c.  Project support related

**Execution Phase I (Title Design)**

1.  Conduct security-related assessments based on the confirmed
    parameters of the project and mission need:

```{=html}
<!-- -->
```
a.  New Facility or existing retrofit

b.  Type of facility (e.g. research, production,
    administrative/computing facility)

c.  Population of the facility

d.  Potential locations for the facility

e.  Existing facility or infrastructure upgrade project (e.g., fire
    safety upgrade, security systems upgrade, and adding classified
    capabilities to a formerly unclassified facility

```{=html}
<!-- -->
```
2.  Conduct security-related assessments based on the DBT, security
    policies, and the confirmed security-related:

```{=html}
<!-- -->
```
a.  SNM, other nuclear material, radiological material, biological
    assets (virus samples, etc.), classified and/or sensitive
    information or parts, critical assets, high cost or unique items,
    high availability items (fire station, EOC, etc.)

b.  Potential physical size and location of the project

c.  Potential for hazardous materials

d.  Potential impacts to protective force size and posture

e.  Potential interfaces with emergency management/response assets due
    to nature of the facility

f.  Impacts on existing security infrastructure/operations

g.  Associated security risks

```{=html}
<!-- -->
```
3.  Conduct reviews of overall project documentation for:

    a.  General and specific security requirements inclusion in
        engineering and design packages (e.g., physical security,
        barriers, explosives, security communications, PF support,
        entry/access controls, intrusion detection/surveillance systems,
        MC&A systems; classified and/or unclassified sensitive
        information systems; cyber systems)

    b.  Operational and infrastructure support needed for security
        features

    c.  Interfaces and impacts to and from other sections of the
        engineering and design package (e.g. safety systems, general and
        specific layouts, operational descriptions, etc.)

4.  Provide tasking, as required, to security-related disciplines to
    consult on the project (e.g., physical security, information
    security, MC&A, OPSEC, PF, personnel security, etc.):

    a.  Begin development of security-related training strategies

    b.  Begin development of security-related operational strategies

    c.  Interface with safety and operational training development

5.  Continue relationships with other team members or disciplines
    involved:

```{=html}
<!-- -->
```
a.  Operations

b.  Safety

c.  Engineering

d.  Training

e.  Information/Cyber Security Technologies

f.  Budget

```{=html}
<!-- -->
```
6.  Execute and review/complete major security-related milestones:

```{=html}
<!-- -->
```
a.  Conduct of VAs

b.  Security System design, including key technologies

c.  Security documentation

d.  Security performance tests

e.  Security ORR

```{=html}
<!-- -->
```
7.  Review/Finalize security-related costs and resources:

```{=html}
<!-- -->
```
a.  Direct Project related

b.  Security operations and staffing

c.  Project support related

**Execution Phase II (Construction / Acquisition)**

1.  Monitor construction and change control:

```{=html}
<!-- -->
```
a.  Document reviews

b.  Project meeting attendance

c.  Construction site walkthroughs

d.  Participation/observation in security related acceptance testing

```{=html}
<!-- -->
```
2.  Continue security related assessments based on the DBT, security
    policies, and the confirmed security-related:

```{=html}
<!-- -->
```
a.  SNM, other nuclear material, radiological material, biological
    assets (virus samples, etc.), classified and/or sensitive
    information or parts, critical assets, high cost or unique items,
    high availability items (fire station, EOC, etc.)

b.  Potential physical size and location of the project

c.  Potential for hazardous materials

d.  Potential impacts to protective force size and posture

e.  Potential interfaces with emergency management/response assets due
    to nature of the facility

f.  Impacts on existing security infrastructure/operations

g.  Associated security risks

```{=html}
<!-- -->
```
3.  Continue reviews of overall project documentation and construction
    for:

    a.  General and specific security requirements inclusion in
        engineering and design packages (e.g. barriers, explosives,
        security communications, PF support, entry/access controls, and
        intrusion detection/surveillance systems)

    b.  Operational and infrastructure support needed for security
        features

    c.  Interfaces and impacts to and from other sections of the
        engineering and design package (e.g., safety systems, general
        and specific layouts, operational descriptions, etc.)

4.  Provide tasking, as required, to security-related disciplines to
    consult on the project (e.g., physical security, information
    security, MC&A, OPSEC, PF, personnel security, etc.):

    a.  Begin development of security-related training strategies

    b.  Begin development of security-related operational strategies

    c.  Interface with safety and operational training development

5.  Continue relationships with other team members or disciplines
    involved:

    a.  Operations

    b.  Safety

    c.  Engineering

    d.  Training

    e.  Information/Cyber Security Technologies

    f.  Budget

6.  Complete documentation and analysis necessary to support major
    security-related milestones:

    a.  Conduct of VAs

    b.  Staffing plans

    c.  Security System installation, including security technology

    d.  Security documentation updated and completed

```{=html}
<!-- -->
```
i.  Security plans, including Site Security Plan , Site Safeguards and
    Security Plan, MC&A

ii. Security procedures

iii. Operations/Maintenance plans

iv. Proposed operation/maintenance budgets

    a.  Security function and performance tests, (all safeguards and
        security functions)

    b.  Security ORR

    c.  Documentation in support of the SSIMS data registration

```{=html}
<!-- -->
```
7.  Review/finalize security related costs and resources

```{=html}
<!-- -->
```
a.  Direct Project related

b.  Security operations

c.  Project support related

**Transition/Closeout Phase**

1.  Monitor construction closeout and change control

2.  Transition security to an operational status

3.  Continue security-related assessments based on the DBT, security
    policies, and the confirmed security-related:

```{=html}
<!-- -->
```
a.  SNM, other nuclear material, radiological material, biological
    assets (virus samples, etc.), classified and/or sensitive
    information or parts, critical assets, high cost or unique items,
    high availability items (fire station, EOC, etc.)

b.  Potential physical size and location of the project

c.  Potential for hazardous materials

d.  Potential impacts to protective force size and posture

e.  Potential interfaces with emergency management/response assets due
    to nature of the facility

f.  Impacts on existing security infrastructure/operations

g.  Associated security risks

```{=html}
<!-- -->
```
4.  Review final project documentation and construction (As-built) and
    assist in the development of punch lists for:

    a.  General and specific security requirements inclusion in
        engineering and design packages (e.g., barriers, explosives,
        security communications, PF support, entry/access controls,
        intrusion detection/surveillance systems)

    b.  Operational and infrastructure support needed for security
        features

    c.  Interfaces and impacts to and from other sections of the
        engineering and design package (e.g., safety systems, general
        and specific layouts, operational descriptions, etc.)

5.  Provide tasking, as required, to security related disciplines to
    consult on the project (e.g., physical security, information
    security, MC&A, OPSEC, PF, etc.)

```{=html}
<!-- -->
```
a.  Finalize/conduct security-related training

b.  Finalize/conduct security-related operational procedures

c.  Interface with safety and operational training development and
    conduct

d.  Interface with safety and operational procedures

```{=html}
<!-- -->
```
6.  Continue relationships with other team members or disciplines
    involved

```{=html}
<!-- -->
```
a.  Operations

b.  Safety

c.  Engineering

d.  Training

e.  Information/Cyber Security Technologies

f.  Budget

```{=html}
<!-- -->
```
7.  Complete documentation and analysis necessary to support major
    security-related milestones:

```{=html}
<!-- -->
```
a.  Conduct of VAs

b.  Staffing plans

c.  Security System installation

d.  Security documentation updated and completed

    i.  Security plans

    ii. Security procedures

    iii. Maintenance and test plans/procedures

    iv. Proposed operational budgets

e.  Security functional, performance/acceptance tests

f.  Security ORR

```{=html}
<!-- -->
```
8.  Conduct/oversee security-related operational acceptance tests and
    performance-related tests:

9.  Finalize security-related costs, resources and reports

```{=html}
<!-- -->
```
a.  Direct Project related

b.  Security operations

c.  Project support related

d.  SSIMS

**ATTACHMENT 2 - REFERENCES**

**[Legislation]{.underline}**

42 U.S.C. 2011, et seq., Atomic Energy Act of 1954, as amended

42 U.S.C. 7101 to 7386k, Codification of Department of Energy
Organization Act

42 U.S.C. 7144a, Establishment of Security, Counterintelligence, and
Intelligence Policies

41 CFR 102.74, Facility Management

48 CFR 952.204-2, Security Requirements

**[Department Directives]{.underline}**

DOE 205 Series: Although separate from the safeguards and security (S&S)
information security program, the Department's cyber security program
operates under the same basic protection principles. The cyber security
program (including both classified and unclassified cyber security) is
administered by the Department's Chief Information Officer.

DOE O 413.3A, *Program and Project Management for the Acquisition of
Capital Assets*

DOE G 413.3-1, *Management of Design and Construction*

DOE G 413.3-2, *Quality Assurance*

DOE G 413.3-3, *Safeguards and Security for Project Management*

DOE G 413.3-4, *Tailoring*

DOE G 413.3-5, *Performance Baselines & Baseline Management*

DOE G 413.3-6, *High Performance Sustainable Building*

DOE G 413.3-7, *Risk Management*

DOE G 413.3-8, *EM Clean-up Projects*

DOE G 413.3-9, *Project Reviews*

DOE G 413.3-10, *Earned Value Management*

DOE G 413.3-11, *Project Management Lesson Learned Process*

DOE G 413.3-12, *Cost Estimating*

DOE G 413.3-13, *Acquisition Strategies*

DOE G 413.3-14, *IT Projects*

DOE G 413.3-15, *Project Execution Plans*

DOE G 413.3-16, *CD-4*

DOE G 413.3-17, *Mission Need Statement*

DOE G 413.3-18, *Integrated Project Teams*

DOE O 470.4, *Safeguards and Security Program* and DOE M 470.4-X Series
of Manuals

**[Other Federal Directives]{.underline}**

FC 4-010-01, Unified Facilities Criteria, DoD Minimum Antiterrorism
Standards for Buildings

U.S. Army Corps of Engineers, Technical Manual 5-853-4, Electronic
Security Systems; CEGS 13720 series guides, and the PROSPECT Program

GSA Office of Government Policy, Federal Real Property Council Security
Resource Guide

DOJ Vulnerability Assessment of Federal Buildings