# Presentation: 464142

## INTEGRATED SAFEGARDS & SECURITY MANAGEMENT  (ISSM) 

**IMPLEMENTATION @ BWXT PANTEX**
**Peggy Finney, Program /Project Manager **
**Safeguards & Security Division**
**Amarillo, Texas  **
**Security Awareness Special Interest Group (SASIG) Workshop and Meeting**
**April 13-14, 2004**** **

**Notes:**
S&S & Plant Project Integration  / ISSM Lead and other hats. 

## ISSM OBJECTIVE

**Perform Work Securely**
- Systematically integrate safeguards and security into management and work practices at all levels so that missions are accomplished securely.
**Based On Worker Participation**
**Accomplished Through Management**
- Setting Expectations
- Providing Tools to Meet Expectations
- Assessing System & Feedback to the System
**Expectation is that ...ISSM will not prevent “all” security incidents but will significantly reduce their probability.**

**Notes:**
For BWXT Pantex.....ISSM must be accomplished within current resources.  

## ISSM DEFINITION

**A formal, organized process whereby people plan, perform, assess, and improve the secure conduct of work in a technically defensible, effective, and efficient manner.**

**Notes:**
.........ISSM Is Not Another Security Program

## ISSM “In Place” @ BWXT Pantex Where We Were in 2001.. 

- ISSM Posters in Place Through Out BWXT Pantex Security Areas
- ISSM Hotline and Groupwise Email Address Established
- Intranet Web Page Created
- ISSM Narrative In Plant’s Annual Computer Based Training  (CBT) Program
- One Time Security Awareness Flyer Added to Employee Paycheck Envelopes

**Notes:**
ISSM was determined in place by BXWT Pantex in FY2001 with the above elements in place.
Assessing current implementation we found, 
Posters are in high traffic areas – most have been taken down or replaced. Good Reminded but the program has to be enhanced to be effective

Concern with our Security Hotline we will address at the end of the presentation

Assuming control of this program – re-evaluated where we were in ISSM the hardest part was trying to identify what exactly ISSM mission is and how to implement that mission. 

## Minimum ISSM Framework Elements To Declare ISSM “In Place” 

- Element 1: *	*DOE Requirements established & contained in 		M&O Contracts
- Element 2 : 	ISSM System Description developed and 			approved
- Element 3: 	ISSM Self Assessment Performed*  *
- Element 4: 	ISSM System Review and Update Process
- Element 5:  Functional Line Oversight Program

## FY04 ISSM - ADVANCEMENTS IN IMPLEMENTATION

- Protecting National Security Objective Incorporated Into BWXT Pantex Strategic Plan
- ISSM Project Review Team Established
- Enhanced Project Review
- Historical Storage of Project Review Responses
- New Business Process Based Document Management System
- Line Management Assessments
- Software Identification, Inventory, & Categorization for Safety, Security, & Quality Assurance

**Notes:**
After must study and interaction with other sites, the above constitute this FY’s path forward For ISSM. 

## ELEMENT 1 Requirements In M&O Contract & Contract Flow Down Documents

- DOE P 470.1 Added To M&O Contract (09/02)
- ISSM Requirement Added to Directive 0001 (08/03)
- ISSM Roles and Responsibilities Added to S&S Plant Standard 4501 (08/03)
- ISSM Requirements Added to Plant Operating Procedures Upon Annual Review and Update  (Began 08/03)

## ELEMENT 2  System Development

**Enhanced Approach to Reviewing/Approving Work From S&S Perspective**
- ISSM Team Includes SME In All Security Programs** **
- ISSM Team Reviews **All **Work at Pantex
- Security & Cross-cutting Program Requirements Integrated Into All Projects Reviewed
- Special Security Plan Requirement For Activity Not Covered By  SSSP
- ISSM  Project Review & Storage Data Base
- Assess and Measure Success of Integration Process

## Slide 9

**Notes:**
However busy this appear....it is reflective of the new process for reviewing all work.  The previous review process placed limitations on the security programs that reviewed the planned work.  Sometimes work was already underway before the appropriate security reviews were performed.  It is unknown if work was taking place or had taken place without our knowledge. 
1. The new process covers all types of work being performed: ie 1st Box.  
2. The new process moves the responsibility for security reviews from the project manager to the ISSM team.  Security subject matter experts review the work and determine which security requirements apply.
3. The old process preformed review and assessed if work is covered under the current SSSP or if a VA needs to be performed...the new process documents requirement for a Special Security Plan in the event work is NOT covered by the current site security plan. Previously......here was no system in place that asked this question consistently looking at all work and including all security program requirements...a good example is notification to FOCI personnel of new sub-contracted work.  
4. Allowances for changes to the scope of work and responsibility to present the change for ISSM team review is incorporated into the process. 
5. Approval Signature Sheets have been developed base on business process owner that have oversight that work is performed within the process requirements. 
6. A new data base for the storage of ISSM team requirement responses has been developed and old documents have been scanned into the data base for historical reference. 
7. Data storage is significant to the Self Assessment Programs, Line Management Assessments, and  Audit & Survey inquiries. 
8. A method for specifically designed method that allow for work to stop is a threat to national security is perceived or other security non-compliance or concern is revealed. 

## ELEMENT 2  System Development

**Document Management System**
**Business Requirements Instruction Network**
- Defining Roles & Responsibilities Relative To Business Processes *(****Not**** Organizational Structure)*
- Web-Based Interface Links Related Business Functions & Identifies All Stakeholders
- Identifies & Integrates All Plant Requirements
- Clarifies Individual Responsibility
- Promises Competence Commensurate with Responsibilities

**Notes:**
A 2nd very effective business tool that  will allow a broad spectrum of personnel at the plant to acquire a knowledge of security requirements is the  Plant effort to transition to a new automated, and  business process based, document management system.  The new system, based on Kansas City’s Doc Mgnt System, is an effort to place all things in one place. Efforts are underway to define the processes at Pantex from a Business Perspective....not organizational.  There has been a tremendous amount of effort involved in converting our old requirments document heirachy system (and all other documents used for instruction) to process documents from which work instructions flow).  This is a tremendous tool by whiich we can get the word out quickly concerning security measures, controls, requirements and/ or any other information and actually reduces redundacy in documentation and conflicting information.          

## Four S&S Business Processes @ BWXT Pantex:  

- Controlled Access
- Nuclear Material Control & Accountability
- Maintaining Secure Information & Matter
- Maintaining Secure Facilities & Equipment

**Notes:**
Along with all other plant process, S&S owned process are defined above. 

## Slide 12

## ELEMENT 3 ISSM SELF ASSESSMENTS

- Self Assessment Performed in FY2002
- FY03 Self Assessment Not Scheduled or Performed
- FY04 Self Assessment Will Be Performed As An Amendment To the FY04 Approved Schedule

## ELEMENT 4ISSM REVIEW & UPDATE PROCESS 

- Metrics Are Being Developed To Measure Implementation of Program
- Metrics Are Pending for Measuring Effectiveness of Overall Program

## ELEMENT 5FUNCTIONAL LINE OVERSIGHT PROGRAM

- Scheduled in Late FY04 After Other ISSM Elements Are Better Established.
- Plans To Link Security Requirement to Plant Business Requirement Document Management System.

## ISSM Concerns.....

- Plant Support To Security Hotline Very Low
- Competing With Other Hotline Programs (No More Surprises)
*PX ISSM Hotline* Report Ave of **4 **Security Concerns **/Yr**
*PX No More Surprises* Report Ave of **48 **Security Concerns **/Yr**
- Value-Added Is In Question
- Assessment of the Program In Progress
- Culture Change is Slow....

**Notes:**

....but...we are finding that the plant population wants to protect national security

Possible Factors/ Reasons for this:
OPSEC POC in each division are trained to respond to security concerns
Most process changes do not have security implications
Multiple hotlines at Plant Site...confusing and ....the ISSM hotline has been mistakenly named  SPO Hotline. 

## FY2004 PERCENT ISSM IN PLACE  

## Future Goals

- Enhanced Contribution to Plant Lessons Learned Program
- Enhanced Security Plan Program
- Link Incident Reporting to Security Hotline
- Enhanced Line Management Assessment Program
- Effectiveness & Performance Assessment