AAAAAAAAAAAAAAA 

 

U.S. Department of Energy 

Office of Inspector General 

Office of Audit Services 

Audit Report 

Certification and Accreditation of the 

Department's National Security 

Information Systems 

DOE/IG-0800 August 2008
Department of Energy 

Washington, DC 20585 

August 11, 2008 

MEMORANDUM FOR 

FROM: 

Inspector General 

SIIHJECT: INFORMATION: Audit Report on "Certification and 

Accreditation of the Ilepartment's National Security Information 

Systems" 

BACKGROUND 

The Department of Energy and its facility contractors maintain numerous national 

security information systems that process and store classified data needed to accomplish 

national security goals. Recognizing and addressing the risks associated with operating 

such systems. the Department has adopted a certification and accreditation (C&A) 

process designed to ensure that these systems are secure prior to beginning operation and 

that they remain so throughout their lifecycle. The C&A process includes formal steps to 

recognize and address risks, determine whether system security controls are in place and 

operating ef'fectively, and ensure that changes to the system are adequately tested and 

approved. 

Prior Office of Inspector General reviews have identified concerns with the Department's 

C&A process. For example, our report on C,'erf~ficufion rind Accredilution c?f'Unclu.s.s~fjed 

InfOrm~llion ,5'j:stem.s (DOEJIG-0752, January 2007) found that many of the Department's 

unclassified systems were not properly certified and accredited for operation due to 

inadequate policies and monitoring. In addition, our Special Inquiry on Selected C,'ontrols 

over C1lu.s,s~fied Infi)rmution u! the Los Alumos Nutioncll Luhoru!ory (OAS-SR-07-0 1. 

November 2006) disclosed that system security plans were incomplete and separation of 

duties over systems processing classified information had not been implemented. 

Because of the importance of protecting classified information, we initiated this audit at 

six of the Department's major facilities to determine whether national security 

information systems had been appropriately certified and accredited. 

The Department had taken steps to improve security over its national security information 

systems. Yet. we found that additional actions as part of the C&A process are needed to 

reduce the risk of compromise to these systems. In particular, we found that: 

At five of the six sites included in our audit, risks such as a lack of separation of 

duties and the presence of unclassified and classified systems operating in the 

same environment, had not been addressed in system security plans; 
a In many instances, security plans, or changes to systems, were not appropriately 

approved by Department officials. Further, in certain cases, plans did not 

accurately reflect the actual environment in which the system operated; and, 

a At five of the six sites reviewed, contingency plans had not been developed for 

national security infonnation systems - a critical activity required to mitigate the 

risk of service disruption. 

Several problems contributed to the weaknesses identified during our review. In 

particular, the Department had not yet fully developed and implemented adequate cyber 

security policies to ensure that national security infonnation systems were adequately 

protected. In addition, Federal and contractor officials did not always utilize effective 

mechanisms to monitor performance of security controls. Without inlprovements, the 

Department lacks assurance that its classified data and systems are secure from numerous 

threats and vulnerabilities. The issues identified during our review were similar to those 

that contributed to an environment in which the theft of classified information at the Los 

Alamos National Laboratory occurred in 2006. In our judgment, the findings in the 

attached report suggests that the Department could be at risk for similar diversions. 

We noted that the Department had initiated a wide range of actions to address cyber 

security weaknesses. For example, in response to our Special Inquiry on Selected 

C'ontrols over CTlus.sified 67fi,rmution at the Los Alarnos Nation~ll Luhorcrtory, the Deputy 

Secretary required each site to conduct a thorough examination of the adequacy of its 

practices and procedures to ensure that classified information was protected. In addition, 

the Department updated its Nutionul S"krity Sy.stern Munuul in March 2007 to further 

enhance its cyber protective requirements. While these were positive steps, they have 

not, as evidenced by the findings described in our report, adequately resolved weaknesses 

in controls over national security information systems. In that light, we made several 

recommendations designed to further enhance security over the Department's national 

security information systems. 

Due to security considerations, specific information regarding the locations and systems 

reviewed has been omitted from this report and supplied to Department officials directly. 

MANAGEMENT REACTION 

Management concurred with two of the report's four recomnlendations and pledged to 

take needed corrective actions. In response to management's comments and additional 

technical data provided by program officials. we clarified the intent of the two 

recommendations with which management disagreed. In separate comments, the NNSA 

agreed with the information contained in the report and concurred with each of the NNSA 

specific recommendations. Management's comments are included in Appendix 3. 

Attachment 

cc: Acting Deputy Secretary 

Under Secretary of Energy 

lJnder Secretary for Science 

Administrator, National Nuclear Security Administration 

Chief of Staff 
REPORT ON CERTIFICATION AND ACCREDITATION OF THE 

DEPARTMENT'S NATIONAL SECURITY INFORMATION 

SYSTEMS 

TABLE OF 

CONTENTS 

Protection of National Security Information Systems

Details of Finding ..........................................................................................................1 

Recommendations .........................................................................................................7

Comments .....................................................................................................................8

Appendices

1. Objective, Scope, and Methodology........................................................................9 

2. Prior Reports ..........................................................................................................11 

3. Management Comments ........................................................................................12 
Protection of National Security Information Systems 

________________________________________________________________ 

Page 1 Details of Finding

Ensuring Security Our audit focused on the certification and accreditation 

Over Classified (C&A) of national security information systems and 

Information Systems included the review of 65 systems at six of the Department 

of Energy's (Department) major sites. These systems were 

managed by various elements of the Department, including 

the National Nuclear Security Administration (NNSA), the 

Office of Environmental Management (EM) and the Office 

of Science (Science). 

Our review of these systems disclosed that many of them 

were not appropriately certified and accredited for 

operation. In particular, organizations did not always 

identify and/or address risks to systems to ensure that 

mitigating controls were in place. In a number of instances, 

system security plans reviewed were not appropriately 

accredited, changes were not approved, or the plans did not 

accurately describe the respective systems. In addition, 

sites had not developed and implemented contingency 

plans for national security information systems. 

System Risks

Responsible officials had not ensured that system-specific 

risks, such as those that could allow unauthorized access or 

release of classified information, were addressed in system 

security plans. In particular: 

• Although prohibited by Department policies, 

Information System Security Officers – those 

individuals responsible for ensuring security of an 

information system – were inappropriately granted 

system administrator access for 31 of the 56 

systems reviewed at 5 sites. Officials at two NNSA 

sites informed us that this situation also existed for 

many of their systems not selected for our review. 

As disclosed in our Special Inquiry on Selected 

Controls over Classified Information at the Los 

Alamos National Laboratory, inadequate separation 

of duties can, as a practical matter, allow 

individuals to supervise and approve their own 

work. Despite this risk, the lack of separation of 

duties and needed mitigating controls were not 

addressed in system security plans. 

• While we observed the existence of unclassified and 

national security information systems operating in 

the same environment at certain locations, risks 
 

________________________________________________________________ 

Page 2 Details of Finding

associated with mixed-media environments were 

not always documented in the system security plans. 

This risk – exacerbated by the lack of segregation of 

duties – could permit the transfer of classified 

information to unclassified systems. Absent 

documentation of this risk, the Federal official 

responsible for approving operation of the systems 

may not have been aware of all potential 

vulnerabilities. 

• Risks related to weak methods for implementing 

passwords on national security information systems 

at one NNSA site were not documented. Even 

though the Department directs that computergenerated passwords be used on national security 

information systems, users were permitted to 

manually change passwords outside of automated 

password controls without checks being performed 

to ensure the strength of the password or 

compliance with requirements. Officials at the site 

did not document this weakness in the security 

plans because they did not believe it to be a security 

risk even though the practice was specifically 

prohibited by the Department. Guidance issued by 

the National Institute of Standards and Technology 

(NIST) also stresses that user-created passwords are 

more vulnerable to compromise. 

Security Planning

Designated Approving Authorities (DAA) did not always 

validate and approve system plans or related modifications 

to plans even though significant and unique security risks 

existed. In particular, approvals of system security plans 

were at too high a level and did not consider all variations 

of system risks. At one NNSA site, the DAA approved an 

overarching master security plan and one related sub-plan. 

However, he did not specifically approve the remaining 22 

sub-plans even though significant differences existed 

between them. Rather than provide explicit approval, the 

DAA relied on contractor officials to certify plans for 

systems ranging from supercomputers and classified 

networks to individual computers used to move files 

between classified and unclassified systems. Although 

Department directives permit the use of this master plan 

approach, the operating environments of the systems should 
 

________________________________________________________________ 

Page 3 Details of Finding

be similar. In this instance, the DAA could not ensure that 

all risks to the systems were either addressed through 

mitigating controls or accepted as a residual risk. 

System security plans also did not always accurately reflect 

system accreditation boundaries in that they did not contain 

accurate inventories of hardware associated with the 

system. For instance, a system observed at one NNSA site 

contained ten servers even though none were explicitly 

approved for operation in the security plan. In addition, 

security plans at other NNSA, EM, and Science sites did 

not always contain accurate inventories, in that they 

excluded items such as Universal Serial Bus (USB) 

scanners, a camera, and network and desktop printers. In 

most cases, the DAA did not approve these changes to 

information systems even though the addition of certain of 

those devices may have created additional security risks. 

These issues are similar to weaknesses previously reported 

in our Special Inquiry on Selected Controls over Classified 

Information at the Los Alamos National Laboratory, which 

disclosed that omitting equipment from plans prevented 

security officials from evaluating the impact of these 

changes and may have contributed to an environment in 

which the theft of classified information occurred. As 

noted by NIST, accurate inventories are a key initial step in 

determining what system elements are exposed to security 

risks. 

Contingency Planning

In spite of Federal and Departmental requirements to 

ensure that information systems and data can be recovered 

in the event of a disaster, five sites had not appropriately 

developed and implemented contingency plans for their 

national security information systems. Although 

requirements issued jointly by the NNSA and the 

Department's Chief Information Officer (CIO) mandated 

that at least 80 percent of information systems have a 

documented and tested contingency plan in place by July 

2005, we found that sites had developed such plans for only 

19 of 65 (29%) systems reviewed. Sites had not developed 

contingency plans for systems such as classified computing 

networks utilized by hundreds of users, or for various 

research systems supporting the Department's national 

security mission. In addition, many of the systems without 

contingency plans did not require data backups or the 
 

________________________________________________________________ 

Page 4 Details of Finding

backups were maintained in the same building as the 

original data – sometimes even in the same room. Some 

sites also had either not fully identified mission-critical 

systems or had not prioritized their recovery in the event of 

a disaster. As stressed by NIST, the ability to successfully 

implement contingency planning is essential to mitigating 

the risk of system and service unavailability. Notably, one 

NNSA laboratory had established contingency plans for 

each of the systems that had been included in our review.

Security Policy and We identified several problems that contributed, 

Program Monitoring in part, to the weaknesses in the Department's certification 

and accreditation (C&A) process. In particular, policies 

and guidance did not always clearly define C&A 

requirements. However, even when policies were 

developed, facilities often had not implemented the 

required controls. In addition, performance monitoring by 

Headquarters and site officials was not adequate to ensure 

that requirements were met. Further, we found that similar 

problems disclosed in reports authored by the Department's 

Office of Health, Safety and Security had not been totally 

resolved. 

Cyber Security Policy

Headquarters programs and sites reviewed had not fully 

developed and implemented cyber security policies to 

ensure that national security information systems were 

adequately protected. In particular, policies and guidance 

issued by the Department did not always clearly define 

C&A requirements. For instance, our analysis showed that 

significant security changes were inappropriately made to 

systems due to the lack of guidance or direction as to what 

changes required approval by the DAA. Incomplete 

guidance for contingency planning allowed many sites to 

limit their disaster recovery efforts for national security 

information systems. Although the Department updated its 

National Security System Manual, DOE Manual 205.1-4, 

and required that additional controls be incorporated into 

Program Cyber Security Plans (PCSP), officials from 

Headquarters and sites commented that the new mandates 

were vague and could not be effectively implemented. 

PCSPs were not always updated to reflect the Department's 

new requirements for protecting national security 

information systems and/or had not been implemented by 
 

________________________________________________________________ 

Page 5 Details of Finding

field sites. Specifically, although the Department required 

implementation of its updated National Security System 

Manual by July 2007, the NNSA still had not updated its 

PCSP to include additional requirements. As a result of 

this delay, NNSA sites that were required to follow the 

PCSP continued to implement outdated requirements for 

protecting national security information systems. For 

example, 18 systems at one NNSA site were re-accredited 

since the new manual was issued. However, none of the 

security plans required updated controls such as 

segregation of duties and two-factor authentication1

 for 

system access. Officials at this site commented that 

updated controls would not be implemented until reaccreditation of a system, which would not occur for up to 

three years. Similarly, none of the 10 networks, and nearly 

300 workstations accredited at another NNSA site since the 

new manual was issued, were required to comply with the 

new mandates. Subsequent to our field site reviews, the 

NNSA issued an updated PCSP to incorporate new 

requirements for securing national security information 

systems. If fully implemented, this plan should help 

address a number of weaknesses identified in our report. 

Even when PCSPs were developed by Headquarters 

programs, sites reviewed had not implemented the controls 

required by the plans. Specifically, none of the systems 

accredited at three Science, EM, and Office of Nuclear 

Energy sites after the issuance of updated PCSPs were 

completed in accordance with the new requirements. In 

one case, officials at a Science site acknowledged that the 

lack of separation of duties nullified a number of other 

security controls, including the ability to protect USB ports 

on classified systems. To its credit, this site developed a 

gap analysis describing weaknesses in controls over 

national security information systems and initiated the 

process to correct them. By failing to comply with their 

respective PCSPs, sites had not always implemented 

additional controls designed to enhance security over 

information systems. 

Sites reviewed also had not updated local cyber security 

policies or developed transition plans to ensure that new

 

1

 Two-factor authentication requires two independent ways to establish identity and privileges, such as both 

a physical device and a password, while traditional password authentication only requires knowledge of a 

password to gain access to a system. 
 

________________________________________________________________ 

Page 6 Details of Finding

Department requirements were met. Specifically, several 

sites reviewed had not developed Cyber Security Program 

Plans (CSPP) – site-level policies and procedures designed 

to ensure effective security controls are implemented – that 

included controls in the new National Security System 

Manual. At two NNSA sites, the CSPPs were updated 

more than six months after the issuance of the new manual, 

but still did not include new requirements even though they 

were required by the site contracts. In addition, five sites 

had either not determined what new requirements should be 

implemented or had not established a transition plan to 

meet those requirements. 

Performance Monitoring

Headquarters and field site officials did not always 

implement effective mechanisms to ensure adequate C&A 

of national security information systems. Although NNSA 

Headquarters officials conducted an assessment of 

classified cyber security at two of the sites reviewed, the 

sites were not informed of the results and therefore could 

not develop corrective action plans to address identified 

weaknesses. Timely and effective evaluations may have 

identified many of the weaknesses noted during our review 

and permitted the initiation of corrective actions. 

We also noted that assessments conducted by site-level 

officials were not always effective or were not performed. 

For instance, although one NNSA site office completed an 

evaluation of its laboratory's cyber security program in 

Fiscal Year 2007, it did not identify or track corrective 

actions for weaknesses such as inadequate separation of 

duties or incomplete inventories of equipment in system 

security plans. In addition, the DAA at another site office 

commented that he was unable to conduct effective surveys 

in the past year due to a lack of resources. We also found 

weaknesses in the contractors' self-assessment processes at 

four sites, including untimely assessments and inadequate 

separation between those responsible for testing and 

implementing controls. 

Finally, even though sites and Headquarters officials 

became aware of similar weaknesses through evaluations 

conducted by the Department's Office of Health, Safety and 

Security, they had not always taken appropriate action to 

remediate such vulnerabilities.
 

________________________________________________________________ 

Page 7 Recommendations and Comments

Information Security Without improvements, the Department lacks assurance 

and Assurance that its national security information systems are secure 

from both internal and external threats. As noted in our 

Special Inquiry on Selected Controls over Classified 

Information at the Los Alamos National Laboratory, the 

lack of separation of duties, if exploited, can result in the 

unauthorized exfiltration of classified information to the 

detriment of national security. Similarly, these conditions 

could permit the introduction of unauthorized peripheral 

devices. As a demonstration of the harm that can be caused 

by unapproved devices, we specifically identified an 

unapproved network device during our previous review at 

the Los Alamos National Laboratory that may have 

contributed to a significant theft of classified information. 

In addition, the failure to develop and test contingency 

plans limits the Department's assurance that it will be able 

to restore critical operations in a timely manner in the event 

of a disaster. 

RECOMMENDATIONS To address the issues identified in this report and improve 

controls over national security information systems, we 

recommend that the Department and NNSA CIOs, in 

coordination with the Under Secretary of Energy and the 

Under Secretary for Science, as appropriate: 

1. Ensure that Department policies are updated to 

reflect current requirements for securing national 

security information systems. 

We further recommend that the Administrator, NNSA, the 

Under Secretary of Energy, and the Under Secretary for 

Science: 

2. Ensure that current PCSPs are utilized for all 

future system C&As; and, 

3. Prioritize and immediately implement high-risk 

security controls, such as segregation of duties 

and two-factor authentication, to protect the 

Department's classified information and systems. 

We also recommend that the Administrator, NNSA: 

4. Enhance performance monitoring and oversight 

activities at Headquarters and field sites to ensure 

effective C&A of national security information 

systems. 
 

________________________________________________________________ 

Page 8 Comments

MANAGEMENT Management concurred with recommendations one and 

REACTION three. Specifically, management indicated that steps will 

be taken to update existing security policies and to 

implement high-risk controls over national security 

information systems. Based on management's comments 

and additional technical information provided by program 

officials, we modified recommendation two in our draft 

report to recognize that each of the program's PCSPs had 

now been updated to reflect requirements in the 

Department's new National Security System Manual. The 

updated PCSPs, as the modified recommendation indicates, 

should be used for weaknesses in the NNSA's performance 

monitoring and oversight process. Recommendation four 

was also modified to focus solely on weaknesses in 

NNSA's performance monitoring and oversight process. In 

separate comments, the NNSA agreed with the information 

contained in the report and concurred with each of the 

specific recommendations. The NNSA disclosed that it 

recently updated its cyber security policies and is working 

to implement the recommendations contained in the report. 

AUDITOR Management's comments are generally responsive to our 

COMMENTS recommendations. We continue to recommend that the 

Department's programs utilize their updated PCSPs when 

conducting future C&A activities for national security 

information systems because weaknesses in this area 

directly contributed to problems with implementing 

protective controls. Additional action is also needed to 

enhance the NNSA's performance monitoring process over 

its national security information systems. Management's 

comments are included in their entirety in Appendix 3. 
Appendix 1 

________________________________________________________________ 

Page 9 Objective, Scope, and Methodology

OBJECTIVE The objective of this audit was to determine whether the 

Department of Energy's (Department) national security 

information systems have been appropriately certified and 

accredited for operation. 

SCOPE The audit was performed between October 2007 and May 

2008 at Department Headquarters in Washington, DC, and 

Germantown, Maryland, and five field sites – three 

managed by the National Nuclear Security Administration 

(NNSA), one managed by the Office of Environmental 

Management, and one managed by the Office of Science 

(Science). We also obtained information from an Office of 

Nuclear Energy site not visited. 

METHODOLOGY To accomplish our objective, we: 

• Reviewed Federal regulations and Departmental 

directives and guidance pertaining to certification 

and accreditation (C&A) of national security 

information systems; 

• Reviewed prior reports issued by the Office of 

Inspector General and the Department's Office of 

Health, Safety and Security; 

• Reviewed program and site level policies relevant 

to C&A of national security information systems; 

• Held discussions with program officials from 

Department Headquarters and sites reviewed, 

including representatives from the Office of Chief 

Information Officer (OCIO), Science, and the 

Under Secretary of Energy, as well as the NNSA; 

and, 

• Judgmentally selected a sample of 65 system 

security plans for review to determine whether 

relevant C&A requirements had been implemented. 

The audit was conducted in accordance with generally 

accepted Government auditing standards for performance 

audits and included tests of internal controls and 

compliance with laws and regulations to the extent 

necessary to satisfy the audit objective. Accordingly, we 
Appendix 1 (continued) 

________________________________________________________________ 

Page 10 Objective, Scope, and Methodology

assessed internal controls regarding the C&A of national 

security information systems across the Department. 

Because our review was limited, it would not necessarily 

have disclosed all internal control deficiencies that may 

have existed at the time of our audit. We also assessed 

performance measures in accordance with the Government 

Performance and Results Act of 1993 relevant to C&A of 

national security information systems. We found that two 

of the six field sites reviewed had established limited 

measures specific to this area. We did not rely on 

computer-processed data to satisfy our audit objective. 

Officials from the Office of the Chief Information Officer 

and the NNSA waived an exit conference. 
Appendix 2 

________________________________________________________________ 

Page 11 Prior Reports

APPENDIX 2

PRIOR OFFICE OF INSPECTOR GENERAL REPORTS

Office of Inspector General Reports

• Special Report on Management Challenges at the Department of Energy 

(DOE/IG-0782, December 2007). The Office of Inspector General (OIG) 

identified seven significant management challenges facing the Department of 

Energy (Department), including cyber security. The report noted that although 

the Department had in place an aggressive effort to address existing weaknesses, 

we continued to identify deficiencies, including problems relevant to the 

Department's certification and accreditation of unclassified information systems. 

• Audit Report on Certification and Accreditation of Unclassified Information 

Systems (DOE/IG-0752, January 2007). Many systems were not properly 

certified and accredited prior to becoming operational. For example, 9 of 14 sites 

reviewed had not always properly categorized security levels or risk of damage to 

systems and information contained within, or had not adequately tested and 

evaluated security controls. In many instances, senior agency officials accredited 

systems even though required documentation was inadequate or incomplete, such 

as incomplete inventories of software and hardware included within defined 

accreditation boundaries. In addition, the Office of the Chief Information Officer 

and other program organizations did not adequately review completed activities 

for quality or compliance with requirements. 

• Special Inquiry on Selected Controls over Classified Information at the Los 

Alamos National Laboratory (OAS-SR-07-01, November 2006). We found that 

the security framework at the Laboratory was seriously flawed. For instance, 

security policy in a number of key areas was non-existent, applied inconsistently, 

or not followed. In addition, monitoring by both Laboratory and Federal officials 

was inadequate; critical security functions were not adequately segregated; and 

physical verification of the accuracy of security plans by Federal and Laboratory 

officials was not performed. 

• Evaluation Report on The Department's Unclassified Cyber Security Program - 

2007 (DOE/IG-0776, September 2007). The evaluation identified continued 

deficiencies in the Department's cyber security program that exposed its critical 

systems to an increased risk of compromise. In particular, weaknesses existed 

relevant to system certification and accreditation, contingency planning, access 

controls, configuration management, and change controls. Problems occurred, at 

least in part, because Department organizations had not always ensured that 

Department policies, and cyber security controls were adequately implemented 

and conformed to Federal requirements. 
Appendix 3 

________________________________________________________________ 

Page 12 Management Comments
Appendix 3 (continued) 

________________________________________________________________ 

Page 13 Management Comments 
Appendix 3 (continued) 

________________________________________________________________ 

Page 14 Management Comments 
Appendix 3 (continued) 

________________________________________________________________ 

Page 15 Management Comments 
IG Report No. DOE/IG-0800

CUSTOMER RESPONSE FORM 

The Office of Inspector General has a continuing interest in improving the usefulness of 

its products. We wish to make our reports as responsive as possible to our customers' 

requirements, and, therefore, ask that you consider sharing your thoughts with us. On the 

back of this form, you may suggest improvements to enhance the effectiveness of future 

reports. Please include answers to the following questions if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 

procedures of the inspection would have been helpful to the reader in understanding 

this report? 

2. What additional information related to findings and recommendations could have 

been included in the report to assist management in implementing corrective actions? 

3. What format, stylistic, or organizational changes might have made this report's 

overall message more clear to the reader? 

4. What additional actions could the Office of Inspector General have taken on the 

issues discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may contact you should 

we have any questions about your comments. 

Name Date 

Telephone Organization 

When you have completed this form, you may telefax it to the Office of Inspector 

General at (202) 586-0948, or you may mail it to: 

Office of Inspector General (IG-1) 

Department of Energy 

Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 

Inspector General, please contact Judy Garland-Smith (202) 586-7828. 
The Office of Inspector General wants to make the distribution of its reports as customer friendly 

and cost effective as possible. Therefore, this report will be available electronically through the 

Internet at the following address: 

U.S. Department of Energy Office of Inspector General Home Page 

http://www.ig.energy.gov

Your comments would be appreciated and can be provided on the Customer Response Form.