I
106TH CONGRESS
2D SESSION
H. R. 3906
To ensure that the Department of Energy has appropriate mechanisms to
independently assess the effectiveness of its policy and site performance
in the areas of safeguards and security and cyber security.
IN THE HOUSE OF REPRESENTATIVES
MARCH 14, 2000
Mr. BLILEY (for himself, Mr. UPTON, Mr. BARTON of Texas, and Mr. BURR
of North Carolina) introduced the following bill; which was referred to
the Committee on Commerce, and in addition to the Committees on
Armed Services, and Science, for a period to be subsequently determined
by the Speaker, in each case for consideration of such provisions as fall
within the jurisdiction of the committee concerned
A BILL
To ensure that the Department of Energy has appropriate
mechanisms to independently assess the effectiveness of
its policy and site performance in the areas of safeguards
and security and cyber security.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. OFFICE OF INDEPENDENT SECURITY OVER-
SIGHT.
(a) OFFICE.—The Secretary of Energy shall main-
tain an Office of Independent Security Oversight, which
improvement. It also shall perform timely followup
reviews to ensure that corrective actions are effec-
tive, and conduct complex-wide studies of security
issues and generic weaknesses in safeguards and se-
curity.
(2) FUNCTIONS.—The Office of Independent
Security Oversight shall perform the following func-
tions:
(A) Conduct regular evaluations, at least
once every 18 months at each site, of safe-
guards and security programs at Department of
Energy sites that have significant amounts of
special nuclear material, classified information,
or other security interests. The scope of the
evaluations shall include all aspects of safe-
guards and security, including physical protec-
tion of special nuclear material, accountability
of special nuclear material, protection of classi-
fied and sensitive information, personnel secu-
rity, and foreign visits and assignments.
(B) Perform regular assessments of nu-
clear materials assurance at Department of En-
ergy sites.
(C) Evaluate and assess Department of
Energy policies related to safeguards and secu-
rity.
(D) Perform timely followup reviews to en-
sure that corrective actions are effective.
(E) Perform complex-wide studies of issues
and generic weaknesses in safeguards and secu-
rity.
(F) Develop and validate reports that iden-
tify findings and issues, and make recommenda-
tions for improvement.
(G) Review other government and commer-
cial safeguards and security programs to pro-
vide a benchmark for Department of Energy
performance.
(H) Develop recommendations and oppor-
tunities for improving safeguards and security
for submittal to the Secretary.
(I) Any other function the Secretary con-
siders appropriate and consistent with the mis-
sion described in paragraph (1).
(c) CYBER SECURITY.—
(1) MISSION.—The Office of Independent Secu-
rity Oversight shall be responsible for the inde-
pendent evaluation of the effectiveness of classified
and unclassified computer security policies and pro-
grams throughout the Department of Energy (in-
cluding the National Nuclear Security Administra-
tion). This consists of establishing and maintaining
a continuous program for assessing Internet security
to include offsite scanning and controlled penetra-
tion attempts to detect vulnerabilities that could be
exploited by hackers. The Office shall also conduct
timely followup reviews to ensure that corrective ac-
tions are effective, and perform complex-wide studies
and analyses of events associated with computer se-
curity programs.
(2) FUNCTIONS.—The Office of Independent
Security Oversight shall perform the following func-
tions:
(A) Conduct regular evaluations of classi-
fied and unclassified computer security pro-
grams at Department of Energy sites, with
sites having significant amounts of special nu-
clear material, classified information, or other
security interests being evaluated at least once
every 18 months.
(B) Establish and maintain a continuous
program for assessing Internet security to in-
clude offsite scanning and controlled penetra-
tion attempts to detect vulnerabilities that could
be exploited by hackers and ensure they are
corrected by line management.
(C) Evaluate and assess Department of
Energy policies related to classified and unclas-
sified computer security.
(D) Perform timely followup reviews to en-
sure that corrective actions are effective.
(E) Perform complex-wide studies of issues
and generic weaknesses in computer security
programs.
(F) Develop and validate reports that iden-
tify findings and issues, and make recommenda-
tions for improvement.
(G) Review other government and commer-
cial computer security programs to provide a
benchmark for Department of Energy perform-
ance.
(H) Develop recommendations and oppor-
tunities for improving cyber security for sub-
mittal to the Secretary.
(I) Any other function the Secretary con-
siders appropriate and consistent with the mis-
sion described in paragraph (1).
SEC. 2. REPORTS TO CONGRESS.
(a) REPORT BY OFFICE.—The Office of Independent
Security Oversight shall, before February 15 of each year,
transmit to the Secretary of Energy and to the Congress
an unclassified report, with a classified appendix if re-
quested or necessary, summarizing the activities of the Of-
fice during the immediately preceding calendar year. Such
report shall include—
(1) an overview of the status of security at the
Department of Energy in the areas of responsibility
of that Office;
(2) a description of significant problems and de-
ficiencies, by site if applicable, identified in such se-
curity areas;
(3) a description of recommendations for cor-
rective action made by the Office during the report-
ing period with respect to significant problems or de-
ficiencies identified pursuant to paragraph (2);
(4) the adequacy of corrective actions, if any,
taken by the Department to address such problems
and deficiencies;
(5) an identification of each significant problem
or deficiency described in previous annual reports on
which corrective action has not been effectively com-
pleted;
(6) a summary of each significant report made
to the Secretary pursuant to this Act during the re-
porting period;
(7) a description and explanation of the reasons
for any significant revisions to security policy deci-
sions made during the reporting period; and
(8) a description of any significant security pol-
icy decision with which the Director is in disagree-
ment.
(b) REPORT BY SECRETARY.—The Secretary of En-
ergy shall, before March 15 of each year, transmit to the
Congress an unclassified report, with a classified appendix
if requested or necessary, summarizing the Secretary’s re-
sponse to the Office’s annual report submitted under sub-
section (a). Such report from the Secretary shall include—
(1) an identification of each significant prob-
lem, deficiency, or recommendation identified in the
Office’s annual report with which the Secretary is in
disagreement;
(2) an explanation of the reasons for any fail-
ure on the part of the Department of Energy to
complete effectively corrective actions recommended
by the Office in its previous annual reports; and
(3) a description of the Secretary’s response to
each significant report made to the Secretary pursu-
ant to this Act during the reporting period.
(c) PUBLIC AVAILABILITY.—Within 60 days after the
transmission of the annual report of the Office of Inde-
pendent Security Oversight under subsection (a), the Sec-
retary of Energy shall make copies of the unclassified por-
tions of such report available to the public upon request
and at a reasonable cost. Within 60 days after the trans-
mission of the annual report of the Secretary under sub-
section (b), the Secretary shall make the unclassified por-
tions of such report available to the public upon request
and at a reasonable cost.
(d) SPECIAL REPORTS.—The Director of the Office
of Independent Security Oversight shall report imme-
diately to the Secretary of Energy and the Congress when-
ever the Director becomes aware of particularly serious or
flagrant problems or deficiencies relating to the security
programs, practices, or operations of the Department of
Energy. The Secretary shall, within 7 calendar days after
receiving a report under this subsection, report to Con-
gress on the corrective actions taken to address such prob-
lems.
(e) DIRECT REPORTING.—The Director of the Office
of Independent Security Oversight shall report directly to
the Congress with respect to those matters identified in
subsections (a) and (d), and the Secretary of Energy shall
not alter, modify, or otherwise change the substance of
any such report, nor shall the Secretary prevent, prohibit,
or delay any such report.
(f) CONGRESSIONAL TESTIMONY AND BRIEFINGS.—
The Director of the Office of Independent Security Over-
sight, whenever called to testify before any Committee of
Congress or to brief its Members or staff, shall provide
the Secretary of Energy with advance notice of the subject
matter of that testimony or briefing, but the Secretary
shall not alter, modify, or otherwise change the substance
of such testimony or briefing, or prevent, prohibit, or delay
such testimony or briefing.
Æ