Nuclear Security: DOE Could Improve Aspects of Nuclear Security Reporting
Published: 2017-04-11T00:00:00

Fast Facts:
The Department of Energy operates sites that hold special nuclear material—such as highly enriched uranium—which can be used to make nuclear weapons. Due to the sensitive nature of these sites, DOE must annually report on the status of their security infrastructure to Congress.
DOE's reports identified challenges that could affect the security at some of its sites, and we found that the agency is not fully prepared to address these challenges. Among other things, we recommended that DOE develop a plan to address physical security infrastructure needs—such as fences, alarms, and sensors—at its sites.

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOE and NNSA operate sites with facilities holding special nuclear material that can be used to make nuclear weapons. The National Defense Authorization Act of 2014 requires the Secretary of Energy to submit to congressional committees a report detailing the status of security at sites holding key quantities of special nuclear material, along with a certification that the sites meet DOE's security standards and requirements by December 1 of each year. The law requires DOE's reports to include a similar report from NNSA. A report accompanying the legislation included a provision for GAO to evaluate these efforts. This report examines (1) the extent to which these DOE and NNSA reports meet the definition of quality information under federal internal control standards, and (2) any significant physical security challenges at sites that the reports or agency officials identified and the extent to which the agencies have addressed them. GAO reviewed the 2014 and 2015 reports and interviewed agency officials.
section_title: What GAO Found
paragraphs: The Department of Energy's (DOE) and the National Nuclear Security Administration's (NNSA) annual reports for 2014 and 2015 on the security of nuclear facilities holding special nuclear material did not fully meet the definition of quality information under the federal internal control standards. These standards define quality information as appropriate, current, complete, accurate, accessible, and provided on a timely basis. GAO found that, in general, while the reports were based on current information and were accessible to Congress, they did not fully meet quality information standards because the reports:
did not always contain complete information on the assessments used to support the agencies' certifications that sites are secure and
were not provided to Congress in a timely manner.
For example, DOE's 2015 annual security report did not mention whether an important assessment was conducted at two of its four sites or include information regarding the date or outcome of the assessment at three of its four sites. NNSA's 2015 annual security report noted its sites conducted these assessments; however, it did not provide information regarding the date or outcome at one site. Without complete information on the assessments used to determine each site's overall security assessment, it was not always possible to determine the basis for the site security certification solely using the information contained in the reports. In addition, GAO found that DOE's and NNSA's annual 2014 and 2015 security reports were issued several months late. DOE officials told GAO the delay was partly due to the lengthy internal review process. DOE and NNSA stated that they would promptly report any serious security issues to Congress using means other than the annual security reports. When the reports are issued late, however, Congress may not routinely receive timely notice of issues so that it can take actions to improve sites' security.
GAO's review of the annual security status reports and interviews with agency officials indicated that DOE and NNSA share significant challenges that could affect their ability to maintain physical security at sites and certify them as secure. For example, security infrastructure, such as fences, alarms, and sensors, at many DOE and NNSA facilities is outdated and requires extensive maintenance to ensure proper functioning. NNSA is developing a physical security infrastructure plan to be issued in spring 2017, but DOE has not fully developed plans or estimated costs to address its needs. Additionally, DOE has not fully implemented a June 2011 order, which could result in some nuclear materials requiring additional security. GAO found that even though the order called for implementation plans within 6 months of its issuance, one DOE site, with the approval of the Deputy Secretary of Energy, will not have an implementation plan until 2018. Based on GAO's review and the comments of agency officials, neither the 2014 and 2015 security reports provided comprehensive risk and potential vulnerability information to Congress nor had these issues been communicated through other means.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOE include more complete information in the reports, better align the review process and mandated deadlines, plan for infrastructure needs, and inform Congress of the reason for delays in implementing its June 2011 order and any identified vulnerabilities. DOE raised concerns with the first recommendation, generally agreed with the second and the third, and stated it had already implemented the fourth. In response, GAO modified the first recommendation and will assess DOE's implementation of the fourth.

section_title: Letter
paragraphs: The Department of Energy (DOE) and its National Nuclear Security  Administration (NNSA) are responsible for protecting special nuclear  material, including plutonium and highly enriched uranium, which can be  used in nuclear weapons or to construct an improvised nuclear or  radiological device. A successful attempt by terrorists or others to steal,  sabotage, or otherwise gain unauthorized access to special nuclear  material could help them develop weapons that could be used against the  United States. The security of DOE and NNSA facilities that store and  process special nuclear material has raised concerns, particularly after a  serious security incident in 2012 in which three trespassers gained  unauthorized access to the protected area of NNSA’s Y-12 National  Security Complex in Oak Ridge, Tennessee. This incident led to a 2-week  stand-down of that site’s operations. According to DOE’s Inspector  General, the security incident was unprecedented and represented  multiple system failures, including failures to maintain critical security  equipment, respond properly to alarms, and understand security  protocols. In addition, in a fiscal year 2017 report, DOE’s Office of  Inspector General listed safety and security as one of the most significant  management challenges the department faces.
DOE classifies special nuclear material into categories according to its  risk, threat, and consequence potential for direct use in producing a  significant nuclear yield or the production of a device that could do so.  When in specified forms and quantities, category I special nuclear  material represents the highest level of consequence for misuse and loss,  is of high strategic significance, and must be protected from theft,  unauthorized use, diversion, or sabotage. Category II, the next highest level of consequence, is of moderate strategic significance because it  could be, among other things, combined, or “rolled up,” to category I  quantities. Other categories of nuclear material represent lower levels of  consequence; they are not, by themselves, capable of producing a  nuclear yield but must be secured to prevent theft or the accumulation of  category I quantities, among other things.
DOE and NNSA, working through contractors, each manage four sites  that have a number of facilities that store or process category I and  category II special nuclear material. DOE’s four sites are managed by its  Office of Environmental Management within the Office of Management  and Performance, which is led by the Under Secretary for Management  and Performance, as well as by its Office of Science and its Office of  Nuclear Energy, which are both led by the Under Secretary for Science  and Energy. NNSA, which is led by the Under Secretary for Nuclear  Security, who also serves as the Administrator, manages its four sites.
DOE’s Office of the Associate Under Secretary for Environment, Health,  Safety, and Security is responsible for comprehensive security policy for  DOE and NNSA. In addition, DOE’s Office of Enterprise Assessments,  which reports directly to the Secretary of Energy, manages an  independent oversight program for safety and security at DOE and NNSA  sites.
In December 2013, Congress passed the National Defense Authorization  Act of 2014. The act, as amended, requires the Administrator of NNSA  to, by September 30 of each year, submit to the Secretary of Energy a  report detailing the status of security at NNSA facilities holding category I  and category II quantities of special nuclear material, and provide written  certification that the facilities are secure and meet DOE’s and NNSA’s  security standards and requirements. In addition, the act requires the  Secretary of Energy to submit to the congressional defense committees a  report detailing the status of security at DOE’s atomic energy defense  facilities holding category I and category II special nuclear material, and  provide written certification that the facilities are secure and meet DOE’s  security standards and requirements by December 1 of each year. DOE  is also to submit the unaltered report from NNSA at the same time.  According to the law, if the Secretary or Administrator is unable to make  the required written certification, they shall submit corrective action plans  describing the deficiency resulting in being unable to make the  certification, actions to be taken to correct the deficiency, and timelines  for taking such action. The Secretary of Energy submitted DOE’s and  NNSA’s annual security reports for 2014 and 2015 and certified in the  reports that all relevant facilities are secure.
The Senate Armed Services Committee report accompanying the  National Defense Authorization Act for Fiscal Year 2014 included a  provision for us to review and report on DOE and NNSA efforts related to  the security of special nuclear material. This report examines (1) the  extent to which DOE’s and NNSA’s annual reports on the security of sites  holding category I or category II special nuclear material meet the  definition of quality information under federal internal control standards,  and (2) any significant physical security challenges at these sites that the  reports or DOE or NNSA officials identified, and the extent to which DOE  and NNSA have addressed these challenges.
To examine the extent to which DOE’s and NNSA’s annual reports on the  security of sites holding category I or category II special nuclear material  meet the definition of quality information contained in the information and  communication standard under the federal internal control standards, we  analyzed the act to determine the reporting requirements for DOE and  NNSA and analyzed the content of DOE’s and NNSA’s 2014 and 2015  reports as compared with the definition. Federal internal control standards  promulgated in 1999 were in effect until October 1, 2015, and contained a  standard related to information and communication. This standard  stated that for an entity to run and control its operations, it must have  relevant, reliable, and timely communications related to internal as well as  external events. Federal internal control standards issued in 2014 and in  effect as of October 1, 2015, define quality information under the  information and communication standard as being appropriate, current,  complete, accurate, accessible, and provided on a timely basis. The  1999 federal internal control standards were in effect when NNSA and  DOE completed reports in response to the December 1, 2014, and  September 30, 2014, reporting requirements. However, DOE and NNSA  completed reports in response to the December 1, 2015, and September  30, 2015, requirements after the revised federal internal control standards  took effect in October 2015. Given that the 2014 and 2015 annual  security reports were completed when different internal control standards  applied, for ease of comparison between the reports, we applied the  current, 2014, internal control standards to both reports. Further, we  applied the 2014 internal control standards as they are the applicable  standards moving forward, and DOE and NNSA have an annual  requirement to provide the security reports to Congress. A federal control  standard related to timeliness was in effect under the 1999 standards and  is currently included in the internal control standards effective in October  2015. In addition, we obtained and reviewed DOE’s order regarding its  Safeguards and Security Program, which establishes DOE security  program planning and management requirements. We developed a data  collection instrument to obtain information on the scope and currency of  physical security information that was incorporated into the annual  security reports from DOE and NNSA program offices that operate the  relevant sites. The information we requested included dates of the sites’  most recent security plans, vulnerability assessments, and independent  assessments by the Office of Enterprise Assessments. We relied on  information contained in the annual security reports as well as on  testimonial evidence from DOE and NNSA officials on the reporting of  these dates, as well as on the extent to which site-level physical security  measures may satisfy DOE’s current and expected requirements and  standards for nuclear material control and accountability or physical  security. We did not independently review and verify whether site  responses and the resulting reports were accurate.
To examine any significant physical security challenges at these sites and  the extent to which DOE and NNSA have addressed these challenges,  we reviewed the annual security reports and interviewed DOE and NNSA  officials to identify any concerns about security challenges at their sites  with category I or category II nuclear material. We reviewed DOE orders  and documents that may affect DOE’s and NNSA’s standards and  requirements for physical security, including DOE’s design basis threat  order, which specifies the potential size and capabilities of adversary  forces against which the sites must defend; its nuclear material control  and accountability order; and its order for its physical security program.  In addition, we interviewed DOE and NNSA officials to determine how the  November 2016 design basis threat order may affect physical security  arrangements at specific facilities at DOE and NNSA sites. We also  interviewed DOE and NNSA officials to determine how the agencies have  responded to any identified challenges. We compared this information  with other relevant work, including leading practices for capital planning  contained in GAO’s Executive Guide and OMB’s Capital Programming  Guide.
We conducted this performance audit from April 2016 to April 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: This section provides information on key DOE and NNSA nuclear sites,  key DOE security concepts and processes, and DOE and NNSA  processes to develop their annual security reports.
subsections: section_title: Key DOE and NNSA Nuclear Sites, Locations, and Purpose
paragraphs: There are four DOE and four NNSA sites holding category I and category  II special nuclear material to carry out the agencies’ nuclear missions:  DOE’s Hanford Site, Idaho National Laboratory, Oak Ridge National  Laboratory, and Savannah River Site and NNSA’s Los Alamos National  Laboratory, Nevada National Security Site, Pantex Plant, and Y-12  National Security Complex. DOE’s Under Secretary for Management and  Performance, DOE’s Under Secretary for Science and Energy, and  NNSA’s Administrator are to ensure that each of the sites they manage  has a safeguards and security program with the necessary protections to  protect security interests against malevolent acts such as theft; diversion;  sabotage; compromise; or unauthorized access to nuclear weapons,  nuclear weapons components, or special nuclear material. Figure 1  provides information on the missions of DOE and NNSA sites containing  category I and category II special nuclear material.
DOE orders establish requirements that must be met for all DOE and  NNSA operations except under certain conditions, with appropriate  approvals. DOE’s overall risk-based security directive is contained in  DOE Order 470.4B, Safeguards and Security Program, and was updated  in February 2013, and most recently in January 2017. A key component  of DOE’s approach to security is the design basis threat order, a  classified document that identifies the characteristics of the potential  threats to DOE and NNSA assets. The design basis threat order is  based on a classified, multiagency intelligence community assessment of  potential terrorist threats.
DOE and NNSA counter the terrorist threat specified in the design basis  threat order with a multifaceted protective system. All protective systems  at DOE’s and NNSA’s most sensitive sites employ a defense-in-depth  concept with multiple layers of physical security measures designed to  work in concert to deter, detect, assess, communicate about, delay, and  respond to intruders or unauthorized activities. The protection strategy  also includes personnel security, information security, and material  control and accountability elements. According to the DOE Standard:  Nuclear Materials Control and Accountability, a material control and  accountability program is to ensure that all accountable nuclear materials  are in their authorized location and are being used for their intended purposes such that single component failures will not result in significant  vulnerabilities. These various security measures typically include  physical security features and systems, such as integrated cameras,  alarms, and motion sensors; fences and anti-vehicle barriers; and  numerous access control points, such as turnstiles, badge readers, and  vehicle inspection stations. At most sites, these measures are integrated  into perimeter intrusion detection systems. Each site generally has a  heavily armed protective force that is often equipped with such items as  automatic weapons, night vision equipment, body armor, and chemical  protective gear. In addition, each site is to follow a specific protection  strategy based on the type of special nuclear material it must protect.
According to NNSA officials, the performance of protective systems is to  be formally and regularly examined through vulnerability assessments,  which are systematic risk-based evaluations in which qualitative and  quantitative techniques are applied to detect vulnerabilities and determine  how to effectively protect specific assets, such as special nuclear  material.
The results of the vulnerability assessments, other performance  assessments, and expert analysis are to be used to establish the specific  security measures, equipment, and requirements for a site, which are to  be documented at each site in a classified security plan. In addition to  identifying known vulnerabilities, risks, and protection strategies for  mitigating these risks and vulnerabilities for the site, the plan formally  acknowledges how much residual risk DOE is willing to accept. For more  than 2 decades, DOE has employed a risk-based approach to security  that seeks to direct resources to its most critical assets—in this case  category I special nuclear material—and mitigate risks to these assets to  an acceptable level. According to DOE officials, levels of risk—high,  medium, and low—are assigned classified numerical values and are  derived from a mathematical equation that compares a terrorist group’s  capabilities with the overall effectiveness of the crucial elements of the  site’s protective forces and systems.
Through a variety of complementary inspections and assessments, DOE  ensures that its contractors are implementing its safeguards and security  policies and that its systems are performing as intended. Contractors  perform regular self-assessments. DOE’s safeguards and security order  also requires relevant security offices to comprehensively survey  contractors’ operations for safeguards and security regularly. In addition,  DOE’s Office of Enterprise Assessments is to conduct independent  assessments that appraise, among other things, DOE and NNSA physical  security systems, personnel security, protective forces, and nuclear  material control and accountability practices to identify gaps and  vulnerabilities. According to DOE Office of Enterprise Assessments  officials, they assess security at DOE and NNSA category I sites about  every 2 years.
section_title: Overview of DOE and NNSA Processes to Develop Annual Security Reports
paragraphs: In general, DOE and NNSA have employed similar processes to develop  and produce their annual security reports. DOE’s Office of the Associate  Under Secretary for Environment, Health, Safety, and Security and  NNSA’s Office of Security Operations and Performance Assurance within  the Office of the Associate Administrator for Defense Nuclear Security  coordinate each agency’s report development effort. According to DOE  and NNSA officials in those offices, in the summer of each calendar year  the agencies request information from sites containing category I or  category II special nuclear material. The agencies give their sites about 3  weeks to respond to these requests and to provide the requested  documentation. Officials said that once the responses are received,  DOE Office of Environment, Health, Safety, and Security and NNSA  Office of Defense Nuclear Security officials synthesize the relevant sites’  responses and respectively develop the DOE and NNSA draft reports,  which then are submitted for review by General Counsel and the relevant  Under Secretaries, including the NNSA Administrator. NNSA then sends  its report to DOE for transmittal, and the Secretary of Energy transmits  both reports to Congress, along with his certification.
section_title: DOE’s and NNSA’s 2014 and 2015 Annual Security Reports Did Not Fully Meet the Definition of Quality Information under the Federal Internal Control Standards
paragraphs: DOE’s and NNSA’s 2014 and 2015 annual reports on the security of  nuclear facilities holding category I and category II quantities of special  nuclear material did not fully meet the definition of quality information in  the 2014 federal internal control standards. Under the 2014 federal  standards for internal control, management should use quality information  to achieve the entity’s objectives. The information and communication  standard defines quality information as appropriate, current, complete,  accurate, accessible, and provided on a timely basis. DOE’s and  NNSA’s reports met certain aspects of the definition of quality information  in that they were based on current information and were accessible.  However, the reports did not always contain complete information on the  important assessments that the agencies used in their certification of  sites’ security. Moreover, they were not provided in a timely manner as  called for by both the 1999 and 2014 federal internal control standards.
subsections: section_title: DOE’s and NNSA’s 2014 and 2015 Annual Security Reports Were Based on Current Information and Were Accessible
paragraphs: We found that, in general, the 2014 and 2015 annual security reports—in  which DOE and NNSA certified that their sites met current security  requirements and standards—partially met the definition of quality  information in the 2014 federal standards for internal control in that they  were based on what was currently available information at the time they  were prepared. For example, DOE and NNSA attested through responses  to our data collection instrument that their assessments were based on  the most current reviews of a site’s security plan, vulnerability  assessments, security surveys, and independent assessments that were  available when the reports were being drafted. Moreover, DOE and  NNSA officials told us that the agencies prepare their annual security  reports by drawing on existing and well-established DOE processes for  verifying the adequacy of security at facilities, such as formally approved  security plans and independent assessments. With respect to being  accessible, we verified that NNSA provided its annual security reports to  DOE, and DOE provided both agencies’ reports to the appropriate  congressional committees. While the reports are classified and thus not  publicly available, DOE delivered the reports to the respective  committees’ security offices, where they were available to recipients with  the appropriate clearances and need to know. In addition, a DOE official  provided us with evidence that DOE had briefed congressional staff on  the reports.
section_title: DOE’s and NNSA’s 2014 and 2015 Annual Security Reports Did Not Always Contain Complete Information on the Important Assessments Used to Certify Sites’ Security
paragraphs: We found that DOE’s and NNSA’s 2014 and 2015 annual security reports  did not always meet the definition of quality information as called for in the  2014 federal internal control standards because they did not always  contain complete information that provided the basis for the agencies’  certifications in the reports that sites are secure. Generally, we found that  NNSA’s reports included information on a wider range of individual site  security assessments than did DOE’s reports. However, neither DOE’s  nor NNSA’s reports contained complete information to support the  agencies’ assessments that all of the relevant sites were secure. For  example, DOE’s 2015 annual security report did not mention whether a  vulnerability assessment was conducted at two of its four sites or include  any information regarding the date or outcome of the most recent  vulnerability assessments at three of its four sites. NNSA’s 2015 annual  security report noted that its four sites conducted vulnerability  assessments, but one site did not provide information regarding the most  recent completion date of its vulnerability assessment. Table 1 indicates  the extent to which DOE’s and NNSA’s reports contained complete  information regarding the important assessments—security plans,  vulnerability assessments, independent assessments, and other  assessments—that officials said were used to certify that sites are  secure.
In general, without complete information on the assessments—that is,  security plans, vulnerability assessments, independent assessments, and  other assessments—that officials said were used to determine each site’s  overall security assessment, it was not always possible to determine the  basis for the site security certification solely using the information  contained in the reports. To better understand the basis for the agencies’  certifications that relevant sites were secure, we requested and were  provided additional information from relevant DOE and NNSA sites  regarding key dates for assessments, including dates for a site’s most  recent security plan, most recent vulnerability assessment, and last  independent assessment by the Office of Enterprise Assessments. We  found that all this information was available for all the DOE and NNSA  sites covered in our review.
As noted earlier, to develop the reports, DOE and NNSA request  information from sites on, among other things, the outcomes of site-level  assessments, such as site vulnerability assessments and independent  assessments. According to NNSA documentation, the information NNSA  requested included: a summary of the state of security at the relevant category I or a summary listing of the equivalencies and exemptions in place for  DOE security orders at the site; and a description of the most recent site security plan and vulnerability  assessment; results of inspections, such as independent  assessments, by DOE’s Office of Enterprise Assessments and  contractor self-assessments; and descriptions of any vulnerabilities or  challenges the site identified that might hamper its ability to certify it is  secure at present or in coming years.
A DOE Office of Corporate Security Strategy official told us that, unlike  NNSA, DOE does not use a standard data request to solicit information  from its sites. Instead, a DOE Office of Environment, Health, Safety and  Security official stated that each program office requests essentially the  same information from its respective sites, as detailed above in the NNSA  request.
DOE Office of Environment, Health, Safety and Security and NNSA  officials told us that responses by sites to these requests varied in terms  of the types of information and level of detail provided. This may  contribute to the variation of information contained in the report for each  site. In addition, according to DOE officials, the draft report was more  detailed in the first internal draft and modified to adjust to the  recommended report size and level of detail by the DOE Executive  Secretariat templates and standards. However, DOE officials from the  Office of Environment, Health, Safety, and Security stated that the final  level of detail provided in the annual security reports is consistent with the  law. These and other DOE officials stated that although the annual  security reports may not always contain all the specific details of the  information used to inform the Secretary’s security certification, DOE’s  assessment of security is based on a wide array of data and information  from the sites and from headquarters. The officials also stated that report  preparers had access to such sources of information at the time they  developed the report content. These officials stated that including all  these sources in the report would be overwhelming and would distract  from the substantial issues important to ensure the continued security of  special nuclear material. Nonetheless, DOE officials also acknowledged  the desirability of incorporating greater detail in order to create a greater  degree of transparency. Furthermore, they said that DOE is open to  exploring ways of expanding the level of detail and transparency in future  reports. For example, DOE Office of Environmental Management officials  suggested that DOE include a bibliography in its reports to list the  sources it consulted while developing them.
With such additional detail available in the reports, users of the report  would be more readily able to determine if DOE’s certification that its sites  are secure is based on current and complete information. Additional detail  would also provide better evidence that similar complete information was  assessed across the DOE and NNSA sites to make the certifications, and  it would be more consistent with DOE’s mandate to submit reports that  detail the status of security of atomic energy defense facilities holding  category I and category II quantities of special nuclear material.
section_title: DOE’s and NNSA’s 2014 and 2015 Reports Were Not Provided in a Timely Manner
paragraphs: We further found that DOE’s and NNSA’s annual security reports for 2014  and 2015 were not provided in a timely manner as called for by both the  1999 and 2014 federal internal control standards. To date, neither agency  has met the mandated deadlines for submitting the reports. The  Administrator of NNSA is required to provide NNSA’s report to DOE by  September 30, and the Secretary of Energy is required to submit NNSA’s  and DOE’s reports to Congress by December 1 of each year. Table 2 lists  the required completion date for the 2014 and 2015 yearly report and,  where available, the month and year each report was provided to the  relevant entity.
DOE and NNSA officials told us the 2014 and 2015 reports were issued  late in part because the requirement did not provide guidance on the  information that should be contained in the report. As a result, the  agencies struggled internally to determine the content of the reports in  response to the requirement to report and certify the security of DOE and  NNSA sites. In addition, lengthy internal review times also contributed to  delays in issuance. For example, DOE officials stated that the 2014 and  2015 DOE annual security reports were substantially drafted, and  contained virtually all of what would become the final submitted content,  by mid-October of the reporting year but were delayed by the internal  review process. The officials stated that, despite the delay, the lengthy  internal review process served some good in that it provided substantial  opportunity for multiple DOE managers and organizations to engage with  the content of the reports. DOE and NNSA officials said that they were  working on improving the timeliness of the reports and noted that the  2016 reports had been submitted to Congress on a more timely basis.
When the reports are issued late, Congress may not receive information  detailing identified deficiencies and corrective actions that the agencies  are taking or are planning to take to address such deficiencies in a timely  fashion. DOE officials told us that they would promptly report any serious  security issues to Congress using means other than the annual security  reports. In addition, officials said any problems would be immediately  addressed by employing compensatory measures, which are generally  temporary because of their high cost. However, agency officials  acknowledged it may take the agencies several years to secure the  funding necessary to implement long-term solutions to the problems.  For example, a DOE Office of Science and Nuclear Energy official stated  that funding for problems identified in the fall of 2016 would not be  reflected in the budget cycle until fiscal year 2019 because the  department would have already largely developed its fiscal year 2018  budget request. By continuing to focus on better aligning the internal  review process and report publication deadlines, DOE and NNSA could  help ensure that Congress routinely receives timely notice of any  deficiencies to enable it to take actions to improve sites’ security.
section_title: Known Challenges Could Affect Some Sites’ Physical Security, and DOE Could Take Additional Steps to Address Them
paragraphs: The annual security reports and our interviews with agency officials  indicate the agencies have identified challenges that could affect physical  security at some NNSA and DOE sites but that DOE has not completed  plans to address these challenges. More specifically, DOE and NNSA  share two significant challenges that could affect their abilities to maintain  physical security and certify sites holding category I and category II  special nuclear material as secure, and DOE faces an additional  challenge. The shared challenges are (1) fully analyzing and meeting  security requirements contained in the new design basis threat order, a  classified document issued in November 2016 that specifies the potential  size and capabilities of adversary forces that the sites must defend  against, and (2) maintaining and updating aging physical security  infrastructure. The additional challenge for DOE is to complete  implementation of a 2011 order for nuclear material control and  accountability. DOE officials told us they believe that the DOE annual  security reports have made a significant positive contribution by  highlighting these key challenges and served a valuable function in  identifying emerging concerns.
Concerning the first shared challenge, DOE’s and NNSA’s annual  security reports and officials at the agencies noted that the issuance of a  new design basis threat order presents a challenge to most sites because  it will require significant time and resources for officials to fully analyze  and meet the new requirements and possibly drive new or different  security requirements for some facilities and materials. Agency officials  told us it may take 2 or more years to plan for and make the necessary  changes to security at sites in response to the recently issued design  basis threat order. For example, they said that each site plans to  conduct new vulnerability assessments and develop and validate a new  security plan in response to the new design basis threat order. Further,  DOE officials confirmed that it may take several years to develop the  justification and obtain resources for these changes. According to DOE  officials, DOE and NNSA sites are required by the 2016 design basis  threat order, within 180 days of approval, to either inform the cognizant  Under Secretary that the site is in compliance with the order or submit a  timeline to develop an implementation plan.
Concerning the second shared challenge, DOE’s and NNSA’s annual  security reports and officials at the agencies noted that the physical  security infrastructure at many DOE and NNSA facilities is outdated and  requires extensive continued maintenance to ensure proper functioning.  This outdated infrastructure includes perimeter intrusion detection and  assessment systems and alarm stations, which are important  components of DOE’s defense-in-depth concept. According to agency  officials and documents, addressing such upgrades could require  significant time and funding. While this challenge is shared by both DOE  and NNSA sites, NNSA is in the process of developing a security  infrastructure plan, as required by law, that will outline and prioritize the  costs and time frames necessary to address physical security challenges  at its sites. Such a plan is to provide the basis for NNSA to request the  additional funds necessary to address physical security infrastructure  challenges at its sites. NNSA in March 2017 projected it may need more  than $1 billion over the next 10 years to upgrade essential security  infrastructure. DOE officials told us they do not have a similar  requirement to develop a physical security infrastructure plan and that,  while several of their sites face significant physical security issues related  to aging infrastructure, they have not fully developed plans that would  allow them to prioritize decisions based on infrastructure needs or  estimated costs to address those needs. One DOE site has attempted  to address its challenges and minimize its investment in physical security  infrastructure needs by disposition of its special nuclear material into  other forms or by transferring it to other sites, but it has been delayed in  doing so. Specifically, as we reported in July 2005, Oak Ridge National  Laboratory originally planned to dispose of its category I special nuclear  material by 2014; however, DOE officials we interviewed for this review  told us that this disposition has been delayed until 2023, and funding  constraints could delay the date until 2027.
Although DOE sites are in various stages of addressing physical security  infrastructure challenges, without a DOE physical security infrastructure  plan to address these issues across sites, including major projects,  expected costs, and time frames, DOE officials and Congress will not  have a comprehensive view of the challenge, and the future security of  DOE sites holding category I and category II special nuclear material may  be compromised. We have previously identified leading practices for  making capital planning and investment decisions, drawn primarily from  GAO’s Executive Guide and OMB’s Capital Programming Guide. These  leading practices include undertaking a comprehensive needs  assessment to determine immediate requirements as well as future  needs, and developing a long-term capital plan. Further, OMB capital  planning and budgeting guidance to executive agencies emphasizes that  when planning and budgeting for infrastructure asset investments,  agencies should consider the full costs of ownership over the life of an  asset, to include a life-cycle assessment of a project’s initial costs as well  as the longer-term costs for maintenance, operation, and disposal.
Concerning the additional challenge for DOE, the June 2011 nuclear  material control and accountability order update required sites to develop  implementation plans within 6 months of its issuance, including timelines  and resources needed to implement the order and a description of the  vulnerabilities and impacts created by any delayed implementation of the  requirements. According to DOE Standard: Nuclear Materials Control and  Accountability, each site or facility operator needs to establish a  sustainable, effective graded safeguards program for the control and  accounting of nuclear materials to detect and deter theft and diversion,  and to prevent the unauthorized control of a weapon, test device, or  materials that can be used to make an improvised nuclear device.  Material control and accountability programs are to ensure that all  accountable nuclear materials are in their authorized location and are  being used for their intended purpose such that single component failures  will not result in significant vulnerabilities. According to DOE, an effective  and efficient material control and accountability program is based on the  consequences of the loss or misuse of nuclear materials. Although the  new order was issued in 2011, DOE officials told us that the security  strategy at two sites changed in 2015, which resulted in new  implementation plans in 2016. Officials stated that both sites are currently  undertaking implementation activities, which should be complete by the  middle of 2017. With respect to the third site, in 2014 the Deputy  Secretary of Energy, citing other more pressing security concerns at the  site, approved the delayed completion of the site’s implementation  strategy and plan until 2018. DOE officials said that full implementation of  the order at this site could result in the need for additional and potentially  costly security measures to mitigate potential vulnerabilities. They also  said that even when plans for this site are complete, implementing them  will likely take many years.
The full implications of DOE’s delay in completing plans and  implementing security strategies associated with the June 2011 order  have not been fully determined. For example, sites may have to  recategorize nuclear material from category II to category I as a result of  implementing the order, and would then be potentially responsible for  funding and implementing additional measures to ensure that those  nuclear materials are protected at a higher level as detailed in DOE’s  Safeguards and Security Program. The 2011 order required sites to  develop implementation plans within 6 months. Further, according to the  order, if implementation of all requirements under a site’s implementation  plan was not possible within 6 months of the order’s issuance, sites were  supposed to document any requirements that could not be implemented  within 6 months of the effective date of the order or within existing  resources and submit to the relevant program officers and relevant Under  Secretaries. According to the order, this documentation was to include  timelines and resources needed to implement the order, and a description  of the vulnerabilities and impacts created by the delayed implementation  of the requirements. DOE officials told us that although the 2014 and  2015 DOE annual security reports discussed this issue, neither report  fully conveyed the potential seriousness of it nor had any of the detailed  information—timelines and resources needed to implement the 2011  order, and a description of the vulnerabilities and impacts created by the  delayed implementation of the requirements of the order—been  communicated to Congress through the reports or through other means.  Our review of the 2014 and 2015 reports confirmed that the discussion of  this issue had been limited. DOE officials said they believe that the 2016  report provides a more detailed discussion of the issue. Because all  required implementation plans have not been developed, nor have they  been fully implemented, DOE may have unaddressed security risks.
section_title: Conclusions
paragraphs: Special nuclear material could be used by terrorists to make a nuclear  weapon or to construct an improvised nuclear or radiological device, and protecting this material is vital to our national security. The serious  security incident at the Y-12 National Security Complex in 2012  demonstrated unacceptable security problems at one site but also raised  questions about the security of other DOE and NNSA sites that hold  category I and category II special nuclear material. As a result of  increased scrutiny and at the direction of Congress, DOE and NNSA  officials examined the security of their category I and II special nuclear  material sites and certified in their 2014 and 2015 reports that they were  secure. Officials of both agencies said that they have improved their  process for producing the reports over time and are open to incorporating  other improvements. In addition, DOE and NNSA officials told us they  believe that the annual security reports have made a significant positive  contribution by highlighting key security challenges. We found that while  annual reports were based on current information and were accessible,  they were not always complete in terms of the assessments—security  plans, vulnerability assessments, independent assessments, and other  assessments—used to support the agencies’ assertions that all of the  relevant sites were secure. In addition, the reports have not been  provided in a timely manner, in part because of a lengthy internal review  process. Providing more complete information would allow Congress to  better determine whether DOE’s and NNSA’s certification that their sites  are secure is based on complete and current information. Additional  information in the reports would also provide better evidence that similar  information was assessed across the DOE and NNSA sites to make the  certifications. Further, providing additional information would be more  consistent with DOE’s mandate to submit reports that detail the status of  security of facilities holding category I and category II special nuclear  material. In addition, delays in issuing the reports may in turn affect  congressional efforts to address any issues identified in the reports. While  DOE and NNSA have made some progress in providing Congress with  reports in a timelier fashion, by continuing to focus on better aligning the  internal review process and mandated deadlines, DOE and NNSA further  ensure that Congress receives timely notice of any deficiencies to enable  it to take actions to improve sites’ security.
The quality of information contained in the reports is increasingly  important as DOE and NNSA communicate significant challenges that  could affect their ability to certify that their category I and II facilities  holding special nuclear material are secure. For example, DOE and  NNSA share the common challenge of an aging physical security  infrastructure at some sites. While NNSA is currently developing a plan  that will identify the cost of, and time frames for, addressing the physical  security infrastructure challenges at its sites, DOE has not done so.
Without a similar DOE physical security infrastructure plan that would  allow the agency to prioritize decisions based on infrastructure needs,  DOE officials and Congress will not have a comprehensive view of the  challenge, and the future security of DOE sites holding category I and  category II special nuclear material may be compromised. DOE also  faces a long-standing challenge in planning for and implementing a June  2011 nuclear material control and accountability order. DOE officials told  us that although the 2014 and 2015 annual security reports discussed this  issue, neither of the reports fully conveyed the potential seriousness of it.  DOE officials said that their 2016 annual security report provides a more  detailed discussion of the issue. Because all required implementation  plans have not been developed, nor have they been fully implemented,  DOE may have unaddressed security risks.
section_title: Recommendations for Executive Action
paragraphs: We are making four recommendations in this report.
We recommend that the Secretary of Energy, working with the  Administrator of the National Nuclear Security Administration, take the  following two actions.
Include more complete information on the assessments—that is,  security plans, vulnerability assessments, independent assessments,  and other assessments—used in the annual reports to support the  agencies’ assessments that DOE and NNSA sites are secure.
Better align the internal review process and mandated report  publication deadlines.
Additionally, we recommend that the Secretary of Energy take the  following two actions.
Develop a plan for addressing the physical security infrastructure  needs at DOE sites. Similar to a report under development by NNSA,  this plan could identify cost and time frames and enable DOE and the  Congress to prioritize these projects.
In future annual security certification reports, inform Congress of the  reasons for the delayed implementation of the June 2011 DOE  material control and accountability order at some sites, as well as the  steps DOE and its sites are taking to implement it. DOE should also  provide Congress with information on any vulnerabilities or  deficiencies in the security at sites that may potentially exist while the  sites complete implementation of the order as well as information on  any concomitant adjustment to their security posture that is required.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided DOE and NNSA a draft of this report for comment. DOE and  NNSA provided a coordinated written response, which is reproduced in  appendix I. In the comments, which DOE transmitted, DOE raised  concerns about the first finding and recommendation, stated it accepted  the second, agreed with the third, and said it had already implemented  the fourth, as discussed below. DOE and NNSA also provided technical  comments, which we incorporated as appropriate.
In overarching comments, DOE stated that some statements in the draft  report inaccurately imply that DOE and NNSA annual reports do not meet  OMB Circular A-123 (A-123) federal internal control standards and that  the assessments are not supported by documentation of internal control  assessments, and that these statements should be removed from the  report. DOE, in its comment letter, states that the department has a  robust, A-123 compliant internal control program under which rigorous  annual internal control testing is conducted by all DOE program offices  and sites. We acknowledge the agency’s point as we did not did not  review DOE’s annual process for conducting internal control assessments  and have deleted any mention of A-123 from the report.
In commenting on our recommendations, DOE stated that our first  recommendation about the need to include more complete information in  the annual security reports would be more beneficial if it were rewritten to  use only the congressional language of the fiscal year 2014 NDAA in  evaluating what the report should do. DOE stated that it was also  concerned by the assertions that the level of detail in the 2014 and 2015  reports was insufficient to meet the legislative requirement for the  Secretary of Energy to certify that nuclear materials are secure, that the  relevant security standards and requirements are being met, and that any  existing deficiencies have been acknowledged and corrective actions  outlined. DOE also stated that the legislative intent of this requirement  was to produce an executive level summary report. DOE suggested that it  would be more appropriate for us to assess the reports against the intent  of the legislative requirement contained in the NDAA. DOE also stated the  agencies’ security certifications were based on recent information and  were well-founded.
As noted earlier, the Senate Armed Services Committee report  accompanying the National Defense Authorization Act for Fiscal Year  2014 included a provision for us to review and report on DOE and NNSA  efforts related to the security of special nuclear material; this provision did  not require us to assess the legal sufficiency of DOE’s reports, nor did it  confine us to focusing on compliance with legislative requirements. We do  not state that the agencies’ reports fail to meet legislative requirements.  However, we believe that the reports could be improved. As such, we  stand by our analysis and believe that using the definition of quality  information under federal internal controls standards is useful and  appropriate criteria for assessing the 2014 and 2015 security reports.  Furthermore, based on discussions with agency officials, we specified in  our report and modified our recommendation to include exactly the kinds  of assessment information—security plans, vulnerability assessments,  independent assessments, and other assessments— DOE could  consistently include in the reports that would make them more complete.  Through our review, we verified that this information is readily available  from each of the 8 sites.
In its letter, DOE stated that it is committed to strengthening the reports  by providing more useful detail and is working with Congress to facilitate  its efforts to do so. For example, in its letter DOE stated that, as a result  of discussions with congressional committees, the National Defense  Authorization Act for Fiscal Year 2017 amended the original legislative  requirement to make certification requirements identical for DOE and  NNSA, a change that DOE describes as a significant improvement to  ensure consistency in certification across sites with category I and II  special nuclear material. DOE also stated in its letter that it may consider  development of a proposal to Congress regarding modification of the  frequency of the current reporting requirement. When we met with agency  officials in February 2017 to discuss the draft report, they suggested that  a biennial reporting period would better align with important security  assessment schedules and would assist in providing current and  complete information on site security. We are encouraged by DOE’s  stated focus on efforts to improve the reports and their belief that such  improvements would better help ensure consistency in certification across  all the sites. We believe that implementing our recommendation to include  more complete information in the reports would support these efforts.
DOE stated that it accepted our second recommendation about better  aligning the internal review process and mandated report publication  deadlines for annual security reports. DOE also notes, however, that the  report suggests that the lack of timely reporting deprives the Secretary  and Congress of information they need to act in response to potential  deficiencies. DOE stated that the department and NNSA do not rely on  the annual report to provide all levels of higher management with  information about urgent issues the moment they are identified, but that  they also interact with congressional staff across the gamut of security  issues. This is acknowledged in our report, but we continue to believe that  when the reports are issued late, Congress may not receive information  detailing identified deficiencies and corrective actions that the agencies  are taking or are planning to take to address in a timely fashion. Our  report also notes that because of the annual budget cycle, once a security  problem is identified, it can take as many as two years before Congress  can take actions, such as providing additional funding, to address the  problem. Our report further describes how some of these actions can take  many years and resources and sustained effort to implement. In its  comments, DOE stated it has already accomplished significant  improvement in the timeliness of its internal review process, as evidenced  by the more timely completion of its 2016 annual security report. Our  report acknowledges DOE’s more timely submission of the 2016 reports.   We continue to believe, however, that when reports are issued late,  Congress may not routinely receive timely notice of issues so that it can  take actions to improve sites’ security.
DOE agreed with our recommendation about developing a plan for  addressing the physical security infrastructure needs at DOE sites, which  could identify cost and time frames and enable DOE and Congress to  prioritize these projects. DOE stated that its Security Committee, which is  responsible for developing security policy, has made this a priority and is  developing strategies to resolve this and future enterprise-wide security  concerns.
DOE stated it has already implemented our last recommendation to  include in future annual security certification reports the reasons for the  delayed implementation of the June 2011 order at some sites, as well as  the steps DOE and its sites are taking to implement it and provide  Congress with information on any vulnerabilities or deficiencies in the  security at sites that may potentially exist while the sites complete  implementation of the order as well as information on any concomitant  adjustment to their security posture that is required. It its letter, DOE said  its 2014 report provided a detailed narrative explanation of the rationale  for the 2011 order change and an explanation of how its sites had  initiated the process to determine potential security impacts. DOE further  stated that its 2015 report summarized its evolving understanding of the  impact of this issue, and that its 2016 report is even more explicit in  characterizing the extent of potential problems and suggesting the shape  of emerging solutions. DOE also said that its future reports would more  clearly explain why implementation has extended over multiple years.
Our review of the 2014 and 2015 reports and the comments of agency  officials interviewed during the course of our review, however, indicate  that neither of the reports fully conveyed the potential seriousness of the  issue. In addition, neither report communicated to Congress the timelines  and implementation resources needed and a description of the  vulnerabilities and impacts created by the delayed implementation of the  requirements of the order. As discussed earlier, DOE provided its and  NNSA’s 2016 reports to Congress in January 2017 after we had  completed our audit work and delivered our draft report to the agencies  for comment. As a result, we have not yet assessed DOE’s position that  the 2016 report, in combination with the 2014 and 2015 reports,  addresses our fourth recommendation. We will assess DOE’s efforts,  including the 2016 report, as part of our monitoring of the implementation  of these recommendations.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Energy, the Administrator of the National  Nuclear Security Administration, and other interested parties. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-3841 or oakleys@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.
section_title: Appendix I: Comments from the Department of Energy and the National Nuclear Security Administration
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Jonathan Gill (Assistant  Director), Antoinette Capaccio, Justin Fisher, Michelle Munn, and Cynthia  Norris made key contributions to this report.