Nuclear Supply Chain: DOE Should Assess Circumstances for Using Enhanced Procurement Authority to Manage Risk
Released: 2016-08-11T00:00:00

Letter

Background

Within DOE, NNSA conducts its mission activities across several research and development laboratories, production plants, and other sites, known collectively as the nuclear security enterprise. Seven of the eight sites in the nuclear security enterprise, as shown in figure 1, include facilities, equipment, and components owned by NNSA and operated by M&O contractors on behalf of NNSA. Five M&O contractors each operate one site, and one contractor operates both the Pantex and Y-12 sites. M&O contractor activities include, among other things, producing parts or procuring parts from suppliers. For example, the Kansas City National Security Campus produces or procures more than 100,000 parts annually—ranging from nuts and bolts to more complex radar components—including about 85 percent of the components that go into a typical nuclear weapon. We previously reported that the site had increased the percentage of nonnuclear components purchased from external suppliers from about 54 to 70 percent.

DOE’s efforts to manage supply chain risk include the following:

M&O contractors may develop lists of approved suppliers of nuclear weapons components and certain information technology systems. M&O contractor representatives we interviewed said that suppliers are added to the list after an evaluation that examines their ownership or management based on publicly available data and a review of their capability to meet technical and quality assurance requirements.

DOE’s Office of Intelligence and Counterintelligence supports the department by conducting intelligence and counterintelligence activities. For example, the office’s field staff can provide information to M&O contractors when there are potential issues of concern related to a “foreign nexus” of a supplier or potential supplier. If a foreign nexus is identified, the Office of Intelligence and Counterintelligence can perform an in-depth evaluation to determine whether the supplier poses a risk to the supply chain.

DOE’s Office of the Chief Information Officer (OCIO) is responsible for providing, among other things, department-wide guidance, policy, and oversight to ensure secure, efficient, and cost-effective use of information technology resources. DOE program offices can request that OCIO review the risk that an information technology supplier poses to the supply chain. Upon receiving such a request, OCIO assesses the risk using information from open source databases, and works with the DOE Office of Intelligence and Counterintelligence when additional analysis is needed.

In addition, NNSA has taken several steps in recent years to increase its focus on supply chain risk management. For example, in 2011 NNSA initiated a multi-disciplinary effort with the Sandia National Laboratories and the Kansas City National Security Campus, which focused on identifying, analyzing, and mitigating risks that may arise through malicious exploitation of NNSA supply chain and cyber-security vulnerabilities. Also, in 2013 NNSA issued a weapon quality policy, which it updated in 2015, that stated, in part, that information about unique problems, such as the insertion of malicious hardware and software into the supply chain, shall be shared and investigated throughout the nuclear security enterprise. In addition, NNSA officials said the agency was in the process of establishing a Nuclear Enterprise Assurance Steering Group composed of senior NNSA and DOE headquarters officials to provide oversight and management of NNSA nuclear enterprise assurance activities. Such activities include supply chain risk management practices to protect against malicious components that could interfere with the functionality of a weapons system.

The enhanced procurement authority provided by the act applies specifically to supply chain risk for covered systems as follows:

Supply chain risk is the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system or covered item to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of the covered system or item.

Covered systems are primarily nuclear weapons and components and items associated with design, production, and maintenance of such weapons or of nonproliferation and counterproliferation programs and certain information technology systems.

The enhanced procurement authority may provide a tool to help DOE manage supply chain risk in certain circumstances where, under the Federal Acquisition Regulation, DOE might otherwise need to disclose the reason for its determination not to award a procurement contract or subcontract to a particular supplier or DOE’s decision might be subject to appeal. Specifically, the authority permits the exclusion of contractors or subcontractors that pose a supply chain risk and allows DOE to not disclose the reasons for its determination to use the authority and, unlike most other procurement actions, the use of the authority, including the decision to not disclose, is not subject to review in any federal court. In circumstances where DOE uses the enhanced procurement authority, the Secretary is to notify other federal agencies responsible for a procurement that may be subject to the same or similar supply chain risk in a manner and to the extent consistent with the requirements of national security. Under the act, DOE’s enhanced procurement authority will terminate in June 2018, 4 years from the effective date of the act.

DOE Has Not Used or Developed Processes for Using the Enhanced Procurement Authority to Manage Supply Chain Risk

As of May 2016, the Secretary of Energy had not used the enhanced procurement authority, and DOE had not developed processes for using the authority, as it had not fully assessed the circumstances under which the authority might be useful. To use the enhanced procurement authority, the Secretary must be made aware of a supply chain risk. DOE or NNSA officials would have to notify the Secretary that a supplier or potential supplier could pose a significant risk to a covered system. Once the Secretary was made aware of a significant supply chain risk, to use the enhanced procurement authority he or she must make a determination in writing that use of the authority was necessary to protect national security, and that less restrictive measures were not reasonably available to reduce the supply chain risk, among other things. The act requires the Secretary to obtain a risk assessment that demonstrates that there is a significant risk to the supply chain. Although the act does not define the elements of a risk assessment, DOE officials stated that a risk assessment may include a system characterization, threat identification, vulnerability identification, impact analysis, and risk determination, among other things. They stated that the risk assessment would be similar to a risk analysis and mitigation report which the department used to document supply chain issues, such as suspect counterfeit parts. However, DOE had not developed specific processes to collect such information for a risk assessment report and provide it to the Secretary so that he or she could make a determination about whether to use the authority.

DOE officials said that they expect that instances under which the authority would be useful to be infrequent, but that DOE had not conducted an assessment to confirm that view. Some DOE and NNSA officials and M&O contractor representatives expressed uncertainty about whether the authority was needed. According to DOE officials, M&O contractors generally procure the parts for covered systems, and NNSA officials said that it is unlikely that an M&O contractor would need to request that the Secretary use the authority. NNSA and M&O contractor representatives told us, that since M&O contractors are not federal entities, they are not subject to the same procurement restrictions as such entities and already possess the capability to exclude a supplier that poses a supply chain risk. When procuring a part from a supplier, an M&O contractor is generally not required to disclose security-related reasons to a potential supplier to explain why that supplier was not selected. In addition, when an M&O contractor establishes a subcontract with a supplier, the M&O contractor can terminate the subcontract at any time for convenience without providing a reason. Some DOE officials also told us that there are mechanisms within the Federal Acquisition Regulation for federal entities to mitigate supply chain risks for covered system procurements. For example, the Federal Acquisition Regulation states that a federal entity can contract only with a “responsible” supplier. According to DOE officials, a supplier that presents a supply chain risk may not be considered a responsible supplier and may be excluded from a federal contract for a covered system.

Some DOE officials provided us their views about circumstances under which the enhanced procurement authority could be useful; however, as of May 2016, DOE had not fully assessed these or other circumstances under which using the authority would help the department manage supply chain risk. For example, some DOE officials mentioned particular circumstances under which the authority might be useful, such as if DOE learned about an adversary’s connection to a potential or existing supplier and an M&O contractor was not aware of the connection. However, the DOE officials also said that, if such a situation arose, the enhanced procurement authority would not be the only option because DOE’s Office of Intelligence and Counterintelligence could contact the M&O contractor, which could then decide whether to terminate the supplier for convenience, or in the case of a potential supplier, choose another supplier without providing an explanation. Alternatively, some DOE officials said that the enhanced procurement authority could be useful in a case where DOE or NNSA directly contracted with a supplier. However, DOE and NNSA officials said they had not identified the extent to which their direct procurements were for components of covered systems to which the enhanced procurement authority could apply.

Under federal standards for internal control, legislators and others may change either an entity’s objectives or how an entity is to achieve an objective, and management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving the entity’s objectives or addressing related risk. Congress provided the Secretary with the enhanced procurement authority as an additional means to manage supply chain risk, but DOE has not fully assessed how the authority might help the department achieve its objectives. DOE officials said the Nuclear Enterprise Assurance Steering Group, which was still being formed, would be the appropriate group to develop processes for using the enhanced procurement authority. However, without assessing the circumstances under which the authority could be useful, DOE will have difficulty determining the authority’s relevance and, if the authority is considered to be relevant, developing processes for using it. As a result, if the authority is needed, DOE may miss opportunities to use the authority to better manage supply chain risk. Additionally, under federal standards for internal control, management should communicate information externally so that external parties can help the entity achieve its objectives and address related risks. Without assessing the circumstances under which the authority could be useful, DOE will not have information about the relevance of the authority to support congressional decision-making about whether to extend the authority beyond June 2018, when it is currently scheduled to terminate.

DOE Has Not Examined Whether Adequate Resources Are in Place for Using the Enhanced Procurement Authority

DOE has identified resources for potentially using the enhanced procurement authority but has not examined whether these resources are adequate. DOE officials described two types of resources that were in place and that could be important in using the authority: (1) information on DOE, NNSA, or M&O contractor procurements and potential suppliers for those procurements that are gathered from open or classified sources or solicited from potential suppliers, and (2) trained personnel who can evaluate supply chain risks based on that information. For example, DOE’s Office of Intelligence and Counterintelligence and OCIO officials said that they were involved in DOE’s supply chain risk management efforts and that they could collect information on counterintelligence risks posed by potential suppliers to support the use of the enhanced procurement authority. Additionally, DOE has access to other data that could help support the use of the authority. A DOE official told us that, for DOE-led procurements related to covered systems, the department’s Strategic Integrated Procurement Enterprise System (STRIPES) could be queried to identify whether a particular supplier of concern either had a contract or was bidding on a contract. However, DOE officials said since the database does not contain information about M&O contractors’ suppliers, DOE would need to request such information from the M&O contractors.

Although DOE has not fully examined whether adequate resources are in place to support using the enhanced procurement authority, DOE and M&O contractor representatives expressed a range of opinions about whether adequate resources are available. For example, some DOE OCIO officials said that they did not anticipate a need for more resources because of the enhanced procurement authority. Some M&O contractor representatives told us that they might need more trained personnel if they had to follow additional procedures for examining whether potential suppliers had foreign ownership or connections. However, M&O contractor representatives said that they could not assess what resources might be needed to support the use of the authority without a requirement to do so in their M&O contracts and that DOE has not established any such requirements. Establishing a requirement for the M&O contractors to assess available resources could be a component of any process DOE develops for using the authority however, as noted above, DOE has not developed processes for using the authority.

Under federal standards for internal control, personnel need to possess and maintain a level of competence that allows them to accomplish their assigned responsibilities, as established by management to achieve objectives. Management evaluates competence of personnel across the entity in relation to established policies. These standards also state that management should design a process that uses the entity’s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. If DOE determines that some circumstances warrant using the enhanced procurement authority, examining whether its resources are adequate could help ensure that the department can support using the authority in accordance with any processes that it develops.

Conclusions

DOE has taken several steps in recent years to increase its focus on managing supply chain risk. However, 2 years after Congress provided the Secretary with enhanced procurement authority to help manage supply chain risk DOE has not used and has not developed processes for using the authority. While DOE officials expect that instances under which the authority would be useful would be infrequent, given other options DOE and its M&O contractors have to manage risks, DOE has not fully assessed the circumstances where the authority could be useful, consistent with federal standards that call for management to periodically review control activities for relevance and effectiveness. Without assessing the circumstances under which the enhanced procurement authority could be useful, DOE will not know how, if at all, the authority could help it achieve its objective of managing supply chain risk and will not be able to provide information about the relevance of the authority to support congressional decision-making about whether to extend the authority beyond its current termination date. Further, because DOE has not developed processes for using the authority, DOE also has not assessed whether adequate resources—trained personnel and information—are in place to support such processes. Examining whether adequate resources are in place, consistent with internal control standards, could help provide assurance that the resources are available to support using the authority in accordance with any processes that DOE develops.

Recommendation for Executive Action

To ensure that DOE’s control activities continue to be relevant and effective for managing supply chain risk, the Secretary should direct the Under Secretary for Nuclear Security, as the Administrator of the NNSA, to work with the Office of Intelligence and Counterintelligence and other DOE organizations, as appropriate, to assess the circumstances that might warrant using the enhanced procurement authority, and If this assessment identifies circumstances that might warrant using the authority, the Secretary should direct the Under Secretary for Nuclear Security to work with other DOE organizations, as appropriate, to establish processes for using it and examine whether adequate resources are in place to support those processes.

Communicate the results of this assessment to the relevant congressional committees for their use in determining whether to extend the authority past its current termination date.

Agency Comments

We provided a draft of this report for review and comment to DOE. In written comments, reproduced in appendix I, DOE agreed with our recommendation. Specifically, NNSA said it will work with other DOE organizations, as appropriate, in an assessment of the situations that might warrant the use of the enhanced procurement authority. Should specific circumstances be identified to use the authority, NNSA will develop a process for its use, including an assessment of resources supporting the process. NNSA estimated these activities would be completed by December 31, 2016, and the results will be shared with relevant congressional committees. NNSA also provided technical comments that we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Energy, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or neumannj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to the report are listed in appendix II.

Appendix I: Comments from the Department of Energy

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Christopher Murray, Assistant Director; Pamela Davidson; Ellen Fried; Daniel Semick; Alexandra Stone; and Barbara Timmerman made key contributions to this report.