DOE is responsible for a diverse set of missions, including nuclear security, energy research, and environmental cleanup. These missions are managed by organizations within DOE and largely carried out by M&O contractors at various DOE sites. According to federal budget data, NNSA is one of the largest organizations in DOE, overseeing nuclear weapons, nuclear nonproliferation, and naval reactors missions at its sites. With an $11 billion budget in fiscal year 2012—nearly 40 percent of DOE’s total budget—NNSA is responsible for providing the United States with safe, secure, and reliable nuclear weapons in the absence of underground nuclear testing and maintaining core competencies in nuclear weapons science, technology, and engineering. Ensuring a safe and reliable nuclear weapons stockpile is an extraordinarily complicated task and requires state-of-the-art experimental and computing facilities, as well as the skills of top scientists in the field. To its credit, NNSA consistently accomplishes this task, as evidenced by the successful assessment of the safety, reliability, and performance of each weapon type in the nuclear stockpile since its creation. To support these capabilities into the future, in 2011, the administration announced plans to request $88 billion from Congress over the next decade to operate and modernize the nuclear security enterprise. As discussed earlier, work activities to support NNSA’s national security missions are largely carried out by M&O contractors. This arrangement has historical roots. Since the Manhattan Project produced the first atomic bomb during World War II, NNSA, DOE, and predecessor agencies have depended on the expertise of private firms, universities, and others to carry out research and development work and efficiently operate the facilities necessary for the nation’s nuclear defense. Currently, DOE spends 90 percent of its annual budget on M&O contracts, making it the largest non-Department of Defense contracting agency in the government. DOE generally regulates the safety of its own nuclear facilities and operations at its sites. In contrast, the Nuclear Regulatory Commission (NRC) generally regulates commercial nuclear facilities, and the Occupational Safety and Health Administration (OSHA) generally regulates worker safety at commercial industrial facilities. However, because of the dangerous nature of work conducted at many sites within the nuclear security enterprise—handling nuclear material such as plutonium, manufacturing high explosives, and various industrial operations that use hazardous chemicals—oversight of the nuclear security enterprise is multifaceted. First, DOE policy states that its M&O contractors are expected to develop and implement an assurance system, or system of management controls, that helps ensure the department’s program missions and activities are executed in an effective, efficient, and safe manner. Through these assurance systems, contractors are required to perform self-assessments as well as identify and correct negative performance trends. Second, NNSA site offices, which are collocated with NNSA sites, oversee the performance of M&O contractors. Site office oversight includes communicating performance expectations to the contractor, reviewing the contractor’s assurance system, and conducting contractor performance evaluations. Third, DOE’s Office of Health, Safety, and Security—especially its Office of Independent Oversight—conducts periodic appraisals to determine if NNSA officials and contractors are complying with safety and security requirements. Fourth, NNSA receives safety assessments and recommendations from other organizations, most prominently the Safety Board—an independent executive branch agency created by Congress to assess safety conditions and operations at DOE’s defense nuclear facilities. To address public health and safety issues, the Safety Board is authorized to make recommendations to the Secretary of Energy, who may then accept or reject, in whole or in part, the recommendations. If the Secretary of Energy accepts the recommendations, the Secretary must prepare an implementation plan. DOE and some of its contractors have viewed this multifaceted oversight to be overly burdensome. To address this issue, in March 2010 the Deputy Secretary of Energy announced a reform effort to revise DOE’s safety and security directives and modify the department’s oversight approach to “provide contractors with the flexibility to tailor and implement safety and security programs without excessive federal oversight or overly prescriptive departmental requirements.” In the memorandum announcing this effort, the Deputy Secretary noted that burdensome safety requirements were affecting the productivity of work at DOE’s sites and that reducing this burden on contractors would lead to measurable productivity improvement. The Deputy Secretary noted that DOE’s Office of Health, Safety and Security in 2009 had begun reforming its approach to enforcement and oversight. Similar to, but independent of DOE’s safety and security reform effort, in February 2011, NNSA initiated its “governance transformation” project, which involved revising the agency’s business model to, among other things, place more reliance on contractors’ self-oversight through its contractor assurance system to ensure such things as effective safety and security performance. NNSA’s non-nuclear Kansas City Plant completed implementation of this new business model, and other NNSA sites—such as the Nevada National Security Site and the Y-12 National Security Complex—were in the process of implementing it, too, when the Y-12 security incident occurred. In response to the Y-12 security breach, multiple investigations and reviews of the incident were performed by NNSA, the DOE Office of Inspector General, and the DOE Office of Independent Oversight. These reviews identified numerous problems with NNSA’s and its contractors’ performance, including: physical security systems, such as alarms; protective force (i.e., NNSA’s heavily armed, contractor guard forces) training and response; failures to correct numerous known problems; and weaknesses in contract and resource management. In addition, at the request of the Secretary of Energy, an independent panel, composed of three former executives from Federal agencies and the private sector, and a NNSA Security Task Force found broader and systemic security issues across the nuclear security enterprise. The Secretary’s panel in December 2012 analyzed various models for providing security at DOE and NNSA sites but generally found that improvements to the security culture, management, and oversight were necessary, in addition to having an effective organizational structure. In addition, the leader of the NNSA Security Task Force testified before the House Armed Services Committee in February 2013 about significant deficiencies in NNSA’s entire security organization, oversight, and culture. In response to the Y-12 security incident and these findings, DOE and NNSA took a number of immediate actions, including repairing security equipment, reassigning key security personnel, and firing the Y-12 protective force contractor. In February 2013, the Acting NNSA Administrator committed to implementing a three-tiered oversight process involving contractor self-assessment, NNSA evaluation of site performance, and independent oversight by DOE’s Office of Independent Oversight. The Acting Administrator testified before the House Armed Services Committee that she believed that such actions will help instill a culture that embraces security as an essential element of NNSA’s missions. In assessing DOE’s actions to address the security breakdowns at Y-12, a central question will be whether these latest actions taken will produce sustained improvements in security at Y-12 and across the nuclear security enterprise. As we and others have reported, DOE has a long history of security breakdowns and an equally long history of instituting responses and remedies to “fix” these problems. For example, in examining the Y-12 security incident, NNSA’s former Acting Chief of Defense Nuclear Security and the leader of the NNSA’s Security Task Force testified in February 2013 about problems with NNSA’s federal security organization including poorly defined roles and responsibilities for its headquarters and field security organizations, inadequate oversight and assessments of site security activities, and issues with overseeing contractor actions and implementing improvements. As noted in table 1, 10 years ago we reported on very similar problems, and since that time DOE has undertaken numerous security initiatives to address them. We have not evaluated these recent initiatives but we have ongoing work to evaluate them as part of our review on security reform for the Subcommittee, which we will complete later this year. It is also important to note that NNSA’s long-standing security problems are not limited to Y-12. DOE’s and NNSA’s work with nuclear materials such as plutonium and highly enriched uranium, nuclear weapons and their components, and large amounts of classified data require extremely high security, however, as we and DOE have reported, NNSA and DOE have a long history of poor security performance across the nuclear security enterprise, most notably at Los Alamos and Livermore national laboratories, as well as ongoing struggles to sustain security improvements, including information security. As we noted in our September 2012 testimony, Los Alamos National Laboratory (Los Alamos) experienced a number of high-profile security incidents in the previous decade that were subject to congressional hearings, including some held by this Subcommittee. Many of these incidents focused on Los Alamos’s inability to account for and control its classified resources. These incidents include the transfer or removal of classified information from authorized work areas or the laboratory itself, the temporary loss of two hard drives containing nuclear weapon design information, and difficulties in accounting for classified removable electronic media. In addition to these well-publicized incidents, security evaluations through 2007 identified other persistent, systemic security problems at Los Alamos. These problems included weaknesses in controlling and protecting classified resources, inadequate controls over special nuclear material, inadequate self-assessment activities, and weaknesses in the process that Los Alamos uses to ensure it corrects identified security deficiencies. Partly as a result of these findings, as we reported in 2008, Los Alamos underwent a 10 month shut-down of operations in 2004 and experienced a change in contractors in 2005. Moreover, the Secretary of Energy issued a compliance order in 2007 requiring Los Alamos to implement specific corrective actions to, among other things, address long-standing deficiencies in its classified information programs.