A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access, use, destruction, or disruption. Organizations accomplish this objective by designing and implementing controls that are intended to, among other things, prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. At LANL, these assets include Category I special nuclear material, such as plutonium and highly enriched uranium; thousands of classified nuclear weapons parts and components; millions of classified documents; thousands of pieces of classified removable electronic media that contain nuclear weapon design information; over 100 vaults and vault-type rooms that store classified assets; and computer networks and the hardware on which these networks run that protect classified information as well as sensitive unclassified information. LANL is subject to a series of DOE security orders that outline requirements for implementing effective physical and cyber security protection strategies. These orders include an assessment of the potential size and capabilities of terrorist forces that could physically attack a laboratory and against which a laboratory must be prepared to defend. The orders further describe different levels of physical protection for sensitive and classified assets, depending on the risk they would pose if they were lost, stolen, or otherwise compromised. Appropriate physical protection safeguards include locks and keys, fences, means to detect unauthorized entry, perimeter alarms, vehicle barriers, and armed guards. In addition, the Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and information systems across the federal government. FISMA requires each agency to develop, document, and implement an agencywide information security program that supports the operations and assets of the agency, including those provided or managed by another agency or contractor on its behalf. Examples of appropriate information security controls include user identification and authentication that allow computer systems to differentiate between users and verify their identities; cryptography that ensures the confidentiality and integrity of critical and sensitive information; configuration management that identifies and manages security features for all hardware, software, and firmware components of an information system and controls changes to them; and audit and monitoring controls that help establish individual accountability and monitor compliance with security policies. LANL is managed and operated by a corporate entity, Los Alamos National Security LLC (LANS). NNSA’s Los Alamos Site Office serves as the primary federal overseer of laboratory security performance. Annually, the Site Office determines how much money LANS will earn for its management of the laboratory according to a maximum available performance-based fee established in the laboratory’s contract. The Site Office bases its determination on the laboratory’s success in meeting the goals laid out in performance evaluation plans. These plans allocate portions of the maximum available performance award fee to NNSA performance objectives, including measures related to both physical and cyber security. In addition, two DOE organizations are required to periodically review physical and cyber security at LANL. NNSA’s Los Alamos Site Office is required to conduct security surveys annually. These surveys are based on observations of performance, including compliance with DOE and NNSA security directives. In fiscal year 2008, the results of this survey are directly tied to NNSA’s performance evaluation plan, and are therefore a factor in LANS’ ability to earn the maximum available performance award fee. DOE’s Office of Independent Oversight also conducts evaluations, typically every 18 months for facilities that store Category I special nuclear material. These evaluations identify weaknesses in the laboratories’ security programs and produce findings that laboratory officials must take action to correct. The reviews overlap substantially, but each is required to provide a comprehensive assessment of the laboratory’s security programs. Physical security at LANL is in a period of significant improvement, and LANL is implementing over two dozen initiatives to reduce, consolidate, and better protect its classified assets, as well as reduce the physical footprint of the laboratory by closing unneeded facilities. LANL officials believe that these initiatives will reduce the risk of incidents that can result in the loss of control over classified assets. For example, to reduce and consolidate classified assets and its physical footprint, as of March 2008, LANL had (1) reduced from nine to one the number of areas containing Category I special nuclear material; (2) reduced the amount of accountable classified removable electronic media from 87,000 pieces to about 4,300 and made information previously accessible on removable media available only through the laboratory’s classified computer network; (3) eliminated about 30,000 classified nuclear weapon parts; and (4) reduced the number of vault-type rooms from 142 to 111. In addition, during fiscal year 2007, LANL reduced the physical footprint of existing facilities by over 500,000 square feet. In concert with these actions, LANL is implementing a series of engineered and administrative controls to better protect and control classified assets, such as removing the functions from classified computers that enable them to create new pieces of removable electronic media and streamlining physical security procedures to make them easier to implement across the laboratory. We found that DOE’s Office of Independent Oversight and the Los Alamos Site Office identified significant physical security problems at LANL that the laboratory had not fully addressed. Specifically, while LANL’s storage of classified parts in unapproved storage containers and its process for ensuring that actions to correct identified security deficiencies have been cited in external security evaluations for years, complete security solutions in these areas had not yet been implemented at the time of our review. In addition, external security evaluations had repeatedly identified concerns about the adequacy of LANL’s assessments of its own security performance. The security self-assessment program provides LANL with the opportunity to self-identify security deficiencies and address them before they can be exploited. External security evaluations found that LANL’s self-assessments were not comprehensive and did not include discussions of all internal findings. These evaluations also noted that findings identified through self-assessments were not always analyzed and addressed through corrective actions. At the time of our review, Los Alamos Site Office and DOE Office of Independent Oversight officials noted that LANL’s self-assessment program was improving. LANL officials identified three management approaches that they asserted would sustain security improvements over the long term. However, these approaches were either in an early stage of development or contained important weaknesses that may impair their ability to ensure the sustainability of security improvements at the laboratory for the foreseeable future. First, LANL officials identified completing the management actions required by the Secretary of Energy’s Compliance Order issued as a result of the October 2006 thumb drive incident as an approach to ensure that security improvements are sustained, yet the Compliance Order itself does not provide a mechanism to sustain security improvements over the long-term. Second, LANL officials told us they will track the implementation of longer-term actions, including those required by the Compliance Order, by developing and implementing the Contractor Assurance System required under the LANS contract. However, the extent to which LANL can rely on the Contractor Assurance System to ensure the long-term sustainability of security improvements is unclear. According to a Los Alamos Site Office official, the Contractor Assurance System will not be fully completed for 3 to 4 years and, thus, will not be fully implemented by the time actions under the Compliance Order are completed. Finally, according to LANL officials, the laboratory plans to realize security improvements by meeting the security-related performance incentives in the annual performance evaluation plans NNSA uses to measure performance and determine an award fee for LANS. However, the annual performance evaluation plans focus principally on compliance with DOE requirements and do not sufficiently reward security program improvement. In that regard, according to a senior NNSA security official, compliance with current DOE requirements does not assure that LANL’s security program is functioning effectively. Indeed, we found that all but $30,000 of the total $1.43 million fiscal year 2008 performance fee allocated to physical security was associated with LANL’s achievement of compliance-oriented milestones, such as issuing plans, publishing policies, and completing equipment maintenance requirements. The management attention dedicated to improving physical security following the October 2006 thumb drive incident mirrors the level of attention that followed LANL’s 2004 shutdown, when over 3,400 safety and security deficiencies were identified for correction. This shutdown lasted up to 10 months for some laboratory activities and cost as much as $370 million. Given how quickly LANL’s security performance declined between the full resumption of laboratory activities in May 2005 and the discovery of the thumb drive on private property, LANL’s ability to sustain the improved security posture it has recently achieved is unproven. Strong federal oversight will help ensure that these improvements are sustained. However, we reported that the Los Alamos Site Office suffers from a shortage of security personnel and lacks funding needed for training. Specifically, as of October 2007, the Los Alamos Site Office employed 13 security staff—enough for 1 person to oversee each of the topical areas the Site Office had to evaluate. This staffing level, officials said, was sufficient to cover only 15 percent of LANL’s facilities. In April 2008, a senior security official at the Site Office said security staffing levels had decreased since October 2007. Furthermore, while NNSA had identified the need to train and certify Site Office security personnel in specific subject matters, according to Site Office officials no specific training funds had been made available. We made three recommendations to the Secretary of Energy and the Administrator of NNSA that, if effectively implemented, will improve physical security at LANL and help ensure that improvements LANL has achieved are sustained over the long term. Specifically, we recommended that LANL be required to develop a comprehensive strategic plan for laboratory security that addresses all previously identified security weaknesses and focuses on improving security program effectiveness. Furthermore, we recommended that NNSA provide meaningful financial incentives in future performance evaluation plans for implementation of this comprehensive strategic plan for laboratory security. In June 2008, the Committee requested that we review the security status at Livermore.