This section provides information on key DOE and NNSA nuclear sites, key DOE security concepts and processes, and DOE and NNSA processes to develop their annual security reports. There are four DOE and four NNSA sites holding category I and category II special nuclear material to carry out the agencies’ nuclear missions: DOE’s Hanford Site, Idaho National Laboratory, Oak Ridge National Laboratory, and Savannah River Site and NNSA’s Los Alamos National Laboratory, Nevada National Security Site, Pantex Plant, and Y-12 National Security Complex. DOE’s Under Secretary for Management and Performance, DOE’s Under Secretary for Science and Energy, and NNSA’s Administrator are to ensure that each of the sites they manage has a safeguards and security program with the necessary protections to protect security interests against malevolent acts such as theft; diversion; sabotage; compromise; or unauthorized access to nuclear weapons, nuclear weapons components, or special nuclear material. Figure 1 provides information on the missions of DOE and NNSA sites containing category I and category II special nuclear material. DOE orders establish requirements that must be met for all DOE and NNSA operations except under certain conditions, with appropriate approvals. DOE’s overall risk-based security directive is contained in DOE Order 470.4B, Safeguards and Security Program, and was updated in February 2013, and most recently in January 2017. A key component of DOE’s approach to security is the design basis threat order, a classified document that identifies the characteristics of the potential threats to DOE and NNSA assets. The design basis threat order is based on a classified, multiagency intelligence community assessment of potential terrorist threats. DOE and NNSA counter the terrorist threat specified in the design basis threat order with a multifaceted protective system. All protective systems at DOE’s and NNSA’s most sensitive sites employ a defense-in-depth concept with multiple layers of physical security measures designed to work in concert to deter, detect, assess, communicate about, delay, and respond to intruders or unauthorized activities. The protection strategy also includes personnel security, information security, and material control and accountability elements. According to the DOE Standard: Nuclear Materials Control and Accountability, a material control and accountability program is to ensure that all accountable nuclear materials are in their authorized location and are being used for their intended purposes such that single component failures will not result in significant vulnerabilities. These various security measures typically include physical security features and systems, such as integrated cameras, alarms, and motion sensors; fences and anti-vehicle barriers; and numerous access control points, such as turnstiles, badge readers, and vehicle inspection stations. At most sites, these measures are integrated into perimeter intrusion detection systems. Each site generally has a heavily armed protective force that is often equipped with such items as automatic weapons, night vision equipment, body armor, and chemical protective gear. In addition, each site is to follow a specific protection strategy based on the type of special nuclear material it must protect. According to NNSA officials, the performance of protective systems is to be formally and regularly examined through vulnerability assessments, which are systematic risk-based evaluations in which qualitative and quantitative techniques are applied to detect vulnerabilities and determine how to effectively protect specific assets, such as special nuclear material. The results of the vulnerability assessments, other performance assessments, and expert analysis are to be used to establish the specific security measures, equipment, and requirements for a site, which are to be documented at each site in a classified security plan. In addition to identifying known vulnerabilities, risks, and protection strategies for mitigating these risks and vulnerabilities for the site, the plan formally acknowledges how much residual risk DOE is willing to accept. For more than 2 decades, DOE has employed a risk-based approach to security that seeks to direct resources to its most critical assets—in this case category I special nuclear material—and mitigate risks to these assets to an acceptable level. According to DOE officials, levels of risk—high, medium, and low—are assigned classified numerical values and are derived from a mathematical equation that compares a terrorist group’s capabilities with the overall effectiveness of the crucial elements of the site’s protective forces and systems. Through a variety of complementary inspections and assessments, DOE ensures that its contractors are implementing its safeguards and security policies and that its systems are performing as intended. Contractors perform regular self-assessments. DOE’s safeguards and security order also requires relevant security offices to comprehensively survey contractors’ operations for safeguards and security regularly. In addition, DOE’s Office of Enterprise Assessments is to conduct independent assessments that appraise, among other things, DOE and NNSA physical security systems, personnel security, protective forces, and nuclear material control and accountability practices to identify gaps and vulnerabilities. According to DOE Office of Enterprise Assessments officials, they assess security at DOE and NNSA category I sites about every 2 years. In general, DOE and NNSA have employed similar processes to develop and produce their annual security reports. DOE’s Office of the Associate Under Secretary for Environment, Health, Safety, and Security and NNSA’s Office of Security Operations and Performance Assurance within the Office of the Associate Administrator for Defense Nuclear Security coordinate each agency’s report development effort. According to DOE and NNSA officials in those offices, in the summer of each calendar year the agencies request information from sites containing category I or category II special nuclear material. The agencies give their sites about 3 weeks to respond to these requests and to provide the requested documentation. Officials said that once the responses are received, DOE Office of Environment, Health, Safety, and Security and NNSA Office of Defense Nuclear Security officials synthesize the relevant sites’ responses and respectively develop the DOE and NNSA draft reports, which then are submitted for review by General Counsel and the relevant Under Secretaries, including the NNSA Administrator. NNSA then sends its report to DOE for transmittal, and the Secretary of Energy transmits both reports to Congress, along with his certification. DOE’s and NNSA’s 2014 and 2015 annual reports on the security of nuclear facilities holding category I and category II quantities of special nuclear material did not fully meet the definition of quality information in the 2014 federal internal control standards. Under the 2014 federal standards for internal control, management should use quality information to achieve the entity’s objectives. The information and communication standard defines quality information as appropriate, current, complete, accurate, accessible, and provided on a timely basis. DOE’s and NNSA’s reports met certain aspects of the definition of quality information in that they were based on current information and were accessible. However, the reports did not always contain complete information on the important assessments that the agencies used in their certification of sites’ security. Moreover, they were not provided in a timely manner as called for by both the 1999 and 2014 federal internal control standards. We found that, in general, the 2014 and 2015 annual security reports—in which DOE and NNSA certified that their sites met current security requirements and standards—partially met the definition of quality information in the 2014 federal standards for internal control in that they were based on what was currently available information at the time they were prepared. For example, DOE and NNSA attested through responses to our data collection instrument that their assessments were based on the most current reviews of a site’s security plan, vulnerability assessments, security surveys, and independent assessments that were available when the reports were being drafted. Moreover, DOE and NNSA officials told us that the agencies prepare their annual security reports by drawing on existing and well-established DOE processes for verifying the adequacy of security at facilities, such as formally approved security plans and independent assessments. With respect to being accessible, we verified that NNSA provided its annual security reports to DOE, and DOE provided both agencies’ reports to the appropriate congressional committees. While the reports are classified and thus not publicly available, DOE delivered the reports to the respective committees’ security offices, where they were available to recipients with the appropriate clearances and need to know. In addition, a DOE official provided us with evidence that DOE had briefed congressional staff on the reports. We found that DOE’s and NNSA’s 2014 and 2015 annual security reports did not always meet the definition of quality information as called for in the 2014 federal internal control standards because they did not always contain complete information that provided the basis for the agencies’ certifications in the reports that sites are secure. Generally, we found that NNSA’s reports included information on a wider range of individual site security assessments than did DOE’s reports. However, neither DOE’s nor NNSA’s reports contained complete information to support the agencies’ assessments that all of the relevant sites were secure. For example, DOE’s 2015 annual security report did not mention whether a vulnerability assessment was conducted at two of its four sites or include any information regarding the date or outcome of the most recent vulnerability assessments at three of its four sites. NNSA’s 2015 annual security report noted that its four sites conducted vulnerability assessments, but one site did not provide information regarding the most recent completion date of its vulnerability assessment. Table 1 indicates the extent to which DOE’s and NNSA’s reports contained complete information regarding the important assessments—security plans, vulnerability assessments, independent assessments, and other assessments—that officials said were used to certify that sites are secure. In general, without complete information on the assessments—that is, security plans, vulnerability assessments, independent assessments, and other assessments—that officials said were used to determine each site’s overall security assessment, it was not always possible to determine the basis for the site security certification solely using the information contained in the reports.