NNSA relies on its Stockpile Stewardship Program to ensure the safety, security, and effectiveness of the nuclear weapons stockpile. The Stockpile Stewardship Program is comprised of various elements, including, but not limited to: (1) the Advanced Simulation and Computing (ASC) Campaign, which provides the computational science and simulation tools to understand the behaviors and effects of nuclear weapons; (2) Directed Stockpile Work, which provides evidence of the health of the nuclear weapons stockpile and involves day-to-day maintenance of these weapons, including life extension efforts; (3) the Science Campaign, which provides tools and capabilities geared toward advancing the general understanding of all nuclear weapons systems; and (4) the Engineering Campaign, which provides a sustained basis for stockpile certification and assessments throughout the life cycle of each weapon. The coordination among the Stockpile Stewardship elements is instrumental to increasing NNSA’s confidence in the performance of nuclear weapons. To help accomplish its Stockpile Stewardship mission, NNSA relies on the three weapons laboratories—Los Alamos, Livermore, and Sandia. Los Alamos and Livermore are the two design laboratories that are responsible for designing the nuclear weapons’ explosive package and conducting research to better understand nuclear weapons phenomena. Sandia is an engineering laboratory and has principal responsibility for the research, design, and development of nonnuclear warhead components; integration of these components with Los Alamos and Livermore; and overall warhead systems integration with DOD. In accordance with NNSA, management and operations contractors, who are responsible for day-to-day operations of the laboratories, are required to adhere to agency policies. At the time of our review, NNSA’s classified supercomputing resources consisted of 12 classified supercomputing systems. Figure 1 shows the hows the hardware configuration of a supercomputing system. hardware configuration of a supercomputing system. NNSA classified supercomputing systems employ a large number of interdependent processors, which are the core unit of a computer that gathers instructions and data. These processors are mounted onto a compute chip, which is the portion of the system that carries out the instructions of a computer program. These compute chips are inserted onto a compute card, which also holds memory for the compute chips to use. A number of compute cards are attached to a node card, which have one or more processors with a common memory and are connected by high-speed interconnection networks. Each node card is inserted into a single cabinet, and that configuration is repeated many times to build a single supercomputing system. Each supercomputing system has a peak performance, which is the maximum rate of floating-point operations per second (FLOPS) that the system can sustain. Currently, almost all NNSA classified supercomputer systems operate at the teraFLOP level, which represents a trillion FLOPS. According to NNSA, the laboratories have three types of classified supercomputing systems: Capacity: Small systems that execute parallel problems with more modest computational requirements. These systems serve as the workhorse for the ASC program and are responsible for processing the day-to-day supercomputing workload. Capability: This type of supercomputer is used to solve the largest and most demanding problems that other computing systems cannot manage. Advanced architecture: Research and development systems that assist the ASC program in preparing to rapidly deploy and exploit the next generation of supercomputing technology. These systems have a targeted workload and serve as the foundation for the next generation of NNSA supercomputers. Table 1 shows the classified supercomputing systems currently in use at the three weapons laboratories. NNSA’s classified supercomputing capabilities consist of supporting resources, including (1) parallel files systems, which store transitory data; (2) network file systems, which store user and project data for a calculation; (3) archival storage systems, which serve as storage for data; and (4) visualization systems, which enable users to better comprehend the results of their computations. NNSA’s classified supercomputing systems are connected via its Enterprise Secure Network and the Distance Computing (DISCOM) network, which function as supporting resources for the classified supercomputing environment. The Enterprise Secure Network provides classified communications across the nuclear weapons complex, including security services and other activities that ensure the flow of NNSA’s data sharing and business missions. DISCOM provides secure, high-speed remote access for intra- and inter-site file transfers and enables users, across the three weapons laboratories, to operate on remote computing resources as if they were local. DISCOM and the Enterprise Secure Network serve as the backup networks to each other. Figure 2 shows the composition of NNSA’s classified supercomputing network infrastructure. NNSA reported obligating approximately $1.7 billion from fiscal years 2007 through 2009 to support ASC program activities at the three weapons laboratories. The $1.7 billion was predominantly associated with three efforts: Weapons codes and models. This effort is intended to develop and improve weapons simulation models and codes for predicting the behavior of weapons systems and devices in the nuclear stockpile. Computational systems and software environment. This effort is intended to provide ASC users a stable, seamless computing environment for ASC-deployed platforms. It is responsible for procuring, delivering, and deploying ASC computational systems and user environments via technology development and integration across the three weapons laboratories. Facility operations and user support. This effort is intended to provide both the necessary physical facility and operational support for reliable supercomputing and storage environments, as well as a suite of user services for effective use of the three weapons laboratories’ computing resources. Facility operations cover physical space, power and other utility infrastructure, and local- and wide-area networking, as well as system administration, cyber security, and operations services for ongoing support. The user support function includes planning, development, integration and deployment, continuing product support, and quality and reliability activity collaborations. To strengthen the security of information and information systems across the federal government, including those at NNSA’s weapons laboratories, the Federal Information Security Management Act of 2002 (FISMA) requires each agency to develop, document, and implement an agencywide information security program that supports the operations and assets of the agency, including those provided or managed by another agency or contractor on its behalf. This security program is to include plans and procedures to ensure the continuity of operations for information systems that support the agency’s operations. Pursuant to its FISMA responsibilities, the National Institute of Standards and Technology (NIST) has issued federal standards and guidelines on information security, such as a contingency planning guide for federal information systems, and recommended security controls, which address contingency and disaster recovery planning and testing. To further ensure the security of national security systems, the Committee on National Security Systems (CNSS) requires federal agencies with national security systems to implement a comprehensive set of security controls and enhancements for these systems. CNSS requires that each agency implement a contingency and disaster recovery planning capability that ensures the integrity and availability of its national security information and information systems. FISMA, NIST guidelines, and CNSS policies all call for contingency and disaster recovery planning—also referred to as continuity of operations for information systems—for critical components of information protection. DOE and NNSA policies also regard contingency and disaster recovery plans as being necessary for information protection. If normal operations are interrupted, contingency and disaster recovery plans allow senior agency officials to detect, mitigate, and recover operations. Examples of the key components that make up contingency and disaster recovery planning programs include (1) assessing the criticality and sensitivity of computerized operations and identification of supporting resources such as developing business impact analyses (BIA), (2) taking steps to prevent and minimize potential damage and interruption such as establishing data backup processes, (3) developing comprehensive contingency and disaster recovery plans, and (4) conducting periodic testing of contingency and disaster plans. The extent to which controls—such as contingency and disaster recovery planning—are implemented depends on a level of risk assigned to the system or information maintained on the system. NIST standards and guidelines, CNSS instructions, and NNSA policy allow consideration of risk in determining the level of protection of systems and data. These standards and policies require that organizations consider the impact or consequences of loss as it relates to the confidentiality, integrity, and availability of the information, and assign a value of low, moderate, or high impact levels. For contingency and disaster recovery planning, consideration of “availability” is the key element. NNSA policy defines the values for the consequences of loss associated with availability as follows: High—Loss of life might result from loss of availability; information must always be available on request, with no tolerance for delay; loss of availability will have an adverse effect on national-level interests; federal requirement (i.e., requirement for material control and accountability inventory); or loss of availability will have an adverse effect on confidentiality. Moderate—Information must be readily available with minimum tolerance for delay; bodily injury might result from loss of availability; or loss of availability will have an adverse effect on organizational-level interests. Low—Information must be available with flexible tolerance for delay. Contingency and disaster recovery planning and testing for NNSA’s classified supercomputing systems have not been fully implemented at each of the three weapons laboratories—Los Alamos, Sandia, and Livermore. Specifically, NNSA did not ensure that the laboratories (1) developed BIAs to determine the impact of potential service disruptions, (2) fully tested data backup processes, and (3) developed and tested contingency and disaster recovery plans. These shortcomings existed, at least in part, because NNSA’s component organizations were unclear of their roles and responsibilities for providing oversight in the laboratories’ implementation of contingency and disaster recovery planning. Until the agency fully implements a contingency and disaster recovery planning program for its classified supercomputing assets at the weapons laboratories, it has limited assurance that vital information can be recovered and made available to meet national security priorities and requirements.