The Office of the Under Secretary for Energy, Science and Environment comprises nine program offices, including the Offices of Environmental Management; Nuclear Energy, Science and Technology; and Science and accounts for about 57 percent of DOE’s fiscal year 2006 budget request (see fig. 1). ESE has five sites that collectively have substantial quantities of Category I special nuclear material. (See table 1.) For fiscal year 2006, DOE requested over $300 million for security at these five sites. This represents about 70% of the entire security budget request for ESE. (See table 2.) Contractors operate all of these sites. Within DOE’s Office of Security and Safety Performance Assurance, DOE's Office of Security develops and promulgates orders and policies to guide the department's safeguards and security programs. DOE’s overall security policy is contained in DOE Order 470.1, Safeguards and Security Program, which was originally approved in 1995. The key component of DOE's approach to security is the DBT, a classified document that identifies the characteristics of the potential threats to DOE assets. A classified companion document, the Adversary Capabilities List, provides additional information on terrorist capabilities and equipment. The DBT has been traditionally based on a classified, multiagency intelligence community assessment of potential terrorist threats, known as the Postulated Threat. The threat from terrorist groups is generally the most demanding threat contained in the DBT. DOE counters the terrorist threat specified in the DBT with a multifaceted protective system. While specific measures vary from site to site, all protective systems at DOE's most sensitive sites employ a defense-in-depth concept that includes the following: a variety of integrated alarms and sensors capable of detecting physical barriers, such as fences and antivehicle obstacles; numerous access control points, such as turnstiles, badge readers, vehicle inspection stations, radiation detectors, and metal detectors; operational security procedures, such as a “two person” rule that prevents only one person from having access to special nuclear material; and hardened facilities and vaults. Each site also has a heavily armed protective force that is often equipped with such items as automatic weapons, night vision equipment, body armor, and chemical protective gear. These protective forces comprise Security Police Officers that are classified into three groups: Security Police Officer-I, Security Police Officer-II, and Security Police Officer-III. Security Police Officer-Is are only assigned to fixed, armed posts. Generally, very few of these officers are used at ESE sites because of the limited roles they can fill. Security Police Officer-IIs generally are assigned to posts such as access control booths, or to foot or vehicle patrols. Finally, Security Police Officers-IIIs are responsible for operations such as hostage rescue and the recapture and recovery of special nuclear material. According to federal regulations, Security Police Officers-IIIs have more demanding physical fitness and training standards than Security Police Officers-Is or Security Police Officers-IIs. At the ESE sites we visited, protective forces work for private contractors and are unionized. The number of qualified Security Police Officers-IIs and Security Police Officers-IIIs at ESE sites is shown in table 3. Protective force duties and requirements, such as physical fitness standards, are explained in detail in DOE Manual 473.2-2, Protective Force Program Manual, as well as in DOE regulations (10 C.F.R. pt. 1046, Physical Protection of Security Interests). DOE issued the current Protective Force Program Manual in June 2000. Although protective forces are expected to comply with the duties and requirements established in DOE policies, deviations from these policies are allowed as long as certain approval and notification criteria are met. Following are the three types of deviations: Variances: Variances are approved conditions that technically vary from DOE security requirements but afford equivalent levels of protection. Waivers: Waivers are approved nonstandard conditions that deviate from DOE security requirements that, if uncompensated, would create a potential security vulnerability. As such, waivers require implementation of what DOE calls compensatory measures. Compensatory measures could include deploying additional protective forces or curtailing operations until the asset can be better protected. Exceptions: Exceptions are approved deviations from DOE security requirements that create a safeguards and security vulnerability. Exceptions are approved only when correction of the condition is not feasible, and compensatory measures are inadequate. In addition to complying with these security requirements, DOE protective systems, including protective forces, also must meet performance standards. For example, DOE sites are required to demonstrate that their protective systems are capable of defending special nuclear material against terrorist forces identified in the DBT. The performance of protective systems is formally and regularly examined through vulnerability assessments. A vulnerability assessment is a systematic evaluation process in which qualitative and quantitative techniques are applied to detect vulnerabilities and arrive at effective protection of specific assets, such as special nuclear material. To conduct such assessments, DOE uses, among other things, subject matter experts, such as U.S. Special Forces; computer modeling to simulate attacks; and force-on-force exercises, in which the site's protective forces undergo simulated attacks by a group of mock terrorists. In addition to their use in evaluating the effectiveness of physical protection strategies, DOE believes force-on-force exercises are the most realistic representation of adversary attacks that can be used to train protective forces. Through a variety of complementary measures, DOE ensures that its contractors are complying with DOE’s safeguards and security policies, including protective force duties and requirements, and that its systems are performing as intended. Contractors perform regular self-assessments and are encouraged to uncover any problems themselves. In addition to routine oversight, DOE orders require field offices to comprehensively survey contractors' operations for safeguards and security every year. DOE's Office of Independent Oversight and Performance Assurance provides yet another check through its comprehensive inspection program. This office performs comprehensive inspections roughly every 18 months at each DOE site that has specified quantities of Category I special nuclear material. All deficiencies (findings) identified during surveys and inspections require the contractors to take corrective action. Since the terrorist attacks of September 11, 2001, DOE security policies have been under almost constant reexamination and have undergone considerable change. For example, the department’s security polices have been undergoing a streamlining process for nearly 2 years. In addition, as we pointed out in our April 2004 report, DOE worked for almost 2 years to develop and issue a new DBT. When DOE issued its first post-September 11 DBT in May 2003, we recommended that DOE reexamine it because, among other things, it contained a terrorist threat that was less than the threat identified in the intelligence community’s Postulated Threat. DOE agreed to reexamine the 2003 DBT and issued a revised and more demanding DBT in October 2004. The October 2004 DBT significantly increased the terrorist threat to DOE facilities and required enhanced protection strategies for DOE facilities. Under the new DBT, sites with Category I special nuclear material will not have to be fully prepared to defend their sites against the terrorist threat contained in the new 2004 DBT until October 2008. By July 29, 2005, DOE sites will have to forward 2004 DBT implementation plans to the Deputy Secretary of Energy and, within 3 months, begin submitting quarterly DBT implementation reports. At the time of our review, cost estimates were still preliminary, but security officials at ESE sites said that they may require collectively an additional $384-$584 million over the next several years in order for all ESE sites with Category I special nuclear material to meet the 2004 DBT. We found that the majority of the 105 protective force members we interviewed at ESE sites generally believe that they currently are ready to perform their mission of protecting the site’s special nuclear material. Consistent with that belief, the five ESE sites we visited had the required training programs, facilities, and equipment, and the 105 protective force members whose records we reviewed were generally meeting the readiness requirements contained in the DOE orders and federal regulations. However, we did find some weaknesses at ESE sites that could adversely affect the ability of ESE protective forces to defend their sites. These include protective force officers’ lack of regular participation in force-on-force exercises; the frequency and quality of training opportunities; the lack of dependable communications systems; and insufficient protective gear, including protective body armor and chemical protective gear, and the lack of armored vehicles. Readiness is defined by the Department of Defense (DOD) as the ability of forces to deploy quickly and to accomplish specific goals and missions. In particular, DOD believes that a ready force should possess a sufficient number of experienced, trained, and properly equipped personnel. Through realistic and comprehensive training, these personnel are forged into a cohesive unit that can perform its tasks even under extreme conditions. DOE orders and federal regulations establish the framework for ensuring that DOE protective forces are ready to perform their mission. ESE protective force officers generally believe that they are ready to perform their mission. Specifically, 102 of the 105 officers we interviewed stated that they believed that they, and their fellow officers, understood what was expected of them should the site be attacked by a terrorist group. Moreover, 65 of the 105 officers rated the readiness of their site’s protective force as high, while 20 officers rated their protective force as somewhat or moderately ready to defend the site. Only a minority of the officers (16 of 105) we interviewed rated the readiness of their force to defend their sites as low. Two officers were uncertain of their forces’ readiness, and two did not respond to the question. In addition, the majority of officers we interviewed believed they and the protective force officers with whom they worked on a regular basis formed a cohesive unit that would be able to perform their most essential mission of protecting special nuclear material.