Within DOE, NNSA conducts its mission activities across several research and development laboratories, production plants, and other sites, known collectively as the nuclear security enterprise. Seven of the eight sites in the nuclear security enterprise, as shown in figure 1, include facilities, equipment, and components owned by NNSA and operated by M&O contractors on behalf of NNSA. Five M&O contractors each operate one site, and one contractor operates both the Pantex and Y-12 sites. M&O contractor activities include, among other things, producing parts or procuring parts from suppliers. For example, the Kansas City National Security Campus produces or procures more than 100,000 parts annually—ranging from nuts and bolts to more complex radar components—including about 85 percent of the components that go into a typical nuclear weapon. We previously reported that the site had increased the percentage of nonnuclear components purchased from external suppliers from about 54 to 70 percent. DOE’s efforts to manage supply chain risk include the following: M&O contractors may develop lists of approved suppliers of nuclear weapons components and certain information technology systems. M&O contractor representatives we interviewed said that suppliers are added to the list after an evaluation that examines their ownership or management based on publicly available data and a review of their capability to meet technical and quality assurance requirements. DOE’s Office of Intelligence and Counterintelligence supports the department by conducting intelligence and counterintelligence activities. For example, the office’s field staff can provide information to M&O contractors when there are potential issues of concern related to a “foreign nexus” of a supplier or potential supplier. If a foreign nexus is identified, the Office of Intelligence and Counterintelligence can perform an in-depth evaluation to determine whether the supplier poses a risk to the supply chain. DOE’s Office of the Chief Information Officer (OCIO) is responsible for providing, among other things, department-wide guidance, policy, and oversight to ensure secure, efficient, and cost-effective use of information technology resources. DOE program offices can request that OCIO review the risk that an information technology supplier poses to the supply chain. Upon receiving such a request, OCIO assesses the risk using information from open source databases, and works with the DOE Office of Intelligence and Counterintelligence when additional analysis is needed. In addition, NNSA has taken several steps in recent years to increase its focus on supply chain risk management. For example, in 2011 NNSA initiated a multi-disciplinary effort with the Sandia National Laboratories and the Kansas City National Security Campus, which focused on identifying, analyzing, and mitigating risks that may arise through malicious exploitation of NNSA supply chain and cyber-security vulnerabilities. Also, in 2013 NNSA issued a weapon quality policy, which it updated in 2015, that stated, in part, that information about unique problems, such as the insertion of malicious hardware and software into the supply chain, shall be shared and investigated throughout the nuclear security enterprise. In addition, NNSA officials said the agency was in the process of establishing a Nuclear Enterprise Assurance Steering Group composed of senior NNSA and DOE headquarters officials to provide oversight and management of NNSA nuclear enterprise assurance activities. Such activities include supply chain risk management practices to protect against malicious components that could interfere with the functionality of a weapons system. The enhanced procurement authority provided by the act applies specifically to supply chain risk for covered systems as follows: Supply chain risk is the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system or covered item to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of the covered system or item. Covered systems are primarily nuclear weapons and components and items associated with design, production, and maintenance of such weapons or of nonproliferation and counterproliferation programs and certain information technology systems. The enhanced procurement authority may provide a tool to help DOE manage supply chain risk in certain circumstances where, under the Federal Acquisition Regulation, DOE might otherwise need to disclose the reason for its determination not to award a procurement contract or subcontract to a particular supplier or DOE’s decision might be subject to appeal. Specifically, the authority permits the exclusion of contractors or subcontractors that pose a supply chain risk and allows DOE to not disclose the reasons for its determination to use the authority and, unlike most other procurement actions, the use of the authority, including the decision to not disclose, is not subject to review in any federal court. In circumstances where DOE uses the enhanced procurement authority, the Secretary is to notify other federal agencies responsible for a procurement that may be subject to the same or similar supply chain risk in a manner and to the extent consistent with the requirements of national security. Under the act, DOE’s enhanced procurement authority will terminate in June 2018, 4 years from the effective date of the act. As of May 2016, the Secretary of Energy had not used the enhanced procurement authority, and DOE had not developed processes for using the authority, as it had not fully assessed the circumstances under which the authority might be useful. To use the enhanced procurement authority, the Secretary must be made aware of a supply chain risk. DOE or NNSA officials would have to notify the Secretary that a supplier or potential supplier could pose a significant risk to a covered system. Once the Secretary was made aware of a significant supply chain risk, to use the enhanced procurement authority he or she must make a determination in writing that use of the authority was necessary to protect national security, and that less restrictive measures were not reasonably available to reduce the supply chain risk, among other things. The act requires the Secretary to obtain a risk assessment that demonstrates that there is a significant risk to the supply chain. Although the act does not define the elements of a risk assessment, DOE officials stated that a risk assessment may include a system characterization, threat identification, vulnerability identification, impact analysis, and risk determination, among other things. They stated that the risk assessment would be similar to a risk analysis and mitigation report which the department used to document supply chain issues, such as suspect counterfeit parts. However, DOE had not developed specific processes to collect such information for a risk assessment report and provide it to the Secretary so that he or she could make a determination about whether to use the authority. DOE officials said that they expect that instances under which the authority would be useful to be infrequent, but that DOE had not conducted an assessment to confirm that view. Some DOE and NNSA officials and M&O contractor representatives expressed uncertainty about whether the authority was needed. According to DOE officials, M&O contractors generally procure the parts for covered systems, and NNSA officials said that it is unlikely that an M&O contractor would need to request that the Secretary use the authority. NNSA and M&O contractor representatives told us, that since M&O contractors are not federal entities, they are not subject to the same procurement restrictions as such entities and already possess the capability to exclude a supplier that poses a supply chain risk. When procuring a part from a supplier, an M&O contractor is generally not required to disclose security-related reasons to a potential supplier to explain why that supplier was not selected. In addition, when an M&O contractor establishes a subcontract with a supplier, the M&O contractor can terminate the subcontract at any time for convenience without providing a reason. Some DOE officials also told us that there are mechanisms within the Federal Acquisition Regulation for federal entities to mitigate supply chain risks for covered system procurements. For example, the Federal Acquisition Regulation states that a federal entity can contract only with a “responsible” supplier. According to DOE officials, a supplier that presents a supply chain risk may not be considered a responsible supplier and may be excluded from a federal contract for a covered system. Some DOE officials provided us their views about circumstances under which the enhanced procurement authority could be useful; however, as of May 2016, DOE had not fully assessed these or other circumstances under which using the authority would help the department manage supply chain risk. For example, some DOE officials mentioned particular circumstances under which the authority might be useful, such as if DOE learned about an adversary’s connection to a potential or existing supplier and an M&O contractor was not aware of the connection. However, the DOE officials also said that, if such a situation arose, the enhanced procurement authority would not be the only option because DOE’s Office of Intelligence and Counterintelligence could contact the M&O contractor, which could then decide whether to terminate the supplier for convenience, or in the case of a potential supplier, choose another supplier without providing an explanation. Alternatively, some DOE officials said that the enhanced procurement authority could be useful in a case where DOE or NNSA directly contracted with a supplier. However, DOE and NNSA officials said they had not identified the extent to which their direct procurements were for components of covered systems to which the enhanced procurement authority could apply. Under federal standards for internal control, legislators and others may change either an entity’s objectives or how an entity is to achieve an objective, and management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving the entity’s objectives or addressing related risk. Congress provided the Secretary with the enhanced procurement authority as an additional means to manage supply chain risk, but DOE has not fully assessed how the authority might help the department achieve its objectives. DOE officials said the Nuclear Enterprise Assurance Steering Group, which was still being formed, would be the appropriate group to develop processes for using the enhanced procurement authority. However, without assessing the circumstances under which the authority could be useful, DOE will have difficulty determining the authority’s relevance and, if the authority is considered to be relevant, developing processes for using it.