Several security incidents in the late 1990s highlighted the need for improvements at DOE. For example, the possible loss of nuclear weapons design information and the “missing” computer hard drives at Los Alamos National Laboratory revealed important weaknesses in security. More broadly, many reports have criticized DOE security: the President’s Foreign Intelligence Advisory Board report, the Cox Committee report,and a number of our reports on particular aspects of DOE’s security program. In response to individual events and reports, DOE, and later NNSA, developed initiatives intended to address nuclear security problems. Numerous initiatives were undertaken to strengthen, among other things, personnel, physical, information, and cyber security as well as DOE’s counterintelligence program. Because of their importance, the initiatives were in many cases special efforts undertaken outside the established departmental processes for policy development, which include, among other things, the opportunity for all affected parties to review and comment on proposed policies. DOE and NNSA security activities associated with the initiatives generally fall under two major offices in each organization. For DOE headquarters, these are the Office of Security and the Office of Counterintelligence. The Office of Security is responsible for establishing policies and procedures to protect, among other things, nuclear materials and information at all DOE and NNSA facilities at headquarters and in the field. The Office of Counterintelligence is responsible for setting counterintelligence policy for DOE and NNSA, as well as gathering information and conducting activities to protect against espionage and other intelligence activities at non-NNSA sites. For NNSA, the two major offices are the Office of Defense Nuclear Security and the Office of Defense Nuclear Counterintelligence. These offices administer and manage security and counterintelligence functions within NNSA. Security activities are also carried out in the field at DOE and NNSA operations offices, area offices, laboratories, and production facilities. NNSA’s field structure includes national weapons laboratories, production facilities, and naval reactors program sites. Among the three national laboratories are Lawrence Livermore in California and Sandia in New Mexico, which conduct research and development for the nuclear weapons program and a broad range of nonnuclear research. The Pantex Plant in Texas is one of four production sites. Pantex assembles and disassembles nuclear weapons; stores nuclear weapons components on an interim basis; and develops, fabricates, and tests explosive components for nuclear weapons. The Bettis Atomic Power Laboratory in Pennsylvania is one of two naval reactor laboratories. Among other activities, Bettis conducts research, designs new reactor and propulsion systems, and provides technical expertise to the Navy’s nuclear fleet. DOE and NNSA have implemented 64 percent of the 75 nuclear security initiatives developed since 1998. Of the remaining initiatives, most are to be completed by December 2002. Successful implementation of the initiatives can enhance security at NNSA facilities. There are three lessons to be learned from implementing these initiatives that can help ensure future initiatives achieve their intended benefits. First, field perspectives should be fully considered in the development of initiatives. Some initiatives, such as the development of a new foreign visits and assignments database, were developed without fully considering the perspectives of contractor and NNSA staff in the field, leading to operational inefficiencies and staff frustration. Second, initiatives should be clearly communicated to the field. Initiatives were not always clearly communicated to the field, resulting in confusion among contractor and NNSA field staff regarding what requirements they needed to implement. Third, a coordinated process for implementing initiatives could be beneficial. Some sites did not have a coordinated process for implementing initiatives, although at the Pantex Plant we observed a potential best practice in which a team approach for implementing initiatives had been developed. These lessons to be learned do not pertain to the naval reactors program because of its unique security structure and program within NNSA. DOE and NNSA have made progress in implementing the 75 nuclear security initiatives developed since 1998. As of January 2002, 48—or 64 percent—of the initiatives had been completed. DOE and NNSA report that 19 initiatives will be completed by December 2002 and that one will be completed in 2007. DOE and NNSA do not have expected completion dates for the remaining seven initiatives. Table 1 shows the general status of the initiatives, while appendix II provides details on the status of each initiative. Successful implementation of the initiatives can reduce the likelihood of security problems and therefore enhance security at NNSA facilities. For example, DOE has eliminated the backlog of security clearance investigations and reinvestigations of employees with access to classified information. Eliminating this backlog ensures that those employees with access to classified information have had their backgrounds checked and that cleared personnel needed in important mission-related areas are available for work. Other initiatives can strengthen controls over cyber security. For example, DOE has published 29 cyber security directives for classified and unclassified systems and has provided cyber security training for system administrators and managers. In addition, the counterintelligence program has been improved. For example, DOE and NNSA have integrated counterintelligence and foreign intelligence operational and analytic efforts throughout the nuclear weapons complex. This integration should lead to improved analyses by counterintelligence personnel at headquarters and in the field due to their increased access to the expertise of, and information available through, foreign intelligence staff. DOE and NNSA have 27 initiatives that are still in progress. These initiatives address a broad range of security areas, including information security, physical security, nuclear material accountability and control, cyber security, and counterintelligence. According to DOE and NNSA, 19 of these initiatives will be completed by December 2002. Another initiative, intended to improve communication with employees regarding security, will be completed in 2007. DOE and NNSA could not provide specific completion dates for the remaining seven initiatives. Two of the seven are cyber security initiatives related to the implementation of a cyber security architecture program and the development of a research and development capability for DOE. As such, according to DOE officials, these initiatives represent continuous efforts. For the other five, DOE and NNSA officials told us they could not develop reasonable completion dates. For example, DOE officials said that they do not have a completion date for the initiative to encrypt selected classified electronic media because they are waiting for the National Institute of Standards and Technology to provide a list of qualified vendors that meet the new advanced encryption standard. Three lessons can be learned from DOE’s and NNSA’s experience in implementing the initiatives that can help ensure future initiatives achieve their intended benefits. First, field perspectives should be fully considered in the development of initiatives. Second, initiatives should be clearly communicated to the field. Third, a coordinated process for implementing initiatives could be beneficial. Contractor and NNSA field staff at three sites told us that their perspectives were not fully considered in the development of initiatives. The initiatives were typically formulated at headquarters by security staff without full review, comment, or discussion from the field. In contrast, for proposed policies and directives, DOE and NNSA have a formal review and comment process in place, through which field staff can provide input. For example, according to contractor staff at the two national laboratories we visited, field perspectives on system specifications were not fully considered in the development of DOE’s new foreign visits and assignments database. As a result, it is incompatible with local databases at these two sites. The volume of foreign interactions at these sites makes this problem significant. Because of the database incompatibilities, information must be manually entered into DOE’s database by contractor staff at these sites, rather than being uploaded electronically. Further, at one of these sites, DOE’s database is being used only on a limited basis because of these problems. Contractor officials at the two sites said that had they been involved more when this initiative was being developed, these problems might have been avoided or reduced. Office of Security officials admitted that participation by field staff was constrained by the fast track approach to implementation. However, these officials pointed out that since the database became operational, field staff have been actively included in continuing program development, system enhancement, and training activities. Another example of difficulties caused by the lack of full consideration for field perspectives occurred in an initiative requiring a departmentwide inventory of electronic media containing certain classified information. This initiative required a complete inventory at all sites, within 30 days, of all electronic media containing certain classified information. Contractor officials at three sites told us that problems they experienced implementing this initiative might have been foreseen and mitigated if field perspectives had been more fully considered in its development. For example, security staff at the three sites said that unclear wording in the initiative led to confusion and debate as to what media and information were actually covered by the initiative. Ultimately, staff at each site interpreted and implemented the initiative based on their local decisions as to its meaning and intent. Further, staff at two sites told us that the requirement to complete the inventory within 30 days was unrealistic given the quantity of affected media at their sites. As a result, their efforts were rushed and some aspects of the inventory, such as inaccurate reading of bar codes at one site, caused difficulties that they were still trying to resolve at the time of our visits. Contractor and NNSA field staff at three sites told us that the initiatives were not always clearly communicated to them from headquarters. There was no systematic, uniform process in place for notifying sites of initiatives, and in some cases the initiatives were communicated through web sites, memorandums, and word of mouth. For example, contractor officials at one national laboratory told us that multiple offices within DOE and NNSA provided guidance to them on some cyber security initiatives, often through informal means such as web site postings or verbal communication. This lack of clear communication produced confusion at the site about which requirements they needed to implement. In regard to two physical security initiatives, there is some confusion as to who is responsible for their completion. One of these initiatives addresses the hiring of additional security personnel and security maintenance technicians; the other addresses accelerating upgrades to physical safeguards and security.