003.03-02, Delegation of Authority for Cyber Security

Oepartmnnt of E norgy Niitionnl Nuclear Sf!c11rlty /\dtYtinistration \ 1Vashinnton, OC 20£18~:; February 16, 2011 SUBJECT: Delegation of Authority- Cyber Security Reference: 1. Title XXXll of the National Defense Authorization Act for Fiscal Year 2000 (P.L. 106-65) as amended, dated October 5, 1999, Section 3232 2. Memorandum from the Administrator to Chief, Defense Nuclear Security, subject: Delegation of Authority, dated July 10, 2008 3. Memorandum from the Chief, Defense Nuclear Security to Chief Information Officer, subject: Delegation of authority for Cyber security, dated October 8, 2008 The Chief, Defense Nuclear Security, is responsible, by statute, for the development and implementation of security programs for the National Nuclear Security Administration (NNSA), including the protection, control, and ·accounting of materials, and for the physical and cyber security for all NNSA facilltie;. A~ such, the Chief, Defense Nuclear Security has been delegated authority from the Administrator to function as the Cognizant Security Authority for NNSA. I hereby re-delegate the Cognizant Security Authority for cvber security to NNSA's Chief information Officer {CIO), including the authority to oversee compliance within authorized management authority as prescribed by law, Executive Order, or Departmental Policy and directives. This authority may be re-delegated once to the NNSA Chief Information Security Officer. Coples of any re-delegations of this authority will be provided to the Chief, Defense Nuclear Security. To allow the Chief, Defense Nuclear Security to fulfill assigned statutory responsibilities, the NNSA CIO or delegate will routinely report on and obt3in concurrence as appropriate for decisions in the following areas: • Any significant changes to NNSA cyber security policy and/or guidance affecting the security posture of classified or unclassified Information systems. • Any risks associated with a significant cyber security Incident and/or critical emerging threats effecting NNSA Information systems. • Planning, programming, budgeting, and execution for NNSA's FS-21 cyber security budget. • Annual NNSAsite assessment guidance for cyber security programs. • Any NNSA cyber security policy, guidance, initiative, or issue that requires coordination with the physical security program. • Development of NNSA cyber security strategic plans. • Results and corrective actions associated with major inspection activities (e.g., Office o( Inspector General, Office of Health, Safety and Security, Government Accountability Office, etc.). All previous delegations for the NNSfl cyber security program are hereby resdnded . . cc: Thomas D'Agostino, NA-1 Nelle Miller, NA-2 Robert Osborn II, NA-2.2 David Jonas, NA-3.1 Mark Holecek, KCSO Allee Williams, LSO Kevin Smith, LASO Stephen Mellington, NSO Steven Erhart, PXSO Patty Wagner, 550 Douglas Dearolph, SRSO Theodore Sherry, YSO Karen Boardman, NZ 2