DOE M 452.4-1A, Protection of Use Control Vulnerabilities and Design

DOE M 452.4-1A Approved: 3-11-04 Expires: 3-11-08 PROTECTION OF USE CONTROL VULNERABILITIES AND DESIGNS U.S. DEPARTMENT OF ENERGY Office of Nuclear Weapon Surety and Quality DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Nuclear Weapon Surety and Quality CANCELE D DOE M 452.4-1A i 3-11-04 PROTECTION OF USE CONTROL VULNERABILITIES AND DESIGNS 1. PURPOSE. This manual establishes a general process and provides direction for controlling access to and disseminating Sigma 14 and 15 nuclear weapon data (NWD) at the Department of Energy (DOE). It supplements DOE O 452.4A, Security and Control of Nuclear Explosives and Nuclear Weapons, dated 12-17-01, which establishes DOE requirements and responsibilities to prevent the deliberate unauthorized use of U.S. nuclear explosives and nuclear weapons. 2. CANCELLATIONS. DOE M 452.4-1, Protection of Use Control Vulnerabilities and Designs, dated 7-1-99. Cancellation of a directive does not, by itself, modify or otherwise affect any contractual obligations to comply with such a directive. Cancelled directives incorporated by reference in a contract remain in effect until the contract is modified to delete the references to the requirements in the cancelled directives. 3. APPLICABILITY. a. Primary DOE Organizations, Including National Nuclear Security Administration (NNSA) Organizations. Except for the exclusions in paragraph 3c, this Manual applies to any of those Primary DOE Organizations with access to Sigma 14 and/or Sigma 15 NWD (i.e., documents, materials, and hardware), (see Attachment 1 for the complete list of Primary DOE Organizations). This Manual automatically applies to any primary DOE organization created after it is issued. Note that only the Administrator of NNSA can direct NNSA employees. Where ever this Manual gives direction to NNSA employees, it should be understood that this direction is provided only for the convenience of the Administrator and is not intended to assume or replace the authority of the Administrator’s direction. b. Site/Facility Management Contractors. (1) The Contractor Requirements Document (CRD), Attachment 2, sets forth requirements of this Order that will apply to site/facility management contracts that include the CRD. (2) The CRD must be included in site/facility management contracts involving access to Sigma 14 and/or Sigma 15 NWD. DOE site office managers may tailor portions of the CRD in the contract as needed. (3) This Manual does not automatically apply to other than site/facility management contractors. Any application of any requirements of this Manual to other than site/facility management contractors will be communicated separately from the Manual. (4) Lead Program Secretarial Officers are responsible for telling contracting officers which site/facility management contractors are affected by this CANCELE D ii DOE M 452.4-1A 3-11-04 Manual. Once notified, contracting officers are responsible for incorporating the CRD into the contracts of affected site/facility management contractors via the laws, regulations, and DOE directives clause of the contracts. (5) As stated in the Department of Energy Acquisition Regulation, clause 970.5204-2, Laws, Regulations, and DOE Directives, regardless of the performer of the work, site/facility management contractors with the CRD incorporated into their contracts are responsible for compliance with the CRD. (a) (b)

Affected site/facility management contractors are responsible for flowing down the requirements of the CRD to subcontractors at any tier to the extent necessary to ensure compliance with the requirements. Contractors must not unnecessarily or imprudently flow down requirements to subcontractors. That is, contractors will— 1 ensure that they and their subcontractors comply with the requirements of the CRD and 2 incur only those costs that would be incurred by a prudent person in the conduct of competitive business. c. Exclusions. This Manual does not apply to those Primary DOE Organizations indicated in Attachment 1. 4. SUMMARY. In June 1994, the Deputy Assistant Secretary for Military Application and Stockpile Management [now National Nuclear Security Administration Assistant Deputy Administrator for Military Application and Stockpile Operations (ADAMASO)] established two new NWD categories, Sigma 14 and Sigma 15, for controlling Sensitive Use Control Information. The ADAMASO staff and the Use Control Effectiveness Committee developed procedures for handling information determined to be in these categories. This Manual incorporates and finalizes these procedures and supersedes previous letter instructions. 5. CONTACTS. For additional information or technical interpretation of this Manual, contact the Office of Nuclear Weapon Surety and Quality at 301-903-3463. BY ORDER OF THE SECRETARY OF ENERGY: KYLE E. McSLARROW Deputy Secretary CANCELE D DOE M 452.4-1A iii 3-11-04 CONTENTS CHAPTER I. INTRODUCTION 1. Background...................................................................................................................... I-1 2. Scope, Purpose, and Justification..................................................................................... I-1 3. Manual Administration and Management Responsibilities............................................. I-1 a. Assistant Deputy Administrator for Military Application and Stockpile Operations (ADAMASO) .................................................................................... I-1 b. Use Control Site Coordinators ............................................................................. I-1 c. National Nuclear Security Administration Headquarters Use Control Program Coordinator ........................................................................................... I-2 d. National Nuclear Security Administration Office of Nuclear Safeguards and Security Programs ...................................................................... I-3 e. Originating Agencies/Organizations.................................................................... I-3 f. Lead Program Secretarial Officers....................................................................... I-3 g. Contracting Officers............................................................................................. I-3 4. DEFINITIONS................................................................................................................. I-3 CHAPTER II. OPERATING PROCEDURES 1. Operating Principles........................................................................................................ II-1 2. Control Process for Sigma 14 and 15 Nuclear Weapon Data......................................... II-1 a. Identification of Sigma 14 and 15 Nuclear Weapon Data .................................. II-1

b. Receipt and Transmission ................................................................................... II-2 c. Marking............................................................................................................... II-2 d. In Use .................................................................................................................. II-4 e. Storage Requirements ......................................................................................... II-4 f. Accountability..................................................................................................... II-5 g. Computer Systems .............................................................................................. II-5 3. Procedures for Restricting Access and Limiting Distribution ........................................ II-6 a. Within the Department of Energy....................................................................... II-6 b. Outside the Department of Energy ..................................................................... II-6 CANCELE D iv DOE M 452.4-1A 3-11-04 CONTENTS (continued) ATTACHMENT 1. ORGANIZATIONS TO WHICH DOE M 452.4-1A IS AND IS NOT APPLICABLE ATTACHMENT 2. CONTRACTOR REQUIREMENTS DOCUMENT CANCELE D DOE M 452.4-1A I-1 3-11-04 CHAPTER I. INTRODUCTION 1. BACKGROUND. A special category of information once known as “Sensitive Use Control Information” has been designated as Sigma 14 or Sigma 15 nuclear weapon data (NWD). Use control information is sensitive because it can significantly enhance an adversary’s ability to obtain an unauthorized nuclear detonation. Therefore, access to Sigma 14 and 15 NWD must be strictly limited to those who have a verified need to know to accomplish their jobs safely and effectively. This fact is recognized by both the Department of Defense (DoD) and the Department of Energy (DOE) and is reflected in the joint agreement “DOE/DoD Procedures for Assessments of Use Control Effectiveness,” dated January 1981. (Copies of the joint agreement are available from the Office of Nuclear Weapon Surety and Quality). Division of Sensitive Use Control Information into two categories allows the creation of two sets of access criteria and, consequently, the application of more stringent controls to matter in the most sensitive category, Sigma 14. Nuclear weapon vulnerability information will be protected within this category (Sigma 14). Sigma 14 NWD is rarely disseminated outside DOE. As with all NWD, the keystone to access control for Sigma 14 and 15 NWD is need to know. Only those individuals with the appropriate security clearances, Sigma 14 or 15 access authorizations, and valid needs to know will be permitted access to these categories of NWD. 2. SCOPE, PURPOSE, AND JUSTIFICATION. This Manual only addresses Sigma 14 and Sigma 15 NWD. The requirements contained in this Manual are in addition to the requirements for protecting classified information contained in DOE O 471.2A, Information Security Program, dated 3-27-97, and associated Orders and Manuals. It presents DOE direction for procedures to control access to information or materials that would significantly enhance an adversary’s ability to accomplish deliberate unauthorized use of nuclear weapons or explosives while ensuring that authorized personnel have access to the information necessary to accomplish their assigned tasks safely and effectively. 3. MANUAL ADMINISTRATION AND MANAGEMENT RESPONSIBILITIES.

a. Assistant Deputy Administrator for Military Application and Stockpile Operations (ADAMASO). Confirms, in writing, nominees for use control site coordinators (UCSCs), and ensures their names are given to the National Nuclear Security Administration (NNSA) Headquarters (HQ) use control program coordinator (UCPC). b. Use Control Site Coordinators. (1) Ensure rosters or databases of all site personnel currently approved for Sigma 14 and/or 15 access at their respective sites are maintained. CANCELE D I-2 DOE M 452.4-1A 3-11-04 (2) Maintain lists of matter at their respective sites containing Sigma 14 NWD, oversee annual inventories of this matter, and provide summaries of these inventories to the NNSA HQ UCPC as required. (3) Serve as points of contact for issues related to Sigma 14 or 15 NWD handling at their respective sites. (4) Coordinate with the Use Control Effectiveness Committee and knowledgeable classification authorities to identify and categorize Sigma 14 and 15 NWD consistently. (5) Coordinate site plans with local onsite organizations and the NNSA HQ UCPC. (6) Ensure site compliance with the procedures in this Manual. (7) Ensure that personnel authorized Sigma 14 or 15 access have sufficient training and awareness and are knowledgeable of the procedures for protecting such information. (8) Report any Sigma 14 NWD that cannot be found or may have been compromised to the NNSA HQ UCPC and local security office within 1 hour of a security incident declaration. (9) Approve all Sigma 14 and 15 access authorizations at their respective sites. (10) Coordinate with UCSCs at other sites as required. (11) Ensure, in conjunction with shipping organizations, that proper access controls are in force at receiving DoD organizations before hardware containing Sigma 15 NWD is transferred to DoD. (12) Designate, in writing, an alternate for Sigma 14 authorizations if required (Note: Sigma 15 authorizations may be delegated to others at a site, as appropriate, but Sigma 14 authorizations may only be handled by a designated alternate). c. National Nuclear Security Administration Headquarters Use Control Program Coordinator. (1) Serves as the UCSC for HQ organizations. (2) Serves as a backup point of contact for Sigma 14 actions at other sites, as needed. (3) Serves as a program coordinator for the overall implementation of this Manual. CANCELE D DOE M 452.4-1A I-3 3-11-04 (4) Serves as point of contact, including providing access approvals, for agencies outside DOE for interactions involving Sigma 14 and/or 15 information. (5) Develops policy and procedures in coordination with appropriate organizations to identify, categorize, and protect Sigma 14 and 15 NWD consistently. (6) Approves transfers of all Sigma 14 NWD and Sigma 15 hardware to outside agencies with the exception of items controlled by directive schedule. (7) Maintains a current list of UCSCs and periodically distributes it to the site UCSCs. (8) Confers with the NNSA HQ Office of Nuclear Safeguards and Security Programs on requests for access approval from individuals outside DOE and maintains lists of all those approved for such access. (9) Updates and maintains this Manual. d. National Nuclear Security Administration Office of Nuclear Safeguards and Security Programs. Approves requests for access approval from individuals outside DOE (with concurrence from the NNSA HQ UCPC). e. Originating Agencies/Organizations.

(1) In conjunction with their UCSCs or designees, identify specific design information that would significantly enhance an adversary’s ability to accomplish deliberate unauthorized use of nuclear weapons, explosives, or devices. (2) In conjunction with their UCSCs or designees, categorize information as Sigma 14 or 15. f. Lead Program Secretarial Officers. Notify contracting officers of affected site/facility management contractors. g. Contracting Officers. Once notified, incorporate this Order’s Contractor Requirements Document into the contracts of affected contractors. 4. DEFINITIONS. a. Documents. Written or printed information; removable automated data processing media (diskettes, tapes, cards, etc.); charts; maps; paintings; drawings; engravings; sketches; photographic prints; exposed or developed film; working CANCELE D I-4 DOE M 452.4-1A 3-11-04 notes and papers; reproductions of such things by any means or process; and sound and video recordings by magnetic, optical, or any other electronic means. b. Incidental Access. Access granted to individuals who handle or come into contact with Sigma 14 and Sigma 15 nuclear weapon data (NWD) but whose job functions do not include review or other use of the Sigma 14 and Sigma 15 NWD. c. Matter. Any combination of documents or materials. d. National Nuclear Security Administration (NNSA). As used in this Manual, NNSA includes all Federal and contractor employees that design, manufacture, or test nuclear weapons and/or explosive devices; retire nuclear weapon components; or administer the preceding programs. e. Nuclear Weapon Data. Restricted Data or Formerly Restricted Data concerning the design, manufacture, or utilization (including theory, development, storage, characteristics, performance, and effects) of nuclear weapons or nuclear weapon components, including information incorporated in or related to nuclear explosive devices. f. Sensitive Use Control Information. Information that significantly enhances an adversary’s ability to obtain an unauthorized nuclear detonation from a nuclear weapon or device. g. Sigma 14. That category of sensitive information (including bypass scenarios) concerning the vulnerability of nuclear weapons to a deliberate unauthorized nuclear detonation. h. Sigma 14 or 15 Access Authorization. A formal authorization by a DOE element or contractor organization with responsibility for Sigma 14 or 15 nuclear weapon data (NWD) for a specific individual to access that specific category of NWD. i. Sigma 15. That category of sensitive information concerning the design and function of nuclear weapon use control systems, features, and components. This includes use control for passive and active systems. It may include weapon design features not specifically part of a use control system. (Note: Not all use control design information is Sigma 15.) CANCELE D DOE M 452.4-1A II-1 3-11-04 CHAPTER II. OPERATING PROCEDURES 1. OPERATING PRINCIPLES. The following principles apply to the protection of Sigma 14 and 15 NWD. a. Access to and distribution of Sigma 14 and 15 NWD must be restricted to those persons with appropriate Sigma 14 or 15 access authorizations, valid needs to know, and DOE “Q” access authorizations or the equivalents based on Single Scope Background Investigations (SSBIs). b. The number of documents and items of hardware containing Sigma 14 NWD should be kept to the minimum necessary for operational requirements.

c. All Sigma 14 and 15 NWD are categorized as either Restricted Data (RD) or Formerly Restricted Data (FRD) and classified as either Top Secret or Secret. (For classification guidance, see the topical classification guide for nuclear weapon control.) (1) Confidential RD or FRD documents and materials previously marked as Sensitive Use Control Information should be reviewed, their classifications upgraded if appropriate, and properly marked as they are accessed during normal use (i.e., accessed or handled for any reason). (2) Documents and materials created before July 1, 1999, that contain Sigma 14 and/or Sigma 15 NWD must be properly marked with Sigma 14 or Sigma 15 caveats, as appropriate, as they are accessed during normal use (i.e., accessed or handled for any reason). (3) Information previously marked as Sensitive Use Control Information may only be stored in approved security containers with the same controls as Sigma 15 information. d. Technical discussion and/or distribution of Sigma 14 and/or 15 NWD within DOE (including NNSA and other locations) will be restricted as indicated in paragraph 1a of this chapter, and dissemination of Sigma 14 and 15 NWD outside DOE must be limited to what is absolutely essential to accomplish required tasks as approved by the NNSA HQ UCPC. 2. CONTROL PROCESS FOR SIGMA 14 AND 15 NUCLEAR WEAPON DATA. a. Identification of Sigma 14 and 15 Nuclear Weapon Data. (1) For use control or weapon systems, the specific information knowledge of which would significantly enhance an adversary’s ability to achieve a deliberate unauthorized nuclear detonation must be identified. CANCELE D II-2 DOE M 452.4-1A 3-11-04 (2) Documents containing information so identified must be categorized as Sigma 14 or Sigma 15. b. Receipt and Transmission. The receipt and transmission requirements found in DOE M 471.2-1C, Classified Matter Protection and Control Manual, dated 4-17-01, (CMPC Manual) or its successors must be followed for Sigma 14 and Sigma 15 NWD. Additionally, only personnel that have appropriate Sigma access authorizations may be designated as agents for addressees. (1) Documents. Information may be sent electronically only if the appropriate government-approved encryption is applied for the transmission and the need to know for information is protected by technical means (Entrust, etc.). (2) Hardware. (a) Hardware should be designed to prevent DoD personnel from seeing Sigma 15 NWD during normal handling and maintenance operations. (b) All transfers of Sigma 14 or Sigma 15 hardware outside DOE, with the exception of items controlled by directive schedule, must be approved. (These items include, but are not limited to, nuclear weapons; nuclear components; nuclear explosive-like assemblies; weapon trainers; flight test units; alteration/modification/retrofit components and kits; repair components; and tester and handling gear.) 1 Interface simulators or trainer hardware permanently transferred to DoD will not contain Sigma 14 NWD and can only contain that Sigma 15 NWD that is absolutely essential to support DoD operations. 2 Proper access controls must be in place at receiving DoD organizations before hardware containing Sigma 15 NWD is transferred to DoD (even on a temporary basis). c. Marking. This requirement applies to all documents and permanent hardware containing Sigma 14 and/or Sigma 15 NWD. (1) Documents. Basic marking requirements found in the CMPC Manual must be followed for Sigma 14 and Sigma 15 NWD, with the following additions.

CANCELE D DOE M 452.4-1A II-3 3-11-04 (a) Per the CMPC Manual, the caveat marking (e.g., Sigma 14) should be placed above the category marking on the first page (whether cover page, title page, or the first page of text). For example: Sigma 14 RESTRICTED DATA This document contains Restricted Data as defined in the Atomic Energy Act of 1954. Unauthorized disclosure is subjected to Administrative a Criminal Sanctions. nd (b) Individual pages of a Sigma 14 and/or Sigma 15 document may be marked with the words Sigma 14 and/or Sigma 15 as appropriate. (This is a good business practice but not a requirement.) (c) Because Sigma 14 is the most sensitive category, documents containing both Sigma 14 and Sigma 15 NWD must be marked Sigma 14 to ensure they are protected at the highest level. (d) Documents containing Sigma 14 NWD will carry the following additional handling instruction. This document may not be reproduced or disseminated beyond original distribution without approval of the originator, the originating agency Use Control Site Coordinator, or the National Nuclear Security Administration Headquarters Use Control Program Coordinator. (e) Sigma 14 and Sigma 15 documents must have unique and distinctive cover sheets specifying the appropriate Sigma 14 or 15 access authorization is required before viewing the contents. 1 When a Sigma 14 or 15 document is removed from a security container, a standard form cover sheet must be applied to each document by placing it over the distinctive Sigma 14 or Sigma 15 cover sheet. 2 In lieu of the two cover sheets, a locally created cover sheet or identifying label on a standard form cover sheet may be used if approved by the responsible security office. (2) Hardware. (a) Permanent hardware or hardware configurations identified as containing Sigma 14 NWD will be placed in accountability and CANCELE D II-4 DOE M 452.4-1A 3-11-04 subjected to the same access restrictions as those described in the preceding paragraphs. (b) Temporary hardware configurations identified as containing Sigma 14 NWD (e.g., those used during black-hat or field exercises) must be access-restricted, and accountability may be waived by the site UCSC if satisfied with the compensatory security measures in place. Such temporary Sigma 14 hardware configurations must be dismantled as soon as possible after the activity is ended. (c) In lieu of marking, design laboratories and production agencies will establish instructions for handling hardware designated for Sigma 14 or Sigma 15 NWD. These instructions may be tailored for special situations and programs, but in developing them, the design laboratories/production agencies must consider the cost of implementation. d. In Use. (1) In use (unattended) storage policy is not allowed for Sigma 14 NWD. Sigma 14 documents must be constantly attended by or under the control of a person with the proper access authorization and need to know. (2) Sigma 14 documents will not be left unattended in an “open storage” room or vault. (3) The in use requirements found in the CMPC Manual must be followed for Sigma 15 NWD. e. Storage Requirements. The storage requirements found in the CMPC Manual must be followed for Sigma 14 and Sigma 15 documents, with the following additions. (1) Top Secret Sigma 14 documents must be stored in a vault or vault-type room, physically separated from other non-Sigma-14 documents, and locked in an approved security container.

(2) Secret Sigma 14 documents within a vault or vault-type room must be physically separated from other non-Sigma-14 documents and locked in an appropriate container (i.e., file cabinet, desk, or approved security container). (3) Secret Sigma 14 documents within a Limited Area but outside a vault or vault-type room must be physically separated from other non-Sigma-14 documents and locked in an approved security container. CANCELE D DOE M 452.4-1A II-5 3-11-04 (4) Only personnel authorized Sigma 14 access may have access to security containers (and their combinations) that have Sigma 14 content. (5) Only personnel authorized Sigma 15 access may have access to security containers (and their combinations) that have Sigma 15 content. (6) Personnel authorized only for Sigma 15 access must obtain additional Sigma 14 authorization as previously described to be granted access to Sigma 14 containers and information. f. Accountability. For Sigma 14 and 15 matter, the accountability requirements found in the CMPC Manual must be followed, with the following additions. (1) Inventory. An annual inventory of Sigma 14 matter will be performed to support scheduled NNSA reporting requirements. (2) Report. A summary of the annual inventory will be provided, if requested, to the NNSA HQ UCPC for each site holding Sigma 14 NWD. If requested, the report will consist of the following: (a) name and location of the site, (b) number of Sigma 14 documents and materials at the site, (c) number of Sigma 14 documents and materials entered into accountability during the reporting period, and (d) number of Sigma 14 documents and materials destroyed during the reporting period. g. Computer Systems. (1) Sigma data residing on computer systems will be protected from unauthorized access in a manner that is consistent with the protection of the same information when it is in a paper document. (2) Controls will be enacted, where required, to be consistent with those in place for paper documents. Electronic media containing Sigma 14 or 15 NWD must be externally marked to indicate that they contain Sigma 14 or 15 NWD. (3) Specific baseline requirements contained in DOE M 471.2-2, Classified Information Systems Security Manual, dated 8-3-99, (or successor) must be followed for Sigma 14 and Sigma 15 NWD. CANCELE D II-6 DOE M 452.4-1A 3-11-04 3. PROCEDURES FOR RESTRICTING ACCESS AND LIMITING DISTRIBUTION. a. Within the Department of Energy. (1) Each DOE site that handles Sigma 14 and/or 15 NWD must nominate a UCSC to be responsible for ensuring site compliance with the procedures in this Manual, including approving Sigma 14 and 15 access authorizations at the site. The nominee must have sufficient stature in the organization to ensure that effective methods for implementing these procedures are established for in use at the site. (2) UCSC nominees will be confirmed in writing by NNSA, and a current list of UCSC s will be maintained at HQ and periodically distributed to the UCSCs. (3) Each site that handles Sigma 14 and/or 15 NWD must maintain current and historical lists and/or databases of all site personnel authorized Sigma 14 and/or 15 access. (a) When site personnel going to other locations require Sigma 14 and/or 15 access, the sites involved will coordinate access approvals. (b) The NNSA Weapon Data Access Control System must be used to record an individual’s access to this information.

(4) Personnel afforded incidental access to Sigma 15 NWD (i.e., security guards, network administrators, library custodians, mail room clerks, emergency response personnel) may be separately identified. (a) Such personnel do not require a need to know as specified in paragraph 1a of this chapter, but require access to areas containing Sigma 15 matter to perform authorized functions and activities. This exception is limited to special circumstances as authorized by the NNSA HQ UCPC and respective site UCSC and may not be used as an alternative to the site UCSC Sigma 15 list and/or database. (b) All persons afforded incidental access to Sigma 14 NWD must be included in the site Sigma 14 access list and/or database. b. Outside the Department of Energy. (1) Individuals outside DOE must have Sigma 14 or 15 access authorizations before they can be given Sigma 14 or 15 NWD. CANCELE D DOE M 452.4-1A II-7 3-11-04 (a) Requests for access to Sigma 14 or 15 NWD should be made using DOE F 5631.20, U.S. Department of Energy Request for Visit or Access Approval. (b) Current lists of non-DOE personnel with access to Sigma 14 and Sigma 15 NWD must be maintained. (2) Requests for access to Sigma 14 and/or 15 NWD from DoD personnel must have prior approval through the Assistant to the Secretary of Defense (ATSD), Nuclear, Chemical, and Biological Defense Programs (NCB), or its successor organization. Such approval will be provided for specific purposes or projects and will be contingent upon confirmation that the personnel have Q access authorizations (or comparable authorizations based on SSBIs) and valid needs to know. (3) The following provisions also apply to individuals outside DOE. (a) Authorizations for access to Sigma 14 or Sigma 15 NWD may not exceed 1 year, although reauthorization is allowed. 1 Continuing or blanket access to Sigma 14 or 15 NWD is allowed only in special situations and as justified in writing to the NNSA HQ UCPC. 2 Sponsoring organizations are required to inform the site UCSC as access needs change. (b) Except for DoD personnel in designated Sigma 14 or Sigma 15 billets, access to Sigma 14 or Sigma 15 NWD by personnel outside DOE will be on a case-by-case basis. Some agencies and/or offices may require special procedures. (These will be handled by the HQ UCPC in concert with the concerned agencies and/or offices.) (c) Documents containing Sigma 14 NWD must be approved for transfer to agencies outside DOE. The special circumstances and time periods for such transfers will be established by the ADAMASO. (d) Documents containing Sigma 15 NWD may be transferred to agencies outside DOE by currently established procedures. These procedures include, but are not limited to, obtaining approval via the NNSA Weapon Data Access Control System and ensuring use of authorized channels and/or facilities by querying the Safeguards and Security Information Management System (SSIMS). (To ensure compliance with the latest procedures, contact the Office of Nuclear Weapon Surety and Quality at 301-903-3463.) CANCELE D II-8 DOE M 452.4-1A 3-11-04 (e) Dissemination of Sigma 14 or 15 NWD outside DOE requires the recipient to maintain accountability (Sigma 14 only), storage, and handling procedures equivalent to the requirements set forth in this Manual. These requirements preclude further dissemination of NWD without approval from the HQ UCPC and restrict NWD access to those individuals authorized by the HQ UCPC.

(f) Certain positions within DoD may be designated for continuing access to Sigma 14 or 15 upon agreement between the ATSD (NCB) and ADAMASO. CANCELE D DOE M 452.4-1A Attachment 1 3-11-04 Page 1 PRIMARY DOE ORGANIZATIONS TO WHICH DOE M 452.4-1A IS APPLICABLE Office of the Secretary Office of Congressional and Intergovernmental Affairs Office of Counterintelligence Departmental Representative to the Defense Nuclear Facilities Safety Board Office of General Counsel Office of Independent Oversight and Performance Assurance Office of the Inspector General Office of Intelligence Office of Management, Budget and Evaluation and Chief Financial Officer Office of Nuclear Energy, Science and Technology National Nuclear Security Administration Office of Policy and International Affairs Office of Science Office of Security Office of Security and Safety Performance Assurance PRIMARY DOE ORGANIZATIONS TO WHICH DOE M 452.4-1A IS NOT APPLICABLE Chief Information Officer Office of Civilian Radioactive Waste Management Office of Economic Impact and Diversity Office of Electric Transmission and Distribution Office of Energy Assurance Office of Energy Efficiency and Renewable Energy Energy Information Administration Office of Environment, Safety and Health Office of Environmental Management Office of Fossil Energy Office of Hearings and Appeals Office of Legacy Management Office of Public Affairs Secretary of Energy Advisory Board Bonneville Power Administration CANCELE D Attachment 1 DOE M 452.4-1A Page 2 3-11-04 Southeastern Power Administration Southwestern Power Administration Western Area Power Administration CANCELE D DOE M 452.4-1A Attachment 2 3-11-04 Page 1 CONTRACTOR REQUIREMENTS DOCUMENT DOE M 452.4-1A, PROTECTION OF USE CONTROL VULNERABILITIES AND DESIGNS This Contractor Requirements Document (CRD) specifies requirements applicable to Department of Energy (DOE) contractors, including National Nuclear Security Administration (NNSA) contractors, whose employees have access to Sigma 14 and/or Sigma 15 nuclear weapon data (NWD). Regardless of the performer of the work, the contractor is responsible for compliance with the requirements of this CRD. Affected site/facility management contractors are responsible for flowing down the requirements of the CRD to subcontractors at any tier to the extent necessary to ensure compliance with the requirements. 1. The contractor must appoint a use control site coordinator (UCSC) and provide his or her name to the NNSA Headquarters (HQ) use control program coordinator (UCPC). The UCSC must have sufficient stature in the organization to ensure that effective methods for implementing these procedures are established and are in use at that contractor site. 2. The contractor must— a. maintain a list of documents containing Sigma 14 NWD, and, when requested, provide a summary of this list to the NNSA HQ UCPC at least annually; b. provide a point of contact for issues related to Sigma 14 and 15 NWD handling; c. coordinate procedures with knowledgeable derivative classifiers, the Use Control Effectiveness Committee, and classification authorities to identify, classify, and categorize Sigma 14 and 15 NWD consistently; d. coordinate site plans with local onsite organizations and the NNSA HQ UCPC; e. ensure site compliance with these procedures; f. ensure that personnel authorized Sigma 14 or 15 access have sufficient training and awareness and are knowledgeable of the procedures for protecting such information; and

g. report any Sigma 14 matter that cannot be found or may have been compromised to the NNSA HQ UCPC and the local security office within 1 hour of a security incident declaration. 3. The contractor must ensure that the following operating principles are complied with. a. Access to and distribution of Sigma 14 and 15 NWD must be restricted to persons with the appropriate Sigma 14 or 15 access authorizations, valid needs to know, and DOE “Q” access authorizations or equivalent authorizations, based on Single Scope Background Investigations (SSBIs). CANCELE D Attachment 2 DOE M 452.4-1A Page 2 3-11-04 b. The number of documents and items of hardware containing Sigma 14 should be kept to the minimum necessary for operational requirements. c. All Sigma 14 and 15 NWD are to be classified as Secret or Top Secret Restricted Data (RD) or Formerly Restricted Data (FRD) per the Topical Classification Guide for Use Control-3 (TCGUC-3) or its successor. (1) Confidential FRD or RD documents previously marked as Sensitive Use Control Information should be reviewed, their classifications upgraded if appropriate, and properly marked as they are accessed during normal use (i.e., if they are accessed or handled for any reason). (2) Older documents not covered by the preceding restrictions that contain Sigma 14 or 15 data must be correctly marked and their classifications upgraded if necessary as they are accessed during normal use (i.e., if they are accessed or handled for any reason). (3) Information previously marked as Sensitive Use Control Information may only be stored in approved security containers with the same controls as Sigma 15 information. (4) Where appropriate, hardware classifications must be upgraded. d. Technical discussion and/or distribution of Sigma 14 or 15 NWD within the DOE complex must be restricted as indicated in paragraph 3a of this CRD, and dissemination of NWD outside DOE must be limited to what is absolutely essential to perform required tasks as approved by the NNSA HQ UCPC. e. Sigma 14 NWD must be housed only in those facilities where effective protective measures (as defined in this CRD) are implemented. 4. The contractor must ensure that documents and materials containing Sigma 14 information are identified, their classifications upgraded if appropriate, properly marked, and entered into formal accountability. a. In addition to the markings required by DOE O 471.2A, Information Security Program, dated 3-27-97, and its associated implementing Manual and CRD, documents containing Sigma 14 must carry the following additional handling instruction. CANCELE D This document may not be reproduced or disseminated beyond original distribution without approval of the originator, the originating agency Use Control Site Coordinator, or the National Nuclear Security Administration Headquarters Use Control Program Coordinator. DOE M 452.4-1A Attachment 2 3-11-04 Page 3 b. In addition to the storage requirements found in DOE M 471.2-1C, Classified Matter Protection and Control Manual, dated 4-17-01, (or successor), the contractor must comply with the following. (1) Top Secret Sigma 14 documents must be stored in a vault or vault-type room, physically separated from other non-Sigma-14 documents, and locked in an approved security container. (2) Secret Sigma 14 documents within a vault or vault-type room must be physically separated from other non-Sigma-14 documents and locked in an appropriate container (i.e., file cabinet, desk, or approved security container).

(3) Secret Sigma 14 documents within a Limited Area but outside a vault or vault-type room must be physically separated from other non-Sigma-14 documents and locked in an approved security container. c. Only personnel authorized Sigma 14 access may have access to security containers (and their combinations) that have Sigma 14 content. (1) The person with control of this matter must determine that the intended recipient is approved for Sigma 14 access and has a current need to know before allowing access. (2) Sigma 14 documents must not be left unattended in an “open storage” room or vault. d. While restrictions on Sigma 15 NWD are similar to those for Sigma 14 NWD, Sigma 15 can be commingled with other classified documents; however, only personnel authorized Sigma 15 access may have access to security containers (and their combinations) that have Sigma 15 content. e. People only authorized for Sigma 15 access must obtain Sigma 14 authorizations as previously described to be granted access to Sigma 14 containers and information. 5. The contractor must use general classification guidelines and definitions related to use control and specific weapon classification guides. (See the joint “DOE/DoD Nuclear Weapon Classification Policy Guide,” CG-W-5, Chapter 5-B, and the TCGUC-3.) 6. The contractor must maintain current and historical lists and/or databases of all site personnel authorized Sigma 14 or 15 access. a. All Sigma 14 or 15 access authorizations must be approved by the UCSC. b. When site personnel going to other locations require either Sigma 14 or Sigma 15 access, the UCSCs of the respective sites must coordinate access approvals. CANCELE D Attachment 2 DOE M 452.4-1A Page 4 3-11-04 c. The DOE Weapon Date Access Control System must be used to record an individual’s access to this information. 7. The contractor must deny access to Sigma 14 and/or 15 NWD to Departmental officials not possessing the requisite access authorizations, as described in this CRD. Without the appropriate access authorizations, access is limited to Sigma 1 through 13 NWD. 8. The contractor must deny access to Sigma 14 and/or 15 NWD to individuals from outside DOE unless access has been requested from and approved by the Office of Nuclear Safeguards and Security Programs. a. Such requests must be made using DOE F 5631.20, U.S. Department of Energy Request for Visit or Access Approval. (Note: As part of the approval process, the Office of Nuclear Safeguards and Security Programs obtains concurrence from the NNSA HQ UCPC.) b. Requests from DoD personnel must have the prior approval of the Assistant to the Secretary of Defense (ATSD), Nuclear, Chemical, and Biological Defense Programs (NCB), or its successor organization. Such approval must be provided for specific purposes or projects and must be contingent upon confirmation that the personnel have Q access authorizations (or equivalents, based on SSBIs) and valid needs to know. The following additional provisions apply. (1) Continuing or blanket access to Sigma 14 or 15 NWD is allowed only in special situations and as justified in writing to the NNSA HQ UCPC. The sponsoring organization is required to inform the site UCSC as access needs change. (2) Documents containing Sigma 14 NWD must not be transferred to agencies outside DOE without explicit approval of the NNSA HQ UCPC. The special circumstances and time periods for such transfers must be established by the Assistant Deputy Administrator for Military Application and Stockpile Operations.

(3) Documents containing Sigma 15 NWD may be transferred to agencies outside DOE by currently established procedures. These procedures include, but are not limited to, obtaining approval via the NNSA Weapon Data Access Control System and ensuring use of authorized channels and/or facilities by querying the Safeguards and Security Information Management System. (To ensure compliance with the latest procedure, contact the Office of Nuclear Weapon Surety and Quality.) (4) Dissemination of Sigma 14 or 15 NWD outside DOE requires the recipient to maintain accountability, storage, and handling procedures equivalent to the requirements set forth in this CRD. These requirements preclude further dissemination of NWD without approval from the NNSA HQ UCPC. CANCELE D DOE M 452.4-1A Attachment 2 3-11-04 Page 5 c. Certain positions within DoD may be designated for continuing access to Sigma 14 or 15 NWD upon agreement between the ATSD(NCB) and the NNSA Assistant Deputy Administrator for Military Application and Stockpile Operations. 9. The contractor must identify all Sigma 14 hardware, place it into accountability, and subject it to the same access restrictions as those described in the preceding paragraphs. a. Temporary hardware configurations identified as containing Sigma 14 NWD (e.g., those used during black-hat or field exercises) must be access-restricted; however, accountability may be waived by the UCSC if he/she is satisfied with the compensatory security measures in place. Such temporary configurations must be dismantled as soon as possible after the activity is ended. b. The contractor must also comply with the following hardware restrictions. (1) Work with the design laboratories and production agencies to establish site instructions for marking and handling hardware designated as Sigma 14 or Sigma 15. (These instructions may be tailored for special situations and programs; however, the costs of implementation must be considered.) (2) Design hardware to prevent DoD personnel from seeing Sigma 15 NWD during normal handling and maintenance operations. (3) Ensure that interface simulators or trainer hardware permanently transferred to DoD does not contain Sigma 14 information and only contains the Sigma 15 NWD that is absolutely essential to support DoD operations. (4) Before hardware containing Sigma 15 NWD is transferred to DoD (even on a temporary basis), the shipping organization and associated UCSC must ensure that proper accountability and access controls are in force at the receiving DoD organization. (5) The NNSA HQ UCPC must approve the transfer of all Sigma 14 hardware outside DOE. Except for items controlled by directive schedule (e.g., nuclear weapons, associated trainers, nuclear components, and joint test units), the NNSA HQ UCPC also must approve the transfer of all Sigma 15 hardware outside DOE. 10. The UCSC may delegate Sigma 15 authorization responsibilities to others within the site; however, Sigma 14 access authorization responsibility cannot be delegated. a. The UCSC can designate an alternate for Sigma 14 access authorizations, if required. b. In addition, the NNSA HQ UCPC can serve as a backup point of contact for Sigma 14 actions at contractor sites when needed. CANCELE D Attachment 2 DOE M 452.4-1A Page 6 3-11-04 11. If requested by the NNSA HQ UCPC, the contractor must perform an annual inventory of Sigma 14 matter to support scheduled NNSA reporting requirements.

a. The site UCSC must oversee the inventory and must provide a summary to the NNSA HQ UCPC for each site holding Sigma 14 information. b. The report to the NNSA HQ UCPC must consist of the following— (1) name and location of the site; (2) number of Sigma 14 documents and materials at the site; (3) number of Sigma 14 documents and materials entered into accountability during the reporting period (within the last year); and (4) number of Sigma 14 documents and materials destroyed during the reporting period (i.e., within the last year). 12. Personnel afforded incidental access to Sigma 15 NWD (e.g., security guards, network administrators, library custodians, mail room clerks, emergency response personnel) may be separately identified. Such personnel do not require the needs to know identified in paragraph 3a of this CRD but require access to areas containing Sigma 15 matter to perform authorized functions and activities. This exception is limited to special circumstances as authorized by the NNSA HQ UCPC and respective site UCSC and may not be used as an alternative to the site UCSC Sigma 15 list and/or database. 13. Personnel afforded incidental access to Sigma 14 NWD must be included in the site Sigma 14 access list and/or database. 14. Sigma 14 and Sigma 15 documents must have unique and distinctive cover sheets specifying that the appropriate Sigma 14 or Sigma 15 access authorization is required before viewing the contents. The contractor may, in lieu of two cover sheets, create a local cover sheet if approved by the responsible security office. CANCELE D Cover PROTECTION OF USE CONTROL VULNERABILITIES AND DESIGNS CONTENTS CHAPTER I. INTRODUCTION 1. Background 2. Scope, Purpose, and Justification 3. Manual Administration and Management Responsibilities a. Assistant Deputy Administrator for Military Application and Stockpile Operations b. Use Control Site Coordinators c. National Nuclear Security Administration Headquarters Use Control Program Coordinator d. National Nuclear Security Administration Office of Nuclear Safeguards and Security Programs e. Originating Agencies/Organizations f. Lead Program Secretarial Officers g. Contracting Officers 4. DEFINITIONS a. Documents b. Incidental Access c. Matter d. National Nuclear Security Administration (NNSA) e. Nuclear Weapon Data f. Sensitive Use Control Information g. Sigma 14 h. Sigma 14 or 15 Access Authorization i. Sigma 15 CHAPTER II. OPERATING PROCEDURES 1. OPERATING PRINCIPLES 2. CONTROL PROCESS FOR SIGMA 14 AND 15 NUCLEAR WEAPON DATA. a. Identification of Sigma 14 and 15 Nuclear Weapon Data b. Receipt and Transmission c. Marking d. In Use e. Storage Requirements f. Accountability g. Computer Systems 3. PROCEDURES FOR RESTRICTING ACCESS AND LIMITING DISTRIBUTION a. Within the Department of Energy b. Outside the Department of Energy ATTACHMENT 1. PRIMARY DOE ORGANIZATIONS TO WHICH DOE M 452.4-1A IS AND IS NOT APPLICABLE ATTACHMENT 2. CONTRACTOR REQUIREMENTS DOCUMENT