DOE O 470.2B, Independent Oversight and Performance Assurance Program

DISTRIBUTION: INITIATED BY: All Department Heads Office of Independent Oversight and Performance Assurance U.S. Department of Energy ORDER Washington, D.C. Approved: 10-31-02 SUBJECT: INDEPENDENT OVERSIGHT AND PERFORMANCE ASSURANCE PROGRAM 1. OBJECTIVE. To prescribe the requirements and responsibilities for the Department of Energy (DOE) Independent Oversight and Performance Assurance Program. The Independent Oversight Program is designed to enhance the DOE safeguards and security; cyber security; emergency management; and environment, safety, and health programs by providing DOE and contractor managers, Congress, and other stakeholders with an independent evaluation of the adequacy of DOE policy and the effectiveness of line management performance in safeguards and security; cyber security; emergency management; environment, safety, and health; and other critical functions as directed by the Secretary. This order specifies the formal process for responding to independent oversight findings through a corrective action process that implements Defense Nuclear Facilities Safety Board Recommendation 98-1. 2. CANCELLATION. Cancellation of an Order does not modify or otherwise affect any contractual obligation to comply with such an Order. Canceled Orders incorporated by reference in a contract remain in effect until the contract is modified to delete the reference to the requirements in the canceled Orders. a. DOE O 470.2A, Security and Emergency Management Independent Oversight Program, dated 03-01-00. (This order is superceded completely by 470.2B) b. DOE O 414.1A, Quality Assurance, Attachment 2, Safety Issue Corrective Action Process (no other parts of DOE O 414.1A are affected by this cancellation). 3. APPLICABILITY. a. DOE Elements. Except as noted in paragraph 3c, this Order applies to all DOE elements, including the National Nuclear Security Administration (NNSA), (see Attachment 1) . b. Contractors. (1) This Order’s Contractor Requirements Document (CRD), contained in Attachment 2, applies to all DOE site/facility management contracts consistent with the clause entitled Laws, regulations, and DOE directives, 48 CFR 970.5204-2. See paragraph 5.d(1) below. DOE O 470.2B 2 DOE O 470.2B 10-31-02 (2) The pertinent requirements of the CRD of this Order shall also be made applicable to other DOE contracts that contain the clauses Security (48 CFR 952.204-2), Classification/Declassification (48 CFR 952.204-70), and/or Integration of environment, safety and health into work planning and execution (48 CFR 952.223-71). See paragraph 5.e. below. c. Exclusions. This Order does not apply to activities conducted under the authority of the Director, Naval Nuclear Propulsion Program, as assigned by Executive Order 12344 (statutorily prescribed by 42 U.S.C. 7158, note). With respect to intelligence-related activities of the Director, Office of Intelligence, this Order applies only to information protection and cyber security measures, pursuant to Executive Order 12333. Consistent with Secretarial Delegation Order Number 00-033.00A to the Administrator and Chief Executive Officer, Bonneville Power Administration, this order does not apply to oversight of environmental programs or occupational safety and health programs at Bonneville Power Administration. 4. REQUIREMENTS.

a. Program Independence. The Office of Independent Oversight and Performance Assurance (OA) has the responsibility for independent oversight within DOE, reporting directly to the Secretary. To provide an objective evaluation of the Department’s performance, OA is independent of all other DOE elements that have line, program management, and/or policy development responsibilities for safeguards and security; cyber security; emergency management; or environment, safety, and health programs. b. Basis for Independent Oversight and Performance Assurance Activities. (1) OA is the DOE focal point for independent evaluation of DOE sites, facilities, organizations, and operations in the areas of safeguards and security; cyber security; emergency management; and environment, safety, and health. (2) The following are to be used as the basis for independent oversight: DOE Orders, Notices and Manuals; approved site safeguards and security plans, cyber security plans, and other security plans; DOE threat statements; emergency management program plans; approved site safety management system description documents, integrated safety management (ISM) contract clauses, other ISM implementation documents, and other quality assurance documentation; safety basis, authorization basis, and authorization agreements; applicable statutes and rules; other contractually mandated requirements; and approved deviations. Other DOE guidance, while not to be considered or applied as requirements, may be used to augment and strengthen the baseline by providing supplemental information about acceptable methods for implementing requirements contained in Orders, Notices, and Manuals. DOE O 470.2B 3 10-31-02 (3) OA evaluates the effectiveness of line management performance in safeguards and security; cyber security; emergency management; and environment, safety, and health programs to determine the adequacy of DOE policy and policy implementation. c. Licensed DOE Facilities or Activities. Independent oversight activities for DOE facilities or activities licensed by the Nuclear Regulatory Commission must, except where excluded by law or DOE policy, be structured to minimize or eliminate duplication of oversight efforts while ensuring DOE security interests; emergency management; and environment, safety, and health programs and associated facilities are independently evaluated. Accordingly, the scheduling of independent oversight activities must take into account the inspection and assessment activities of the Nuclear Regulatory Commission. d. Conduct of Safeguards and Security; Cyber Security; Emergency Management; and Environment, Safety, and Health Independent Oversight and Performance Assurance Appraisals. The appraisal process is used to implement the Independent Oversight and Performance Assurance Program. (1) Appraisals (e.g., inspections, safety management evaluations, special reviews, special studies, and follow-up reviews) are used to evaluate the status of safeguards and security; cyber security; emergency management; and environment, safety, and health at DOE-owned or DOE-leased sites or facilities or for DOE operations or organizations. (2) Appropriate scheduling, notification, and planning, using OA specific appraisal process protocols that include a process for prioritizing and scheduling appraisal activities, must be completed before appraisals are conducted.

(3) Appraisals are conducted to evaluate management systems, adequacy of policy, and implementation of policy. Data collection activities include, but are not limited to, measurement of actual performance whenever possible, interviews, and document reviews. Available classified and unclassified information sources must be used to determine the effectiveness of protection afforded to the workers, the public, the environment, and national security interests, and the ability of protection programs to prevent an unacceptable immediate risk to the workers, the public, or the environment or the inadvertent release of national security information. (4) The factual accuracy of appraisal results must be verified by the most qualified DOE line management (field element/cognizant secretarial office/NNSA Deputy Administrators) personnel available. The factual accuracy process is described in detail in paragraph 4f. 4 DOE O 470.2B 10-31-02 (5) As deemed appropriate by the Director, Office of Independent Oversight and Performance Assurance, ratings (effective performance, needs improvement, or significant weakness) and findings may be assigned to overall programs and/or selected topical areas. (6) Findings must be clearly identified in the appraisal report to facilitate the development of corrective actions by the responsible organization. As appropriate, findings must reference the relevant DOE requirements. (7) Safeguards and security and cyber security findings are formally tracked using the Safeguards and Security Information Management System (SSIMS). Emergency management and environment, safety, and health findings are formally tracked using the Corrective Action Tracking System (CATS). OA may follow up on these findings in accordance with established DOE protocols. (8) When appropriate, appraisal results should identify enhancements (opportunities for improvement) that can assist line and program managers improve program implementation or performance based on the results from the appraisal. e. Response to Major Vulnerabilities or Imminent Danger. (1) OA will advise line management promptly (not to exceed 24 hours) when appraisal activities indicate — (a) an imminent danger (unmitigated hazard) situation that presents an unacceptable immediate risk to workers, public health, or the environment, (b) a major safeguards and security or cyber security vulnerability (e.g., unacceptable risk of special nuclear material theft or diversion, radiological or industrial sabotage, espionage), or (c) emergency management deficiencies that present an unacceptable immediate risk to workers, the public, or the environment, or national security. (2) When notified by OA of any of the above conditions (imminent danger, a major vulnerability, or emergency management deficiency), line management must take the following actions: (a) promptly identify and implement immediate compensatory actions to mitigate the condition, (b) within 10 working days, notify the Cognizant Secretarial Officer and OA of actions taken or compensatory measures planned, and DOE O 470.2B 5 10-31-02 (c) develop and implement long-term actions (including determining costs and identifying funds) to eliminate the vulnerability or reduce the level of danger to an acceptable level as soon as possible. (3) If line management disagrees with the severity of the identified condition or the need for prompt action, this should immediately be brought to the attention of senior DOE management for resolution.

f. Reporting. OA must inform senior DOE officials, including NNSA Deputy Administrators, cognizant secretarial officers, and DOE field managers of all appraisal results regarding the effectiveness of safeguards and security; cyber security; emergency management; or environment, safety, and health programs, as appropriate. Communication of appraisal results will include briefings, reports, and other written products as follows: (1) Throughout the appraisal process, OA must provide updates on the status of the appraisal to the Secretary, Deputy Secretary, Under Secretaries, cognizant secretarial officers, and policy organizations (e.g., Office of Security, Office of Emergency Operations, Office of the Chief Information Officer, or the Office of Environment, Safety and Health), as appropriate. (2) Under most circumstances, reports must be prepared according to the following processes and time frames. The Director, OA, may modify the prescribed time frames when appropriate (e.g., to evaluate multiple sites or organizations requiring extensive coordination among various field elements and to address special needs). (a) During the course of data collection, multiple opportunities are provided to validate the information collected by OA and used to develop the appraisal report. During the later stages of an appraisal, OA prepares a preliminary draft report, which must be submitted to responsible DOE line management organizations for initial onsite validation and review for factual accuracy. These organizations complete their reviews based on the agreed to appraisal schedule. (b) After considering the factual accuracy of comments and making revisions as appropriate, OA must distribute a final draft report for formal review and comment (typically before leaving the site). The final draft report is provided to each of the following: the DOE field element, the cognizant secretarial officer, the NNSA Administrator or Under Secretary (as applicable), and applicable DOE policy organizations (based on the appraisal results). 6 DOE O 470.2B 10-31-02 (c) Formal review and comment on the final draft report must be completed within 10 working days of receiving the final draft report. A unified response is expected from DOE line management organizations. The applicable policy organizations are expected to provide comments separately. (d) OA reviews comments on the factual accuracy of the final draft report and prepares the final report within 10 working days of receiving comments. (3) Line management organizations and other responsible DOE organizations may provide appraisal reports (including the preliminary draft report, the final draft report, and the final report) to personnel in their organizations for review. OA will coordinate with the Office of the Secretary to determine the appropriate distribution of the final report to other organizations. (4) OA will brief the following individuals on the results of appraisal activities: DOE senior managers, applicable cognizant secretarial officers, managers of affected DOE field elements, the NNSA Administrator or Under Secretary (as applicable), and appropriate DOE policy organizations. (5) OA will coordinate with the cognizant secretarial officers, the affected DOE field elements, and the NNSA Administrator or Under Secretary (as applicable) before briefing other DOE personnel, the DOE Security Council, or the Defense Nuclear Facilities Safety Board. Based on the timing of those briefings, the cognizant secretarial officer or NNSA Deputy Administrator and/or DOE field element manager may be requested to present their approaches to implementing corrective actions.

(6) OA will coordinate with Public Affairs, congressional liaison, DOE line management organizations, the Office of Security, the NNSA Administrator or Under Secretary (as applicable), and the Office of the Secretary to develop an approach for providing appraisal results to external stakeholders. g. Corrective Action Development. DOE line managers, the Cognizant Line Manager (CLM), with the approval of the applicable Cognizant Secretarial Officer (CSO), must develop and implement corrective actions to address the findings identified in the appraisal report. When a finding addresses DOE policy, the applicable policy organization must develop and implement appropriate corrective actions. The corrective action plan process includes the following: (1) Interim Corrective Action Plan (a) An interim corrective action plan is not required for environment, safety and health findings. An interim corrective action plan is DOE O 470.2B 7 10-31-02 required for all safeguards and security, cyber security and emergency management findings. (b) The responsible organizations, as identified by the findings, must prepare and submit interim corrective action plans to the CSO and to OA within 30 calendar days of the issuance of the final report to address safeguards and security, cyber security, and emergency management findings. (c) The interim corrective action plan should include an analysis of each finding to ensure the corrective actions address the cause(s) as well as any systemic program weaknesses, describe ongoing and planned corrective actions (including milestones) for each of the findings, and identify individuals accountable for each action. (d) The interim corrective action plans are used to solicit written comments for consideration in the development of the final corrective action plan. OA reviews the interim corrective action plans and provides comments within 15 calendar days of receipt to the responsible organization, with a copy to the CSO. (2) Final Corrective Action Plan (a) A comprehensive final corrective action plan to address all findings (safeguards and security; cyber security; emergency management; and environment, safety and health findings) must be developed. The final corrective action plan will be formally tracked through SSIMS or CATS as appropriate. (b) When a finding addresses a deficiency in DOE policy, the applicable DOE policy organization (e.g., Office of Security; the Assistant Secretary for Environment, Safety and Health; or the Office of the Chief Information Officer) must develop and implement appropriate corrective actions. (c) When the findings involve multiple sites or Program Secretarial Officer (PSO) organizations, the responsible organizations must coordinate to develop and approve a comprehensive final corrective action plan. (d) The CLM in coordination with the CSO and applicable policy organizations, must develop a comprehensive final corrective action plan. The plan must be developed in a timely manner to permit approval by the CSO within 60 calendar days of the issuance of the final report. 8 DOE O 470.2B 10-31-02 (1) All comments provided by OA on the interim corrective action plans must be considered when developing the final corrective action plan. (2) The final corrective action plan must include both field and Headquarters corrective actions, as appropriate, to address all findings. (3) The final corrective action plan should indicate the following for each finding:

• a thorough analysis of the underlying causal factors to determine whether systemic program weaknesses exist, • steps to address the cause(s) of the finding, • actions planned that will prevent the recurrence of the finding, • responsible individuals and organizations, • dates actions will be initiated, • dates actions are expected to be completed, • how actions will be tracked to completion, and • mechanisms for independent verification of closure to ensure that the actions are effective to prevent recurrence of the finding. (e) The applicable CSO, or designee, must approve the final corrective action plan for line management actions within 60 calendar days of the issuance of the final report. The CSO may delegate this authority to the CLM or other designee. Policy organizations must approve their corrective actions within the same time frame. The CLM and the responsible policy organizations must complete the corrective action data fields for the approved corrective action plan in CATS or SSIMS, as applicable. (f) The final approved corrective action plan must be reviewed by OA within 30 calendar days of approval, with comments and their basis provided to the responsible organization, with a copy to the CSO, when it is determined that the final corrective action plan does not provide timely or adequate corrective actions for the identified findings. (g) The approval authority must resolve all comments provided by OA on the final corrective action plan by determining if a revision is needed, making the appropriate revisions, and providing OA with DOE O 470.2B 9 10-31-02 the revised final corrective action plan indicating how their comments were resolved. (h) Comments on the corrective action plan or its implementation should be resolved at the lowest possible organizational level. Comments that cannot be resolved must be elevated until resolution is obtained. If needed, comments may be elevated to the Deputy Secretary and/or the Secretary for resolution. (i) The final corrective action plan must be implemented and corrective actions tracked to completion by updating the status of actions on a frequent (e.g., monthly) basis using CATS or SSIMS (as applicable) until the finding is closed. Periodic (e.g., quarterly) status reports will be provided to assist senior DOE management monitor the status of corrective actions. (j) The CLM must coordinate with the applicable field and headquarters organizations and the CSO to conduct an independent assessment of completed corrective actions. This verification must be performed by persons with sufficient independence from those who performed the work described in the corrective action plan to ensure the corrective action plan was effective in closing the findings. (k) During corrective action plan implementation, OA may review the timeliness and adequacy of corrective actions as part of their independent appraisal activities. (l) OA may conduct follow-up reviews of appraisal findings to verify and validate the effectiveness of the corrective actions and to confirm closure of findings. OA must identify a new finding for resolution when a corrective action plan has not resolved the original finding. h. Annual Report to the Secretary. OA must provide input on the status of safeguards and security throughout the Department to the Administrator NNSA for use in the Annual Report to the Secretary and the Annual Report to the President, as appropriate. 5. RESPONSIBILITIES.

a. Director, Office of Independent Oversight and Performance Assurance. Supported by the Office of Safeguards and Security Evaluations; the Office of Cyber Security and Special Reviews; the Office of Emergency Management Oversight; and the Office of Environment, Safety and Health Evaluations, the director does the following: 10 DOE O 470.2B 10-31-02 (1) Develops and maintains DOE safeguards and security; cyber security; emergency management; and environment, safety, and health independent oversight and performance assurance policies, procedures, standards, and guidelines. (2) Advises appropriate site and Headquarters managers promptly (within 24 hours) of major vulnerabilities or imminent danger identified during appraisal activities at evaluated sites. (3) Briefs senior DOE officials, including the NNSA Administrator, Under Secretary, cognizant secretarial officers, the Office of Security, DOE policy organizations, and the managers of DOE sites, on the results of appraisal activities. (4) Coordinates with the DOE Inspector General when appraisal activities identify concerns that may have criminal or waste/fraud/abuse considerations. (5) Directs, manages, and conducts the safeguards and security; cyber security; emergency management; and environment, safety, and health independent oversight programs. (6) Coordinates the scheduling, notification, and planning of appraisals with appropriate cognizant secretarial officers and heads of field elements. (7) Ensures emergency management and environment, safety, and health findings (and related information) are entered into CATS and ensures that safeguards and security and cyber security findings (and related information) are entered into SSIMS in a timely manner (e.g., within 5 days following the transmittal of the final report). (8) Reviews corrective action plans and provides comments, when necessary, within prescribed time frames. Ensures comments are resolved or elevates comments until resolution is obtained. If needed, elevates comments to the Deputy Secretary and/or the Secretary for resolution. (9) Maintains awareness of the status of findings and ratings identified during appraisals. (10) Coordinates with the applicable DOE policy organization (e.g., Office of Security; Office of Emergency Operations, the Office of Environment, Safety and Health; or the Office of the Chief Information Officer) to resolve safeguards and security; cyber security; emergency management; or environment, safety, and health policy findings or deficiencies and to ensure accurate interpretation of requirements. DOE O 470.2B 11 10-31-02 (11) Provides DOE managers with independent evaluations of safeguards and security; cyber security; emergency management; and environment, safety, and health policies, programs, and implementation; evaluations may be provided in various written formats (e.g., inspection, management evaluation, special study, special review, and follow-up review reports). (12) Develops and maintains protocols for conducting appraisals of safeguards and security; cyber security; emergency management; and environment, safety, and health. These protocols will address: appraisal priorities, frequency, and scheduling; appraisal planning; data collection, analysis, and validation methods; development of ratings, findings, and opportunities for improvement; report preparation; and follow-up activities, as appropriate.

(13) On a selected basis, conducts appraisals to verify and validate the effectiveness of corrective actions and to confirm closure of findings. (14) Coordinates with the Office of Price-Anderson Enforcement when appraisal activities identify any potential noncompliance with rules, consistent with the Price-Anderson Amendments Act. b. Director, Office of Security. (1) Coordinates resolution of applicable policy findings identified in the final appraisal reports with cognizant secretarial officers and heads of field elements. (2) Coordinates with cognizant secretarial officers and heads of field elements to assist in resolving other findings applicable to the Office of Security identified in the final appraisal reports. (3) Manages and maintains a database (e.g., SSIMS) in support of line management activities to track findings and associated corrective actions in the areas of safeguards and security and cyber security. (4) Reviews draft appraisal reports for factual accuracy regarding policies and/or activities of the Office of Security. (5) In coordination with the responsible CSO, develops, implements, and tracks to completion corrective actions within the prescribed time frames for findings related to policies or activities of the Office of Security. (6) Provides official DOE interpretation of requirements contained within DOE Orders, Notices and Manuals under the cognizance of the Office of Security. 12 DOE O 470.2B 10-31-02 1 In most cases, the cognizant secretarial officer is also the lead program secretarial officer. If the cognizant secretarial officer is not also the lead program secretarial officer, the cognizant secretarial officer is responsible for coordinating with the lead program secretarial officer on any findings that require input or action from the lead program secretarial officer. c. Administrator (NNSA), Cognizant Secretarial Officers, and Program Secretarial Officers. (1) As line management, accept accountability for the performance of a site, facility, laboratory, operation or organization including its performance with respect to safeguards and security; cyber security; emergency management and environment, safety, and health.1 (2) Review draft appraisal reports for factual accuracy, and prepare corrective action plans within the time frames prescribed in this Order. (3) Take timely and appropriate corrective action to address findings identified in the appraisal report by ensuring corrective action plans are— • coordinated between the CSO, the CLM, and applicable line management and policy organizations, • developed to address all findings identified by the appraisal report, • submitted within prescribed time frames, • approved by the appropriate CSO or designee, and • implemented and tracked to completion and closure (through verification). (4) Provide, to OA, the requested documentation, points of contact, access to sites, facilities, and operations in support of OA appraisal activities, and participate in special study groups. (5) The Administrator NNSA, through the Chief, Defense Nuclear Security, develops the Annual Report to the President with input from the Office of Independent Oversight and Performance Assurance. (6) The Administrator NNSA and the Cognizant Secretarial Officers provide input and concurrence on the Annual Report to the Secretary. d. Heads of Field Elements/Heads of Contracting Activities .

(1) Heads of Field Elements/Heads of Contracting Activities shall ensure that the CRD attached to this Order is incorporated into all DOE site/facility management contracts pursuant to the clause entitled Laws, regulations, and DOE directives, 48 CFR 970.5204-2, by notifying the contracting DOE O 470.2B 13 10-31-02 officer. Once notified, the contracting officer shall be responsible for incorporating the CRD without modification into the contracts, as soon as practicable, but no later than 6 months after the effective date of this order. (2) Heads of Field Elements review draft appraisal reports for factual accuracy, and prepare corrective action plans within the time frames prescribed in this Order. (3) Heads of Field Elements take timely and appropriate corrective action to address the findings identified in the appraisal report by ensuring corrective action plans are— • coordinated with the CSO and CLM, • developed to address the findings identified by the appraisal report, • submitted within prescribed time frames, • approved by the appropriate official at the field element with a recommendation for approval by the CSO, • provided to the CSO, or designee, for approval, and • implemented and tracked to completion and closure (through verification). (4) Heads of Field Elements provide, to OA, the requested documentation, points of contact, and information concerning programs under their jurisdiction; ensure necessary support, access to sites, facilities and operations, and requested work space for the appraisal team in support of OA appraisal activities; and participate in special study groups. e. The Procurement Executives of DOE and NNSA. The Procurement Executives of DOE and NNSA shall implement the pertinent requirements of the CRD of this Order in the Department of Energy Acquisition Regulation or other appropriate procurement directive, including the prescription of any necessary contract clause(s) for those contracts specified in paragraph 3.b.(2) above. f. Executive Secretary of the Special Access Program Oversight Committee. Assists the Office of Independent Oversight and Performance Assurance in obtaining access to special access programs as required to provide effective independent oversight of the overall DOE safeguards and security program. 14 DOE O 470.2B 10-31-02 g. Assistant Secretary, Office of Environment, Safety and Health. (1) Coordinates resolution of environment, safety, and health policy findings identified in the final appraisal reports with cognizant secretarial officers and heads of field elements. (2) Coordinates with cognizant secretarial officers and heads of field elements to assist in resolving other findings applicable to the Office of Environment, Safety and Health identified in the final appraisal reports. (3) Administers the Corrective Action Management Program and maintains a database (e.g., CATS) in support of line management activities to track findings and associated corrective actions in the areas of environment, safety, health, and emergency management. (4) Reviews draft appraisal reports for factual accuracy regarding policies and/or activities of the Office of Environment, Safety and Health. (5) In coordination with the responsible CSO, develops, implements and tracks to completion corrective actions within the prescribed time frames for findings related to environment, safety, and health policy deficiencies.

(6) Provides official DOE interpretation of requirements contained within DOE Orders, Notices, and Manuals under the cognizance of the Assistant Secretary, Office of Environment, Safety and Health. h. Director, Office of Price-Anderson Enforcement. (1) Carries out the Department’s functions under the Price-Anderson Amendments Act of 1988 for investigation and enforcement of potential violations of applicable DOE nuclear safety requirements. (2) Coordinates with OA when appraisal activities identify any potential noncompliance with rules, consistent with the Price Anderson Amendments Act. i. Chief Information Officer/Office of the Chief Information Officer. (1) Coordinates resolution of applicable policy findings identified in the final appraisal reports with cognizant secretarial officers and heads of field elements. (2) Coordinates with cognizant secretarial officers and heads of field elements to assist in resolving other findings applicable to the Office of the Chief Information Officer identified in the final appraisal reports. DOE O 470.2B 15 (and 16) 10-31-02 (3) Reviews draft appraisal reports for factual accuracy regarding policies and/or activities of the Office of the Chief Information Officer. (4) In coordination with the responsible CSO, develops, implements, and tracks to completion corrective actions within the prescribed time frames for findings related to policies or activities of the Office of the Chief Information Officer. (5) Provides official DOE interpretation of requirements contained within DOE Orders, Notices and Manuals under the cognizance of the Office of the Chief Information Officer. j. Director, Office of Emergency Operations. (1) Coordinates resolution of applicable policy findings identified in the final appraisal reports with cognizant secretarial officers and heads of field elements. (2) Coordinates with cognizant secretarial officers and heads of field elements to assist in resolving other findings applicable to the Office of Emergency Operations identified in the final appraisal reports. (3) Reviews draft appraisal reports for factual accuracy regarding policies and/or activities of the Office of Emergency Operations. (4) In coordination with the responsible CSO, develops, implements, and tracks to completion corrective actions within the prescribed time frames for findings related to policies or activities of the Office of Emergency Operations. (5) Provides official DOE interpretation of requirements contained within DOE Orders, Notices and Manuals under the cognizance of the Office of Emergency Operations. 6. CONTACT. Questions concerning this Order should be directed to the Office of Independent Oversight and Performance Assurance at 301-903-3777. SPENCER ABRAHAM Secretary of Energy DOE O 470.2B Attachment 1 10-31-02 Page 1 (and Page 2) DOE ORGANIZATIONS TO WHICH DOE O 470.2B IS APPLICABLE

Office of the Secretary Chief Information Officer Office of Civilian Radioactive Waste Management Office of Congressional and Intergovernmental Affairs Office of Counterintelligence Departmental Representative to the Defense Nuclear Facilities Safety Board Office of Economic Impact and Diversity Office of Energy Efficiency and Renewable Energy Energy Information Administration Office of Environment, Safety and Health Office of Environmental Management Office of Fossil Energy Office of General Counsel Office of Hearings and Appeals Office of Independent Oversight and Performance Assurance Office of the Inspector General Office of Intelligence Office of Management, Budget and Evaluation and Chief Financial Officer National Nuclear Security Administration Office of Nuclear Energy, Science and Technology Office of Policy and International Affairs Office of Public Affairs Office of Science Secretary of Energy Advisory Board Office of Security Office of Worker and Community Transition Office of Energy Assurance Albuquerque Operations Office Nevada Operations Office Chicago Operations Office Oakland Operations Office Oak Ridge Operations Office Richland Operations Office Savannah River Operations Office Idaho Operations Office Golden Field Office Rocky Flats Field Office Ohio Field Office Bonneville Power Administration Southeastern Power Administration Southwestern Power Administration Western Area Power Administration DOE O 470.2B Attachment 2 10-31-02 Page 1 CONTRACTOR REQUIREMENTS DOCUMENT DOE O 470.2B, Independent Oversight and Performance Assurance Program The contractor shall comply with the following requirements: 1. The contractor shall support the conduct of Independent Oversight and Performance Assurance Program appraisals (e.g., inspections, follow-up reviews, focused reviews, and special studies) at sites under their cognizance. This support includes, but is not limited to, the following: a. timely identification of points of contact to provide information and support during appraisals; b. documentation and information concerning safeguards and security; cyber security; emergency management; and environment, safety, and health programs under their jurisdictions; c. access to contractor facilities and personnel, as required; and d. provision of work space and administrative support for the appraisal team. 2. When notified by OA of an imminent danger situation, a major safeguards and security or cyber security vulnerability, or an emergency management deficiency that presents an unacceptable immediate risk to workers, the public, the environment, or national security, the responsible contractor organization shall take the following actions in coordination with DOE line management: a. promptly identify and implement immediate compensatory actions to mitigate the condition, b. within 10 working days, notify the Cognizant Secretarial Officer and OA of actions taken or compensatory measures planned, and c. develop and implement long-term actions (including determining costs and identifying funds) to eliminate the vulnerability or reduce the level of risk to an acceptable level as soon as possible. 3. When requested, the contractor should assist in the factual accuracy review of OA appraisal reports by completing the following actions. a. Review the preliminary draft appraisal report on an accelerated basis and provide a response through the responsible DOE field element. This review should be completed based on the agreed to appraisal schedule.

b. Review the final draft report and provide comments through the responsible DOE field element within 10 working days of receiving the final draft report. Attachment 2 DOE O 470.2B Page 2 10-31-02 4. The contractor is provided appraisal reports (including the preliminary draft report, the final draft report, and the final report) for controlled distribution to personnel in their organization for review. 5. The contractor shall prepare, implement, and track to completion approved corrective action plans that address findings identified during the appraisals on the effectiveness of safeguards and security; cyber security; emergency management; or environment, safety, and health programs. Final corrective action plans are to be based on an analysis of underlying causal factors to determine whether systemic program weaknesses exist. a. The contractor shall provide timely input to the DOE field element in support of the development of the interim corrective action plan (which DOE line management shall submit within 30 calendar days of the issuance of the final report) to address safeguards and security, cyber security, and emergency management findings. The plan should identify any compensatory measures taken, determine the cause(s) of the finding(s) which will serve as the basis for actions planned to prevent a recurrence of the finding(s), describe ongoing and planned corrective actions (including milestones) for each of the identified deficiencies, and where possible, identify individuals accountable for each action. b. The contractor shall provide timely input to the DOE field element in support of the development of the final corrective action plan (which DOE line management shall submit within 60 calendar days of the issuance of the final appraisal report) to address all safeguards and security, cyber security, emergency management, and environment, safety and health findings. The contractor shall consider all comments provided on the interim plan when developing the final corrective action plan. In addition to describing compensatory measures and actions taken, the final corrective action plan should indicate the following for each finding: • a thorough analysis of the underlying causal factors to determine whether systemic program weaknesses exist, • steps to address the cause(s) of the finding, • actions planned that will prevent a recurrence of the finding, • responsible individuals and organizations, • dates actions will be initiated, • dates actions are expected to be completed, • how actions will be tracked to completion, and • mechanisms for verifying closure to ensure that actions are appropriate to prevent recurrence of the finding. 6. The contractor shall ensure that the above provisions apply to subcontractors performing safeguards and security; cyber security; emergency management; and environment, safety, and health functions. DOE O 470.2B Attachment 3 10-31-02 Page 1 ATTACHMENT 3 DEFINITIONS Appraisal: An OA activity conducted to evaluate the effectiveness of line management performance or the adequacy of DOE policy to include inspections, safety management evaluations, special reviews, special studies, follow-up reviews. Cognizant Line Manager: The DOE field or Headquarters manager, having line management responsibility, who is directly responsible for the development of corrective action plans and the implementation of corrective actions.

Deficiency: A deficiency is an inadequacy that is found during an appraisal. Deficiencies may serve as the basis for one or more findings. Directives: Directives include Policies, Orders, Notices, Manuals, Regulations, Technical Standards and related documents, and Guides. Findings: Findings are used to indicate significant deficiencies or safety issues that warrant a high level of attention on the part of management. If left uncorrected, such findings could adversely affect the DOE mission, environment, safety or health of workers or the public, or national security. Findings may identify aspects of a program that do not meet the intent of DOE policy. Findings will be clearly identified in the appraisal report, will define the specific nature of the deficiency, whether it is localized or indicative of a systemic problem, and will identify which organization is responsible for corrective actions. Findings require resolution by management through a formal corrective action process. Imminent Danger: Conditions or practices in the workplace where a danger exists which could reasonably be expected to cause death or serious physical harm either immediately or before the abatement of such danger, through normal procedures, would otherwise be required. Independent Oversight: Independent oversight is the objective evaluation of the Department’s performance without being subject to or influenced by the Department’s policy or line management organizations. Within DOE, the sole responsibility for independent oversight resides with the Office of Independent Oversight and Performance Assurance, reporting directly to the Office of the Secretary of Energy. Line Management: Line management refers to that portion of the Department’s organization that has a linear reporting relationship extending from the Secretary to the people in the facilities directly performing the Department’s missions. It is the chain of command that extends from the Secretary to the Cognizant Secretarial Officers, to the field organizations, to the contractors and sub-contractors responsible for performing work. It is distinct from DOE support organizations, such as the Office of the Assistant Secretary for Environment, Safety and Health and the Office of Management, Budget and Evaluation, which also have support responsibilities and functions important to security and safety. Policy: The term “DOE policy” or “policy” when used in lower case in this Order is meant to be all inclusive of all documents describing the philosophies, fundamental values, administration, and operation of the Department. Attachment 3 DOE O 470.2B Page 2 10-31-02 Ratings: Ratings are indicators of management system performance levels. The three ratings are: effective performance (green), needs improvement (yellow), and significant weakness (red). Safety Issue: A safety issue defines a condition that, if left uncorrected, could adverse impact the environment, or the safety and health of workers or the public, or the DOE mission. Safety issues may serve as the basis for one or more finding. Safety issues, when reported under Attachment 2 to DOE Order 414.1A, Quality Assurance, required a corrective action plan. Under DOE Order 470.2B, Independent Oversight and Performance Assurance Program, conditions warranting corrective actions will be reported as findings. Major Vulnerability: A vulnerability which, if detected and exploited, could reasonably be expected to result in a successful attack causing serious damage to the national security. DOE O 470.2B 1. Objective 2. Cancellation 3. Applicability 4. Requirements 5. Responsibilities 6. Contact Attachment 1 - Applicability Attachment 2 - CRD Attachment 3 - Definitions