DOE O 470.4A, Safeguards and Security Program

U.S. Department of Energy ORDER Washington, D.C. DOE O 470.4A Approved: 5-25-07 SUBJECT: SAFEGUARDS AND SECURITY PROGRAM 1. PURPOSE. To establish responsibilities for the DOE Safeguards and Security (S&S) Program and the managerial framework for implementing U.S. Department of Energy (DOE) Policy 470.1, Integrated Safeguards and Security Management, dated 5-8-01. The requirements identified in this Order and its topical manuals are based on national policy promulgated in laws, regulations, and Executive orders to prevent unacceptable adverse impacts on national security, the health and safety of DOE and contractor employees, the public, or the environment. 2. CANCELLATION. This Order cancels DOE O DOE 470.4, Safeguards and Security Program, dated 8-26-05. 3. APPLICABILITY. a. DOE Elements. Except for the exclusion in paragraph 3c, this Order applies to all Departmental elements. (Go to www.directives.doe.gov/pdfs/reftools/org-list.pdf for the current listing of all Departmental elements. This Order automatically applies to Departmental elements created after it is issued.) The Administrator of the National Nuclear Security Administration (NNSA) will assure that NNSA employees comply with their respective responsibilities under this Order. Nothing in this Order will be construed to interfere with the NNSA Administrator’s authority under section 3212(d) of Public Law (P.L.) 106-65 to establish Administration-specific policies, unless disapproved by the Secretary. b. DOE Contractors. Not applicable. c. Exclusion. In accordance with the responsibilities and authorities assigned by Executive Order (E.O.) 12344 and to ensure consistency throughout the joint Navy and DOE organization of the Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors will implement and oversee all requirements and practices pertaining to this DOE Order for activities under the Deputy Administrator’s cognizance. d. Exemption. (1) Requirements in this Order that overlap or duplicate requirements of the Nuclear Regulatory Commission (NRC) related to radiation protection, nuclear safety (including quality assurance), and safeguards and security of nuclear material do not apply to the design, construction, operation, and decommissioning of Office of Civilian Radioactive Waste Management facilities. (2) This exemption does not apply to requirements for which the NRC defers to DOE or does not exercise regulatory jurisdiction. AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Health, Safety and Security 2 DOE O 470.4A 5-25-07 e. Fundamental Research. In accordance with national policy, including NSDD-189 National Policy on the Transfer of Scientific, Technical and Engineering Information, no restriction may be placed on the conduct or reporting of federally-funded fundamental research that has not received national security classification or been otherwise restricted based on applicable U.S. Statutes, Presidential Directives, or the Code of Federal Regulations. 4. REQUIREMENTS. a. S&S programs must be developed and maintained that incorporate the responsibilities contained in this Order and ensure that the following directives are effectively implemented: (1) DOE O 226.1, Implementation of Department of Energy Oversight Policy, dated 9-15-05; (2) DOE P 470.1, Integrated Safeguards and Security Management (ISSM) Policy, dated 5-08-01; (3) DOE M 470.4-1 Chg 1, Safeguards and Security Program Planning and Management, dated 8-26-05.

(4) DOE M 470.4-2 Chg 1, Physical Protection, dated 8-26-05; (5) DOE M 470.4-3 Chg 1, Protective Force, dated 8-26-05; (6) DOE M 470.4-4, Information Security, dated 8-26-05; (7) DOE M 470.4-5, Personnel Security, dated 8-26-05; (8) DOE M 470.4-6, Chg 1, Nuclear Material Control and Accountability, dated 8-26-05; and (9) DOE M 470.4-7, Safeguards and Security Program References, dated 8-26-05. b. All delegations of responsibilities must be documented in writing. c. Interfaces and necessary interactions between S&S programs and other disciplines such as safety, emergency management, counterintelligence, facility operations, cyber system operations, and business/budget operations including property management must be identified and clearly defined. The interfaces must be maintained throughout the lifecycle of protective measures to ensure that safeguards and security planning and operations work together effectively with these disciplines. 3 DOE O 470.4A 5-25-07 5. RESPONSIBILITIES. a. Secretary. (1) Ensures that an effective S&S Program is established and executed within DOE under the authorities granted by relevant Executive orders, the U.S. Department of Energy Organization Act, as amended (42 U.S.C. §§ 7101-7352), and the Atomic Energy Act of 1954, as amended (42 U.S.C. §§ 2011-2286) and in accordance with the National Nuclear Security Administration Act (P.L. 106-65). (2) Designates senior Departmental officials to direct and administer the S&S Program. (3) Delegates, in writing, all responsibilities and authorities as necessary to those who require them. (4) As the senior DOE official of the intelligence community, approves the placement of intelligence Special Access Programs (SAPs). (5) Approves all other Department-originated SAPs. (6) Authorizes continuing operations of facilities/activities determined to be of high security risk. NOTE: This authority can be delegated only to the Deputy Secretary. (7) Approves and issues the Design Basis Threat Policy. (8) Has sole authority to approve the imposition of requirements on Office of Civilian Radioactive Waste Management programs and activities that are more stringent and/or comprehensive than those imposed by the NRC. b. Deputy Secretary. (1) Serves as Chief Operating Officer of the Department and is responsible for all Departmental policy development and operations. (2) Ensures that the S&S Program achieves excellence in performance, has internal compatibility, is graded in application, and integrates corporate programs and support activities with line programs consistent with the precepts of Integrated Safeguards and Security Management. (3) Reviews all staff and support office policies and guidance that affect Departmental elements. 4 DOE O 470.4A 5-25-07 c. Under Secretary for Nuclear Security/Administrator of the National Nuclear Security Administration. (1) Is responsible for the management and implementation of S&S programs administered by NNSA. (2) Authorizes continuing operations of facilities/activities determined to be of moderate security risk. NOTE: This authority can be delegated only to a head of a Departmental element. (3) Through the Associate Administrator for Defense Nuclear Security:

(a) Serves as the DOE cognizant security authority responsible for the development and implementation of security programs, operations, and facilities under the purview of NNSA, including physical security, personnel security, materials control and accountability, classified and sensitive information protection, and technical security. NOTE: This authority may be delegated to subordinate NNSA line managers, and delegation must be documented in the appropriate safeguards and security management plan. (b) Authorizes NNSA Federal and contractor employees to carry firearms and make arrests without warrants as provided by §161k of the Atomic Energy Act [codified at 42 U.S.C. § 2201 (k)]. (c) Oversees the security implementation of NNSA SAPs and provides an annual report to Congress. (d) Coordinates with NA-20 on NNSA programs for cooperation with the International Atomic Energy Agency about security activities. (e) Participates as a technical member of USG teams conducting physical security system reviews of foreign facilities in receipt, or due to receive, U.S.-origin special nuclear material to assure such possession or receipt is not inimical to U.S security interests. Based on knowledge of DOE nuclear material security systems evaluates foreign security systems using criteria contained in the IAEA technical document, "The Physical Protection of Nuclear Material and Nuclear Facilities" (INFCIRC/225/Rev.4). Participates in the writing of the U.S. team's reports. (f) Participates in international discussions regarding safeguards policies and procedures. (g) Coordinates with Departmental elements and HSS to ensure Departmental compliance with the terms of the Agreement between the United States of America and the International Atomic 5 DOE O 470.4A 5-25-07 Energy Agency for the Application of Safeguards in the United States of America and its Additional Protocol. (h) Reviews and coordinates with HSS the deployment of physical protection technology for the transportation of special nuclear material (SNM), nuclear weapons, and nuclear weapons components. (i) Issues direction for and oversees implementation of security conditions for operations under the cognizance of the NNSA. (j) Establishes a system of control measures to ensure that access to classified matter is limited to authorized persons. These control measures must be appropriate to the environment in which the access occurs and the nature of the matter. The system must include technical, physical, and personnel control measures. (k) Establishes procedures for reporting incidents of security concern and provides resources for conducting inquiries and damage assessments and for implementing corrective actions. (l) Develops and allocates the NNSA security budget, including budgets for the infrastructure that supports Defense Nuclear Security missions. (m) Directs the implementation of Defense Nuclear Security programs in accordance with the requirements of this Order and associated programmatic Manuals, including development of procedures and guidance (n) Provides NNSA counterintelligence liaison. (o) Acts as the DOE representative for international S&S policy development, including development of guidelines and technical documents and providing technical assistance. (p) In conjunction with the NNSA, develops, manages, and maintains the North Atlantic Treaty Organization security policy for DOE. (4) Through the Deputy Administrator for Defense Programs:

(a) Coordinates the required reporting of lost, potentially compromised, or unauthorized disclosure of classified information to the Joint Atomic Information Exchange Group (JAIEG). (b) Requests review and approval from the JAIEG for all classified matter containing Restricted Data or Formerly Restricted Data intended for transmission to foreign entities before release. 6 DOE O 470.4A 5-25-07 (c) Ensures that security-sensitive shipments from the U.S. to other countries are coordinated with HSS (i.e., shipments of SNM that are subject to DOE-administered Atomic Energy Act Mutual Defense Agreements and shipments of DOE classified matter). (d) Coordinates with the Office of Intelligence and Counterintelligence on the schedule for the transportation of SNM and security-sensitive shipments. d. Under Secretary for Science. (1) Is responsible for management and implementation of S&S programs administered by the DOE Office of Science. (2) Serves as the DOE cognizant security authority for programs, operations, and facilities under the purview of the Office listed above. NOTE: This authority may be delegated to subordinate DOE line managers and must be documented in the appropriate safeguards and security management plan. (3) Issues direction for and oversees the implementation of security conditions for operations under the cognizance of the office listed under paragraph 5d. (4) Directs the implementation of S&S programs in accordance with the requirements of this Order and associated programmatic Manuals, including the development of procedures and guidance. (5) Establishes a system of control measures to ensure that access to classified matter is limited to authorized persons. These control measures must be appropriate to the environment in which the access occurs and the nature of the matter. The system must include technical, physical, and personnel control measures. (6) Establishes procedures for reporting incidents of security concern and provides resources for conducting inquiries and damage assessments and for implementing corrective actions. (7) Coordinates with the Deputy Director, Counterintelligence Directorate concerning incidents that indicate a deliberate compromise of classified information or involve foreign persons, governments, or activities. (8) Develops and allocates S&S budgets for assigned programs, including budgets for the infrastructure that supports S&S missions. (9) Authorizes continuing operations of facilities/activities determined to be a moderate security risk. This authority can be delegated only to the head of a Departmental element. 7 DOE O 470.4A 5-25-07 e. Under Secretary of Energy. (1) Is responsible for the management and implementation of S&S programs administered by the DOE Offices of Energy Efficiency and Renewable Energy, Environmental Management, Fossil Energy, Nuclear Energy, and Civilian Radioactive Waste Management. (2) Serves as the DOE cognizant security authority for programs, operations, and facilities under the purview of the offices listed in paragraph 5e(1) above. NOTE: This authority may be delegated to subordinate DOE line managers, and delegation must be documented in the appropriate safeguards and security management plan. (3) Issues direction for and oversees the implementation of security conditions for operations under the cognizance of the offices listed in paragraph 5e(1).

(4) Directs the implementation of S&S programs in accordance with the requirements of this Order and associated programmatic manuals, including the development of procedures and guidance. (5) Establishes a system of control measures to ensure that access to classified matter is limited to authorized persons. These control measures must be appropriate to the environment in which the access occurs and the nature of the matter. The system must include technical, physical, and personnel control measures. (6) Establishes procedures for reporting incidents of security concern and provides resources for conducting inquiries and damage assessments and for implementing corrective actions. (7) Coordinates with the Deputy Director, Counterintelligence Directorate concerning incidents that indicate a deliberate compromise of classified information or involve foreign persons, governments, or activities. (8) Develops and allocates S&S budgets for assigned programs, including budgets for the infrastructure that supports S&S missions. (9) Authorizes continuing operations of facilities/activities determined to be a moderate security risk. This authority can only be delegated to the head of a Departmental element. f. Heads of Departmental Elements. (1) Oversee DOE facilities and Administrators of Power Marketing Administrations (excluding the Administrator, Bonneville Power Administration). 8 DOE O 470.4A 5-25-07 (2) Develop S&S management plans that describe S&S policy implementation and include detailed information on the assignment of roles, responsibilities, delegations, authorities, and development of budgets and allocation of resources. (3) Develop S&S implementing procedures and guidance for assigned programs, implements the programs, and provide oversight and technical direction. (4) Develop and allocate S&S budgets for assigned programs, including budgets for the infrastructure that supports S&S missions. (5) Ensure that line management implement applicable S&S directives. (6) Notify contracting officers of affected contracts that must include specific S&S contractor requirements documents. (7) Ensure that procurement requests for new contracts require inclusion of appropriate language, including the clause at Title 48 Code of Federal Regulations (CFR) 952.204-2, Security Requirements, and the appropriate CRDs from manuals associated with this Order in the resulting contracts, if necessary. (8) Ensure that contracting officers provide DOE F 470.1, Contract Security Classification Specification (CSCS), to the DOE cognizant security authorities or their delegates. (9) Curtails or suspends operations when continued operations would result in an unacceptable risk to national security and/or to the health and safety of DOE and contractor employees, the public, or the environment. (10) Integrate S&S crosscutting policies and consistently interpret applicability of those policies to affected Departmental elements. (11) Ensure that the authorized security condition requirements are implemented and remain vigilant for any local changes at affected facilities. (12) Ensure that S&S personnel under their cognizance are managed, trained, and equipped and are provided the facilities and logistical support, intelligence, communications, and other support services needed to maintain protection of S&S interests. (13) Ensure that line management have implemented vulnerability assessment programs and that DOE officials responsible for overseeing the program have been designated.

9 DOE O 470.4A 5-25-07 (14) Ensure that implementing procedures for incidents of security concern are established and sufficient resources are provided to conduct inquiries and damage assessments and to implement corrective actions. (15) Designate officials responsible for conducting and completing required S&S surveys. (16) Ensure that contractors and subcontractors execute applicable S&S programs and policies. g. Director, Office of Defense Nuclear Nonproliferation. In addition to the responsibilities under paragraph 5f, evaluates, in coordination with HSS, the adequacy of physical protection measures for irradiated reactor fuel shipments outside the U.S. h. Director, Office of Nuclear Energy. In addition to the responsibilities under paragraph 5f, authorizes the transfer of SNM to the Departments of the Army, Air Force, and Navy (Navy Facilities Engineering Command only), in such quantities and at such times as necessary for new military reactor cores, for existing military reactor replacement cores, and for miscellaneous purposes (other than use in nuclear weapons) authorized by Congress. i. General Counsel, Office of General Counsel. Provides legal advice and assistance to HSS regarding issues or changes in laws and regulations that may affect S&S interests and programs, including incidents of security concern, administrative review cases, and SAPs. j. Chief Information Officer. (1) Administers and oversees the DOE cyber security and TEMPEST programs, and approves access to CRYPTO and communications security (COMSEC). (2) Coordinates with HSS to ensure that classified and unclassified controlled information being processed, stored, or transmitted in automated information systems is protected in accordance with information security policies. (3) Coordinates with the HSS Office of Independent Oversight regarding the results of independent oversight inspections, reviews, and special studies of cyber security. k. Director, Office of Public Affairs. Coordinates with HSS, and when applicable, the NNSA Office of Congressional, Intergovernmental and Public Affairs on press releases involving S&S matters. 10 DOE O 470.4A 5-25-07 l. Chief Health, Safety and Security Officer. (1) Develops and implements the Department’s S&S program consistent with strategies and policies governing the protection of national security and other critical assets entrusted to the Department. (2) Coordinates and promulgates the Department’s policies and procedures for a comprehensive S&S program. (3) Directs the development and implementation of a security program for the protection of the DOE Headquarters, its personnel, and assets. (4) Works closely with the NNSA through the HSS Office of Independent Oversight to continue independent oversight of NNSA’s S&S; cyber security; environment, safety, and health; and emergency management programs. (5) Establishes and maintains the DOE Classification Program and ensures consistency between classification and S&S policies. (6) Provides advice and assistance to DOE organizations concerning S&S programs. (7) Serves as the principal advisor to the Secretary on S&S matters. (8) Establishes and coordinates the S&S technology program to support user needs and policy objectives. (9) Implements the procedures for the assessment of civil penalties set forth in Title 10, Code of Federal Regulations, Part 824, “Procedural Rules for the Assessment of Civil Penalties for Classified Information Security Violations,” (10 CFR part 824).

(10) Through the Deputy Chief for Operations, HSS. (a) Formulates and promulgates Departmental S&S policy. (b) Acts as senior Agency official responsible for directing and administering the DOE information security program [E.O. 12958, section 5.6(c)]. (c) Acts as the senior Agency official responsible for directing and administering the DOE personnel security program [E.O. 12968, section 6.1(a)]. (d) Acts as the senior Agency official responsible for directing and administering the DOE’s implementation of the National Industrial Security Program [E.O. 12829, section 203(a)]. DOE O 470.4A 5-25-07 11 (e) Maintains national-level liaison with Federal law enforcement, security, and intelligence agencies in support of the DOE S&S Program and represents DOE in interagency efforts related to S&S activities. (f) Develops the Design Basis Threat Policy. (g) Develops and issues the DOE Adversary Capabilities List. (h) Serves as the certification authority for Departmental vulnerability assessment analysts. (i) Develops S&S training programs and provides S&S training to Departmental personnel, primarily through the National Training Center. (j) Provides and manages resources for standardized, state-of-the-art training programs and facilities at the National Training Center and coordinates with the Office of Management to ensure conformance with DOE training policy. (k) Serves as the DOE cognizant security authority for DOE Headquarters facilities. NOTE: This authority may be delegated to subordinate DOE officials as necessary. (l) Oversees implementation of the DOE Headquarters S&S Program. (m) Reviews procurement requests for new HSS Headquarters contracts that if appropriate, ensures that the provisions of 48 CFR 952.204-2, Security Requirements, and the requirements of the appropriate CRDs from Manuals associated with this Order are included in the contracts. (n) Develops and allocates S&S budgets for assigned programs and the infrastructure that supports S&S missions. (o) Authorizes DOE Federal and contractor employees at Headquarters and at all non-NNSA sites to carry firearms and make arrests without warrant in accordance with section 161k of the Atomic Energy Act. (p) Oversees DOE SAPs and approves associated positions that require polygraph examinations. NOTE: Oversight does not include NNSA SAPs. 12 DOE O 470.4A 5-25-07 (11) Through the Director, Office of Independent Oversight. (a) Conducts independent inspections and evaluations to assess the effectiveness of S&S Program implementation. (b) Evaluates the security postures of Departmental elements and contractor-operated facilities for compliance with DOE policies and directives. m. Director, Office of Intelligence and Counterintelligence. (1) Acts as the senior intelligence officer for the Department. (2) In conjunction with HSS, develops programs and procedures to protect foreign intelligence information, intelligence sources and methods, and sensitive compartmented information from unauthorized disclosure. (3) Exercises those authorities pertaining to intelligence activities vested in the Secretary under E.O. 12333, as amended, and its implementing directives. (4) Provides technical assistance and intelligence information to HSS for the formulation of the Design Basis Threat (DBT) Policy, and Adversary Capabilities List. n. Deputy Director, Counterintelligence Directorate.

(1) Manages and executes counterintelligence activities including evaluations, administrative inquiries, counterintelligence polygraph examinations, and investigations. NOTE: Does not include authorities and responsibilities of the Inspector General, the General Counsel, the HSS, or the authorities of the Secretary that cannot be delegated. (2) Analyzes, produces, and disseminates threat-related counterintelligence information as requested. (3) Develops and coordinates all counterintelligence policy. (4) Processes inquiries into situations for which there is a suspicion of foreign activity. (5) Supports the conduct of inquiries. (6) Ensures that information developed through counterintelligence program activities that affects personnel security, physical security, materials control and accountability, information security, operations security, and technical surveillance countermeasures is shared with HSS and the Office of Defense Nuclear Security. Notifies the DOE cognizant security 13 DOE O 470.4A 5-25-07 authority upon the discovery of security incidents during the course of counterintelligence activities unless notification has the potential to compromise counterintelligence operations or activities. (7) Coordinates with the Office of Security, as appropriate, concerning security issues, including espionage and the possible or potential compromise of intelligence-related information. o. Administrator, Bonneville Power Administration (BPA). (1) Ensures that procurement requests for new contracts include appropriate security-related CRDs in the contract. (2) Develops and approves a BPA Safeguards and Security Management Plan that describes the roles, responsibilities and implementation of the BPA S&S Program. (3) Develops S&S implementing guidance, and implements and provides oversight and technical direction for the BPA S&S Program. (4) Develops and allocates BPA S&S budgets for assigned programs, including budgets for the infrastructure that supports S&S missions. (5) Ensures that line management implements S&S directives applicable to BPA. (6) Ensures that contracting officers, or BPA Classification Officers, provide DOE F 470.1, Contract Security Classification Specification (CSCS), to the DOE cognizant security authority at Headquarters. (7) Curtails or suspends operations when continued operations would result in an unacceptable risk to national security and/or to the health and safety of BPA employees and contractor employees, the public, or the environment. (8) Integrates S&S crosscutting policies and interprets applicability of those policies to affected BPA elements consistently. (9) Ensures that authorized security condition requirements are implemented, and remains vigilant for any local changes for affected facilities. (10) Ensures that S&S personnel under his/her cognizance are managed, trained, and equipped and are provided with facilities and logistical support, intelligence, communications, and other support services needed to maintain protection of BPA S&S interests. (11) Ensures that line management under his/her cognizance has implemented vulnerability assessment programs, and that BPA line management responsible for overseeing the program has been designated. 14 DOE O 470.4A 5-25-07 (12) Ensures that implementing procedures for incidents of security concern are established and sufficient resources are provided to conduct inquiries and damage assessments and to implement corrective actions.

(13) Through scheduling and coordination with the surveying organization, helps ensure that required S&S surveys can be conducted and completed. (14) Ensures that contractors and subcontractors execute all S&S programs and policies applicable to BPA. p. Contracting Officers. (1) After notification by the DOE line management official initiating the procurement activity, incorporate appropriate CRDs into affected contracts in accordance with law, regulation, and the DOE directives clause of the contracts. (2) Assist originators of procurement requests who want to incorporate the provisions of 48 CFR 952.204-2, Security Requirements, and appropriate CRDs in new contracts. 6. DEVIATIONS. Deviations from the requirements in this Order must be processed in accordance with DOE M 470.4-1, Chg 1. 7. NECESSITY FINDING STATEMENT. In compliance with Sec. 3174 of P. L. 104-201 (42 USC 7274k note), DOE hereby finds that this Order is necessary for the protection of human health and the environment or safety, fulfillment of current legal requirements, and conduct of critical administrative functions. 8. DEFINITIONS. Terms commonly used in the program are defined in the S&S Glossary in DOE M 470.4-7. Departmental elements and field elements are defined in DOE M 251.1-1B, Departmental Directives Programs Manual. In addition to these, the following definitions are provided for use with this Order. a. Line management refers to DOE and NNSA Federal and contractor employees who have been granted the authority to commit resources or direct the allocation of personnel or approve implementation plans and procedures in the accomplishment of specific work activities. b. DOE cognizant security authority refers to DOE and NNSA Federal employees who have been granted the authority to commit security resources or direct the allocation of security personnel or approve security implementation plans and procedures in the accomplishment of specific work activities. The Under Secretary for Science, the Under Secretary for Energy and the Associate Administrator for Defense Nuclear Security are designated in this order as the DOE cognizant security authorities for their organizations. This is not intended to imply that only these officials can serve as DOE cognizant securities authorities DOE O 470.4A 15 (and 16) 5-25-07 for their organizations. Lower level DOE cognizant security authorities should be established as needed to carry out the cognizant security authority responsibilities associated with this order and its associated manuals. 9. CONTACT. Questions concerning this Order should be directed to the HSS Office of Security Policy at 301-903-4642. BY ORDER OF THE SECRETARY OF ENERGY: CLAY SELL Deputy Secretary