Calendar Year 2020

Department of Energy facilities, including those managed by the National Nuclear Security
Administration (NNSA), use a fonllal security clearance process to authorize einployees with a
"need to know" to access classified information or special nuclear material. The NNSA Service
Center (Service Center) in Albuquerque, New Mexico, is the cognizant authority for NNSA
personnel security clearances. ~ I fIis cal year 2007, the Service Center spent about $21 million to process approximately 52,000 personnel security clearances for NNSA facilities. This included Lawrence Livermore National Laboratory (Livermore) and Sandia National Laboratory- California (Sandia), where about 9,200 individuals held clearances and approximately $3.6 million of the $2 1 million was expended. During this same period, the Service Center had a backlog of over 2,500 personnel security clearance requests that it was unable to process.

Clearances within the Department is time and resource intensive. and processing backlogs have been a concern within the Department. Ensuring security clearances are requested only when truly recluired is a matter of policy and will help reduce un-guarantee expenditures and the clearance backlog. We initiated this inspection to determine if security clearance justifications at Livermore and Sandia met the Department's requirements.
Cyber Security Risk Management Practices at the Bonneville Power Administration
The Bonneville Power Administration (Bonneville) provides electrical power to millions
of custoniers in eight states in the Pacific Northwest. To support this critical function,
Bonneville makes extensive use of a number of information systems to conduct various
activities, including financial management, operation of extensive electricity transmission
systems, and marketing and transferring wholesale electrical power. Some of
Bonneville's most sensitive systems are used to help control the flow of electricity to the
power grid. Should any of these control systems be rendered inoperable for an extended
period, Bonneville's customer base could be adversely impacted.
The Department of Energy and its National Nuclear Security Administration (NNSA), operate
some of the most sensitive Federal facilities in the United States. Because of the mission
requirements, safeguards and security is a top priority at these sites. As part of its security
regime, the Department maintains a cadre of armed protective force officers to prevent and
defend against malevolent acts. In recent years, the Department has worked to enhance security
by increasing the capabilities of weapon systems used by the protective force officers. One such
weapon is the 40 mm grenade launcher, which utilizes high explosive ammunition to defeat
adversary personnel and equipment. A number of Department sites have procured these
weapons.
The Department of Energy and its National Nuclear Security Administration (NNSA), operate
some of the most sensitive Federal facilities in the United States. Because of the mission
requirements, safeguards and security is a top priority at these sites. As part of its security
regime, the Department maintains a cadre of armed protective force officers to prevent and
defend against malevolent acts. In recent years, the Department has worked to enhance security
by increasing the capabilities of weapon systems used by the protective force officers. One such
weapon is the 40 mm grenade launcher, which utilizes high explosive ammunition to defeat
adversary personnel and equipment. A number of Department sites have procured these
weapons.
Cyber Security Risk Management Practice at the Southeastern, Southwestern, and Western AreaPower Administrations
The Southeastern, Southwestern, and Western Area Power Administrations provide
electrical power to customers in 29 states. To support this critical function, the Power
Marketing Administrations (PMAs) utilize infornlation systems to conduct various
activities, including financial management, marketing, and transferring wholesale
electrical power across the Nation's electrical grids. In particular, Southwestern and
Western operate supervisory control and data acquisition (SCADA) systems - systems
critical to controlling the flow of electricity to the power grid. The power grids are part
of the U.S. critical infrastructure. Interruptions in these control systems for an extended
period could adversely impact the PMAs' customers.