Additional Action Needed to Improve NNSA’s Security Program

Although NNSA has improved its headquarters oversight of security across  the nuclear weapons complex, NNSA continues to experience difficulties  in developing a safeguards and security program that provides reasonable  assurance that all protection objectives are being met, especially at certain  locations and in several topical areas, most notably cyber security,  according to our review of NNSA site office surveys and independent  inspections by DOE’s Office of Independent Oversight. While the results of the surveys and inspections  are not entirely consistent, they do identify weaknesses with physical  security at several NNSA sites, including the Nevada Test Site, Los Alamos  National Laboratory, and the Y-12 National Security Complex, and  weaknesses throughout NNSA in the cyber security area. While NNSA has recently improved its headquarters oversight of  security, it has been hampered over the last 7 years by several factors,  including (1) the lack of an effective headquarters organization, (2) security  staffing shortages at its site offices, (3) lack of adequate training resources  and opportunities for its site office security staff, and (4) the lack of a  complete security information database and framework for evaluating  security review results. To his credit, the current Associate Administrator for DNS has taken  numerous steps to build an effective headquarters security organization. First, it  has implemented the Defense Nuclear Security Intern Program. NNSA Lacks Security Metrics to Gauge the Effectiveness of Its Safeguards and Security Program and Has Not Effectively Communicated Lessons Learned to Guide Security Improvements

NNSA does not have comprehensive metrics regarding the overall  effectiveness of its safeguards and security program and is not  communicating lessons-learned to guide security improvements across the  complex. In addition, NNSA does not have complete data for tracking security  deficiencies identified by security oversight reviews. Problems continue, in part, because NNSA and DOE have not yet fully  agreed on how NNSA should function within the department. DOE and NNSA Have Not Yet Fully Determined How NNSA Should Operate as a Separately Organized Agency within DOE

NNSA has focused considerable attention on reorganizing its internal  operations, but it and DOE continue to struggle with establishing how  NNSA should operate as a separately organized agency within the  department. Several factors have contributed to this situation. Budgeting. Sandia National Laboratories now follows the  DOE requirement. Create a National Nuclear Weapons Agency. As a result, NNSA has not significantly reduced  project delivery times or costs. Recognizing the importance of program managers, NNSA has  taken several actions, such as initiating a project and program management  improvement team and developing a program management policy. Identify and train program managers. Establish an independent analysis unit. Unlike DOD, NNSA has not  established an independent group responsible for reviewing program  proposals, verifying cost estimates, and analyzing alternatives. With respect to project management, we recommend that NNSA take the  following seven actions:  establish an NNSA-specific project management policy to ensure  application of the DOE project management manual;  prepare a project management improvement plan;  reinstitute annual reporting to the Congress on project management   include major projects, such as the Stockpile Life Extension  refurbishments, in DOE’s Project Assessment and Reporting System;  complete a comprehensive database of all projects’ reports on  management lessons learned to improve project management  throughout NNSA;  develop benchmark data on individual contractors’ project management  performance to assist managers in improving contractor performance;  and  require that contractors’ project managers receive project manager  training and attain project manager certification.
Why GAO Did This Study

In response to security and management weaknesses, in 1999 the Congress created the National Nuclear Security Administration (NNSA), a separately organized agency within the Department of Energy (DOE). NNSA is responsible for the nation's nuclear weapons, nonproliferation, and naval reactors programs. Since its creation, NNSA has continued to experience security problems, such as unauthorized access to a NNSA unclassified computer system, and cost and schedule overruns on its major projects, such as the National Ignition Facility. GAO reviewed the extent to which NNSA has taken steps to (1) improve security at its laboratories and plants and (2) improve its management practices and revise its organizational structure. To carry out its work, GAO reviewed legislation; NNSA policies, plans and budgets; and interviewed current and former NNSA and DOE officials.

What GAO Found

Although NNSA has begun to build an effective security organization, it still cannot demonstrate that all of its security program objectives are being met at all of its sites. Specifically, the results of internal and independent security oversight assessments have identified weaknesses in physical security at several NNSA sites, including the Nevada Test Site, Sandia National Laboratories and the Y-12 National Security Complex, and weaknesses in cyber security throughout NNSA. The following factors have contributed to this situation: Weak organization of headquarters security. Until recently, NNSA did not have consistent leadership or direction at the headquarters level for its security program. Security staffing shortages at NNSA site offices. Since NNSA became operational, five of its six site offices have not been staffed at the required levels, according to GAO's analysis. Site offices oversee NNSA contractor security operations. Inadequate security staff training. NNSA has not implemented a training program that provides federal security officials with the skills needed to effectively oversee contractor security programs. Incomplete security data. DOE's database for tracking security deficiencies identified by security oversight assessments is incomplete, and, as a result, NNSA lacks a comprehensive understanding of the overall effectiveness of its security program. NNSA has taken several actions to improve its management practices, including developing a planning, programming, budgeting and evaluation process. However, management problems continue, in part, because NNSA and DOE have not fully agreed on how NNSA should function within the department as a separately organized agency. This lack of agreement has resulted in organizational conflicts that have inhibited effective operations. GAO also identified the following areas where additional management improvements are needed: Project management. NNSA has not developed a project management policy, implemented a plan for improving its project management efforts, and fully shared project management lessons learned between its sites. Program management. NNSA has not identified all of its program managers and trained them to a certified level of competency. Financial management. NNSA has not established an independent analysis unit to review program budget proposals, confirm cost estimates, and analyze budget alternatives.