DOE Office of Security Policy, AU-51 July 2018 DOE OPSEC Handbook DOE Office of Security Policy, AU-51 July 2018

Office of Security Policy DOE Office of Environment, Health, Safety and Security, AU Office of Security, AU-50 Office of Security Policy, AU-51 Marc Brooks, Director; Michelle Berger Physical Security Systems D. Golden, Topic Lead C. Amazeen Material Control & Accountability D. Holmer, Topic Lead Information Security C. Piechowski, Team Lead L. Ruhnow, Topic Lead Program Planning & Management N. Wright, Team Lead G. White, Topic Lead Protection Program Operations M. Hojnacke, Team Lead DOE’s Office of Security Policy Promulgates Program Planning and Management, Information Security, Classified Matter Protection and Control, Protection Program Operations, and Nuclear Material Control and Accountability Policy, as well as associated DOE Technical Standards, Handbooks, and Guides (see following slides) Develops associated legislative initiatives for modifications to United States Code, e.g., revision to Departmental arrest and use of force authorities for its protective forces Publishes related Code of Federal Regulations (CFR), e.g., 10 CFR Part 1016, Safeguarding of Restricted Data, 10 CFR Part 1046, Medical, Physical Readiness, Training, and Access Authorization Standards for Protective Force Personnel, and participates in the development/revision of 32 CFR Part 2004, National Industrial Security Program directive As the Office of Primary Interest for these DOE security policies, provides Safeguards and Security consultations on equivalencies and exemptions, policy clarifications, and terminations of safeguards requests Coordinates and ensures adherence to 10 CFR Part 1046 requirements for associated independent reviews of medical disqualification Protective Force R. Faiver, Topic Lead T. Jones

National Security Decision Directive (NSDD) 298 “Heads of Executive departments or agencies with national security missions shall: Establish organizational OPSEC programs; Issue, as appropriate, OPSEC policies, procedures, and planning guidance; and Designate departmental and agency planners for OPSEC.”

DOE OPSEC Policy Bring NSDD 298 into DOE DOE Order 471.6, Admn Chg 2, Information Security Distributed Management/Organizational Model Decentralized Critical Information Approach

DOE OPSEC Policy Operations Security (OPSEC). (1) An OPSEC program(s) must be implemented covering each site and facility to ensure the protection of Critical Information (CI) and to enhance mission effectiveness and protection of operations and activities. (2) Each OPSEC program must: (a) Identify and document its CI; (b) Review and update its CI documentation as necessary to reflect current assets, threats, operations and other relevant factors; (c) Ensure that its CI is protected from inadvertent and unauthorized disclosure, commensurate with all pertinent factors; (d) Provide the information required for sound risk-management decisions concerning the protection of sensitive information to the decision makers who are responsible for mission accomplishment; and (e) Assign and document approved responsibilities for OPSEC direction, management, and implementation. (3) OPSEC assessments must be conducted at a frequency not to exceed 36 months at facilities that possess Category I special nuclear material (or credible roll up to a Category I quantity), Top Secret, or Special Access Program information within their boundaries. (4) Information generated by or for the Federal Government and being placed on any website or otherwise being made available to the public must not contain CI unless authorized by the ODFSA.

DOE OPSEC Procedures and Planning Guidance OPSEC Handbook Purpose: - Information resource Lead: - Linda Ruhnow, AU-51 Initial Support: - Susan Thorsten and JoAnn Archuleta, PNNL - Working Group Invitation - June 18, 2018 Comments provided - EFCOG Provided on July 6, 2018 Comments by July 24, 2018

Next Steps Following Working Group and EFCOG Comment Adjudication: Final AU-wide review and approval of draft AU-51 submits the final revised document to RevCom Peer Review - Comment period in RevCom (60 days) Comment Resolution (30 days) TSMs and SMEs concur with revisions/resolutions (10 days)

QUESTIONS ?