NA-2019-001-04, Redelegation Order No. NA-005.01-01 to the Deputy Administrator for Defense Programs

NATIONAL NUCLEAR SECURITY ADMINISTRATION REDELEGATION ORDER NO. NA-005.01-01 TO THE DEPUTY ADMINISTRATOR FOR DEFENSE PROGRAMS 1. DELEGATION. Under the authorities and responsibilities delegated to me via NNSA Delegation Order No. NA-005.01, I delegate to the Deputy Administrator for Defense Programs authority to take the following actions: 1.1 Execute and retain cybersecurity authority for Information Technology (IT) systems that involve equipment that is an integral part of the weapon or weapons system 1• This includes ensuring that procurement, integration, operation, maintenance, and disposal of IT and systems are vetted appropriately and follow Federal standards and risk management measures defined in federal laws and Supplemental Directive 205.1, Baseline Cybersecurity Program. This delegation specifically assigns and limits authority for acceptance of all risks for any IT that is contained within the physical boundary of the nuclear weapon or is connected directly to weapon components; used for testing equipment that connects directly to the nuclear weapon; or used for the direct command and control functionality built into the weapon. 1.2 Report the selection and progress of this IT, including the information security requirements and system of milestones for measuring progress in terms of cost, capability of the system to meet specified requirements, timeliness, quality, the management of the IT investments, and the risk, vulnerability, or threat assessments of those IT investments. 2. RESCISSION. NONE. 3. LIMITATION. 3.1 Any IT not contained within the physical boundary of nuclear weapon or is connected directly to weapon components to test system efficacy, remains under the cognizance of the NNSA Chief Information Officer (CIO) per the authorities granted by federal law and the NNSA Administrator. 3.2 The NNSA CIO retains cybersecurity governance authority and oversight roles for all teclmology managed on behalf ofNNSA through federal laws. 3.3 In exercising the authority delegated in this Order, the delegate shall be governed by the rules and regulations of the Department of Energy, the National Nuclear Security Administration, and the policies and procedures prescribed by the Secretary and Under Secretary for Nuclear Security/Administrator. 1 United States Code Title 40, Section §11103, Applicability to national security systems, (D) involves equipment that is an integral part of a weapon or weapons system. I t I 3.4 Nothing in this Order precludes the Under Secretary for Nuclear Security/ Administrator from exercising any of the authority delegated by this Order. 3.5 Nothing in this Order shall be constmed to supersede or otherwise interfere with the authorities provided to the NNSA Administrator by law or delegation. 3.6 Any amendments to this Order shall be made in consultation with the NNSA General Counsel. 4. AUTHORITY TO REDELEGATE. I authorize you to re-delegate the stated cybersecurity responsibilities herein to a senior Federal Manager under your authority. Further re-delegation of cybersecurity responsibilities is prohibited. Re-delegation must conform to the requirements in NNSA Business Operating Procedure (BOP)-00.03, Delegation and Designation of Authority. Copies of re-delegations shall be provided to the CIO, Chief, Defense Nuclear Security, and the NNSA's Office of Business Services. 5. DURATION AND EFFECTIVE DATE. 5.1 5.2 All actions pursuant to any authority delegated prior to this Order or pursuant to any authority granted by this Order taken prior to and in effect on the date of this Order are ratified and remain in force as if taken under this Order, unless or until rescinded, amended or superseded. This Order is effective /4qy{ ,LS- Zc,/7 Associ e Administrator for Information Management and Chief Information Officer