SD 452.4 Admin Chg 1, Implementation and Evaluation of Controls to Prevent Deliberate Unauthorized Use

CONTROLLED DOCUMENT OFFICE OF PRIMARY INTEREST (OPI): AVAILABLE ONLINE AT: Weapon Surety and Control Division http://directive.nnsa.doe.gov printed copies are uncontrolled SUPPLEMENTAL DIRECTIVE Issued: 07-07-11 Admin Change 1: 07-01-20 Re-Certification Due: 11-17-28 IMPLEMENTATION AND EVALUATION OF CONTROLS TO PREVENT DELIBERATE UNAUTHORIZED USE NATIONAL NUCLEAR SECURITY ADMINISTRATION Office of Defense Programs NNSA SD 452.4 THIS PAGE INTENTIONALLY LEFT BLANK NNSA SD 452.4 1 07-07-11 ADMIN CHG 1: 07-01-20 IMPLEMENTATION AND EVALUATION OF CONTROLS TO PREVENT DELIBERATE UNAUTHORIZED USE 1. PURPOSE. This NNSA Supplemental Directive (SD) supports the requirements of Department of Energy (DOE) Order (DOE O) 452.4C, Security and Use Control of Nuclear Explosives and Nuclear Weapons. Specifically, this SD supports the Order’s requirements to implement deliberate unauthorized use (DUU) preventive measures for nuclear explosive operations (NEO) and associated activities and to perform independent evaluations to determine if NEOs are adequately designed and controlled to satisfy the use control (UC) Standard of DOE O 452.1E, Nuclear Explosive and Weapon Surety Program, and the DUU control criteria below. 2. CANCELLATION. AL SD 56XB Chapter 11.9 Control of Nuclear Explosive Operations During Pantex Plant Operations. 3. APPLICABILITY. a. National Nuclear Security Administration (NNSA) Elements. This SD applies to all NNSA elements that directly or indirectly support the Nuclear Explosive and Weapon Security and Control Program prescribed in DOE O 452.4C that protects against DUU of nuclear explosives and nuclear weapons at the Pantex Plant and the Nevada National Security Site. b. Exclusions. (1) This SD does not apply to the Office of Naval Reactors in accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 USC sections 2406, 2511 and to ensure consistency throughout the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Supplemental Directive for activities under the Director's cognizance, as deemed appropriate. (2) The requirements of this SD do not apply to emergency response activities. 4. REQUIREMENTS. a. DUU CONTROL CRITERIA. DUU controls are a mix of engineered and administrative controls (with emphasis on engineered controls) to provide defense- in-depth. DUU control implementation and independent evaluations must be guided by the following criteria: (1) Limit access to nuclear explosives. (2) Minimize the time that vulnerable nuclear explosive configurations exist during disassembly, assembly, transportation, staging, and testing 2 NNSA SD 452.4 07-07-11 ADMIN CHG 1: 07-01-20 operations. (3) For configurations that require person-to-person coverage prescribed in DOE O 452.2E, Nuclear Explosive Safety, provide engineered protection (e.g., covers or containers that require two individuals to access) when immediate access to the configuration is not needed, and when such covers are feasible. (4) Nuclear explosives equipped with use control design features such as permissive action link (PAL) or active protection subsystems must maintain them in the highest security state (i.e., ”Locked” and “On”) using the appropriate PAL codes for the given status (i.e., shipping or staging/processing) and configuration (i.e., Ultimate User and lower levels of assembly, as feasible).

(5) Design nuclear explosive assembly and disassembly operations so that any UC design features are installed at the earliest practical time during assembly and removed at the latest practical time during disassembly. (6) Minimize the time that nuclear weapon components necessary to obtain nuclear detonation are collocated or provide controls to limit the use of collocated components (such as locked storage containers). (7) Limit access to weapon components and code/key material that could contribute to the success of a DUU attempt. (8) Ensure that code/key material is maintained under a split-knowledge two- person control system as specified by applicable directives. (9) Minimize the possibility of introducing unauthorized equipment, material, and/or contraband to nuclear explosive areas (NEA). (10) Minimize the possibility of unauthorized use or modification of nuclear explosive test equipment. (11) Minimize the presence of energy sources in an NEA that could contribute to a DUU attempt. b. DUU CHANGE CONTROL. Site Offices that authorize NEOs and associated activities and facilities must establish and implement a DUU change evaluation process to ensure DUU controls are not compromised. c. DELIBERATE UNAUTHORIZED USE REVIEW TEAM (DUURT). (1) Purpose. DUURT evaluations satisfy the DOE O 452.4C requirement for independent DUU evaluations and support the Site Office Manager’s responsibility under DOE O 452.1E to ensure (based on competent, independent reviews) that each authorized NEO meets the Nuclear Explosive Surety Standards prescribed in DOE O 452.1E. NNSA SD 452.4 3 07-07-11 ADMIN CHG 1: 07-01-20 (2) Scope and Timing. DUURT evaluations may be specific to a particular nuclear explosive, operation, class of operations, associated activity, tester, tooling, facility, or site. The evaluations must be performed periodically and are typically concurrent with the nuclear explosive safety (NES) evaluations prescribed in NNSA SD 452.2A, Nuclear Explosive Safety Evaluation Processes. The DUURT evaluation scope (in terms of NEO, facilities, and management systems examined) is usually the same as that of the concurrent NES evaluation; however, the criteria being evaluated differ. The focus of the DUURT is the fourth Nuclear Explosive Surety Standard whereas the NES Study Group (NESSG) is focused on the first two Nuclear Explosive Surety Standards as prescribed in DOE O 452.1E. DUU scenarios usually begin with loss of control. In this context, loss of control includes a wide range of events such as failure of the Two-Person Concept (TPC), failure of the Human Reliability Program (HRP), failure of the security clearance process, unauthorized access, and introduction of unauthorized material into an NEA. Security operations, TPC, and the HRP therefore play a major role in preventing the initiation of DUU scenarios. This SD does not address evaluation of security and HRP because it is done through their own programs. However, there are aspects of security and HRP specifically related to the NEOs (e.g., dual locks, ARGUS Security©, escort procedures, TPC) that are appropriate for the DUURT evaluations covered in this SD. (3) DUURT Composition. The DUURT includes the NESSG chair and laboratory members of the concurrent NES evaluation. The DUURT chair may recruit additional members as deemed appropriate. Typically, this will include one or more laboratory people with UC expertise and a representative responsible for change control.

(a) Independence. The DUURT members must make objective, independent judgments regarding the effectiveness of measures to prevent DUU. All DUURT members and UC technical advisors must meet the same independence requirements specified for NESSG members and technical advisors in NNSA SD 452.2A. (b) Sigma 14. Personnel who serve as DUURT members require Sigma 14 access authorization for this duty. (4) Planning Meetings. Most DUURT activities will be concurrent with NES evaluation activities and largely rely upon the same planning as the NESSG. Exceptions exist when there is a need to discuss separate DUU topics. The NESSG Chair determines the need for DUURT planning meetings and study-specific DUURT member training. This may include laboratory or project team presentations on: (a) Weapon-specific DUU vulnerabilities; 4 NNSA SD 452.4 07-07-11 ADMIN CHG 1: 07-01-20 (b) Nuclear explosive design features and attributes important to DUU at relevant levels of assembly; (c) DUU implications and controls associated with facilities, management programs, and processes. (5) Input Documentation. The DUURT will inform the Project Team if they need any documentation beyond that provided for the concurrent NES evaluation. Typically, this additional documentation will focus on how the DUU criteria are met for the subject of the evaluation. The Project Team is responsible for compiling that input documentation and distributing to the DUURT members. (6) Conducting the DUURT Evaluation. Most DUURT activities will be concurrent with NES evaluation activities and largely rely upon the same briefings and demonstrations/observations as the NESSG. Additional closed DUURT meetings will be conducted as needed to address any aspects of the reviewed activities that have potential DUU implications. The Chair will schedule closed DUURT meetings during the course of the evaluation. Final DUURT deliberations and report writing are also conducted in closed sessions after completion of the NES evaluation. The DUURT should be careful to distinguish among DUU issues, NES issues, and issues that have relevance to both disciplines. Documentation of DUU aspects must be confined to the DUU evaluation report. While it is acceptable and sometimes helpful to refer to a related NES issue in the DUU evaluation report, the NES evaluation report should not discuss or allude to DUU issues. Information used and developed by the DUURT must be protected in accordance with applicable use control and weapon system classification guidance with particular emphasis on the possibility of creating information that warrants Sigma 14 protection. DOE O 452.7, Protection of Use Control Vulnerabilities and Designs, applies. (7) DUURT Evaluation Report. The DUURT evaluation will be documented in an appropriately classified report with limited distribution. The report must include the following: (a) Identification of the DUURT members. (b) Brief statement of purpose. (c) Brief statement of scope and description of studied activities. (It is usually sufficient to cite the concurrent NES evaluation report and refer to it for details.) NNSA SD 452.4 5 07-07-11 ADMIN CHG 1: 07-01-20 (d) Brief statement of DUURT activities. (Typically, this is essentially all the concurrent NES evaluation activities plus the closed DUURT meetings.) (e) Evaluation results (relevant findings, deliberation topics, recommendations, minority opinions with the majority response, and overall conclusions regarding controls to meet the Use Control Standard and other DUU criteria).

(8) Action on DUU Evaluation Reports. The responsible NNSA Site Office Manager is the primary customer for DUURT reports. The Site Office Manager: (a) Considers the DUURT input in conjunction with existing surety measures to ensure NEOs authorized meet the DOE O 452.1E Nuclear Explosive Surety Standards and documents relevant decisions. (b) Ensures that DUURT findings are implemented as appropriate. (c) Ensures the DUU change control process, as appropriate captures implemented DUURT findings/recommendations. 5. RESPONSIBILITIES. a. Director, Weapon Security and Control Division. (1) Updates and maintains this NNSA SD. (2) Approves/disapproves deviations from DUURT evaluation process requirements in this NNSA SD. b. NNSA Site Office Managers. (1) Authorize NEOs based in part on input from DUURT evaluations. (2) Provide appropriate direction to the management and operating contractor based on DUURT findings and recommendations. (3) Establish and manage a DUU change control process. c. Director, Office of Stockpile Sustainment. Ensures NEOs are designed in a manner that protects against DUU. d. Director, Nuclear Explosive Safety Division. (1) Develops and implements the process for independent DUURT evaluations. (2) Assigns chairs to organize, convene, and lead DUURT evaluations. (3) Maintains a file copy of DUURT evaluation until the DUURT evaluation is 6 NNSA SD 452.4 07-07-11 ADMIN CHG 1: 07-01-20 superseded or otherwise no longer relevant. e. NNSA Design Agencies. (1) Provide technical experts as needed to support activities described in this SD. (2) Provide input, briefings, and demonstrations, as required, and certify the completeness and accuracy of the information. (3) Inform DUURTs on nuclear explosive design attributes relevant to protection against DUU. (4) Inform NNSA and applicable NNSA Production Agency of actionable information that has the potential to adversely impact DUU protection for approved operations. f. Project Teams. Ensure NEOs and related activities for which they are responsible incorporate measures as needed to satisfy the DUU criteria in this Supplemental Directive. 6. REFERENCES. a. 10 CFR Part 712, Human Reliability Program, which establishes policies and procedures for a security and safety reliability program designed to ensure that individuals who occupy positions affording access to certain materials, nuclear explosive devices, facilities, and programs meet the highest standards of reliability and physical and mental suitability. b. DOE O 452.1E, Nuclear Explosive and Weapon Surety Program, dated 01-26-15, which establishes requirements and responsibilities for the DOE Nuclear Explosive and Weapon Surety Program. c. DOE O 452.2E, Nuclear Explosive Safety, dated 01-26-15, which establishes requirements to implement the nuclear explosive safety elements of DOE O 452.1E for routine and planned nuclear explosive operations. d. NNSA SD 452.2A, Nuclear Explosive Safety Evaluation Processes, dated 10- 20-17, provides supplemental details to support the nuclear explosive safety evaluation requirements of DOE O 452.2E. e. DOE O 452.4C, Security and Use Control of Nuclear Explosives and Nuclear Weapons, dated 08-28-15, which establishes requirements to implement the nuclear explosive security and use control elements of DOE O 452.lE to ensure authorized use when directed by proper authority and protect against deliberate unauthorized use.

f. DOE O 452.7, Protection of Use Control Vulnerabilities and Designs, dated 05- 14-10, incorporating Change 1, dated 05-29-20, establishes the policy, NNSA SD 452.4 7 07-07-11 ADMIN CHG 1: 07-01-20 process and procedures for control of sensitive use control information in nuclear weapon data categories Sigma 14 and Sigma 15 to ensure that dissemination of the information must be restricted to individuals with valid need-to-know. 7. CONTACT. Questions concerning this NNSA Supplemental Directive should be addressed to the Weapon Security and Control Division, 202-586-9714. BY ORDER OF THE ADMINISTRATOR: Administrative Change Approved 7-1-20 SD 452.4 Admin Chg 1 1.PURPOSE. 1.PURPOSE. This NNSA Supplemental Directive (SD) supports the requirements ofDepartment of Energy (DOE) Order (DOE O) 452.4C, Security and Use Control ofNuclear Explosives and Nuclear Weapons. Specifically, this SD supports the Order’srequirements to implement deliberate unauthorized use (DUU) preventive measures fornuclear explosive operations (NEO) and associated activities and to perform independentevaluations to determine if NEOs are adequately designed and controlled to satisfy the usecontrol (UC) Stan 2.CANCELLATION. 2.CANCELLATION. AL SD 56XB Chapter 11.9 Control of Nuclear Explosive OperationsDuring Pantex Plant Operations. 3.APPLICABILITY. a.National Nuclear Security Administration (NNSA) Elements. This SD applies toall NNSA elements that directly or indirectly support the Nuclear Explosive andWeapon Security and Control Program prescribed in DOE O 452.4C that protectsagainst DUU of nuclear explosives and nuclear weapons at the Pantex Plant andthe Nevada National Security Site. b.Exclusions. 4.REQUIREMENTS. a.DUU CONTROL CRITERIA. DUU controls are a mix of engineered andadministrative controls (with emphasis on engineered controls) to provide defense-in-depth. DUU control implementation and independent evaluations must beguided by the following criteria: a.DUU CONTROL CRITERIA. DUU controls are a mix of engineered andadministrative controls (with emphasis on engineered controls) to provide defense-in-depth. DUU control implementation and independent evaluations must beguided by the following criteria: a.DUU CONTROL CRITERIA. DUU controls are a mix of engineered andadministrative controls (with emphasis on engineered controls) to provide defense-in-depth. DUU control implementation and independent evaluations must beguided by the following criteria: b. DUU CHANGE CONTROL. Site Offices that authorize NEOs and associated activities and facilities must establish and implement a DUU change evaluation process to ensure DUU controls are not compromised. b. DUU CHANGE CONTROL. Site Offices that authorize NEOs and associated activities and facilities must establish and implement a DUU change evaluation process to ensure DUU controls are not compromised. b. DUU CHANGE CONTROL. Site Offices that authorize NEOs and associated activities and facilities must establish and implement a DUU change evaluation process to ensure DUU controls are not compromised. 5. RESPONSIBILITIES. 6. REFERENCES. 7. CONTACT.