NNSA SD 470.4-2 Implementation Instructions

NNSA SD 470.4-2 Implementation Instructions March 2020 NNSA SD 470.4-2 IMPLEMENTATION INSTRUCTIONS This National Nuclear Security Administration (NNSA) implementation instructions document prescribes the Defense Nuclear Security (DNS) Enterprise Safeguards and Security Planning and Analysis Program (E-SSPAP) process used to develop a consistent and standardized procedure for conducting security planning activities and reporting risk within the NNSA nuclear security enterprise (NSE). These instructions provide guidance to support the implementation of NNSA Supplemental Directive (SD) 470.4-2, Enterprise Safeguards and Security Planning and Analysis Program. NNSA SD 470.4-2 was developed to implement Department of Energy (DOE) Order (O) 470.4, Safeguards and Security Program, and DOE O 470.3C, Design Basis Threat (DBT) in order to provide a standardized approach to security risk management. The processes outlined in this document are required to provide a set of consistent deliverables that ensure risk-informed decisions that result in an integrated, robust, and efficient safeguards and security program. This document is available by contacting Defense Nuclear Security at 202-586-8900. It will not be listed on the NNSA Supplemental Directives webpage. Chapter 1: Asset Identification 1. purpose. The purpose of this chapter is to describe the process used for identifying and characterizing Department of Energy (DOE) assets into a protection level (PL) as a preliminary step to determine suitable physical protection measures require... 2. Background. DOE uses the concept of PLs in order to apply graded protection to departmental assets whose loss or damage have the potential to harm national security, the public, employees and contractors, the environment, or departmental missions. The term asset is used in a general sense with a subset of assets commonly referred to as targets. DOE has defined the term asset as something useful or valuable (e.g., Category I special nuclear material [SNM] or government property). A target is a... Assets requiring performance-based protection include nuclear weapons, nuclear test devices, or completed nuclear assemblies, Category I and II quantities of SNM, and credible roll-up to Category I and II quantities of SNM, which require protection st... Assets whose protection is compliance-based are categorized as PL-5 through PL-8, which include radiological materials, hazardous chemicals, biological materials, select agents and toxins, classified and sensitive information, accountable nuclear mate... 3. REQUIREMENTS. Asset identification is an important function, and the necessary first step is to determine potential targets that must be analyzed in order to ensure they are provided adequate physical protection. Asset identification is not a one... Sites must implement a formal process and develop procedures to provide assurance that physical protection of departmental assets is provided in accordance with departmental directives and the requirements defined in the local facility/site security p...

4. PROCESS. Asset identification involves identifying all the types of departmental assets at a site requiring physical protection as defined in DOE Threat Policy and departmental directives. Once the assets are identified, the PL is assigned based ... Assets may fall into more than one PL. As an example, a nuclear weapon is defined as a PL-1 but has classified material and parts that fall within PL-7, and radiological material that may meet the criteria for PL-5, PL-6, or PL-7. All PL levels shou... PL-5 through PL-8 assets may reside within PL-1 through PL-4 facilities and be designated as targets requiring analysis when conducting a vulnerability assessment (VA). The types of assets characterized by DOE and their associated PLs include: a. Accountable Nuclear Material. Accountable nuclear material other than special nuclear material (SNM) is defined in DOE policy, and includes: (1) Depleted Uranium (2) Normal Uranium (3) Americium (Am)-241 (4) Americium (Am)-243 (5) Berkelium (6) Californium-252 (7) Curium (8) Deuterium (9) Enriched Lithium (10) Neptunium (Np)-237 (11) Thorium (12) Tritium Protection Level. Accountable nuclear material is subject to the asset categorization process in Section 4.f. and 4.i., with the exception of Americium-241, Americium-243, and Neptunium-237, which can also be treated as SNM, and may be assigned a PL ... b. Biological Agents. Biological agents include bacteria, viruses, fungi, other microorganisms, and their associated toxins. They have the ability to adversely affect human health in a variety of ways, from mild reactions to serious illness and deat... (1) BSL1 and ABSL1 are defined as well-characterized activities not known to consistently cause disease in healthy adult humans, and of minimal potential hazard to laboratory personnel and the environment. (2) BSL2 and ABSL2 are defined as activities of moderate potential hazard to personnel and the environment. (3) BSL3 and ABSL3 are defined as activities that may cause serious or potentially lethal disease after inhalation. (4) BSL4 and ABSL4 are defined as activities that pose a high individual risk of aerosol-transmitted laboratory infections, agents which cause severe to fatal disease in humans for which vaccines or other treatments are not available, and agents such ... c. Classified Matter and Sensitive Information. Includes information classified under the Atomic Energy Act, Executive Order 13526, Classified National Security Information, or as defined in DOE O 475.2A, Identifying Classified Information, or its pr... (1) Top Secret Information. Information whose unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to the national security. (2) Secret Information. Information whose unauthorized disclosure could reasonably be expected to cause serious damage to the national security. (3) Confidential Information. Information whose unauthorized disclosure could reasonably be expected to cause damage to the national security. (4) OUO. Information that is unclassified, but has the potential to damage governmental, commercial, or private interests and falls under at least one of eight Freedom of Information Act (FOIA) exemptions as defined in DOE O 471.3, Identifying and Pr... (5) UCNI. Certain unclassified information about nuclear facilities and nuclear weapons whose unauthorized release could have a significant adverse effect on the national security or public health and safety as defined in DOE O 471.1B, Identification...

d. Government Property and Facilities. Includes DOE owned or controlled real and personal property. As defined in DOE O 430.1B, Real Property Asset Management, real property includes: “…any interest in land, together with the improvements, facilitie... Some government property and facilities may be used to perform critical missions for the Department, and in some cases, to perform critical missions for the Nation. As defined in DOE Threat Policy, they may be designated as part of the National Criti... Protection Level. Facilities or assets defined under PPD-21 as part of the National Critical Infrastructure are defined as PL-5. Facilities or assets defined by DOE Program Offices or Power Marketing Administrations as critical program assets or fac... e. Hazardous Chemicals. Hazardous chemical inventories at a site are chemicals that have the potential to be used by a threat to cause injury or death to personnel on- or off-site if released into the environment. DOE sites may also use weaponized chemicals for research and development purposes related to chemical warfare, which involves using the toxic properties of chemical substances as weapons. These chemicals are known as chemical agents and non-tradition... DOE facilities maintain inventories of other chemicals associated with nuclear material, not common to industry that may also pose a significant risk to people if released into the environment, e.g., uranium hexafluoride, depleted uranium hexafluoride... However, mixtures also pose a unique problem, especially when marketed or sold under a brand name rather than the chemical content. Mixtures may be procured, created, or stored during the normal course of operations. Such hazardous materials are not l... Chemicals identified in the sites’ Emergency Planning and Hazards Assessment (EPHA) process, as defined in DOE O 151.D, Comprehensive Emergency Management System, should also be included in asset identification. A list of the common industrial types ... (1) Step 1 - Identify Hazardous Chemicals of Interest On-site. The first step in the process is to identify on-site inventories of chemical hazards and radiological materials by working with the various organizations that maintain inventories of the ... (2) Step 2 - Analyze Consequences of a Release. The second step in the process is to work with the site’s emergency preparedness personnel to analyze release consequences as part of the site’s EPHA process defined in DOE G 151.1-2 and determine worst... (a) The quantities of chemical hazards can be compared to the LCT and the results used to assign PLs. If the quantity of the material of interest and the distance to the site boundary falls between the same two distances ( > 100m and less than the nex... (b) Use acceptable models and appropriate modeling assumptions to determine the distance to PAC-3. Using this information and the distance to the site boundary, determine the PL. The modeling assumptions used should be consistent with those used by em... (3) Step 3 - Determine Protection Level. If the results of the screening determine an off-site release exceeds PAC-3 criteria, the chemicals are defined as a PL-5 asset. If the results of the screening determine an on-site release exceeds PAC-3 crit... (4) Step 4 - Develop Malevolent Scenarios. The final step in the screening process is to develop scenarios based on the adversary characteristics defined in DOE Threat Policy that would result in a release of the hazardous chemicals. Use the PL-5 th... It is possible that no credible scenario can be developed based on the adversary capabilities for the postulated threat and technical requirements needed for a worst-case release. This is documented upfront in the SRA and the formal processes require...

f. Nuclear Weapons and Nuclear Components. Nuclear weapons, nuclear weapon components and subcomponents, and nuclear test devices are tracked at a site in accordance with the requirements defined in departmental directives. Protection Level. Complete nuclear weapons are defined in DOE Threat Policy as PL-1 assets. Other nuclear weapon components, subcomponents, and test devices are assigned PLs based on the assets within, which could include SNM, classified parts, and ... g. Personnel. Departmental federal employees, contractors, and general public on Departmental property and property leased by the department. The process for the evaluating personnel in the security planning process is provided in Chapter 3. h. Radiological Material. Radiological material consists of radionuclides, also known as radioisotopes or radioactive isotopes, which are atoms that have excess nuclear energy, making them unstable. SNM is a specially defined type of radiological ma... Radiological material is generally a broad term that refers to all types of radionuclides, including isotopes of SNM and accountable nuclear materials. For purposes of asset categorization in DOE, radiological material, sources, and SNM are tracked s... Radiological material at a site is a security concern from threats who may attempt to perform malevolent actions that would result in personnel being exposed to highly radioactive radiological materials without dispersing the material, known as a radi... Threats may also attempt to disperse the radioactive material into the environment, resulting in the potential for radiation exposure to personnel in the affected area. Dispersal may include lofting of material or creation of a device (dispersal scen... Radiation Dose Criteria. The radiation dose criteria in DOE Threat Policy is derived from the DOE Memorandum from D.M. Minnema, DP-45 to C. Hassell, NN-512, Trigger Dose Levels for Radiological Sabotage, August 26, 1997, also known as the DOE Trigger... (1) The basis for the threshold criterion listed in the LDT used to determine whether radioactive material is a potential on-site radiological dispersal target is derived from 10% LDC at 100 meters. (2) The basis for the threshold criterion listed in the LDT used to determine whether radioactive material is a potential off-site radiological dispersal target is derived from 100% LDC at the site boundary. (3) In addition to the LDT, a second off-site dispersal criterion of 3,000 rad is used for a whole-body dose received in a one-hour period. This dose results in 100% lethality. (4) The criterion used to determine whether radioactive material is a potential on-site radiation exposure target that could cause severe deterministic effects is a radionuclide with an activity of 100 times the International Atomic Energy Agency (IAE... (1) Step 1 - Identify Radiological Material. The first step in the process is to acquire a listing of all radiological material on site. All radiological material at a site should be identified and evaluated to determine whether it meets the criteri... As a starting point, the analyst should use existing inventories as required for the site’s Occupation Radiation Protection Program, Nuclear Facility Safety Hazards Assessment, Emergency Management, DOE Radiological Source and Tracking, and Nuclear Ma... (a) Surrogate Material. A surrogate radionuclide can be defined as a single radionuclide which is used to represent another radionuclide or group of radionuclides for the purpose of a conservative screening analysis. This allows for the calculation ... (b) Collocated Radiological Material. Radiological materials are considered to be collocated if breaching a common physical security barrier (e.g., a locked door at the entrance to a storage room) would allow access to the radiological material or de... Sum of Fractions. The sum of the ratios of the activity or mass for radionuclides collocated in a single target location is determined using off-site and on-site thresholds. If the sum of the ratios equals or exceeds 100 percent of a threshold, then... (c) Subject matter expert review of the exact radionuclides represented is performed based upon the results of the screening analysis. (d) The common theme in each analysis is the selection of conservative screening values relevant to the purpose of the analysis and use of subject matter expert evaluation of the data. (e) DOE Threat Policy requires a reduction factor of seven be used for alpha-emitting radionuclides when determining acute 24-hour dose rates for bone marrow, gastrointestinal tract, and lungs. Due to the nature of an alpha emitter’s particle size, it is acceptable to bound off-site dose criteria using the lung criteria when evaluating alpha-emitting radionuclides.

(2) Step 2 – Analyze Consequences of Release. The second step in the process is to analyze the dispersal consequences for the radiological material of concern dispersed on- or off-site, in order to assign the appropriate PL. Three processes may be u... (a) LDT. In the first process, LDT can be used to screen material. They contain 10% LDC at 100 meters and 100% lethality values at multiple distances (100, 500, and 1000 meters). If lung solubility is known, use the appropriate row (F, M, or S) if ... 1 LDT are based on conservative assumptions. If the LDT indicate that the quantity of radioactive material is not sufficient to meet off-site thresholds, it can be excluded from analysis as a potential PL-5 asset. 2 If the LDT indicate that the quantity of radioactive material is not sufficient to meet on-site thresholds, it can be excluded from analysis as a potential PL-6 asset. 3 If an off-site release results in greater than or equal to 100% LDC threshold delivered in the 24-hour period after the intake, or a 3,000-rad whole-body dose in 1-hour criteria, the radiological material is defined as a PL-5 radiological dispersal ... 4 All other radiological material is considered a PL-7 asset. (b) Existing EPHA. The second process is to use the results of an existing EPHA to determine if on- or off-site thresholds cannot be met with the quantity and type of radioactive material present. If the current EPHA has included malevolent acts inf... 1 If an off-site release results in greater than or equal to 100% LDC threshold delivered in the 24-hour period after the intake, or a 3,000-rad whole-body dose in 1-hour criteria, the radiological material is defined as a PL-5 radiological dispersal ... 2 If an on-site release results in greater than or equal to 10% LDC threshold delivered in the 24-hour period after the intake, the radiological material is defined as a PL-6 radiological dispersal asset. 3 All other radiological material is considered a PL-7 asset. (c) Dispersal Tool. A dispersal tool can also be used to determine dose rates at specified distances. When using a dispersal tool, the following parameters will be used to account for a broad range of potential event and meteorological uncertainties: 1 Receptor locations will include 100 meters from the release location and the distance to nearest site boundary. 2 Ground level release. 3 D atmospheric stability class. 4 Direction specific atmospheric dispersion factors will not be used. (3) Step 3 – Develop Scenarios and Assess Risk. The final step in the screening process is to develop scenarios based on the adversary characteristics defined in DOE Threat Policy that would result in a release of the radiological materials. Use the... It is possible that no credible scenario can be developed based on the adversary capabilities for the postulated threat and technical requirements needed for a worst-case release. This is documented upfront in the SRA and the formal processes require... (1) Step 1 - Identify Radiological Material. Follow the same process as identified in Step 1 for dispersal targets. (2) Step 2 – Analyze Consequence of Direct Exposure. The second step in the process is to determine either the unshielded exposure dose at one meter from the source or if the type and activity meets 100 times the D1 values defined in the IAEA D-value... (a) PLs are determined based on the amount of radiological material available, and scenarios are developed based on the required amount to meet or exceed dose threshold quantities. Credibility of a scenario is not a factor in determining a PL. If a ... (b) If the radioactive material meets the dose criteria, the radiological material is defined as a PL-6 radiological exposure asset. (c) If the radiological material does not meet the dose criterion in (a) above, it is defined as a PL-7 radiological exposure asset.

(3) Step 3 - Develop Scenarios and Assess Risk. The final step in the screening process is to develop scenarios based on the adversary characteristics defined in DOE Threat Policy that would result in direct exposure to radiological materials. Use t... i. Special Nuclear Material. SNM is categorized in DOE policy into Category I, II, III, or IV based on the quantity of the material and its assigned attractiveness level. Material categorization is a conservative estimate of the quantity of SNM nece... SNM Roll-up. Roll-up of SNM must be evaluated for the potential to roll-up to a Category I, II, or III quantity. The process for the evaluation of the credibility of roll-up is provided in Chapter 4. Protection Levels. Assembled nuclear weapons and test devices are classified as PL-1 assets. Directly usable Category I SNM is classified as a PL-2 asset. Category I and II quantities of SNM not meeting the PL-2 criteria and credible roll-up to Cat... Chapter 2: Vulnerability Assessments 1. purpose. This chapter provides an outline of the vulnerability assessment (VA) processes to be followed in conducting security planning and analysis activities for protection level (PL)-1 through PL-4 assets, including organizing and documenting t... 2. APPLICABILITY. NNSA security planning is based on a departmentally determined performance standard that describes the projected characteristics and capabilities of a design-basis adversary at the safeguards and security planning horizon (five year... 3. Background. This chapter provides for standardization of overall approach, structure, content, and supporting documentation to meet VA requirements. Specifically, once the scope of the analysis is established, comparisons can be made among sites ... a. Defining the overall effectiveness of the site/facility’s protection program. b. Determining requirements for a new mission. c. Responding to proposed changes in mission or operations. d. Evaluating proposed changes in security system or protective force configurations. e. Changing DOE Threat Policy. 4. REQUIREMENTS. Sites must follow the processes outlined in this chapter when conducting VAs. a. Site security analysis files and resulting documentation must be organized and formatted in the manner outlined in this attachment and must be supported by necessary evidence files referenced in and used during the analytical processes. b. NNSA sites must use the included document formats and reporting templates to communicate the results of security analysis and risk metrics to local field offices and the program office (NA-70) as defined by the Supplemental Directive. c. Scenarios used in VA analysis must be characterized based on the type of capabilities used in the scenario as defined in DOE Threat Policy. d. Changes to a protection strategy must be based on vulnerability assessments and risk analysis, risk management principles, and cost/benefit analysis to support decisions that are made.

5. PROCESS. Figure 3 illustrates the major process components addressed in this chapter. Each block shown in the process flow is discussed in a section of this chapter. Conducting a VA is not always a sequential process. Some activities can or wil... a. Scoping Agreements. The objective of this section is to define the scope of the VA, e.g., basic requirements, expectations, and assumptions for conducting the VA. VAs may be conducted for a variety of reasons, including (1) Defining the overall effectiveness of the site/facility’s protection program. (2) Determining requirements for a new mission. (3) Responding to proposed changes in mission or operations. (4) Evaluating proposed changes in security system or protective force configurations. (5) Changing DOE Threat Policy. (6) A new VA is required for: (a) A new facility with PL-1 through PL-4 assets, or addition of a previously unanalyzed asset at an existing facility that cannot be bound with the existing analysis. (b) Changes in the protection threshold defined in policy or significant change in local/NNSA security element-specific threats. (c) Changes in a protection strategy that may reduce the effectiveness of the protection system. (d) Changes in target categorization that result in a change of protection strategy (i.e., a change in PL that cannot be bound with existing analysis). (e) Changes to facility categorization that require a change in the overall response plan that could have an impact on the effectiveness of the protection system. (f) Changes to protective force categorization that require a change in the overall response plan that could have an impact on the effectiveness of the protection system. (g) Changes provided by DNS or the field office (7) An update to an existing VA is required to: (a) Incorporate performance testing data into Figures of Merit (FoMs) annually at a minimum. (b) Incorporate changes in a site security plan (SSP) that lower protection system effectiveness. (c) Incorporate changes in an individual security plan (SP) that lower protection system effectiveness. (d) As directed by DNS or field office.

(8) Develop a Scoping Agreement. Scoping agreements document the parameters for the analysis. VA analysis will not be initiated until the scoping agreement is reviewed and concurred on by all relevant parties (i.e., Protective Force [PF], Materials ... (9) Scoping Agreement Content. VA scoping agreements for NNSA sites include the content as listed. (a) Reason for conducting the Vulnerability Assessment. Describe the reason for conducting the VA. What specific driver requires a new analysis of the site security? Examples: New facility, new target location, different Protective Force configura... (b) Changes since the last Vulnerability Assessment. Describe what has changed since the last security analysis, including any interim security measures that have not been incorporated into the security analysis. The intent is to be able to trace th... (c) Site-specific assumptions and basis. The following conditions and performance assumptions will be reported in the scoping agreement and vulnerability assessment report (VAR). (d) Target and Threat Bounding Conditions. Describe the adversaries and objectives included in the analysis and how the site is bounding targets for the VA. Provide rationale for why it is appropriate to bound discrete or roll-up targets into a base... (e) Performance Assumptions. Performance assumptions are documented in cases where there is no testing data to support a FoM that will be used in the analysis. For detection, assessment, and delay FoMs, describe the expected assumptions by system, F... (f) Deviations from DOE Policy. Describe all current approved deviations from DOE policy that are expected to affect the security analysis and any expected deviation from policy. Describe the specific requirement(s) that are being deviated from and ... (g) Organizational Responsibilities. Describe the organizations with specific responsibilities to support development of the VA. Describe what the organization is responsible for and why it is necessary for conducting the VA. Describe the anticipat... (h) Schedule for Conducting the Analysis and Producing the Vulnerability Assessment Report. Provide a high-level schedule for completing the analysis. A simple Gantt chart (e.g., Microsoft Excel, Word, PowerPoint, or Project) will be used to provide... (i) Change Control Process for Updating the Scoping Agreement. Describe the process and notification chain for making changes to the scoping agreement. Describe site-specific triggers that would cause a change to the agreement. At a minimum, change... 1 Changes to baseline assumptions. 2 Additions to baseline assumptions. 3 Changes that cause the schedule to be delayed, which will be coordinated with the local ODFSA. 4 New deviations that affect the analysis. (j) Information References Used for Site-Specific Performance Data. Provide a table of references to be used to develop site-specific performance data. The table must include the reference, the date of publication of the reference, and a brief descr... (k) Scoping Agreement Format. VA scoping agreements for NNSA sites follow the format as listed below: 1 Introduction. The introduction will include: a Reason for conducting the VA. b Changes since the last VA was conducted. c Deviations from DOE policy. d Organizational responsibilities. e Change control process.

2 Target Characterization. This section will identify: a The assets and targets being analyzed. b Targets excluded from analysis and reasons why (if applicable). c Bound targets (if applicable). d Any assumptions related to target characterization. 3 Threat Characterization. a Threats and threat objectives to be analyzed. b Threats and threat objectives excluded from analysis and rationale as to why they were excluded (if applicable). c Bound threats (if applicable). d Any assumptions related to threat characterization. 4 Facility Characterization. a Protection Layers. b Delay assumptions. c Blast Analysis assumptions. d Any assumptions related to the facility. 5 Protective Force Characterization. Any assumptions related to the protective force. 6 Insider Analysis. Any assumptions related to the insider. 7 Scenario Development. Any assumptions related to scenario development. 8 Probability of Neutralization. Any assumptions related to probability of neutralization. 9 Protection System Effectiveness. Any assumptions related to protection system effectiveness. 10 References. List all references. 11 Schedule. Attach a schedule for the completion of the VA. b. Target Determination. This section describes the process used for identifying and characterizing PL-1 through PL-4 targets generated from the list of special nuclear material (SNM) assets as described in Chapter 1 of this document. VA analysts are expected to have an intimate working knowledge of the processes and procedures around the handling, use, experimental, and production activities associated with SNM targets. Detailed knowledge is required to understand the ways advers... In order to validate target assumptions, it is necessary to spend considerable time in testing and production areas, laboratories, and storage areas containing SNM as applicable at a site. VA analysts are expected to observe target-related activities... (2) Determine Threat and Threat Objectives. Using DOE Threat Policy and the next section of this chapter, determine potential threat and threat objectives for each asset. Threat and threat objectives assist in bounding of targets. (3) Identify Potential Targets. In determining potential targets, all identified SNM assets need to be evaluated for inclusion in the target set. Other programs such as MC&A, operations, nuclear safety, and emergency management organizations can ass... (4) Characterize Targets. See the Graded Safeguards Table in DOE policy for the characterization of different types of SNM. When characterizing SNM, the material form process and form code decision tree in DOE-STD-1194-2011 Nuclear Materials Control... (a) SNM Target Location, Flow, and Movement. Target location determines the different configurations target materials could be in that an adversary may attempt to exploit. Questions the analyst needs to ask include, but are not limited to: 1 In what configuration is the material? 2 Where is the target material located most of the time? 3 Is it accessible? 4 How long will it take to remove the material? 5 To where is it moved, and how often? 6 Is it generally kept in a container or other protective enclosure? 7 Is it removed from its primary container or other protective enclosure? 8 How long is the material in its current location? (Is the operation scheduled or routine?) 9 How and when is the material removed for shipments and receipts? 10 Where is the SNM stored for shipments and receipts?

(b) Target Configuration. Target configuration, when combined with target location, flow, and movement, determines the number of different operating configurations required in computer facility models used for pathway analysis and combat simulation n... 1 Container dimensions and shapes (drawings, pictures). 2 Container weights. 3 What are the new task times when it is moved or removed from its container or other protective enclosure? 4 Can the adversary accomplish the objective without removing the material from its container? 5 Are any special tools necessary to remove the material from its container? If so, how and where are they stored and controlled? 6 How much time is required to remove the material from its container? 7 Cladding. 8 Container information. 9 Labeling and tamper-indicating devices. 10 Internal and external shielding. 11 Internal and external containers or other protective enclosure. (c) Target Attributes. The analyst needs to collect the following information about the specific target material. 1 Dimensions and shapes. 2 Material type. 3 Material state. 4 Size and portability. 5 Radiation levels or other self-protecting information (dose rate). 6 Whether it is metallic or non-metallic. (5) Characterize Protection Measures. Determine what access control, detection, delay, and response measures are afforded to each target. These items are factors in determining which targets may be bound together. (6) Screen Targets. Identify targets that can be removed from analysis and document these targets. (a) Targets can be removed from analysis if the targets have a dedicated barrier or inherent design that exceeds the adversary capabilities in the DOE Threat Policy. (b) Document any target removed from analysis and the rationale for removal in the VAR. (7) Bound Targets within a PL. Group targets by site area, PL, location, asset category, asset type, threats and threat objectives, protection strategies, and protection measures. Grouping assists in the bounding of targets into representative target... (a) Location. Targets that are geographically located in the same general area can be bound together if the other factors discussed below are similar. Targets undergoing dissimilar operations cannot be bound together. (b) Response and Protection Strategy. Targets that have the same response and protection strategy can be bound together if they are located in the same location and meet the other criteria listed below. (c) Targets that are protected with a containment strategy can be bound with targets that have a denial strategy as long theft scenarios are addressed in the VAR. Similarly, targets that are protected with a denial-of-task strategy can be bound with t... (d) Adversary Force Size and Capabilities. Targets with smaller adversary numbers and reduced capabilities can be bound by higher numbers and capabilities if location, adversary objectives, response, protection strategy, and security features are sim... (e) Adversary Objective. Targets with similar adversary objectives may be bound together (e.g., theft of SNM) if the other criteria outlined in this section is met. (f) Protection Measures. Targets that have the same types of tasks and delay times to access them can be bound together. Targets with similar delay times, but dissimilar tasks to access, cannot be bound together. Targets with longer delay times may be bound by targets with lesser delay times if the threat and response are the same.

(g) Operations processing, testing, transport, storage. Targets undergoing dissimilar operations cannot be bound together. (8) Bounding within Different Protection Levels. It is appropriate to bound targets in different protection levels based on adversary capabilities and attack vectors. This type of bounding must be documented in the scoping agreement and approved by ... It is important to note that these target sets do not necessarily bound all adversary types. For example, targets protected with a denial of task protection strategy might be bound together for the purposes of outsider analysis but might not be for i... (9) Generate a Target Matrix. A site target matrix (Table 7) is developed describing the targets that will be analyzed. Each facility must generate a target matrix that describes the site’s assets, targets, and which targets have been binned. This ... (10) Prioritize Targets. Targets are prioritized based on DOE Threat Policy and local threat determination. (11) Program Review. An NNSA program review of the site’s targets will be conducted during the facility characterization to determine if the selection and bounding of targets meets DOE policy and the intent of the implementation instructions. (12) SNM Roll-up Targets. SNM roll-up is a special type of SNM theft. The roll-up process is described in Chapter 4. (13) Protracted Theft Targets. Protracted theft is the unauthorized accumulation of a specified quantity of SNM from a location or multiple locations over a period of time. The threat associated with protracted theft is an insider. Data derived fro... c. Threat and Threat Objective Characterization. The objective of this section is to outline the requirements needed to develop a detailed characterization of threats and their objectives in order to map those threats to security interests. The thre... For departmental facilities, the general threat information required to develop applicable threat characterization is found in the DOE Threat Policy. All applicable DOE, NNSA, and program office (NA-70) memoranda should be reviewed for additional thr... (1) Identify Adversary Types. Characterizing the threat requires identifying the various applicable adversary types. Adversary types are specifically defined by DOE Threat Policy and include the following: (a) International Terrorists; (b) Domestic Terrorists; (c) Demonstrators and Protestors; (d) Criminals, individual(s); (e) Criminals, organized; (f) Psychotics (insider); (g) Psychotics (outsider); (h) Disgruntled employee; (i) Violent activists; and (j) Insiders. (2) Identify Adversary Numbers. Based on the PL asset and adversary type, the analyst determines the number of adversaries to be considered in the analysis. Adversary numbers will vary depending on adversary type and PL. DNS, in consultation with f... (3) Establish Adversary Objectives. Adversary objectives are wide-ranging with specific strategic and tactical goals. Creating a complete listing of all possible adversary objectives is not practical, but a list of adversary types and objectives ana... (a) Embarrassing the United States Government; (b) Damaging the United States Government’s nuclear weapons capability; (c) Acquiring special nuclear material or other hazardous material that can be weaponized; (d) Acquiring desired technologies or information; (e) Symbolic action(s) against facilities, assets, or capabilities that embody a specific cause (e.g., nuclear activities, perceived environmental impacts, perceived economic exploitation, etc.).

Some examples of adversary methods for accomplishing defined objectives: (a) Theft/unauthorized use of a nuclear weapon, nuclear component, or SNM; (b) Improvised nuclear device; (c) Theft of asset; (d) Radiological, chemical, or biological sabotage; (e) Theft of classified or sensitive information; (f) Sabotage of a critical facility or mission; (g) Theft of government property; (h) Facility seizure; (i) Workplace violence or hostage-taking; (j) Protest activities to include vandalism, destruction of property, etc.; and (k) Espionage/foreign intelligence collection (only if this act would assist the adversary in performing the above objectives). (4) Adversary Capabilities. Adversary capabilities are described in the DOE Threat Policy. All adversary capabilities are considered; however, the degree to which multiple capabilities can be compiled and integrated in a single scenario is managed b... (5) Adversary Scenarios. Scenarios will be developed that cover the range of adversary types, objectives, and capabilities listed in the DOE Threat Policy. Scenario development for the terrorist threat is described in detail in this chapter. DNS, w... d. Facility Characterization. The objective of this section is to understand and depict the facility/site or intra-site transport in order to define its performance relative to intrusion detection, access control, surveillance, alarm assessment, and ... This section discusses the steps an analyst uses to characterize the facility. Every aspect of the facility and the associated safeguards and security programs, e.g., personnel security, information security, physical security, and MC&A are defined t... (1) The Target. The target is determined earlier in the VA process. The target determines the protection requirements, protective force (PF) response strategies, and the numbers and characteristics of the adversary. The VA analyst should understand... (2) Facility Operations. To characterize the facility, the VA analyst should thoroughly understand all security-related facility operations. The key to correctly characterizing the facility is gathering and validating all pertinent information. Sin... (a) Target Operations. The location and forms of the target should be characterized in all states of operation to include process, storage, and transportation. The analyst should consider information such as whether the material is in containers, in... (b) Facility Operating States. During the characterization, the analyst should understand all the operational states and conditions under which the facility functions. These include day-shift, off-shift, vault open, vault closed, material being proc... (c) Access Control. This operation is the passing of personnel, vehicles, and containers between security areas or layers. The operation also includes contraband and SNM shielding detection. Other considerations are visitor control, emergency ingre... (d) Intrusion Detection and Assessment Systems. These systems include exterior, interior, and duress alarm systems. The analyst should understand alarm accessed and alarm secured conditions. Assessment systems include closed-circuit television (CCT... (e) Delay Systems. Passage delay systems may be active or passive depending on the configuration and operation of the door(s). Other delay systems can include surfaces, vehicle barriers, and activated delay systems. The analyst should recognize tha... (f) Material Controls. These include process line and waste stream monitoring and measurement systems, radio frequency identification inventory tags, SNM portals, shipping/transfer controls, and surveillance measures (e.g., daily administrative check... (g) Response Force. With respect to facility characterization, it is important to understand the relationship between security elements and response force posts and patrols and their influence on detection and delay. (h) As-Built Accuracy. The facility is modeled (characterized) as it was built, accurately reflecting barriers, sensing, assessment, and delay systems. (i) Facility Recovery Plans. If conducting a sabotage VA, the analyst should understand mitigation factors that could reduce the severity of a sabotage event. These may include emergency response, recovery capability, evacuations, access controls, s... (j) Transportation Activities. This includes delay, barrier, and detection systems associated with the transportation of targets. The Office of Secure Transportation (OST) is the appropriate organization to conduct detailed vulnerability analysis fo...

(3) Layer Identification. After developing a thorough understanding of the facility, the VA analyst identifies the various security layers that comprise the facility. Layer identification is used in the model (regardless of what modeling tool is use... For VAs in which a protection system effectiveness (PE) is calculated for SNM protection, sites will use, at a minimum, four layers. The four layers are the site boundary, the protected area (PA), and the material access area (MAA) or facility bounda... (4) Figures of Merit (FoMs). FoMs are the values used to model the characteristics of the protection system regardless of the analytical tool/methodology being used to calculate the overall probability of PE. FoMs used for probability of interruptio... To the extent possible, FoMs should be based on performance tests. This means FoMs in modeling and simulation tools should reflect actual performance, and not an upper or lower threshold or expected performance values. (a) Sensing. Sensing is the recognition of a stimulus from a sensor. Sensors include the following: 1 Intrusion Detection Systems (IDS). Analysts must have a working knowledge of how IDS function including appropriate application and placement of IDS. The VA analyst must understand the process of alarm communications and alarm station operation. ... a Function. The ability of the system to function as designed based on the results of function tests. This value is determined from the aggregate result of function tests and ranges from 0.00 – 0.95. The criteria for determining a function value is... b Operability. The operability rating is the proportion of time the system is online and functioning compared to the total number of hours the system should be available. It is calculated on a quarterly basis. The criteria for determining an operab... c Alarms per central alarm station (CAS) and secondary alarm station (SAS), CAS/SAS Operator Hour (A/COH). The A/COH metric is used to account for the number of actions a CAS/SAS operator is performing per hour. The higher the ratio, the more likely... d Effectiveness. The overall effectiveness of the system based on the results of effectiveness testing. This value is determined from the aggregate result of all effectiveness tests for a given system and ranges from 0.00 – 0.95. Reference data such... e Calculation. The probability of sensing (PS) is calculated by the following equation: Calculations are determined quarterly (if new data is available) and averaged together for inclusion in the annual update to the VAR. 2 PF Personnel. PF may also serve in a detection capacity and provide assessment of intrusion. When using PF as intrusion detection, the analyst ensures that intrusion can be sensed either by hearing or seeing adversary actions. Analysts should con... 3 Non-PF. Non-PF personnel can communicate the cause of an intrusion. 4 MC&A Systems. MC&A systems can provide additional detection of loss of SNM. The analyst will include MC&A performance data in the system effectiveness calculation for insider threats. Any MC&A FoMs must be based on performance testing and the mos... 5 Process Alarms. In some cases, process alarms can be used to augment the security system by sensing unauthorized changes to equipment, such as the opening of a pressurized glove box.

(b) Assessment. Assessment capability is the ability to accurately assess the cause of an intrusion alarm and should be considered in facility characterization. Assessment methods are listed below. 1 PF. A dispatched or posted PF member that can assess and communicate the cause of an intrusion alarm. Assigning a PF assessment FoM must be based on performance testing and the most recent quarterly EMETL assessments. 2 CCTV. Provides a quick and remote assessment tool used by the alarm station operator. Instant replay and automatic camera call-up enhance the assessment capability. Assigning an assessment FoM for CCTV is based on performance testing. (c) Detection. Detection is derived from both sensing and assessment. Analysts use FoM for probability of detection (PD) values used in models and simulations. To calculate the PD for a system, the following equation is used: (d) Access Controls. Access control permits or denies access to facilities, security interests, or designated security areas. Access controls may be implemented administratively, mechanically, electronically, or through the use of PF. Access contro... (e) Delay. Delay is the time an adversary requires to complete an action or to traverse an area. Delay is typically characterized as time in most models. Analysts should understand the source delay data and understand the range of delay associated ... 1 Distance. Travel distances are computed as time. Delay before detection does not contribute to the overall effectiveness of the protective system. 2 Barriers. Breaching physical barriers results in delay time imposed on the adversary. The breaching method used determines the delay the barrier provides. Explosive breaching of barriers may provide additional detection caused by the sound of the... a Passage. These barriers are designed to grant passage to authorized personnel and to provide delay (and detection) of unauthorized personnel. These barriers may control personnel or vehicles. Types of passage barriers include doors, gates, and po... b Surfaces. Surfaces include walls, roofs, and fences. c Active Barriers. Active barriers are designed to provide additional delay when activated. Some active barriers such as obscurants and pop-up vehicle barriers require activation by security personnel. Other active barriers such as sticky foam may ...

(5) Pathway Analysis and Layered Probability of Detection (PD). Layered PD, in combination with layered probability of neutralization (PN), is a method to determine PE at various security layers in a system and used to evaluate and rank potential adv... (a) Critical Detection Point (CDP). The CDP is the point on an adversary path where the minimum delay along the remaining part of a path, defined as time remaining (TR) just exceeds the response force time (RFT) at the nearest location on the timelin... (b) Timely Detection. Timely detection is a measurement of the interaction between the physical and human security components that provide detection and assessment of a malevolent act in progress, and barriers that delay adversaries long enough for t... (c) Cumulative PD. Cumulative PD for any single adversary path is determined as follows: 1 Build an adversary timeline (computerized or manually) by establishing the delay and detection elements along an adversary path using the FoM from the facility characterization. Adversary paths must be based on the threat that is being emulated and... 2 From the end of the adversary task, go backward in time to the RFT and mark this point along the timeline as the CDP. 3 From the start of the path, identify the detection points and corresponding detection values for each point up to the CDP. 4 The PI is the cumulative detection from the start of the adversary task to the CDP. 5 As an example, using the formula listed above, if there are three detection points (PD1, PD2, and PD3) along an adversary path up to the CDP, PI is manually calculated as follows: ,𝑃-𝐼.=,𝑃-𝐷1.+,1−,𝑃-𝐷1..∗,𝑃-𝐷2.+,1−,𝑃-𝐷1..∗,1−,𝑃-𝐷2..∗,𝑃-𝐷3. 6 The path with the lowest PI is the one with the lowest cumulative detection probability up to the CDP and is determined as follows: a Build an adversary timeline (computerized or manually) by establishing the delay and detection elements along an adversary path using the FoM from the facility characterization. b Identify the adversary path with the lowest delay from start to finish. c From the end of the adversary path, go backward in time to the RFT and mark this point along the timeline as the CDP. d Select the elements on each layer with the lowest PD from the start of the path to the CDP, regardless of their associated delay. e The PI is the cumulative detection probability from the start of the adversary task to the CDP. f The layered PD is the cumulative detection probability from the start of the adversary timeline to the user defined point. (6) Minimized Delay Pathway. Minimized delay pathway is a process to evaluate the balance of delay systems at the site. This process is not used to calculate PI but is used to understand the FoM provided by barriers in the system. It may also be us... (a) Determine the overall adversary task time. (b) Determine PF response strategy. (c) From the starting point of the task, the adversary will make choices to minimize delay, regardless of the likelihood of detection by the protection system. (d) The total time for the pathway is the cumulative delay. (7) Minimize Detection Pathway. Minimized detection pathway is another process to evaluate the balance of detection systems at the site. This process is not used to calculate PI but is used to understand the FoM provided by the intrusion detection c... (a) Determine the overall adversary task time. (b) Determine PF response strategy.

(8) FoM Validation and Supporting Documentation. Detection FoMs must be based on (in preferential order) performance testing, function/operability and effectiveness testing, accepted standards (model database settings), professional judgment (analyst... The delay FoM can be based on accepted standards (model database settings), professional judgment (analyst), subject matter expertise, approved sources, and performance testing. The Sandia Technology Transfer manuals provide the analyst with addition... (9) Explosive Analysis. Technical experts should be consulted for assistance in conducting blast analysis for unique buildings or situations. Several tools can be used to conduct explosive analyses. Tools are used by the VA analyst to determine bla... (a) Explosive Effects. Criteria for determining effects on buildings and personnel was derived from several DOE sources and National Standards. The expected standards used for VA analysis is summarized in the following sections. 1 Documentation for conducting explosive analyses: 2 Building blueprints; 3 Maps; 4 Photographs; 5 Analyses; and 6 Engineering structural descriptions. (b) Blast Overpressure. Overpressure, also called a blast wave, refers to the sudden onset of a pressure wave after an explosion. A blast wave results in injuries to personnel and damage to buildings. The damage associated with a blast wave is depe... (c) Blast Injuries. Explosions can produce unique patterns of injury that are difficult to predict. The injury patterns are a product of the composition and amount of the materials involved, surrounding environment, delivery method, and the distance... (d) Personnel Survivability. Table 13 provides the psi criterion and impacts for evaluating effects on personnel to be used in VA analysis. The analyst will use an approved tool to determine the incident overpressure based on the weight of the explo... (e) Building Damage. The extent and severity of building damage cannot be predicted with perfect certainty. Past events show that the unique specifics of the failure sequence for a building significantly affect the level of damage. Despite these un... (f) Potential Force Multipliers. Potential force multipliers are items that exist onsite that can materially assist the adversary in reducing PF, eliminating barriers, bypassing access controls, etc. Examples include onsite chemical inventories, wea... e. Protective Force Characterization. The objective of PF characterization is to accurately characterize the PF’s capability against a defined threat to defend a target as it relates to detection, delay, response, interruption, and neutralization. T... The PF characterization process is based on delineating PF operations pertaining to detection, delay, interruption, and neutralization in the context of the DOE Threat Policy and an identified target. Although the effectiveness of the PF’s neutraliza... PF characterization is heavily dependent on the analyst observing the PF in operation during all conditions and states. To ensure that the VA analyst is evaluating and characterizing PF operations on a regular basis, field visits and evaluations usin... As part of the PF characterization step, the VA analyst should obtain the following site-specific PF information that will serve as a foundation to characterizing the PF. (1) PF Staffing Levels and Locations. Obtain all PF response staffing levels, to include assigned positions, for all conditions and states and response plans for the target building to be analyzed. The PF characterization must be synchronized with t... (a) Dayshift/Onshift storage area accessed (SNM not in use); (b) Dayshift/Onshift storage area accessed (SNM in use); (c) SNM shipment; (d) Dayshift/Onshift storage area secure; (e) Off shift storage area secure; (f) Dayshift/Onshift SNM Process Area occupied; (g) Off shift SNM Process Area unoccupied; (h) SNM used in a non-standard configuration under an approved security plan; (i) All conditions in emergency situations such as fire, evacuation, medical, etc. Careful consideration is given to ensure that the number of PF identified for each condition and state is based on the minimal operations staffing requirement. The number of extra PF for each shift may change significantly from day to day (Protective...

(2) PF-issued Equipment. Individually assigned duty equipment for each post and patrol should be documented and kept current. Equipment can have a direct bearing on the PF’s ability to respond, interrupt, and neutralize the threat, and the VA analys... (a) Type of vehicle (four-wheel drive; armored and, if so, to what level; non-armored, etc.); (b) Weapon model and caliber; (c) Basic operational ammunition load and type of ammunition carried; (d) Type of gas mask; (e) Chemical and biological weapons (CBW) equipment; (f) Armored vest; (g) Radio; (h) Alternate communications (pagers, cellular telephones, etc.); (i) Night vision equipment; (j) Thermal imaging; (k) Breaching equipment; (l) Identification friend or foe equipment, and (m) Weapons optics. (3) Post and Patrol Orders. Post and patrol orders must be reviewed in order to understand and accurately characterize each post and patrol position. Information obtained from these post and patrols provides the VA analyst the ability to characteriz... (4) Response Plans. PF response plans detailing the number of PF personnel required to respond to a target and the PF assigned locations are analyzed during PF characterization. These response plans are reviewed to determine how the PF responds and ... (5) Determining Alarm Assessment and Communication Time (AACT). AACTs are used to provide an accurate representation of the time required to assess and communicate an alarm situation for each identified protection layer (e.g., extended detection, pro... (a) The pool of data used for AACT determination includes alarm response assessments conducted independently at each protection layer. The resulting data is then input into the modeling tools to provide an accurate representation of the assessment an... (b) Using these data points, the AACT is calculated using the 75th percentile calculation. To calculate AACT, use a computer-based spreadsheet such as Microsoft Excel. The steps to do this are: 1 Enter the AACT results from tests into an Excel spreadsheet. 2 Enter the following formula into an empty cell: =PERCENTILE (array, 0.75). 3 Array in the above command refers to the range of cells into which the AACT has been entered. For example, if the AACTs were entered in cells A1 through A25, the syntax would be A1:A25. 4 The value that Excel returns into the cell is the 75th percentile AACT. This value is the mathematical value of all the AACTs and may not demonstrate an actual AACT test value. 5 Results from AACTs must be used in modeling for each layer identified. (c) AACTs should account for and include the following: 1 Layer of AACT; 2 Location of the alarm; 3 The time it takes for the Central Alarm Station or a PF member to assess the alarm; 4 PF member assessing the alarm; 5 The time it takes for the Central Alarm Station or a PF member to communicate the alarm; 6 The time it takes for PF members to acknowledge the alarm; 7 PF member communicating the alarm. The following table provides an example of how AACT data will be collected.

(6) Determining Response Force Time (RFT). RFT is the time it takes the PF to respond to a predetermined position and to prepare to initiate interruption of the adversary’s mission. RFTs are established by performance testing and are unique to site ... (a) The pool of data that can be used for RFT determination includes alarm response assessments, limited scope performance tests, and force on force (FoF) response times. (b) Using these data points [define sources], the RFT is calculated using the 75th percentile calculation. To calculate RFT, use a computer-based spreadsheet such as Microsoft Excel. The steps to do this are: 1 Enter the RFT from tests into an Excel spreadsheet. 2 Enter the following formula into an empty cell: =PERCENTILE (array, 0.75). 3 Array in the above command refers to the range of cells into which the RFT has been entered. For example, if the RFTs were entered in cells A1 through A25, the syntax would be A1:A25. 4 The value that Excel returns into that cell is the 75th percentile RFT. This value is the mathematical value and may not reflect an actual RFT test value. 5 Results from RFTs must be used in modeling for each layer identified. (c) RFTs should account for: 1 Type of equipment required for the PF to respond; 2 Location of equipment; 3 Equipment donning time; 4 Distance PF travels; 5 Means of PF movement; 6 Weapon preparation time; 7 Communication time; 8 Radio discipline; and 9 Effects of radio jamming on response times. The following table provides an example of how RFT data will be collected. (7) Recapture. Site-specific PF recapture capabilities should be identified to accurately characterize the PF’s ability to regain control of SNM within an MAA. This includes not only determining capabilities such as breaching, but also understanding... (8) Deadly Force Policy and Implementation. In addition to understanding the rules for using deadly force and site-specific rules of engagement as stipulated in policy, the analyst will also consider the site’s training program. The training program... (9) Memorandums of Understanding – External Response Support. Site-specific agreements made with local law enforcement agencies will be reviewed if local law enforcement is used in determining PE to identify the agreed-upon required response time and... (a) Is notified to respond in a manner that is understood by both parties; (b) Knows where to respond; (c) Has communications capability with the onsite PF; and (d) Has demonstrated, through past performance tests, the ability to perform as anticipated.

(10) Other Considerations. Other areas the analyst should evaluate in order to develop an accurate assessment of the PF’s effectiveness in carrying out their mission are discussed below. (a) Picture in Time. The site will conduct pictures in time based on unannounced observations of the PF during different dayshift/onshift and backshift conditions and target states. The purpose of conducting pictures in time is to gain data to: 1) ... (b) Shift Change. The VA analyst will understand how PF shift changes are conducted to determine the feasibility and impact of an adversary attack using a force multiplier such as a vehicle bomb, hand-carried improvised explosive device, CBW, or othe... (c) Building Evacuations in Response to Alarms. The VA analyst needs to review PF procedures related to the roles and actions PF takes during a criticality evacuation or other full or partial building evacuation in response to alarms. These procedur... (d) Communications. The ability to communicate effectively has a direct effect on detection, assessment, PF response times, and neutralization of the adversary. There are no default data for communications FoM. They are factored in when considering... (e) Ability to Mitigate the Effects of Communications Jamming. The site should determine the effects of jamming radio communications and to what degree response would be degraded. The site should assess the knowledge and ability of the PF to revert ... (f) Ability to Neutralize Adversary Vehicles. The VA analyst will evaluate the ability of the PF to both interrupt and neutralize an adversary vehicle (up to and including armored vehicles). This includes determining the operational weaponry deploye... (g) Shadow force. The VA analyst will evaluate the ability of the PF to respond when in a Shadow Force configuration. The evaluation, at a minimum, will include computer modeling or tabletop exercises and the results will be included in the VAR. (11) Validation and Verification of PF Characterization Information. One of the most important aspects of ensuring the PF characterization task is completed accurately is to validate and verify the FoM and effectiveness that have been assigned to the... (a) EMETL Field Manual. Serves as the primary resource for training, evaluating, and assessing collective, leader, and individual protective force tasks in the NNSA enterprise. Task evaluation is done primarily by PF leaders, Instructors, and perfor... 1 Observe/participate in performance testing and performance assessment activities to validate that performance of tactics, techniques, and procedures are aligned with current protection strategy assumptions. 2 Review and, where applicable, integrate EMETL assessment results into the VA process to augment ongoing efforts to identify and correct weaknesses in PF performance (e.g., probability of neutralization). 3 Participate in quarterly stakeholder integration meetings held to establish a site's overall EMETL assessment results. 4 VA analysts will use the EMETL Field Manual and conduct protective force field visits to verify assumptions used in the VA. The applicable EMETL task being evaluated is used during the field visit. The table below provides an example of this form....

(b) Three main components of protection program defensive planning are used to assist in adapting the tactical doctrine to site-specific needs: terrain analysis, barrier planning, and defensive fire planning. These are also used in the VA process to a... 1 Terrain Analysis. Terrain analysis is the process of interpreting natural and manmade features of a geographic area to determine their effects on site defensive operations. Major natural terrain features and a focus on the adversary provide the fo... This analysis is a joint effort involving vulnerability analysts, security planners, and PF focusing on major natural terrain features and potential adversary avenues of approach and tactics. The terrain analysis dictates the location and types of ba... a Likely avenues of approach; b Locations of hardened fighting positions; c Placement of crew-served weapons; d Barrier plans; e Defensive fire plans; and f Preplanned tactical responses for maneuvering elements. 2 Barrier Analysis. The barrier planning process helps determine the types of barriers to be employed and how best to position them to meet a variety of objectives, e.g., to decrease blast overpressure effects at certain locations, increase the abili... f. Application of the Insider. The objective of this section is to understand the baseline requirements and the methodology for analyzing the insider as an adversary, both when acting alone and in collusion with an outside adversary team. An insider... Insiders present a unique problem for a physical protection system (PPS) as an insider is capable of using defeat methods not available to outsiders when confronted with protection elements and access controls. Based on their access, authority, and k... (1) Types of Insiders. For purposes of this document, the term insider is used to mean an individual who can take advantage of their access, authority, and facility knowledge to gain proximity to a target/facility; to potentially bypass protection el... (a) Passive – The insider can only pass information to an outside adversary element. This insider will only obtain information that affords a low risk for compromise. (b) Active – The active non-violent insider will not use physical force or violence but may covertly assist the adversary team by executing other actions such as unlocking doors, triggering false alarms, instructing central alarm station to ignore ala... (c) Violent – In addition to being active, the violent insider uses violence to further adversary actions. An active violent insider may use violence, physical force, and weapons to actively support outsiders by directly participating in the adversar... (2) Methodologies used to conduct an insider analysis will include modeling and simulation tools, expert reviews, and table-top methodologies to provide the ratings and appropriate supporting documentation. The intent of insider characterization is t... (a) Identify targets. Targets in an insider analysis will include abrupt and protracted theft targets and various types of sabotage targets based on the material at a site. (b) Characterize facility. Characterize the facility with an emphasis on the insider-related safeguards. The analyst will characterize the facility (as described in Facility Characterization) with a focus on defining insider safeguards elements at e... (c) Identify representative job categories. Identify potential insiders by job category and summarize their job description. Collecting, categorizing, and describing this information is vital to determine the attributes of access, authority, and kno... 1 Start with facility defined job categories and use these categories to identify the categories used in the analysis. 2 All personnel in job categories with access to security areas are included as potential categories for an active insider analysis.

(d) Determine access and authority for each job category. Using a variety of data collection methods, including interviews, the representative access and authority for each job category included in the analysis is defined. Access and authority are d... 1 Physical Access. Authorized access to security areas within a DOE facility, such as a PPA, limited area (LA), PA, MAA, or a secure storage area. 2 Cyber Access. Authorized access to systems that control security functions. Access affords the ability to control, manipulate, or turn off alarms systems or access control systems. 3 Authority. Official or acknowledged authority to influence or control others. Authority may be used to direct operations, physical security systems, security operations, or authorize access to target areas and assets. Report a list of insiders to capture job responsibilities, physical access, authority, and cyber capabilities based on physical access. The following table is an example of how to capture these insider attributes. (e) Determine Knowledge Level for each insider job category. There may be cases where an insider has three levels of restricted information. The information or knowledge that the insider possesses will be captured. However, the amount of knowledge ... 1 Open Information. Open information reflects a level of knowledge that can be acquired through publicly available sources such as the internet, library, etc. For the conduct of VAs and risk assessments, it should be assumed the insider has this lev... 2 Limited Information. Limited information reflects a level of knowledge that an individual would acquire from having physical access to an area; allowing them to gather information that is readily observable, but not specifically affiliated with the... 3 Restricted Information. Restricted information reflects the most detailed level of knowledge, which is acquired and inherently associated with the individual’s occupation. For example, a member of the PF would be able to convey a high-level of det... a Facility Information: Construction of the facility combined with detailed classified breaching techniques and times. Specific locations where classified breaching techniques are most effective. Controlled or classified weaknesses in alarm systems... b Protective Force Information: Compartmentalized or classified information on specialized weapons, equipment or procedures, individual protective force responses to include timelines, tactics, and classified identified weaknesses in the response. c Target Information: Specific material inventories in specific locations, especially including the category and attractiveness of desired SNM targets, and material most conducive to conducting certain scenarios. (f) Rank Job Categories. Job categories are ranked based on access, authority, and knowledge. Prioritize potential insider types and simplify the list of potential insiders that will need further analysis. Using the data generated, a decision can b... (3) Program Review. At this point in the VA process, the Facility Characterization Program Review is conducted. The goal of this program review is to determine if assets are properly identified; and threats, the facility, and protective force are pr... (a) Insiders in Collusion 1 Passive 2 Active Non-Violent 3 Violent (b) Insiders Acting Alone 1 Active Non-Violent 2 Violent

(c) Passive Insider. The passive insider by definition is a collusion scenario. The passive insider will support adversary actions by supplying information to the adversary when they are at low risk for compromise to obtain the information. The fol... 1 Build outsider adversary scenario(s) as described in the Scenario Development section. 2 Based on the selected insider, identify the level and type of knowledge applicable to the insider using the data derived in Tables 19 and 21 and the ranking of the insiders. Table 22 provides an example of this matrix. 3 Analyze potential scenarios using a tabletop with SMEs (VA, performance testing, protective force, MC&A, operations, and federal oversight), performance testing exercise force-on-force (FoF) or limited scope performance test, or computer simulation. 4 Determine and document the impacts of the colluding insider’s actions on sensing, assessment, delay, use of cyber-attack methods, and the overall impact to the probability of neutralization for each scenario. 5 The effectiveness of the system against the outsider scenario, using the knowledge acquired from the passive insider, is determined using the outsider analysis process. 6 Document passive colluding insider impact on PE in the following manner: (d) Active. An active insider by definition is non-violent. An active nonviolent colluding insider can provide information prior to the attack, during the attack, or become part of the attack by performing non-violent acts such as leaving doors unse... 1 Build outsider adversary scenario(s) as described in the Scenario Development section. 2 Determine actions based on a specific job position that could be taken based on access, authority, and knowledge to materially help the outsiders in the scenario. For active insiders, the analyst identifies actions an insider(s) could take to assis... 3 If the actions of the insider degrade the performance of one or more protection elements, determine the modified FoM for each action and safeguard, taking into account the use of violence or not, to appropriately degrade PD or delay for each safegua... 4 If the actions of the insider aid in the adversaries attempt to neutralize the PF, include those actions as part of the neutralization analysis. 5 Analyze potential scenarios using tabletops with SMEs (VA, performance testing, protective force, MC&A, operations and federal oversight), performance testing, or computer simulations. 6 Determine and document the effects of the active colluding insider’s actions on sensing, assessment, delay, use of cyber-attack methods, and the overall impact to the probability of neutralization for each scenario. 7 The effectiveness of the system against the outsider scenario, using the support of the insider, is determined using the outsider analysis process incorporating the insider modified protection elements. 8 Document active colluding insider impact on PE in the following manner:

(e) Violent. In addition to being active, the violent insider uses violence to assist in the accomplishment of the adversary mission. The violent insider can use violence, physical force, and weapons to actively support outside adversaries by direct... 1 Build outsider adversary scenario(s) as described in this chapter. 2 Determine actions based on a specific job position that could be taken based on access, authority, and knowledge to materially help the outsiders in the scenario. For violent insiders, the analyst identifies actions an insider(s) could take to assi... 3 If the actions of the insider degrade the performance of one or more protection elements, determine the modified FoM for each action and safeguard, taking into account the use of violence or not, to appropriately degrade PD or delay for each safegua... 4 Determine PD for the introduction of equipment or weapons by the insider. 5 If the actions of the insider aid in the adversaries’ attempt to neutralize the PF, include those actions as part of the neutralization analysis. 6 Determine detection potential and protective force response based on the detection, delay, and response that is present. 7 Determine where in the pathway detection will occur and when a response is initiated. Detection and response occurring early along the insider’s task timeline would indicate a greater probability of interrupting the outsiders along their task timel... 8 Document violent colluding insider impact on PE in the following manner: (f) Active. An active nonviolent insider acting alone is one who uses stealth and deceit to defeat safeguards components but is unwilling to use more than very limited force, such as picking a lock. They will stop their actions upon detection. 1 Develop scenarios an insider might use to acquire SNM or create a sabotage event. For each step in the scenario determine the task required, and the steps necessary to complete the task. Build a timeline for each scenario. 2 Determine actions based on a specific job position that could be taken based on access, authority, and knowledge that would assist the insider. 3 Identify all safeguards associated with protection elements the insider would encounter along each timeline (e.g., lock on door, balanced magnetic switch on door, video motion detector on item, two-person rule). 4 For each protection element, determine defeat strategies from based on access, authority, and knowledge that are credible for the insider in the job category being evaluated. Document defeat methods, delay time, and probability of detection values.... 5 Analyze potential scenarios using tabletops with SMEs (VA, performance testing, protective force, MC&A, operations, and federal oversight), performance testing, or computer simulations. 6 Determine if adequate sensing, assessment, and delay are present to ensure a timely response for each scenario. PE = PD for this insider. 7 MC&A Program Elements Contribution. MC&A elements are major contributing factors for non-violent insiders. Because of the significant contribution from MC&A program elements, non-violent insider PE is adjusted using MC&A Comprehensive Analysis of ... 8 Document the active insider acting alone PE in the following manner:

(g) Violent. A violent insider acting alone can behave as a nonviolent insider to deceitfully defeat certain protection elements and use violence to forcefully defeat others. A violent insider will not stop upon detection alone, so interruption and ... 1 Determine the insider job categories to consider for the use of violence. Assume that an insider would not use a violent tactic unless their probability of success was at least equivalent to a non-violent tactic and exclude strategies or scenarios ... 2 Review scenarios developed for non-violent insiders and eliminate insider categories with low PE. Note: Some non-violent job categories use the same scenarios and have similar probability of detection. 3 Exclude violent strategies and scenarios that are not optimal. 4 Develop scenarios a violent insider might use to acquire SNM or create a sabotage event. For each step in the scenario, determine the task required, and the task necessary to complete the event. Build a timeline for each scenario. 5 Determine actions based on a specific job position that could be taken based on access, authority, and knowledge that would assist the insider. 6 Determine the protection layer where violence would first be used. 7 Determine the probability of detection at each layer. 8 Address the introduction of contraband if necessary. 9 If the actions of the insider degrade the performance of one or more protection elements, determine the modified FoM for each action and safeguard, taking into account the use of violence or not, to appropriately degrade or increase PD or delay for ... 10 Determine response force times for each scenario. Response force times will be based on performance testing. 11 Analyze potential scenarios using tabletops of SMEs (VA, performance testing, protective force, MC&A, operations, and federal oversight), performance testing, or computer simulations. 12 Determine if an adequate response is available to allow for interruption and neutralization. 13 Document the violent insider acting alone PE in the following manner: (h) Determine the maximum quantity of SNM available in an area. (i) Determine the material characteristics (size, weight, portability). (j) Using the insider analysis: 1 List all insiders who have access to the area. 2 Determine and document each individual’s access, knowledge, and authority. 3 Identify frequency of access. 4 Identify all safeguards associated with protection elements the insider would encounter along each timeline (e.g., lock on door, balanced magnetic switch on door, video motion detector on item, two-person rule). 5 Determine the optimum quantities of SNM that minimized detection. (k) Using defeat strategies from Table 26, document defeat methods, delay time, and probability of detection values in Table 26 at each protection layer. For each defeat method/detection element combination, assign a FoM for the probability of detect... 1 Acquire SNM. 2 MAA removal. 3 PA removal. 4 PPA removal. 5 List possible concealment and diversion paths. 6 Determine the cumulative overall probability of detection.

g. Scenario Development. This section provides an overview of the scenario development process used in performance testing and determining protection system effectiveness (PE). As described in the DOE Threat Policy, the processes defined in this cha... The VA process uses a set of baseline and above baseline adversary scenarios that include specific adversary resources, capabilities, and times needed to successfully complete their objective. The development of scenarios also includes a scenario sco... (1) Baseline scenarios that use baseline capabilities and evaluate the effectiveness of security and how it is delivered at a site. (2) Above baseline scenarios that provide additional insight into the strengths and weaknesses of the protection system. (3) Below baseline scenarios that provide insight into the effects of changing threats on the protective system. (4) Baseline Scenario. Baseline scenarios must be used to evaluate whether a security system is meeting design requirements. Sites will develop a series of baseline scenarios to address outsiders and outsiders in collusion with an insider threat. A... (a) Application of the graduated threat axis (GTA). The GTA will be used to develop scenarios necessary to test the range of response capabilities for a given target. (b) Standardized Data. Since this process is heavily subject matter expert dependent, standardized data will be used whenever possible (e.g., Sandia Barrier Reference Guides or NNSA standardized databases). In the event standardized data cannot be u... (c) Pathway Analysis Data. The results of the pathway analysis are used to inform the analyst and refine the development of scenarios. (d) Scenario Rating Methodology. The NNSA VA methodology uses the mission analysis process to provide an independent comparative assessment of scenarios by rating them based on certain factors and criteria to provide a uniform process to compare scen... (e) Scenario Scoring. Scenarios will be developed using the DOE Threat Policy criteria and then scored using the graded adversary scenario scoring matrix (GASSM). Scenario scoring will be developed based on scenario objectives and site configuration... (f) Additional Considerations. Baseline adversary capabilities and insider characteristics identified and defined in the DOE Threat Policy will be used to develop baseline scenarios. Existing baseline scenarios may form the basis for below or above ... 1 As stated in the DOE Threat Policy, not all baseline capabilities will be included in a single scenario but spread across the scenario set. 2 Targets will be identified and bound as applicable. 3 Only baseline scenarios are used to determine PE.

(g) Tactics. Scenarios consider adversaries using a combination of tactics including force, stealth, and deceit. (h) Path Elements. Scenarios will test major components of the security system. (i) Threat Objective. Scenarios will address theft and improvised nuclear device as appropriate. (j) Operating Conditions. Scenarios should address the range of operating conditions at the site. (k) Information. Scenarios will consider that an adversary’s ability to plan and execute an attack is heavily influenced by their level of knowledge associated with the target, PF, and facility, and how the information is acquired (e.g., insider, sur... (l) Adversary Capabilities. Scenarios should be developed to include baseline adversary capabilities defined in the DOE Threat Policy. Consideration of the weights that can be carried by each adversary individual and vehicle are included in adversar... (m) Insider Considerations. Scenarios must be developed to include the use of a passive, active, or violent insider colluding with outsiders. Insider knowledge will be applied using the guidance from the DOE Threat Policy. An insider is selected up... (n) Review Open Source Information. The adversary mission planning process starts with a review of open source information to initially evaluate potential targets and attack paths. This information is used to assist in developing specific objectives... (o) Define Objectives. The adversary objective will be defined up front in the scenario planning process after open source information has been reviewed based on VA needs. Objectives will be those listed in the DOE Threat Policy and GTA for baseline... (p) Use of Insider. Baseline scenarios typically use either a passive or active insider colluding in the development of COAs to be carried out by the adversaries (refer to the Application of Insider section in this chapter). Sites will be expected t... 1 No insider. Only open source information is used to plan an attack. Additionally, DNS may issue a request for evaluation of scenarios that have not been typically assessed in the past using only open source information (e.g., attack on a waste fac... 2 Passive Insider. This type of insider can only pass information to an outside adversary element. This insider will only obtain information that affords a low risk for compromise and will meet the stipulations detailed in the DOE Threat Policy and ... 3 Active Insider. This type of insider can be violent or non-violent. The active non-violent insiders will not use physical force or violence but may covertly assist the adversary team by executing other actions such as unlocking doors, triggering f...

(q) Insider Information. For the conduct of a VA analysis, the insider will convey to the outsider one category of information at the restricted level and the remaining two categories at the limited level (if credible), along with any additional info... 1 Open Source Information. Open information reflects a level of knowledge that can be acquired through publicly available sources such as the internet, library, etc. For the conduct of VAs and risk assessments, it should be assumed the insider has t... 2 Limited Information. Limited information reflects a level of knowledge that an individual would acquire from having physical access to an area, allowing them to gather information that is readily observable, but not specifically affiliated with the... 3 Restricted Information. Restricted information reflects the most detailed level of knowledge, which is acquired and inherently associated with the individual’s occupation. For example, a member of the PF would be able to convey a high-level of det... a Facility Information: Construction of the facility combined with detailed classified breaching techniques and times. Specific locations where classified breaching techniques are most effective. Controlled or classified weaknesses in alarm systems... b Protective Force Information: Compartmentalized or classified information on specialized weapons, equipment or procedures, individual protective force responses to include timelines, tactics, and classified identified weaknesses in the response. c Target Information: Specific material inventories in specific locations, especially including the category and attractiveness of desired SNM targets, and material most conducive to conducting certain scenarios. (r) Planning. At this point in the scenario development process initial COAs are developed. The following additional planning parameters will be used when developing Baseline scenario COAs. (s) Insider Information. Insider information will be limited to the type of insider information described in section (k) above and the guidance provided in the DOE Threat Policy. 1 Delay Times. Minimum times for specialized breaching will not be used for baseline scenarios. Times will reflect realistic values that meet the intent of DOE Threat Policy using the process described in the Sandia Barrier Reference Guide. a For specialized breaching tasks using restricted insider information, the task time will be 1.5 times the default or SME value unless the site has developed a range of times based on performance testing. If a range of times has been developed then ... b For specialized breaching tasks using non-restricted insider information, the task time will be 2.0 times the default or SME value unless the site has developed a range of times based on performance testing. If a range of times has been developed, ... 2 Breaching Capabilities. Each protection level in DOE Threat Policy for PL 1 though PL 4 has explicit explosives types and capabilities listed for use in analysis. Vulnerability assessment analysis is limited to the tables in DOE Threat Policy when... 3 Protective Force Information. Lack of restricted protective force is included in the adversary planning phase. 4 Target Information. Lack of restricted target information will result in an increase of 1.5 in target locating and gathering time.

(t) Scenario Documentation. The scenario write-up will consist of the following items in sufficient detail to allow for program reviews to evaluate scenarios: 1 Description of the scenario selection process; 2 Adversary mission plan (including tactics and path elements); 3 Insider and capabilities; 4 Information used to develop the attack plan; 5 Adversary capabilities used for the scenario; 6 Adversary equipment and weights; 7 Adversary team composition and task assignments; 8 Adversary transportation; and 9 Adversary timeline. (u) Scenario Rating. A modified mission analysis process is used to provide an independent comparative assessment of scenarios by rating them based on the following factors and criteria. Scenarios are rated using a 0 to 40-point scale. Each factor ... 1 Difficulty. GTA is used to evaluate scenario difficulty. GTA scenarios are scaled based on adversary complexity and capabilities. GTA-1 is the least complex, scaling up to GTA-6 as the most complex. The rating criteria was developed using this p... a GTA-1-2: 1 point b GTA-3: 2 points c GTA-4: 3 points d GTA-5: 4 points e GTA-6: 5 points 2 Speed. The speed of an attack has an impact on overall adversary success. Diversions and multiple pronged attacks are slower to develop and require more resources and training. This criterion was evaluated on the number of attack elements or the ... a Single prong attack: 1 point b Use of a diversion: 2 points c Two prong attacks: 3 points d Multiple prong attack: 4 points e Time coordinated attack: 5 points 3 Flexibility. A simple attack is easier to execute and requires less resources and training. This criterion was evaluated on the level of cross training required to complete the mission (e.g., multiple trained breaches or IND technicians). This fa... a No cross training: 1 point b Some cross training: 2 points c All cross trained: 3 points 4 Surprise. Rated based on where detection is likely to occur in the adversary timeline (Practical Detection Point). The closer detection occurs in the adversary timeline the higher the probability of success for the adversary. This factor is score... a Likely detected at PPA: 1 points b Likely detected at PA: 2 points c Likely detected at MAA: 3 points d Likely detected at target building: 4 points e Likely detected at target: 5 points 5 Reliance on Specialized Equipment. The complexity of the required breaches has an impact on the overall success of a scenario. More complex breaches require more equipment and specialized training, raising the complexity of the scenario. Speciali... a Mechanical breaches only: 1 point b Homemade explosives, single breach: 2 points c Homemade explosives, multiple breaches: 3 points d Commercial explosives, single breach: 4 points e Commercial explosives, multiple breaches: 5 points 6 Specialized Knowledge. Scaled to capture the complexities of the types of knowledge needed to carry out an attack. Open source information is easy to get when compared to restricted information typically reliant on the use of an insider. This fac... a Open source information only: 1 point b Limited Information: 3 points c Restricted information: 5 points 7 Reliance on Insider. Based on the use and type of insider. This factor is scored as follows: a No insider: 0 points b Passive: 1 point c Active non-violent: 2 points d Active non-violent human reliability program (HRP): 3 points e Active violent: 4 points f Active violent HRP: 5 points

(v) Distribution of Adversary Capabilities. DOE Threat Policy translates tactical deployment trends of terrorist capabilities into specific task specifications. It is expected that scenarios employed will stress a wide range of systems and capabilit... (w) Number of Scenarios. Develop a sufficient number of scenarios to factor in criteria outlined in this chapter and to meet the DOE Threat Policy objectives. (x) Scenario Development Review. All sites that use the DOE Threat Policy will undergo a scenario development review to ensure that sites implement a consistent, accurate, and disciplined application of DOE Threat Policy during baseline scenario deve... 1 SDRT Scenario Modifications. Once a set of SDRT scenarios has been approved, scenario variables for individual GTA scenarios will be modified as long as the intent of the GTA approved scenario remains intact. The goal is to develop a comprehensive... 2 Scenario Updates. SDRT approved scenarios will be updated and undergo an SDRT review whenever there are: a Changes in protection thresholds defined in policy. b Significant changes in local/NNSA security element specific threats. c Operational changes that may reduce the effectiveness to marginal or low levels. d New facilities with critical assets as defined by DOE Threat Policy or addition of a previously unanalyzed critical asset. e Changes in target characterization that result in a change in protection strategy. f Changes in PF strategy, protective systems, facility operations, and facility characterization. g Guidance given by DNS. (y) Scenario Documentation. The scenario write-up will consist of the following items in sufficient detail to allow for program reviews to evaluate scenarios: 1 Description of the scenario; 2 Adversary mission plan; 3 Insider capabilities; 4 Adversary capabilities used for the scenario; 5 Adversary equipment and weights; 6 Adversary team composition and task assignments; 7 Adversary transportation; and 8 Adversary timeline. (z) The results from these scenarios are not used to calculate baseline PE reported in the VAR and upgrades are not required to be implemented. Above and below baseline cases are developed and analyzed to: 1 Stress the system above the capabilities of the baseline scenarios by using intelligence-derived above baseline adversary tactics or by increasing or decreasing the adversary numbers or capabilities. 2 Evaluate airborne threats. 3 Address specific issues determined by DNS. (aa) SDRT Program Review. Prior to executing the scenario in any type of analysis, an SDRT will be completed. The SDRT is the second of three program reviews. Details are provided in Chapter 6, Program Reviews.

h. Neutralization Methodology. The probability of neutralization (PN) is a numeric value representing the probability the protective force (PF) can prevent an adversary from completing their attack objective(s) as it pertains to Category 0, I, and II... PN results will be supported by EMETL assessments and performance testing results. PN will also be supported by all other assurance activities conducted at a site, especially assurance activities related to PF duties and response plans. The cumulati... (1) Layered PN. PN must be calculated at each security layer used in the system effectiveness (PE) calculation when using computer simulations. When determining PN for a specific layer, detection is assumed at that layer. PF response begins at that... (2) Neutralization Tools. Multiple tools must be used to calculate PN metrics. Each tools metric is calculated independently and then combined when determining PE. The tools available to calculate PN metrics are: (a) Computer Simulation. A DNS provided computer simulation modeling tool will be used to simulate battles in a given space in a batch format. This type of tool is capable of showing the results of hundreds of simulated FoF exercises and gives the a... 1 When using computer simulations, PN is calculated using the outcome of 250 runs at each identified protection layer or when the analyst has reached a 95% confidence interval on the number of protective force wins. A probability equation is used tha... 2 Quality Assurance Process. Each site will develop a quality assurance process to validate inputs into the computer simulations. At a minimum, the process will verify the following to ensure accurate modeling results: a Buildings structures. b Terrain modeling. c Protective force weapon sets. d Protective force response. e Delay times. f Blast parameters and impact. g Adversary actions. (b) FoF Exercises. FoFs are tests involving two or more personnel operating as opposing forces (e.g., protective force versus adversary) while employing Engagement Simulation Systems (ESS) and controllers. They are used to evaluate components of a s... 1 Be based on SDRT-approved baseline scenarios to form the basis of the attack plan. a Scenario variables will be modified as described in this chapter to develop a larger set of baseline scenarios for input into computer modeling. b Scenarios will be run in all operating conditions and with both operating shift and off-shift protective force numbers. 2 FoF scenarios not previously analyzed with computer modeling will be input in and modeled as prescribed in this document with the goal of expanding GTA scenario sets. 3 FoF PN Calculation. An overall PN is calculated for each FoF exercise. Similar GTA baseline scenarios are combined to determine a PN for the respective GTA scenario set. PN is determined using the best estimation method (i.e., MLE, Jeffrey, or Wi... (c) Limited Scope Performance Tests (LSPTs). LSPTs are reduced-scope exercises/tests that focus on replicating one or more limited aspects of an engagement (e.g., recapture capabilities). These aspects of battle tests are conducted under the guideli... LSPT PN Calculation. PN for LSPTs is calculated in the same manner as prescribed for FoF exercises. (d) Table-top Exercises. Table-top exercises are simulations that are designed to test the theoretical ability of a group to respond to a situation. Scenarios are stepped through as each team takes turns making moves. Moves are scrutinized by judge... Tabletop PN Calculation. PN for tabletops is calculated in the same manner as prescribed for FoF exercises.

(3) Supporting PN Data. Sites must document or capture performance data that supports the reported PN value. (a) VBIED Effects. Site will include the effects on the PF and buildings using the criteria from this chapter when an adversary deploys a VBIED in a scenario. Sites will develop blast criteria (e.g., blast rings) specific to the VBIED size that iden... (b) Other Neutralization Factors. Sites will capture and document data associated with other relevant factors during the PN analysis. The analysis will be supported by assurance activities conducted at a site, especially assurance activities related... 1 AACTs. 2 RFTs. 3 Command, control, and communication. 4 The ability to effectively use weapon systems and vehicles. 5 PF and adversary team casualties as both numbers and percentage of engaged forces. 6 Friendly fire casualties. 7 Ability to demonstrate tactical efficiency (shoot and move). 8 Area/location where neutralization occurs and whether the location was on entry or exit (where the neutralization area may exist on both entry and exit paths). 9 Adversary time on target (applies to targets for which denial of task or containment strategies are concerned). 10 The effectiveness of force multipliers. (4) PN Adjustment Factors. PN is calculated under ideal conditions and does not consider such factors as daily training, qualifications, and operational readiness. PN calculated at 95% confidence interval (CI) is a best-case value. Adjustment facto... (a) This factor is based on summarized EMETL results. EMETL data is incorporated by scoring each mission essential task (e.g., detect, deter, deny, recapture) to determine an overall rating. The overall score is used to adjust the calculated PN. (b) At the end of a quarterly EMETL assessment, the tasks in Table 33 are assigned a numeric value from Table 34. Based on the total score, the PN value for each evaluated scenario is adjusted according to the factors in Table 35. The four quarterly... (5) Combining PN Sources. PN will be derived from multiple sources as available. Sources include computer simulations, FoF exercises, LSPTs, and table-top exercises. For new VA analysis, not all sources may be immediately available. Data will be c... Every scenario should include PN metrics from multiple sources, but not every layer requires PN metrics from multiple sources. i. Protection System Effectiveness Methodology. The Department of Energy has developed a PE equation for use in the vulnerability assessment process. The equation reflects the capabilities of a robust, multi-layered protection system by including th... When PN analysis is completed, the site will conduct the analysis of and derive a PE value for each scenario. This section describes how to calculate PE when layered PD and PN or single probability of interruption (PI) and PN have been calculated as ... (1) Computer Simulation Methodology. The PE methodology consists of obtaining equation data and calculating a PE number for each scenario. (a) Obtain Layered Equation Inputs. For each layer defined in the layered PE equation, a PD and PN value is required. 1 Layered PD. The value for PD is obtained as described in this chapter. One value is required for each layer used in the analysis for computer simulations. 2 Layered PN. The value for PN is obtained as described in this chapter. One value is required for each layer used in the analysis for computer simulations.

(b) Calculate PE. PE is calculated by inputting the values obtained into the system effectiveness equation as described in the DOE Threat Policy. The equation for calculating PE for a layered protection system is: (2) FoF Exercise and LSPT Methodology. The PE methodology consists of obtaining equation data and calculating a PE number for each scenario. (a) Obtain Equation Inputs. An overall PI and PN value is required. 1 PI. The value for PI is obtained as described in this chapter. 2 PN. A single PN is determined based on the results of the individual exercise. (b) Calculate PE. PE is calculated by inputting the values obtained into the following equation: (3) PE Reporting Format and Averaging. PE will be reported as shown in Table 36. The table calculates individual layer PE’s and aggregates into a scenario PE. In addition, the table averages PE’s across a facility and by protection strategy. The i... (a) Planned and Current PE. The PE matrix is split into two parts. The first part of the matrix is for planned PE. The FoMs in this matrix do not have performance (EMETL, FAR/NAR, etc.) factored into the PD and PN values. The PD values in this matr... 1 Facility Matrices. Each individual facility or operation within a facility requires its own PE matrix. It is not appropriate to include targets in storage within a facility with targets in process. Likewise, it is not appropriate to include targe... 2 Scenario Averaging. Averaging occurs within the reporting charts. It is not appropriate to average scenarios at a level higher than the charts allow for. It is not appropriate for a site to report a single PE for all facilities or scenarios. Sce... (b) PE for a traditional tabletop is determined using the process outlined in Attachment 2. j. Program Review. At this point in the VA process, the final program review is conducted. The goal of this program review is to evaluate the completed draft VAR prior to local field office approval. The program review team consists of the E-SSAP P... k. Protection Strategy Change Analysis. When the protection system effectiveness (PE) is not acceptable to site and program management, upgrades are considered. On occasion, a site may select to remove or replace elements of the protective system. ... This section describes how security system changes are analyzed prior to implementation of upgrades in a protection strategy or removal of protection elements currently being used. A consistent format for evaluating changes is necessary to determine ... (1) Methodology. The process for evaluating proposed changes depends on the increase in effectiveness for proposed upgrades, impact on protection system effectiveness for replacements or removals, risk management principles, and the initial and life-... (a) Upgrade Analysis. If the system effectiveness is found to be unacceptable, the vulnerability should be analyzed using commonly used root cause analysis methods. Protection system upgrades can be further defined by categorizing the anticipated im... 1 Upgrade Selection Protocol. The following questions may be considered when identifying potential upgrades: a What is the cost of the proposed upgrade and other options? b What is the schedule for acquisition of the upgrade? c What is the schedule for implementation of the upgrade? d Is there a more cost-effective method of attaining the same acceptable system effectiveness level? (If so, then an opportunity exists to reduce cost without a negative impact on system effectiveness.) e What is the benefit of the upgrade(s) relative to individual and collective set(s) of scenarios (e.g., reduction in PF manning levels, reduced maintenance costs)? f At the program level, what is the opportunity cost of completing the upgrade? g Are the risks addressed by the upgrades offsetting the risks associated with the opportunity costs?

2 Upgrade Types. a Administrative Security System Upgrades. Administrative upgrades are defined as procedures, policies, and practices that mitigate an identified vulnerability. Administrative upgrades are generally limited to the modification of processes or reallo... b Physical Security System Upgrades. Physical security system upgrades are defined as changes in the security system requiring construction or the procurement of capital equipment. Physical security system upgrades can include the purchase of X-ray ... c Facility Process and Material Inventory Upgrades. Facility process and material inventory upgrades are defined as changes in the way target materials are processed or stored. These efforts can result in the elimination of targets or a significant ... d PF Upgrades. These upgrades are defined as increases to manpower levels, tactics, equipment, or deployment of the PF. 3 Assigning Upgrade Cost. Cost estimates should include procurement, implementation, recurring, and life-cycle costs. The analyst’s role in this process is to define functional requirements for potential upgrades. 4 Cost/Risk Benefit Analysis. All potential upgrade options are developed in sufficient detail to provide cost/risk estimates compared to changes in PE. A cost/benefit analysis is performed, and the upgrades are ranked for their relative cost-effect... 5 Upgrade Matrix. Provide an upgrade matrix containing sufficient information for management to make appropriate decisions. An example is provided in Table 37. Additional considerations are compatibility operations, safety, sustainability, and timeframe to implement. 6 Upgrade Supporting Documentation. The upgrade matrix is not a stand-alone document. All matrix entries should have documentation to support the entered data. Only minimal supporting information is needed to support entries and should accompany th... a Analyses supporting the change in the upgrade PE; b Original cost-estimate documentation; c Associated data; d Limited scope performance tests and force-on-force exercises. 7 Removal or Replacement Analysis. If a system is determined to no longer be useful, or is in need of replacement, the impact of the removal or change in the system will be analyzed and documented. a Removal or Replacement Protocol. The following questions may be considered when evaluating removals or replacements of existing security systems: 1. What is the impact of the proposed removal relative to individual and collective set(s) of scenarios? 2. Does the replacement system perform at the same level as the existing system? 3. Is there a more cost-effective method of attaining the same acceptable system effectiveness level? (If so, then an opportunity exists to reduce cost without a negative impact on system effectiveness.)

8 Threat Change or New Facility Analysis. The following process is used when evaluating changes in the DOE Threat Policy or when conducting a new VA analysis. It does not apply to minor revisions to existing threat policy or annual updates to the VAR. a Follow the VA process to characterize the asset and define targets; identify threats, capabilities, and objectives; characterize the facility and protective force; and determine the protection strategy. b Determine baseline protective force numbers required to meet order compliance for the asset being evaluated (i.e., PL-1, PL-2, PL-3, or PL-4.). This should include protective force needed at all layers of the security system. c Add protective force incrementally to develop and evaluate distinct protection staffing levels. d Develop notional response plans for each of the incremental additions. e Develop a sufficient number of scenarios to evaluate the protection posture. Scenarios are approved by the ODFSA. f Analyze scenarios using computer simulations or tabletop processes to evaluate PF response in order to adjust staffing level configurations if necessary. g Conduct preliminary neutralization analyses to determine a range of system effectiveness and include the results in the VAR using the format in Table 38. h Using the determined range of system effectiveness, federal risk acceptance authorities determine the desired protection level/strategy. i Conduct further computer simulation analyses or tabletop exercises. l. Quality Assurance. VAs are very complex endeavors employing a wide range of figures of merit (FoMs) along with other assumptions derived from a variety of sources. The validity of a VA depends on developing a detailed understanding of the facilit... This section provides methods that can be used to ensure the vulnerability assessment (VA) accurately reflects the system effectiveness at the site and has been completed in accordance with NNSA program direction. Methodology. This process addresses activities to ensure the operational configuration of a site is accurately reflected in the VA. In addition, this process ensures that all of the major activities associated with a VA, target identification and bo... (1) Field Evaluation. The first and most important factor VA analysts must do to ensure accuracy of the security analysis is spend time in and around the facilities and observe operations. VA analysts should constantly question their conclusions bas... (a) Model and Simulation Accuracy. VA analysts must ensure the models and simulations they use as part of the security analysis are approved and funded by DNS. Only approved computer models and databases are used to support analysis. Any part of th... (b) Operation Change Control. Review existing change control processes to ensure operational changes are not made without ensuring they do not affect assumptions, FoMs, or protection system effectiveness (PE) values reported in the VA. (c) Protection System Evaluation. The process of performing a VA does not end with the development of results and the implementation of protection system upgrades. Protection system evaluation is a continuing improvement process that develops data f... 1 Performance Assurance Program. Performance testing is one of many tools employed to determine the effectiveness of safeguards and security system elements. Performance testing can be used to develop VA data, validate security element effectiveness... 2 Self-Assessment Program. The S&S program includes an annual self-assessment of the S&S program elements. Although generally directed toward establishing compliance and performance with departmental directives, it benefits the development and valid... 3 Surveys. DOE conducts periodic surveys of departmental federal facilities. Surveys are performance and compliance reviews against department directives as bounded by approved site security plans. SMEs use document reviews, staff interviews, and p... 4 Reviews and Inspections. Reviews or inspections conducted by other DOE elements or other government agencies provide another source of data that can support VA results or identify weaknesses in VA documentation and analysis methods. Reviews and in...

(2) Target Identification and Bounding. As part of the quality assurance (QA) process, the analyst must review target characteristics to ensure they are correct. Annually, VA analysts must verify that the protection strategy for each target on a sit... m. VAR Format. The following format must be used to develop a VAR that supports a permanent fixed site. Sites may add additional sections as needed. Note: VAR format for temporary projects or to support CD1, CD2, and CD3 project execution should inc... (1) Executive Summary (2) Introduction (3) Scope (4) Changes in VAR (5) Assumptions (6) Asset Characterization (a) Accountable Nuclear Material (b) Biological Agents (c) Classified and Sensitive Information (d) Hazardous Chemicals (e) Nuclear Weapons and Nuclear Components (f) Personnel (g) Radiological Material (h) Special Nuclear Material (i) Government Property 1 PL-5 2 PL-6 3 PL-7 High Value Assets 4 PL-7 (7) Target Determination and Description (a) Theft or Diversion of SNM (b) Protected Theft/Loss Detection (c) Rollup (d) Biological or Chemical Sabotage (e) Industrial Sabotage (f) Radiological Sabotage (g) Theft or Espionage of Classified (h) Destruction or Vandalism of Government Property (8) Threat Characterization (a) Adversary Types (b) Adversary Attributes (c) Adversary Objectives (9) Facility Characterization (a) General Site Description (b) Facility Operations (c) Security Layers 1 Detection 2 Delay 3 Response 4 Figures of Merit a Sensing b Assessment c Reponses (d) Delay Analysis (e) Blast Analysis 1 VBIEDS (to be used in scenario development and analysis) 2 VBIED Effects on Buildings 3 VBIED Effects on Protective Force 4 VBIED Mitigating Factors 5 Beaching charges, overpressure charges, IEDs (10) Protective Force (a) Overview (b) ACT (c) RFT (d) EMETL (e) Defensive Planning Checklist (11) Performance Assurance (a) Essential Elements (b) Compensatory Measures (12) Insider Analysis (a) Material Control and Accountability 1 Overview 2 COMPASS (b) Insiders (c) Human Reliability Program Mitigation (d) Summary of Results (13) Terrorist Analysis (a) Layered Probability of Detection (b) Probability of Interruption (c) Application of the Insider (d) Scenarios (e) Probability of Neutralization (14) Protection System Effectiveness PL-1through PL-4 Assets (a) Baseline Scenarios (b) Designed vs Performance (c) Above/Below Baseline Scenarios (15) Comprehensive Threat Analysis PL-5 through PL-8 Assets Summary of Results (16) Conclusions and Recommendations

Chapter 3: Security Risk Assessments 1. purpose. This chapter is intended to promote analytical processes throughout NNSA that are transparent and consistent in its characterization of the threat and protection system. This document provides for standardization of overall approach, str... 2. APPLICABILITY. NNSA security planning is based on a departmentally determined performance standard that describes the projected characteristics and capabilities of a design-basis adversary at the safeguards and security planning horizon (five year... 3. Background. Security planning and analysis, as outlined in DOE Order 470.4B, Safeguards and Security Programs, incorporates a risk-based approach to protecting departmental assets and activities. This chapter provides NNSA sites with technical di... a. Security Planning. SRAs are used in support of security planning activities that result in the development of an SSP or SP. SRAs evaluate risk for identified assets, threats, and threat objectives in DOE Threat Policy. Figure 8 outlines the SRA ... (1) Compliance-based assets. For departmental assets that are required to implement a compliance-based protection strategy, SRAs will be used to: (a) Estimate the effectiveness of the compliance-based approach in support of security planning activities; (b) Identify efficiencies in procedures and processes that may reduce vulnerabilities; and (c) Identify essential elements required to be tested or evaluated with surveys and self-assessments in a comprehensive Performance Assurance Program (PAP). Details for determining essential elements are provided in Chapter 5. (d) Identify the need for compensatory measures based on the consequence of loss and protection system effectiveness (vulnerability) of the asset. Details for determining compensatory measures are provide in Chapter 5. (2) Performance-based assets. In some cases, DOE directives do not have specific protection requirements, such as for high consequence radiological, chemical, or biological sabotage targets or for national critical infrastructure as defined by DOE Th... (a) Determine the basis for determining appropriate levels of physical protection or acceptance of risk, which is documented in a site’s SP(s), approved by the appropriate federal risk management official, and then becomes the baseline physical protec... (b) Identify efficiencies in procedures and processes that may reduce vulnerabilities; (c) Identify any protection upgrades necessary to mitigate risk; and (d) Identify essential elements required to be evaluated and effectiveness tested in a comprehensive PAP. Details for determining essential elements are provided in Chapter 5. (e) Identify the need for compensatory measures based on the consequence of loss and protection system effectiveness (vulnerability) of the asset. Details for determining compensatory measures are provided in Chapter 5. b. Deviations from Policy and Non-Conforming Storage of Classified Matter. SRAs used to support deviations and non-conforming storage of classified matter are focused on a comparative analysis to DOE Order requirements. SRAs used to support a deviat... (1) Identify efficiencies in procedures and processes that may reduce vulnerabilities; (2) Identify any necessary protection upgrades necessary to mitigate risk; and (3) Identify essential elements required to be evaluated and tested in a comprehensive PAP.

c. Termination of Safeguards. SRAs conducted to support a termination of safeguards request focus on determining comparative risk to the material and the protection requirements necessary as a condition of having safeguards terminated. SRAs used to ... (1) Determine policy requirements for security of the material having safeguards terminated; (2) Identify risks associated with the termination of safeguards request; and (3) Determine security requirements that will be applied to the material having safeguards termination approved at the appropriate level. 4. REQUIREMENTS. An SRA is used to determine relative risk when a formal vulnerability assessment (VA) is not required, but some level of security analysis is necessary as defined in departmental policy. An SRA does not require the same level of rig... a. Site’s security analysis files and resulting documentation will be organized and formatted in the same manner and supported by necessary evidence files referenced in and used during the analytical processes. b. NNSA sites will use the included document formats and reporting templates to communicate the results of security analysis and risk metrics to local field offices and the program office (NA-70) as defined by the reporting requirements outlined in th... c. In the case where departmental or National security requirements do not exist, an SRA must be used to aid in the determination of baseline protection requirements accepted by the Officially Designated Federal Security Authority (ODFSA). d. An SRA must be used to evaluate risk and identify vulnerabilities with the intent of finding procedural or operational efficiencies that may reduce vulnerabilities or risks for PL-5 through PL-7 assets. e. To meet planning objectives, an SRA for PL-8 assets must be completed as outlined in this chapter using the parameters in the DOE Threat Policy. f. Risk Acceptance. The results of SRAs are intended to provide an estimated security risk to departmental assets. For PL-5 through PL-7 assets, security risk is based on an assessment of the consequence of loss of an asset, and the vulnerability to...

5. SRA – Security Planning. DOE policy requires security planning and analysis that incorporates a risk-based approach to protecting departmental assets and activities. The processes outlined in the following sections are intended to meet this requi... a. Methodology. The SRA is the cumulative report for communicating security risk for PL-5 through PL-8 assets to senior managers and federal risk accepting officials. The SRA will accurately and concisely communicate the consequence, vulnerability, ... (1) Asset Identification. This is the first step to determine potential targets that need to be analyzed in order to ensure they are provided adequate protection. Asset identification involves categorizing all the types of departmental assets at a s... (2) Scoping Agreement. A scoping agreement is required for an SRA used to support an SSP. The scoping agreement identifies the parameters of the analysis and schedule for completion. The scoping agreement is approved by the local field office and i... (a) Reason for conducting the SRA. Describe the reason for conducting the SRA. What specific driver requires a new analysis of the site security? The explanation should include both background information on the specific driver behind the new SRA a... (b) Changes since the last SRA (if applicable). Describe what has changed since the last security analysis, including any interim security measures that have not been incorporated into the security analysis. The intent is to be able to trace the evo... (c) Site-specific Assumptions and Basis. Assumptions include system performance assumptions. (d) Target and Threat Bounding Conditions. Describe the adversaries and objectives included in the analysis and how the site is bounding targets for the SRA. Provide rationale for why it is appropriate to bound targets into a baseline set or to excl... (e) Deviations from DOE Policy. Describe all current approved deviations from DOE policy that are expected to impact the security analysis. Describe the specific requirement(s) that are being deviated from and how supplemental security measures or s... (f) Organizational Responsibilities. Describe the organizations with specific responsibilities to support development of the SRA. Describe what the organization is responsible for and why it is necessary for conducting the SRA. Describe the anticip... (g) Schedule for Conducting the Analysis and Producing the Security Risk Assessment Report. Describe the schedule for completing the analysis. Include any organizations with responsibilities and deliverables in the scheduling process. The schedule ... (h) Change Control Process for Updating the Scoping Agreement. Describe the process and notification chain for making changes to the scoping agreement. Describe site-specific triggers that would cause a change to the agreement. At a minimum, change... 1 Changes to baseline assumptions; 2 Additions to baseline assumptions; 3 Changes that cause the schedule to be delayed beyond 30 days, or as coordinated with the local ODFSA; and 4 New deviations that impact the analysis. (i) Information References Used for Site-Specific Performance Data. Provide references to be used to develop site-specific performance data.

b. Determine Target, Threats, and Threat Objectives. A target is a subset of a group of assets and is something that is selected as the focus of a malevolent attack. After assets are identified and PLs assigned, potential targets are evaluated to co... (1) Determine Assets and Protection Levels. An asset list is generated using the criteria described in the asset identification section of this document. The asset list includes the location, asset category, asset type, PL, and required protection s... (2) Determine Threats and Objectives. Using DOE Threat Policy, determine potential threats and threat objectives for each asset. Threat and threat objectives assist in bounding of targets. For the purpose of analysis, threats may be grouped into in... (a) Identify Threat Types. Characterizing the threat requires identifying the various applicable adversary types. Adversary types are defined by DOE Threat Policy and include the following: 1 International Terrorists (outsider); 2 Domestic Terrorists (outsider); 3 Demonstrators and Protestors (outsider); 4 Criminals, individual (insider/outsider); 5 Criminals, organized (outsider); 6 Psychotics (insider/outsider); 7 Disgruntled employee (insider); and 8 Violent activists (outsider). (b) Identify Threat Numbers. Based on the asset and adversary type, the analyst determines the number of adversaries to be considered in the SRA using the DOE Threat Policy. Adversary numbers will vary depending on adversary type and PL. For advers... (c) Establish Threat Objectives. Threat objectives are wide-ranging with specific strategic and tactical goals. Creating a complete listing of all possible adversary objectives is not practical, but a list of threat types and objectives analyzed app... 1 Theft of asset; 2 Radiological, chemical, or biological sabotage; 3 Theft of classified or sensitive information; 4 Sabotage of a critical facility or mission; 5 Theft of government property; 6 Facility seizure; 7 Workplace violence or hostage-taking; 8 Protest activities to include vandalism, destruction of property, etc.; and 9 Espionage/foreign intelligence collection (only as this act would assist the adversary in performing the above objectives). (d) Determine Threat Capabilities. Adversary capabilities are described in the DOE Threat Policy. All adversary capabilities are considered when developing scenarios, but not all need to be used when conducting an SRA. (e) Identify Potential Targets. In determining potential targets, all identified special nuclear material (SNM) assets need to be evaluated for inclusion in the target set. Other programs such as Nuclear Materials Control and Accountability, operati... (f) Characterize Targets. Identify basic attributes of each target in order to support target screening and the target binning process. Attributes include: 1 Target locations and storage configurations; 2 Target weight, size, and portability; 3 Container information; 4 Task times to remove target; and 5 Basis for outcome (threat success criteria). (g) Screen Targets. Identify targets that can be removed from analysis and document these targets. 1 Targets can be removed from analysis if the targets have a dedicated barrier or inherent design that exceeds the adversary capabilities of the DOE Threat Policy. 2 Document any target removed from analysis and the rationale for removal in the SRA.

(h) Bounding of Targets. Group targets by site area, PL, location, asset category, asset type, threats and threat objectives, protection strategies, and protection measures. Grouping assists in the bounding of targets into representative target sets... 1 PL-5 and PL-6 Targets. The following bounding parameters apply to PL-5 and PL-6 targets: a Response and Protection Strategy. Targets that have the same response and protection strategy can be bound together if they meet the other criteria listed below. b Threat Size, Threat Objectives, and Capabilities. Targets with smaller adversary numbers and reduced capabilities can be bound by higher numbers and capabilities if adversary objectives, response, protection strategy, and security features are simi... c Protection Measures. Targets that have the same types of access control, tasks, and delay times can be bound together. Targets with similar delay times but dissimilar tasks to access the target cannot be bound together. Targets with longer delay ... d Consequence Values. Like targets with the same consequence value can be bound together. Like targets with different consequence values cannot be bound together. 2 PL-7 Targets. Compliance-based targets with similar threat types, threat objectives, protection measures, and consequence values can be bound together to conduct a single site-wide assessment. The following example is provided: a Classified Material. Secret and confidential material stored in multiple order compliant vault type rooms (VTR) in a group of buildings. The targets have the same consequence value and the group of buildings all have the same building access requi... b General Property. General property and facilities can be addressed through global assessments based on the asset, consequence value, threat type, and threat objective. 3 PL-8 Targets. PL-8 assets are personnel subject to work-place violence, an active shooter incident, a hostage situation, or a vehicle-borne improvised explosive device (VBIED) event while on DOE-controlled property. SRAs for PL-8 assets can be bou... Several buildings have similar access control (e.g., badge reader access required for entry), and a comparable number of people potentially located within the building (e.g., <100). The threat is a psychotic insider or disgruntled employee conducting... (i) Generate a Target Matrix. A Site Target Matrix is developed describing the targets that will be analyzed. Each facility must generate a target matrix that describes the site’s assets, targets, and which targets have been binned. This listing wi...

c. Consequence Assessment. Table 41 is a relative consequence-of-loss matrix for departmental assets, based on the PLs defined in the DOE Threat Policy and other national drivers. Consequence-of-loss is a relative ranking for a specific asset, but w... d. Characterize Physical Protection System (PPS). PPS components for each target are identified. PPS components include all the measures in place to perform the functions of detection, delay, and response. When characterizing the PPS, all system co... (1) Protection Layers. As part of characterizing the PPS, protection layers need to be identified. For SRAs, there is no required number of layers, and the layers identified for use in the model do not need to correlate with the traditional layers o... (2) Detection, Delay, and Response. Detection, delay, and response are required functions of an effective PPS. To aid in characterization, information is gathered concerning the implementation of the PPS. This may include data, information, and sta... (3) Explosive Analysis. Explosive analysis is required to determine impacts to PL-5, PL-6, and PL-7 High Value critical mission assets. Other PL-7 government property assets that do not meet DOE Order compliance requirements will be evaluated with e... (a) Blast Overpressure. Overpressure, also called a blast wave, refers to the sudden onset of a pressure wave after an explosion. A blast wave results in injuries to personnel and damage to buildings. The damage associated with a blast wave is depe... (b) Blast Injuries. Explosions can produce unique patterns of injury that are difficult to predict. The injury patterns are a product of the composition and amount of the materials involved, surrounding environment, delivery method, and the distance... (c) Personnel Survivability. Table 43 provides the psi criterion and impacts for evaluating effects on personnel. Once incident overpressure has been determined based on the weight of the explosive and the distance from the charge, Table 5 can be us... (d) Building Damage. The extent and severity of building damage cannot be predicted with perfect certainty. Past events show that the unique specifics of the failure sequence for a building significantly affect the level of damage. Despite these un... e. Develop Scenarios. DOE Threat Policy outlines potential PL-specific scenarios. These include but are not limited to: mechanical attack; ballistic attack; facility seizure; improvised explosive devices; vehicle-borne improvised explosive devices; ... f. Analyze the PPS. The next step in the SRA process is analyzing the effectiveness of the PPS. This involves using the information gathered in the previous steps to develop scenarios as defined in the DOE Threat Policy and then estimating the relat... g. Assess Vulnerabilities and Risk. The resulting vulnerability and relative consequence for the asset are used to determine risk using Table 48. After all targets are analyzed, a table like Table 49 is completed. h. Identify Essential Elements. The results of the assessment should indicate those elements of detection, delay, or response that have an impact on vulnerabilities and risk, or identify what countermeasures are required to reduce risk. These elemen... i. Evaluate Mitigating Factors. There are many factors that could have an impact on the estimated risk and they should be addressed to provide the risk decision makers with additional information on where to allocate potential resources. These facto... (1) Local and site-specific threats, (2) Local/regional/national statistics, (3) Other national standards, (4) Operational security programs at the facility, (5) Deterrence measures, and (6) Geographical location and other environmental factors.

j. Communicate Risk to Decision Makers. At this point, the results of the assessment are communicated to the appropriate decision makers in the form of a briefing. The results are communicated prior to identifying countermeasures and preparing a fin... k. Identify Potential Countermeasures. If necessary, a set of potential countermeasures is developed and presented to the risk accepting authority. A range of possible mitigation measures should be considered, including measures to reduce consequenc... l. SRA – Site Security Plan Report Format. The SRA report used to support the site’s security plans will use the following format. For SRAs associated with capital projects and non-recurring campaigns and temporary conditions, a modified format can b... (1) Executive Summary, (2) Introduction, (3) Asset and Target Characterization, (4) Consequence Assessment, (5) Threat Objectives and Threat Types, (6) Assumptions, (7) Physical Protection Systems, (8) Scenarios, (9) Analysis of the PPS, (10) Essential Elements, (11) Risk and Vulnerability Summary, (12) Mitigating Factors, (13) Countermeasures, and (14) Conclusions and Recommendations. 6. SRA – Deviations and non-standard storage of classified. The objective of this section is to provide the methodology and process for conducting an SRA that supports a deviation or non-conforming storage of classified matter request. a. Deviations. There are two types of deviations: (1) Equivalency. An equivalency is an alternative to how a requirement in a directive is met in cases where the how is specified. Equivalencies represent alternative approaches to achieving the goal of a directive’s requirement that results in no in... (2) Exemption. An exemption is a release from compliance with one or more requirements in a directive without the identification of an equivalent means of meeting the requirement. The level of additional risk being accepted must be identified, and an... Approval and Documentation. The analysis must be documented in an SRA or VA and approved at the appropriate level. b. Non-conforming Storage of Classified Matter. Non-conforming storage is a means of providing equivalent protection for classified matter that cannot be protected by policy standards and requirements due to size, nature, operational necessity, or ot... (1) Protection Effectiveness. Non-conforming storage must provide equivalent protection to that provided to similar levels and categories of classified matter by standard configurations. (2) Approval and Documentation. The methods, protection measures, and procedures must be documented and approved by the ODFSA. c. Methodology. The process for conducting an SRA for deviations and non-conforming storage requests is slightly different than one conducted to support security planning. This type of assessment focuses on conducting a comparative analysis to exist... (1) Identify Assets. Identify the asset requiring analysis. (2) Define Order Requirements. Define the order requirements necessary for the protection of the identified asset and describe why a deviation or non-conforming storage request is needed. (3) Determine Threat Objective and Threat Types. Potential threats to departmental assets are identified based on the applicable asset protection level defined in the DOE Threat Policy. The guidance provided in this policy is used as a basis for the... (4) Define Assumptions. All assumptions used in the comparative analysis will need to be identified and documented. (5) Characterize Protection. Include all security systems that contribute to the overall protection of the target, including security layers and boundaries, applicable detection, delay, access controls, and protective force response (armed or unarmed... (a) Protection Measures. The description of the protection measures will be detailed enough to support the conclusions determined in the comparative analysis. The characterization will discuss specific numeric values (e.g., probability of detection,... (b) Essential Elements. Characterizing protection requirements will assist in identifying essential protection elements that are required to be supported with continuing performance testing to support a deviation.

(6) Develop Scenarios. DOE Threat Policy outlines potential PL-specific scenarios. Threats and capabilities will be used to develop scenarios used to conduct a comparative analysis. Not all threats need to be analyzed. Threats can be grouped into ... (7) Comparative Analysis. The protection of the asset is compared with protection afforded by an order-compliant protection system. The focus of this step is to compare the protection effectiveness along the adversary pathway. The output of the ana... (a) Deviations. The protection effectiveness along the complete adversary pathway is compared layer by layer or element by element. This comparison describes adversary actions along the pathway and the probability of detection for each task. The re... (b) Non-Conforming Storage of Classified Matter. A comparative analysis is completed when some characteristic of the target prevents the application of a standard protection design. In order to define equivalency, the protection standard that will b... (8) Determine Risk. The level of risk is determined in order to justify an equivalency, exemption, or non-conforming storage request. (9) Communicate Risk to Decision Makers. At this point, the results of the assessment are communicated to the appropriate decision makers in the form of a briefing. The briefing is completed prior to finalizing the report to resolve any issues. (10) Define Equivalency or Exemption. The need to submit an equivalency or an exemption is determined based on the results of the SRA. If there is no increased risk, an equivalency can be requested. If risk is determined to be higher than that prov... (a) Equivalency. Equivalencies will address what measures are being done and what non-compliant citations are being addressed by these measures. 1 If an equivalency addresses a multitude of order non-compliance issues, the overall protection system effectiveness can be used as a basis for acceptance. 2 If an equivalency is addressing a single noncompliance issue (e.g., non-compliant fencing), it should include definitive statements concerning the performance of that overall element (e.g., perimeter intrusion detection and assessment system), such ... (b) Exemption. The description of the exemption should focus on identifying any risk that would be accepted by the risk acceptors. (11) SRA Supporting Documentation. The analyst should be prepared to defend any assumptions or element performance parameters that support the asset protection analysis. (a) Documentation used or created as a result of the analysis will be maintained and filed for future use and for review in validation efforts. Examples of documentation to be maintained may include, but are not limited to: 1 Basis for any assumptions, 2 Applicable policy requirements, 3 Description of protective systems, 4 Performance testing data if used, and 5 Data used, but not explained in the process. (12) SRA Report. The SRA report for deviations and non-conforming storage of classified matter will follow the following format: (a) Executive Summary, (b) Introduction, (c) Asset Characterization, (d) Order Requirements, (e) Threat Objectives and Threat Types, (f) Assumptions, (g) Protection Measures, (h) Comparative Analysis, (i) Risk Summary, (j) Equivalency/Exemption, (k) Conclusions and Recommendations, and (l) References.

7. SRA – Termination of Safeguards. The objective of this section is to provide the methodology and process for conducting an SRA that supports a termination of safeguards request for attractiveness level D or higher SNM. Methodology. a. Identify Assets. Characterize the SNM being terminated using the Graded Safeguards Table in DOE O 474.2, Nuclear Material Control and Accountability (typically provided by the Nuclear Materials Control and Accountability organization). b. Define Order Requirements. Determine order security protection requirements for the material that safeguards are being terminated. c. Determine Threat Objective and Threat Types. Potential threats to departmental assets are identified based on the applicable asset protection level defined in the DOE Threat Policy. The guidance provided in this policy will be used as a basis for... d. Define Assumptions. All assumptions used in the comparative analysis need to be identified and documented. e. Characterize Protection. Include all security systems that contribute to the overall protection of the target, including security layers and boundaries, applicable detection, delay, access controls, and protective force response (armed or unarmed)... Protection Measures. The description of the protection measures will be detailed enough to support the conclusions determined in the comparative analysis. The characterization will discuss specific numeric values (e.g., probability of detection, tra... f. Develop Scenarios. DOE Threat Policy outlines potential PL-specific scenarios. Threats and capabilities will be used to develop scenarios used to conduct a comparative analysis. Not all threats need to be analyzed. Threats can be grouped into b... g. Comparative Analysis. The protection of the asset is compared with a compliant standard protection to determine if the receiving facility (interim of final storage) has sufficient protection measures to protect the material as it is characterized ... h. Determine Risk. The level of risk is determined in order to justify if risk acceptance is necessary. i. Communicate Risk to Decision Makers. At this point, the results of the assessment are communicated to the appropriate decision makers in the form of a briefing. The briefing is completed prior to finalizing the report to resolve any issues. j. SRA Report. The SRA report to support termination of safeguards requests follows this format: (1) Executive Summary, (2) Introduction, (3) Asset Characterization, (4) Order Requirements, (5) Threat Objectives and Threat Types, (6) Assumptions, (7) Protection Measures, (8) Comparative Analysis, (9) Risk Summary, and (10) Conclusions and Recommendation. Chapter 4: Roll-up Analysis 1. purpose. The purpose of this chapter is to provide guidance on how to conduct a roll-up analysis on special nuclear material (SNM) assets. 2. Background. Roll-up is the accumulation of smaller quantities of SNM to attain a higher category. A single DOE facility may have smaller categories of SNM in different locations, such as multiple storage containers within a room, multiple rooms i... 3. REQUIREMENTS. a. Roll-up. DOE policy requires a Category I quantity of SNM to be located within a material access area (MAA), Category II within a protected area (PA), Category III within a limited area (LA), and Category IV within a property protection area (PPA). (1) Sites must analyze material holdings within or across security boundaries to determine credibility of obtaining higher category of SNM (bound by the site boundary). (2) When the total quantity of SNM at a site is Category I located outside an MAA, Category II located outside a PA, or Category III outside an LA, analysis must be conducted to determine the credibility of roll-up. Roll-up can be evaluated within a ... (3) Roll-up may also be required in the case when larger quantities inside a security area do not have all the required protection of the higher total quantity, e.g., multiple Category IV material balance areas (MBAs) in an LA. Sites must consider ot... (4) A Material Risk Review Committee (MRRC), as defined in DOE Threat Policy, must be completed to support roll-up analysis.

b. Credible Roll-up. The concept of credible roll-up must be predicated on the assumption that a threat as defined in Department of Energy (DOE) Order 470.3C, Design Basis Threat Policy (DBT) or its successor (hereinafter referred to as DOE Threat Po... (1) SNM is in a form that does not require extensive reprocessing to aggregate and combine into a usable goal quantity. Feasibility of reprocessing questionable SNM configurations must be evaluated by the MRRC. (2) It does not require significant time and effort to acquire. (3) There is a reasonable likelihood of success against the physical protection measures in place. If roll-up is deemed credible, protective measures can be implemented that mitigate the ability to achieve the goal quantity making roll-up non-credible. Implemented measures will be performance tested to ensure performance is maintained. c. Non-Credible Roll-up. Roll-up is deemed not credible if the SNM is determined not to be a credible target or the physical protection measures are effective against the defined threat. A determination that roll-up is not credible is based on characteristics of the SNM, characteristics of the SNM locations, and the physical protection measures in place. If roll-up is determined not to be credible, the protection measures in place th... 4. PROCESS. Conducting a roll-up analysis involves gathering necessary information, determining if the SNM is a credible target, determining the adversary tasks to acquire a goal quantity of SNM, characterizing the physical protection measures, and m... a. Determine SNM Locations and Quantities. Determine the SNM location(s) and quantity of SNM on the site and associated security areas that will be included in the roll-up analysis. Based on the scope, the roll-up analysis may include multiple items... (1) Delay times, (2) Response force times and strategy, and (3) Location. b. MRRC Review. At this point in the process a request is initiated for an MRRC to review the potential material types and revise the scope of the analysis if necessary. c. Characterize Targets. Gathering information regarding the type and form of the SNM, and information regarding other factors such as radiation dose rate, weight, weight percent, and criticality concerns. The specific characteristics of the locatio... d. Identify Roll-up Combinations. Identify combinations of SNM locations that can lead to roll-up. Identify all the possible combinations of SNM locations at a site where the amalgamation of smaller quantities of SNM can lead to the roll-up quantity... e. Identify Potential Threats. The DOE Threat Policy is used to determine the potential threats and capabilities that need to be analyzed based on the potential roll-up combinations identified. The insider analysis should form the basis for evaluati... f. Characterize Protection Measures. Define the physical protection measures in place for each SNM roll-up target to be considered in the analysis. For an abrupt roll-up analysis, applicable facility conditions (e.g., vault open, vault closed, etc.)... g. Determine Figures of Merit (FoMs). FoMs are assigned to detection and delay elements characterized in the previous step. Detection FoMs can be derived from subject matter experts (SMEs), manuals, databases, test reports, and performance testing. ... h. Develop Scenarios. Adversary scenarios are developed based on the combinations for roll-up previously identified. The process for developing scenarios is as follows: (1) Develop information regarding the number and type of tasks adversaries in the defined threat group have to perform to acquire the material; (2) List the tools and equipment needed; (3) Determine the time for each task; and (4) Determine if a threat would find the SNM a conceivable target based on the characterization of the SNM, and the SNM locations. In some cases, an argument can be made that the SNM is not a viable target. For example, grams of hold-up in miles of ...

i. Evaluate Scenarios. Detection, delay, and response capabilities for each scenario are captured to determine the overall protection system effectiveness and the credibility of roll-up for the scenario. This can be accomplished using a variety of m... j. Cumulative Probability of Detection (PD). Cumulative PD is determined by assigning a likelihood that an adversary will be detected or interrupted during each roll-up task up to the critical detection point (CDP) using response force times (RFTs) d... k. Probability of Interruption (PI). PI is equal to cumulative PD if detection initiates a protective force response sufficient to ensure interruption of the adversary before the accumulation of the goal quantity of SNM. An example adversary timelin... l. Determine Credibility of Roll-up. Roll-up is deemed non-credible if: (1) The analysis supports the conclusion that the SNM is not a viable target, or (2) PI and delay mechanisms provide a high assurance that a protective force response arrives and interrupts the adversary before the roll-up quantity is accumulated. The response must be with sufficient numbers of response personnel and equipment to... m. Protection System Effectiveness (PE). If it is determined that sufficient numbers of response personnel arrive prior to accumulation, PE is calculated using: n. Order Compliance or Upgrades Analysis. Strict order compliance measures can be implemented that meet the required level of protection for the material, and follow-on analysis is conducted to determine protection system effectiveness based on this ... o. Upgrades Analysis. The second option is to conduct an upgrades analysis that implements protection measures that provide assurance that roll-up is not credible. Upgrades must be selected that increase PE to the acceptable level identified in the ... p. Performance Assurance Activities. Ongoing performance assurance activities, to include the identification of essential elements, will be incorporated into the physical protection program to validate roll-up assumptions. These activities include p...

Chapter 5: Performance Assurance Program 1. purpose. This chapter provides guidance on implementing processes to ensure the NNSA Performance Assurance Program (PAP) demonstrates reliable, effective protection of enterprise assets. 2. Background. DOE directives require a site to conduct surveys, self-assessments, and performance testing activities for safeguards and security (S&S) programs to evaluate program effectiveness. To meet these requirements, a comprehensive approach ... Sites must implement and maintain a PAP in accordance with the overall protection goals established by NNSA and local federal oversight that ensures that essential elements used to protect identified NNSA assets meet established requirements for relia... 3. REQUIREMENTS. PAPs must be tailored to address all NNSA assets at a site and be comprised of the total security system and S&S programs at the location. The PAP must tailor evaluation and testing activities at a site in order to ensure a systems ... The PAP must be approved by the Officially Designated Federal Security Authority (ODFSA) and provide a comprehensive approach to assure an acceptable level of performance for identified essential elements of a facility/site protection program crucial ... a. PAPs must: (1) Identify essential elements that encompass all S&S topical areas relating to program management operations, physical protection, protective force, information security, personnel security, and materials control and accountability that are relevant... (2) Not duplicate monitoring and testing activities conducted under ongoing quality assurance and S&S operations but include them in a comprehensive program that ensures all assets are being protected. (3) Include operability tests to confirm, without any indication of effectiveness, that a performance-based or compliance-based system element or total system is operating as expected. (4) Include effectiveness tests to provide assurance that essential elements of the system are working as expected, separately or in coordination, to meet protection program objectives. (5) Include results from surveys and self-assessments to evaluate program level essential elements that may not be readily operability or effectiveness tested. (6) Ensure essential elements have been determined based on the range of Department of Energy (DOE) Order 470.3C, Design Basis Threat Policy (DBT) or its successor (hereinafter referred to as DOE Threat Policy) threats for identified assets to ensure ... (7) Comply with the performance testing or self-assessment and survey requirements promulgated in DOE directives. (8) Demonstrate the effectiveness of essential elements provided by NNSA guidance or identified through vulnerability assessment (VA) analysis for protection level (PL)-1 through PL-4 assets. (9) Demonstrate the effectiveness of essential elements identified by an SRA for PL-5 through PL-8 assets. (10) Ensure that the S&S program elements are operational at all times, functioning as intended, and interacting in such a way as to identify and preclude the occurrence of adverse activity before security is compromised. (11) Implement compensatory measures for essential elements that are effective and performance tested to the extent possible. (12) Initiate the appropriate maintenance required to repair or replace non-functioning security systems.

4. PROCESS. The development of the PAP is done through systematically evaluating all protection programs, security-related systems and sub-systems, and security components in accordance with DOE/NNSA guidance to determine essential and non-essential ... NNSA has developed a core list of essential elements for PL-1 through PL-4 assets included in this chapter. Other essential elements may be identified by the site using the results from VA analysis. Essential elements for PL-5 through PL-8 assets ar... Programmatic self-assessments and surveys for all areas of S&S are continually ongoing and evaluated for inclusion into the PAP as programmatic essential elements. a. Security Components. NNSA used security components to define essential elements for security assets. These terms are consistent with other policy documents promulgated by NNSA. These components are: (1) Deter (2) Detect (3) Deny (4) Recapture (5) Recovery (6) Reconstitute b. NNSA Performance Assurance Program Elements. DOE defines two types of elements: essential and non-essential. This chapter further breaks essential elements into three categories to assist the site in determining essential elements, setting testin... c. PL-1: PL-4 Essential Elements. NNSA has developed a core list of essential elements for PL-1 through PL-4 facilities (Figure 14). Additions to the NNSA core list must be based on the results of VA analysis indicating the impact to overall securit... (1) Threat Specific; (2) Performance-based; (3) Operability tested; (4) Effectiveness performance tested; Testing of elements that are not prone to failure and that are not subject to compromise without noticeable tampering, such as walls and fences, is not required as long as it can be illustrated and documented through VA analysis that tampering with su... (5) Associated with pre-defined compensatory measures that are implemented immediately in the event the element is not operational or fails to function at the required level; (6) Approved by the ODFSA; and (7) Reviewed annually. d. PL-5: PL-8 Essential Elements. Essential elements for PL-5 through PL-8 assets are identified through the SRA process. PL-5 through PL-8 essential elements will be performance-based and effectiveness tested at the frequency prescribed in DOE poli... (1) Identified through the SRA process; (2) Threat Specific; (3) Site specific; (4) Operability tested; (5) Effectiveness performance tested for performance-based assets; (6) Associated with compensatory measures approved by the ODFSA as determined by the site based on the consequence of loss and vulnerability of the asset. (7) Approved by the ODFSA; and (8) Reviewed annually. e. Programmatic Essential Element. Programmatic essential elements are S&S programs or components of S&S programs that apply across all facilities and operations with S&S interests. Programmatic essential elements are determined by the site, approve... (1) Classified Matter Protection and Control (CMPC); (2) Cyber (as it relates to access to security systems); (3) Human Reliability Program (HRP); (4) Information Security (INFOSEC); (5) Insider Threat Mitigation Program; (6) Material Control and Accountability Comprehensive Assessment of Safeguards Strategies (COMPASS) program; (7) Operational Security (OPSEC); (8) Personnel Security (PERSEC); (9) Protective Force Enterprise Mission Essential Task List (EMETL) Evaluations; and (10) Protection Program Management (PPM) Components.

f. Non-essential Element. Non-essential elements are protection systems or measures included in a defense-in-depth strategy, but do not by themselves meet the definition of an essential element. Non-essential elements are typically at a Category I f... g. Performance Assurance Program Committee. In order to effectively implement a PAP, a local PAP committee will be established for PL-1 through PL-4 facilities. The PAP committee will meet quarterly at a minimum and is comprised of designated contra... h. Compensatory Measures. Compensatory measures are implemented in situations when essential elements fail to meet performance requirements and an alternate strategy is necessary to ensure the protection of assets. Adequate compensatory measures may... (1) Pre-defined and approved by the ODFSA. (2) Performance tested to the extent possible and the results of the test used in VA models. i. Performance Testing. An effective testing program provides both the reliability and assurance of security-related subsystems and components. The purpose of performance testing is to ensure systems, people, and procedures can perform as required, ... (1) All potential threat types and capabilities evaluation; (2) The adversary pathway and the equipment necessary to execute adversary objectives; and (3) All shifts and weather conditions testing. j. Determining FoMs. Performance testing results will be used to determine FoMs used in VAs modeling or validating SRA assumptions. The preferred method for determining FoMs is to conduct a sufficient number of tests and use accepted statistical met... (1) Integration of Testing into VA Models. Testing data will be used to calculate a FoM and reported in the VAR in a table similar in format to the table below. (2) This methodology will also be used to support essential element performance values identified from an SRA. k. Weighting of Performance Tests. Current fiscal year performance tests should be weighted higher than previous fiscal years in order to establish system performance trends and/or issues. For example, if using the current and previous years, the cur... l. Performance Assurance Program Plan Format and Content. The following format will be used for PAP plans at PL-1through PL-4 designated facilities: (1) INTRODUCTION (2) PURPOSE (a) Application (b) Updates to the PAP Plan (3) OBJECTIVE (4) ROLES AND RESPONSIBILITIES (a) PAP Committee (b) Vulnerability Assessments (c) Protective Force (d) Physical Security Systems (e) Material Control and Accountability (f) Operations (g) Performance Testing (5) SCOPE (a) PL-1: PL-4 Essential Elements (b) PL-5: PL-8 Essential Elements (c) Programmatic Essential Elements (6) PROGRAM DESCRIPTION (a) Methodology for Determining Essential Elements PL-1: PL-4 (b) Methodology for Determining Essential Elements PL-5: PL-8 (c) Methodology for Determining Non-Essential Elements (7) SURVEYS AND SELF-ASSESSMENTS (8) PERFORMANCE TESTING (a) Testing Methodology (b) Categories of Performance Tests (c) Number of Required Tests (d) Test Schedules (e) Performance Test Plans (f) Performance Test Reports (g) Deficiencies or Failures (h) Document Retention (i) Tracking and Trending Test Results (j) Integration of Tests Results into VA Models (9) COMPENSATORY MEASURES (a) Pre-defined Compensatory Measures (b) Ad-hoc Compensatory Measures (c) Removal of Compensatory Measures (d) Testing of Compensatory Measures

(10) MAINTENANCE (a) Corrective Maintenance (b) Preventative Maintenance (c) Performance Testing After Maintenance (11) REFERENCE Chapter 6: Program Reviews 1. Background. A standardized security risk assessment (SRA) and vulnerability assessment (VA) approach, incorporating program reviews, allows for an independent evaluation of a site’s SRA and VA processes prior to inclusion into site security docume... 2. REQUIREMENTS. Program reviews are conducted for new security analysis to ensure DOE/NNSA policy requirements are being addressed. Program reviews will be conducted in accordance with NNSA SD 470.4-1, Defense Nuclear Security Federal Oversight Proc... Note: Program reviews are not required during the early stages of line-item projects. They are, however, required starting at the critical decision 3 stage. For non-recurring campaigns and temporary conditions, the site Officially Designated Federal S... 3. SRA PROGRAM REVIEW PROCESS. An SRA program review will be conducted to ensure the intent of Department of Energy (DOE) Order 470.3C, Design Basis Threat Policy (DBT) or its successor (hereinafter referred to as DOE Threat Policy) and this Suppleme... The review will consist of a program review of completed SRAs to ensure they meet the structure and content of Chapter 3 and the intent of DOE Threat Policy. 4. VA PROGRAM REVIEW PROCESS. Three program reviews will be conducted to ensure the intent of DOE Threat Policy and this document’s requirements are being followed. a. Facility Characterization Review. This program review is conducted after assets have been identified, targets determined, the threat and threat objectives characterized, facility and protective force have been characterized, security layers and Fo... (1) Assets Identification and Target Determination. The following items will be reviewed to determine if the analysis is meeting order requirements and the intent of this document: (a) Are assets assigned to the appropriate PL? (b) Is there an approved scoping agreement? (c) Is there a Target Description Matrix that addresses all potential targets? (d) Were tools and processes used to assist with special nuclear material (SNM) target characterization and evaluation consistent with DOE policy and the SD implementation instructions? (e) Have all Category I target (including roll-up targets) been analyzed? (f) Is there documented analysis of how and why targets were bound? (g) Have temporary locations of SNM used during operations, material movements, or holding areas used during material shipments, been identified and evaluated? (h) Has intra-site transportation of SNM to and from this facility, as well as the in-processing of off-site shipments, been evaluated for potential theft or diversion opportunities? (i) Were tools and processes used to assist with biological, chemical, and radiological sabotage target characterization and evaluation consistent with DOE policy and the SD implementation instructions? (j) Are hazardous chemical and radiological release calculations based on an approved dispersion model or tool? (k) Is the risk for radiological, biological, and chemical sabotage targets documented, including justification for targets that were not evaluated? (l) Has the intra-site transportation of radiological material to and from this facility as well as the receipt and unloading of off-site shipments been evaluated for potential radiological sabotage opportunities?

(2) Threat and Threat Objective Characterization. The following items will be reviewed to determine if the VA analysis is meeting order requirements and the intent of this document’s requirements: (a) Has a Threat and Threat Objective Matrix been developed for identified assets? (b) Has the full threat spectrum applicable to the site’s assets been identified? (c) Has the appropriate protection strategy been assigned to identify assets? (3) Facility Characterization. The following items will be reviewed to determine if the analysis is meeting order requirements and the intent of the SD implementation instructions related to facility characterization: (a) Are the site processes and tools used to characterize the facility consist with DOE policy and the SD implementation instructions? (b) Does the site verify assumptions used in the VA for facility characterization, material control and accountability (MC&A), operations, and physical systems? (c) Are results from MC&A performance tests used in facility characterization as outlined in the SD implementation instructions? (d) Are results from system operability and effectiveness tests used in facility characterization as outlined in the SD implementation instructions? (e) Is operability and false and nuisance alarm data used to determine system performance values as described in the SD implementation instructions? (f) Have security layers been determined as described in the SD implementation instructions? (g) Are FoMs determined and documented in a manner consistent with that identified in the SD implementation instructions? (h) Have delay times been developed consistent with the manner identified in these instructions? (i) Has blast analysis been completed to evaluate impacts to the protective force and buildings? (4) Protective Force Characterization. The following items will be reviewed related to protective force characterization to determine if the analysis is meeting order requirements and the intent of the SD implementation instructions: (a) Has alarm assessments and communication time (AACTs) and response force times (RFTs) been developed, documented, and incorporated in VA models? (b) Has Enterprise Mission Essential Task List (EMETL) been incorporated into the VA analysts PF characterization routine as identified in the SD implementation instructions? (c) Has the site begun the development of a protection program planning checklist for each Category I facility? (5) Insider Analysis. The following items will be reviewed to determine if the analysis is meeting order requirements and the intent of the SD implementation instructions for conducting an insider analysis: (a) Have all potential insiders been identified and analyzed? (b) Has cyber access for insiders been evaluated to determine the ability to control, manipulate, or turn off alarms or control systems? (c) Has an insider information matrix been developed that captures the level of knowledge in each insider category to assist with scenario development? (d) Has the site’s colluding insider analysis been completed to a point to support SDRT scenario development? (e) Has performance testing begun to support insider assumptions and determine FoMs?

b. Scenario Development Review. The scenario development review process is designed to lead to consensus peer approval of the scenarios and to support more consistent modeling, performance testing, and analysis results. The Scenario Development Revi... (1) SDRT Request. SDRTs will be requested through the field office to DNS. (2) Scenarios. Scenarios will be developed in a manner to ensure they are a realistic representation of the adversary capabilities defined in the DOE Threat Policy for the specific target(s) located at the site. They will include the full range of a... (3) Sites Responsibilities. The role of the site is to: (a) Participate with the program office (NA-70) in the selection of dates for an SDRT technical review. (b) Develop an agenda for the completion of an SDRT. (c) Provide requested documentation prior to the SDRT site visit. (d) Hosting the SDRT (preparation, logistics, and support during the visit). (e) Conduct a scenario briefing at the beginning of an SDRT technical review and providing additional information as needed by the team. A briefing template and list of information required by the SDRT is provided below. (4) E-SSAP Program Manager Responsibilities. The role of the E-SSAP Program Manager is to: (a) Work with the requesting site to finalize SDRT dates. (b) Request support for the SDRT from AU, NNSA, and other DOE program offices sites as necessary. Requests for support will be channeled through local field offices. (5) Site Scenario Briefing Requirements: (a) An overview of the operation and layout of the site. (b) A description of the nature of the assets at the site along with the target category and threat assigned from the DOE Threat Policy. (c) Application of the insider. (d) A description of the adversary capabilities list considered by the site when developing baseline scenarios including which capabilities were selected and the rationale for any capabilities not selected. (e) A description of how each element of the baseline capabilities matrix was used or considered when developing baseline scenarios. (f) A description of how variables (tactics, paths, etc.) in DOE Threat Policy were considered and applied as appropriate in developing baseline scenarios. (g) A matrix displaying how adversary capabilities were distributed among the baseline scenarios. (h) A matrix displaying how the scenarios scored. (i) A description of which targets were selected and how they were bounded to account for different target configurations, locations, and facility states. (j) A description of the rationale used to determine the number of baseline scenarios based on the specific nature of the site. (k) A detailed description of each of the baseline scenarios including, for example, facility state, target configuration, insider, adversary objectives and tactics, adversary plans, adversary equipment, etc. (l) A description of the proposed methodology the site plans to use to analyze the baseline scenarios. (m) A description of how the site used the above baseline capabilities matrix and developed a range of above baseline scenarios. (n) A detailed description of each of the above baseline scenarios. (o) A detailed description of other threat scenarios used in the analysis.

(6) SDRT Conduct. The SDRT technical review will consist of activities by team members in all or some of the following areas to acquire the information needed to develop their conclusions and recommendations as described in this document. These acti... (a) Facility tour. (b) Site scenario development briefings. (c) Discussions with appropriate site SMEs. (d) Based on the information gathered, the team will determine the adequacy and thoroughness of the processes and scenarios at the site and decide whether they concur that the processes sufficiently meet DOE Threat Policy. If issues are identified, t... (7) SDRT Evaluation Questions. The following items will be verified by the team during the conduct of the SDRT: (a) Was the scenario development process from the SD implementation instructions followed when developing scenarios? (b) Based on the nature of the assets for the project, was the appropriate protection level assigned, and were all potential threats and threat objectives evaluated? (c) Were all adversary capabilities considered when developing scenarios? (d) Were the following variables addressed in baseline scenarios? 1 Different tactics 2 Varying pathways 3 Applicable threat objectives 4 Differing operating conditions 5 Open source information 6 A range of adversary capabilities 7 The role of the insider (e) Were the adversary capabilities distributed among the baseline scenarios? (f) Were targets bounded appropriately to account for different targets and facility states? (g) Were sufficient baseline scenarios selected? (h) Did the scenarios selected meet the intent of DOE Threat Policy? (8) SDRT Report. After completion of the SDRT, the program office (NA-70) will prepare a report summarizing the objectives of the SDRT technical review, conclusions, and any recommendations. Completion of this report and addressing recommendations o... c. Vulnerability Assessment Report Program Review. The final review is conducted after PE has been determined and includes a review of the VAR, SRAs, and PAP supporting an SSP for a PL-1 though PL-4 designated facility. Included in this review is th... (1) Protection System Effectiveness. The following items will be reviewed to determine if the analysis is meeting order requirements and the intent of the SD implementation instructions: (a) Are the scenarios used to determine PE SDRT approved and consistent with the current protection strategy at the site? (b) Was PE for computer simulations determined using layered probability of detection (PD) and layered probability of neutralization (PN)? (c) Was there a quality assurance process used to validate computer simulation results? (d) Did the determination of PE incorporate computer simulations, performance testing, or tabletop exercises? (e) Did the reporting of PE follow the format provided in the SD implementation instructions? (f) Did the structure of the VAR follow the format from the SD implementation instructions? Attachment 1: Default Performance Values 1. purpose. The purpose of this attachment is to provide security system performance default values to be used when performance testing data is not available. 2. REQUIREMENTS. The tables provided in this attachment must be used when conducting vulnerability assessments (VAs) when performance testing has not been completed. Performance testing must be conducted to validate default values used in the initia... 3. PROCESS. This section contains default performance values to be used in the VA process when performance testing data does not yet exist.

Attachment 2: Vulnerability Assessment Tabletop Protocol 1. purpose. This attachment provides principles and processes for conducting tabletop exercises to determine probability of neutralization (PN) and protection system effectiveness (PE) as described in Chapter 2. The tabletop analysis is a management... 2. Background. A tabletop analysis is a relatively quick, high-level simulation method that can be used to conduct an assessment of the effectiveness of physical security systems against a specific scenario or set of scenarios. It is used extensivel... 3. REQUIREMENTS. The process outlined in this attachment must be used when conducting a tabletop to support PN and PE determination described in Chapter 2. This attachment does not apply to conducting security risk assessments in Chapter 3. 4. PROCESS. This tabletop process relies heavily on subjective inputs regarding performance of security systems, actions of both adversary and protective forces, and reactions of forces based on situational awareness. The method is a structured, cos... a. Objectives of a Tabletop Exercise. The primary tabletop objective is to evaluate a site’s ability to address a spectrum of site-specific threats. The tabletop runs scenarios designed to fully understand the strengths and weaknesses of the physica... b. Tabletop Roles. Tabletop exercises are conducted using subject matter experts arranged in teams, thereby providing a broad-based perspective of the exercise. The teams and their associated roles and responsibilities are listed below. (1) Tabletop Facilitator. The Tabletop Facilitator is responsible for the preparation and conduct of the tabletops. Prior to the tabletop simulations, the Tabletop Facilitator ensures the appropriate equipment is in place, appropriate personnel have... (2) Blue Team. The Blue Team consists of site federal and contractor security representatives, including PF personnel, who are responsible for the overall security of the facility being analyzed. The Blue Team can also consist of site facility repre... The Blue Team is responsible for establishing initial positions of each PF element based on site data and for managing all PF actions and reactions throughout the simulation. (3) Red Team. The Red Team consists of scenario planners and subject matter experts in small unit combat planning and attack execution groups using unconventional warfare tactics. The Red Team is responsible for developing specific attack plans base... (4) Green Team. The Green Team consists of experienced NNSA security professionals with appropriate expertise in the conduct of vulnerability assessments, physical security systems, and PF operations. The Green Team acts as the referees or honest br... (5) Management Team. The Management Team consists of personnel representing the program office (NA-70), field office management, and senior contractor management. Their primary role is to provide overall process direction and oversight of the conduc... (6) Administrative Support Team. The Administrative Support Team is responsible for managing the equipment needed to conduct the exercise, recording the actions of each simulation for after action review and historical archiving, capturing significan...

c. Tabletop Planning. Prior to the conduct of the tabletops at a site, representatives of the applicable organizations will work with the site to develop a set of DOE Threat Policy compliant representative scenarios. The Red Team then builds attack ... d. Tabletop Equipment List. This section lists the equipment necessary to conduct the tabletop simulations. (1) Classified Meeting Room. A main room, approved for classified meetings, will be selected that is large enough for all the teams as well as any anticipated observers. A smaller room is required to sequester members of the Red or Blue Teams during... (2) Maps or Sand Table. In order to facilitate the tabletop, a method of displaying the site and movements of Blue and Red Team entities is needed. Computer generated displays may be used for this purpose, a sand table, or one or more large topograp... (3) White Board. A large dry erase white board or presentation size pad of paper on an easel will be available for use by the facilitator to record important events or details during each simulation. (4) Dry Erase Markers and Game Pieces. Dry erase markers and game pieces are used to identify locations of Red and Blue Team entities during the simulations. These entities may include aircraft, vehicles, fighting positions, and personnel. (5) Measurement Device. A device built to the scale of the map or sand table will be used to quickly measure distances. Any calibrated device is acceptable. (6) Probability of Hit/Probability of Kill (PH/PK) Tool. A method of determining the outcome of engagements between forces is needed to facilitate the tabletop. One method is to allow members from the Red and Blue Teams to make a determination based... (7) Tabletop Recording. A method should be used to record the timeline and significant events during each scenario. A computerized tabletop recorder may be used for this purpose and to playback simulations as needed for after action reviews. The ta... e. Tabletop Conduct. (1) The tabletops will be structured to allow the Red and Blue Teams to interact with a prepared scenario on the site’s terrain. The Tabletop Facilitator, whose responsibility is to ensure a smooth and accurate depiction of the scenario as it is carr... (2) The Tabletop Facilitator begins each simulation by asking the Blue Team to leave the tabletop area and having the Red Team brief the attack scenario to the White Team, Green Team, and any other personnel present to observe the tabletop exercise. ... (3) The Facilitator starts the simulation by examining the first events of the attack based on input from the Red Team (either based on elapsed time, such as 10, 20, or 30 second increments, or based on significant events as appropriate). The Tableto... (4) The Administrative Support Team will annotate all individual and vehicle movements, potential engagements, and other stated intentions on the white board for both teams. Once actions of both the Red and Blue Team entities are appropriately captur... (5) The Facilitator briefly recaps the results of the actions and engagements of the previous time slice to the Red and Blue Teams, describing what each entity would have seen, heard, or experienced during this phase of the simulation. The process st... (6) During the simulation, as the Red Team crosses security layers or is engaged in the process of moving between security layers, the Green Team will be responsible for estimating effectiveness of key elements of the protection system and recording t...

f. Basic Rules. (1) Entity Movement/Obstacles/Barriers. (a) Tables 3, 4, and 5 contain various tables to assist in the movement of personnel and vehicles regarding time and distance traveled. (b) Breaching of obstacles or barriers will replicate the task times identified in the Sandia Access Delay Manual or be based on formal site-specific performance testing data. Based on the purpose of the tabletop exercise, the delay times will be coo... (2) Engagements. If there are any engagements, the outcome is determined based on the selected method. The outcome should consider: (a) Engagement Feasibility – based on line of sight and range of shooter’s weapon. (b) Appropriate Shooter and Target Characteristics – type of weapon and munitions, stationary or moving, head or flank, range, etc. (3) Alarm Activation. The Tabletop Facilitator will announce whenever an entity triggers activation of an alarm sensor. The delay time for the Blue Team to react to the alarm activation must be based on the site’s calculation of alarm assessment and... (4) Special Weapons / Equipment. (a) Smoke grenades do not become effective until 20 seconds from deployment. The dissipation of the smoke plume is based on prevailing atmospheric data. (b) The use of explosive breaching charges requires all steps (placement, retreat, detonation, return, and clearing debris) be accounted for and associated task times and retreat distances are consistent with the adversary time line. (c) Mechanical and thermal breaching times will be consistent with the times delineated in the Sandia Access Delay Manual and as agreed to by the Facilitator, Management Team, and Green Team prior to the execution of the exercise. g. Tabletop Tools. (1) Effectiveness Rating Process. (a) The Effectiveness Rating Tabletop Matrix (Table 1) and Effectiveness Rating Scale (Table 2) is the method used by the Green Team to estimate the relative effectiveness of the performance of the site’s protection strategy during the simulation. Th... (b) At each of these events, the Green Team estimates the effectiveness of the site’s ability to sense, assess, interrupt, and neutralize the adversary at that particular level. As the table is filled out, a relative indication of site effectiveness ... 1 At each layer or significant adversary event, the Green Team will use the criteria in Table 2 to estimate important parameters based on the provided criteria. 2 The values are entered into the Effectiveness Rating Tabletop Matrix and results tabulated. To tabulate, the lowest probability of interruption (PI) or PN value in each row is copied to the layer score column. 3 When the table is completed, the highest value in the Layer Score column is carried down to the Estimated PE cell. (c) The tables are also used to record the total number of Red and Blue Team entities in each engagement and total numbers of casualties for each side. The adversary time to traverse through a protection layer at the site is recorded and added to ind... (2) PH/PK Adjudication. A number of methods may be used to adjudicate the outcome of engagements during a tabletop. These can range from subject matter expertise to simple lookup tables to databases based on weapons test data to generate PH/PK table... (3) Timeline Recorder. A number of methods may be used to record the outcome of events during the tabletop. NNSA will continue to evaluate ways to make tabletop recording easier.

h. After Action Review. At the conclusion of each simulation, the Facilitator leads an after-action review of the scenario, discussing relative strengths and weaknesses of the physical security system, and procedural improvements to the process. The... Attachment 3: Acronyms A/COH: Alarms per CAS/SAS Operator Hour AACT: Alarm Assessment and Communication Time ACL: Adversary Capabilities List AEGL: Acute Exposure Guideline Level AMSS: Assistant Manager Safeguards and Security ARS: Acute Radiation Syndrome BSL: Biosafety Levels CCTV: Close Circuit Television CDNS: Chief, Defense Nuclear Security CDP: Critical Detection Point CFATS: Chemical Facility Anti-Terrorism Standards COMPASS: Comprehensive Assessment of Safeguards Strategies CRD: Contractor Requirements Document CSO: Chief Security Officer DNS: Defense Nuclear Security DOE: Department of Energy DOT: Department of Transportation EA: Enterprise Assessments EMETL: Enterprise Mission Essential Task List EPHA: Emergency Planning Hazards Assessment ERPG: Emergency Response Planning Guidelines E-SSPAP: Enterprise Safeguards and Security Planning and Analysis Program FoF: Force-on-Force FoM: Figure of Merit FS-20. Field Security 20 FYNSP: Future-Years Nuclear Security Programming GASSM: Graded Adversary Scenario Scoring Matrix HRP: Human Reliability Program HSPD: Homeland Security Presidential Directive IAEA: International Atomic Energy Agency IND: Improvised Nuclear Device LA: Limited Area LLNL: Lawrence Livermore National Laboratory MAA: Material Access Area MC&A: Material Control and Accountability M&O: Management & Operating MRRC: Material Risk Review Committee NNSA: National Nuclear Security Administration NSE: Nuclear Security Enterprise NSTCA: Nuclear Security Threat Capabilities Assessment ODFSA: Officially Designated Federal Security Authority ODSA: Officially Designated Security Authority OUO: Official Use Only PA: Protected Area PAP: Performance Assurance Program PAC: Protection Action Level PD: Probability of Detection PDP: Practical Detection Point Pe: Protection System Effectiveness PF: Protective Force PI: Probability of Interruption PL: Protection Level PN: Probability of Neutralization PPA: Property Protection Area PPD: Presidential Policy Directive PPS: Physical Protection System PS: Probability of Sensing RFT: Response Force Time SAP: Special Access Program S&S: Safeguards and Security SCIF: Sensitive Compartmented Information Facility SD: Supplemental Directive SDRT: Scenario Development Review Team SECON: Security Condition SIRP: Security Incident Response Plan SME: Subject Matter Expert SP: Security Plan SRA: Security Risk Assessment SSP: Site Security Plan TEEL: Temporary Emergency Exposure Limit TR: Time Remaining UCNI: Unclassified Controlled Nuclear Information VA: Vulnerability Assessment VAR: Vulnerability Assessment Report VBIED: Vehicle Borne Improvised Explosive Device VTR: Vault Type Room

Attachment 4: Definitions Acceptance Test. A series of tests on newly installed systems to validate they are operating as designed. Test series include operability, function, and effectiveness tests. Adversarial Test. A test designed to defeat a security system using DOE Threat Policy adversary objectives and criteria. The test must account for and include the entire set of tools or equipment necessary to complete the adversary mission objective... Alarm Assessment and Communication Time (AACT). The time it takes the alarm station or protective force member to assess and communicate an alarm. AACT is separate from the time it takes the protective force to respond to an alarm. AACT is calculat... Asset. A general term for any Departmental resource or property that requires protection from malevolent acts. It includes, but is not limited to, federal and contractor personnel; classified information or matter; sensitive compartmented informatio... Bounded Targets. Targets that have been grouped into a single target for analysis purposes based on similarities in characterization of the targets, facilities, and physical protection systems. Compensatory Measure. An immediate action taken to temporarily replicate or otherwise augment the security system to account for a non-functioning essential element. Credible Pathway. An adversary pathway developed using threat types and capabilities from DOE Threat Policy. Effectiveness of the protection system is not a criterion in determining a credible pathway. Credible Scenario. A scenario that accurately reflects the capabilities of the defined adversary without consideration of the adversaries’ chance of success. A credible scenario must be based on the approved threat policy and is judged credible by t... Critical Detection Point (CDP). The point in the security system where the adversary’s remaining task time exceeds the protective force response time. The CDP is expressed on the path element where there is a chance of detecting the adversary along ... Defense Nuclear Security Program Review. An NA-71 led program review of site VA deliverables. The program review team makeup is similar to that of the Scenario Development Review Team with the exception of AU-52 being required. NA-71 is responsible... Delay Time. The time required to accomplish a task such as breach an obstacle, mount or dismount a vehicle, or cross an area. To the extent possible, delay times should be based on empirical data. Delay times can be represented as a point estimate,... Delayed Assessment. Assessment that, in approximately equal measures, may or may not accurately determine the cause of an event. Effectiveness Test. A test to confirm the ability of an implemented and operating essential element or total system to meet an established requirement of protection against an adversary defined by DOE policy or vulnerability assessment figure-of-meri... Essential Element. A component of a larger system which directly affects the ability of the system to perform a required function. Essential elements may include safeguards and security equipment, procedures, or people. Figure of Merit. A numerical point-estimate of performance expressed as a number from 0-1 with 0 representing an event that will not occur and 1 representing a certain event. FS-20. Field Security 20. The budget and accounting code for NNSA field security operations.

Limited Notice Test. A test used to evaluate personnel performance or duties or security equipment without prior knowledge of the test being conducted using established requirements of protection against an adversary defined by DOE policy or vulnerab... Limited Scope Performance Test. Performance tests designed and conducted to realistically test any operation or procedure, verify performance or policy requirement, or verify possession of a requisite knowledge or skill to perform a specific task. Modeling & Simulation. The process of obtaining information about how a system will behave without physical testing for the purposes of developing data as a basis for making managerial or technical decisions. Non-Essential Element. Safeguards and security protection elements that contribute to aspects of security system effectiveness but are not essential for reasons such as providing secondary detection or delay or are part of a system that has redundant... Operability Testing. This is a confirmation performance test to confirm that a security component or total system is operating as required and can effectively perform a specified function. Performance Assurance Program Plan. A site developed plan that documents the processes used to ensure protection elements of a facility/site protection program are functioning as designed in accordance with the overall protection goals established by... Practical Detection Point. The detection point along a pathway where the adversary is most likely to be detected. Practical detection points are scenario dependent. Probability of Assessment (PA). A figure-of-merit representing the likelihood that an alarm station operator or protective force member will correctly identify a sensing event with the correct stimulation. Probability of Detection (PD). A figure-of-merit representing the likelihood that an alarm event will be correctly associated with a triggering event. PD is the product of PS and PA. Probability of Interruption (PI). A figure-of-merit representing the likelihood that the system will detect an attempted malevolent act in a timely manner that initiates a protective response to interrupt an adversary. PI is PD if detection is timely. Probability of Neutralization (PN). A numeric estimate representing the probability the protective force can prevent an adversary from completing their objective(s) based on protective force success criteria derived from the results of computer model... Probability of Sensing (PS). A figure-of-merit representing the likelihood that a sensor will annunciate given the correct stimulation and not annunciate given the incorrect stimulation. Programmatic Mission Critical. Activities that must occur for a program to be able to meet its objectives. Activities are determined by coordination between NA-10/NA-70. Programmatic Essential Element. Safeguards and Security program level essential elements that apply across all facilities and operations with Safeguards and Security interests. Examples include programs such as Operations Security (OPSEC), Informati... Protection Level. The hierarchy of security assets as defined by the Department of Energy. Protection System Effectiveness (PE). A numeric estimate of the security system’s ability to achieve a desired effect. PE is dependent on PD, PI, and PN. Response Force Time (RFT). The time it takes the protective force to respond to a predetermined location and to prepare to initiate interruption of the adversary. RFTs can be scenario, facility, or site-specific depending on how the protective force... Scenario Development Review Team (SDRT). A program review led by NA-71 consisting of program representatives, AU-52 representatives, and subject matter experts as determined by NA-71. The program office (NA-70) is responsible for reviewing, approvin... Security Plan (SP). A site-developed plan that documents how, when, and where security is performed and integrated into operations at a facility. The SP is based on the results of the security risk asse