Los Alamos National Laboratory: Long-Term Strategies Needed to Improve Security and Management Oversight
GAO-08-694
Published: Jun 13, 2008. Publicly Released: Jul 15, 2008.
Skip to Highlights
Highlights
In 2006, a Los Alamos National Laboratory (LANL) contract employee unlawfully removed classified information from the laboratory. This was the latest in a series of high-profile security incidents at LANL spanning almost a decade. LANL conducts research on nuclear weapons and other national security areas for the National Nuclear Security Administration (NNSA). GAO was asked to (1) identify LANL's major programs and activities and how much they rely on classified resources; (2) identify initiatives LANL is taking to reduce and consolidate its classified resources and physical footprint and the extent to which these initiatives address earlier security concerns; and (3) determine whether its new management approaches will sustain security improvements over the long-term. To carry out its work, GAO analyzed LANL data; reviewed policies, plans, and budgets; and interviewed officials.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Energy | To improve security at Los Alamos National Laboratory, the Secretary of Energy and the Administrator of NNSA should require LANL to develop a comprehensive strategic plan for laboratory security that (1) addresses all previously identified security weaknesses, (2) contains specific and objective measures for developing and implementing solutions that address previously identified security weaknesses and against which performance can be evaluated, (3) takes an integrated view of physical and cyber security, (4) focuses on improving security program effectiveness, and (5) provides for periodic review and assessment of the strategic plan to ensure LANL identifies any additional security risks and addresses them. |
Closed – Implemented
Los Alamos National Laboratory (LANL) developed and issued a comprehensive strategic plan for laboratory security in September 2008. GAO's report discussed several previously identified security problems that, at the time of our report, had not been addressed by LANL or had resurfaced as challenges. All of these previously identified security problems are addressed in LANL's strategic plan for laboratory security. The plan also includes targets, measures, and schedules for addressing these security challenges. The plan itself flows from National Nuclear Security Administration (NNSA) strategic planning guidance to reduce both cyber and physical security vulnerabilities and focuses on security program effectiveness by integrating security evaluation efforts such as self-assessment, security improvement task forces, and security compliance reviews with subject matter experts across multiple security functions. The strategic plan is effective for FY 2009 through FY 2014, and LANL reviews and revises the plan annually to ensure it is responsive to the laboratory's changing security environment. In addition, the Los Alamos Site Office and LANL provide NNSA's Office of Defense Nuclear Security with a quarterly Safeguards and Security Management Systems Assurance Report that tracks security performance and provides status updates on initiatives.
|
| National Nuclear Security Administration | To improve security at Los Alamos National Laboratory, the Secretary of Energy and the Administrator of NNSA should require LANL to develop a comprehensive strategic plan for laboratory security that (1) addresses all previously identified security weaknesses, (2) contains specific and objective measures for developing and implementing solutions that address previously identified security weaknesses and against which performance can be evaluated, (3) takes an integrated view of physical and cyber security, (4) focuses on improving security program effectiveness, and (5) provides for periodic review and assessment of the strategic plan to ensure LANL identifies any additional security risks and addresses them. |
Closed – Implemented
Los Alamos National Laboratory (LANL) developed and issued a comprehensive strategic plan for laboratory security in September 2008. GAO's report discussed several previously identified security problems that, at the time of our report, had not been addressed by LANL or had resurfaced as challenges. All of these previously identified security problems are addressed in LANL's strategic plan for laboratory security. The plan also includes targets, measures, and schedules for addressing these security challenges. The plan itself flows from National Nuclear Security Administration (NNSA) strategic planning guidance to reduce both cyber and physical security vulnerabilities and focuses on security program effectiveness by integrating security evaluation efforts such as self-assessment, security improvement task forces, and security compliance reviews with subject matter experts across multiple security functions. The strategic plan is effective for FY 2009 through FY 2014, and LANL reviews and revises the plan annually to ensure it is responsive to the laboratory's changing security environment. In addition, the Los Alamos Site Office and LANL provide NNSA's Office of Defense Nuclear Security with a quarterly Safeguards and Security Management Systems Assurance Report that tracks security performance and provides status updates on initiatives.
|
| National Nuclear Security Administration | To ensure sustained improvement of LANL's security program, the Administrator of NNSA should provide meaningful financial incentives in future performance evaluation plans for implementation of this comprehensive strategic plan for laboratory security. |
Closed – Implemented
We evaluated NNSA's performance evaluation plans for LANL for fiscal years 2010 and 2011 and found that these plans included meaningful financial incentives for future security performance at the laboratory. In addition, performance evaluation plans incentivized security challenges included in LANL's strategic plan for security that GAO identified as needing to be addressed, such as improved self assessment, executing an effective security program, and improving the control and accountability system for special nuclear material.
|
| National Nuclear Security Administration | To enhance security initiatives already under way at LANL, the NNSA should require that future laboratory plans for footprint reduction include specific criteria for evaluating facilities' security risks when making initial selections of facilities for footprint reduction. |
Closed – Implemented
In June 2009, NNSA issued its FY 2010 Defense Nuclear Security Program Execution Guidance (PEG) to sites, including LANL, for their use in developing annual operating plans. The PEG links NNSA security requirements and resources to performance expectations for sites. The PEG provides a specific performance objective for reducing the security footprint of sites in order to manage risk to address the spectrum of security threats, such as reduction in classified matter. These performance objectives have been carried forward and updated in PEGs through FY 2012.
|
Full Report
Office of Public Affairs
Topics
Agency missionsClassified informationCyber securityData collectionData destructionFacility securityInformation securityInformation security managementInternal controlsMission essential operationsPerformance measuresPhysical securityPolicy evaluationProgram evaluationProgram managementRisk assessmentRisk managementSecurity assessmentsSecurity policiesSecurity regulationsSecurity threatsStrategic planningWeapons research and developmentCorrective actionProgram goals or objectivesProgram implementation