Attachment_J-7_Non-possessing_Security_Plan_Section_.doc

Non-Possessing Security Plan

This plan summarizes the safeguards and security responsibilities of:

with its principal office and place of business at:

doing business covered by this plan at the following location:

The provisions of our contract with the Department of Energy (DOE) and/or with a DOE contractor do not authorize our company to receive, store, transmit, or originate classified information within our facility(ies). However, performance of work under this contract will require at least some of our personnel to hold DOE access authorizations for access to classified information and/or special nuclear material (SNM) at other approved DOE facilities. We understand that our company is responsible for ensuring that all personnel involved in this contract — including company managers, employees, and direct consultants, as well as any lower-tier subcontractors whose employees require DOE access authorizations — comply with all applicable DOE security requirements, including the following:

Security Training

DOE O 470.4B, CRD –Attachments 3 and 5

· Arrange for the Facility Security Officer (FSO) to complete training, as necessary, to implement the requirements of this plan, as well as other provisions in the underlying DOE directives.

· Identify other company and subcontractor personnel who assist the FSO in implementing this plan, and arrange training as necessary to ensure compliance with DOE requirements

· Ensure that individuals are trained to investigate and report Incidents of Security Concern.

· Ensure that all company and subcontractor personnel — regardless of clearance status — receive initial security briefings prior to being allowed unescorted access to any DOE security area(s) under the company’s control.

· Ensure that all cleared company and subcontractor personnel receive comprehensive security briefings and execute SF-312, Classified Information Nondisclosure Agreement, before receiving access to classified information.

· Ensure that all cleared company and subcontractor personnel receive annual security refresher briefings within the time frames prescribed by the DOE or prime contractor’s Security Awareness Coordinator.

· Ensure that cleared company and subcontractor personnel receive security termination briefings and complete DOE F 5631.29, Security Termination Statement, when their DOE access authorizations are terminated.

· Maintain records of initial, comprehensive, refresher, and termination security briefings in a manner that the dates on which company and subcontractor personnel received these briefings.

· Coordinate with RL Security and Emergency Services Division on applicable training that may be necessary.

Access Authorizations DOE O 472.2, 4.u. -Reporting Responsibilities and Requirements

· Obtain access authorizations as soon as possible for all Key Management Personnel (KMPs) identified in the Foreign Ownership, Control or Influence (FOCI) determination at the same level as the company’s facility clearance.

· Obtain other access authorizations only as required to perform work involving access to classified information and/or SNM, and only at the level required by each individual.

· Handle and submit access authorization requests and maintaining personal clearance-related documentation about individuals in accordance with the Privacy Act of 1974.

· Maintain current information about all active access authorizations, including each cleared individual’s name, DOE file number, date of clearance notification, and the classified contract(s) for which an access authorization is held.

· Ensure cleared individuals are aware of their responsibility to directly notify DOE of potentially relevant information — e.g., arrests, bankruptcies, garnishments, name changes, marriage/cohabitation, etc.

· Notify DOE within two working days after the company becomes aware of a cleared individual’s mental health treatment or any other condition that might cause a significant defect in judgment or reliability.

· Notify DOE through established channels as soon as possible — but no later than two working days— when an individual no longer requires an access authorization (e.g., termination of employment or transfer to unclassified work).

Physical Program Operations Security/ Security Badges

DOE O 473.3, Chapter XI, II

· Ensure that any visitor, temporary, and/or other local site-specific (LSSO) badges used by the company comply with DOE requirements, including restrictions relating to foreign nationals.

· Ensure that all individuals who receive a DOE security badge are aware of the requirement to report lost or stolen badges to the issuing Badge Office within 24 hours.

· Ensure employees are trained regarding prohibited and controlled articles.

Information Security

DOE O 471.6 – CRD

· Access to classified matter must be limited to persons who possess appropriate access authorization and who have a need to know.

· The originator of any matter that may be classified must ensure matter is reviewed for classification by a derivative classifier.

· Protection of Classified Matter – caveat – temporarily unattended classified matter process that the Order allows does not apply at RL.

Facility Clearance DOE O 470.4B, Attachment 3 - Section 1

· Ensure that any solicitations for lower-tier contracts or other agreements with other companies that require their personnel to obtain access authorizations contain the notice at DEAR 952.204.72, Facility Clearance.

· Submit a DOE F 470.1, Contract Security Classification Specification (CSCS), through appropriate channels and obtaining DOE approval before awarding a lower-tier agreement that requires access authorizations to another company.

· Ensure that any lower-tier agreements awarded to other companies that will require access authorizations contain the clauses at DEAR 952.204-2, Security, and DEAR 952.204-70, Classification/Declassification.

· Submit a CSCS form to DOE through appropriate channels if significant changes occur in a previously registered agreement — e.g., the extension of the contract end date or the termination of work requiring access authorizations.

FOCI

DOE O 470.4B, Attachment 3, Section 2

· Notify DOE immediately of any actual or anticipated changes in FOCI that might affect the company’s current FOCI status — e.g., a change from “No” to “Yes” in an item on SF-328, Certificate Pertaining to Foreign Interests.

· Provide annual certifications to DOE if no significant changes have occurred in the company’s ownership; its officers, directors, and executive personnel; or the information in the company’s last full FOCI certification.

Classification Guidance CRD O 475.2A, CRD-Attachment 6, Classification Education Program

· Ensure that any company personnel certified as Authorized Derivative Classifiers (ADCs) for work at other facilities receive all required training, including Classified Matter Protection and Control (CMPC) requirements.

· Ensure that any company personnel whose work involves generating matter at other facilities that might be classified receive CMPC training and are aware of the procedures for obtaining ADC reviews.

Incidents of Security Concern DOE O 470.4B, CRD – Attachment 5

· Ensure that all company personnel who are authorized access to classified information, sensitive unclassified information and/or SNM at other facilities are aware of the requirements and procedures for reporting security infractions or incidents.

· Establish an incident management program that provides for appropriate disciplinary measures if DOE determines that company personnel have committed security infractions or incidents.

Personally Identifiable Information (PII) CRD O 205.1B, DOE Cyber Security Program DOE O 206.1, DOE Privacy Program Appendix L, Rules of Behavior, in the Program Cyber Security Plan (PCSP), Rev 1.2 for unclassified systems Appendix B of the PCSP – for classified systems

· Ensure that actions are taken to address data breaches of PII that is collected, processed or maintained on paper records, stored and/or transmitted through DOE computer systems, and sensitive data owned by DOE that is properly stored on non-DOE computer systems.

· Ensure that data breaches that involve the suspected or conformed loss of PII are immediately reported the DOE

· Ensure employees complete the Annual Privacy Training and sign the completion certificate acknowledging their responsibility for maintaining and protecting Privacy Act information prior to being authorized access to all information systems.

· Ensure that employees receive training for the rules of behavior prior to accessing DOE systems.

Official Use Only (OUO)

DOE O 471.3, Admin Change 1

· Ensure that documents determined to contain OUO information are marked and protected as described in DOE O 471.3, Admin Change 1.

· Ensure that documents determined to no longer warrant protection as OUO have their markings removed.

· Ensure that access to (a) documents marked as containing OUO information or (b) OUO information from such documents is only provided to those persons who need to know the information to perform their jobs or other DOE-authorized activities.

Our company will develop internal procedures as needed to implement all applicable DOE security requirements and inform company and subcontractor personnel of their individual responsibilities for implementing these requirements. In addition, company and subcontractor personnel will comply with applicable security procedures at the sites where work involving classified information and/or SNM is performed.

Our company understands that, at least every five years, designated DOE representatives must inspect our facilities compliance with all applicable DOE safeguards and security requirements. Upon request, company personnel will provide DOE with documentation for these reviews. If DOE notifies our company in writing that its security procedures and/or practices do not comply with DOE security requirements, we will submit an appropriate corrective action plan to DOE within 30 working days and provide at least quarterly progress reports until DOE determines that all deficiencies are corrected.

CERTIFICATIONS

As the designated Facility Security Officer, I accept lead responsibility for ensuring company compliance with all applicable DOE security requirements, including those highlighted in this plan.

Typed Name

Signature

Telephone Number

Date

The undersigned management representative certifies that the Facility Security Officer has been given the authority, resources, and other management support needed to ensure company compliance with all applicable DOE security requirements. If a new Facility Officer is appointed, the company also agrees to immediately notify DOE and to execute a new Non-Possessing Plan.

Typed Name

Signature

Official Title

Date

April 4, 2012