Draft Scope of Service.pdf

**DRAFT SUPPORT SCOPE FOR OFFICE OF ENTERPRISE ASSESSMENTS***

Ref. 89303024REA000008

INTRODUCTION/BACKGROUND

The US Department of Energy’s (DOE) Office of Enterprise Assessments (EA) supports the President’s and Secretary of Energy’s priorities for maintaining a safe, secure and effective nuclear deterrent and reducing the threat of nuclear proliferation, overseeing the United States’ energy supply, carrying out the environmental clean-up from the Cold War nuclear mission.

DOE is responsible for the safe and secure operation of 105 active sites, 91 legacy management sites, 13 active nuclear research reactors, four primary nuclear production facilities and one nuclear test site. EA conducts onsite assessments of safeguards and security; cybersecurity;

emergency management; environmental and nuclear safety; worker safety and health; and other critical functions across the Department. Independent oversight and assessment activities are performed to help DOE line management accomplish their mission responsibilities effectively and efficiently, with the highest regard for safety and security, and to determine whether programs are effectively implemented and achieving Department-wide and site-specific objectives. EA assessments provide compliance and performance feedback to the Secretary, Congress, and senior DOE managers. EA also provides the Secretary and senior DOE managers with a “rapid response” capability to perform special assessments in safeguards and security; cybersecurity; emergency management; environmental and nuclear safety; worker safety and health; and other critical functions. The “rapid response” function is used at management’s discretion to gather information about and evaluate any situation that requires senior management attention and response.

In addition, EA implements congressionally-authorized contractor enforcement programs, operates the DOE National Training Center (NTC), and maintains collaborative relationships within and outside the Department. Because EA reports directly to the Office of the Secretary, it is organizationally independent of the DOE entities that develop and implement security and safety policy and programs and can therefore provide a “check and balance” function by objectively: 1) observing and reporting on the performance of DOE Federal and contractor organizations’ implementation of security and safety policies and programs, 2) applying enforcement actions to contractor organizations for poor performance in adhering to legally enforceable security and safety requirements, and 3) developing and delivering security and safety training programs that reflect best practices and lessons learned from EA independent assessments to enhance workforce performance. EA activities complement, but do not replace the responsibility of DOE line management to ensure compliance with security and safety requirements.

To ensure it can perform its mission, EA also implements various support functions such as information management, operation of a communications center and classified document repository, maintenance and delivery of computer equipment for use during onsite assessments, maintenance and delivery of Engagement Simulation Systems (ESS) and various quality assurance functions. EA interfaces with senior DOE management and external organizations and maintains internal organizational support functions including strategic planning, business operations, human resources support, and resource management.

In order to successfully execute its mission, EA must maintain a broad spectrum of national-level subject matter expertise that reflects the diverse operations and missions of the Department and is capable of performing technically defensible independent assessments in the areas of safeguards and security; cybersecurity; emergency management; nuclear safety and environmental protection; and occupational safety and health.

• In the area of safeguards and security, EA evaluates the full spectrum of safeguards and security program disciplines in accordance with DOE Policy 470.1B, Safeguards and Security Policy. Providing stakeholders with key information on how the Department of Energy is meeting its obligations to protect Special Nuclear Material, other nuclear materials, classified matter, sensitive information, government property and facilities, and the safety and security of employees, contractors, and the public. As well as other assets delineated in the DOE’s Design Basis Threat order, e.g., radioactive materials, biological assets, toxic chemicals, protection of national critical infrastructure, and other unique DOE assets. Key safeguards, security program elements, and highly specialized technical areas include physical security systems, material control and accountability, personnel security, protective force, program planning and management, insider threat protection, and information security. EA also maintains and deploys a Composite Adversary Team that serves as highly skilled role players for selected performance tests of site security systems and complex force-on-force performance testing that uses engagement simulation systems.

• In the area of cybersecurity, the EA evaluates protection of classified and controlled unclassified information on computer systems and networks. Key cybersecurity elements include risk management, identification and implementation of technical controls, and penetration testing. The program includes continuous oversight of cybersecurity through an office dedicated to multi-faceted reviews including announced assessments, red teaming (a process for unannounced network penetration testing), assessments of the risk management framework implementation, assessment of the DOE high value assets, state of the art penetration testing capabilities, and the ongoing development of new assessment and technical methods to emulate the adversary that pose the greatest threats to DOE.

• In the area of emergency management, EA evaluates all aspects of emergency management programs, including emergency planning, preparation, capabilities, readiness assurance, operations, and response. Key emergency management elements include emergency planning hazards assessments, response procedures, training, exercises, and integrated performance tests.

• In the area of nuclear safety, EA evaluates all phases of the lifecycle of nuclear facilities including design, construction, operations, and decontamination and decommissioning. For high hazard nuclear design/construction projects key assessment areas include design, safety basis development, quality assurance, construction quality, start-up readiness and turnover.

For facilities in the operations, decontamination or decommissioning phase, EA assessments focus on implementation of the safety basis and nuclear safety management programs Environmental assessments are primarily focused on radioactive waste management and environmental radiation protection.

• In the area of worker safety and health, EA focuses on performance through evaluation of the effectiveness of work planning and control processes in the identification and analysis of hazards and application of controls to protect the health and safety or workers. EA also conducts periodic complex wide assessments of specific safety and health functional areas (i.e. radiation protection, construction safety, chronic beryllium prevention program, etc.) to provide insights on the health of worker safety management programs. EA also assesses performance of line management and contractor feedback and improvement processes for worker safety and health.

EA also implements the DOE safety and security enforcement program in accordance with applicable regulations (10 CFR 820 for nuclear safety, 10 CFR 824 for classified information security, and 10 CFR 851 for worker safety and health). Enforcement program activities include investigations, enforcement actions, regulatory assistance reviews, data analysis, and docketing functions.

Senior DOE management and external organizations rely on EA to be independent, provide unbiased information, and ensure defensible independent assessments and enforcement actions. Therefore, the integrity of the program is of paramount importance and EA must provide a high degree of assurance that its management, assessment, and investigation team members have no conflicts of interest that could adversely impact its independence.

Further information on EA may be found at:

https://energy.gov/ea/office-enterprise-assessments

SCOPE

The Contractor shall provide personnel, equipment, facilities, materials, and technical expertise as necessary to support EA in performing the full scope of its mission. This support includes the independent oversight program, the enforcement program and the training programs. Technical expertise will be required in the areas of safeguards and security;

cybersecurity; emergency management; nuclear safety, environmental (radiological) protection, and worker safety, and health; as well as general and cross-cutting support to EA.

As required, the Contractor shall provide procedures and system support, meeting facilities, assistance in preparation of presentations, editing, graphics, reproduction services, locations with facilities approved for classified processing by DOE, and other administrative support necessary to support the issuance of reports associated with all work under this contract.

https://energy.gov/ea/office-enterprise-assessments

The Contractor shall assist with the planning and design of assessments and performance tests throughout DOE. Technical expertise will be required in functional areas such as emergency preparedness and response; nuclear safety, safety basis, high-hazard nuclear facility design and construction; environment, safety, and health; integrated safety management; counter terrorism; engineering; and a variety of management, operational, and technical systems analyses. Technical expertise shall also be required in topical areas such as Safeguards and Security Program planning and management; physical security systems; protective force;

material control and accountability; and information security. In addition, technical expertise shall be required for cybersecurity; threat identification and analysis; adversary tactics, techniques, and procedure development; risk and cybersecurity program implementation and management; and IT system design, authorization, and monitoring.

The Contractor shall participate with Federal government representatives as members of assessment teams and shall participate in the scoping, planning, conduct, analysis, and report writing phases of those activities. The Contractor shall provide word processing, logistical, editorial, and technical writing support for review and assessment processes; some of these activities will entail working with classified information in accordance with applicable DOE and site requirements.

Assessments may include multiple week efforts to determine the status of safeguards and security; cybersecurity; nuclear safety; worker safety and health; emergency management;

and/or environmental policies and programs and the effectiveness of line program and site contractor performance. These activities may address the full range of DOE federal and contractor organizational levels, systems, and programs or may focus on one or more specific topics or areas of concern. Investigations are typically performed in response to accidents, major events, significant or recurring non-compliances, or other indicators of performance issues in the areas of safety and security. Various other mission support activities or assessments may be conducted to support DOE line management in achieving DOE mission objectives; such reviews could be specifically tailored to follow-up on implementation of previously identified weaknesses or in accordance with senior DOE management direction.

DOE-wide reviews, investigations, and assessments may be multiple month efforts that determine the effectiveness of line and support programs related to specific aspects of safeguards and security; cybersecurity; emergency management; and environment, safety, and health operations. A series of focused assessments may be conducted at several sites to determine individual performance weaknesses and generic Departmental issues. Special emphasis is placed on DOE policies, programs, and implementation at the Headquarters program level and performance of the Department in total.

The contractor shall install, maintain, secure, authorize, and monitor government furnished computer systems for certain assessment activities; maintain and deploy engagement simulation systems; and provide support for document/communication centers. DOE may require the Contractor to apply its expertise in safeguards and security; cybersecurity;

emergency management; and environment, safety, and health to support other EA functions, such as training development or delivery and enforcement investigations.