EXHIBIT G SECURITY REQUIREMENTS

Educational Institution or Non-Profit Organization

Delegation of Authority / Responsibility to LANL RLM

Security Risk Checklist

P.R. / Subcontract #_____________________________

Educational / Non-Profit Org: _____________________

Worker’s Name_________________________________

LANS is responsible for security compliance associated with work performed on-site by workers from educational institutions or non-profit organizations. A LANL line manager (RLM) shall be responsible and accountable for security compliance requirements for all work activities performed on-site at LANL by the Subcontractor’s employees. The RLM shall be responsible for ensuring Subcontractor’s workers are properly briefed on all applicable LANS security compliance requirements; complete all required training; understand and follow all LANL rules, regulations, policies and procedures.

Section I: Applicability

The “Delegation of Authority / Responsibility to LANL RLM” Exhibit G shall be used when an educational institution or non-profit organization is performing unclassified research and development (R&D) work for LANL that will be conducted on-site at LANL.

If any of the following minimum work activities are associated with this subcontract in whole or part, then additional security requirements may be necessary.

involve unescorted access to LANL Limited Areas;

require Subcontractor employees to have access to the LANL site for 10 or more days during a 12 month period;

require Subcontractor employees to receive any LANL training;

involve access to Classified or LANL Controlled Unclassified Information;

require access to LANL networks or systems requiring authentication and Security controls; and/or

otherwise require work to be performed at LANL or utilize LANL networks.

Accordingly, a DSO/SPL must determine if a regular Exhibit G Physical Security is required; or if a modified Delegation of Authority/Responsibility form may be used.

Section II: Required Security Briefing

The LANL RLM shall work with the organization’s Security Program Lead or Deployed Security Officer to assess the project’s security risks. After risk determination is made by the SPL or DSO, risk mitigation shall be addressed through a security briefing.

Once risk identification is complete, the subcontract worker performing the work shall be briefed on all applicable security requirements pertaining to the scope of work invoking an Individual Security Plan (ISP), as well as any facility or location-specific security requirements, prior to the work beginning.

General Security

Fill in appropriate (unclassified) information:

LANL WORK SITE / TA:

# Days On-site (includes Town Site, Research Park & Leased Buildings)

Check appropriate boxes [Note: more than one box in each category may need to be checked]

ON-SITE WORK AREA DESIGNATION
General Access Area / Publically Accessible
Property Protection Area (PPA)
Limited Area (LA)
Protected Area (PA)
Material Access Area (MAA)
SCIF, SAPF, certified Vault or Vault Type Room

BADGE TYPE / CLEARANCE LEVEL
LANL Generic Uncleared US Visitor badge
LANL Generic Uncleared US Visitor Escort Required badge
LANL Uncleared Site-specific badge
LANL Uncleared Foreign National badge
LANL Cleared Foreign National badge
Uncleared DOE badge
L-Cleared DOE badge
Q-Cleared DOE badge

DATA CLASSIFICATION
Unclassified / Public Release
Unclassified
Controlled Unclassified Information (OUO, LPI, PII, ECI, AT, NNPI, RSI)
UCNI
Classified

Is an OPSEC Plan required? Yes No	If Yes, LANL Host will provide guidance on getting assistance for Plan development; and OPSEC Plan approval prior to work commencing.

Physical Security

Will escorting be needed? Yes No If Yes, designate/assign a properly trained LANS escort.

Will work be performed within a Security Area? Yes No If Yes, do workers have a need to work in a secure area to perform work for LANL and how will access be controlled?

Will work involve access to Enhanced Security Areas (e.g. Vault, Vault Type Room, SCIF, SAP)? Yes No If Yes, ensure the proper training has been completed.

Personnel Security

Is training required? Yes No	If Yes, the training marked below is applicable to the SOW and subcontract worker MUST complete prior to work beginning.

Required Course	Course Title	Frequency
General Security
General Employee Training (GET) - On site 10 or more days	Once
LANL Emergency Procedures and Protective Actions - All	12 months
Annual Security Refresher (ASR) – L & Q-cleared Workers	12 months
Comprehensive Security Briefing - L & Q-cleared Workers	Once
Export Control Fundamentals – Based on SOW	12 months
Substance Abuse Awareness – All	Once
Workplace Violence Awareness - All	Once
Cyber Information Security
Initial Information Security Briefing - All Computer Users	Once
Annual Information Security Refresher – All Computer users	12 months
Protecting Classified & Sensitive Information
Protecting UCNI - Users of Unclassified Controlled Nuclear Information (UCNI) – If access to UCNI will be required	Once
Physical Security
The Outsider – Vault or Vault Type Room Users	Once
Vault or Vault Type Room User – Vault or Vault Type Room Users	12 months
LANL Site-Specific Training (list as appropriate)

Will Subcontract worker receive a LANL Generic Badge? Yes No If Yes, this type of badge can only be used for short term visits (e.g. 1-2 days maximum)

Will Subcontract worker receive a badge from the LANL Badge Office? Yes No If Yes, worker is required to complete and pass a pre-badge drug test no more than 60 days prior to requesting the badge. Link to approved testing labs: http://www.samhsa.gov/workplace/resources/drug-testing/certified-lab-list

Will Subcontract require or do worker(s) hold an “L” or “Q” clearance? Yes No If Yes, in addition to pre-badge drug test, must complete an e-QIP & RLM must sign a DOE F 472.1C.

Will the Subcontract worker be a foreign national? Yes No If Yes, a request must be processed through FV&A Office & FVTS system prior to the worker coming on site or requesting a badge (allow at least 45 days)

Information Security

Will work activity involve Controlled Unclassified Information (OUO, LPI, PII, NNPI, ECI, AT) Yes No If Yes, ensure subcontract worker has a need to know and requires access to the information to perform the work for LANL. Access to ECI by non-Permanent Resident Alien foreign nationals is prohibited.

Will UCNI information be provided or generated? Yes No	If Yes, provide access only to a subcontract worker who has a need to know in performance of official duties for LANL. Brief worker on proper access, storage and destruction of UCNI.

Will any part of the activity involve Classified matter or material? Yes No If Yes, ensure proper training has been completed and a need-to-know before work begins. Brief worker on proper access, storage and destruction of Classified.

Cyber Security

Computer Access Type: None Stand-Alone Network Access

Type of Network Access: Green Turquoise Gray Yellow Red If Red, ensure proper training has been completed & need-to-know is established to perform work for LANL before work begins.

Type of Yellow Network Access: Local Remote Local HPC Remote HPC Remote users (who do not process mandatory protected information) must apply for remote access and receive approval from Cyber Security.

Will Subcontractor require a CRYPTOCARD? Yes No

Will personal (non-LANL) computers (including tablet computers) be brought in to LANL-owned or leased properties? Yes No If Yes, approval must be obtained (Form 1897) prior to introduction of the computer into any LANL space that is not designated as an Open Area or Property Protection Area.

Will Subcontract worker be a foreign national? Yes No	If Yes, a request must be processed through FV&A Office & FVTS system prior to the worker coming on site or requesting a CRYPTOCARD.

Controlled Articles & Wireless Technology

Will wireless communications be used? Yes No If Yes, determine the type & any associated restrictions / required approvals.

Will wireless networking be used? Yes No If Yes, approval must be obtained from the Cyber Information Security Office prior to work beginning.

Will work require the use of non-government Controlled PEDs in a Limited Area or connected to a LANL-owned system? Yes No If Yes, approval must be obtained from the Cyber Information Security Office prior to the introduction of any controlled article.

Will work require the use of non-government wireless technology? Yes No If Yes, ensure Bluetooth and devices with wireless networking protocol capability are disabled while in any PPA or higher security area.

Will Subcontractor use non-government wireless computing devices? Yes No	If Yes, approval from Cyber Security via (Form 1897) is required.

Section III: Individual Security Plan

Complete and brief an Individual Security Plan for each educational or non-profit worker whose proposed work activity involves any of the criteria listed under Section I.

Add supplementary security requirement information as needed to address risks identified in the scope of work and work location.

Worker shall receive a copy of the Plan as a reference to the security requirements.

Documentation of the security briefing shall be maintained in a manner that provides an audit trail that verifies an individual’s receipt of the briefing.

REQUIRED REVIEWS AND APPROVALS

Security Risk Identification

P.R. / Subcontract #: ____________________________

Educational / Non-Profit Org: _____________________

Worker’s Name: ________________________________

Submitted By:

Name of Requester / STR/AdSTR	Signature	Date

Reviewed By:

Name of DSO	or SPL	Signature	Date

Approved By:

Name of RLM	Signature	Date