May 4, 2012
Issued to URS CH2M Oak Ridge, LLC, related to a Security Incident involving the Protection and Control of Classified Information at the East Tennessee Technology Park
The Office of Health, Safety and Security's Office of Enforcement and Oversight has completed its evaluation of a security incident involving the protection and control of classified information at the East Tennessee Teclmology Park (ETTP) (Local Tracking System Report No. II-IOSC-0576-13). Based on this evaluation, the Department of Energy (DOE) identified concerns that warrant management attention by URS CH2M Oak Ridge, LLC (UCOR), the responsible contractor for ETTP.
The specific concerns stem from the number of classified components that were found to be inadequately protected and controlled, as required by DOE O 471.6, Information Security (effective June 20, 2011) and the UCOR security plan, dated May 17, 2011. According to the final inquiry report, these noncompliant conditions existed for several weeks before UCOR project management reported the deficiencies to the UCOR security organization. UCOR's slow response to these known noncompliant conditions contributed to the potential for uncleared workers to gain unauthorized access to classified information. Furthermore, DOE finds that the associated corrective actions do not appear to address each of the underlying causes or identify an engineered solution, and may not be effective in preventing recurrence.