SIMP Comp Security Briefing

1
Lessons Learned Contributing to Security
Awareness
Gene Marquez April 13, 2004
2
Value of Lessons Learned (LL)

• If we dont utilize what weve learned, then .

3
Value of Lessons Learned

Were no better off than Wylie Coyote!
4
Lessons Learned
Lessons Learned (LL) - Good work practices or
innovative approaches that are captured and are
shared to promote repeat application. Lessons
learned may also be adverse work practices or
experiences that are captured and shared to avoid
recurrence.
5
Lessons Learned
The Safeguards Security LL Program captures,
analyzes, and disseminates security-related LL
information. The intent of the program is to
 1.  Gather information from Line operations
and other sources.  2.  Add value to the
information by analyzing, organizing and
packaging it.  3. Return the
information to the Line as Lessons Learned.
6
Security Awareness

• A Two-Pronged Approach -
• Re-enforcing security basics
• Alerting the workforce about undesired
  performance (events or trends)
• Security incident data
• Feedback from SS programs/operations
• Feedback from Line
• Audit/Inspection results
• DOE/HQ, NNSA alerts

7
LL Sources

• Security incident management database
• Standard monthly reports
• Quarterly reports - analysis, trending,
  highlights, and recommendations
• Real-time identification of hot topics
• Feedback from SS programs/operations
• Feedback from Line (LIWG, individuals)
• Audit/Inspection results
• Corporate Security Stand Downs
• DOE/HQ, NNSA alerts/notices

8
Communicating LL

• Lessons Learned Website (subscription based)
• Porcelain Press
• Sandia Daily News (email distribution)
• Lab News Articles (biweekly publication)
• Posters signs
• Awareness Videos, Corp. Homepage hot button
• Targeted communications (email, Secretarial
  Newsletter, etc.)
• Security Education Briefings
• Line Organization Briefings

9
Where Do We Go From Here?

• Its all about achieving the desired Security
  Performance, so well
• Work to better tap LL sources
• Continue to work at INTEGRATION (SEALL team,
  Security Ed. Awareness Training,
  communications)
• Work to identify useful metrics
• Keep the customer in mind (info. overload)
• Learn from YOU!