1. Enhanced Security Through Human Error Awareness PNNL-SA-42136

2. Tracking a Security Event Event A Security Event Occurs

3. Tracking a Security Event Identify & Categorize Event It Is Identified and Categorized

4. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Event A Preliminary Report to DOE Is Made

5. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Event A Full Inquiry Is Begun

6. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Take Mitigative Action Event Impact Is Assessed, Mitigation Begun

7. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Take Mitigative Action Event Direct Cause and Contributing Factors Are Identified

8. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Take Mitigative Action Event Internal, and… External (ITAC) Documentation

9. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Take Mitigative Action Event Resulting in Corrective Actions and… …Assessment of Patterns and Trends

10. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Take Mitigative Action Event Corrective Actions to Prevent Recurrence

11. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Take Mitigative Action Event Distribute Lessons Learned Lessons Learned Are Distributed in DOE

12. Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Distribute Lessons Learned Prevent Similar Occurrences Elsewhere Take Mitigative Action Event …to Prevent the Likelihood of Similar Occurrences Elsewhere

13. Distribute Lessons Learned You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Your role in the incident inquiry process is a critical link in the chain of incident reporting, inquiry, documentation and analysis that supports the goal of reducing the number of security incidents across the DOE complex.

14. You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reporting Distribute Lessons Learned

15. You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reporting Inquiry Distribute Lessons Learned

16. You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reporting Documentation Inquiry Distribute Lessons Learned

17. You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reporting Analysis Documentation Inquiry Distribute Lessons Learned

18. You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reporting Analysis Documentation Inquiry Lessons Learned

19. Distribute Lessons Learned You Are Here Tracking a Security Event Identify & Categorize Preliminary Report to DOE Full Inquiry Assess Impact Assess Direct Cause & Contributions Document IMI 1, 2, 3 via ITAC Document Non Incidents & IMI 4’s Internally Assess Patterns & Trends Develop Corrective Actions Prevent Recurrence Prevent Similar Occurrences Elsewhere Take Mitigative Action Event Reduced Likelihood of Security Incidents ESTHER: Enhanced Security Through Human Error Reduction