(a) Persons subject to penalty
Any person who has entered into a contract or agreement with the Department of Energy, or a subcontract or subagreement thereto, and who violates (or whose employee violates) any applicable rule, regulation, or order prescribed or otherwise issued by the Secretary pursuant to this chapter relating to the safeguarding or security of Restricted Data or other classified or sensitive information shall be subject to a civil penalty of not to exceed $100,000 for each such violation.

(b) Fee or payment reductions for violations
The Secretary shall include in each contract with a contractor of the Department provisions which provide an appropriate reduction in the fees or amounts paid to the contractor under the contract in the event of a violation by the contractor or contractor employee of any rule, regulation, or order relating to the safeguarding or security of Restricted Data or other classified or sensitive information. The provisions shall specify various degrees of violations and the amount of the reduction attributable to each degree of violation.

(c) Powers and limitations
The powers and limitations applicable to the assessment of civil penalties under section 2282a of this title, except for subsection (d) of that section, shall apply to the assessment of civil penalties under this section.

(d) Application to certain entities
In the case of an entity specified in subsection (d) of section 2282a of this title—

(1) the assessment of any civil penalty under subsection (a) against that entity may not be made until the entity enters into a new contract with the Department of Energy or an extension of a current contract with the Department; and

(2) the total amount of civil penalties under subsection (a) in a fiscal year may not exceed the total amount of fees paid by the Department of Energy to that entity in that fiscal year.