EVALUATION REPORT 

REDACTED VERSION 

Information System Security 

Evaluation of the Technical Training 

Center – Chattanooga, TN 

OIG-09-A-11 July 22, 2009 

All publicly available OIG reports are accessible through 

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/ 
 

The views, opinions, and findings contained in this report are those of the authors and should not be construed as an official Nuclear Regulatory 

Commission position, policy, or decision, unless so designated by other official documentation. 

Office of the Inspector General 

Information System Security Evaluation of the 

Technical Training Center – Chattanooga, TN 

Contract Number: GS-00F-0001N 

Delivery Order Number: 20291 

July 21, 2009 
 Information System Security Evaluation of 

the Technical Training Center – Chattanooga, TN 

 

EXECUTIVE SUMMARY 

BACKGROUND

The Nuclear Regulatory Commission’s (NRC) Technical Training Center (TTC) was 

established in Chattanooga in 1980 as part of an expanded program of training based 

primarily on lessons learned from the Three Mile Island incident. Chattanooga was 

originally selected as the site for enhanced inspector training because of the need to make 

greater use in the agency’s technical training programs of reactor simulators owned by 

the Tennessee Valley Authority. Since 1980, the NRC has purchased its own simulators 

and currently has four operating at the Chattanooga site. 

On December 17, 2002, the President signed the E-Government Act of 2002, which 

included the Federal Information Security Management Act (FISMA) of 2002. FISMA 

outlines the information security management requirements for agencies, which include 

an annual independent evaluation of an agency’s information security program1

 and 

practices to determine their effectiveness. This evaluation must include testing the 

effectiveness of information security policies, procedures, and practices for a 

representative subset of the agency’s information systems. FISMA also requires 

assessment of compliance with FISMA requirements and related information security 

policies, procedures, standards, and guidelines. FISMA requires the annual evaluation to 

be performed by the agency’s Inspector General or by an independent external auditor. 

The NRC Office of the Inspector General (OIG) requested that the four NRC regional 

offices and the TTC be included in the independent evaluation of the agency’s 

implementation of FISMA for fiscal year 2009. Information security policies, 

procedures, and practices at the regional offices and the TTC were last assessed in 2003 

and 2006. This report describes evaluation findings for the TTC. 

PURPOSE

The objectives of the information system security evaluation of the TTC were to: 

 Evaluate the adequacy of NRC’s information security program and practices for 

NRC automated information systems as implemented at the TTC. 

 Evaluate the effectiveness of agency information security control techniques as 

implemented at the TTC. 

 Evaluate corrective actions planned and taken as a result of previous OIG 

evaluations. 

 

1

 For the purposes of FISMA, the agency uses the term “information system security program.” 
 Information System Security Evaluation of 

the Technical Training Center – Chattanooga, TN 

 

RESULTS IN BRIEF

The TTC has made improvements in its implementation of NRC’s information system 

security program and practices for NRC automated information systems since the 

previous evaluations in 2003 and 2006. All corrective actions from the previous 

evaluations have been implemented. However, the information system security practices 

are not always consistent with the NRC’s automated information systems security 

program as defined in Management Directive (MD) and Handbook 12.5, NRC Automated 

Information Systems Security Program, other NRC policies, FISMA, and National 

Institute of Standards and Technology (NIST) guidance. While many of the TTC’s 

automated and manual security controls are generally effective, some security controls 

need improvement. Areas needing improvement included: physical and environmental 

security controls, continuity of operations and emergency planning, and configuration 

management. Specifies cannot be presented in this publically released version of the 

report. 

RECOMMENDATIONS

This report makes recommendations to the Executive Director for Operations to improve 

NRC’s information system security program and implementation of FISMA at the TTC. 

THE FULL REPORT CONTAINS SECURITY RELATED INFORMATION THAT IS 

NOT RELEASED TO THE PUBLIC. FOR ADDITIONAL INFORMATION, PLEASE 

CONTACT THE OFFICE OF THE INSPECTOR GENERAL AT 301-415-5915.